diff --git a/.acrolinx-config.edn b/.acrolinx-config.edn index c7880180f3..2794193b88 100644 --- a/.acrolinx-config.edn +++ b/.acrolinx-config.edn @@ -2,40 +2,32 @@ :allowed-branchname-matches ["main" "release-.*"] :allowed-filename-matches ["windows/"] - :targets + :use-gh-statuses true + + :targets { :counts { - ;;:correctness 13 - ;;:total 15 ;; absolute flag count but i don't know the difference between this and issues - ;;:issues 15 ;; coming from the platform, will need to be tested. + ;;:correctness 13 + ;;:total 15 ;; + ;;:issues 15 ;; + ;;:correctness 13 ;; } :scores { ;;:terminology 100 - :qualityscore 80 ;; Confirmed with Hugo that you just comment out the single score and leave the structure in place + :qualityscore 80 ;; ;;:correctness 40 } } :guidance-profile "d2b6c2c8-00ee-47f1-8d10-b280cc3434c1" ;; Profile ID for "M365-specific" - :acrolinx-check-settings - { - "languageId" "en" - "ruleSetName" "Standard" - "requestedFlagTypes" ["CORRECTNESS" "SPELLING" "GRAMMAR" "STYLE" - "TERMINOLOGY_DEPRECATED" - "TERMINOLOGY_VALID" - "VOICE_GUIDANCE" - ] - "termSetNames" ["M365" "Products" "Microsoft"] - } - :template-header " -## Acrolinx Scorecards + +## Acrolinx Scorecards -**The minimum Acrolinx topic score of 80 is required for all MAGIC content merged to the default branch.** +**The minimum Acrolinx topic score of 80 is required for all Magic content merged to the default branch.** If you need a scoring exception for content in this PR, add the *Sign off* and the *Acrolinx exception* labels to the PR. The PubOps Team will review the exception request and may take one or more of the following actions: @@ -43,22 +35,26 @@ If you need a scoring exception for content in this PR, add the *Sign off* and t - Escalate the exception request to the Acrolinx Review Team for review. - Approve the exception and work with the GitHub Admin Team to merge the PR to the default branch. -For more information about the exception criteria and exception process, see [Minimum Acrolinx topic scores for publishing](https://review.docs.microsoft.com/en-us/office-authoring-guide/acrolinx-min-score?branch=master). +For more information about the exception criteria and exception process, see [Minimum Acrolinx topic scores for publishing](https://review.docs.microsoft.com/en-us/office-authoring-guide/acrolinx-min-score?branch=main). -Click the scorecard links for each article to review the Acrolinx feedback on grammar, spelling, punctuation, writing style, and terminology: +Select the total score link to review all feedback on clarity, consistency, tone, brand, terms, spelling, grammar, readability, and inclusive language. _You should fix all spelling errors regardless of your total score_. Fixing spelling errors helps maintain customer trust in overall content quality. -| Article | Score | Issues | Correctness
score | Scorecard | Processed | -| ------- | ----- | ------ | ------ | --------- | --------- | +| Article | Total score
(Required: 80) | Words + phrases
(Brand, terms) | Correctness
(Spelling, grammar) | Clarity
(Readability) | +|---------|:--------------:|:--------------------:|:------:|:---------:| " :template-change - "| ${s/file} | ${acrolinx/qualityscore} | ${acrolinx/flags/issues} | ${acrolinx/scores/correctness} | [link](${acrolinx/scorecard}) | ${s/status} | + "| ${s/status} ${s/file} | [${acrolinx/qualityscore}](${acrolinx/scorecard}) | ${acrolinx/scores/words_and_phrases} | ${acrolinx/scores/correctness} | ${acrolinx/scores/clarity} | " :template-footer " -**More info about Acrolinx** +**More information about Acrolinx** -Use the Acrolinx extension, or sidebar, in Visual Studio Code to check spelling, grammar, style, tone, clarity, and key terminology when you're creating or updating content. For more information, see [Use the Visual Studio Code extension to run Acrolinx locally](https://review.docs.microsoft.com/en-us/office-authoring-guide/acrolinx-vscode?branch=master). +- [Install Acrolinx locally for VSCode for Magic](https://review.docs.microsoft.com/office-authoring-guide/acrolinx-vscode?branch=main) +- [False positives or issues](https://aka.ms/acrolinxbug) +- [Request a new Acrolinx term](https://microsoft.sharepoint.com/teams/M365Dev2/SitePages/M365-terminology.aspx) +- [Troubleshooting issues with Acrolinx](https://review.docs.microsoft.com/help/contribute/acrolinx-error-messages) + " } diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml new file mode 100644 index 0000000000..4f8075ffce --- /dev/null +++ b/.github/ISSUE_TEMPLATE/config.yml @@ -0,0 +1,5 @@ +blank_issues_enabled: false +contact_links: + - name: New feedback experience + url: https://learn.microsoft.com/office/new-feedback + about: We’re transitioning our feedback experience away from GitHub Issues. For more information, select Open. \ No newline at end of file diff --git a/.openpublishing.redirection.browsers.json b/.openpublishing.redirection.browsers.json index 0a24f19eed..f0bf2c40cc 100644 --- a/.openpublishing.redirection.browsers.json +++ b/.openpublishing.redirection.browsers.json @@ -70,6 +70,16 @@ "redirect_url": "/previous-versions/windows/edge-legacy/group-policies/home-button-gp", "redirect_document_id": false }, + { + "source_path": "browsers/edge/index.yml", + "redirect_url": "/previous-versions/windows/edge-legacy/index", + "redirect_document_id": false + }, + { + "source_path": "browsers/edge/group-policies/index.yml", + "redirect_url": "/previous-versions/windows/edge-legacy/group-policies/index", + "redirect_document_id": false + }, { "source_path": "browsers/edge/group-policies/interoperability-enterprise-guidance-gp.md", "redirect_url": "/previous-versions/windows/edge-legacy/group-policies/interoperability-enterprise-guidance-gp", @@ -125,6 +135,16 @@ "redirect_url": "/previous-versions/windows/edge-legacy/managing-group-policy-admx-files", "redirect_document_id": false }, + { + "source_path": "browsers/edge/microsoft-edge-faq.yml", + "redirect_url": "/previous-versions/windows/edge-legacy/microsoft-edge-faq", + "redirect_document_id": false + }, + { + "source_path": "browsers/edge/microsoft-edge.yml", + "redirect_url": "/previous-versions/windows/edge-legacy/microsoft-edge", + "redirect_document_id": false + }, { "source_path": "browsers/edge/microsoft-edge-forrester.md", "redirect_url": "/previous-versions/windows/edge-legacy/microsoft-edge-forrester", @@ -169,6 +189,1101 @@ "source_path": "browsers/internet-explorer/kb-support/clear-ie-cache-from-command-line.md", "redirect_url": "/internet-explorer/kb-support/ie-edge-faqs", "redirect_document_id": false + }, + { + "source_path": "browsers/enterprise-mode/add-employees-enterprise-mode-portal.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/enterprise-mode/add-employees-enterprise-mode-portal", + "redirect_document_id": false + }, + { + "source_path": "browsers/enterprise-mode/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/enterprise-mode/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool", + "redirect_document_id": false + }, + { + "source_path": "browsers/enterprise-mode/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/enterprise-mode/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool", + "redirect_document_id": false + }, + { + "source_path": "browsers/enterprise-mode/add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/enterprise-mode/add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool", + "redirect_document_id": false + }, + { + "source_path": "browsers/enterprise-mode/add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/enterprise-mode/add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool", + "redirect_document_id": false + }, + { + "source_path": "browsers/enterprise-mode/administrative-templates-and-ie11.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/enterprise-mode/administrative-templates-and-ie11", + "redirect_document_id": false + }, + { + "source_path": "browsers/enterprise-mode/approve-change-request-enterprise-mode-portal.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/enterprise-mode/approve-change-request-enterprise-mode-portal", + "redirect_document_id": false + }, + { + "source_path": "browsers/enterprise-mode/check-for-new-enterprise-mode-site-list-xml-file.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/enterprise-mode/check-for-new-enterprise-mode-site-list-xml-file", + "redirect_document_id": false + }, + { + "source_path": "browsers/enterprise-mode/collect-data-using-enterprise-site-discovery.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/enterprise-mode/collect-data-using-enterprise-site-discovery", + "redirect_document_id": false + }, + { + "source_path": "browsers/enterprise-mode/configure-settings-enterprise-mode-portal.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/enterprise-mode/configure-settings-enterprise-mode-portal", + "redirect_document_id": false + }, + { + "source_path": "browsers/enterprise-mode/create-change-request-enterprise-mode-portal.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/enterprise-mode/create-change-request-enterprise-mode-portal", + "redirect_document_id": false + }, + { + "source_path": "browsers/enterprise-mode/delete-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/enterprise-mode/delete-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager", + "redirect_document_id": false + }, + { + "source_path": "browsers/enterprise-mode/edit-the-enterprise-mode-site-list-using-the-enterprise-mode-site-list-manager.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/enterprise-mode/edit-the-enterprise-mode-site-list-using-the-enterprise-mode-site-list-manager", + "redirect_document_id": false + }, + { + "source_path": "browsers/enterprise-mode/enterprise-mode-and-enterprise-site-list-include.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/enterprise-mode/enterprise-mode-and-enterprise-site-list-include", + "redirect_document_id": false + }, + { + "source_path": "browsers/enterprise-mode/enterprise-mode-features-include.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/enterprise-mode/enterprise-mode-features-include", + "redirect_document_id": false + }, + { + "source_path": "browsers/enterprise-mode/enterprise-mode-overview-for-ie11.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/enterprise-mode/enterprise-mode-overview-for-ie11", + "redirect_document_id": false + }, + { + "source_path": "browsers/enterprise-mode/enterprise-mode-schema-version-1-guidance.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/enterprise-mode/enterprise-mode-schema-version-1-guidance", + "redirect_document_id": false + }, + { + "source_path": "browsers/enterprise-mode/enterprise-mode-schema-version-2-guidance.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/enterprise-mode/enterprise-mode-schema-version-2-guidance", + "redirect_document_id": false + }, + { + "source_path": "browsers/enterprise-mode/enterprise-mode-site-list-mgr-portal-tools-include.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/enterprise-mode/enterprise-mode-site-list-mgr-portal-tools-include", + "redirect_document_id": false + }, + { + "source_path": "browsers/enterprise-mode/enterprise-mode-site-list-mgr-versions-include.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/enterprise-mode/enterprise-mode-site-list-mgr-versions-include", + "redirect_document_id": false + }, + { + "source_path": "browsers/enterprise-mode/enterprise-mode.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/enterprise-mode/enterprise-mode", + "redirect_document_id": false + }, + { + "source_path": "browsers/enterprise-mode/export-your-enterprise-mode-site-list-from-the-enterprise-mode-site-list-manager.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/enterprise-mode/export-your-enterprise-mode-site-list-from-the-enterprise-mode-site-list-manager", + "redirect_document_id": false + }, + { + "source_path": "browsers/enterprise-mode/remove-all-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/enterprise-mode/remove-all-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager", + "redirect_document_id": false + }, + { + "source_path": "browsers/enterprise-mode/remove-sites-from-a-local-compatibililty-view-list.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/enterprise-mode/remove-sites-from-a-local-compatibililty-view-list", + "redirect_document_id": false + }, + { + "source_path": "browsers/enterprise-mode/remove-sites-from-a-local-enterprise-mode-site-list.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/enterprise-mode/remove-sites-from-a-local-enterprise-mode-site-list", + "redirect_document_id": false + }, + { + "source_path": "browsers/enterprise-mode/save-your-site-list-to-xml-in-the-enterprise-mode-site-list-manager.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/enterprise-mode/save-your-site-list-to-xml-in-the-enterprise-mode-site-list-manager", + "redirect_document_id": false + }, + { + "source_path": "browsers/enterprise-mode/schedule-production-change-enterprise-mode-portal.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/enterprise-mode/schedule-production-change-enterprise-mode-portal", + "redirect_document_id": false + }, + { + "source_path": "browsers/enterprise-mode/search-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/enterprise-mode/search-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager", + "redirect_document_id": false + }, + { + "source_path": "browsers/enterprise-mode/set-up-enterprise-mode-logging-and-data-collection.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/enterprise-mode/set-up-enterprise-mode-logging-and-data-collection", + "redirect_document_id": false + }, + { + "source_path": "browsers/enterprise-mode/set-up-enterprise-mode-portal.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/enterprise-mode/set-up-enterprise-mode-portal", + "redirect_document_id": false + }, + { + "source_path": "browsers/enterprise-mode/turn-off-enterprise-mode.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/enterprise-mode/turn-off-enterprise-mode", + "redirect_document_id": false + }, + { + "source_path": "browsers/enterprise-mode/turn-on-enterprise-mode-and-use-a-site-list.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/enterprise-mode/turn-on-enterprise-mode-and-use-a-site-list", + "redirect_document_id": false + }, + { + "source_path": "browsers/enterprise-mode/turn-on-local-control-and-logging-for-enterprise-mode.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/enterprise-mode/turn-on-local-control-and-logging-for-enterprise-mode", + "redirect_document_id": false + }, + { + "source_path": "browsers/enterprise-mode/use-the-enterprise-mode-portal.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/enterprise-mode/use-the-enterprise-mode-portal", + "redirect_document_id": false + }, + { + "source_path": "browsers/enterprise-mode/use-the-enterprise-mode-site-list-manager.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/enterprise-mode/use-the-enterprise-mode-site-list-manager", + "redirect_document_id": false + }, + { + "source_path": "browsers/enterprise-mode/using-enterprise-mode.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/enterprise-mode/using-enterprise-mode", + "redirect_document_id": false + }, + { + "source_path": "browsers/enterprise-mode/verify-changes-preprod-enterprise-mode-portal.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/enterprise-mode/verify-changes-preprod-enterprise-mode-portal", + "redirect_document_id": false + }, + { + "source_path": "browsers/enterprise-mode/verify-changes-production-enterprise-mode-portal.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/enterprise-mode/verify-changes-production-enterprise-mode-portal", + "redirect_document_id": false + }, + { + "source_path": "browsers/enterprise-mode/view-apps-enterprise-mode-site-list.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/enterprise-mode/view-apps-enterprise-mode-site-list", + "redirect_document_id": false + }, + { + "source_path": "browsers/enterprise-mode/what-is-enterprise-mode-include.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/enterprise-mode/what-is-enterprise-mode-include", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/TOC.yml", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/TOC", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/breadcrumb/toc.yml", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/breadcrumb/toc", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/docfx.json", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/docfx.json", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/.vscode/settings.json", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/.vscode/settings.json", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/activex-installation-using-group-policy.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/activex-installation-using-group-policy", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/add-employees-enterprise-mode-portal.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/add-employees-enterprise-mode-portal", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/administrative-templates-and-ie11.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/administrative-templates-and-ie11", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/approve-change-request-enterprise-mode-portal.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/approve-change-request-enterprise-mode-portal", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/auto-configuration-and-auto-proxy-problems-with-ie11.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/auto-configuration-and-auto-proxy-problems-with-ie11", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/auto-configuration-settings-for-ie11.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/auto-configuration-settings-for-ie11", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/auto-detect-settings-for-ie11.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/auto-detect-settings-for-ie11", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/auto-proxy-configuration-settings-for-ie11.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/auto-proxy-configuration-settings-for-ie11", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/blocked-out-of-date-activex-controls.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/blocked-out-of-date-activex-controls", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/browser-cache-changes-and-roaming-profiles.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/browser-cache-changes-and-roaming-profiles", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/change-history-for-internet-explorer-11.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/change-history-for-internet-explorer-11", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/check-for-new-enterprise-mode-site-list-xml-file.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/check-for-new-enterprise-mode-site-list-xml-file", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/choose-how-to-deploy-ie11.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/choose-how-to-deploy-ie11", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/choose-how-to-install-ie11.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/choose-how-to-install-ie11", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/collect-data-using-enterprise-site-discovery.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/collect-data-using-enterprise-site-discovery", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/configure-settings-enterprise-mode-portal.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/configure-settings-enterprise-mode-portal", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/create-change-request-enterprise-mode-portal.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/create-change-request-enterprise-mode-portal", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/create-install-packages-for-multiple-operating-systems-or-languages.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/create-install-packages-for-multiple-operating-systems-or-languages", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/customize-ie11-install-packages.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/customize-ie11-install-packages", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/delete-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/delete-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/deploy-ie11-using-automatic-version-synchronization-avs.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/deploy-ie11-using-automatic-version-synchronization-avs", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/deploy-ie11-using-software-distribution-tools.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/deploy-ie11-using-software-distribution-tools", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/deploy-pinned-sites-using-mdt-2013.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/deploy-pinned-sites-using-mdt-2013", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/deprecated-document-modes.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/deprecated-document-modes", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/edit-the-enterprise-mode-site-list-using-the-enterprise-mode-site-list-manager.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/edit-the-enterprise-mode-site-list-using-the-enterprise-mode-site-list-manager", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/enable-and-disable-add-ons-using-administrative-templates-and-group-policy.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/enable-and-disable-add-ons-using-administrative-templates-and-group-policy", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/enhanced-protected-mode-problems-with-ie11.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/enhanced-protected-mode-problems-with-ie11", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-overview-for-ie11.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/enterprise-mode-overview-for-ie11", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-1-guidance.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/enterprise-mode-schema-version-1-guidance", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-2-guidance.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/enterprise-mode-schema-version-2-guidance", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/export-your-enterprise-mode-site-list-from-the-enterprise-mode-site-list-manager.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/export-your-enterprise-mode-site-list-from-the-enterprise-mode-site-list-manager", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/fix-validation-problems-using-the-enterprise-mode-site-list-manager.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/fix-validation-problems-using-the-enterprise-mode-site-list-manager", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/group-policy-and-advanced-group-policy-mgmt-ie11.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/group-policy-and-advanced-group-policy-mgmt-ie11", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/group-policy-and-group-policy-mgmt-console-ie11.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/group-policy-and-group-policy-mgmt-console-ie11", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/group-policy-and-ie11.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/group-policy-and-ie11", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/group-policy-and-local-group-policy-editor-ie11.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/group-policy-and-local-group-policy-editor-ie11", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/group-policy-compatibility-with-ie11.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/group-policy-compatibility-with-ie11", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/group-policy-objects-and-ie11.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/group-policy-objects-and-ie11", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/group-policy-preferences-and-ie11.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/group-policy-preferences-and-ie11", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/group-policy-problems-ie11.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/group-policy-problems-ie11", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/group-policy-shortcut-extensions-ie11.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/group-policy-shortcut-extensions-ie11", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/group-policy-windows-powershell-ie11.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/group-policy-windows-powershell-ie11", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/ie11-delivery-through-automatic-updates.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/ie11-delivery-through-automatic-updates", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/images/img-enterprise-mode-site-list-xml.jpg", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/images/img-enterprise-mode-site-list-xml.jpg", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/images/img-f12-developer-tools-emulation.jpg", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/images/img-f12-developer-tools-emulation.jpg", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/images/wedge.gif", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/images/wedge.gif", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/img-ie11-docmode-lg.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/img-ie11-docmode-lg", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/import-into-the-enterprise-mode-site-list-manager.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/import-into-the-enterprise-mode-site-list-manager", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/index.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/index", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/install-and-deploy-ie11.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/install-and-deploy-ie11", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-microsoft-intune.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/install-ie11-using-microsoft-intune", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-operating-system-deployment-systems.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/install-ie11-using-operating-system-deployment-systems", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-system-center-configuration-manager.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/install-ie11-using-system-center-configuration-manager", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-the-network.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/install-ie11-using-the-network", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-third-party-tools.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/install-ie11-using-third-party-tools", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-windows-server-update-services-wsus.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/install-ie11-using-windows-server-update-services-wsus", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/install-problems-with-ie11.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/install-problems-with-ie11", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/intranet-problems-and-ie11.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/intranet-problems-and-ie11", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/manage-ie11-overview.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/manage-ie11-overview", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/missing-internet-explorer-maintenance-settings-for-ie11.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/missing-internet-explorer-maintenance-settings-for-ie11", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/missing-the-compatibility-view-button.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/missing-the-compatibility-view-button", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/net-framework-problems-with-ie11.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/net-framework-problems-with-ie11", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/new-group-policy-settings-for-ie11.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/new-group-policy-settings-for-ie11", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/out-of-date-activex-control-blocking.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/out-of-date-activex-control-blocking", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/problems-after-installing-ie11.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/problems-after-installing-ie11", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/remove-all-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/remove-all-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/remove-sites-from-a-local-compatibililty-view-list.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/remove-sites-from-a-local-compatibililty-view-list", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/remove-sites-from-a-local-enterprise-mode-site-list.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/remove-sites-from-a-local-enterprise-mode-site-list", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/review-neutral-sites-with-site-list-manager.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/review-neutral-sites-with-site-list-manager", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/save-your-site-list-to-xml-in-the-enterprise-mode-site-list-manager.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/save-your-site-list-to-xml-in-the-enterprise-mode-site-list-manager", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/schedule-production-change-enterprise-mode-portal.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/schedule-production-change-enterprise-mode-portal", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/search-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/search-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/set-the-default-browser-using-group-policy.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/set-the-default-browser-using-group-policy", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/set-up-enterprise-mode-logging-and-data-collection.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/set-up-enterprise-mode-logging-and-data-collection", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/set-up-enterprise-mode-portal.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/set-up-enterprise-mode-portal", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/setup-problems-with-ie11.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/setup-problems-with-ie11", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/system-requirements-and-language-support-for-ie11.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/system-requirements-and-language-support-for-ie11", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/tips-and-tricks-to-manage-ie-compatibility.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/tips-and-tricks-to-manage-ie-compatibility", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/troubleshoot-ie11.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/troubleshoot-ie11", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/turn-off-enterprise-mode.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/turn-off-enterprise-mode", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/turn-off-natural-metrics.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/turn-off-natural-metrics", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/turn-on-enterprise-mode-and-use-a-site-list.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/turn-on-enterprise-mode-and-use-a-site-list", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/turn-on-local-control-and-logging-for-enterprise-mode.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/turn-on-local-control-and-logging-for-enterprise-mode", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/updated-features-and-tools-with-ie11.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/updated-features-and-tools-with-ie11", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/use-the-enterprise-mode-portal.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/use-the-enterprise-mode-portal", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/use-the-enterprise-mode-site-list-manager.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/use-the-enterprise-mode-site-list-manager", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/user-interface-problems-with-ie11.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/user-interface-problems-with-ie11", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/using-enterprise-mode.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/using-enterprise-mode", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/using-ieak11-to-create-install-packages.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/using-ieak11-to-create-install-packages", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/using-inf-files-to-create-install-packages.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/using-inf-files-to-create-install-packages", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/verify-changes-preprod-enterprise-mode-portal.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/verify-changes-preprod-enterprise-mode-portal", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/verify-changes-production-enterprise-mode-portal.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/verify-changes-production-enterprise-mode-portal", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/view-apps-enterprise-mode-site-list.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/view-apps-enterprise-mode-site-list", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/view-enterprise-mode-reports-for-portal.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/view-enterprise-mode-reports-for-portal", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/virtualization-and-compatibility-with-ie11.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/virtualization-and-compatibility-with-ie11", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/what-is-enterprise-mode.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/what-is-enterprise-mode", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/what-is-the-internet-explorer-11-blocker-toolkit.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/what-is-the-internet-explorer-11-blocker-toolkit", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/workflow-processes-enterprise-mode-portal.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-deploy-guide/workflow-processes-enterprise-mode-portal", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-faq/faq-for-it-pros-ie11.yml", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-faq/faq-for-it-pros-ie11", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-faq/faq-ie11-blocker-toolkit.yml", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-faq/faq-ie11-blocker-toolkit", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-faq/faq-ieak11.yml", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-faq/faq-ieak11", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-ieak/accelerators-ieak11-wizard.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-ieak/accelerators-ieak11-wizard", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-ieak/add-and-approve-activex-controls-ieak11.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-ieak/add-and-approve-activex-controls-ieak11", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-ieak/add-root-certificate-ieak11-wizard.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-ieak/add-root-certificate-ieak11-wizard", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-ieak/additional-settings-ieak11-wizard.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-ieak/additional-settings-ieak11-wizard", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-ieak/auto-config-ieak11-wizard.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-ieak/auto-config-ieak11-wizard", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-ieak/auto-detection-dhcp-or-dns-servers-ieak11.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-ieak/auto-detection-dhcp-or-dns-servers-ieak11", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-ieak/auto-version-sync-ieak11-wizard.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-ieak/auto-version-sync-ieak11-wizard", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-ieak/before-you-create-custom-pkgs-ieak11.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-ieak/before-you-create-custom-pkgs-ieak11", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-ieak/branding-ins-file-setting.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-ieak/branding-ins-file-setting", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-ieak/browser-ui-ieak11-wizard.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-ieak/browser-ui-ieak11-wizard", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-ieak/browsertoolbars-ins-file-setting.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-ieak/browsertoolbars-ins-file-setting", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-ieak/browsing-options-ieak11-wizard.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-ieak/browsing-options-ieak11-wizard", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-ieak/cabsigning-ins-file-setting.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-ieak/cabsigning-ins-file-setting", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-ieak/compat-view-ieak11-wizard.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-ieak/compat-view-ieak11-wizard", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-ieak/connection-mgr-ieak11-wizard.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-ieak/connection-mgr-ieak11-wizard", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-ieak/connection-settings-ieak11-wizard.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-ieak/connection-settings-ieak11-wizard", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-ieak/connectionsettings-ins-file-setting.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-ieak/connectionsettings-ins-file-setting", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-ieak/create-build-folder-structure-ieak11.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-ieak/create-build-folder-structure-ieak11", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-ieak/create-manage-deploy-custom-pkgs-ieak11.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-ieak/create-manage-deploy-custom-pkgs-ieak11", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-ieak/create-multiple-browser-packages-ieak11.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-ieak/create-multiple-browser-packages-ieak11", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-ieak/create-uninstall-inf-files-for-custom-components.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-ieak/create-uninstall-inf-files-for-custom-components", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-ieak/custom-components-ieak11-wizard.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-ieak/custom-components-ieak11-wizard", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-ieak/custombranding-ins-file-setting.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-ieak/custombranding-ins-file-setting", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-ieak/customize-automatic-search-for-ie.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-ieak/customize-automatic-search-for-ie", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-ieak/extreginf-ins-file-setting.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-ieak/extreginf-ins-file-setting", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-ieak/favorites-favoritesbar-and-feeds-ieak11-wizard.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-ieak/favorites-favoritesbar-and-feeds-ieak11-wizard", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-ieak/favoritesex-ins-file-setting.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-ieak/favoritesex-ins-file-setting", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-ieak/feature-selection-ieak11-wizard.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-ieak/feature-selection-ieak11-wizard", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-ieak/file-locations-ieak11-wizard.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-ieak/file-locations-ieak11-wizard", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-ieak/file-types-ieak11.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-ieak/file-types-ieak11", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-ieak/first-run-and-welcome-page-ieak11-wizard.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-ieak/first-run-and-welcome-page-ieak11-wizard", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-ieak/guidelines-toolbar-and-favorites-list-ieak11.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-ieak/guidelines-toolbar-and-favorites-list-ieak11", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-ieak/hardware-and-software-reqs-ieak11.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-ieak/hardware-and-software-reqs-ieak11", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-ieak/hidecustom-ins-file-setting.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-ieak/hidecustom-ins-file-setting", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-ieak/ie-setup-command-line-options-and-return-codes.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-ieak/ie-setup-command-line-options-and-return-codes", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-ieak/ieak-information-and-downloads.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-ieak/ieak-information-and-downloads", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-ieak/ieak11-wizard-custom-options.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-ieak/ieak11-wizard-custom-options", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-ieak/iexpress-command-line-options.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-ieak/iexpress-command-line-options", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-ieak/iexpress-wizard-for-win-server.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-ieak/iexpress-wizard-for-win-server", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-ieak/images/wedge.gif", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-ieak/images/wedge.gif", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-ieak/important-urls-home-page-and-support-ieak11-wizard.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-ieak/important-urls-home-page-and-support-ieak11-wizard", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-ieak/index.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-ieak/index", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-ieak/internal-install-ieak11-wizard.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-ieak/internal-install-ieak11-wizard", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-ieak/isp-security-ins-file-setting.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-ieak/isp-security-ins-file-setting", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-ieak/language-selection-ieak11-wizard.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-ieak/language-selection-ieak11-wizard", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-ieak/licensing-version-and-features-ieak11.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-ieak/licensing-version-and-features-ieak11", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-ieak/media-ins-file-setting.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-ieak/media-ins-file-setting", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-ieak/pkg-type-selection-ieak11-wizard.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-ieak/pkg-type-selection-ieak11-wizard", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-ieak/platform-selection-ieak11-wizard.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-ieak/platform-selection-ieak11-wizard", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-ieak/prep-network-install-with-ieak11.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-ieak/prep-network-install-with-ieak11", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-ieak/programs-ieak11-wizard.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-ieak/programs-ieak11-wizard", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-ieak/proxy-auto-config-examples.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-ieak/proxy-auto-config-examples", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-ieak/proxy-ins-file-setting.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-ieak/proxy-ins-file-setting", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-ieak/proxy-settings-ieak11-wizard.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-ieak/proxy-settings-ieak11-wizard", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-ieak/register-uninstall-app-ieak11.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-ieak/register-uninstall-app-ieak11", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-ieak/rsop-snapin-for-policy-settings-ieak11.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-ieak/rsop-snapin-for-policy-settings-ieak11", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-ieak/search-providers-ieak11-wizard.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-ieak/search-providers-ieak11-wizard", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-ieak/security-and-ieak11.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-ieak/security-and-ieak11", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-ieak/security-and-privacy-settings-ieak11-wizard.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-ieak/security-and-privacy-settings-ieak11-wizard", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-ieak/security-imports-ins-file-setting.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-ieak/security-imports-ins-file-setting", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-ieak/troubleshooting-custom-browser-pkg-ieak11.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-ieak/troubleshooting-custom-browser-pkg-ieak11", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-ieak/url-ins-file-setting.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-ieak/url-ins-file-setting", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-ieak/user-experience-ieak11-wizard.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-ieak/user-experience-ieak11-wizard", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-ieak/using-internet-settings-ins-files.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-ieak/using-internet-settings-ins-files", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-ieak/what-ieak-can-do-for-you.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-ieak/what-ieak-can-do-for-you", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/ie11-ieak/wizard-complete-ieak11-wizard.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/ie11-ieak/wizard-complete-ieak11-wizard", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/index.md", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/index", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/internet-explorer.yml", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/internet-explorer", + "redirect_document_id": false + }, + { + "source_path": "browsers/internet-explorer/kb-support/ie-edge-faqs.yml", + "redirect_url": "/previous-versions/windows/internet-explorer/ie-it-pro/internet-explorer-11/kb-support/ie-edge-faqs", + "redirect_document_id": false } ] } diff --git a/.openpublishing.redirection.education.json b/.openpublishing.redirection.education.json index 9b57ae9f30..77b49e134c 100644 --- a/.openpublishing.redirection.education.json +++ b/.openpublishing.redirection.education.json @@ -174,6 +174,138 @@ "source_path": "education/windows/set-up-school-pcs-whats-new.md", "redirect_url": "/education/windows", "redirect_document_id": false + }, + { + "source_path": "education/windows/deploy-windows-10-in-a-school-district.md", + "redirect_url": "/education/windows", + "redirect_document_id": false + }, + { + "source_path": "education/windows/deploy-windows-10-in-a-school.md", + "redirect_url": "/education/windows", + "redirect_document_id": false + }, + { + "source_path": "education/windows/deploy-windows-10-overview.md", + "redirect_url": "/education/windows", + "redirect_document_id": false + }, + { + "source_path": "education/windows/chromebook-migration-guide.md", + "redirect_url": "/education/windows", + "redirect_document_id": false + }, + { + "source_path": "education/windows/autopilot-reset.md", + "redirect_url": "/autopilot/windows-autopilot-reset", + "redirect_document_id": false + }, + { + "source_path": "education/windows/set-up-students-pcs-with-apps.md", + "redirect_url": "/education/windows", + "redirect_document_id": false + }, + { + "source_path": "education/windows/set-up-windows-10.md", + "redirect_url": "/education/windows", + "redirect_document_id": false + }, + { + "source_path": "education/windows/edu-deployment-recommendations.md", + "redirect_url": "/education/windows", + "redirect_document_id": false + }, + { + "source_path": "education/windows/set-up-school-pcs-azure-ad-join.md", + "redirect_url": "/education/windows", + "redirect_document_id": false + }, + { + "source_path": "education/windows/set-up-students-pcs-to-join-domain.md", + "redirect_url": "/education/windows", + "redirect_document_id": false + }, + { + "source_path": "education/windows/windows-editions-for-education-customers.md", + "redirect_url": "/education/windows", + "redirect_document_id": false + }, + { + "source_path": "education/windows/configure-windows-for-education.md", + "redirect_url": "/education/windows", + "redirect_document_id": false + }, + + + { + "source_path": "education/windows/tutorial-school-deployment/configure-device-apps.md", + "redirect_url": "/mem/intune/industry/education/tutorial-school-deployment/configure-device-apps", + "redirect_document_id": false + }, + { + "source_path": "education/windows/tutorial-school-deployment/configure-device-settings.md", + "redirect_url": "/mem/intune/industry/education/tutorial-school-deployment/configure-device-settings", + "redirect_document_id": false + }, + { + "source_path": "education/windows/tutorial-school-deployment/configure-devices-overview.md", + "redirect_url": "/mem/intune/industry/education/tutorial-school-deployment/configure-devices-overview", + "redirect_document_id": false + }, + { + "source_path": "education/windows/tutorial-school-deployment/enroll-autopilot.md", + "redirect_url": "/mem/intune/industry/education/tutorial-school-deployment/enroll-autopilot", + "redirect_document_id": false + }, + { + "source_path": "education/windows/tutorial-school-deployment/enroll-entra-join.md", + "redirect_url": "/mem/intune/industry/education/tutorial-school-deployment/enroll-entra-join", + "redirect_document_id": false + }, + { + "source_path": "education/windows/tutorial-school-deployment/enroll-overview.md", + "redirect_url": "/mem/intune/industry/education/tutorial-school-deployment/enroll-overview", + "redirect_document_id": false + }, + { + "source_path": "education/windows/tutorial-school-deployment/enroll-package.md", + "redirect_url": "/mem/intune/industry/education/tutorial-school-deployment/enroll-package", + "redirect_document_id": false + }, + { + "source_path": "education/windows/tutorial-school-deployment/index.md", + "redirect_url": "/mem/intune/industry/education/tutorial-school-deployment/introduction", + "redirect_document_id": false + }, + { + "source_path": "education/windows/tutorial-school-deployment/manage-overview.md", + "redirect_url": "/mem/intune/industry/education/tutorial-school-deployment/manage-overview", + "redirect_document_id": false + }, + { + "source_path": "education/windows/tutorial-school-deployment/manage-surface-devices.md", + "redirect_url": "/mem/intune/industry/education/tutorial-school-deployment/manage-surface-devices", + "redirect_document_id": false + }, + { + "source_path": "education/windows/tutorial-school-deployment/reset-wipe.md", + "redirect_url": "/mem/intune/industry/education/tutorial-school-deployment/reset-wipe", + "redirect_document_id": false + }, + { + "source_path": "education/windows/tutorial-school-deployment/set-up-microsoft-entra-id.md", + "redirect_url": "/mem/intune/industry/education/tutorial-school-deployment/set-up-microsoft-entra-id", + "redirect_document_id": false + }, + { + "source_path": "education/windows/tutorial-school-deployment/set-up-microsoft-intune.md", + "redirect_url": "/mem/intune/industry/education/tutorial-school-deployment/set-up-microsoft-intune", + "redirect_document_id": false + }, + { + "source_path": "education/windows/tutorial-school-deployment/troubleshoot-overview.md", + "redirect_url": "/mem/intune/industry/education/tutorial-school-deployment/troubleshoot-overview", + "redirect_document_id": false } ] -} +} \ No newline at end of file diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index df4ae61d44..31d8d2cd74 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -1305,81 +1305,6 @@ "redirect_url": "/windows/configuration/configure-windows-diagnostic-data-in-your-organization", "redirect_document_id": false }, - { - "source_path": "windows/configure/cortana-at-work-crm.md", - "redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-crm", - "redirect_document_id": false - }, - { - "source_path": "windows/configure/cortana-at-work-feedback.md", - "redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-feedback", - "redirect_document_id": false - }, - { - "source_path": "windows/configure/cortana-at-work-o365.md", - "redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-o365", - "redirect_document_id": false - }, - { - "source_path": "windows/configure/cortana-at-work-overview.md", - "redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-overview", - "redirect_document_id": false - }, - { - "source_path": "windows/configure/cortana-at-work-policy-settings.md", - "redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-policy-settings", - "redirect_document_id": false - }, - { - "source_path": "windows/configure/cortana-at-work-powerbi.md", - "redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-powerbi", - "redirect_document_id": false - }, - { - "source_path": "windows/configure/cortana-at-work-scenario-1.md", - "redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-scenario-1", - "redirect_document_id": false - }, - { - "source_path": "windows/configure/cortana-at-work-scenario-2.md", - "redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-scenario-2", - "redirect_document_id": false - }, - { - "source_path": "windows/configure/cortana-at-work-scenario-3.md", - "redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-scenario-3", - "redirect_document_id": false - }, - { - "source_path": "windows/configure/cortana-at-work-scenario-4.md", - "redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-scenario-4", - "redirect_document_id": false - }, - { - "source_path": "windows/configure/cortana-at-work-scenario-5.md", - "redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-scenario-5", - "redirect_document_id": false - }, - { - "source_path": "windows/configure/cortana-at-work-scenario-6.md", - "redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-scenario-6", - "redirect_document_id": false - }, - { - "source_path": "windows/configure/cortana-at-work-scenario-7.md", - "redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-scenario-7", - "redirect_document_id": false - }, - { - "source_path": "windows/configure/cortana-at-work-testing-scenarios.md", - "redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-testing-scenarios", - "redirect_document_id": false - }, - { - "source_path": "windows/configure/cortana-at-work-voice-commands.md", - "redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-voice-commands", - "redirect_document_id": false - }, { "source_path": "windows/configure/customize-and-export-start-layout.md", "redirect_url": "/windows/configuration/customize-and-export-start-layout", @@ -1682,12 +1607,12 @@ }, { "source_path": "windows/deploy/assign-applications-using-roles-in-mdt.md", - "redirect_url": "/windows/deployment/deploy-windows-mdt/assign-applications-using-roles-in-mdt", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/deploy-windows-mdt/assign-applications-using-roles-in-mdt", "redirect_document_id": false }, { "source_path": "windows/deploy/build-a-distributed-environment-for-windows-10-deployment.md", - "redirect_url": "/windows/deployment/deploy-windows-mdt/build-a-distributed-environment-for-windows-10-deployment", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/deploy-windows-mdt/build-a-distributed-environment-for-windows-10-deployment", "redirect_document_id": false }, { @@ -1717,17 +1642,17 @@ }, { "source_path": "windows/deploy/configure-mdt-deployment-share-rules.md", - "redirect_url": "/windows/deployment/deploy-windows-mdt/configure-mdt-deployment-share-rules", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/deploy-windows-mdt/configure-mdt-deployment-share-rules", "redirect_document_id": false }, { "source_path": "windows/deploy/configure-mdt-for-userexit-scripts.md", - "redirect_url": "/windows/deployment/deploy-windows-mdt/configure-mdt-for-userexit-scripts", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/deploy-windows-mdt/configure-mdt-for-userexit-scripts", "redirect_document_id": false }, { "source_path": "windows/deploy/configure-mdt-settings.md", - "redirect_url": "/windows/deployment/deploy-windows-mdt/configure-mdt-settings", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/deploy-windows-mdt/configure-mdt-settings", "redirect_document_id": false }, { @@ -1742,7 +1667,7 @@ }, { "source_path": "windows/deploy/create-a-windows-10-reference-image.md", - "redirect_url": "/windows/deployment/deploy-windows-mdt/create-a-windows-10-reference-image", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/deploy-windows-mdt/create-a-windows-10-reference-image", "redirect_document_id": false }, { @@ -1752,12 +1677,12 @@ }, { "source_path": "windows/deploy/deploy-a-windows-10-image-using-mdt.md", - "redirect_url": "/windows/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt", "redirect_document_id": false }, { "source_path": "windows/deploy/deploy-whats-new.md", - "redirect_url": "/windows/deployment/deploy-whats-new", + "redirect_url": "/windows/deployment/", "redirect_document_id": false }, { @@ -1772,7 +1697,12 @@ }, { "source_path": "windows/deploy/deploy-windows-to-go.md", - "redirect_url": "/windows/deployment/deploy-windows-to-go", + "redirect_url": "/windows/deployment/windows-deployment-scenarios-and-tools", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/deploy-windows-to-go.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/windows-to-go/deploy-windows-to-go", "redirect_document_id": false }, { @@ -1782,7 +1712,7 @@ }, { "source_path": "windows/deploy/get-started-with-the-microsoft-deployment-toolkit.md", - "redirect_url": "/windows/deployment/deploy-windows-mdt/get-started-with-the-microsoft-deployment-toolkit", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/deploy-windows-mdt/get-started-with-the-microsoft-deployment-toolkit", "redirect_document_id": false }, { @@ -1922,7 +1852,7 @@ }, { "source_path": "windows/deploy/prepare-for-windows-deployment-with-mdt.md", - "redirect_url": "/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt", "redirect_document_id": false }, { @@ -2002,7 +1932,7 @@ }, { "source_path": "windows/deploy/refresh-a-windows-7-computer-with-windows-10.md", - "redirect_url": "/windows/deployment/deploy-windows-mdt/refresh-a-windows-7-computer-with-windows-10", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/deploy-windows-mdt/refresh-a-windows-7-computer-with-windows-10", "redirect_document_id": false }, { @@ -2017,7 +1947,7 @@ }, { "source_path": "windows/deploy/replace-a-windows-7-computer-with-a-windows-10-computer.md", - "redirect_url": "/windows/deployment/deploy-windows-mdt/replace-a-windows-7-computer-with-a-windows-10-computer", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/deploy-windows-mdt/replace-a-windows-7-computer-with-a-windows-10-computer", "redirect_document_id": false }, { @@ -2047,17 +1977,17 @@ }, { "source_path": "windows/deploy/set-up-mdt-for-bitlocker.md", - "redirect_url": "/windows/deployment/deploy-windows-mdt/set-up-mdt-for-bitlocker", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/deploy-windows-mdt/set-up-mdt-for-bitlocker", "redirect_document_id": false }, { "source_path": "windows/deploy/sideload-apps-in-windows-10.md", - "redirect_url": "/windows/application-management/sideload-apps-in-windows-10", + "redirect_url": "/windows/application-management/sideload-apps-in-windows", "redirect_document_id": false }, { "source_path": "windows/deploy/simulate-a-windows-10-deployment-in-a-test-environment.md", - "redirect_url": "/windows/deployment/deploy-windows-mdt/simulate-a-windows-10-deployment-in-a-test-environment", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/deploy-windows-mdt/simulate-a-windows-10-deployment-in-a-test-environment", "redirect_document_id": false }, { @@ -2207,7 +2137,7 @@ }, { "source_path": "windows/deploy/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md", - "redirect_url": "/windows/deployment/upgrade/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/deploy-windows-mdt/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit", "redirect_document_id": false }, { @@ -2217,12 +2147,12 @@ }, { "source_path": "windows/deploy/use-orchestrator-runbooks-with-mdt.md", - "redirect_url": "/windows/deployment/deploy-windows-mdt/use-orchestrator-runbooks-with-mdt", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/deploy-windows-mdt/use-orchestrator-runbooks-with-mdt", "redirect_document_id": false }, { "source_path": "windows/deploy/use-the-mdt-database-to-stage-windows-10-deployment-information.md", - "redirect_url": "/windows/deployment/deploy-windows-mdt/use-the-mdt-database-to-stage-windows-10-deployment-information", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/deploy-windows-mdt/use-the-mdt-database-to-stage-windows-10-deployment-information", "redirect_document_id": false }, { @@ -2252,7 +2182,7 @@ }, { "source_path": "windows/deploy/use-web-services-in-mdt.md", - "redirect_url": "/windows/deployment/deploy-windows-mdt/use-web-services-in-mdt", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/deploy-windows-mdt/use-web-services-in-mdt", "redirect_document_id": false }, { @@ -2532,7 +2462,7 @@ }, { "source_path": "windows/deploy/windows-10-poc-mdt.md", - "redirect_url": "/windows/deployment/windows-10-poc-mdt", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/windows-10-poc-mdt", "redirect_document_id": false }, { @@ -10450,81 +10380,6 @@ "redirect_url": "/windows/client-management/connect-to-remote-aadj-pc", "redirect_document_id": false }, - { - "source_path": "windows/manage/cortana-at-work-crm.md", - "redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-crm", - "redirect_document_id": false - }, - { - "source_path": "windows/manage/cortana-at-work-feedback.md", - "redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-feedback", - "redirect_document_id": false - }, - { - "source_path": "windows/manage/cortana-at-work-o365.md", - "redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-o365", - "redirect_document_id": false - }, - { - "source_path": "windows/manage/cortana-at-work-overview.md", - "redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-overview", - "redirect_document_id": false - }, - { - "source_path": "windows/manage/cortana-at-work-policy-settings.md", - "redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-policy-settings", - "redirect_document_id": false - }, - { - "source_path": "windows/manage/cortana-at-work-powerbi.md", - "redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-powerbi", - "redirect_document_id": false - }, - { - "source_path": "windows/manage/cortana-at-work-scenario-1.md", - "redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-scenario-1", - "redirect_document_id": false - }, - { - "source_path": "windows/manage/cortana-at-work-scenario-2.md", - "redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-scenario-2", - "redirect_document_id": false - }, - { - "source_path": "windows/manage/cortana-at-work-scenario-3.md", - "redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-scenario-3", - "redirect_document_id": false - }, - { - "source_path": "windows/manage/cortana-at-work-scenario-4.md", - "redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-scenario-4", - "redirect_document_id": false - }, - { - "source_path": "windows/manage/cortana-at-work-scenario-5.md", - "redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-scenario-5", - "redirect_document_id": false - }, - { - "source_path": "windows/manage/cortana-at-work-scenario-6.md", - "redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-scenario-6", - "redirect_document_id": false - }, - { - "source_path": "windows/manage/cortana-at-work-scenario-7.md", - "redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-scenario-7", - "redirect_document_id": false - }, - { - "source_path": "windows/manage/cortana-at-work-testing-scenarios.md", - "redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-testing-scenarios", - "redirect_document_id": false - }, - { - "source_path": "windows/manage/cortana-at-work-voice-commands.md", - "redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-voice-commands", - "redirect_document_id": false - }, { "source_path": "windows/manage/customize-and-export-start-layout.md", "redirect_url": "/windows/configuration//customize-and-export-start-layout", @@ -10650,11 +10505,6 @@ "redirect_url": "/windows/client-management/index", "redirect_document_id": false }, - { - "source_path": "windows/manage/manage-cortana-in-enterprise.md", - "redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-overview", - "redirect_document_id": false - }, { "source_path": "windows/manage/manage-inventory-windows-store-for-business.md", "redirect_url": "/microsoft-store/app-inventory-management-windows-store-for-business", @@ -11202,7 +11052,12 @@ }, { "source_path": "windows/plan/best-practice-recommendations-for-windows-to-go.md", - "redirect_url": "/windows/deployment/planning/best-practice-recommendations-for-windows-to-go", + "redirect_url": "/windows/deployment/windows-deployment-scenarios-and-tools", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/planning/best-practice-recommendations-for-windows-to-go.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/windows-to-go/best-practice-recommendations-for-windows-to-go", "redirect_document_id": false }, { @@ -11332,7 +11187,12 @@ }, { "source_path": "windows/plan/deployment-considerations-for-windows-to-go.md", - "redirect_url": "/windows/deployment/planning/deployment-considerations-for-windows-to-go", + "redirect_url": "/windows/deployment/windows-deployment-scenarios-and-tools", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/planning/deployment-considerations-for-windows-to-go.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/windows-to-go/deployment-considerations-for-windows-to-go", "redirect_document_id": false }, { @@ -11427,7 +11287,12 @@ }, { "source_path": "windows/plan/prepare-your-organization-for-windows-to-go.md", - "redirect_url": "/windows/deployment/planning/prepare-your-organization-for-windows-to-go", + "redirect_url": "/windows/deployment/windows-deployment-scenarios-and-tools", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/planning/prepare-your-organization-for-windows-to-go.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/windows-to-go/prepare-your-organization-for-windows-to-go", "redirect_document_id": false }, { @@ -11462,7 +11327,12 @@ }, { "source_path": "windows/plan/security-and-data-protection-considerations-for-windows-to-go.md", - "redirect_url": "/windows/deployment/planning/security-and-data-protection-considerations-for-windows-to-go", + "redirect_url": "/windows/deployment/windows-deployment-scenarios-and-tools", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/planning/security-and-data-protection-considerations-for-windows-to-go.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/windows-to-go/security-and-data-protection-considerations-for-windows-to-go", "redirect_document_id": false }, { @@ -11617,7 +11487,7 @@ }, { "source_path": "windows/plan/windows-10-compatibility.md", - "redirect_url": "/windows/deployment/planning/windows-10-compatibility", + "redirect_url": "/windows/compatibility/", "redirect_document_id": false }, { @@ -11652,7 +11522,12 @@ }, { "source_path": "windows/plan/windows-to-go-overview.md", - "redirect_url": "/windows/deployment/planning/windows-to-go-overview", + "redirect_url": "/windows/deployment/windows-deployment-scenarios-and-tools", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/planning/windows-to-go-overview.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/windows-to-go/windows-to-go-overview", "redirect_document_id": false }, { @@ -12725,6 +12600,11 @@ "redirect_url": "/windows/deployment/update/waas-wufb-group-policy", "redirect_document_id": false }, + { + "source_path": "windows/deployment/planning/windows-to-go-frequently-asked-questions.yml", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/windows-to-go/windows-to-go-frequently-asked-questions", + "redirect_document_id": false + }, { "source_path": "windows/deployment/upgrade/windows-10-edition-upgrades.md", "redirect_url": "/windows/deployment/upgrade/windows-edition-upgrades", @@ -12734,6 +12614,1796 @@ "source_path": "windows/deployment/windows-10-media.md", "redirect_url": "/licensing/", "redirect_document_id": false + }, + { + "source_path": "windows/deployment/deploy-windows-mdt/assign-applications-using-roles-in-mdt.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/deploy-windows-mdt/assign-applications-using-roles-in-mdt", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/deploy-windows-mdt/build-a-distributed-environment-for-windows-10-deployment.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/deploy-windows-mdt/build-a-distributed-environment-for-windows-10-deployment", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/deploy-windows-mdt/configure-mdt-deployment-share-rules.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/deploy-windows-mdt/configure-mdt-deployment-share-rules", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/deploy-windows-mdt/configure-mdt-for-userexit-scripts.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/deploy-windows-mdt/configure-mdt-for-userexit-scripts", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/deploy-windows-mdt/configure-mdt-settings.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/deploy-windows-mdt/configure-mdt-settings", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/deploy-windows-mdt/create-a-windows-10-reference-image.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/deploy-windows-mdt/create-a-windows-10-reference-image", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/deploy-windows-mdt/get-started-with-the-microsoft-deployment-toolkit.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/deploy-windows-mdt/get-started-with-the-microsoft-deployment-toolkit", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/deploy-windows-mdt/refresh-a-windows-7-computer-with-windows-10.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/deploy-windows-mdt/refresh-a-windows-7-computer-with-windows-10", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/deploy-windows-mdt/replace-a-windows-7-computer-with-a-windows-10-computer.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/deploy-windows-mdt/replace-a-windows-7-computer-with-a-windows-10-computer", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/deploy-windows-mdt/set-up-mdt-for-bitlocker.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/deploy-windows-mdt/set-up-mdt-for-bitlocker", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/deploy-windows-mdt/simulate-a-windows-10-deployment-in-a-test-environment.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/deploy-windows-mdt/simulate-a-windows-10-deployment-in-a-test-environment", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/deploy-windows-mdt/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/deploy-windows-mdt/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/deploy-windows-mdt/use-orchestrator-runbooks-with-mdt.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/deploy-windows-mdt/use-orchestrator-runbooks-with-mdt", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/deploy-windows-mdt/use-the-mdt-database-to-stage-windows-10-deployment-information.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/deploy-windows-mdt/use-the-mdt-database-to-stage-windows-10-deployment-information", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/deploy-windows-mdt/use-web-services-in-mdt.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/deploy-windows-mdt/use-web-services-in-mdt", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/windows-10-poc-mdt.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/deploy-windows-mdt/windows-10-poc-mdt", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/upgrade/resolve-windows-10-upgrade-errors.md", + "redirect_url": "/windows/deployment/upgrade/resolve-windows-upgrade-errors", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/windows-10-deployment-scenarios.md", + "redirect_url": "/windows/deployment/windows-deployment-scenarios", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/windows-10-subscription-activation.md", + "redirect_url": "/windows/deployment/windows-subscription-activation", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/windows-10-enterprise-e3-overview.md", + "redirect_url": "/windows/deployment/windows-enterprise-e3-overview", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/advanced-security-audit-policy-settings.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/advanced-security-auditing.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-auditing", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/appendix-a-security-monitoring-recommendations-for-many-audit-events.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/appendix-a-security-monitoring-recommendations-for-many-audit-events", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/audit-account-lockout.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-account-lockout", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/audit-application-generated.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-application-generated", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/audit-application-group-management.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-application-group-management", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/audit-audit-policy-change.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-audit-policy-change", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/audit-authentication-policy-change.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-authentication-policy-change", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/audit-authorization-policy-change.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-authorization-policy-change", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/audit-central-access-policy-staging.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-central-access-policy-staging", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/audit-certification-services.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-certification-services", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/audit-computer-account-management.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-computer-account-management", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/audit-credential-validation.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-credential-validation", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/audit-detailed-directory-service-replication.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-detailed-directory-service-replication", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/audit-detailed-file-share.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-detailed-file-share", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/audit-directory-service-access.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-directory-service-access", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/audit-directory-service-changes.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-directory-service-changes", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/audit-directory-service-replication.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-directory-service-replication", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/audit-distribution-group-management.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-distribution-group-management", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/audit-dpapi-activity.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-dpapi-activity", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/audit-file-share.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-file-share", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/audit-file-system.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-file-system", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/audit-filtering-platform-connection.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-filtering-platform-connection", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/audit-filtering-platform-packet-drop.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-filtering-platform-packet-drop", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/audit-filtering-platform-policy-change.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-filtering-platform-policy-change", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/audit-group-membership.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-group-membership", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/audit-handle-manipulation.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-handle-manipulation", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/audit-ipsec-driver.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-ipsec-driver", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/audit-ipsec-extended-mode.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-ipsec-extended-mode", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/audit-ipsec-main-mode.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-ipsec-main-mode", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/audit-ipsec-quick-mode.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-ipsec-quick-mode", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/audit-kerberos-authentication-service.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-kerberos-authentication-service", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/audit-kerberos-service-ticket-operations.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-kerberos-service-ticket-operations", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/audit-kernel-object.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-kernel-object", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/audit-logoff.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-logoff", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/audit-logon.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-logon", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/audit-mpssvc-rule-level-policy-change.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-mpssvc-rule-level-policy-change", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/audit-network-policy-server.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-network-policy-server", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/audit-non-sensitive-privilege-use.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-non-sensitive-privilege-use", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/audit-other-account-logon-events.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-other-account-logon-events", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/audit-other-account-management-events.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-other-account-management-events", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/audit-other-logonlogoff-events.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-other-logonlogoff-events", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/audit-other-object-access-events.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-other-object-access-events", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/audit-other-policy-change-events.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-other-policy-change-events", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/audit-other-privilege-use-events.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-other-privilege-use-events", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/audit-other-system-events.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-other-system-events", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/audit-pnp-activity.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-pnp-activity", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/audit-process-creation.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-process-creation", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/audit-process-termination.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-process-termination", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/audit-registry.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-registry", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/audit-removable-storage.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-removable-storage", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/audit-rpc-events.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-rpc-events", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/audit-sam.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-sam", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/audit-security-group-management.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-security-group-management", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/audit-security-state-change.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-security-state-change", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/audit-security-system-extension.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-security-system-extension", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/audit-sensitive-privilege-use.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-sensitive-privilege-use", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/audit-special-logon.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-special-logon", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/audit-system-integrity.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-system-integrity", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/audit-token-right-adjusted.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-token-right-adjusted", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/audit-user-account-management.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-user-account-management", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/audit-user-device-claims.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-user-device-claims", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/basic-audit-account-logon-events.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/basic-audit-account-logon-events", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/basic-audit-account-management.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/basic-audit-account-management", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/basic-audit-directory-service-access.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/basic-audit-directory-service-access", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/basic-audit-logon-events.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/basic-audit-logon-events", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/basic-audit-object-access.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/basic-audit-object-access", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/basic-audit-policy-change.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/basic-audit-policy-change", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/basic-audit-privilege-use.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/basic-audit-privilege-use", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/basic-audit-process-tracking.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/basic-audit-process-tracking", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/basic-audit-system-events.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/basic-audit-system-events", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/basic-security-audit-policies.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/basic-security-audit-policies", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/basic-security-audit-policy-settings.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/basic-security-audit-policy-settings", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/create-a-basic-audit-policy-settings-for-an-event-category.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/create-a-basic-audit-policy-settings-for-an-event-category", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-1100.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-1100", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-1102.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-1102", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-1104.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-1104", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-1105.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-1105", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-1108.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-1108", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4608.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4608", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4610.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4610", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4611.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4611", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4612.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4612", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4614.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4614", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4615.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4615", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4616.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4616", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4618.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4618", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4621.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4621", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4622.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4622", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4624.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4624", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4625.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4625", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4626.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4626", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4627.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4627", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4634.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4634", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4647.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4647", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4648.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4648", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4649.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4649", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4656.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4656", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4657.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4657", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4658.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4658", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4660.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4660", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4661.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4661", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4662.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4662", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4663.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4663", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4664.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4664", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4670.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4670", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4671.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4671", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4672.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4672", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4673.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4673", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4674.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4674", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4675.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4675", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4688.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4689.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4689", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4690.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4690", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4691.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4691", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4692.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4692", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4693.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4693", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4694.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4694", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4695.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4695", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4696.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4696", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4697.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4697", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4698.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4699.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4699", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4700.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4700", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4701.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4701", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4702.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4702", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4703.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4703", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4704.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4704", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4705.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4705", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4706.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4706", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4707.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4707", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4713.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4713", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4714.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4714", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4715.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4715", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4716.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4716", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4717.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4717", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4718.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4718", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4719.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4719", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4720.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4720", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4722.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4722", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4723.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4723", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4724.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4724", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4725.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4725", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4726.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4726", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4731.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4731", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4732.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4732", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4733.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4733", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4734.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4734", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4735.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4735", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4738.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4738", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4739.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4739", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4740.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4740", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4741.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4741", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4742.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4742", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4743.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4743", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4749.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4749", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4750.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4750", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4751.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4751", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4752.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4752", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4753.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4753", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4764.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4764", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4765.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4765", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4766.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4766", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4767.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4767", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4768.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4768", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4769.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4769", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4770.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4770", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4771.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4771", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4772.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4772", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4773.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4773", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4774.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4774", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4775.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4775", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4776.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4776", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4777.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4777", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4778.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4778", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4779.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4779", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4780.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4780", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4781.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4781", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4782.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4782", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4793.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4793", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4794.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4794", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4798.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4798", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4799.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4799", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4800.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4800", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4801.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4801", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4802.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4802", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4803.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4803", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4816.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4816", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4817.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4817", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4818.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4818", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4819.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4819", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4826.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4826", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4864.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4864", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4865.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4865", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4866.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4866", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4867.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4867", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4902.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4902", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4904.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4904", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4905.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4905", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4906.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4906", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4907.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4907", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4908.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4908", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4909.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4909", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4910.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4910", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4911.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4911", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4912.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4912", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4913.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4913", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4928.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4928", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4929.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4929", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4930.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4930", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4931.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4931", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4932.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4932", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4933.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4933", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4934.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4934", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4935.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4935", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4936.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4936", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4937.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4937", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4944.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4944", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4945.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4945", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4946.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4946", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4947.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4947", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4948.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4948", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4949.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4949", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4950.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4950", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4951.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4951", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4952.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4952", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4953.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4953", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4954.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4954", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4956.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4956", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4957.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4957", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4958.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4958", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4964.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4964", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-4985.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4985", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-5024.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5024", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-5025.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5025", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-5027.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5027", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-5028.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5028", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-5029.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5029", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-5030.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5030", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-5031.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5031", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-5032.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5032", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-5033.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5033", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-5034.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5034", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-5035.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5035", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-5037.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5037", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-5038.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5038", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-5039.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5039", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-5051.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5051", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-5056.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5056", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-5057.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5057", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-5058.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5058", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-5059.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5059", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-5060.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5060", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-5061.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5061", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-5062.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5062", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-5063.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5063", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-5064.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5064", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-5065.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5065", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-5066.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5066", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-5067.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5067", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-5068.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5068", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-5069.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5069", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-5070.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5070", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-5136.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5136", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-5137.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5137", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-5138.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5138", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-5139.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5139", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-5140.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5140", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-5141.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5141", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-5142.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5142", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-5143.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5143", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-5144.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5144", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-5145.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5145", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-5148.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5148", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-5149.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5149", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-5150.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5150", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-5151.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5151", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-5152.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5152", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-5153.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5153", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-5154.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5154", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-5155.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5155", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-5156.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5156", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-5157.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5157", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-5158.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5158", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-5159.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5159", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-5168.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5168", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-5376.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5376", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-5377.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5377", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-5378.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5378", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-5447.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5447", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-5632.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5632", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-5633.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5633", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-5712.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5712", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-5888.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5888", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-5889.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5889", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-5890.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5890", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-6144.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-6144", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-6145.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-6145", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-6281.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-6281", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-6400.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-6400", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-6401.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-6401", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-6402.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-6402", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-6403.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-6403", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-6404.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-6404", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-6405.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-6405", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-6406.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-6406", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-6407.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-6407", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-6408.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-6408", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-6409.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-6409", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-6410.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-6410", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-6416.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-6416", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-6419.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-6419", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-6420.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-6420", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-6421.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-6421", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-6422.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-6422", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-6423.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-6423", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/event-6424.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-6424", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/file-system-global-object-access-auditing.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/file-system-global-object-access-auditing", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/how-to-list-xml-elements-in-eventdata.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/how-to-list-xml-elements-in-eventdata", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/monitor-central-access-policy-and-rule-definitions.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/monitor-central-access-policy-and-rule-definitions", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/monitor-claim-types.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/monitor-claim-types", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/monitor-resource-attribute-definitions.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/monitor-resource-attribute-definitions", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/monitor-the-central-access-policies-associated-with-files-and-folders.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/monitor-the-central-access-policies-associated-with-files-and-folders", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/monitor-the-central-access-policies-that-apply-on-a-file-server.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/monitor-the-central-access-policies-that-apply-on-a-file-server", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/monitor-the-resource-attributes-on-files-and-folders.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/monitor-the-resource-attributes-on-files-and-folders", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/monitor-the-use-of-removable-storage-devices.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/monitor-the-use-of-removable-storage-devices", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/monitor-user-and-device-claims-during-sign-in.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/monitor-user-and-device-claims-during-sign-in", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/other-events.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/other-events", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/planning-and-deploying-advanced-security-audit-policies.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/planning-and-deploying-advanced-security-audit-policies", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/registry-global-object-access-auditing.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/registry-global-object-access-auditing", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/security-auditing-overview.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/security-auditing-overview", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/view-the-security-event-log.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/view-the-security-event-log", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/which-editions-of-windows-support-advanced-audit-policy-configuration.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/which-editions-of-windows-support-advanced-audit-policy-configuration", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/auditing/advanced-security-auditing-faq.yml", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-auditing-faq", + "redirect_document_id": false } ] -} +} \ No newline at end of file diff --git a/.openpublishing.redirection.windows-application-management.json b/.openpublishing.redirection.windows-application-management.json index 4b1866c772..1a9744551d 100644 --- a/.openpublishing.redirection.windows-application-management.json +++ b/.openpublishing.redirection.windows-application-management.json @@ -24,6 +24,516 @@ "source_path": "windows/application-management/apps-in-windows-10.md", "redirect_url": "/windows/application-management/overview-windows-apps", "redirect_document_id": false + }, + { + "source_path": "windows/application-management/sideload-apps-in-windows-10.md", + "redirect_url": "/windows/application-management/sideload-apps-in-windows", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/add-apps-and-features.md", + "redirect_url": "/windows/client-management/client-tools/add-remove-hide-features", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-about-appv.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-about-appv", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-add-or-remove-an-administrator-with-the-management-console.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-add-or-remove-an-administrator-with-the-management-console", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-add-or-upgrade-packages-with-the-management-console.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-add-or-upgrade-packages-with-the-management-console", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-administering-appv-with-powershell.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-administering-appv-with-powershell", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-administering-virtual-applications-with-the-management-console.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-administering-virtual-applications-with-the-management-console", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-allow-administrators-to-enable-connection-groups.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-allow-administrators-to-enable-connection-groups", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-application-publishing-and-client-interaction.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-application-publishing-and-client-interaction", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-apply-the-deployment-configuration-file-with-powershell", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-apply-the-user-configuration-file-with-powershell.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-apply-the-user-configuration-file-with-powershell", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-auto-batch-sequencing.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-auto-batch-sequencing", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-auto-batch-updating.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-auto-batch-updating", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-auto-clean-unpublished-packages.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-auto-clean-unpublished-packages", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-auto-provision-a-vm.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-auto-provision-a-vm", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-available-mdm-settings.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-available-mdm-settings", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-capacity-planning.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-capacity-planning", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-client-configuration-settings.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-client-configuration-settings", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-configure-access-to-packages-with-the-management-console.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-configure-access-to-packages-with-the-management-console", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-configure-connection-groups-to-ignore-the-package-version.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-configure-connection-groups-to-ignore-the-package-version", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-configure-the-client-to-receive-updates-from-the-publishing-server.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-configure-the-client-to-receive-updates-from-the-publishing-server", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-connection-group-file.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-connection-group-file", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-connection-group-virtual-environment.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-connection-group-virtual-environment", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-connect-to-the-management-console.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-connect-to-the-management-console", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-convert-a-package-created-in-a-previous-version-of-appv.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-convert-a-package-created-in-a-previous-version-of-appv", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-create-a-connection-group.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-create-a-connection-group", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-create-a-connection-group-with-user-published-and-globally-published-packages.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-create-a-connection-group-with-user-published-and-globally-published-packages", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-create-a-custom-configuration-file-with-the-management-console.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-create-a-custom-configuration-file-with-the-management-console", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-create-and-use-a-project-template.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-create-and-use-a-project-template", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-create-a-package-accelerator.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-create-a-package-accelerator", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-create-a-package-accelerator-with-powershell.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-create-a-package-accelerator-with-powershell", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-create-a-virtual-application-package-package-accelerator.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-create-a-virtual-application-package-package-accelerator", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-creating-and-managing-virtualized-applications.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-creating-and-managing-virtualized-applications", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-customize-virtual-application-extensions-with-the-management-console.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-customize-virtual-application-extensions-with-the-management-console", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-delete-a-connection-group.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-delete-a-connection-group", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-delete-a-package-with-the-management-console.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-delete-a-package-with-the-management-console", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-deploy-appv-databases-with-sql-scripts.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-deploy-appv-databases-with-sql-scripts", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-deploy-appv-packages-with-electronic-software-distribution-solutions.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-deploy-appv-packages-with-electronic-software-distribution-solutions", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-deploying-appv.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-deploying-appv", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-deploying-microsoft-office-2010-wth-appv.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-deploying-microsoft-office-2010-wth-appv", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-deploying-microsoft-office-2013-with-appv.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-deploying-microsoft-office-2013-with-appv", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-deploying-microsoft-office-2016-with-appv.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-deploying-microsoft-office-2016-with-appv", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-deploying-packages-with-electronic-software-distribution-solutions.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-deploying-packages-with-electronic-software-distribution-solutions", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-deploying-the-appv-sequencer-and-client.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-deploying-the-appv-sequencer-and-client", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-deploying-the-appv-server.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-deploying-the-appv-server", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-deployment-checklist.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-deployment-checklist", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-deploy-the-appv-server.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-deploy-the-appv-server", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-deploy-the-appv-server-with-a-script.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-deploy-the-appv-server-with-a-script", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-dynamic-configuration.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-dynamic-configuration", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-enable-administrators-to-publish-packages-with-electronic-software-distribution-solutions.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-enable-administrators-to-publish-packages-with-electronic-software-distribution-solutions", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-enable-reporting-on-the-appv-client-with-powershell.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-enable-reporting-on-the-appv-client-with-powershell", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-enable-the-app-v-desktop-client.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-enable-the-app-v-desktop-client", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-evaluating-appv.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-evaluating-appv", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-for-windows.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-for-windows", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-getting-started.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-getting-started", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-high-level-architecture.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-high-level-architecture", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-install-the-management-and-reporting-databases-on-separate-computers.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-install-the-management-and-reporting-databases-on-separate-computers", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-install-the-management-server-on-a-standalone-computer.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-install-the-management-server-on-a-standalone-computer", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-install-the-publishing-server-on-a-remote-computer.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-install-the-publishing-server-on-a-remote-computer", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-install-the-reporting-server-on-a-standalone-computer.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-install-the-reporting-server-on-a-standalone-computer", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-install-the-sequencer.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-install-the-sequencer", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-load-the-powershell-cmdlets-and-get-cmdlet-help", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-maintaining-appv.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-maintaining-appv", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-managing-connection-groups.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-managing-connection-groups", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-migrating-to-appv-from-a-previous-version.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-migrating-to-appv-from-a-previous-version", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-modify-an-existing-virtual-application-package.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-modify-an-existing-virtual-application-package", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-modify-client-configuration-with-powershell.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-modify-client-configuration-with-powershell", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-move-the-appv-server-to-another-computer.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-move-the-appv-server-to-another-computer", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-operations.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-operations", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-performance-guidance.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-performance-guidance", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-planning-checklist.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-planning-checklist", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-planning-folder-redirection-with-appv.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-planning-folder-redirection-with-appv", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-planning-for-appv.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-planning-for-appv", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-planning-for-appv-server-deployment.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-planning-for-appv-server-deployment", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-planning-for-high-availability-with-appv.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-planning-for-high-availability-with-appv", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-planning-for-sequencer-and-client-deployment.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-planning-for-sequencer-and-client-deployment", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-planning-for-using-appv-with-office.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-planning-for-using-appv-with-office", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-planning-to-deploy-appv.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-planning-to-deploy-appv", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-planning-to-deploy-appv-with-electronic-software-distribution-solutions.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-planning-to-deploy-appv-with-electronic-software-distribution-solutions", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-preparing-your-environment.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-preparing-your-environment", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-prerequisites.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-prerequisites", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-publish-a-connection-group.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-publish-a-connection-group", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-publish-a-packages-with-the-management-console.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-publish-a-packages-with-the-management-console", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-register-and-unregister-a-publishing-server-with-the-management-console.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-register-and-unregister-a-publishing-server-with-the-management-console", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-release-notes-for-appv-for-windows.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-release-notes-for-appv-for-windows", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-release-notes-for-appv-for-windows-1703.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-release-notes-for-appv-for-windows-1703", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-reporting.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-reporting", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-running-locally-installed-applications-inside-a-virtual-environment.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-running-locally-installed-applications-inside-a-virtual-environment", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-security-considerations.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-security-considerations", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-sequence-a-new-application.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-sequence-a-new-application", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-sequence-a-package-with-powershell.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-sequence-a-package-with-powershell", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-supported-configurations.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-supported-configurations", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-technical-reference.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-technical-reference", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-transfer-access-and-configurations-to-another-version-of-a-package-with-the-management-console.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-transfer-access-and-configurations-to-another-version-of-a-package-with-the-management-console", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-troubleshooting.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-troubleshooting", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-using-the-client-management-console.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-using-the-client-management-console", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-view-and-configure-applications-and-default-virtual-application-extensions-with-the-management-console.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-view-and-configure-applications-and-default-virtual-application-extensions-with-the-management-console", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/app-v/appv-viewing-appv-server-publishing-metadata.md", + "redirect_url": "/microsoft-desktop-optimization-pack/app-v/appv-viewing-appv-server-publishing-metadata", + "redirect_document_id": false } ] } diff --git a/.openpublishing.redirection.windows-configuration.json b/.openpublishing.redirection.windows-configuration.json index a55f0f9966..b5f046f434 100644 --- a/.openpublishing.redirection.windows-configuration.json +++ b/.openpublishing.redirection.windows-configuration.json @@ -30,16 +30,6 @@ "redirect_url": "/windows/configuration/configure-windows-diagnostic-data-in-your-organization", "redirect_document_id": false }, - { - "source_path": "windows/configuration/cortana-at-work/cortana-at-work-crm.md", - "redirect_url": "/windows/resources", - "redirect_document_id": false - }, - { - "source_path": "windows/configuration/cortana-at-work/cortana-at-work-powerbi.md", - "redirect_url": "/windows/resources", - "redirect_document_id": false - }, { "source_path": "windows/configuration/diagnostic-data-viewer-overview.md", "redirect_url": "/windows/privacy/diagnostic-data-viewer-overview", @@ -172,12 +162,12 @@ }, { "source_path": "windows/configuration/start-taskbar-lockscreen.md", - "redirect_url": "/windows/configuration/windows-10-start-layout-options-and-policies", + "redirect_url": "/windows/configuration/start/policy-settings", "redirect_document_id": false }, { "source_path": "windows/configuration/stop-employees-from-using-the-windows-store.md", - "redirect_url": "/windows/configuration/stop-employees-from-using-microsoft-store", + "redirect_url": "/windows/configuration/store", "redirect_document_id": false }, { @@ -284,6 +274,766 @@ "source_path": "windows/configuration/windows-diagnostic-data.md", "redirect_url": "/windows/privacy/windows-diagnostic-data", "redirect_document_id": false + }, + { + "source_path": "windows/configuration/changes-to-start-policies-in-windows-10.md", + "redirect_url": "/windows/configuration/start/customize-windows-10-start-screens-by-using-group-policy", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/configure-windows-10-taskbar.md", + "redirect_url": "/windows/configuration/taskbar/", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/customize-and-export-start-layout.md", + "redirect_url": "/windows/configuration/start/layout", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/customize-start-menu-layout-windows-11.md", + "redirect_url": "/windows/configuration/start/customize-start-menu-layout-windows-11", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/customize-taskbar-windows-11.md", + "redirect_url": "/windows/configuration/taskbar", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/customize-windows-10-start-screens-by-using-group-policy.md", + "redirect_url": "/windows/configuration/start/customize-windows-10-start-screens-by-using-group-policy", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/customize-windows-10-start-screens-by-using-mobile-device-management.md", + "redirect_url": "/windows/configuration/start/customize-windows-10-start-screens-by-using-mobile-device-management", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md", + "redirect_url": "/windows/configuration/start/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/find-the-application-user-model-id-of-an-installed-app.md", + "redirect_url": "/windows/configuration/kiosk/find-the-application-user-model-id-of-an-installed-app", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/guidelines-for-assigned-access-app.md", + "redirect_url": "/windows/configuration/kiosk/guidelines-for-assigned-access-app", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/kiosk-additional-reference.md", + "redirect_url": "/windows/configuration/kiosk/kiosk-additional-reference", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/kiosk-mdm-bridge.md", + "redirect_url": "/windows/configuration/kiosk/kiosk-mdm-bridge", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/kiosk-methods.md", + "redirect_url": "/windows/configuration/kiosk/kiosk-methods", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/kiosk-policies.md", + "redirect_url": "/windows/configuration/kiosk/kiosk-policies", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/kiosk-prepare.md", + "redirect_url": "/windows/configuration/assigned-access/recommendations", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/kiosk/recommendations.md", + "redirect_url": "/windows/configuration/assigned-access/recommendations", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/kiosk-shelllauncher.md", + "redirect_url": "/windows/configuration/kiosk/kiosk-shelllauncher", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/kiosk-single-app.md", + "redirect_url": "/windows/configuration/kiosk/kiosk-single-app", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/kiosk-validate.md", + "redirect_url": "/windows/configuration/kiosk/kiosk-validate", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/kiosk-xml.md", + "redirect_url": "/windows/configuration/kiosk/kiosk-xml", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/lockdown-features-windows-10.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/configuration/kiosk/lockdown-features-windows-10", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/lock-down-windows-10-applocker.md", + "redirect_url": "/windows/configuration/kiosk/lock-down-windows-10-applocker", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/lock-down-windows-10-to-specific-apps.md", + "redirect_url": "/windows/configuration/kiosk/lock-down-windows-10-to-specific-apps", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/lock-down-windows-11-to-specific-apps.md", + "redirect_url": "/windows/configuration/kiosk/lock-down-windows-11-to-specific-apps", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/manage-tips-and-suggestions.md", + "redirect_url": "/windows/configuration/", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/provisioning-apn.md", + "redirect_url": "/windows/configuration/cellular/provisioning-apn", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/setup-digital-signage.md", + "redirect_url": "/windows/configuration/kiosk/setup-digital-signage", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/set-up-shared-or-guest-pc.md", + "redirect_url": "/windows/configuration/shared-pc/set-up-shared-or-guest-pc", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/shared-devices-concepts.md", + "redirect_url": "/windows/configuration/shared-pc/shared-devices-concepts", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/shared-pc-technical.md", + "redirect_url": "/windows/configuration/shared-pc/shared-pc-technical", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/start-layout-xml-desktop.md", + "redirect_url": "/windows/configuration/start/layout", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/start-secondary-tiles.md", + "redirect_url": "/windows/configuration/start/layout", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/stop-employees-from-using-microsoft-store.md", + "redirect_url": "/windows/configuration/store", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/store/stop-employees-from-using-microsoft-store.md", + "redirect_url": "/windows/configuration/store", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/supported-csp-start-menu-layout-windows.md", + "redirect_url": "/windows/configuration/start/policy-settings", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/supported-csp-taskbar-windows.md", + "redirect_url": "/windows/configuration/taskbar/policy-settings", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/windows-10-start-layout-options-and-policies.md", + "redirect_url": "/windows/configuration/start/policy-settings", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/windows-accessibility-for-ITPros.md", + "redirect_url": "/windows/configuration/accessibility", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/windows-spotlight.md", + "redirect_url": "/windows/configuration/windows-spotlight/index", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/lock-screen/windows-spotlight.md", + "redirect_url": "/windows/configuration/windows-spotlight", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/cortana-at-work/cortana-at-work-crm.md", + "redirect_url": "/windows/resources", + "redirect_document_id": false + }, + { + "source_path": "windows/configure/cortana-at-work-crm.md", + "redirect_url": "/windows/resources", + "redirect_document_id": false + }, + { + "source_path": "windows/manage/cortana-at-work-crm.md", + "redirect_url": "/windows/resources", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/cortana-at-work/cortana-at-work-powerbi.md", + "redirect_url": "/windows/resources", + "redirect_document_id": false + }, + { + "source_path": "windows/configure/cortana-at-work-powerbi.md", + "redirect_url": "/windows/resources", + "redirect_document_id": false + }, + { + "source_path": "windows/manage/cortana-at-work-powerbi.md", + "redirect_url": "/windows/resources", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/cortana-at-work/cortana-at-work-feedback.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/configuration/cortana-at-work/cortana-at-work-feedback", + "redirect_document_id": false + }, + { + "source_path": "windows/configure/cortana-at-work-feedback.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/configuration/cortana-at-work/cortana-at-work-feedback", + "redirect_document_id": false + }, + { + "source_path": "windows/manage/cortana-at-work-feedback.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/configuration/cortana-at-work/cortana-at-work-feedback", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/cortana-at-work/cortana-at-work-o365.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/configuration/cortana-at-work/cortana-at-work-o365", + "redirect_document_id": false + }, + { + "source_path": "windows/configure/cortana-at-work-o365.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/configuration/cortana-at-work/cortana-at-work-o365", + "redirect_document_id": false + }, + { + "source_path": "windows/manage/cortana-at-work-o365.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/configuration/cortana-at-work/cortana-at-work-o365", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/cortana-at-work/cortana-at-work-overview.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/configuration/cortana-at-work/cortana-at-work-overview", + "redirect_document_id": false + }, + { + "source_path": "windows/configure/cortana-at-work-overview.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/configuration/cortana-at-work/cortana-at-work-overview", + "redirect_document_id": false + }, + { + "source_path": "windows/manage/cortana-at-work-overview.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/configuration/cortana-at-work/cortana-at-work-overview", + "redirect_document_id": false + }, + { + "source_path": "windows/manage/manage-cortana-in-enterprise.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/configuration/cortana-at-work/cortana-at-work-overview", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/cortana-at-work/cortana-at-work-policy-settings.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/configuration/cortana-at-work/cortana-at-work-policy-settings", + "redirect_document_id": false + }, + { + "source_path": "windows/configure/cortana-at-work-policy-settings.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/configuration/cortana-at-work/cortana-at-work-policy-settings", + "redirect_document_id": false + }, + { + "source_path": "windows/manage/cortana-at-work-policy-settings.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/configuration/cortana-at-work/cortana-at-work-policy-settings", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/cortana-at-work/cortana-at-work-scenario-1.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/configuration/cortana-at-work/cortana-at-work-scenario-1", + "redirect_document_id": false + }, + { + "source_path": "windows/configure/cortana-at-work-scenario-1.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/configuration/cortana-at-work/cortana-at-work-scenario-1", + "redirect_document_id": false + }, + { + "source_path": "windows/manage/cortana-at-work-scenario-1.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/configuration/cortana-at-work/cortana-at-work-scenario-1", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/cortana-at-work/cortana-at-work-scenario-2.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/configuration/cortana-at-work/cortana-at-work-scenario-2", + "redirect_document_id": false + }, + { + "source_path": "windows/configure/cortana-at-work-scenario-2.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/configuration/cortana-at-work/cortana-at-work-scenario-2", + "redirect_document_id": false + }, + { + "source_path": "windows/manage/cortana-at-work-scenario-2.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/configuration/cortana-at-work/cortana-at-work-scenario-2", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/cortana-at-work/cortana-at-work-scenario-3.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/configuration/cortana-at-work/cortana-at-work-scenario-3", + "redirect_document_id": false + }, + { + "source_path": "windows/configure/cortana-at-work-scenario-3.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/configuration/cortana-at-work/cortana-at-work-scenario-3", + "redirect_document_id": false + }, + { + "source_path": "windows/manage/cortana-at-work-scenario-3.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/configuration/cortana-at-work/cortana-at-work-scenario-3", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/cortana-at-work/cortana-at-work-scenario-4.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/configuration/cortana-at-work/cortana-at-work-scenario-4", + "redirect_document_id": false + }, + { + "source_path": "windows/configure/cortana-at-work-scenario-4.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/configuration/cortana-at-work/cortana-at-work-scenario-4", + "redirect_document_id": false + }, + { + "source_path": "windows/manage/cortana-at-work-scenario-4.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/configuration/cortana-at-work/cortana-at-work-scenario-4", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/cortana-at-work/cortana-at-work-scenario-5.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/configuration/cortana-at-work/cortana-at-work-scenario-5", + "redirect_document_id": false + }, + { + "source_path": "windows/configure/cortana-at-work-scenario-5.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/configuration/cortana-at-work/cortana-at-work-scenario-5", + "redirect_document_id": false + }, + { + "source_path": "windows/manage/cortana-at-work-scenario-5.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/configuration/cortana-at-work/cortana-at-work-scenario-5", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/cortana-at-work/cortana-at-work-scenario-6.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/configuration/cortana-at-work/cortana-at-work-scenario-6", + "redirect_document_id": false + }, + { + "source_path": "windows/configure/cortana-at-work-scenario-6.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/configuration/cortana-at-work/cortana-at-work-scenario-6", + "redirect_document_id": false + }, + { + "source_path": "windows/manage/cortana-at-work-scenario-6.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/configuration/cortana-at-work/cortana-at-work-scenario-6", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/cortana-at-work/cortana-at-work-scenario-7.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/configuration/cortana-at-work/cortana-at-work-scenario-7", + "redirect_document_id": false + }, + { + "source_path": "windows/configure/cortana-at-work-scenario-7.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/configuration/cortana-at-work/cortana-at-work-scenario-7", + "redirect_document_id": false + }, + { + "source_path": "windows/manage/cortana-at-work-scenario-7.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/configuration/cortana-at-work/cortana-at-work-scenario-7", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/cortana-at-work/cortana-at-work-testing-scenarios.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/configuration/cortana-at-work/cortana-at-work-testing-scenarios", + "redirect_document_id": false + }, + { + "source_path": "windows/configure/cortana-at-work-testing-scenarios.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/configuration/cortana-at-work/cortana-at-work-testing-scenarios", + "redirect_document_id": false + }, + { + "source_path": "windows/manage/cortana-at-work-testing-scenarios.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/configuration/cortana-at-work/cortana-at-work-testing-scenarios", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/cortana-at-work/cortana-at-work-voice-commands.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/configuration/cortana-at-work/cortana-at-work-voice-commands", + "redirect_document_id": false + }, + { + "source_path": "windows/configure/cortana-at-work-voice-commands.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/configuration/cortana-at-work/cortana-at-work-voice-commands", + "redirect_document_id": false + }, + { + "source_path": "windows/manage/cortana-at-work-voice-commands.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/configuration/cortana-at-work/cortana-at-work-voice-commands", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/cortana-at-work/set-up-and-test-cortana-in-windows-10.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/configuration/cortana-at-work/set-up-and-test-cortana-in-windows-10", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/cortana-at-work/test-scenario-1.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/configuration/cortana-at-work/test-scenario-1", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/cortana-at-work/test-scenario-2.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/configuration/cortana-at-work/test-scenario-2", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/cortana-at-work/test-scenario-3.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/configuration/cortana-at-work/test-scenario-3", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/cortana-at-work/test-scenario-4.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/configuration/cortana-at-work/test-scenario-4", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/cortana-at-work/test-scenario-5.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/configuration/cortana-at-work/test-scenario-5", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/cortana-at-work/test-scenario-6.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/configuration/cortana-at-work/test-scenario-6", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/cortana-at-work/testing-scenarios-using-cortana-in-business-org.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/configuration/cortana-at-work/testing-scenarios-using-cortana-in-business-org", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/kiosk/lockdown-features-windows-10.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/configuration/kiosk/lockdown-features-windows-10", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/kiosk/find-the-application-user-model-id-of-an-installed-app.md", + "redirect_url": "/windows/configuration/store/find-aumid", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/kiosk/lock-down-windows-10-applocker.md", + "redirect_url": "/windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-overview", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/kiosk/lock-down-windows-10-to-specific-apps.md", + "redirect_url": "/windows/configuration/assigned-access/configuration-file", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/assigned-access/create-xml.md", + "redirect_url": "/windows/configuration/assigned-access/configuration-file", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/kiosk/lock-down-windows-11-to-specific-apps.md", + "redirect_url": "/windows/configuration/assigned-access/configuration-file", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/kiosk/kiosk-additional-reference.md", + "redirect_url": "/windows/configuration/assigned-access", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/kiosk/kiosk-mdm-bridge.md", + "redirect_url": "/windows/configuration/assigned-access/quickstart-kiosk", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/kiosk/kiosk-policies.md", + "redirect_url": "/windows/configuration/assigned-access/policy-settings", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/kiosk/kiosk-shelllauncher.md", + "redirect_url": "/windows/configuration/assigned-access/shell-launcher", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/kiosk/kiosk-validate.md", + "redirect_url": "/windows/configuration/assigned-access/overview", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/kiosk/kiosk-xml.md", + "redirect_url": "/windows/configuration/assigned-access/configuration-file", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/kiosk/setup-digital-signage.md", + "redirect_url": "/windows/configuration/assigned-access/overview", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/kiosk/kiosk-single-app.md", + "redirect_url": "/windows/configuration/assigned-access/overview", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/kiosk/kiosk-methods.md", + "redirect_url": "/windows/configuration/assigned-access", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/kiosk/guidelines-for-assigned-access-app.md", + "redirect_url": "/windows/configuration/assigned-access/overview", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/kiosk/kiosk-prepare.md", + "redirect_url": "/windows/configuration/assigned-access/recommendations", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/start/customize-start-menu-layout-windows-11.md", + "redirect_url": "/windows/configuration/start/layout", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/start/customize-windows-10-start-screens-by-using-group-policy.md", + "redirect_url": "/windows/configuration/start/layout", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/start/customize-windows-10-start-screens-by-using-mobile-device-management.md", + "redirect_url": "/windows/configuration/start/layout", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/start/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md", + "redirect_url": "/windows/configuration/start/layout", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/taskbar/configure-windows-10-taskbar.md", + "redirect_url": "/windows/configuration/taskbar/", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/taskbar/customize-taskbar-windows-11.md", + "redirect_url": "/windows/configuration/taskbar/", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/start/supported-csp-start-menu-layout-windows.md", + "redirect_url": "/windows/configuration/start/policy-settings", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/tips/manage-tips-and-suggestions.md", + "redirect_url": "/windows/configuration", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/taskbar/configure.md", + "redirect_url": "/windows/configuration/taskbar/", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/taskbar/supported-csp-taskbar-windows.md", + "redirect_url": "/windows/configuration/taskbar/policy-settings", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/start/start-layout-xml-desktop.md", + "redirect_url": "/windows/configuration/start/layout", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/start/customize-and-export-start-layout.md", + "redirect_url": "/windows/configuration/start/layout", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/start/windows-10-start-layout-options-and-policies.md", + "redirect_url": "/windows/configuration/start/policy-settings", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/start/start-secondary-tiles.md", + "redirect_url": "/windows/configuration/start/layout", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/ue-v/uev-administering-uev-with-windows-powershell-and-wmi.md", + "redirect_url": "/microsoft-desktop-optimization-pack/ue-v/uev-administering-uev-with-windows-powershell-and-wmi", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/ue-v/uev-administering-uev.md", + "redirect_url": "/microsoft-desktop-optimization-pack/ue-v/uev-administering-uev", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/ue-v/uev-application-template-schema-reference.md", + "redirect_url": "/microsoft-desktop-optimization-pack/ue-v/uev-application-template-schema-reference", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/ue-v/uev-changing-the-frequency-of-scheduled-tasks.md", + "redirect_url": "/microsoft-desktop-optimization-pack/ue-v/uev-changing-the-frequency-of-scheduled-tasks", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/ue-v/uev-configuring-uev-with-group-policy-objects.md", + "redirect_url": "/microsoft-desktop-optimization-pack/ue-v/uev-configuring-uev-with-group-policy-objects", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/ue-v/uev-configuring-uev-with-system-center-configuration-manager.md", + "redirect_url": "/microsoft-desktop-optimization-pack/ue-v/uev-configuring-uev-with-system-center-configuration-manager", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/ue-v/uev-deploy-required-features.md", + "redirect_url": "/microsoft-desktop-optimization-pack/ue-v/uev-deploy-required-features", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/ue-v/uev-deploy-uev-for-custom-applications.md", + "redirect_url": "/microsoft-desktop-optimization-pack/ue-v/uev-deploy-uev-for-custom-applications", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/ue-v/uev-for-windows.md", + "redirect_url": "/microsoft-desktop-optimization-pack/ue-v/uev-for-windows", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/ue-v/uev-getting-started.md", + "redirect_url": "/microsoft-desktop-optimization-pack/ue-v/uev-getting-started", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/ue-v/uev-manage-administrative-backup-and-restore.md", + "redirect_url": "/microsoft-desktop-optimization-pack/ue-v/uev-manage-administrative-backup-and-restore", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/ue-v/uev-manage-configurations.md", + "redirect_url": "/microsoft-desktop-optimization-pack/ue-v/uev-manage-configurations", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/ue-v/uev-managing-settings-location-templates-using-windows-powershell-and-wmi.md", + "redirect_url": "/microsoft-desktop-optimization-pack/ue-v/uev-managing-settings-location-templates-using-windows-powershell-and-wmi", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/ue-v/uev-managing-uev-agent-and-packages-with-windows-powershell-and-wmi.md", + "redirect_url": "/microsoft-desktop-optimization-pack/ue-v/uev-managing-uev-agent-and-packages-with-windows-powershell-and-wmi", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/ue-v/uev-migrating-settings-packages.md", + "redirect_url": "/microsoft-desktop-optimization-pack/ue-v/uev-migrating-settings-packages", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/ue-v/uev-prepare-for-deployment.md", + "redirect_url": "/microsoft-desktop-optimization-pack/ue-v/uev-prepare-for-deployment", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/ue-v/uev-release-notes-1607.md", + "redirect_url": "/microsoft-desktop-optimization-pack/ue-v/uev-release-notes-1607", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/ue-v/uev-security-considerations.md", + "redirect_url": "/microsoft-desktop-optimization-pack/ue-v/uev-security-considerations", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/ue-v/uev-sync-methods.md", + "redirect_url": "/microsoft-desktop-optimization-pack/ue-v/uev-sync-methods", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/ue-v/uev-sync-trigger-events.md", + "redirect_url": "/microsoft-desktop-optimization-pack/ue-v/uev-sync-trigger-events", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/ue-v/uev-synchronizing-microsoft-office-with-uev.md", + "redirect_url": "/microsoft-desktop-optimization-pack/ue-v/uev-synchronizing-microsoft-office-with-uev", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/ue-v/uev-technical-reference.md", + "redirect_url": "/microsoft-desktop-optimization-pack/ue-v/uev-technical-reference", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/ue-v/uev-troubleshooting.md", + "redirect_url": "/microsoft-desktop-optimization-pack/ue-v/uev-troubleshooting", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/ue-v/uev-upgrade-uev-from-previous-releases.md", + "redirect_url": "/microsoft-desktop-optimization-pack/ue-v/uev-upgrade-uev-from-previous-releases", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/ue-v/uev-using-uev-with-application-virtualization-applications.md", + "redirect_url": "/microsoft-desktop-optimization-pack/ue-v/uev-using-uev-with-application-virtualization-applications", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/ue-v/uev-whats-new-in-uev-for-windows.md", + "redirect_url": "/microsoft-desktop-optimization-pack/ue-v/uev-whats-new-in-uev-for-windows", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/ue-v/uev-working-with-custom-templates-and-the-uev-generator.md", + "redirect_url": "/microsoft-desktop-optimization-pack/ue-v/uev-working-with-custom-templates-and-the-uev-generator", + "redirect_document_id": false } ] } diff --git a/.openpublishing.redirection.windows-deployment.json b/.openpublishing.redirection.windows-deployment.json index 06fc754819..9fe31073d2 100644 --- a/.openpublishing.redirection.windows-deployment.json +++ b/.openpublishing.redirection.windows-deployment.json @@ -12,7 +12,7 @@ }, { "source_path": "windows/deployment/deploy-windows-mdt/deploy-a-windows-11-image-using-mdt.md", - "redirect_url": "/windows/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt", "redirect_document_id": false }, { @@ -22,17 +22,17 @@ }, { "source_path": "windows/deployment/deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md", - "redirect_url": "/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt", "redirect_document_id": false }, { "source_path": "windows/deployment/deploy-windows-mdt/key-features-in-mdt.md", - "redirect_url": "/windows/deployment/deploy-windows-mdt/get-started-with-the-microsoft-deployment-toolkit#key-features-in-mdt", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/deploy-windows-mdt/get-started-with-the-microsoft-deployment-toolkit#key-features-in-mdt", "redirect_document_id": false }, { "source_path": "windows/deployment/deploy-windows-mdt/mdt-lite-touch-components.md", - "redirect_url": "/windows/deployment/deploy-windows-mdt/get-started-with-the-microsoft-deployment-toolkit#mdt-lite-touch-components", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/deploy-windows-mdt/get-started-with-the-microsoft-deployment-toolkit#mdt-lite-touch-components", "redirect_document_id": false }, { @@ -187,7 +187,7 @@ }, { "source_path": "windows/deployment/update/change-history-for-update-windows-10.md", - "redirect_url": "/windows/deployment/deploy-whats-new", + "redirect_url": "/windows/deployment/", "redirect_document_id": false }, { @@ -692,7 +692,7 @@ }, { "source_path": "windows/deployment/upgrade/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md", - "redirect_url": "/windows/deployment/deploy-windows-mdt/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/deploy-windows-mdt/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit", "redirect_document_id": false }, { @@ -754,7 +754,7 @@ "source_path": "windows/deployment/do/mcc-enterprise-portal-deploy.md", "redirect_url": "/windows/deployment/do/mcc-enterprise-deploy", "redirect_document_id": false - }, + }, { "source_path": "windows/deployment/windows-autopatch/deploy/index.md", "redirect_url": "/windows/deployment/windows-autopatch/deploy/windows-autopatch-admin-contacts", @@ -791,8 +791,8 @@ "redirect_document_id": true }, { - "source_path": "windows/deployment/windows-autopatch/operate/windows-autopatch-windows-feature-update-overview.md", - "redirect_url": "/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-feature-update-overview", + "source_path": "windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-feature-update-overview.md", + "redirect_url": "/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-feature-update-overview", "redirect_document_id": true }, { @@ -806,8 +806,8 @@ "redirect_document_id": true }, { - "source_path": "windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-communications.md", - "redirect_url": "/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-communications", + "source_path": "windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-communications.md", + "redirect_url": "/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-communications", "redirect_document_id": true }, { @@ -816,8 +816,8 @@ "redirect_document_id": false }, { - "source_path": "windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-end-user-exp.md", - "redirect_url": "/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-end-user-exp", + "source_path": "windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-end-user-exp.md", + "redirect_url": "/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-end-user-exp", "redirect_document_id": true }, { @@ -826,8 +826,8 @@ "redirect_document_id": false }, { - "source_path": "windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-overview.md", - "redirect_url": "/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-overview", + "source_path": "windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-overview.md", + "redirect_url": "/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-overview", "redirect_document_id": true }, { @@ -836,13 +836,13 @@ "redirect_document_id": true }, { - "source_path": "windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-signals.md", - "redirect_url": "/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-signals", + "source_path": "windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-signals.md", + "redirect_url": "/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-signals", "redirect_document_id": true }, { - "source_path": "windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-summary-dashboard.md", - "redirect_url": "/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-summary-dashboard", + "source_path": "windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-summary-dashboard.md", + "redirect_url": "/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-summary-dashboard", "redirect_document_id": true }, { @@ -1114,6 +1114,81 @@ "source_path": "windows/deployment/windows-autopilot/windows-autopilot.md", "redirect_url": "/mem/autopilot/windows-autopilot", "redirect_document_id": false + }, + { + "source_path": "windows/deployment/deploy-whats-new.md", + "redirect_url": "/windows/deployment/", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/Windows-AutoPilot-EULA-note.md", + "redirect_url": "/legal/windows/windows-autopilot-eula-note", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/windows-10-missing-fonts.md", + "redirect_url": "/windows/deployment/windows-missing-fonts", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/volume-activation/volume-activation-windows-10.md", + "redirect_url": "/windows/deployment/volume-activation/volume-activation-windows", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/volume-activation/activate-windows-10-clients-vamt.md", + "redirect_url": "/windows/deployment/volume-activation/activate-windows-clients-vamt", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/windows-autopatch/operate/windows-autopatch-groups-manage-windows-feature-update-release.md", + "redirect_url": "/windows/deployment/windows-autopatch/operate/windows-autopatch-manage-windows-feature-update-releases", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-trending-report.md", + "redirect_url": "/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-trending-report", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-status-report.md", + "redirect_url": "/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-status-report", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-update.md", + "redirect_url": "/windows/deployment/windows-autopatch/operate/windows-autopatch-customize-windows-update-settings", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-feature-update-status-report.md", + "redirect_url": "/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-feature-update-status-report", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-feature-update-summary-dashboard.md", + "redirect_url": "/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-feature-update-summary-dashboard", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-feature-update-trending-report.md", + "redirect_url": "/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-feature-update-trending-report", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-and-feature-update-reports-overview.md", + "redirect_url": "/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-and-feature-update-reports-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/planning/windows-10-compatibility.md", + "redirect_url": "/windows/compatibility/", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/update/plan-determine-app-readiness.md", + "redirect_url": "/windows/compatibility/windows-11/testing-guidelines", + "redirect_document_id": false } ] } diff --git a/.openpublishing.redirection.windows-security.json b/.openpublishing.redirection.windows-security.json index be07145db2..471c829ed5 100644 --- a/.openpublishing.redirection.windows-security.json +++ b/.openpublishing.redirection.windows-security.json @@ -15,6 +15,21 @@ "redirect_url": "/windows/security/application-security/application-control/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control", "redirect_document_id": false }, + { + "source_path": "windows/security/threat-protection/override-mitigation-options-for-app-related-security-policies.md", + "redirect_url": "/windows/security/operating-system-security/device-management/override-mitigation-options-for-app-related-security-policies", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/block-untrusted-fonts-in-enterprise.md", + "redirect_url": "/windows/security/operating-system-security/device-management/block-untrusted-fonts-in-enterprise", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection.md", + "redirect_url": "/windows/security/operating-system-security/device-management/use-windows-event-forwarding-to-assist-in-intrusion-detection", + "redirect_document_id": false + }, { "source_path": "windows/security//threat-protection/mbsa-removal-and-guidance.md", "redirect_url": "/windows/security/operating-system-security/device-management/windows-security-configuration-framework/mbsa-removal-and-guidance", @@ -1437,12 +1452,12 @@ }, { "source_path": "windows/security/threat-protection/intelligence/av-tests.md", - "redirect_url": "/windows/security/threat-protection/intelligence/top-scoring-industry-antivirus-tests", + "redirect_url": "/microsoft-365/security/defender/top-scoring-industry-antivirus-tests.md", "redirect_document_id": false }, { "source_path": "windows/security/threat-protection/intelligence/coinminer-malware.md", - "redirect_url": "/microsoft-365/security/intelligence/coinminer-malware", + "redirect_url": "/microsoft-365/security/defender-endpoint/malware/coinminer-malware", "redirect_document_id": false }, { @@ -1452,12 +1467,12 @@ }, { "source_path": "windows/security/threat-protection/intelligence/criteria.md", - "redirect_url": "/microsoft-365/security/intelligence/criteria", + "redirect_url": "/microsoft-365/security/defender/criteria", "redirect_document_id": false }, { "source_path": "windows/security/threat-protection/intelligence/cybersecurity-industry-partners.md", - "redirect_url": "/microsoft-365/security/intelligence/cybersecurity-industry-partners", + "redirect_url": "/microsoft-365/security/defender/virus-initiative-criteria", "redirect_document_id": false }, { @@ -1472,17 +1487,17 @@ }, { "source_path": "windows/security/threat-protection/intelligence/exploits-malware.md", - "redirect_url": "/microsoft-365/security/intelligence/exploits-malware", + "redirect_url": "/microsoft-365/security/defender-endpoint/malware/exploits-malware", "redirect_document_id": false }, { "source_path": "windows/security/threat-protection/intelligence/fileless-threats.md", - "redirect_url": "/microsoft-365/security/intelligence/fileless-threats", + "redirect_url": "/microsoft-365/security/defender-endpoint/malware/fileless-threats", "redirect_document_id": false }, { "source_path": "windows/security/threat-protection/intelligence/macro-malware.md", - "redirect_url": "/microsoft-365/security/intelligence/macro-malware", + "redirect_url": "/microsoft-365/security/defender-endpoint/malware/macro-malware", "redirect_document_id": false }, { @@ -1492,12 +1507,12 @@ }, { "source_path": "windows/security/threat-protection/intelligence/phishing-trends.md", - "redirect_url": "/microsoft-365/security/intelligence/phishing-trends", + "redirect_url": "/microsoft-365/security/defender-endpoint/malware/phishing-trends", "redirect_document_id": false }, { "source_path": "windows/security/threat-protection/intelligence/phishing.md", - "redirect_url": "/microsoft-365/security/intelligence/phishing", + "redirect_url": "/microsoft-365/security/defender-endpoint/malware/phishing", "redirect_document_id": false }, { @@ -1507,7 +1522,7 @@ }, { "source_path": "windows/security/threat-protection/intelligence/prevent-malware-infection.md", - "redirect_url": "/microsoft-365/security/intelligence/prevent-malware-infection", + "redirect_url": "/microsoft-365/security/defender-endpoint/malware/prevent-malware-infection", "redirect_document_id": false }, { @@ -4560,6 +4575,11 @@ "redirect_url": "/windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-settings", "redirect_document_id": false }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-settings.md", + "redirect_url": "/windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-overview", + "redirect_document_id": false + }, { "source_path": "windows/security/threat-protection/windows-defender-application-control/applocker/applocker-technical-reference.md", "redirect_url": "/windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-technical-reference", @@ -4660,6 +4680,11 @@ "redirect_url": "/windows/security/application-security/application-control/windows-defender-application-control/applocker/determine-your-application-control-objectives", "redirect_document_id": false }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/determine-your-application-control-objectives.md", + "redirect_url": "/windows/security/application-security/application-control/windows-defender-application-control/wdac-and-applocker-overview", + "redirect_document_id": false + }, { "source_path": "windows/security/threat-protection/windows-defender-application-control/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md", "redirect_url": "/windows/security/application-security/application-control/windows-defender-application-control/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application", @@ -4830,6 +4855,11 @@ "redirect_url": "/windows/security/application-security/application-control/windows-defender-application-control/applocker/understand-applocker-enforcement-settings", "redirect_document_id": false }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/understand-applocker-enforcement-settings.md", + "redirect_url": "/windows/security/application-security/application-control/windows-defender-application-control/applocker/working-with-applocker-rules#enforcement-modes", + "redirect_document_id": false + }, { "source_path": "windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-policy-design-decisions.md", "redirect_url": "/windows/security/application-security/application-control/windows-defender-application-control/applocker/understand-applocker-policy-design-decisions", @@ -4900,6 +4930,11 @@ "redirect_url": "/windows/security/application-security/application-control/windows-defender-application-control/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain", "redirect_document_id": false }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain.md", + "redirect_url": "/windows/security/application-security/application-control/windows-defender-application-control/wdac", + "redirect_document_id": false + }, { "source_path": "windows/security/threat-protection/windows-defender-application-control/applocker/use-the-applocker-windows-powershell-cmdlets.md", "redirect_url": "/windows/security/application-security/application-control/windows-defender-application-control/applocker/use-the-applocker-windows-powershell-cmdlets", @@ -4915,6 +4950,11 @@ "redirect_url": "/windows/security/application-security/application-control/windows-defender-application-control/applocker/using-software-restriction-policies-and-applocker-policies", "redirect_document_id": false }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/using-software-restriction-policies-and-applocker-policies.md", + "redirect_url": "/windows/security/application-security/application-control/windows-defender-application-control/wdac", + "redirect_document_id": false + }, { "source_path": "windows/security/threat-protection/windows-defender-application-control/applocker/what-is-applocker.md", "redirect_url": "/windows/security/application-security/application-control/windows-defender-application-control/applocker/what-is-applocker", @@ -8039,6 +8079,1106 @@ "source_path": "windows/security/operating-system-security/network-security/windows-firewall/firewall-settings-lost-on-upgrade.md", "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall", "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/rdp-sign-in", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/rdp-sign-in", + "redirect_document_id": false + }, + { + "source_path": "windows/security/security-foundations/msft-security-dev-lifecycle.md", + "redirect_url": "/compliance/assurance/assurance-microsoft-security-development-lifecycle", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/pin-reset", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers.md", + "redirect_url": "/windows-server/administration/performance-tuning/role/active-directory-server/capacity-planning-for-active-directory-domain-services", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-ad-prereq.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-deployment-cert-trust.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust-adfs", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust-enroll", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-validate-pki.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust-pki", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust-adfs", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust-enroll", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-deploy-mfa.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust-mfa", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-pki.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust-pki", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-deployment-key-trust.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-aad-join-cloud-only-deploy.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/cloud", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-hybrid-cloud-kerberos-trust-provision.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/how-it-works#provisioning", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-hybrid-cloud-kerberos-trust.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/hybrid-cloud-kerberos-trust", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-provision.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust-enroll", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-validate-pki.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust-pki", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-deployment-guide.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust-adfs", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-key-trust-policy-settings.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust-enroll", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust-mfa", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-identity-verification.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/requirements", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust-mfa.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust-adfs", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust-mfa.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust-adfs", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/deploy/requirements.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/multifactor-unlock", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-and-password-changes.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/how-it-works", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/how-it-works", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-how-it-works.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/how-it-works", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-how-it-works-authentication.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/how-it-works-authentication", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/how-it-works-provisioning", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/policy-settings", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-planning-guide.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-prepare-people-to-use.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/prepare-users", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/passwordless-strategy.md", + "redirect_url": "/windows/security/identity-protection/passwordless-strategy/", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/deploy/cloud.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/cloud-only", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/deploy/hybrid-cloud-kerberos-trust-enroll.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/hybrid-cloud-kerberos-trust", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust-pki.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust-pki.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-videos.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-faq.yml", + "redirect_url": "/windows/security/identity-protection/hello-for-business/faq", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust-pki.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/access-credential-manager-as-a-trusted-caller.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/access-credential-manager-as-a-trusted-caller", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/access-this-computer-from-the-network.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/access-this-computer-from-the-network", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/account-lockout-duration.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/account-lockout-duration", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/account-lockout-policy.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/account-lockout-policy", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/account-lockout-threshold.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/account-lockout-threshold", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/account-policies.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/account-policies", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/accounts-administrator-account-status.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/accounts-administrator-account-status", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/accounts-block-microsoft-accounts.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/accounts-block-microsoft-accounts", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/accounts-guest-account-status.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/accounts-guest-account-status", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/accounts-limit-local-account-use-of-blank-passwords-to-console-logon-only.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/accounts-limit-local-account-use-of-blank-passwords-to-console-logon-only", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/accounts-rename-administrator-account.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/accounts-rename-administrator-account", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/accounts-rename-guest-account.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/accounts-rename-guest-account", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/act-as-part-of-the-operating-system.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/act-as-part-of-the-operating-system", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/add-workstations-to-domain.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/add-workstations-to-domain", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/adjust-memory-quotas-for-a-process.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/adjust-memory-quotas-for-a-process", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/administer-security-policy-settings.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/administer-security-policy-settings", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/allow-log-on-locally.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/allow-log-on-locally", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/allow-log-on-through-remote-desktop-services.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/allow-log-on-through-remote-desktop-services", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/audit-audit-the-access-of-global-system-objects.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/audit-audit-the-access-of-global-system-objects", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/audit-audit-the-use-of-backup-and-restore-privilege.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/audit-audit-the-use-of-backup-and-restore-privilege", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/audit-force-audit-policy-subcategory-settings-to-override.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/audit-force-audit-policy-subcategory-settings-to-override", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/audit-policy.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/audit-policy", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/audit-shut-down-system-immediately-if-unable-to-log-security-audits.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/audit-shut-down-system-immediately-if-unable-to-log-security-audits", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/back-up-files-and-directories.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/back-up-files-and-directories", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/bypass-traverse-checking.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/bypass-traverse-checking", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/change-the-system-time.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/change-the-system-time", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/change-the-time-zone.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/change-the-time-zone", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/create-a-pagefile.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/create-a-pagefile", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/create-a-token-object.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/create-a-token-object", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/create-global-objects.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/create-global-objects", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/create-permanent-shared-objects.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/create-permanent-shared-objects", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/create-symbolic-links.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/create-symbolic-links", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/dcom-machine-access-restrictions-in-security-descriptor-definition-language-sddl-syntax.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/dcom-machine-access-restrictions-in-security-descriptor-definition-language-sddl-syntax", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/debug-programs.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/debug-programs", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/deny-access-to-this-computer-from-the-network.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/deny-access-to-this-computer-from-the-network", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/deny-log-on-as-a-batch-job.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/deny-log-on-as-a-batch-job", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/deny-log-on-as-a-service.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/deny-log-on-as-a-service", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/deny-log-on-locally.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/deny-log-on-locally", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/deny-log-on-through-remote-desktop-services.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/deny-log-on-through-remote-desktop-services", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/devices-allowed-to-format-and-eject-removable-media.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/devices-allowed-to-format-and-eject-removable-media", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/devices-allow-undock-without-having-to-log-on.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/devices-allow-undock-without-having-to-log-on", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/devices-prevent-users-from-installing-printer-drivers.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/devices-prevent-users-from-installing-printer-drivers", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/devices-restrict-cd-rom-access-to-locally-logged-on-user-only.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/devices-restrict-cd-rom-access-to-locally-logged-on-user-only", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/devices-restrict-floppy-access-to-locally-logged-on-user-only.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/devices-restrict-floppy-access-to-locally-logged-on-user-only", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/domain-controller-allow-server-operators-to-schedule-tasks.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/domain-controller-allow-server-operators-to-schedule-tasks", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/domain-controller-ldap-server-channel-binding-token-requirements.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/domain-controller-ldap-server-channel-binding-token-requirements", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/domain-controller-ldap-server-signing-requirements.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/domain-controller-ldap-server-signing-requirements", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/domain-controller-refuse-machine-account-password-changes.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/domain-controller-refuse-machine-account-password-changes", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/domain-member-digitally-encrypt-or-sign-secure-channel-data-always", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/domain-member-digitally-encrypt-secure-channel-data-when-possible.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/domain-member-digitally-encrypt-secure-channel-data-when-possible", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/domain-member-digitally-sign-secure-channel-data-when-possible.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/domain-member-digitally-sign-secure-channel-data-when-possible", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/domain-member-disable-machine-account-password-changes.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/domain-member-disable-machine-account-password-changes", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/domain-member-maximum-machine-account-password-age.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/domain-member-maximum-machine-account-password-age", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/domain-member-require-strong-windows-2000-or-later-session-key.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/domain-member-require-strong-windows-2000-or-later-session-key", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/enable-computer-and-user-accounts-to-be-trusted-for-delegation.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/enable-computer-and-user-accounts-to-be-trusted-for-delegation", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/enforce-password-history.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/enforce-password-history", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/enforce-user-logon-restrictions.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/enforce-user-logon-restrictions", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/force-shutdown-from-a-remote-system.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/force-shutdown-from-a-remote-system", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/generate-security-audits.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/generate-security-audits", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/how-to-configure-security-policy-settings.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/how-to-configure-security-policy-settings", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/impersonate-a-client-after-authentication.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/impersonate-a-client-after-authentication", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/increase-a-process-working-set.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/increase-a-process-working-set", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/increase-scheduling-priority.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/increase-scheduling-priority", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/interactive-logon-display-user-information-when-the-session-is-locked.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/interactive-logon-display-user-information-when-the-session-is-locked", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/interactive-logon-do-not-display-last-user-name.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/interactive-logon-do-not-display-last-user-name", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/interactive-logon-do-not-require-ctrl-alt-del.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/interactive-logon-do-not-require-ctrl-alt-del", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/interactive-logon-dont-display-username-at-sign-in.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/interactive-logon-dont-display-username-at-sign-in", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/interactive-logon-machine-account-lockout-threshold.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/interactive-logon-machine-account-lockout-threshold", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/interactive-logon-machine-inactivity-limit.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/interactive-logon-machine-inactivity-limit", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/interactive-logon-message-text-for-users-attempting-to-log-on.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/interactive-logon-message-text-for-users-attempting-to-log-on", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/interactive-logon-message-title-for-users-attempting-to-log-on.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/interactive-logon-message-title-for-users-attempting-to-log-on", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/interactive-logon-prompt-user-to-change-password-before-expiration.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/interactive-logon-prompt-user-to-change-password-before-expiration", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/interactive-logon-require-domain-controller-authentication-to-unlock-workstation.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/interactive-logon-require-domain-controller-authentication-to-unlock-workstation", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/interactive-logon-require-smart-card.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/interactive-logon-require-smart-card", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/interactive-logon-smart-card-removal-behavior.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/interactive-logon-smart-card-removal-behavior", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/kerberos-policy.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/kerberos-policy", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/load-and-unload-device-drivers.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/load-and-unload-device-drivers", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/lock-pages-in-memory.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/lock-pages-in-memory", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/log-on-as-a-batch-job.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/log-on-as-a-batch-job", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/log-on-as-a-service.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/log-on-as-a-service", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/manage-auditing-and-security-log.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/manage-auditing-and-security-log", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/maximum-lifetime-for-service-ticket.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/maximum-lifetime-for-service-ticket", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/maximum-lifetime-for-user-ticket.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/maximum-lifetime-for-user-ticket", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/maximum-lifetime-for-user-ticket-renewal.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/maximum-lifetime-for-user-ticket-renewal", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/maximum-password-age.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/maximum-password-age", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/maximum-tolerance-for-computer-clock-synchronization.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/maximum-tolerance-for-computer-clock-synchronization", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/microsoft-network-client-digitally-sign-communications-always.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/microsoft-network-client-digitally-sign-communications-always", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/microsoft-network-client-send-unencrypted-password-to-third-party-smb-servers.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/microsoft-network-client-send-unencrypted-password-to-third-party-smb-servers", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/microsoft-network-server-amount-of-idle-time-required-before-suspending-session.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/microsoft-network-server-amount-of-idle-time-required-before-suspending-session", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/microsoft-network-server-attempt-s4u2self-to-obtain-claim-information.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/microsoft-network-server-attempt-s4u2self-to-obtain-claim-information", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/microsoft-network-server-digitally-sign-communications-always.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/microsoft-network-server-digitally-sign-communications-always", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/microsoft-network-server-disconnect-clients-when-logon-hours-expire.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/microsoft-network-server-disconnect-clients-when-logon-hours-expire", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/microsoft-network-server-server-spn-target-name-validation-level.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/microsoft-network-server-server-spn-target-name-validation-level", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/minimum-password-age.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/minimum-password-age", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/minimum-password-length.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/minimum-password-length", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/modify-an-object-label.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/modify-an-object-label", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/modify-firmware-environment-values.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/modify-firmware-environment-values", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/network-access-allow-anonymous-sidname-translation.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-access-allow-anonymous-sidname-translation", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/network-access-let-everyone-permissions-apply-to-anonymous-users.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-access-let-everyone-permissions-apply-to-anonymous-users", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/network-access-named-pipes-that-can-be-accessed-anonymously.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-access-named-pipes-that-can-be-accessed-anonymously", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/network-access-remotely-accessible-registry-paths.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-access-remotely-accessible-registry-paths", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/network-access-remotely-accessible-registry-paths-and-subpaths.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-access-remotely-accessible-registry-paths-and-subpaths", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/network-access-restrict-anonymous-access-to-named-pipes-and-shares.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-access-restrict-anonymous-access-to-named-pipes-and-shares", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/network-access-shares-that-can-be-accessed-anonymously.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-access-shares-that-can-be-accessed-anonymously", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/network-access-sharing-and-security-model-for-local-accounts.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-access-sharing-and-security-model-for-local-accounts", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/network-list-manager-policies.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-list-manager-policies", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/network-security-allow-localsystem-null-session-fallback.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-security-allow-localsystem-null-session-fallback", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/network-security-allow-local-system-to-use-computer-identity-for-ntlm.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-security-allow-local-system-to-use-computer-identity-for-ntlm", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/network-security-configure-encryption-types-allowed-for-kerberos.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-security-configure-encryption-types-allowed-for-kerberos", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/network-security-do-not-store-lan-manager-hash-value-on-next-password-change.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-security-do-not-store-lan-manager-hash-value-on-next-password-change", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/network-security-force-logoff-when-logon-hours-expire.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-security-force-logoff-when-logon-hours-expire", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/network-security-lan-manager-authentication-level.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-security-lan-manager-authentication-level", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/network-security-ldap-client-signing-requirements.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-security-ldap-client-signing-requirements", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-clients.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-clients", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-add-server-exceptions-in-this-domain.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-add-server-exceptions-in-this-domain", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-audit-incoming-ntlm-traffic.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-audit-incoming-ntlm-traffic", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-incoming-ntlm-traffic.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-incoming-ntlm-traffic", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-ntlm-authentication-in-this-domain.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-ntlm-authentication-in-this-domain", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/password-policy.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/password-policy", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/perform-volume-maintenance-tasks.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/perform-volume-maintenance-tasks", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/profile-single-process.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/profile-single-process", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/profile-system-performance.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/profile-system-performance", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/recovery-console-allow-automatic-administrative-logon.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/recovery-console-allow-automatic-administrative-logon", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/recovery-console-allow-floppy-copy-and-access-to-all-drives-and-folders.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/recovery-console-allow-floppy-copy-and-access-to-all-drives-and-folders", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/remove-computer-from-docking-station.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/remove-computer-from-docking-station", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/replace-a-process-level-token.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/replace-a-process-level-token", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/reset-account-lockout-counter-after.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/reset-account-lockout-counter-after", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/restore-files-and-directories.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/restore-files-and-directories", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/secpol-advanced-security-audit-policy-settings.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/secpol-advanced-security-audit-policy-settings", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/security-options.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/security-options", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/security-policy-settings.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/security-policy-settings", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/security-policy-settings-reference.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/security-policy-settings-reference", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/shutdown-allow-system-to-be-shut-down-without-having-to-log-on.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/shutdown-allow-system-to-be-shut-down-without-having-to-log-on", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/shutdown-clear-virtual-memory-pagefile.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/shutdown-clear-virtual-memory-pagefile", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/shut-down-the-system.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/shut-down-the-system", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/store-passwords-using-reversible-encryption.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/store-passwords-using-reversible-encryption", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/synchronize-directory-service-data.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/synchronize-directory-service-data", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/system-cryptography-force-strong-key-protection-for-user-keys-stored-on-the-computer.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/system-cryptography-force-strong-key-protection-for-user-keys-stored-on-the-computer", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/system-objects-require-case-insensitivity-for-non-windows-subsystems.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/system-objects-require-case-insensitivity-for-non-windows-subsystems", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/system-objects-strengthen-default-permissions-of-internal-system-objects.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/system-objects-strengthen-default-permissions-of-internal-system-objects", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/system-settings-optional-subsystems.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/system-settings-optional-subsystems", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/system-settings-use-certificate-rules-on-windows-executables-for-software-restriction-policies.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/system-settings-use-certificate-rules-on-windows-executables-for-software-restriction-policies", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/take-ownership-of-files-or-other-objects.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/take-ownership-of-files-or-other-objects", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/user-account-control-admin-approval-mode-for-the-built-in-administrator-account.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/user-account-control-admin-approval-mode-for-the-built-in-administrator-account", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-standard-users.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-standard-users", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/user-account-control-detect-application-installations-and-prompt-for-elevation.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/user-account-control-detect-application-installations-and-prompt-for-elevation", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/user-account-control-only-elevate-executables-that-are-signed-and-validated.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/user-account-control-only-elevate-executables-that-are-signed-and-validated", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/user-account-control-run-all-administrators-in-admin-approval-mode.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/user-account-control-run-all-administrators-in-admin-approval-mode", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/user-rights-assignment.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/user-rights-assignment", + "redirect_document_id": false + }, + { + "source_path": "windows/security/cloud-security/index.md", + "redirect_url": "/windows/security/cloud-services", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-feature-dual-enrollment.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/dual-enrollment", + "redirect_document_id": false } ] -} \ No newline at end of file +} diff --git a/.openpublishing.redirection.windows-whats-new.json b/.openpublishing.redirection.windows-whats-new.json index 6a9debfcc4..b72627e6c6 100644 --- a/.openpublishing.redirection.windows-whats-new.json +++ b/.openpublishing.redirection.windows-whats-new.json @@ -1,114 +1,179 @@ { - "redirections": [ - { - "source_path": "windows/whats-new/applocker.md", - "redirect_url": "/windows/whats-new/whats-new-windows-10-version-1507-and-1511", - "redirect_document_id": false - }, - { - "source_path": "windows/whats-new/bitlocker.md", - "redirect_url": "/windows/whats-new/whats-new-windows-10-version-1507-and-1511", - "redirect_document_id": false - }, - { - "source_path": "windows/whats-new/change-history-for-what-s-new-in-windows-10.md", - "redirect_url": "/windows/whats-new/index", - "redirect_document_id": false - }, - { - "source_path": "windows/whats-new/contribute-to-a-topic.md", - "redirect_url": "https://github.com/MicrosoftDocs/windows-itpro-docs/blob/public/CONTRIBUTING.md#editing-windows-it-professional-documentation", - "redirect_document_id": false - }, - { - "source_path": "windows/whats-new/credential-guard.md", - "redirect_url": "/windows/whats-new/whats-new-windows-10-version-1507-and-1511", - "redirect_document_id": false - }, - { - "source_path": "windows/whats-new/device-guard-overview.md", - "redirect_url": "/windows/security/threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control", - "redirect_document_id": false - }, - { - "source_path": "windows/whats-new/device-management.md", - "redirect_url": "/windows/client-management/index", - "redirect_document_id": false - }, - { - "source_path": "windows/whats-new/edge-ie11-whats-new-overview.md", - "redirect_url": "/microsoft-edge/deploy/emie-to-improve-compatibility", - "redirect_document_id": false - }, - { - "source_path": "windows/whats-new/edp-whats-new-overview.md", - "redirect_url": "/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip", - "redirect_document_id": false - }, - { - "source_path": "windows/whats-new/lockdown-features-windows-10.md", - "redirect_url": "/windows/configuration/lockdown-features-windows-10", - "redirect_document_id": false - }, - { - "source_path": "windows/whats-new/microsoft-passport.md", - "redirect_url": "/windows/access-protection/hello-for-business/hello-identity-verification", - "redirect_document_id": false - }, - { - "source_path": "windows/whats-new/new-provisioning-packages.md", - "redirect_url": "/windows/configuration/provisioning-packages/provisioning-packages", - "redirect_document_id": false - }, - { - "source_path": "windows/whats-new/security-auditing.md", - "redirect_url": "/windows/whats-new/whats-new-windows-10-version-1507-and-1511", - "redirect_document_id": false - }, - { - "source_path": "windows/whats-new/security.md", - "redirect_url": "/windows/threat-protection/overview-of-threat-mitigations-in-windows-10", - "redirect_document_id": false - }, - { - "source_path": "windows/whats-new/trusted-platform-module.md", - "redirect_url": "/windows/device-security/tpm/trusted-platform-module-overview", - "redirect_document_id": false - }, - { - "source_path": "windows/whats-new/user-account-control.md", - "redirect_url": "/windows/whats-new/whats-new-windows-10-version-1507-and-1511", - "redirect_document_id": false - }, - { - "source_path": "windows/whats-new/windows-10-insider-preview.md", - "redirect_url": "/windows/whats-new", - "redirect_document_id": false - }, - { - "source_path": "windows/whats-new/windows-11-whats-new.md", - "redirect_url": "/windows/whats-new/windows-11-overview", - "redirect_document_id": false - }, - { - "source_path": "windows/whats-new/windows-11.md", - "redirect_url": "/windows/whats-new/windows-11-whats-new", - "redirect_document_id": false - }, - { - "source_path": "windows/whats-new/windows-spotlight.md", - "redirect_url": "/windows/configuration/windows-spotlight", - "redirect_document_id": false - }, - { - "source_path": "windows/whats-new/windows-store-for-business-overview.md", - "redirect_url": "/microsoft-store/windows-store-for-business-overview", - "redirect_document_id": false - }, - { - "source_path": "windows/whats-new/windows-update-for-business.md", - "redirect_url": "/windows/whats-new/whats-new-windows-10-version-1507-and-1511", - "redirect_document_id": false - } - ] + "redirections":[ + { + "source_path":"windows/whats-new/applocker.md", + "redirect_url":"/previous-versions/windows/it-pro/windows-10/whats-new/whats-new-windows-10-version-1507-and-1511", + "redirect_document_id":false + }, + { + "source_path":"windows/whats-new/bitlocker.md", + "redirect_url":"/previous-versions/windows/it-pro/windows-10/whats-new/whats-new-windows-10-version-1507-and-1511", + "redirect_document_id":false + }, + { + "source_path":"windows/whats-new/change-history-for-what-s-new-in-windows-10.md", + "redirect_url":"/windows/whats-new/index", + "redirect_document_id":false + }, + { + "source_path":"windows/whats-new/contribute-to-a-topic.md", + "redirect_url":"https://github.com/MicrosoftDocs/windows-itpro-docs/blob/public/CONTRIBUTING.md#editing-windows-it-professional-documentation", + "redirect_document_id":false + }, + { + "source_path":"windows/whats-new/credential-guard.md", + "redirect_url":"/previous-versions/windows/it-pro/windows-10/whats-new/whats-new-windows-10-version-1507-and-1511", + "redirect_document_id":false + }, + { + "source_path":"windows/whats-new/device-guard-overview.md", + "redirect_url":"/windows/security/threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control", + "redirect_document_id":false + }, + { + "source_path":"windows/whats-new/device-management.md", + "redirect_url":"/windows/client-management/index", + "redirect_document_id":false + }, + { + "source_path":"windows/whats-new/edge-ie11-whats-new-overview.md", + "redirect_url":"/microsoft-edge/deploy/emie-to-improve-compatibility", + "redirect_document_id":false + }, + { + "source_path":"windows/whats-new/edp-whats-new-overview.md", + "redirect_url":"/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip", + "redirect_document_id":false + }, + { + "source_path":"windows/whats-new/lockdown-features-windows-10.md", + "redirect_url":"/windows/configuration/lockdown-features-windows-10", + "redirect_document_id":false + }, + { + "source_path":"windows/whats-new/microsoft-passport.md", + "redirect_url":"/windows/access-protection/hello-for-business/hello-identity-verification", + "redirect_document_id":false + }, + { + "source_path":"windows/whats-new/new-provisioning-packages.md", + "redirect_url":"/windows/configuration/provisioning-packages/provisioning-packages", + "redirect_document_id":false + }, + { + "source_path":"windows/whats-new/security-auditing.md", + "redirect_url":"/previous-versions/windows/it-pro/windows-10/whats-new/whats-new-windows-10-version-1507-and-1511", + "redirect_document_id":false + }, + { + "source_path":"windows/whats-new/security.md", + "redirect_url":"/windows/threat-protection/overview-of-threat-mitigations-in-windows-10", + "redirect_document_id":false + }, + { + "source_path":"windows/whats-new/trusted-platform-module.md", + "redirect_url":"/windows/device-security/tpm/trusted-platform-module-overview", + "redirect_document_id":false + }, + { + "source_path":"windows/whats-new/user-account-control.md", + "redirect_url":"/previous-versions/windows/it-pro/windows-10/whats-new/whats-new-windows-10-version-1507-and-1511", + "redirect_document_id":false + }, + { + "source_path":"windows/whats-new/windows-10-insider-preview.md", + "redirect_url":"/windows/whats-new", + "redirect_document_id":false + }, + { + "source_path":"windows/whats-new/windows-11-whats-new.md", + "redirect_url":"/windows/whats-new/windows-11-overview", + "redirect_document_id":false + }, + { + "source_path":"windows/whats-new/windows-11.md", + "redirect_url":"/windows/whats-new/windows-11-whats-new", + "redirect_document_id":false + }, + { + "source_path":"windows/whats-new/windows-spotlight.md", + "redirect_url":"/windows/configuration/windows-spotlight", + "redirect_document_id":false + }, + { + "source_path":"windows/whats-new/windows-store-for-business-overview.md", + "redirect_url":"/microsoft-store/windows-store-for-business-overview", + "redirect_document_id":false + }, + { + "source_path":"windows/whats-new/windows-update-for-business.md", + "redirect_url":"/previous-versions/windows/it-pro/windows-10/whats-new/whats-new-windows-10-version-1507-and-1511", + "redirect_document_id":false + }, + { + "source_path":"windows/whats-new/whats-new-windows-10-version-1507-and-1511.md", + "redirect_url":"/previous-versions/windows/it-pro/windows-10/whats-new/whats-new-windows-10-version-1507-and-1511", + "redirect_document_id":false + }, + { + "source_path":"windows/whats-new/whats-new-windows-10-version-1607.md", + "redirect_url":"/previous-versions/windows/it-pro/windows-10/whats-new/whats-new-windows-10-version-1607", + "redirect_document_id":false + }, + { + "source_path":"windows/whats-new/whats-new-windows-10-version-1703.md", + "redirect_url":"/previous-versions/windows/it-pro/windows-10/whats-new/whats-new-windows-10-version-1703", + "redirect_document_id":false + }, + { + "source_path":"windows/whats-new/whats-new-windows-10-version-1709.md", + "redirect_url":"/previous-versions/windows/it-pro/windows-10/whats-new/whats-new-windows-10-version-1709", + "redirect_document_id":false + }, + { + "source_path":"windows/whats-new/whats-new-windows-10-version-1803.md", + "redirect_url":"/previous-versions/windows/it-pro/windows-10/whats-new/whats-new-windows-10-version-1803", + "redirect_document_id":false + }, + { + "source_path":"windows/whats-new/whats-new-windows-10-version-1809.md", + "redirect_url":"/previous-versions/windows/it-pro/windows-10/whats-new/whats-new-windows-10-version-1809", + "redirect_document_id":false + }, + { + "source_path":"windows/whats-new/whats-new-windows-10-version-1903.md", + "redirect_url":"/previous-versions/windows/it-pro/windows-10/whats-new/whats-new-windows-10-version-1903", + "redirect_document_id":false + }, + { + "source_path":"windows/whats-new/whats-new-windows-10-version-1909.md", + "redirect_url":"/previous-versions/windows/it-pro/windows-10/whats-new/whats-new-windows-10-version-1909", + "redirect_document_id":false + }, + { + "source_path":"windows/whats-new/whats-new-windows-10-version-2004.md", + "redirect_url":"/previous-versions/windows/it-pro/windows-10/whats-new/whats-new-windows-10-version-2004", + "redirect_document_id":false + }, + { + "source_path":"windows/whats-new/whats-new-windows-10-version-20H2.md", + "redirect_url":"/previous-versions/windows/it-pro/windows-10/whats-new/whats-new-windows-10-version-20H2", + "redirect_document_id":false + }, + { + "source_path":"windows/whats-new/whats-new-windows-10-version-21H1.md", + "redirect_url":"/previous-versions/windows/it-pro/windows-10/whats-new/whats-new-windows-10-version-21H1", + "redirect_document_id":false + }, + { + "source_path":"windows/whats-new/whats-new-windows-10-version-21H2.md", + "redirect_url":"/previous-versions/windows/it-pro/windows-10/whats-new/whats-new-windows-10-version-21H2", + "redirect_document_id":false + }, + { + "source_path":"windows/whats-new/ltsc/index.yml", + "redirect_url":"/windows/whats-new/", + "redirect_document_id":false + } + ] } diff --git a/browsers/TOC.yml b/browsers/TOC.yml deleted file mode 100644 index e396fab3f5..0000000000 --- a/browsers/TOC.yml +++ /dev/null @@ -1,6 +0,0 @@ -- name: Table of Contents - items: - - name: Microsoft Edge - href: edge/index.md - - name: Internet Explorer 11 - href: internet-explorer/index.md diff --git a/browsers/edge/TOC.yml b/browsers/edge/TOC.yml deleted file mode 100644 index 94af3357b5..0000000000 --- a/browsers/edge/TOC.yml +++ /dev/null @@ -1,7 +0,0 @@ -- name: Microsoft Edge deployment for IT Pros - href: index.yml - items: - - name: Group policies & configuration options - href: group-policies/index.yml - - name: Microsoft Edge Frequently Asked Questions (FAQ) - href: microsoft-edge-faq.yml diff --git a/browsers/edge/breadcrumb/toc.yml b/browsers/edge/breadcrumb/toc.yml deleted file mode 100644 index 83065b36a9..0000000000 --- a/browsers/edge/breadcrumb/toc.yml +++ /dev/null @@ -1,3 +0,0 @@ -- name: Microsoft Edge - tocHref: /microsoft-edge/ - topicHref: /microsoft-edge/index diff --git a/browsers/edge/docfx.json b/browsers/edge/docfx.json deleted file mode 100644 index 73d61658e2..0000000000 --- a/browsers/edge/docfx.json +++ /dev/null @@ -1,70 +0,0 @@ -{ - "build": { - "content": [ - { - "files": [ - "**/*.md", - "**/*.yml" - ], - "exclude": [ - "**/obj/**", - "**/includes/**", - "**/shortdesc/**" - ] - } - ], - "resource": [ - { - "files": [ - "**/images/**", - "**/*.png", - "**/*.jpg", - "**/*.gif" - ], - "exclude": [ - "**/obj/**" - ] - } - ], - "globalMetadata": { - "uhfHeaderId": "MSDocsHeader-MSEdge", - "recommendations": true, - "adobe-target": true, - "ms.collection": [ - "tier3" - ], - "breadcrumb_path": "/microsoft-edge/breadcrumbs/toc.json", - "ROBOTS": "INDEX, FOLLOW", - "audience": "ITPro", - "ms.topic": "article", - "manager": "dansimp", - "ms.prod": "microsoft-edge", - "feedback_system": "None", - "hideEdit": true, - "_op_documentIdPathDepotMapping": { - "./": { - "depot_name": "Win.microsoft-edge", - "folder_relative_path_in_docset": "./" - } - }, - "titleSuffix": "Edge", - "contributors_to_exclude": [ - "rjagiewich", - "traya1", - "rmca14", - "claydetels19", - "jborsecnik", - "tiburd", - "garycentric", - "beccarobins", - "Stacyrch140", - "v-stsavell", - "American-Dipper" - ] - }, - "fileMetadata": {}, - "template": "op.html", - "dest": "browsers/edge", - "markdownEngineName": "markdig" - } -} diff --git a/browsers/edge/group-policies/index.yml b/browsers/edge/group-policies/index.yml deleted file mode 100644 index 0934f61897..0000000000 --- a/browsers/edge/group-policies/index.yml +++ /dev/null @@ -1,79 +0,0 @@ -### YamlMime:Landing - -title: Microsoft Edge Legacy group policies # < 60 chars -summary: Microsoft Edge Legacy works with Group Policy and Microsoft Intune to help you manage your organization's computer settings. Group Policy objects (GPOs) can include registry-based Administrative Template policy settings, security settings, software deployment information, scripts, folder redirection, and preferences. # < 160 chars - -metadata: - title: Microsoft Edge Legacy # Required; page title displayed in search results. Include the brand. < 60 chars. - description: Find the tools and resources you need to help deploy and use Microsoft Edge in your organization. # Required; article description that is displayed in search results. < 160 chars. - keywords: Microsoft Edge Legacy, Windows 10 - ms.localizationpriority: medium - ms.prod: microsoft-edge - author: dougeby - ms.author: pashort - ms.topic: landing-page - ms.devlang: na - ms.date: 08/28/2020 #Required; mm/dd/yyyy format. - -# linkListType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | sample | tutorial | video | whats-new - -landingContent: -# Cards and links should be based on top customer tasks or top subjects -# Start card title with a verb - # Card (optional) - - title: What's new - linkLists: - - linkListType: whats-new - links: - - text: Documentation for Microsoft Edge version 77 or later - url: /DeployEdge/ - - text: Microsoft Edge Legacy desktop app will reach end of support on March 9, 2021 - url: https://techcommunity.microsoft.com/t5/microsoft-365-blog/microsoft-365-apps-say-farewell-to-internet-explorer-11-and/ba-p/1591666 - - # Card (optional) - - title: Group policies configure guidance part 1 - linkLists: - - linkListType: reference - links: - - text: All group policies - url: ../available-policies.md - - text: Address bar - url: ./address-bar-settings-gp.md - - text: Adobe Flash - url: ./adobe-settings-gp.md - - text: Books Library - url: ./books-library-management-gp.md - - text: Browser experience - url: ./browser-settings-management-gp.md - - text: Developer tools - url: ./developer-settings-gp.md - - text: Extensions - url: ./extensions-management-gp.md - - text: Favorites - url: ./favorites-management-gp.md - - text: Home button - url: ./home-button-gp.md - - # Card (optional) - - title: Group policies configure guidance part 2 - linkLists: - - linkListType: reference - links: - - text: Interoperability and enterprise mode - url: ./interoperability-enterprise-guidance-gp.md - - text: New Tab page - url: ./new-tab-page-settings-gp.md - - text: Kiosk mode deployment in Microsoft Edge - url: ../microsoft-edge-kiosk-mode-deploy.md - - text: Prelaunch Microsoft Edge and preload tabs - url: ./prelaunch-preload-gp.md - - text: Search engine customization - url: ./search-engine-customization-gp.md - - text: Security and privacy - url: ./security-privacy-management-gp.md - - text: Start page - url: ./start-pages-gp.md - - text: Sync browser - url: ./sync-browser-settings-gp.md - - text: Telemetry and data collection - url: ./telemetry-management-gp.md diff --git a/browsers/edge/images/Picture1.png b/browsers/edge/images/Picture1.png deleted file mode 100644 index a7cd8ea4a0..0000000000 Binary files a/browsers/edge/images/Picture1.png and /dev/null differ diff --git a/browsers/edge/images/Picture2.png b/browsers/edge/images/Picture2.png deleted file mode 100644 index 665e3d2578..0000000000 Binary files a/browsers/edge/images/Picture2.png and /dev/null differ diff --git a/browsers/edge/images/Picture5.png b/browsers/edge/images/Picture5.png deleted file mode 100644 index 9e11775911..0000000000 Binary files a/browsers/edge/images/Picture5.png and /dev/null differ diff --git a/browsers/edge/images/Picture6.png b/browsers/edge/images/Picture6.png deleted file mode 100644 index b5d9d8401d..0000000000 Binary files a/browsers/edge/images/Picture6.png and /dev/null differ diff --git a/browsers/edge/images/compat1.png b/browsers/edge/images/compat1.png deleted file mode 100644 index 35634d70b5..0000000000 Binary files a/browsers/edge/images/compat1.png and /dev/null differ diff --git a/browsers/edge/images/compat2.png b/browsers/edge/images/compat2.png deleted file mode 100644 index e52f7d6c2d..0000000000 Binary files a/browsers/edge/images/compat2.png and /dev/null differ diff --git a/browsers/edge/images/compat3.png b/browsers/edge/images/compat3.png deleted file mode 100644 index f67fad2e8f..0000000000 Binary files a/browsers/edge/images/compat3.png and /dev/null differ diff --git a/browsers/edge/images/config-enterprise-site-list.png b/browsers/edge/images/config-enterprise-site-list.png deleted file mode 100644 index 82ffc30895..0000000000 Binary files a/browsers/edge/images/config-enterprise-site-list.png and /dev/null differ diff --git a/browsers/edge/images/config-open-me-with-scenarios-tab.PNG b/browsers/edge/images/config-open-me-with-scenarios-tab.PNG deleted file mode 100644 index 0e39d589d5..0000000000 Binary files a/browsers/edge/images/config-open-me-with-scenarios-tab.PNG and /dev/null differ diff --git a/browsers/edge/images/deploy-enduser.png b/browsers/edge/images/deploy-enduser.png deleted file mode 100644 index 2a313013a9..0000000000 Binary files a/browsers/edge/images/deploy-enduser.png and /dev/null differ diff --git a/browsers/edge/images/deploy-land.png b/browsers/edge/images/deploy-land.png deleted file mode 100644 index c8fd9a1ba9..0000000000 Binary files a/browsers/edge/images/deploy-land.png and /dev/null differ diff --git a/browsers/edge/images/edge-emie-grouppolicysitelist.png b/browsers/edge/images/edge-emie-grouppolicysitelist.png deleted file mode 100644 index 82ffc30895..0000000000 Binary files a/browsers/edge/images/edge-emie-grouppolicysitelist.png and /dev/null differ diff --git a/browsers/edge/images/edge-emie-registrysitelist.png b/browsers/edge/images/edge-emie-registrysitelist.png deleted file mode 100644 index 9e9ece9c1a..0000000000 Binary files a/browsers/edge/images/edge-emie-registrysitelist.png and /dev/null differ diff --git a/browsers/edge/images/edgeblog.png b/browsers/edge/images/edgeblog.png deleted file mode 100644 index 544ad83db6..0000000000 Binary files a/browsers/edge/images/edgeblog.png and /dev/null differ diff --git a/browsers/edge/images/emie_open_in_ie.png b/browsers/edge/images/emie_open_in_ie.png deleted file mode 100644 index 40bb22123b..0000000000 Binary files a/browsers/edge/images/emie_open_in_ie.png and /dev/null differ diff --git a/browsers/edge/images/emieopeninie.png b/browsers/edge/images/emieopeninie.png deleted file mode 100644 index 40bb22123b..0000000000 Binary files a/browsers/edge/images/emieopeninie.png and /dev/null differ diff --git a/browsers/edge/images/enduser-land.png b/browsers/edge/images/enduser-land.png deleted file mode 100644 index 61958be866..0000000000 Binary files a/browsers/edge/images/enduser-land.png and /dev/null differ diff --git a/browsers/edge/images/enterprise-mode-value-data.png b/browsers/edge/images/enterprise-mode-value-data.png deleted file mode 100644 index 9e9ece9c1a..0000000000 Binary files a/browsers/edge/images/enterprise-mode-value-data.png and /dev/null differ diff --git a/browsers/edge/images/land-compat.png b/browsers/edge/images/land-compat.png deleted file mode 100644 index f709974ced..0000000000 Binary files a/browsers/edge/images/land-compat.png and /dev/null differ diff --git a/browsers/edge/images/land-security.png b/browsers/edge/images/land-security.png deleted file mode 100644 index 468354869f..0000000000 Binary files a/browsers/edge/images/land-security.png and /dev/null differ diff --git a/browsers/edge/images/land1.png b/browsers/edge/images/land1.png deleted file mode 100644 index b47bbd5b30..0000000000 Binary files a/browsers/edge/images/land1.png and /dev/null differ diff --git a/browsers/edge/images/new1.png b/browsers/edge/images/new1.png deleted file mode 100644 index bfa51b83f4..0000000000 Binary files a/browsers/edge/images/new1.png and /dev/null differ diff --git a/browsers/edge/images/new2.png b/browsers/edge/images/new2.png deleted file mode 100644 index dee2d7eb15..0000000000 Binary files a/browsers/edge/images/new2.png and /dev/null differ diff --git a/browsers/edge/images/new3.png b/browsers/edge/images/new3.png deleted file mode 100644 index 59f83920fb..0000000000 Binary files a/browsers/edge/images/new3.png and /dev/null differ diff --git a/browsers/edge/images/new4.png b/browsers/edge/images/new4.png deleted file mode 100644 index 070a4f9a11..0000000000 Binary files a/browsers/edge/images/new4.png and /dev/null differ diff --git a/browsers/edge/images/security1.png b/browsers/edge/images/security1.png deleted file mode 100644 index f4d8b0421e..0000000000 Binary files a/browsers/edge/images/security1.png and /dev/null differ diff --git a/browsers/edge/images/security2.png b/browsers/edge/images/security2.png deleted file mode 100644 index 23ae998b39..0000000000 Binary files a/browsers/edge/images/security2.png and /dev/null differ diff --git a/browsers/edge/images/security3.png b/browsers/edge/images/security3.png deleted file mode 100644 index 3ee5d56354..0000000000 Binary files a/browsers/edge/images/security3.png and /dev/null differ diff --git a/browsers/edge/images/sendintranettoie.png b/browsers/edge/images/sendintranettoie.png deleted file mode 100644 index a90909e19f..0000000000 Binary files a/browsers/edge/images/sendintranettoie.png and /dev/null differ diff --git a/browsers/edge/images/twitter.png b/browsers/edge/images/twitter.png deleted file mode 100644 index 3b30a9a1cc..0000000000 Binary files a/browsers/edge/images/twitter.png and /dev/null differ diff --git a/browsers/edge/images/wedge.gif b/browsers/edge/images/wedge.gif deleted file mode 100644 index aa3490aee9..0000000000 Binary files a/browsers/edge/images/wedge.gif and /dev/null differ diff --git a/browsers/edge/images/wipinsider.png b/browsers/edge/images/wipinsider.png deleted file mode 100644 index a1f1f0b0fe..0000000000 Binary files a/browsers/edge/images/wipinsider.png and /dev/null differ diff --git a/browsers/edge/index.yml b/browsers/edge/index.yml deleted file mode 100644 index 200205ac8f..0000000000 --- a/browsers/edge/index.yml +++ /dev/null @@ -1,92 +0,0 @@ -### YamlMime:Landing - -title: Microsoft Edge Group Legacy Policy configuration options # < 60 chars -summary: Learn how to deploy and configure group policies in Microsoft Edge Legacy on Windows 10. Some of the features coming to Microsoft Edge Legacy gives you the ability to set a custom URL for the New Tab page or Home button. Another new feature allows you to hide or show the Favorites bar, giving you more control over the favorites bar. # < 160 chars - -metadata: - title: Microsoft Edge Group Legacy Policy configuration options # Required; page title displayed in search results. Include the brand. < 60 chars. - description: Learn about interoperability goals and enterprise guidance along with system requirements, language support and frequently asked questions. # Required; article description that is displayed in search results. < 160 chars. - ms.prod: microsoft-edge - keywords: Microsoft Edge Legacy, Windows 10 - ms.localizationpriority: medium - ms.topic: landing-page # Required - author: dougeby #Required; your GitHub user alias, with correct capitalization. - ms.author: pashort #Required; microsoft alias of author; optional team alias. - ms.date: 07/07/2020 #Required; mm/dd/yyyy format. - -# linkListType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | sample | tutorial | video | whats-new - -landingContent: -# Cards and links should be based on top customer tasks or top subjects -# Start card title with a verb - # Card (optional) - - title: About Microsoft Edge - linkLists: - - linkListType: whats-new - links: - - text: Documentation for Microsoft Edge version 77 or later - url: /DeployEdge - - text: Microsoft 365 apps say farewell to Internet Explorer 11 and Windows 10 sunsets Microsoft Edge Legacy - url: https://techcommunity.microsoft.com/t5/microsoft-365-blog/microsoft-365-apps-say-farewell-to-internet-explorer-11-and/ba-p/1591666 - - text: Latest group policies and features added to Microsoft Edge - url: ./change-history-for-microsoft-edge.md - - linkListType: overview - links: - - text: System requirements and supported languages - url: ./about-microsoft-edge.md - - text: Compare Windows 10 editions - url: https://www.microsoft.com/en-us/WindowsForBusiness/Compare - - text: Security & protection - url: ./group-policies/security-privacy-management-gp.md - - text: Interoperability & enterprise guidance - url: ./group-policies/interoperability-enterprise-guidance-gp.md - - text: Group policies & configuration options - url: ./group-policies/index.yml - - # Card (optional) - - title: Microsoft Edge resources - linkLists: - - linkListType: overview - links: - - text: Minimum system requirements - url: ./about-microsoft-edge.md#minimum-system-requirements - - text: Supported languages - url: ./about-microsoft-edge.md#supported-languages - - text: Document change history - url: ./change-history-for-microsoft-edge.md - - text: Microsoft Edge Dev blog - url: https://blogs.windows.com/msedgedev - - text: Microsoft Edge Dev on Twitter - url: ./about-microsoft-edge.md#supported-languages - - text: Microsoft Edge changelog - url: ./change-history-for-microsoft-edge.md - - text: Measuring the impact of Microsoft Edge - url: https://blogs.windows.com/msedgedev - - # Card (optional) - - title: IE11 resources - linkLists: - - linkListType: overview - links: - - text: Deploy Internet Explorer 11 (IE11) - IT Pros - url: /internet-explorer/ie11-deploy-guide/ - - text: Internet Explorer Administration Kit 11 (IEAK 11) - url: /internet-explorer/ie11-ieak - - linkListType: download - links: - - text: Download Internet Explorer 11 - url: https://go.microsoft.com/fwlink/p/?linkid=290956 - - # Card (optional) - - title: Additional resources - linkLists: - - linkListType: overview - links: - - text: Group Policy and the Group Policy Management Console (GPMC) - url: /internet-explorer/ie11-deploy-guide/group-policy-and-group-policy-mgmt-console-ie11 - - text: Group Policy and the Local Group Policy Editor - url: /internet-explorer/ie11-deploy-guide/group-policy-and-local-group-policy-editor-ie11 - - text: Group Policy and the Advanced Group Policy Management (AGPM) - url: /internet-explorer/ie11-deploy-guide/group-policy-and-advanced-group-policy-mgmt-ie11 - - text: Group Policy and Windows PowerShell - url: /internet-explorer/ie11-deploy-guide/group-policy-windows-powershell-ie11 \ No newline at end of file diff --git a/browsers/edge/microsoft-edge-faq.yml b/browsers/edge/microsoft-edge-faq.yml deleted file mode 100644 index 2c434c71f4..0000000000 --- a/browsers/edge/microsoft-edge-faq.yml +++ /dev/null @@ -1,73 +0,0 @@ -### YamlMime:FAQ -metadata: - title: Microsoft Edge - Frequently Asked Questions (FAQ) for IT Pros - ms.reviewer: - ms.date: 12/14/2020 - audience: itpro - manager: dansimp - description: Answers to frequently asked questions about Microsoft Edge features, integration, support, and potential problems. - author: dansimp - ms.author: dansimp - ms.prod: microsoft-edge - ms.topic: faq - ms.mktglfcycl: general - ms.sitesec: library - ms.localizationpriority: medium -title: Frequently Asked Questions (FAQ) for IT Pros -summary: | - Applies to: Microsoft Edge on Windows 10 - - > [!NOTE] - > You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](/DeployEdge/). - - -sections: - - name: Ignored - questions: - - question: How can I get the next major version of Microsoft Edge, based on Chromium? - answer: | - In December 2018, Microsoft [announced](https://blogs.windows.com/windowsexperience/2018/12/06/microsoft-edge-making-the-web-better-through-more-open-source-collaboration/#8jv53blDvL6TIKuS.97) our intention to adopt the Chromium open source project in the development of Microsoft Edge on the desktop, to create better web compatibility for our customers and less fragmentation of the web for all web developers. You can get more information at the [Microsoft Edge Insiders site](https://www.microsoftedgeinsider.com/). - - - question: What's the difference between Microsoft Edge and Internet Explorer 11? How do I know which one to use? - answer: | - Microsoft Edge is the default browser for all Windows 10 devices. It's built to be highly compatible with the modern web. For some enterprise web apps and a small set of sites that were built to work with older technologies like ActiveX, [you can use Enterprise Mode](emie-to-improve-compatibility.md) to automatically send users to Internet Explorer 11. - - For more information on how Internet Explorer and Microsoft Edge work together to support your legacy web apps, while still defaulting to the higher security and modern experiences enabled by Microsoft Edge, see [Legacy apps in the enterprise](https://blogs.windows.com/msedgedev/2017/04/07/legacy-web-apps-enterprise/#RAbtRvJSYFaKu2BI.97). - - - question: Does Microsoft Edge work with Enterprise Mode? - answer: | - [Enterprise Mode](/internet-explorer/ie11-deploy-guide/enterprise-mode-overview-for-ie11) helps you run many legacy web applications with better backward compatibility. You can configure both Microsoft Edge and Internet Explorer to use the same Enterprise Mode Site List, switching seamlessly between browsers to support both modern and legacy web apps. - - - question: How do I customize Microsoft Edge and related settings for my organization? - answer: | - You can use Group Policy or Microsoft Intune to manage settings related to Microsoft Edge, such as security settings, folder redirection, and preferences. See [Group Policy and Mobile Device Management (MDM) settings for Microsoft Edge](./group-policies/index.yml) for a list of policies currently available for Microsoft Edge and configuration information. The preview release of Chromium-based Microsoft Edge might not include management policies or other enterprise functionality; our focus during the preview is modern browser fundamentals. - - - question: Is Adobe Flash supported in Microsoft Edge? - answer: | - Adobe Flash is currently supported as a built-in feature of Microsoft Edge on PCs running Windows 10. In July 2017, Adobe announced that Flash support will end after 2020. With this change to Adobe support, we've started to phase Flash out of Microsoft Edge by adding the [Configure the Adobe Flash Click-to-Run setting group policy](./available-policies.md#configure-the-adobe-flash-click-to-run-setting) - this lets you control which websites can run Adobe Flash content. - - To learn more about Microsoft's plan for phasing Flash out of Microsoft Edge and Internet Explorer, see [The End of an Era — Next Steps for Adobe Flash](https://blogs.windows.com/msedgedev/2017/07/25/flash-on-windows-timeline/#3Bcc3QjRw0l7XsZ4.97) (blog article). - - - question: Does Microsoft Edge support ActiveX controls or BHOs like Silverlight or Java? - answer: | - No, Microsoft Edge doesn't support ActiveX controls and Browser Helper Objects (BHOs) like Silverlight or Java. If you're running web apps that use ActiveX controls, x-ua-compatible headers, or legacy document modes, you need to keep running them in Internet Explorer 11. Internet Explorer 11 offers additional security, manageability, performance, backward compatibility, and standards support. - - - question: How often will Microsoft Edge be updated? - answer: | - In Windows 10, we're delivering Windows as a service, updated on a cadence driven by quality and the availability of new features. Microsoft Edge security updates are released every two to four weeks, while bigger feature updates are included in the Windows 10 releases on a semi-annual cadence. - - - question: How can I provide feedback on Microsoft Edge? - answer: | - Microsoft Edge is an evergreen browser - we'll continue to evolve both the web platform and the user interface with regular updates. To send feedback on user experience, or on broken or malicious sites, use the **Send Feedback** option under the ellipses icon (**...**) in the Microsoft Edge toolbar. - - - question: Will Internet Explorer 11 continue to receive updates? - answer: | - We're committed to keeping Internet Explorer a supported, reliable, and safe browser. Internet Explorer is still a component of Windows and follows the support lifecycle of the OS on which it's installed. For details, see [Lifecycle FAQ - Internet Explorer](/lifecycle/faq/internet-explorer-microsoft-edge). While we continue to support and update Internet Explorer, the latest features and platform updates will only be available in Microsoft Edge. - - - question: How do I find out which version of Microsoft Edge I have? - answer: | - In the upper-right corner of Microsoft Edge, select the ellipses icon (**...**), and then select **Settings**. Look in the **About Microsoft Edge** section to find your version. - - - question: What is Microsoft EdgeHTML? - answer: | - Microsoft EdgeHTML is the web rendering engine that powers the current Microsoft Edge web browser and Windows 10 web app platform (as opposed to *Microsoft Edge, based on Chromium*). diff --git a/browsers/edge/microsoft-edge.yml b/browsers/edge/microsoft-edge.yml deleted file mode 100644 index addd4468b1..0000000000 --- a/browsers/edge/microsoft-edge.yml +++ /dev/null @@ -1,127 +0,0 @@ -### YamlMime:Landing - -title: Microsoft Edge Legacy # < 60 chars -summary: Find the tools and resources you need to help deploy and use Microsoft Edge in your organization. # < 160 chars - -metadata: - title: Microsoft Edge Legacy # Required; page title displayed in search results. Include the brand. < 60 chars. - description: Find the tools and resources you need to help deploy and use Microsoft Edge in your organization. # Required; article description that is displayed in search results. < 160 chars. - keywords: Microsoft Edge, issues, fixes, announcements, Windows Server, advisories - ms.prod: microsoft-edge - ms.localizationpriority: medium - author: aczechowski - ms.author: aaroncz - manager: dansimp - ms.topic: landing-page - ms.date: 08/19/2020 #Required; mm/dd/yyyy format. - -# linkListType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | sample | tutorial | video | whats-new - -landingContent: -# Cards and links should be based on top customer tasks or top subjects -# Start card title with a verb - # Card (optional) - - title: What's new - linkLists: - - linkListType: whats-new - links: - - text: Documentation for Microsoft Edge version 77 or later - url: /DeployEdge/ - - text: Microsoft Edge Legacy desktop app will reach end of support on March 9, 2021 - url: https://techcommunity.microsoft.com/t5/microsoft-365-blog/microsoft-365-apps-say-farewell-to-internet-explorer-11-and/ba-p/1591666 - - text: The latest in Microsoft Edge - url: https://blogs.windows.com/msedgedev/2018/04/30/edgehtml-17-april-2018-update/#C7jCBdbPSG6bCXHr.97 - - text: Microsoft Edge for iOS and Android - url: https://blogs.windows.com/windowsexperience/2017/11/30/microsoft-edge-now-available-for-ios-and-android - - text: Application Guard - url: /windows/security/threat-protection/windows-defender-application-guard/wd-app-guard-overview - - linkListType: download - links: - - text: Evaluate the impact - url: ./microsoft-edge-forrester.md - - # Card (optional) - - title: Improve compatibility with Enterprise Mode - linkLists: - - linkListType: how-to-guide - links: - - text: Use Enterprise mode to improve compatibility - url: ./emie-to-improve-compatibility.md - - text: Turn on Enterprise Mode and use a site list - url: /internet-explorer/ie11-deploy-guide/turn-on-enterprise-mode-and-use-a-site-list - - text: Enterprise Site List Portal - url: https://github.com/MicrosoftEdge/enterprise-mode-site-list-portal - - # Card (optional) - - title: Web Application Compatibility Lab Kit - linkLists: - - linkListType: overview - links: - - text: Overview - url: ./emie-to-improve-compatibility.md - - # Card (optional) - - title: Security - linkLists: - - linkListType: download - links: - - text: NSS Labs web browser security reports - url: https://www.microsoft.com/download/details.aspx?id=58080 - - linkListType: overview - links: - - text: Microsoft Edge sandbox - url: https://blogs.windows.com/msedgedev/2017/03/23/strengthening-microsoft-edge-sandbox/ - - text: Windows Defender SmartScreen - url: /windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview - - # Card (optional) - - title: Deployment - linkLists: - - linkListType: overview - links: - - text: Microsoft Edge deployment guide - url: ./index.yml - - text: Microsoft Edge FAQ - url: ./microsoft-edge-faq.yml - - text: System requirements and language support - url: /microsoft-edge/deploy/hardware-and-software-requirements - - text: Group Policy and MDM settings in Microsoft Edge - url: ./available-policies.md - - text: Microsoft Edge training and demonstrations - url: ./edge-technical-demos.md - - linkListType: download - links: - - text: Web Application Compatibility Lab Kit - url: https://www.microsoft.com/itpro/microsoft-edge/web-app-compat-toolkit - - # Card (optional) - - title: End user readiness - linkLists: - - linkListType: download - links: - - text: Quick Start - Microsoft Edge (PDF, .98 MB) - url: https://go.microsoft.com/fwlink/?linkid=825648 - - text: Find it faster with Microsoft Edge (PDF, 605 KB) - url: https://go.microsoft.com/fwlink/?linkid=825661 - - text: Use Microsoft Edge to collaborate (PDF, 468 KB) - url: https://go.microsoft.com/fwlink/?linkid=825653 - - text: Group Policy and MDM settings in Microsoft Edge - url: ./available-policies.md - - text: Microsoft Edge training and demonstrations - url: ./edge-technical-demos.md - - linkListType: how-to-guide - links: - - text: Microsoft Edge features and tips - url: https://microsoftedgetips.microsoft.com - - # Card (optional) - - title: Stay informed - linkLists: - - linkListType: overview - links: - - text: Sign up for the Windows IT Pro Insider - url: https://aka.ms/windows-it-pro-insider - - text: Microsoft Edge Dev blog - url: https://blogs.windows.com/msedgedev - - text: Microsoft Edge Dev on Twitter - url: https://twitter.com/MSEdgeDev diff --git a/browsers/enterprise-mode/add-employees-enterprise-mode-portal.md b/browsers/enterprise-mode/add-employees-enterprise-mode-portal.md deleted file mode 100644 index 08d914e629..0000000000 --- a/browsers/enterprise-mode/add-employees-enterprise-mode-portal.md +++ /dev/null @@ -1,68 +0,0 @@ ---- -ms.localizationpriority: low -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Details about how to add employees to the Enterprise Mode Site List Portal. -author: dansimp -ms.prod: ie11 -title: Add employees to the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 -ms.reviewer: -manager: dansimp -ms.author: dansimp ---- - -# Add employees to the Enterprise Mode Site List Portal - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -After you get the Enterprise Mode Site List Portal up and running, you must add your employees. During this process, you'll also assign roles and groups. - -The available roles are: - -- **Requester.** The primary role to assign to employees that need to access the Enterprise Mode Site List Portal. The Requester can create change requests, validate changes in the pre-production environment, rollback pre-production and production changes in case of failure, send personal approval requests, view personal change requests, and sign off and close personal change requests. - -- **App Manager.** This role is considered part of the Approvers group. The App Manager can approve change requests, validate changes in the pre-production environment, rollback pre-production and production changes in case of failure, send personal approval requests, view personal requests, and sign off and close personal requests. - -- **Group Head.** This role is considered part of the Approvers group. The Group Head can approve change requests, validate changes in the pre-production environment, rollback pre-production and production changes in case of failure, send personal approval requests, view personal requests, and sign off and close personal requests. - -- **Administrator.** The role with the highest-level rights; we recommend limiting the number of employees you grant this role. The Administrator can perform any task that can be performed by the other roles, in addition to adding employees to the portal, assigning employee roles, approving registrations to the portal, configuring portal settings (for example, determining the freeze schedule, determining the pre-production and production XML paths, and determining the attachment upload location), and using the standalone Enterprise Mode Site List Manager page. - -**To add an employee to the Enterprise Mode Site List Portal** -1. Open the Enterprise Mode Site List Portal and click the **Employee Management** icon in the upper-right area of the page. - - The **Employee management** page appears. - -2. Click **Add a new employee**. - - The **Add a new employee** page appears. - -3. Fill out the fields for each employee, including: - - - **Email.** Add the employee's email address. - - - **Name.** This box autofills based on the email address. - - - **Role.** Pick a single role for the employee, based on the list above. - - - **Group name.** Pick the name of the employee's group. The group association also assigns a group of Approvers. - - - **Comments.** Add optional comments about the employee. - - - **Active.** Click the check box to make the employee active in the system. If you want to keep the employee in the system, but you want to prevent access, clear this check box. - -4. Click **Save**. - -**To export all employees to an Excel spreadsheet** -1. On the **Employee management** page, click **Export to Excel**. - -2. Save the EnterpriseModeUsersList.xlsx file. - - The Excel file includes all employees with access to the Enterprise Mode Site List Portal, including user name, email address, role, and group name. diff --git a/browsers/enterprise-mode/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md b/browsers/enterprise-mode/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md deleted file mode 100644 index 39adf2816d..0000000000 --- a/browsers/enterprise-mode/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md +++ /dev/null @@ -1,112 +0,0 @@ ---- -ms.localizationpriority: low -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: You can add multiple sites to your Enterprise Mode site list by creating a custom text (TXT) or Extensible Markup Language (XML) file of problematic sites and then adding it in the Bulk add from file area of the Enterprise Mode Site List Manager. -author: dansimp -ms.prod: ie11 -ms.assetid: 20aF07c4-051a-451f-9c46-5a052d9Ae27c -ms.reviewer: -manager: dansimp -ms.author: dansimp -title: Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1) (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1) - -**Applies to:** - -- Windows 8.1 -- Windows 7 - -You can add multiple sites to your Enterprise Mode site list by creating a custom text (TXT) or Extensible Markup Language (XML) file of problematic sites and then adding it in the **Bulk add from file** area of the Enterprise Mode Site List Manager. You can only add specific URLs, not Internet or Intranet Zones. - -If you want to add your websites one at a time, see Add sites to the [Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.1)](add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md). - -## Create an Enterprise Mode site list (TXT) file -You can create and use a custom text file to add multiple sites to your Enterprise Mode site list at the same time.

**Important**
This text file is only lets you add multiple sites at the same time. You can’t use this file to deploy Enterprise Mode into your company. - -You must separate each site using commas or carriage returns. For example: - -``` -microsoft.com, bing.com, bing.com/images -``` -**-OR-** - -``` -microsoft.com -bing.com -bing.com/images -``` - -## Create an Enterprise Mode site list (XML) file using the v.1 version of the Enterprise Mode schema -You can create and use a custom XML file with the Enterprise Mode Site List Manager to add multiple sites to your Enterprise Mode site list at the same time. For more info about the v.1 version of the Enterprise Mode schema, see [Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md). - -Each XML file must include: - -- **Version number.** This number must be incremented with each version of the Enterprise Mode site list, letting Internet Explorer know whether the list is new. Approximately 65 seconds after Internet Explorer 11 starts, it compares your site list version to the stored version number. If your file has a higher number, the newer version is loaded.

**Important**
After this check, IE11 won’t look for an updated list again until you restart the browser. - -- **<emie> tag.** This tag specifies the domains and domain paths that must be rendered using IE7 Enterprise Mode, IE8 Enterprise Mode, or the default IE11 browser environment.

**Important**
If you decide a site requires IE7 Enterprise Mode, you must add `forceCompatView=”true”` to your XML file. That code tells Enterprise Mode to check for a `DOCTYPE` tag on the specified webpage. If there is, the site renders using Windows Internet Explorer 7. If there’s no tag, the site renders using Microsoft Internet Explorer 5. - -- **<docMode> tag.**This tag specifies the domains and domain paths that need either to appear using the specific doc mode you assigned to the site. Enterprise Mode takes precedence over document modes, so sites that are already included in the Enterprise Mode site list won’t be affected by this update and will continue to load in Enterprise Mode, as usual. For more specific info about using document modes, see [Fix web compatibility issues using document modes and the Enterprise Mode site list](fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md). - -### Enterprise Mode v.1 XML schema example -The following is an example of what your XML file should look like when you’re done adding your sites. For more info about how to create your XML file, see [Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md). - -``` - - - www.cpandl.com - www.woodgrovebank.com - adatum.com - contoso.com - relecloud.com - /about - - fabrikam.com - /products - - - - contoso.com - /travel - - fabrikam.com - /products - - - -``` - -To make sure your site list is up-to-date; wait 65 seconds after opening IE and then check that the `CurrentVersion` value in the `HKEY\CURRENT\USER\Software\Microsoft\Internet Explorer\Main\EnterpriseMode\` registry key matches the version number in your file.

**Important**
If `CurrentVersion` is not set or is wrong, it means that the XML parsing failed. This can mean that the XML file isn’t there, that there are access problems, or that the XML file format is wrong. Don’t manually change the `CurrentVersion` registry setting. You must make your changes to your site list and then update the list using the import function in the Enterprise Mode Site List Manager (. - -## Add multiple sites to the Enterprise Mode Site List Manager (schema v.1) -After you create your .xml or .txt file, you can bulk add the sites to the Enterprise Mode Site List Manager (schema v.1). - - **To add multiple sites** - -1. In the Enterprise Mode Site List Manager (schema v.1), click **Bulk add from file**. - -2. Go to your site list (either .txt or .xml) to add the included sites to the tool, and then click **Open**.

-Each site is validated and if successful, added to the global site list when you click **OK** to close the menu. If a site doesn’t pass validation, you can try to fix the issues or pick the site and click **Add to list** to ignore the validation problem. For more information about fixing validation problems, see [Fix validation problems using the Enterprise Mode Site List Manager](fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md). - -3. Click **OK** to close the **Bulk add sites to the list** menu. - -4. On the **File** menu, click **Save to XML**, and save your file.

-You can save the file locally or to a network share. However, you must make sure you deploy it to the location specified in your registry key. For more information about the registry key, see [Turn on Enterprise Mode and use a site list](turn-on-enterprise-mode-and-use-a-site-list.md). - -## Next steps -After you’ve added all of your sites to the tool and saved the file to XML, you can configure the rest of the Enterprise Mode functionality to use it. You can also turn Enterprise Mode on locally, so your users have the option to use Enterprise Mode on individual websites from the **Tools** menu. For more information, see [Turn on local control and logging for Enterprise Mode](turn-on-local-control-and-logging-for-enterprise-mode.md). - -## Related topics -- [Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md) -- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) -  - -  - - - diff --git a/browsers/enterprise-mode/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md b/browsers/enterprise-mode/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md deleted file mode 100644 index b4da3f64f5..0000000000 --- a/browsers/enterprise-mode/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md +++ /dev/null @@ -1,122 +0,0 @@ ---- -ms.localizationpriority: low -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Add multiple sites to your Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2). -author: dansimp -ms.prod: ie11 -ms.assetid: da659ff5-70d5-4852-995e-4df67c4871dd -ms.reviewer: -manager: dansimp -ms.author: dansimp -title: Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2) (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 10/24/2017 ---- - - -# Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2) - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 - -You can add multiple sites to your Enterprise Mode site list by creating a custom text (TXT) or Extensible Markup Language (XML) file of problematic sites and then adding it in the **Bulk add from file** area of the Enterprise Mode Site List Manager (schema v.2). You can only add specific URLs, not Internet or Intranet Zones. - -To add your websites one at a time, see [Add sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.2)](add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md). - -## Create an Enterprise Mode site list (TXT) file - -You can create and use a custom text file with the Enterprise Mode Site List Manager (schema v.2) to add multiple sites to your Enterprise Mode site list at the same time. - ->**Important:**
This text file is only lets you add multiple sites at the same time. You can’t use this file to deploy Enterprise Mode into your company. - -You must separate each site using commas or carriage returns. For example: - -``` -microsoft.com, bing.com, bing.com/images -``` -**-OR-** - -``` -microsoft.com -bing.com -bing.com/images -``` - -## Create an Enterprise Mode site list (XML) file using the v.2 version of the Enterprise Mode schema - -You can create and use a custom XML file with the Enterprise Mode Site List Manager (schema v.2) to add multiple sites to your Enterprise Mode site list at the same time. - -Each XML file must include: - -- **site-list version number**. This number must be incremented with each version of the Enterprise Mode site list, letting Internet Explorer know whether the list is new. Approximately 65 seconds after Internet Explorer 11 starts, it compares your site list version to the stored version number. If your file has a higher number, the newer version is loaded.

**Important**
After this check, IE11 won’t look for an updated list again until you restart the browser.  - -- **<compat-mode> tag.** This tag specifies what compatibility setting are used for specific sites or domains. - -- **<open-in> tag.** This tag specifies what browser opens for each sites or domain. - -### Enterprise Mode v.2 XML schema example - -The following is an example of what your XML file should look like when you’re done adding your sites. For more info about how to create your XML file, see [Enterprise Mode schema v.2 guidance](enterprise-mode-schema-version-2-guidance.md). - -``` - - - - EnterpriseSitelistManager - 10240 - 20150728.135021 - - - - IE8Enterprise - MSEdge - - - IE7Enterprise - IE11 - - - default - IE11 - - -``` -In the above example, the following is true: - -- www.cpandl.com, as the main domain, must use IE8 Enterprise Mode. However, www.cpandl.com/images must use IE7 Enterprise Mode. - -- contoso.com, and all of its domain paths, can use the default compatibility mode for the site. - -To make sure your site list is up-to-date; wait 65 seconds after opening IE and then check that the `CurrentVersion` value in the `HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\EnterpriseMode\` registry key matches the version number in your file.

**Important**
If `CurrentVersion` is not set or is wrong, it means that the XML parsing failed. This can mean that the XML file isn’t there, that there are access problems, or that the XML file format is wrong. Don’t manually change the `CurrentVersion` registry setting. You must make your changes to your site list and then update the list using the import function in the Enterprise Mode Site List Manager (schema v.2). - -## Add multiple sites to the Enterprise Mode Site List Manager (schema v.2) -After you create your .xml or .txt file, you can bulk add the sites to the Enterprise Mode Site List Manager (schema v.2). - - **To add multiple sites** - -1. In the Enterprise Mode Site List Manager (schema v.2), click **Bulk add from file**. - -2. Go to your site list (either .txt or .xml) to add the included sites to the tool, and then click **Open**.

-Each site is validated and if successful, added to the global site list when you click **OK** to close the menu. If a site doesn’t pass validation, you can try to fix the issues or pick the site and click **Add to list** to ignore the validation problem. For more information about fixing validation problems, see [Fix validation problems using the Enterprise Mode Site List Manager](fix-validation-problems-using-the-enterprise-mode-site-list-manager.md). - -3. Click **OK** to close the **Bulk add sites to the list** menu. - -4. On the **File** menu, click **Save to XML**, and save your file.

-You can save the file locally or to a network share. However, you must make sure you deploy it to the location specified in your registry key. For more information about the registry key, see [Turn on Enterprise Mode and use a site list](turn-on-enterprise-mode-and-use-a-site-list.md). - -## Next steps -After you’ve added all of your sites to the tool and saved the file to XML, you can configure the rest of the Enterprise Mode functionality to use it. You can also turn Enterprise Mode on locally, so your users have the option to use Enterprise Mode on individual websites from the **Tools** menu. For more information, see [Turn on local control and logging for Enterprise Mode](turn-on-local-control-and-logging-for-enterprise-mode.md). - -## Related topics -- [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) -- [Enterprise Mode schema v.2 guidance](enterprise-mode-schema-version-2-guidance.md) -  - -  - - - diff --git a/browsers/enterprise-mode/add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md b/browsers/enterprise-mode/add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md deleted file mode 100644 index 55b2dcd28a..0000000000 --- a/browsers/enterprise-mode/add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md +++ /dev/null @@ -1,66 +0,0 @@ ---- -ms.localizationpriority: low -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Enterprise Mode is a compatibility mode that runs on Internet Explorer 11, letting websites render using a modified browser configuration that's designed to emulate either Windows Internet Explorer 7 or Windows Internet Explorer 8, avoiding the common compatibility problems associated with web apps written and tested on older versions of Internet Explorer. -author: dansimp -ms.prod: ie11 -ms.assetid: 042e44e8-568d-4717-8fd3-69dd198bbf26 -ms.reviewer: -manager: dansimp -ms.author: dansimp -title: Add sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.1) (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Add single sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.1) - -**Applies to:** - -- Windows 8.1 -- Windows 7 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -Enterprise Mode is a compatibility mode that runs on Internet Explorer 11, letting websites render using a modified browser configuration that’s designed to emulate either Windows Internet Explorer 7 or Windows Internet Explorer 8, avoiding the common compatibility problems associated with web apps written and tested on older versions of Internet Explorer.

**Important**
You can only add specific URLs, not Internet or Intranet Zones. - -

**Note**
If you need to include a lot of sites, instead of adding them one at a time, you can create a list of websites and add them all at the same time. For more information, see [Add multiple sites to the Enterprise Mode site list using a file and the Windows 7 and 8.1 Enterprise Mode Site List Manager](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md). - -## Adding a site to your compatibility list -You can add individual sites to your compatibility list by using the Enterprise Mode Site List Manager. -

**Note**
If you're using the v.2 version of the Enterprise Mode schema, you'll need to use the Enterprise Mode Site List Manager (schema v.1). For more info, see [Add sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.2)](add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md). - - **To add a site to your compatibility list using the Enterprise Mode Site List Manager (schema v.1)** - -1. In the Enterprise Mode Site List Manager (schema v.1), click **Add**. - -2. Type the URL for the website that’s experiencing compatibility problems, like *<domain>.com* or *<domain>.com*/*<path>* into the **URL** box.

-Don't include the `https://` or `https://` designation. The tool automatically tries both versions during validation. - -3. Type any comments about the website into the **Notes about URL** box.

-Administrators can only see comments while they’re in this tool. - -4. Choose **IE7 Enterprise Mode**, **IE8 Enterprise Mode**, or the appropriate document mode for sites that must be rendered using the emulation of a previous version of IE, or pick **Default IE** if the site should use the latest version of IE. - -The path within a domain can require a different compatibility mode from the domain itself. For example, the domain might look fine in the default IE11 browser, but the path might have problems and require the use of Enterprise Mode. If you added the domain previously, your original compatibility choice is still selected. However, if the domain is new, **IE8 Enterprise Mode** is automatically selected. - -Enterprise Mode takes precedence over document modes, so sites that are already included in the Enterprise Mode site list won’t be affected by this update and will continue to load in Enterprise Mode, as usual. For more specific info about using document modes, see [Fix web compatibility issues using document modes and the Enterprise Mode site list](fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md). - -5. Click **Save** to validate your website and to add it to the site list for your enterprise.

-If your site passes validation, it’s added to the global compatibility list. If the site doesn’t pass validation, you’ll get an error message explaining the problem. You’ll then be able to either cancel the site or ignore the validation problem and add it to your list anyway. - -6. On the **File** menu, go to where you want to save the file, and then click **Save to XML**.

-You can save the file locally or to a network share. However, you must make sure you deploy it to the location specified in your registry key. For more information about the registry key, see [Turn on local control and logging for Enterprise Mode](turn-on-local-control-and-logging-for-enterprise-mode.md). - -## Next steps -After you’ve added all of your sites to the tool and saved the file to XML, you can configure the rest of the Enterprise Mode functionality to use it. You can also turn Enterprise Mode on locally, so your users have the option to use Enterprise Mode on individual websites from the **Tools** menu. For more information, see [Turn on local control and logging for Enterprise Mode](turn-on-local-control-and-logging-for-enterprise-mode.md). - -## Related topics -- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) -  - -  - - - diff --git a/browsers/enterprise-mode/add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md b/browsers/enterprise-mode/add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md deleted file mode 100644 index c1a7aee9b8..0000000000 --- a/browsers/enterprise-mode/add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md +++ /dev/null @@ -1,82 +0,0 @@ ---- -ms.localizationpriority: low -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Enterprise Mode is a compatibility mode that runs on Internet Explorer 11, letting websites render using a modified browser configuration that''s designed to emulate either Windows Internet Explorer 8 or Windows Internet Explorer 7, avoiding the common compatibility problems associated with web apps written and tested on older versions of Internet Explorer. -author: dansimp -ms.prod: ie11 -ms.assetid: 513e8f3b-fedf-4d57-8d81-1ea4fdf1ac0b -ms.reviewer: -manager: dansimp -ms.author: dansimp -title: Add sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.2) (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Add single sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.2) - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 - -Enterprise Mode is a compatibility mode that runs on Internet Explorer 11, letting websites render using a modified browser configuration that’s designed to emulate either Windows Internet Explorer 8 or Windows Internet Explorer 7, avoiding the common compatibility problems associated with web apps written and tested on older versions of Internet Explorer.

**Important**
You can only add specific URLs, not Internet or Intranet Zones. - -

**Note**
If you need to include a lot of sites, instead of adding them one at a time, you can create a list of websites and add them all at the same time. For more information, see the [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md) or the [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md) topic, based on your operating system. - -## Adding a site to your compatibility list -You can add individual sites to your compatibility list by using the Enterprise Mode Site List Manager.

-**Note**
If you're using the v.1 version of the Enterprise Mode schema, you'll need to use the Enterprise Mode Site List Manager (schema v.1). For more info, see [Add sites to the Enterprise Mode site list using the WEnterprise Mode Site List Manager (schema v.1)](add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md). - - **To add a site to your compatibility list using the Enterprise Mode Site List Manager (schema v.2)** - -1. In the Enterprise Mode Site List Manager (schema v.2), click **Add**. - -2. Type the URL for the website that’s experiencing compatibility problems, like *<domain>.com* or *<domain>.com*/*<path>* into the **URL** box.

-Don't include the `https://` or `https://` designation. The tool automatically tries both versions during validation. - -3. Type any comments about the website into the **Notes about URL** box.

-Administrators can only see comments while they’re in this tool. - -4. In the **Compat Mode** box, choose one of the following: - - - **IE8Enterprise**. Loads the site in IE8 Enterprise Mode. - - - **IE7Enterprise**. Loads the site in IE7 Enterprise Mode. - - - **IE\[*x*\]**. Where \[x\] is the document mode number and the site loads in the specified document mode. - - - **Default Mode**. Loads the site using the default compatibility mode for the page. - - The path within a domain can require a different compatibility mode from the domain itself. For example, the domain might look fine in the default IE11 browser, but the path might have problems and require the use of Enterprise Mode. If you added the domain previously, your original compatibility choice is still selected. However, if the domain is new, **IE8 Enterprise Mode** is automatically selected. - - Enterprise Mode takes precedence over document modes, so sites that are already included in the Enterprise Mode site list won’t be affected by this update and will continue to load in Enterprise Mode, as usual. For more specific info about using document modes, see [Fix web compatibility issues using document modes and the Enterprise Mode site list](fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md). - -5. In conjunction with the compatibility mode, you'll need to use the **Open in** box to pick which browser opens the site. - - - **IE11**. Opens the site in IE11, regardless of which browser is opened by the employee. - - - **MSEdge**. Opens the site in Microsoft Edge, regardless of which browser is opened by the employee. - - - **None**. Opens in whatever browser the employee chooses. - -6. Click **Save** to validate your website and to add it to the site list for your enterprise.

-If your site passes validation, it’s added to the global compatibility list. If the site doesn’t pass validation, you’ll get an error message explaining the problem. You’ll then be able to either cancel the site or ignore the validation problem and add it to your list anyway. - -7. On the **File** menu, go to where you want to save the file, and then click **Save to XML**.

-You can save the file locally or to a network share. However, you must make sure you deploy it to the location specified in your registry key. For more information about the registry key, see [Turn on local control and logging for Enterprise Mode](turn-on-local-control-and-logging-for-enterprise-mode.md). - -## Next steps -After you’ve added all of your sites to the tool and saved the file to XML, you can configure the rest of the Enterprise Mode functionality to use it. You can also turn Enterprise Mode on locally, so your users have the option to use Enterprise Mode on individual websites from the **Tools** menu. For more information, see [Turn on local control and logging for Enterprise Mode](turn-on-local-control-and-logging-for-enterprise-mode.md). - -## Related topics -- [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) -  - -  - - - diff --git a/browsers/enterprise-mode/administrative-templates-and-ie11.md b/browsers/enterprise-mode/administrative-templates-and-ie11.md deleted file mode 100644 index d92810ceb5..0000000000 --- a/browsers/enterprise-mode/administrative-templates-and-ie11.md +++ /dev/null @@ -1,82 +0,0 @@ ---- -ms.localizationpriority: low -ms.mktglfcycl: deploy -ms.pagetype: security -description: Administrative templates and Internet Explorer 11 -author: dansimp -ms.prod: ie11 -ms.assetid: 2b390786-f786-41cc-bddc-c55c8a4c5af3 -ms.reviewer: -manager: dansimp -ms.author: dansimp -title: Administrative templates and Internet Explorer 11 (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Administrative templates and Internet Explorer 11 - -Administrative Templates are made up of a hierarchy of policy categories and subcategories that define how your policy settings appear in the Local Group Policy Editor, including: - -- What registry locations correspond to each setting. - -- What value options or restrictions are associated with each setting. - -- The default value for many settings. - -- Text explanations about each setting and the supported version of Internet Explorer. - -For a conceptual overview of Administrative Templates, see [Managing Group Policy ADMX Files Step-by-Step Guide](https://go.microsoft.com/fwlink/p/?LinkId=214519). - -## What are Administrative Templates? -Administrative Templates are XML-based, multi-language files that define the registry-based Group Policy settings in the Local Group Policy Editor. There are two types of Administrative Templates: - -- **ADMX.** A language-neutral setup file that states the number and type of policy setting, and the location by category, as it shows up in the Local Group Policy Editor. - -- **ADML.** A language-specific setup file that provides language-related information to the ADMX file. This file lets the policy setting show up in the right language in the Local Group Policy Editor. You can add new languages by adding new ADML files in the required language. - -## How do I store Administrative Templates? -As an admin, you can create a central store folder on your SYSVOL directory, named **PolicyDefinitions**. For example, %*SystemRoot*%\\PolicyDefinitions. This folder provides a single, centralized storage location for your Administrative Templates (both ADMX and ADML) files, so they can be used by your domain-based Group Policy Objects (GPOs). -

**Important**
Your Group Policy tools use the ADMX files in your store, ignoring any local copies. For more information about creating a central store, see [Scenario 1: Editing the Local GPO Using ADMX Files](https://go.microsoft.com/fwlink/p/?LinkId=276810). - -## Administrative Templates-related Group Policy settings -When you install Internet Explorer 11, it updates the local administrative files, Inetres.admx and Inetres.adml, both located in the **PolicyDefinitions** folder. -

**Note**
You won't see the new policy settings if you try to view or edit your policy settings on a computer that isn't running IE11. To fix this, you can either install IE11, or you can copy the updated Inetres.admx and Inetres.adml files from another computer to the **PolicyDefinitions** folder on this computer. - -IE11 provides these new policy settings, which are editable in the Local Group Policy Editor, and appear in the following policy paths: - -- Computer Configuration\\Administrative Templates\\Windows Components\\ - -- User Configuration\\Administrative Templates\\Windows Components\\ - - -|Catalog |Description | -| ------------------------------------------------ | --------------------------------------------| -|IE |Turns standard IE configuration on and off. | -|Internet Explorer\Accelerators |Sets up and manages Accelerators. | -|Internet Explorer\Administrator Approved Controls |Turns ActiveX controls on and off. | -|Internet Explorer\Application Compatibility |Turns the **Cut**, **Copy**, or **Paste** operations on or off. This setting also requires that `URLACTION_SCRIPT_PASTE` is set to **Prompt**. | -|Internet Explorer\Browser Menus |Shows or hides the IE menus and menu options.| -|Internet Explorer\Corporate Settings |Turns off whether you specify the code download path for each computer. | -|Internet Explorer\Delete Browsing History |Turns the **Delete Browsing History** settings on and off. | -|Internet Explorer\Internet Control Panel |Turns pages on and off in the **Internet Options** dialog box. Also turns on and off the subcategories that manage settings on the **Content**, **General**, **Security** and **Advanced** pages. | -|Internet Explorer\Internet Settings |Sets up and manages the **Advanced settings**, **AutoComplete**, **Display Settings**, and **URL Encoding** options. | -|Internet Explorer\Persistence Behavior |Sets up and manages the file size limits for Internet security zones. | -|Internet Explorer\Privacy |Turns various privacy-related features on and off. | -|Internet Explorer\Security Features |Turns various security-related features on and off in the browser, Windows Explorer, and other applications. | -|Internet Explorer\Toolbars |Turns on and off the ability for users to edit toolbars in the browser. You can also set the default toolbar buttons here. | -|RSS Feeds |Sets up and manages RSS feeds in the browser. | - - -## Editing Group Policy settings -Regardless which tool you're using to edit your Group Policy settings, you'll need to follow one of these guides for step-by-step editing instructions: - -- **If you're using the Group Policy Management Console (GPMC) or the Local Group Policy Editor.** See [Edit Administrative Template Policy Settings](https://go.microsoft.com/fwlink/p/?LinkId=214521) for step-by-step instructions about editing your Administrative Templates. - -- **If you're using GPMC with Advanced Group Policy Management (AGPM).** See [Checklist: Create, Edit, and Deploy a GPO](https://go.microsoft.com/fwlink/p/?LinkId=214522) for step-by-step instructions about how to check out a GPO from the AGPM archive, edit it, and request deployment. - -## Related topics -- [Administrative templates (.admx) for Windows 10 download](https://go.microsoft.com/fwlink/p/?LinkId=746579) -- [Administrative Templates (.admx) for Windows 8.1 and Windows Server 2012 R2](https://go.microsoft.com/fwlink/p/?LinkId=746580) - diff --git a/browsers/enterprise-mode/approve-change-request-enterprise-mode-portal.md b/browsers/enterprise-mode/approve-change-request-enterprise-mode-portal.md deleted file mode 100644 index fd58f63df5..0000000000 --- a/browsers/enterprise-mode/approve-change-request-enterprise-mode-portal.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -ms.localizationpriority: low -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Details about how Approvers can approve open change requests in the Enterprise Mode Site List Portal. -author: dansimp -ms.prod: ie11 -title: Approve a change request using the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 -ms.reviewer: -manager: dansimp -ms.author: dansimp ---- - -# Approve a change request using the Enterprise Mode Site List Portal - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -After a change request is successfully submitted to the pre-defined Approver(s), employees granted the role of **App Manager**, **Group Head**, or **Administrator**, they must approve the changes. - -## Approve or reject a change request -The Approvers get an email stating that a Requester successfully opened, tested, and submitted the change request to the Approvers group. The Approvers can accept or reject a change request. - -**To approve or reject a change request** -1. The Approver logs onto the Enterprise Mode Site List Portal, **All Approvals** page. - - The Approver can also get to the **All Approvals** page by clicking **Approvals Pending** from the left pane. - -2. The Approver clicks the expander arrow (**\/**) to the right side of the change request, showing the list of Approvers and the **Approve** and **Reject** buttons. - -3. The Approver reviews the change request, making sure it's correct. If the info is correct, the Approver clicks **Approve** to approve the change request. If the info seems incorrect, or if the app shouldn't be added to the site list, the Approver clicks **Reject**. - - An email is sent to the Requester, the Approver(s) group, and the Administrator(s) group, with the updated status of the request. - - -## Send a reminder to the Approver(s) group -If the change request is sitting in the approval queue for too long, the Requester can send a reminder to the group. - -- From the **My Approvals** page, click the checkbox next to the name of each Approver to be reminded, and then click **Send reminder**. - - An email is sent to the selected Approver(s). - - -## View rejected change requests -The original Requester, the Approver(s) group, and the Administrator(s) group can all view the rejected change request. - -**To view the rejected change request** - -- In the Enterprise Mode Site List Portal, click **Rejected** from the left pane. - - All rejected change requests appear, with role assignment determining which ones are visible. - - -## Next steps -After an Approver approves the change request, it must be scheduled for inclusion in the production Enterprise Mode Site List. For the scheduling steps, see the [Schedule approved change requests for production using the Enterprise Mode Site List Portal](schedule-production-change-enterprise-mode-portal.md) topic. diff --git a/browsers/enterprise-mode/check-for-new-enterprise-mode-site-list-xml-file.md b/browsers/enterprise-mode/check-for-new-enterprise-mode-site-list-xml-file.md deleted file mode 100644 index 7696eedaca..0000000000 --- a/browsers/enterprise-mode/check-for-new-enterprise-mode-site-list-xml-file.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Check for a new Enterprise Mode site list xml file (Internet Explorer 11 for IT Pros) -description: You can have centralized control over Enterprise Mode by creating a single, global XML site list that includes the list of websites to render using Enterprise Mode. -ms.assetid: 2bbc7017-622e-4baa-8981-c0bbda10e9df -ms.reviewer: -manager: dansimp -ms.prod: ie11 -ms.mktglfcycl: deploy -ms.pagetype: appcompat -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.date: 08/14/2017 -ms.localizationpriority: low ---- - - -# Check for a new Enterprise Mode site list xml file - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -You can have centralized control over Enterprise Mode by creating a single, global XML site list that includes the list of websites to render using Enterprise Mode. You can add and remove sites from your XML list as frequently as you want, changing which sites should render in Enterprise Mode for your employees. For information about turning on Enterprise Mode and using site lists, see [Turn on Enterprise Mode and use a site list](turn-on-enterprise-mode-and-use-a-site-list.md). - -The information in this topic only covers HTTPS protocol. We strongly recommend that you use HTTPS protocol instead of file protocol due to increased performance. - -**How Internet Explorer 11 looks for an updated site list** - -1. Internet Explorer starts up and looks for an updated site list in the following places: - - 1. **In the cache container.** IE first checks the cache container to see if it finds your XML site list. - - 2. **In the local cache.** If there’s nothing in the cache container, IE checks your local cache for the site list. - - 3. **On the server.** Based on standard IE caching rules, IE might look for a copy of your site list in the location you put specified in the **SiteList** value of the registry. - -2. If there’s an .xml file in the cache container, IE waits 65 seconds and then checks the local cache for a newer version of the file from the server, based on standard caching rules. If the server file has a different version number than the version in the cache container, the server file is used and stored in the cache container.

**Note**
If you’re already using a site list, enterprise mode continues to work during the 65 second wait; it just uses your existing site list instead of your new one. - -   - -  - -  - - - diff --git a/browsers/enterprise-mode/collect-data-using-enterprise-site-discovery.md b/browsers/enterprise-mode/collect-data-using-enterprise-site-discovery.md deleted file mode 100644 index 91c262c502..0000000000 --- a/browsers/enterprise-mode/collect-data-using-enterprise-site-discovery.md +++ /dev/null @@ -1,446 +0,0 @@ ---- -ms.localizationpriority: low -ms.mktglfcycl: deploy -description: Use Internet Explorer to collect data on computers running Windows Internet Explorer 8 through Internet Explorer 11 on Windows 10, Windows 8.1, or Windows 7. -author: dansimp -ms.prod: ie11 -ms.assetid: a145e80f-eb62-4116-82c4-3cc35fd064b6 -ms.reviewer: -manager: dansimp -ms.author: dansimp -title: Collect data using Enterprise Site Discovery -ms.sitesec: library -ms.date: 07/27/2017 ---- - -# Collect data using Enterprise Site Discovery - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 with Service Pack 1 (SP1) - -Use Internet Explorer to collect data on computers running Windows Internet Explorer 8 through Internet Explorer 11 on Windows 10, Windows 8.1, or Windows 7. This inventory information helps you build a list of websites used by your company so you can make more informed decisions about your IE deployments, including figuring out which sites might be at risk or require overhauls during future upgrades. - ->**Upgrade Analytics and Windows upgrades**
->You can use Upgrade Analytics to help manage your Windows 10 upgrades on devices running Windows 8.1 and Windows 7 (SP1). You can also use Upgrade Analytics to review several site discovery reports. Check out Upgrade Analytics from [here](https://technet.microsoft.com/itpro/windows/deploy/upgrade-analytics-get-started). - - -## Before you begin -Before you start, you need to make sure you have the following: - -- Latest cumulative security update (for all supported versions of Internet Explorer): - - 1. Go to the [Microsoft Security Bulletin](https://go.microsoft.com/fwlink/p/?LinkID=718223) page, and change the filter to **Windows Internet Explorer 11**. - - ![microsoft security bulletin techcenter.](images/securitybulletin-filter.png) - - 2. Click the title of the latest cumulative security update, and then scroll down to the **Affected software** table. - - ![affected software section.](images/affectedsoftware.png) - - 3. Click the link that represents both your operating system version and Internet Explorer 11, and then follow the instructions in the **How to get this update** section. - -- [Setup and configuration package](https://go.microsoft.com/fwlink/p/?LinkId=517719), including: - - - Configuration-related PowerShell scripts - - - IETelemetry.mof file - - - Sample Configuration Manager report templates - - You must use System Center 2012 R2 Configuration Manager or later for these samples to work. - -Both the PowerShell script and the Managed Object Format (.MOF) file need to be copied to the same location on the client device, before you run the scripts. - -## What data is collected? -Data is collected on the configuration characteristics of IE and the sites it browses, as shown here. - -|Data point |IE11 |IE10 |IE9 |IE8 |Description | -|------------------------|-----|-----|-----|-----|------------------------------------------------------------------------| -|URL | X | X | X | X |URL of the browsed site, including any parameters included in the URL. | -|Domain | X | X | X | X |Top-level domain of the browsed site. | -|ActiveX GUID | X | X | X | X |GUID of the ActiveX controls loaded by the site. | -|Document mode | X | X | X | X |Document mode used by IE for a site, based on page characteristics. | -|Document mode reason | X | X | | |The reason why a document mode was set by IE. | -|Browser state reason | X | X | | |Additional information about why the browser is in its current state. Also called, browser mode. | -|Hang count | X | X | X | X |Number of visits to the URL when the browser hung. | -|Crash count | X | X | X | X |Number of visits to the URL when the browser crashed. | -|Most recent navigation failure (and count) | X | X | X | X |Description of the most recent navigation failure (like, a 404 bad request or 500 internal server error) and the number of times it happened. | -|Number of visits | X | X | X | X |Number of times a site has been visited. | -|Zone | X | X | X | X |Zone used by IE to browse sites, based on browser settings. | - - ->**Important**
By default, IE doesn’t collect this data; you have to turn this feature on if you want to use it. After you turn on this feature, data is collected on all sites visited by IE, except during InPrivate sessions. Additionally, the data collection process is silent, so there’s no notification to the employee. Therefore, you must get consent from the employee before you start collecting info. You must also make sure that using this feature complies with all applicable local laws and regulatory requirements. - -### Understanding the returned reason codes -The following tables provide more info about the Document mode reason, Browser state reason, and the Zone codes that are returned as part of your data collection. - -#### DocMode reason -The codes in this table can tell you what document mode was set by IE for a webpage.
These codes only apply to Internet Explorer 10 and Internet Explorer 11. - -|Code |Description | -|-----|------------| -|3 |Page state is set by the `FEATURE_DOCUMENT_COMPATIBLE_MODE` feature control key.| -|4 |Page is using an X-UA-compatible meta tag. | -|5 |Page is using an X-UA-compatible HTTP header. | -|6 |Page appears on an active **Compatibility View** list. | -|7 |Page is using native XML parsing. | -|8 |Page is using a special Quirks Mode Emulation (QME) mode that uses the modern layout engine, but the quirks behavior of Internet Explorer 5. | -|9 |Page state is set by the browser mode and the page's DOCTYPE.| - -#### Browser state reason -The codes in this table can tell you why the browser is in its current state. Also called “browser mode”.
These codes only apply to Internet Explorer 10 and Internet Explorer 11. - -|Code |Description | -|-----|------------| -|1 |Site is on the intranet, with the **Display intranet sites in Compatibility View** box checked. | -|2 |Site appears on an active **Compatibility View** list, created in Group Policy. | -|3 |Site appears on an active **Compatibility View** list, created by the user. | -|4 |Page is using an X-UA-compatible tag. | -|5 |Page state is set by the **Developer** toolbar. | -|6 |Page state is set by the `FEATURE_BROWSER_EMULATION` feature control key. | -|7 |Site appears on the Microsoft **Compatibility View (CV)** list. | -|8 |Site appears on the **Quirks** list, created in Group Policy. | -|11 |Site is using the default browser. | - -#### Zone -The codes in this table can tell you what zone is being used by IE to browse sites, based on browser settings.
These codes apply to Internet Explorer 8, Internet Explorer 9, Internet Explorer 10, and Internet Explorer 11. - -|Code |Description | -|-----|------------| -|-1 |Internet Explorer is using an invalid zone. | -|0 |Internet Explorer is using the Local machine zone. | -|1 |Internet Explorer is using the Local intranet zone. | -|2 |Internet Explorer is using the Trusted sites zone. | -|3 |Internet Explorer is using the Internet zone. | -|4 |Internet Explorer is using the Restricted sites zone. | - -## Where is the data stored and how do I collect it? -The data is stored locally, in an industry-standard WMI class, .MOF file or in an XML file, depending on your configuration. This file remains on the client computer until it’s collected. To collect the files, we recommend: - -- **WMI file**. Use Microsoft Configuration Manager or any agent that can read the contents of a WMI class on your computer. - -- **XML file**. Any agent that works with XML can be used. - -## WMI Site Discovery suggestions -We recommend that you collect your data for at most a month at a time, to capture a user’s typical workflow. We don’t recommend collecting data longer than that because the data is stored in a WMI provider and can fill up your computer’s hard drive. You may also want to collect data only for pilot users or a representative sample of people, instead of turning this feature on for everyone in your company. - -On average, a website generates about 250bytes of data for each visit, causing only a minor impact to Internet Explorer’s performance. Over the course of a month, collecting data from 20 sites per day from 1,000 users, you’ll get about 150MB of data:

250 bytes (per site visit) X 20 sites/day X 30 days = (approximately) 150KB X 1000 users = (approximately) 150MB - ->**Important**
The data collection process is silent, so there’s no notification to the employee. Therefore, you must get consent from the employee before you start collecting info. You must also make sure that using this feature complies with all applicable local laws and regulatory requirements. - -## Getting ready to use Enterprise Site Discovery -Before you can start to collect your data, you must run the provided PowerShell script (IETelemetrySetUp.ps1) on your client devices to start generating the site discovery data and to set up a place to store this data locally. Then, you must start collecting the site discovery data from the client devices, using one of these three options: - -- Collect your hardware inventory using the MOF Editor, while connecting to a client device.

--OR- -- Collect your hardware inventory using the MOF Editor with a .MOF import file.

--OR- -- Collect your hardware inventory using the SMS\DEF.MOF file (Configuration Manager 2007 only) - -### WMI only: Running the PowerShell script to compile the .MOF file and to update security privileges -You need to set up your computers for data collection by running the provided PowerShell script (IETelemetrySetUp.ps1) to compile the .mof file and to update security privileges for the new WMI classes. - ->**Important**
You must run this script if you’re using WMI as your data output. It's not necessary if you're using XML as your data output. - -**To set up Enterprise Site Discovery** - -- Start PowerShell in elevated mode (using admin privileges) and run IETelemetrySetUp.ps1 by by-passing the PowerShell execution policy, using this command: `powershell -ExecutionPolicy Bypass .\IETelemetrySetUp.ps1`. For more info, see [about Execution Policies](https://go.microsoft.com/fwlink/p/?linkid=517460). - -### WMI only: Set up your firewall for WMI data -If you choose to use WMI as your data output, you need to make sure that your WMI data can travel through your firewall for the domain. If you’re sure, you can skip this section; otherwise, follow these steps: - -**To set up your firewall** - -1. In **Control Panel**, click **System and Security**, and then click **Windows Firewall**. - -2. In the left pane, click **Allow an app or feature through Windows Firewall** and scroll down to check the box for **Windows Management Instrumentation (WMI)**. - -3. Restart your computer to start collecting your WMI data. - -## Use PowerShell to finish setting up Enterprise Site Discovery -You can determine which zones or domains are used for data collection, using PowerShell. If you don’t want to use PowerShell, you can do this using Group Policy. For more info, see [Use Group Policy to finish setting up Enterprise Site Discovery](#use-group-policy-to-finish-setting-up-enterprise-site-discovery). - ->**Important**
The .ps1 file updates turn on Enterprise Site Discovery and WMI collection for all users on a device. - -- **Domain allow list.** If you have a domain allow list, a comma-separated list of domains that should have this feature turned on, you should use this process. - -- **Zone allow list.** If you have a zone allow list, a comma-separated list of zones that should have this feature turned on, you should use this process. - -**To set up data collection using a domain allow list** - -- Start PowerShell in elevated mode (using admin privileges) and run IETelemetrySetUp.ps1, using this command: `.\IETelemetrySetUp.ps1 [other args] -SiteAllowList sharepoint.com,outlook.com,onedrive.com`. - - >**Important**
Wildcards, like \*.microsoft.com, aren’t supported. - -**To set up data collection using a zone allow list** - -- Start PowerShell in elevated mode (using admin privileges) and run IETelemetrySetUp.ps1, using this command: `.\IETelemetrySetUp.ps1 [other args] -ZoneAllowList Computer,Intranet,TrustedSites,Internet,RestrictedSites`. - - >**Important**
Only Computer, Intranet, TrustedSites, Internet, and RestrictedSites are supported. - -## Use Group Policy to finish setting up Enterprise Site Discovery -You can use Group Policy to finish setting up Enterprise Site Discovery. If you don’t want to use Group Policy, you can do this using PowerShell. For more info, see [Use Powershell to finish setting up Enterprise Site Discovery](#use-powershell-to-finish-setting-up-enterprise-site-discovery). - ->**Note**
 All of the Group Policy settings can be used individually or as a group. - - **To set up Enterprise Site Discovery using Group Policy** - -- Open your Group Policy editor, and go to these new settings: - - |Setting name and location |Description |Options | - |---------------------------|-------------|---------| - |Administrative Templates\Windows Components\Internet Explorer\Turn on Site Discovery WMI output |Writes collected data to a WMI class, which can be aggregated using a client-management solution like Configuration Manager. |

| - |Administrative Templates\Windows Components\Internet Explorer\Turn on Site Discovery XML output |Writes collected data to an XML file, which is stored in your specified location. | | - |Administrative Templates\Windows Components\Internet Explorer\Limit Site Discovery output by Zone |Manages which zone can collect data. |To specify which zones can collect data, you must include a binary number that represents your selected zones, based on this order:

0 – Restricted Sites zone
0 – Internet zone
0 – Trusted Sites zone
0 – Local Intranet zone
0 – Local Machine zone

**Example 1:** Include only the Local Intranet zone

Binary representation: *00010*, based on:

0 – Restricted Sites zone
0 – Internet zone
0 – Trusted Sites zone
1 – Local Intranet zone
0 – Local Machine zone

**Example 2:** Include only the Restricted Sites, Trusted Sites, and Local Intranet zones

Binary representation: *10110*, based on:

1 – Restricted Sites zone
0 – Internet zone
1 – Trusted Sites zone
1 – Local Intranet zone
1 – Local Machine zone | - |Administrative Templates\Windows Components\Internet Explorer\Limit Site Discovery output by domain |Manages which domains can collect data |To specify which domains can collect data, you must include your selected domains, one domain per line, in the provided box. It should look like:

microsoft.sharepoint.com
outlook.com
onedrive.com
timecard.contoso.com
LOBApp.contoso.com | - -### Combining WMI and XML Group Policy settings -You can use both the WMI and XML settings individually or together: - -**To turn off Enterprise Site Discovery** - -|Setting name |Option | -|---------|---------| -|Turn on Site Discovery WMI output | Off | -|Turn on Site Discovery XML output | Blank | - -**Turn on WMI recording only** - -|Setting name |Option | -|---------|---------| -|Turn on Site Discovery WMI output | On | -|Turn on Site Discovery XML output | Blank | - -**To turn on XML recording only** - -|Setting name |Option | -|---------|---------| -|Turn on Site Discovery WMI output | Off | -|Turn on Site Discovery XML output | XML file path | - -**To turn on both WMI and XML recording** - -|Setting name |Option | -|---------|---------| -|Turn on Site Discovery WMI output | On | -|Turn on Site Discovery XML output | XML file path | - -## Use Configuration Manager to collect your data -After you’ve collected your data, you’ll need to get the local files off of your employee’s computers. To do this, use the hardware inventory process in Configuration Manager, using one of these options: - -- Collect your hardware inventory using the MOF Editor, while connecting to a client device.

--OR- -- Collect your hardware inventory using the MOF Editor with a .MOF import file.

--OR- -- Collect your hardware inventory using the SMS\DEF.MOF file (Configuration Manager 2007 only) - -### Collect your hardware inventory using the MOF Editor while connected to a client device -You can collect your hardware inventory using the MOF Editor, while you’re connected to your client devices. - - **To collect your inventory** - -1. From the Configuration Manager, click **Administration**, click **Client Settings**, double-click **Default Client Settings**, click **Hardware Inventory**, and then click **Set Classes**. - - ![Configuration Manager, showing the hardware inventory settings for client computers.](images/configmgrhardwareinventory.png) - -2. Click **Add**, click **Connect**, and connect to a computer that has completed the setup process and has already existing classes. - -3. Change the **WMI Namespace** to `root\cimv2\IETelemetry`, and click **Connect**. - - ![Configuration Manager, with the Connect to Windows Management Instrumentation (WMI) box.](images/ie11-inventory-addclassconnectscreen.png) - -4. Select the check boxes next to the following classes, and then click **OK**: - - - IESystemInfo - - - IEURLInfo - - - IECountInfo - -5. Click **OK** to close the default windows.
-Your environment is now ready to collect your hardware inventory and review the sample reports. - -### Collect your hardware inventory using the MOF Editor with a .MOF import file -You can collect your hardware inventory using the MOF Editor and a .MOF import file. - - **To collect your inventory** - -1. From the Configuration Manager, click **Administration**, click **Client Settings**, double-click **Default Client Settings**, click **Hardware Inventory**, and then click **Set Classes**. - -2. Click **Import**, choose the MOF file from the downloaded package we provided, and click **Open**. - -3. Pick the inventory items to install, and then click **Import**. - -4. Click **OK** to close the default windows.
-Your environment is now ready to collect your hardware inventory and review the sample reports. - -### Collect your hardware inventory using the SMS\DEF.MOF file (Configuration Manager 2007 only) -You can collect your hardware inventory using the using the Systems Management Server (SMS\DEF.MOF) file. Editing this file lets you collect your data for Configuration Manager 2007. If you aren’t using this version of Configuration Manager, you won’t want to use this option. - -**To collect your inventory** - -1. Using a text editor like Notepad, open the SMS\DEF.MOF file, located in your `\inboxes\clifiles.src\hinv` directory. - -2. Add this text to the end of the file: - - ``` - [SMS_Report (TRUE), - SMS_Group_Name ("IESystemInfo"), - SMS_Class_ID ("MICROSOFT|IESystemInfo|1.0"), - Namespace ("root\\\\cimv2\\\\IETelemetry") ] - Class IESystemInfo: SMS_Class_Template - { - [SMS_Report (TRUE), Key ] - String SystemKey; - [SMS_Report (TRUE) ] - String IEVer; - }; - - [SMS_Report (TRUE), - SMS_Group_Name ("IEURLInfo"), - SMS_Class_ID ("MICROSOFT|IEURLInfo|1.0"), - Namespace ("root\\\\cimv2\\\\IETelemetry") ] - Class IEURLInfo: SMS_Class_Template - { - [SMS_Report (TRUE), Key ] - String URL; - [SMS_Report (TRUE) ] - String Domain; - [SMS_Report (TRUE) ] - UInt32 DocMode; - [SMS_Report (TRUE) ] - UInt32 DocModeReason; - [SMS_Report (TRUE) ] - UInt32 Zone; - [SMS_Report (TRUE) ] - UInt32 BrowserStateReason; - [SMS_Report (TRUE) ] - String ActiveXGUID[]; - [SMS_Report (TRUE) ] - UInt32 CrashCount; - [SMS_Report (TRUE) ] - UInt32 HangCount; - [SMS_Report (TRUE) ] - UInt32 NavigationFailureCount; - [SMS_Report (TRUE) ] - UInt32 NumberOfVisits; - [SMS_Report (TRUE) ] - UInt32 MostRecentNavigationFailure; - }; - - [SMS_Report (TRUE), - SMS_Group_Name ("IECountInfo"), - SMS_Class_ID ("MICROSOFT|IECountInfo|1.0"), - Namespace ("root\\\\cimv2\\\\IETelemetry") ] - Class IECountInfo: SMS_Class_Template - { - [SMS_Report (TRUE), Key ] - String CountKey; - [SMS_Report (TRUE) ] - UInt32 CrashCount; - [SMS_Report (TRUE) ] - UInt32 HangCount; - [SMS_Report (TRUE) ] - UInt32 NavigationFailureCount; - }; - ``` - -3. Save the file and close it to the same location. - Your environment is now ready to collect your hardware inventory and review the sample reports. - -## View the sample reports with your collected data -The sample reports, **Configuration Manager Report Sample – ActiveX.rdl** and **Configuration Manager Report Sample – Site Discovery.rdl**, work with System Center 2012, so you can review your collected data. - -### Configuration Manager Report Sample – ActiveX.rdl -Gives you a list of all of the ActiveX-related sites visited by the client computer. - -![ActiveX.rdl report, lists all ActiveX-related sites visited by the client computer.](images/configmgractivexreport.png) - -### Configuration Manager Report Sample – Site Discovery.rdl -Gives you a list of all of the sites visited by the client computer. - -![Site Discovery.rdl report, lists all websites visited by the client computer.](images/ie-site-discovery-sample-report.png) - -## View the collected XML data -After the XML files are created, you can use your own solutions to extract and parse the data. The data will look like: - -``` xml - - - [dword] - [dword] - [dword] - - - [string] - - [guid] - - [dword] - [dword] - [dword] - [dword] - [dword] - [dword] - [dword] - [dword] - [string] - [dword] - - - - -``` -You can import this XML data into the correct version of the Enterprise Mode Site List Manager, automatically adding the included sites to your Enterprise Mode site list. - -**To add your XML data to your Enterprise Mode site list** - -1. Open the Enterprise Mode Site List Manager, click **File**, and then click **Bulk add from file**. - - ![Enterprise Mode Site List Manager with Bulk add from file option.](images/bulkadd-emiesitelistmgr.png) - -2. Go to your XML file to add the included sites to the tool, and then click **Open**.
Each site is validated and if successful, added to the global site list when you click **OK** to close the menu. If a site doesn’t pass validation, you can try to fix the issues or pick the site and click **Add to list** to ignore the validation problem. For more information about fixing validation problems, see [Fix validation problems using the Enterprise Mode Site List Manager](fix-validation-problems-using-the-enterprise-mode-site-list-manager.md). - -3. Click **OK** to close the **Bulk add sites to the list** menu. - -## Turn off data collection on your client devices -After you’ve collected your data, you’ll need to turn Enterprise Site Discovery off. - -**To stop collecting data, using PowerShell** - -- On your client computer, start Windows PowerShell in elevated mode (using admin privileges) and run `IETelemetrySetUp.ps1`, using this command: `powershell -ExecutionPolicy Bypass .\IETelemetrySetUp.ps1 –IEFeatureOff`. - - >**Note**
Turning off data collection only disables the Enterprise Site Discovery feature – all data already written to WMI stays on your employee’s computer. - - -**To stop collecting data, using Group Policy** - -1. Open your Group Policy editor, go to `Administrative Templates\Windows Components\Internet Explorer\Turn on Site Discovery WMI output`, and click **Off**. - -2. Go to `Administrative Templates\Windows Components\Internet Explorer\Turn on Site Discovery XML output`, and clear the file path location. - -### Delete already stored data from client computers -You can completely remove the data stored on your employee’s computers. - -**To delete all existing data** - -- On the client computer, start PowerShell in elevated mode (using admin privileges) and run these four commands: - - - `Remove-WmiObject -Namespace root/cimv2/IETelemetry IEURLInfo` - - - `Remove-WmiObject -Namespace root/cimv2/IETelemetry IESystemInfo` - - - `Remove-WmiObject -Namespace root/cimv2/IETelemetry IECountInfo` - - - `Remove-Item -Path 'HKCU:\Software\Microsoft\Internet Explorer\WMITelemetry'` - -## Related topics -* [Enterprise Mode Site List Manager (schema v.2) download](https://go.microsoft.com/fwlink/?LinkId=746562) -* [Enterprise Mode for Internet Explorer 11 (IE11)](enterprise-mode-overview-for-ie11.md) -  - - - diff --git a/browsers/enterprise-mode/configure-settings-enterprise-mode-portal.md b/browsers/enterprise-mode/configure-settings-enterprise-mode-portal.md deleted file mode 100644 index 807cc8d2c8..0000000000 --- a/browsers/enterprise-mode/configure-settings-enterprise-mode-portal.md +++ /dev/null @@ -1,97 +0,0 @@ ---- -ms.localizationpriority: low -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Details about how the Administrator can use the Settings page to set up Groups and roles, the Enterprise Mode Site List Portal environment, and the freeze dates for production changes. -author: dansimp -ms.prod: ie11 -title: Use the Settings page to finish setting up the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 -ms.reviewer: -manager: dansimp -ms.author: dansimp ---- - -# Use the Settings page to finish setting up the Enterprise Mode Site List Portal - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -The **Settings** page lets anyone with Administrator rights set up groups and roles, set up the Enterprise Mode Site List Portal environment, and choose the freeze dates for production changes. - -## Use the Environment settings area -This area lets you specify the location of your production and pre-production environments, where to store your attachments, your settings location, and the website domain for email notifications. - -**To add location info** -1. Open the Enterprise Mode Site List Portal and click the **Settings** icon in the upper-right area of the page. - - The **Settings** page appears. - -2. In the **Environment settings** area of the page, provide the info for your **Pre-production environment**, your **Production environment**, your **Attachments location**, your **Settings location**, and your **Website domain for email notifications**. - -3. Click **Credentials** to add the appropriate domain, user name, and password for each location, and then click **OK**. - -## Use the Group and role settings area -After you set up your email credentials, you'll be able to add or edit your Group info, along with picking which roles must be Approvers for the group. - -**To add a new group and determine the required change request Approvers** -1. Open the Enterprise Mode Site List Portal and click the **Settings** icon in the upper-right area of the page. - - The **Settings** page appears. - -2. In the **Group and role settings** area of the page, click **Group details**. - - The **Add or edit group names** box appears. - -3. Click the **Add group** tab, and then add the following info: - - - **New group name.** Type name of your new group. - - - **Group head email.** Type the email address for the primary contact for the group. - - - **Group head name.** This box automatically fills, based on the email address. - - - **Active.** Click the check box to make the group active in the system. If you want to keep the group in the system, but you want to prevent access, clear this check box. - -4. Click **Save**. - - -**To set a group's required Approvers** -1. In the **Group and role settings** area of the page, choose the group name you want to update with Approvers from the **Group name** box. - -2. In the **Required approvers** area, choose which roles are required to approve a change request for the group. You can choose one or many roles. - - - **App Manager.** All employees in the selected group must get change request approval by someone assigned this role. - - You can change the name of this role by clicking the pencil icon and providing a new name in the **Edit role name** box. - - - **Group Head.** All employees in the selected group must get change request approval by someone assigned this role. - - You can change the name of this role by clicking the pencil icon and providing a new name in the **Edit role name** box. - - - **Administrator.** All employees in the selected group must get change request approval by someone assigned this role. - -## Use the Freeze production changes area -This optional area lets you specify a period when your employees must stop adding changes to the current Enterprise Mode Site List. This must include both a start and an end date. - -**To add the start and end dates** -1. Open the Enterprise Mode Site List Portal and click the **Settings** icon in the upper-right area of the page. - - The **Settings** page appears. - -2. In the **Freeze production changes** area of the page, use the calendars to provide the **Freeze start date** and the **Freeze end date**. Your employees can't add apps to the production Enterprise Mode Site List during this span of time. - -3. Click **Save**. - -## Related topics -- [Enterprise Mode Site List Portal source code](https://github.com/MicrosoftEdge/enterprise-mode-site-list-portal) - -- [Enterprise Mode and the Enterprise Mode Site List](what-is-enterprise-mode.md) - -- [Use the Enterprise Mode Site List Manager tool or page](use-the-enterprise-mode-site-list-manager.md) diff --git a/browsers/enterprise-mode/create-change-request-enterprise-mode-portal.md b/browsers/enterprise-mode/create-change-request-enterprise-mode-portal.md deleted file mode 100644 index 867bb143b8..0000000000 --- a/browsers/enterprise-mode/create-change-request-enterprise-mode-portal.md +++ /dev/null @@ -1,73 +0,0 @@ ---- -ms.localizationpriority: low -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Details about how to create a change request within the Enterprise Mode Site List Portal. -author: dansimp -ms.prod: ie11 -title: Create a change request using the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 -ms.reviewer: -manager: dansimp -ms.author: dansimp ---- - -# Create a change request using the Enterprise Mode Site List Portal - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -Employees assigned to the Requester role can create a change request. A change request is used to tell the Approvers and the Administrator that a website needs to be added or removed from the Enterprise Mode Site List. The employee can navigate to each stage of the process by using the workflow links provided at the top of each page of the portal. - -> [!Important] -> Each Requester must have access to a test machine with Administrator rights, letting him or her get to the pre-production environment to make sure that the requested change is correct. - -**To create a new change request** -1. The Requester (an employee that has been assigned the Requester role) signs into the Enterprise Mode Site List Portal, and clicks **Create new request**. - - The **Create new request** page appears. - -2. Fill out the required fields, based on the group and the app, including: - - - **Group name.** Select the name of your group from the dropdown box. - - - **App name.** Type the name of the app you want to add, delete, or update in the Enterprise Mode Site List. - - - **Search all apps.** If you can't remember the name of your app, you can click **Search all apps** and search the list. - - - **Add new app.** If your app isn't listed, you can click **Add new app** to add it to the list. - - - **Requested by.** Automatically filled in with your name. - - - **Description.** Add descriptive info about the app. - - - **Requested change.** Select whether you want to **Add to EMIE**, **Delete from EMIE**, or **Update to EMIE**. - - - **Reason for request.** Select the best reason for why you want to update, delete, or add the app. - - - **Business impact (optional).** An optional area where you can provide info about the business impact of this app and the change. - - - **App location (URL).** The full URL location to the app, starting with https:// or https://. - - - **App best viewed in.** Select the best browser experience for the app. This can be Internet Explorer 5 through Internet Explorer 11 or one of the IE7Enterprise or IE8Enterprise modes. - - - **Is an x-ua tag used?** Select **Yes** or **No** whether an x-ua-compatible tag is used by the app. For more info about x-ua-compatible tags, see the topics in [Defining document compatibility](https://msdn.microsoft.com/library/cc288325(v=vs.85).aspx). - -4. Click **Save and continue** to save the request and get the app info sent to the pre-production environment site list for testing. - - A message appears that the request was successful, including a **Request ID** number, saying that the change is being made to the pre-production environment site list. - -5. The Requester gets an email with a batch script, that when run, configures their test machine for the pre-production environment, along with the necessary steps to make sure the changed info is correct. - - - **If the change is correct.** The Requester asks the approvers to approve the change request by selecting **Successful** and clicking **Send for approval**. - - - **If the change is incorrect.** The Requester can rollback the change in pre-production or ask for help from the Administrator. - -## Next steps -After the change request is created, the Requester must make sure the suggested changes work in the pre-production environment. For these steps, see [Verify your changes using the Enterprise Mode Site List Portal](verify-changes-preprod-enterprise-mode-portal.md). diff --git a/browsers/enterprise-mode/delete-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md b/browsers/enterprise-mode/delete-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md deleted file mode 100644 index ad225f2556..0000000000 --- a/browsers/enterprise-mode/delete-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -ms.localizationpriority: low -description: Delete a single site from your global Enterprise Mode site list. -ms.pagetype: appcompat -ms.mktglfcycl: deploy -author: dansimp -ms.prod: ie11 -ms.assetid: 41413459-b57f-48da-aedb-4cbec1e2981a -ms.reviewer: -manager: dansimp -ms.author: dansimp -title: Delete sites from your Enterprise Mode site list in the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Delete sites from your Enterprise Mode site list in the Enterprise Mode Site List Manager - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - - - **To delete a single site from your global Enterprise Mode site list** - -- From the Enterprise Mode Site List Manager, pick the site you want to delete, and then click **Delete**.
-The site is permanently removed from your list. - -If you delete a site by mistake, you’ll need to manually add it back using the instructions in the following topics, based on operating system. - -- [Add sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.2)](add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md) - -- [Add sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.1)](add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md) - -## Related topics -- [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) -- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) -- [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) -  - -  - - - diff --git a/browsers/enterprise-mode/edit-the-enterprise-mode-site-list-using-the-enterprise-mode-site-list-manager.md b/browsers/enterprise-mode/edit-the-enterprise-mode-site-list-using-the-enterprise-mode-site-list-manager.md deleted file mode 100644 index 403690d64f..0000000000 --- a/browsers/enterprise-mode/edit-the-enterprise-mode-site-list-using-the-enterprise-mode-site-list-manager.md +++ /dev/null @@ -1,53 +0,0 @@ ---- -ms.localizationpriority: low -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: You can use Internet Explorer 11 and the Enterprise Mode Site List Manager to change whether page rendering should use Enterprise Mode or the default Internet Explorer browser configuration. You can also add, remove, or delete associated comments. -author: dansimp -ms.prod: ie11 -ms.assetid: 76aa9a85-6190-4c3a-bc25-0f914de228ea -ms.reviewer: -manager: dansimp -ms.author: dansimp -title: Edit the Enterprise Mode site list using the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Edit the Enterprise Mode site list using the Enterprise Mode Site List Manager - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -You can use Internet Explorer 11 and the Enterprise Mode Site List Manager to change whether page rendering should use Enterprise Mode or the default Internet Explorer browser configuration. You can also add, remove, or delete associated comments. - -If you need to edit a lot of websites, you probably don’t want to do it one at a time. Instead, you can edit your saved XML or TXT file and add the sites back again. For information about how to do this, depending on your operating system and schema version, see [Add multiple sites to the Enterprise Mode site list using a file and Enterprise Mode Site List Manager (schema v.2)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md) or [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md). - - **To change how your page renders** - -1. In the Enterprise Mode Site List Manager, double-click the site you want to change. - -2. Change the comment or the compatibility mode option. - -3. Click **Save** to validate your changes and to add the updated information to your site list.
-If your change passes validation, it’s added to the global site list. If the update doesn’t pass validation, you’ll get an error message explaining the problem. You’ll then be able to either cancel the update or ignore the validation problem and add it to your list anyway. For more information about fixing validation issues, see [Fix validation problems using the Enterprise Mode Site List Manager](fix-validation-problems-using-the-enterprise-mode-site-list-manager.md). - -4. On the **File** menu, click **Save to XML**, and save the updated file.
-You can save the file locally or to a network share. However, you must make sure you deploy it to the location specified in your registry key. For more information about the registry key, see [Turn on Enterprise Mode and use a site list](turn-on-enterprise-mode-and-use-a-site-list.md). - -## Related topics -- [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) -- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) -- [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) -  - -  - - - diff --git a/browsers/enterprise-mode/enterprise-mode-and-enterprise-site-list-include.md b/browsers/enterprise-mode/enterprise-mode-and-enterprise-site-list-include.md deleted file mode 100644 index a8f90c3697..0000000000 --- a/browsers/enterprise-mode/enterprise-mode-and-enterprise-site-list-include.md +++ /dev/null @@ -1,50 +0,0 @@ -## Enterprise Mode and the Enterprise Mode Site List XML file -The Enterprise Mode Site List is an XML document that specifies a list of sites, their compat mode, and their intended browser. Using [Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853), you can automatically start a webpage using a specific browser. In the case of IE11, the webpage can also be launched in a specific compat mode, so it always renders correctly. Your employees can easily view this site list by typing _about:compat_ in either Microsoft Edge or IE11. - -Starting with Windows 10, version 1511 (also known as the Anniversary Update), you can also [restrict IE11 to only the legacy web apps that need it](https://blogs.windows.com/msedgedev/2016/05/19/edge14-ie11-better-together/), automatically sending sites not included in the Enterprise Mode Site List to Microsoft Edge. - -### Site list xml file - -This is a view of the [raw EMIE v2 schema.xml file](https://gist.github.com/kypflug/9e9961de771d2fcbd86b#file-emie-v2-schema-xml). There are equivalent Enterprise Mode Site List policies for both [Microsoft Edge](/microsoft-edge/deploy/emie-to-improve-compatibility) and [Internet Explorer 11](/internet-explorer/ie11-deploy-guide/turn-on-enterprise-mode-and-use-a-site-list). The Microsoft Edge list is used to determine which sites should open in IE11; while the IE11 list is used to determine the compat mode for a site, and which sites should open in Microsoft Edge. We recommend using one list for both browsers, where each policy points to the same XML file location. - -```xml - - - - EnterpriseSiteListManager - 10586 - 20150728.135021 - - - - IE8Enterprise - IE11 - - - default - IE11 - - - IE7Enterprise - IE11 - - - - - IE8Enterprise" - IE11 - - - IE7 - IE11 - - - IE7 - IE11 - - - -``` diff --git a/browsers/enterprise-mode/enterprise-mode-features-include.md b/browsers/enterprise-mode/enterprise-mode-features-include.md deleted file mode 100644 index 9da0e79778..0000000000 --- a/browsers/enterprise-mode/enterprise-mode-features-include.md +++ /dev/null @@ -1,17 +0,0 @@ -### Enterprise Mode features - -Enterprise Mode includes the following features: - -- **Improved web app and website compatibility.** Through improved emulation, Enterprise Mode lets many legacy web apps run unmodified on IE11, supporting several site patterns that aren’t currently supported by existing document modes. - -- **Tool-based management for website lists.** Use the Enterprise Mode Site List Manager to add website domains and domain paths and to specify whether a site renders using Enterprise Mode. -Download the [Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) or the [Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378), based on your operating system and schema. - -- **Centralized control.** You can specify the websites or web apps to interpret using Enterprise Mode, through an XML file on a website or stored locally. Domains and paths within those domains can be treated differently, allowing granular control. Use Group Policy to let users turn Enterprise Mode on or off from the Tools menu and to decide whether the Enterprise browser profile appears on the Emulation tab of the F12 developer tools. - - > [!Important] - > All centrally-made decisions override any locally-made choices. - -- **Integrated browsing.** When Enterprise Mode is set up, users can browse the web normally, letting the browser change modes automatically to accommodate Enterprise Mode sites. - -- **Data gathering.** You can configure Enterprise Mode to collect local override data, posting back to a named server. This lets you "crowd source" compatibility testing from key users; gathering their findings to add to your central site list. diff --git a/browsers/enterprise-mode/enterprise-mode-overview-for-ie11.md b/browsers/enterprise-mode/enterprise-mode-overview-for-ie11.md deleted file mode 100644 index ae103d5802..0000000000 --- a/browsers/enterprise-mode/enterprise-mode-overview-for-ie11.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -ms.localizationpriority: low -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Use the topics in this section to learn how to set up and use Enterprise Mode, Enterprise Mode Site List Manager, and the Enterprise Mode Site List Portal for your company. -author: dansimp -ms.prod: ie11 -ms.assetid: d52ba8ba-b3c7-4314-ba14-0610e1d8456e -ms.reviewer: -manager: dansimp -ms.author: dansimp -title: Enterprise Mode for Internet Explorer 11 (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Enterprise Mode for Internet Explorer 11 - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -Use the topics in this section to learn how to set up and use Enterprise Mode and the Enterprise Mode Site List Manager in your company. - -## In this section -|Topic |Description | -|---------------------------------------------------------------|-----------------------------------------------------------------------------------| -|[Enterprise Mode and the Enterprise Mode Site List](what-is-enterprise-mode.md)|Includes descriptions of the features of Enterprise Mode. | -|[Set up Enterprise Mode logging and data collection](set-up-enterprise-mode-logging-and-data-collection.md) |Guidance about how to turn on local control of Enterprise Mode and how to use ASP or the GitHub sample to collect data from your local computers. | -|[Turn on Enterprise Mode and use a site list](turn-on-enterprise-mode-and-use-a-site-list.md) |Guidance about how to turn on Enterprise Mode and set up a site list, using Group Policy or the registry. | -|[Enterprise Mode schema v.2 guidance](enterprise-mode-schema-version-2-guidance.md) |Guidance about how to write the XML for your site list, including what not to include, how to use trailing slashes, and info about how to target specific sites. | -|[Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md) |Guidance about how to write the XML for your site list, including what not to include, how to use trailing slashes, and info about how to target specific sites. | -|[Check for a new Enterprise Mode site list xml file](check-for-new-enterprise-mode-site-list-xml-file.md) |Guidance about how the Enterprise Mode functionality looks for your updated site list. | -|[Turn on local control and logging for Enterprise Mode](turn-on-local-control-and-logging-for-enterprise-mode.md) |Guidance about how to turn on local control of Enterprise Mode, using Group Policy or the registry.| -|[Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) |Guidance about how to use the Enterprise Mode Site List Manager, including how to add and update sites on your site list. | -|[Use the Enterprise Mode Site List Portal](use-the-enterprise-mode-portal.md) |Guidance about how to set up and use the Enterprise Mode Site List Manager, including how to add and update sites on your site list. | -|[Using Enterprise Mode](using-enterprise-mode.md) |Guidance about how to turn on either IE7 Enterprise Mode or IE8 Enterprise Mode. | -|[Fix web compatibility issues using document modes and the Enterprise Mode Site List](fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md) |Guidance about how to decide and test whether to use document modes or Enterprise Mode to help fix compatibility issues. | -|[Remove sites from a local Enterprise Mode site list](remove-sites-from-a-local-enterprise-mode-site-list.md) |Guidance about how to remove websites from a device's local Enterprise Mode site list. | -|[Remove sites from a local compatibility view list](remove-sites-from-a-local-compatibililty-view-list.md) |Guidance about how to remove websites from a device's local compatibility view list. | -|[Turn off Enterprise Mode](turn-off-enterprise-mode.md) |Guidance about how to stop using your site list and how to turn off local control, using Group Policy or the registry. | -  - -  - -  - - - diff --git a/browsers/enterprise-mode/enterprise-mode-schema-version-1-guidance.md b/browsers/enterprise-mode/enterprise-mode-schema-version-1-guidance.md deleted file mode 100644 index d04fbf79b9..0000000000 --- a/browsers/enterprise-mode/enterprise-mode-schema-version-1-guidance.md +++ /dev/null @@ -1,125 +0,0 @@ ---- -ms.localizationpriority: low -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Use the Enterprise Mode Site List Manager to create and update your Enterprise Mode site list for devices running Windows 7 or Windows 8.1 Update. -author: dansimp -ms.prod: ie11 -ms.assetid: 17c61547-82e3-48f2-908d-137a71938823 -ms.reviewer: -manager: dansimp -ms.author: dansimp -title: Enterprise Mode schema v.1 guidance (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Enterprise Mode schema v.1 guidance - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 - -Use the Enterprise Mode Site List Manager (schema v.1) to create and update your Enterprise Mode site list for devices running the v.1 version of the schema, or the Enterprise Mode Site List Manager (schema v.2) to create and update your Enterprise Mode site list for devices running the v.2 version of the schema. We strongly recommend moving to the new schema, v.2. For more info, see [Enterprise Mode schema v.2 guidance](enterprise-mode-schema-version-2-guidance.md). - -If you don't want to use the Enterprise Mode Site List Manager, you also have the option to update your XML schema using Notepad, or any other XML-editing app. - -## Enterprise Mode schema v.1 example -The following is an example of the Enterprise Mode schema v.1. This schema can run on devices running Windows 7 and Windows 8.1. - -**Important**
-Make sure that you don't specify a protocol when adding your URLs. Using a URL like `contoso.com` automatically applies to both https://contoso.com and https://contoso.com. - -``` xml - - - www.cpandl.com - www.woodgrovebank.com - adatum.com - contoso.com - relecloud.com - /about - - fabrikam.com - /products - - - - contoso.com - /travel - - fabrikam.com - /products - - - -``` - -### Schema elements -This table includes the elements used by the Enterprise Mode schema. -|Element |Description |Supported browser | -|---------|---------|---------| -|<rules> | Root node for the schema.
**Example**

<rules version="205"> 
<emie>
<domain>contoso.com</domain>
</emie>
</rules> |Internet Explorer 11 and Microsoft Edge | -|<emie> |The parent node for the Enterprise Mode section of the schema. All <domain> entries will have either IE8 Enterprise Mode or IE7 Enterprise Mode applied.
**Example**
<rules version="205"> 
<emie>
<domain>contoso.com</domain>
</emie>
</rules>

**or**
For IPv6 ranges:


<rules version="205">
<emie>
<domain>[10.122.34.99]:8080</domain>
</emie>
</rules>


**or**
For IPv4 ranges:

<rules version="205"> 
<emie>
<domain>[10.122.34.99]:8080</domain>
</emie>
</rules> | Internet Explorer 11 and Microsoft Edge | -|<docMode> |The parent node for the document mode section of the section. All <domain> entries will get IE5 - IE11 document modes applied. If there's a <domain> element in the docMode section that uses the same value as a <domain> element in the emie section, the emie element is applied.
**Example**
 
<rules version="205">
<docmode>
<domain docMode="7">contoso.com</domain>
</docmode>
</rules> |Internet Explorer 11 | -|<domain> |A unique entry added for each site you want to put on the Enterprise Mode site list. The first <domain> element will overrule any additional <domain> elements that use the same value for the section. You can use port numbers for this element.
**Example**
 
<emie>
<domain>contoso.com:8080</domain>
</emie> |Internet Explorer 11 and Microsoft Edge | -|<path> |A unique entry added for each path under a domain you want to put on the Enterprise Mode site list. The <path> element is a child of the <domain> element. Additionally, the first <path> element will overrule any additional <path> elements in the schema section.
**Example**
 
<emie>
<domain exclude="false">fabrikam.com
<path exclude="true">/products</path>
</domain>
</emie>


Where [https://fabrikam.com](https://fabrikam.com) doesn't use IE8 Enterprise Mode, but [https://fabrikam.com/products](https://fabrikam.com/products) does. |Internet Explorer 11 and Microsoft Edge | - -### Schema attributes -This table includes the attributes used by the Enterprise Mode schema. -|Attribute|Description|Supported browser| -|--- |--- |--- | -|<version>|Specifies the version of the Enterprise Mode Site List. This attribute is supported for the <rules> element.|Internet Explorer 11 and Microsoft Edge| -|<exclude>|Specifies the domain or path that is excluded from getting the behavior applied. This attribute is supported on the and elements.
**Example**

<emie>
<domain exclude="false">fabrikam.com
<path exclude="true">/products</path>
</domain>
</emie>

Where [https://fabrikam.com](https://fabrikam.com) doesn't use IE8 Enterprise Mode, but [https://fabrikam.com/products](https://fabrikam.com/products) does.|Internet Explorer 11 and Microsoft Edge| -|<docMode>|Specifies the document mode to apply. This attribute is only supported on <domain> or <path>elements in the <docMode> section.
**Example**

<docMode> 
<domain exclude="false">fabrikam.com
<path docMode="7">/products</path>
</domain>
</docMode>|Internet Explorer 11| - -### Using Enterprise Mode and document mode together -If you want to use both Enterprise Mode and document mode together, you need to be aware that <emie> entries override <docMode> entries for the same domain. - -For example, say you want all of the sites in the contoso.com domain to open using IE8 Enterprise Mode, except test.contoso.com, which needs to open in document mode 11. Because Enterprise Mode takes precedence over document mode, if you want test.contoso.com to open using document mode, you'll need to explicitly add it as an exclusion to the <emie> parent node. - -```xml - - - contoso.com - test.contoso.com - - - test.contoso.com - - -``` - -### What not to include in your schema -We recommend that you not add any of the following items to your schema because they can make your compatibility list behave in unexpected ways: -- Don’t use protocols. For example, `https://`, `https://`, or custom protocols. They break parsing. -- Don’t use wildcards. -- Don’t use query strings, ampersands break parsing. - -## How to use trailing slashes -You can use trailing slashes at the path-level, but not at the domain-level: -- **Domain-level.** Don’t add trailing slashes to a domain, it breaks parsing. -- **Path-level.** Adding a trailing slash to a path means that the path ends at that point. By not adding a trailing slash, the rule applies to all of the sub-paths. - -**Example** - -``` xml -contoso.com - /about/ - -``` -In this example, `contoso.com/about/careers` will use the default version of Internet Explorer, even though `contoso.com/about/` uses Enterprise Mode. - - -## How to target specific sites -If you want to target specific sites in your organization. - -|Targeted site |Example |Explanation | -|--------------|--------|------------| -|You can specify subdomains in the domain tag. |<docMode>
<domain docMode="5">contoso.com</domain>
<domain docMode="9">info.contoso.com</domain>
<docMode>
|
  • contoso.com uses document mode 5.
  • info.contoso.com uses document mode 9.
  • test.contoso.com also uses document mode 5.
| -|You can specify exact URLs by listing the full path. |<emie>
<domain exclude="false">bing.com</domain>
<domain exclude="false" forceCompatView="true">contoso.com</domain>
<emie>
|
  • bing.com uses IE8 Enterprise Mode.
  • contoso.com uses IE7 Enterprise Mode.
| -|You can nest paths underneath domains. |<emie>
<domain exclude="true">contoso.com
<path exclude="false">/about</path>
<path exclude="true">
/about/business</path>
</domain>
</emie>
|
  • contoso.com will use the default version of IE.
  • contoso.com/about and everything underneath that node will load in Enterprise Mode, except contoso.com/about/business, which will load in the default version of IE.
| -|You can’t add a path underneath a path. The file will still be parsed, but the sub-path will be ignored. |<emie>
<domain exclude="true">contoso.com
<path>/about
<path exclude="true">/business</path>
</path>
</domain>
</emie>
|
  • contoso.com will use the default version of IE.
  • contoso.com/about and everything underneath that node will load in Enterprise Mode, including contoso.com/about/business because the last rule is ignored.
| diff --git a/browsers/enterprise-mode/enterprise-mode-schema-version-2-guidance.md b/browsers/enterprise-mode/enterprise-mode-schema-version-2-guidance.md deleted file mode 100644 index fcdaa18eee..0000000000 --- a/browsers/enterprise-mode/enterprise-mode-schema-version-2-guidance.md +++ /dev/null @@ -1,139 +0,0 @@ ---- -ms.localizationpriority: low -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Use the Enterprise Mode Site List Manager to create and update your Enterprise Mode site list for devices running Windows 10. -author: dansimp -ms.prod: ie11 -ms.assetid: 909ca359-5654-4df9-b9fb-921232fc05f5 -ms.reviewer: -manager: dansimp -ms.author: dansimp -title: Enterprise Mode schema v.2 guidance (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 12/04/2017 ---- - - -# Enterprise Mode schema v.2 guidance - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 - -Use the Enterprise Mode Site List Manager to create and update your site list for devices running Windows 7, Windows 8.1, and Windows 10, using the version 2.0 (v.2) of the Enterprise Mode schema. If you don't want to use the Enterprise Mode Site List Manager, you also have the option to update your XML schema using Notepad, or any other XML-editing app. - -**Important**
-If you're running Windows 7 or Windows 8.1 and you've been using the version 1.0 (v.1) of the schema, you can continue to do so, but you won't get the benefits that come with the updated schema. For info about the v.1 schema, see [Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md). - -## Enterprise Mode schema v.2 updates -Because of the schema changes, you can't combine the old version (v.1) with the new version (v.2) of the schema. If you look at your XML file, you can tell which version you're using by: - -- <rules>. If your schema root node includes this key, you're using the v.1 version of the schema. - -- <site-list>. If your schema root node includes this key, you're using the v.2 version of the schema. - -You can continue to use the v.1 version of the schema on Windows 10, but you won't have the benefits of the new v.2 version schema updates and new features. Additionally, saving the v.1 version of the schema in the new Enterprise Mode Site List Manager (schema v.2) automatically updates the file to use the v.2 version of the schema. - -### Enterprise Mode v.2 schema example -The following is an example of the v.2 version of the Enterprise Mode schema. - -**Important**
-Make sure that you don't specify a protocol when adding your URLs. Using a URL like ``, automatically applies to both https://contoso.com and https://contoso.com. -  -``` xml - - - - EnterpriseSitelistManager - 10240 - 20150728.135021 - - - - IE8Enterprise - MSEdge - - - default - IE11 - - - IE7Enterprise - IE11 - - - default - IE11 - - - default - none - - IE8Enterprise" - - - IE7 - IE11 - - - IE8Enterprise - IE11 - - - IE7 - IE11 - - -``` - -### Updated schema elements -This table includes the elements used by the v.2 version of the Enterprise Mode schema. - - -|Element |Description |Supported browser | -|---------|---------|---------| -|<site-list> |A new root node with this text is using the updated v.2 version of the schema. It replaces <rules>.
**Example**
<site-list version="205">
<site url="contoso.com">
<compat-mode>IE8Enterprise</compat-mode>
<open-in>IE11</open-in>
</site>
</site-list>
| Internet Explorer 11 and Microsoft Edge | -|<site> |A unique entry added for each site you want to put on the Enterprise Mode site list. The first <site> element will overrule any additional <site> elements that use the same value for the <url> element.
**Example**
<site url="contoso.com">
<compat-mode>default</compat-mode>
<open-in>none</open-in>
</site>

**or** For IPv4 ranges:
<site url="10.122.34.99:8080">
<compat-mode>IE8Enterprise</compat-mode>
<site>


**or** For IPv6 ranges:

<site url="[10.122.34.99]:8080">
<compat-mode>IE8Enterprise</compat-mode>
<site>


You can also use the self-closing version, <url="contoso.com" />, which also sets:

  • <compat-mode>default</compat-mode>
  • <open-in>none</open-in>
  • | Internet Explorer 11 and Microsoft Edge | -|<compat-mode> |A child element that controls what compatibility setting is used for specific sites or domains. This element is only supported in IE11.
    **Example**

    <site url="contoso.com">
    <compat-mode>IE8Enterprise</compat-mode>
    </site>
    **or**
    For IPv4 ranges:
    <site url="10.122.34.99:8080">
    <compat-mode>IE8Enterprise</compat-mode>
    <site>

    **or** For IPv6 ranges:

    <site url="[10.122.34.99]:8080">
    <compat-mode>IE8Enterprise</compat-mode>
    <site>

    Where

    • **IE8Enterprise.** Loads the site in IE8 Enterprise Mode.
      This element is required for sites included in the **EmIE** section of the v.1 schema and is needed to load in IE8 Enterprise Mode.
    • **IE7Enterprise.** Loads the site in IE7 Enterprise Mode.
      This element is required for sites included in the **EmIE** section of the v.1 schema and is needed to load in IE7 Enterprise Mode

      **Important**
      This tag replaces the combination of the `"forceCompatView"="true"` attribute and the list of sites specified in the EmIE section of the v.1 version of the schema.

    • **IE[x]**. Where [x] is the document mode number into which the site loads.
    • **Default or not specified.** Loads the site using the default compatibility mode for the page. In this situation, X-UA-compatible meta tags or HTTP headers are honored.
    • |Internet Explorer 11 | -|<open-in> |A child element that controls what browser is used for sites. This element supports the **Open in IE11** or **Open in Microsoft Edge** experiences, for devices running Windows 10.
      **Examples**
      <site url="contoso.com">
      <open-in>none</open-in>
      </site>


      Where

      • IE11. Opens the site in IE11, regardless of which browser is opened by the employee.
      • MSEdge. Opens the site in Microsoft Edge, regardless of which browser is opened by the employee.
      • None or not specified. Opens in whatever browser the employee chooses.
      • | Internet Explorer 11 and Microsoft Edge | - -### Updated schema attributes -The <url> attribute, as part of the <site> element in the v.2 version of the schema, replaces the <domain> element from the v.1 version of the schema. - -|Attribute|Description|Supported browser| -|---------|---------|---------| -|allow-redirect|A boolean attribute of the element that controls the behavior for redirected sites. Setting this attribute to "true" indicates that the site will open in IE11 or Microsoft Edge even if the site is navigated to as part of a HTTP or meta refresh redirection chain. Omitting the attribute is equivalent to "false" (sites in redirect chain will not open in another browser).
        **Example**
        <site url="contoso.com/travel">
        <open-in allow-redirect="true">IE11 </open-in>
        </site>
        In this example, if [https://contoso.com/travel](https://contoso.com/travel) is encountered in a redirect chain in Microsoft Edge, it will be opened in Internet Explorer.| Internet Explorer 11 and Microsoft Edge| -|version |Specifies the version of the Enterprise Mode Site List. This attribute is supported for the <site-list> element. | Internet Explorer 11 and Microsoft Edge| -|url|Specifies the URL (and port number using standard port conventions) to which the child elements apply. The URL can be a domain, sub-domain, or any path URL.
        **Note**
        Make sure that you don't specify a protocol. Using <site url="contoso.com"> applies to both [https://contoso.com](https://contoso.com) and [https://contoso.com](https://contoso.com).
        **Example**
        <site url="contoso.com:8080">
        <compat-mode>IE8Enterprise</compat-mode>
        <open-in>IE11</open-in>
        </site>
        In this example, going to [https://contoso.com:8080](https://contoso.com:8080) using Microsoft Edge, causes the site to open in IE11 and load in IE8 Enterprise Mode. | Internet Explorer 11 and Microsoft Edge| - -### Deprecated attributes -These v.1 version schema attributes have been deprecated in the v.2 version of the schema: - -|Deprecated attribute|New attribute|Replacement example| -|--- |--- |--- | -|<forceCompatView>|<compat-mode>|Replace <forceCompatView="true"> with <compat-mode>IE7Enterprise</compat-mode>| -|<docMode>|<compat-mode>|Replace <docMode="IE5"> with <compat-mode>IE5</compat-mode>| -|<doNotTransition>|<open-in>|Replace:
        <doNotTransition="true"> with <open-in>none</open-in>| -|<domain> and <path>|<site>|Replace:
        <emie>
        <domain exclude="false">contoso.com</domain>
        </emie>
        With:
        <site url="contoso.com"/> 
        <compat-mode>IE8Enterprise</compat-mode>
        </site>
        **-AND-**
        Replace:
        <emie> 
        <domain exclude="true">contoso.com
        <path exclude="false" forceCompatView="true">/about</path>
        </domain>
        </emie>

        With:
        <site url="contoso.com/about">
        <compat-mode>IE7Enterprise</compat-mode>
        </site>| - -While the old, replaced attributes aren't supported in the v.2 version of the schema, they'll continue to work in the v.1 version of the schema. If, however, you're using the v.2 version of the schema and these attributes are still there, the v.2 version schema takes precedence. We don’t recommend combining the two schemas, and instead recommend that you move to the v.2 version of the schema to take advantage of the new features. - -**Important**
        -Saving your v.1 version of the file using the new Enterprise Mode Site List Manager (schema v.2) automatically updates the XML to the new v.2 version of the schema. - -### What not to include in your schema -We recommend that you not add any of the following items to your schema because they can make your compatibility list behave in unexpected ways: - -- Don’t use protocols. For example, https://, https://, or custom protocols. They break parsing. -- Don’t use wildcards. -- Don’t use query strings, ampersands break parsing. - -## Related topics -- [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) - - - - diff --git a/browsers/enterprise-mode/enterprise-mode-site-list-mgr-portal-tools-include.md b/browsers/enterprise-mode/enterprise-mode-site-list-mgr-portal-tools-include.md deleted file mode 100644 index f1c67006ba..0000000000 --- a/browsers/enterprise-mode/enterprise-mode-site-list-mgr-portal-tools-include.md +++ /dev/null @@ -1,36 +0,0 @@ -## Enterprise Mode Site List Manager and the Enterprise Mode Site List Portal tools -You can build and manage your Enterprise Mode Site List is by using any generic text editor. However, we’ve also provided a couple tools that can make that process even easier. - -### Enterprise Mode Site List Manager -This tool helps you create error-free XML documents with simple n+1 versioning and URL verification. We recommend using this tool if your site list is relatively small. For more info about this tool, see the [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) topics. - -There are 2 versions of this tool, both supported on Windows 7, Windows 8.1, and Windows 10: - -- [Enterprise Mode Site List Manager (schema v.1)](https://www.microsoft.com/download/details.aspx?id=42501). This is an older version of the schema that you must use if you want to create and update your Enterprise Mode Site List for devices running the v.1 version of the schema. - - We strongly recommend moving to the new schema, v.2. For more info, see [Enterprise Mode schema v.2 guidance](enterprise-mode-schema-version-2-guidance.md). - -- [Enterprise Mode Site List Manager (schema v.2)](https://www.microsoft.com/download/details.aspx?id=49974). The updated version of the schema, including new functionality. You can use this version of the schema to create and update your Enterprise Mode Site List for devices running the v.2 version of the schema. - - If you open a v.1 version of your Enterprise Mode Site List using this version, it will update the schema to v.2, automatically. For more info, see [Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md). - -If your list is too large to add individual sites, or if you have more than one person managing the site list, we recommend using the Enterprise Site List Portal. - -### Enterprise Mode Site List Portal -The [Enterprise Mode Site List Portal](https://github.com/MicrosoftEdge/enterprise-mode-site-list-portal) is an open-source web tool on GitHub that allows you to manage your Enterprise Mode Site List, hosted by the app, with multiple users. The portal is designed to use IIS and a SQL Server backend, leveraging Active Directory (AD) for employee management. - -In addition to all the functionality of the Enterprise Mode Site List Manager tool, the Enterprise Mode Site List Portal helps you: - -- Manage site lists from any device supporting Windows 7 or greater. - -- Submit change requests. - -- Operate offline through an on-premise solution. - -- Provide role-based governance. - -- Test configuration settings before releasing to a live environment. - -Updates to your site list are made by submitting new change requests, which are then approved by a designated group of people, put into a pre-production environment for testing, and then deployed immediately, or scheduled for deployment later. - -Because the tool is open-source, the source code is readily available for examination and experimentation. We encourage you to [fork the code, submit pull requests, and send us your feedback](https://github.com/MicrosoftEdge/enterprise-mode-site-list-portal)! For more info about the Enterprise Mode Site List Portal, see the [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) topics. \ No newline at end of file diff --git a/browsers/enterprise-mode/enterprise-mode-site-list-mgr-versions-include.md b/browsers/enterprise-mode/enterprise-mode-site-list-mgr-versions-include.md deleted file mode 100644 index 4ead83795d..0000000000 --- a/browsers/enterprise-mode/enterprise-mode-site-list-mgr-versions-include.md +++ /dev/null @@ -1,7 +0,0 @@ -## Enterprise Mode Site List Manager versions -There are currently two versions of the Enterprise Site List Manager, both based on your schema and operating system. Download the [Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) or the [Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) tool, based on your operating system. - -|Schema version |Operating system |Enterprise Site List Manager version | -|-----------------|---------------|------------------------------------| -|Enterprise Mode schema, version 2 (v.2) |Windows 10
        -OR-
        Windows 8.1
        -OR-
        Windows 7|Uses the Enterprise Mode Site List Manager (schema v.2) and the v.2 version of the schema. If you import a v.1 version schema into the Enterprise Mode Site List Manager (schema v.2), the XML is saved into the v.2 version of the schema.

        For more info about the v.2 version of the schema, see [Enterprise Mode schema v.2 guidance](enterprise-mode-schema-version-2-guidance.md).| -|Enterprise Mode schema, version 1 (v.1) |Windows 10
        -OR-
        Windows 8.1
        -OR-
        Windows 7|Uses the Enterprise Mode Site List Manager (schema v.1) and the v.1 version of the schema.

        For more info about the v.1 version of the schema, see [Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md)| \ No newline at end of file diff --git a/browsers/enterprise-mode/enterprise-mode.md b/browsers/enterprise-mode/enterprise-mode.md deleted file mode 100644 index 2c433182a9..0000000000 --- a/browsers/enterprise-mode/enterprise-mode.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -ms.localizationpriority: low -ms.mktglfcycl: deploy -ms.pagetype: security -description: Use this section to learn about how to turn on Enterprise Mode. -author: dansimp -ms.author: dansimp -ms.prod: edge -ms.assetid: -ms.reviewer: -manager: dansimp -title: Enterprise Mode for Microsoft Edge -ms.sitesec: library -ms.date: 07/17/2018 ---- - -# Enterprise Mode for Microsoft Edge -Enterprise Mode, a compatibility mode that runs on Internet Explorer 11 on Windows 10, Windows 8.1, and Windows 7 devices, lets websites render using a modified browser configuration that’s designed to emulate either Windows Internet Explorer 7 or Windows Internet Explorer 8. Running in this mode helps to avoid many of the common compatibility problems associated with web apps written and tested on older versions of Internet Explorer. - -Many customers identify web app compatibility as a significant cost to upgrading because web apps need to be tested and upgraded before adopting a new browser. The improved compatibility provided by Enterprise Mode can help give customers the confidence to upgrade to IE11, letting customers benefit from modern web standards, increased performance, improved security, and better reliability. - -## Available dual-browser experiences - - -## Enterprise Mode features - - - - -## Enterprise Mode Site List management tools -...description of what you can do with these tools; also specify if you must use both or if each tool works independently and no dependencies on the other tool... I think these tools are for two different scenarios... - -You can build and manage your Enterprise Mode Site List is by using any generic text editor. However, we’ve also provided a couple of tools that can make that process even easier. - -| | | -|---------|---------| -|Enterprise Mode Site List Manager |Use if your site list is relatively small. | -|Enterprise Mode Site List Portal |Use if your site list is too large to add individual sites, or if you have more than one person managing the sites. | - -### Enterprise Mode Site List Manager - - -### Enterprise Mode Site List Portal - - - -## Enterprise Mode Site List XML file -[!INCLUDE [enterprise-mode-and-enterprise-site-list-include](enterprise-mode-and-enterprise-site-list-include.md)] - - -## Turn on Enterprise Mode - - -### Add a single site to the site list - - -### Add multiple sites to the site list diff --git a/browsers/enterprise-mode/export-your-enterprise-mode-site-list-from-the-enterprise-mode-site-list-manager.md b/browsers/enterprise-mode/export-your-enterprise-mode-site-list-from-the-enterprise-mode-site-list-manager.md deleted file mode 100644 index 4f4cbb32bb..0000000000 --- a/browsers/enterprise-mode/export-your-enterprise-mode-site-list-from-the-enterprise-mode-site-list-manager.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -ms.localizationpriority: low -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: After you create your Enterprise Mode site list in the Enterprise Mode Site List Manager, you can export the contents to an Enterprise Mode (.EMIE) file. -author: dansimp -ms.prod: ie11 -ms.assetid: 9ee7c13d-6fca-4446-bc22-d23a0213a95d -ms.reviewer: -manager: dansimp -ms.author: dansimp -title: Export your Enterprise Mode site list from the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Export your Enterprise Mode site list from the Enterprise Mode Site List Manager - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -After you create your Enterprise Mode site list in the Enterprise Mode Site List Manager, you can export the contents to an Enterprise Mode (.EMIE) file. This file includes all of your URLs, including your compatibility mode selections and should be stored somewhere safe. If your list gets deleted by mistake you can easily import this file and return everything back to when this file was last saved. - -**Important**
          -This file is not intended for distribution to your managed devices. Instead, it is only for transferring data and comments from one manager to another. For example, if one administrator leaves and passes the existing data to another administrator. Internet Explorer doesn’t read this file. - - **To export your compatibility list** - -1. On the **File** menu of the Enterprise Mode Site List Manager, click **Export**. - -2. Export the file to your selected location. For example, `C:\Users\\Documents\sites.emie`. - -## Related topics - -- [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) -- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) -- [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) -  - -  - - - diff --git a/browsers/enterprise-mode/images/config-enterprise-site-list.png b/browsers/enterprise-mode/images/config-enterprise-site-list.png deleted file mode 100644 index 82ffc30895..0000000000 Binary files a/browsers/enterprise-mode/images/config-enterprise-site-list.png and /dev/null differ diff --git a/browsers/enterprise-mode/images/enterprise-mode-value-data.png b/browsers/enterprise-mode/images/enterprise-mode-value-data.png deleted file mode 100644 index 9e9ece9c1a..0000000000 Binary files a/browsers/enterprise-mode/images/enterprise-mode-value-data.png and /dev/null differ diff --git a/browsers/enterprise-mode/remove-all-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md b/browsers/enterprise-mode/remove-all-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md deleted file mode 100644 index a1d5a8a76b..0000000000 --- a/browsers/enterprise-mode/remove-all-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -ms.localizationpriority: low -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Instructions about how to clear all of the sites from your global Enterprise Mode site list. -author: dansimp -ms.prod: ie11 -ms.assetid: 90f38a6c-e0e2-4c93-9a9e-c425eca99e97 -ms.reviewer: -manager: dansimp -ms.author: dansimp -title: Remove all sites from your Enterprise Mode site list using the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Remove all sites from your Enterprise Mode site list using the Enterprise Mode Site List Manager - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -You can clear all of the sites from your global Enterprise Mode site list. - -**Important**   -This is a permanent removal and erases everything. However, if you determine it was a mistake, and you saved an XML copy of your list, you can add the file again by following the steps in the [Add multiple sites to the Enterprise Mode site list using a file and Enterprise Mode Site List Manager (schema v.2)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md) or [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md), depending on your operating system. - - **To clear your compatibility list** - -1. On the **File** menu of the Enterprise Mode Site List Manager, click **Clear list**. - -2. Click **Yes** in the warning message.

        Your sites are all cleared from your list. - -## Related topics -- [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) -- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) -- [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) -  - -  - - - diff --git a/browsers/enterprise-mode/remove-sites-from-a-local-compatibililty-view-list.md b/browsers/enterprise-mode/remove-sites-from-a-local-compatibililty-view-list.md deleted file mode 100644 index 91ff0fab17..0000000000 --- a/browsers/enterprise-mode/remove-sites-from-a-local-compatibililty-view-list.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -ms.localizationpriority: low -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Instructions about how to remove sites from a local compatibility view list. -author: dansimp -ms.prod: ie11 -ms.assetid: f6ecaa75-ebcb-4f8d-8721-4cd6e73c0ac9 -ms.reviewer: -manager: dansimp -ms.author: dansimp -title: Remove sites from a local compatibility view list (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Remove sites from a local compatibility view list - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -Remove websites that were added to a local compatibility view list by mistake or because they no longer have compatibility problems. - - **To remove sites from a local compatibility view list** - -1. Open Internet Explorer 11, click **Tools**, and then click **Compatibility View Settings**. - -2. Pick the site to remove, and then click **Remove**.

        -Sites can only be removed one at a time. If one is removed by mistake, it can be added back using this same box and the **Add** section. - -  - -  - - - diff --git a/browsers/enterprise-mode/remove-sites-from-a-local-enterprise-mode-site-list.md b/browsers/enterprise-mode/remove-sites-from-a-local-enterprise-mode-site-list.md deleted file mode 100644 index 4e7e10efde..0000000000 --- a/browsers/enterprise-mode/remove-sites-from-a-local-enterprise-mode-site-list.md +++ /dev/null @@ -1,58 +0,0 @@ ---- -ms.localizationpriority: low -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Instructions about how to remove sites from a local Enterprise Mode site list. -author: dansimp -ms.prod: ie11 -ms.assetid: c7d6dd0b-e264-42bb-8c9d-ac2f837018d2 -ms.reviewer: -manager: dansimp -ms.author: dansimp -title: Remove sites from a local Enterprise Mode site list (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Remove sites from a local Enterprise Mode site list - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -Remove websites that were added to a local Enterprise Mode site list by mistake or because the sites no longer have compatibility problems. - -**Note**
        The changes described in this topic only impact sites added to a local Enterprise Mode site list and not the list of sites deployed to all employees by an administrator. Employees can't delete sites added to the list by an administrator. - -  **To remove single sites from a local Enterprise Mode site list** - -1. Open Internet Explorer 11 and go to the site you want to remove. - -2. Click **Tools**, and then click **Enterprise Mode**.

        -The checkmark disappears from next to Enterprise Mode and the site is removed from the list. - -**Note**
        If the site is removed by mistake, it can be added back by clicking **Enterprise Mode** again. - - **To remove all sites from a local Enterprise Mode site list** - -1. Open IE11, click **Tools**, and then click **Internet options**. - -2. Click the **Delete** button from the **Browsing history** area. - -3. Click the box next to **Cookies and website data**, and then click **Delete**. - -**Note**
        This removes all of the sites from a local Enterprise Mode site list. - -   - -  - -  - - - diff --git a/browsers/enterprise-mode/save-your-site-list-to-xml-in-the-enterprise-mode-site-list-manager.md b/browsers/enterprise-mode/save-your-site-list-to-xml-in-the-enterprise-mode-site-list-manager.md deleted file mode 100644 index 2cb578171f..0000000000 --- a/browsers/enterprise-mode/save-your-site-list-to-xml-in-the-enterprise-mode-site-list-manager.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -ms.localizationpriority: low -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: You can save your current Enterprise Mode compatibility site list as an XML file, for distribution and use by your managed systems. -author: dansimp -ms.prod: ie11 -ms.assetid: 254a986b-494f-4316-92c1-b089ee8b3e0a -ms.reviewer: -manager: dansimp -ms.author: dansimp -title: Save your site list to XML in the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Save your site list to XML in the Enterprise Mode Site List Manager - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -You can save your current Enterprise Mode compatibility site list as an XML file, for distribution and use by your managed systems. - - **To save your list as XML** - -1. On the **File** menu of the Enterprise Mode Site List Manager, click **Save to XML**. - -2. Save the file to the location you specified in your Enterprise Mode registry key, set up when you turned on Enterprise Mode for use in your company. For information about the Enterprise Mode registry key, see [Turn on local control and logging for Enterprise Mode](turn-on-local-control-and-logging-for-enterprise-mode.md).

        -The first time a user starts Internet Explorer 11 on a managed device; Internet Explorer will look for a new version of the site list at the specified location. If the browser finds an updated site list, IE downloads the new XML site list and uses it. - -## Related topics -- [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) -- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) -- [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) -  - -  - - - diff --git a/browsers/enterprise-mode/schedule-production-change-enterprise-mode-portal.md b/browsers/enterprise-mode/schedule-production-change-enterprise-mode-portal.md deleted file mode 100644 index c946663dda..0000000000 --- a/browsers/enterprise-mode/schedule-production-change-enterprise-mode-portal.md +++ /dev/null @@ -1,53 +0,0 @@ ---- -ms.localizationpriority: low -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Details about how Administrators can schedule approved change requests for production in the Enterprise Mode Site List Portal. -author: dansimp -ms.prod: ie11 -title: Schedule approved change requests for production using the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 -ms.reviewer: -manager: dansimp -ms.author: dansimp ---- - -# Schedule approved change requests for production using the Enterprise Mode Site List Portal - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -After a change request is approved, the original Requester can schedule the change for the production environment. The change can be immediate or set for a future time. - -**To schedule an immediate change** -1. The Requester logs onto the Enterprise Mode Site List Portal and clicks **In Progress** from the left pane. - -2. The Requester clicks the **Approved** status for the change request. - - The **Schedule changes** page appears. - -3. The Requester clicks **Now**, and then clicks **Save**. - - The update is scheduled to immediately update the production environment, and an email is sent to the Requester. After the update finishes, the Requester is asked to verify the changes. - - -**To schedule the change for a different day or time** -1. The Requester logs onto the Enterprise Mode Site List Portal and clicks **In Progress** from the left pane. - -2. The Requester clicks the **Approved** status for the change request. - - The **Schedule changes** page appears. - -3. The Requester clicks **Schedule**, sets the **Preferred day**, **Preferred start time**, and the **Preferred end time**, and then clicks **Save**. - - The update is scheduled to update the production environment on that day and time and an email is sent to the Requester. After the update finishes, the Requester will be asked to verify the changes. - - -## Next steps -After the update to the production environment completes, the Requester must again test the change. If the testing succeeds, the Requester can sign off on the change request. If the testing fails, the Requester can contact the Administrator group for more help. For the production environment testing steps, see the [Verify the change request update in the production environment using the Enterprise Mode Site List Portal](verify-changes-production-enterprise-mode-portal.md) topic. diff --git a/browsers/enterprise-mode/search-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md b/browsers/enterprise-mode/search-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md deleted file mode 100644 index bf7e73664e..0000000000 --- a/browsers/enterprise-mode/search-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md +++ /dev/null @@ -1,44 +0,0 @@ ---- -ms.localizationpriority: low -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Search to see if a specific site already appears in your global Enterprise Mode site list. -author: dansimp -ms.prod: ie11 -ms.assetid: e399aeaf-6c3b-4cad-93c9-813df6ad47f9 -ms.reviewer: -manager: dansimp -ms.author: dansimp -title: Search your Enterprise Mode site list in the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Search your Enterprise Mode site list in the Enterprise Mode Site List Manager - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -You can search to see if a specific site already appears in your global Enterprise Mode site list so you don’t try to add it again. - - **To search your compatibility list** - -- From the Enterprise Mode Site List Manager, type part of the URL into the **Search** box.

        -The search query searches all of the text. For example, entering *“micro”* will return results like, www.microsoft.com, microsoft.com, and microsoft.com/images. Wildcard characters aren’t supported. - -## Related topics -- [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) -- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) -- [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) -  - -  - - - diff --git a/browsers/enterprise-mode/set-up-enterprise-mode-logging-and-data-collection.md b/browsers/enterprise-mode/set-up-enterprise-mode-logging-and-data-collection.md deleted file mode 100644 index 923d4dfe04..0000000000 --- a/browsers/enterprise-mode/set-up-enterprise-mode-logging-and-data-collection.md +++ /dev/null @@ -1,160 +0,0 @@ ---- -ms.localizationpriority: low -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Set up and turn on Enterprise Mode logging and data collection in your organization. -author: dansimp -ms.prod: ie11 -ms.assetid: 2e98a280-f677-422f-ba2e-f670362afcde -ms.reviewer: -manager: dansimp -ms.author: dansimp -title: Set up Enterprise Mode logging and data collection (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Set up Enterprise Mode logging and data collection - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -Using Group Policy, you can turn on Enterprise Mode for Internet Explorer and then you can turn on local user control using the **Let users turn on and use Enterprise Mode from the Tools menu** setting, located in the `Administrative Templates\Windows Components\Internet Explorer` category path. After you turn this setting on, your users can turn on Enterprise Mode locally, from the IE **Tools** menu. - -![enterprise mode option on the tools menu.](images/ie-emie-toolsmenu.png) - -The **Let users turn on and use Enterprise Mode from the Tools menu** setting also lets you decide where to send the user reports (as a URL). We recommend creating a custom HTTP port 81 to let your incoming user information go to a dedicated site. A dedicated site is important so you can quickly pick out the Enterprise Mode traffic from your other website traffic. - -![group policy to turn on enterprise mode.](images/ie-emie-grouppolicy.png) - -Getting these reports lets you find out about sites that aren’t working right, so you can add them to your Enterprise Mode site list, without having to locate them all yourself. For more information about creating and using a site list, see the [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md) or the [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md) topic, based on your operating system. - -## Using ASP to collect your data -When you turn logging on, you need a valid URL that points to a server that can be listened to for updates to a user’s registry key. This means you need to set up an endpoint server for the incoming POST messages, which are sent every time the user turns Enterprise Mode on or off from the **Tools** menu. - - **To set up an endpoint server** - -1. Configure an IIS server to work with your Enterprise Mode data collection process. If you’re unsure how to set up IIS, see the [IIS installation webpage](https://go.microsoft.com/fwlink/p/?LinkId=507609). - -2. Open Internet Information Services (IIS) and turn on the ASP components from the **Add Roles and Features Wizard**, **Server Roles** page.

        -This lets you create an ASP form that accepts the incoming POST messages. - -3. Open the Internet Information Services (IIS) Manager, click **Bindings**, highlight **Port 81**, click **Edit**, and then change the website information to point to Port 81 so it matches your custom-created port. - - ![IIS Manager, editing website bindings.](images/ie-emie-editbindings.png) - -4. Open the **Logging** feature, pick **W3C** for the format, and click **Select Fields** to open the **W3C Logging Fields** box. - - ![IIS Manager, setting logging options.](images/ie-emie-logging.png) - -5. Change the WC3 logging fields to include only the **Date**, **Client IP**, **User Name**, and **URI Query** standard fields, and then click **OK**.

        -Using only these fields keeps the log file simple, giving you the date, client IP address, and the website URI information for any site changed by your users. - -6. Apply these changes to your default website and close the IIS Manager. - -7. Put your EmIE.asp file into the root of the web server, using this command: - - ``` - <% @ LANGUAGE=javascript %> - <% - Response.AppendToLog(" ;" + Request.Form("URL") + " ;" + Request.Form("EnterpriseMode")); - %> - ``` -This code logs your POST fields to your IIS log file, where you can review all of the collected data. - - -### IIS log file information -This is what your log files will look like after you set everything up and at least one of your users has turned on Enterprise Mode locally from the **Tools** menu. You can see the URL of the problematic website and client IP address of the user that turned on Enterprise Mode. - -![Enterprise Mode log file.](images/ie-emie-logfile.png) - - -## Using the GitHub sample to collect your data -Microsoft has created the [EMIE-Data-Collection_Sample](https://go.microsoft.com/fwlink/p/?LinkId=507401) that shows how to collect your Enterprise Mode reports. This sample only shows how to collect data, it doesn’t show how to aggregate the data into your Enterprise Mode site list.

        -This sample starts with you turning on Enterprise Mode and logging (either through Group Policy, or by manually setting the EnterpriseMode registry key) so that your users can use Enterprise Mode locally. For the steps to do this, go to [Turn on local control and logging for Enterprise Mode](turn-on-local-control-and-logging-for-enterprise-mode.md). - -**Note**
        If you decide to manually change the registry key, you can change the **Enable** setting to `[deployment url]/api/records/`, which automatically sends your reports to this page. - -### Setting up, collecting, and viewing reports -For logging, you’re going to need a valid URL that points to a server that can be listened to for updates to a user’s registry key. This means you need to set up an endpoint server for the incoming POST messages, which are sent every time the user turns Enterprise Mode on or off from the **Tools** menu. These POST messages go into your database, aggregating the report data by URL, giving you the total number of reports where users turned on Enterprise Mode, the total number of reports where users turned off Enterprise Mode, and the date of the last report. - - **To set up the sample** - -1. Set up a server to collect your Enterprise Mode information from your users. - -2. Go to the Internet Explorer/[EMIE-Data_Collection_Sample](https://go.microsoft.com/fwlink/p/?LinkId=507401) page on GitHub and tap or click the **Download ZIP** button to download the complete project. - -3. Open Microsoft Visual Studio 2013 with Update 2, and then open the PhoneHomeSample.sln file. - -4. On the **Build** menu, tap or click **Build Solution**.

        -The required packages are automatically downloaded and included in the solution. - - **To set up your endpoint server** - -1. Right-click on the name, PhoneHomeSample, and click **Publish**. - - ![Visual Studio, Publish menu.](images/ie-emie-publishsolution.png) - -2. In the **Publish Web** wizard, pick the publishing target and options that work for your organization. - - **Important**
        - Make sure you have a database associated with your publishing target. Otherwise, your reports won’t be collected and you’ll have problems deploying the website.  - - ![Visual Studio, Publish Web wizard.](images/ie-emie-publishweb.png) - - After you finish the publishing process, you need to test to make sure the app deployed successfully. - - **To test, deploy, and use the app** - -1. Open a registry editor on the computer where you deployed the app, go to the `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Main\EnterpriseMode` key, and change the **Enable** string to: - - ``` "Enable"="https:///api/records/" - ``` - Where `` points to your deployment URL. - -2. After you’re sure your deployment works, you can deploy it to your users using one of the following: - - - Turn on the **Let users turn on and use Enterprise Mode from the Tools menu** Group Policy setting, putting your `` information into the **Options** box. - - - Deploy the registry key in Step 3 using System Center or other management software. - -3. Get your users to visit websites, turning Enterprise Mode on or off locally, as necessary. - - **To view the report results** - -- Go to `https:///List` to see the report results.

        -If you’re already on the webpage, you’ll need to refresh the page to see the results. - - ![Enterprise Mode Result report with details.](images/ie-emie-reportwdetails.png) - - -### Troubleshooting publishing errors -If you have errors while you’re publishing your project, you should try to update your packages. - - **To update your packages** - -1. From the **Tools** menu of Microsoft Visual Studio, click **NuGet Package Manager**, and click **Manage NuGet Packages for Solution**. - - ![Nuget Package Manager for package updates.](images/ie-emie-packageupdate.png) - -2. Click **Updates** on the left side of the tool, and click the **Update All** button.

        -You may need to do some additional package cleanup to remove older package versions. - -## Related topics -- [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) -- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) -- [What is Enterprise Mode?](what-is-enterprise-mode.md) -- [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) -- [Turn on Enterprise Mode and use a site list](turn-on-enterprise-mode-and-use-a-site-list.md) -  - -  - - - diff --git a/browsers/enterprise-mode/set-up-enterprise-mode-portal.md b/browsers/enterprise-mode/set-up-enterprise-mode-portal.md deleted file mode 100644 index ff7107b46a..0000000000 --- a/browsers/enterprise-mode/set-up-enterprise-mode-portal.md +++ /dev/null @@ -1,235 +0,0 @@ ---- -ms.localizationpriority: low -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Details about how to set up the Enterprise Mode Site List Portal for your organization. -author: dansimp -ms.prod: ie11 -title: Set up the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 -ms.reviewer: -manager: dansimp -ms.author: dansimp ---- - -# Set up the Enterprise Mode Site List Portal - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -The Enterprise Mode Site List Portal is an open-source web tool on GitHub that allows you to manage your Enterprise Mode Site List, hosted by the app, with multiple users. The portal is designed to use IIS and a SQL Server backend, leveraging Active Directory (AD) for employee management. Updates to your site list are made by submitting new change requests, which are then approved by a designated group of people, put into a pre-production environment for testing, and then deployed immediately, or scheduled for deployment later. - -Before you can begin using the Enterprise Mode Site List Portal, you must set up your environment. - -## Step 1 - Copy the deployment folder to the web server -You must download the deployment folder (**EMIEWebPortal/**), which includes all of the source code for the website, from the [Enterprise Mode Site List Portal](https://github.com/MicrosoftEdge/enterprise-mode-site-list-portal) site to your web server. - -**To download the source code** -1. Download the deployment folder from the [Enterprise Mode Site List Portal](https://github.com/MicrosoftEdge/enterprise-mode-site-list-portal) source code to your web server. - -2. Install the Node.js® package manager, [npm](https://www.npmjs.com/). - - > [!NOTE] - > You need to install the npm package manager to replace all the third-party libraries we removed to make the Enterprise Mode Site List Portal open-source. - -3. Open File Explorer and then open the **EMIEWebPortal/** folder. - -4. Press and hold **Shift**, right-click the window, then click **Open PowerShell window here**. - -5. Type _npm i_ into the command prompt, then press **Enter**. - - Installs the npm package manager and bulk adds all the third-party libraries back into your codebase. - -6. Go back up a directory, open the solution file **EMIEWebPortal.sln** in Visual Studio, and then build the entire solution. - -7. Copy the contents of the **EMIEWebPortal/** folder to a dedicated folder on your file system. For example, _D:\EMIEWebApp_. In a later step, you'll designate this folder as your website in the IIS Manager. - -## Step 2 - Create the Application Pool and website, by using IIS -Create a new Application Pool and the website, by using the IIS Manager. - -**To create a new Application Pool** -1. In IIS Manager, expand your local computer in the **Connections** pane, right-click **Application Pools**, then click **Add Application Pool**. - - The **Add Application Pool** box appears. - -2. In the **Add Application Pool** box, enter the following info: - - - **Name.** Type the name of your new application pool. For example, _EMIEWebAppPool_. - - - **.NET CLR version.** Pick the version of .NET CLR used by your application pool from the drop-down box. It must be version 4.0 or higher. - - - **Managed pipeline mode.** Pick **Integrated** from the drop-down box. IIS uses the integrated IIS and ASP.NET request-processing pipeline for managed content. - -3. Click **OK**. - -4. Select your new application pool from the **Application Pool** pane, click **Advanced Settings** from the **Edit Application Pool** area of the **Actions** pane. - - The **Advanced Settings** box appears. - -5. Make sure your **Identity** value is **ApplicationPoolIdentity**, click **OK**, and then close the box. - -6. Open File Explorer and go to your deployment directory, created in Step 1. For example, _D:\EMIEWebApp_. - -7. Right-click on the directory, click **Properties**, and then click the **Security** tab. - -8. Add your new application pool to the list (for example, _IIS AppPool\EMIEWebAppPool_) with **Full control access**, making sure the location searches the local computer. - -9. Add **Everyone** to the list with **Read & execute access**. - -**To create the website** -1. In IIS Manager, expand your local computer in the **Connections** pane, right-click **Sites**, then click **Add Website**. - - The **Add Website** box appears. - -2. In the **Add Website** box, type the name of your website into the **Site name** box. For example, _EMIEWebApp_, and then click **Select**. - - The **Select Application Pool** box appears. - -4. Pick the name of the application pool created earlier in this step, and then click **OK**. For example, _EMIEWebAppPool_. - -5. In the **Physical path** box, browse to your folder that contains your deployment directory. For example, _D:\EMIEWebApp_. - -6. Set up your **Binding**, including your **Binding Type**, **IP address**, and **Port**, as appropriate for your organization. - -7. Clear the **Start Website immediately** check box, and then click **OK**. - -8. In IIS Manager, expand your local computer, and then double-click your new website. For example, _EMIEWebApp_. - - The **<website_name> Home** pane appears. - -9. Double-click the **Authentication** icon, right-click on **Windows Authentication**, and then click **Enable**. - - > [!NOTE] - > You must also make sure that **Anonymous Authentication** is marked as **Enabled**. - -10. Return to the **<website_name> Home** pane, and double-click the **Connection Strings** icon. - -11. Open the **LOBMergedEntities Connection String** to edit: - - - **Data source.** Type the name of your local computer. - - - **Initial catalog.** The name of your database. - - > [!NOTE] - > Step 3 of this topic provides the steps to create your database. - -## Step 3 - Create and prep your database -Create a SQL Server database and run our custom query to create the Enterprise Mode Site List tables. - -**To create and prep your database** -1. Start SQL Server Management Studio. - -2. Open **Object Explorer** and then connect to an instance of the SQL Server Database Engine. - -3. Expand the instance, right-click on **Databases**, and then click **New Database**. - -4. Type a database name. For example, _EMIEDatabase_. - -5. Leave all default values for the database files, and then click **OK**. - -6. Open the **DatabaseScripts/Create DB Tables/1_CreateEMIETables.sql** query file, located in the deployment directory. - -7. Replace the database name placeholder with the database name you created earlier. For example, _EMIEDatabase_. - -8. Run the query. - -## Step 4 - Map your Application Pool to a SQL Server role -Map your ApplicationPoolIdentity to your database, adding the db_owner role. - -**To map your ApplicationPoolIdentity to a SQL Server role** -1. Start SQL Server Management Studio and connect to your database. - -2. Expand the database instance and then open the server-level **Security** folder. - - > [!IMPORTANT] - > Make sure you open the **Security** folder at the server level and not for the database. - -3. Right-click **Logins**, and then click **New Login**. - - The **Login-New** dialog box appears. - -4. Type the following into the **Login name** box, based on your server instance type: - - - **Local SQL Server instance.** If you have a local SQL Server instance, where IIS and SQL Server are on the same server, type the name of your Application Pool. For example, _IIS AppPool\EMIEWebAppPool_. - - - **Remote SQL Server instance.** If you have a remote SQL Server instance, where IIS and SQL Server are on different servers, type `Domain\ServerName$`. - - > [!IMPORTANT] - > Don't click **Search** in the **Login name** box. Login name searches will resolve to a ServerName\AppPool Name account and SQL Server Management Studio won't be able to resolve the account's virtual Security ID (SID). - -5. Click **User Mapping** from the **Select a page** pane, click the checkbox for your database (for example, _EMIEDatabase_) from the **Users mapped to this login** pane, and then click **db_owner** from the list of available roles in the **Database role membership** pane. - -6. Click **OK**. - -## Step 5 - Restart the Application Pool and website -Using the IIS Manager, you must restart both your Application Pool and your website. - -**To restart your Application Pool and website** -1. In IIS Manager, expand your local computer in the **Connections** pane, select your website, then click **Restart** from the **Manage Website** pane. - -2. In the **Connections** pane, select your Application Pool, and then click **Recycle** from the **Application Pool Tasks** pane. - -## Step 6 - Registering as an administrator -After you've created your database and website, you'll need to register yourself (or another employee) as an administrator for the Enterprise Mode Site List Portal. - -**To register as an administrator** -1. Open Microsoft Edge and type your website URL into the Address bar. For example, https://emieportal:8085. - -2. Click **Register now**. - -3. Type your name or alias into the **Email** box, making sure it matches the info in the drop-down box. - -4. Click **Administrator** from the **Role** box, and then click **Save**. - -5. Append your website URL with `/#/EMIEAdminConsole` in the Address bar to go to your administrator console. For example, https://emieportal:8085/#/EMIEAdminConsole. - - A dialog box appears, prompting you for the system user name and password. The default user name is EMIEAdmin and the default password is Admin123. We strongly recommend that you change the password by using the **Change password** link as soon as you're done with your first visit. - -6. Select your name from the available list, and then click **Activate**. - -7. Go to the Enterprise Mode Site List Portal Home page and sign in. - -## Step 7 - Configure the SMTP server and port for email notification -After you've set up the portal, you need to configure your SMTP server and port for email notifications from the system. - -**To set up your SMTP server and port for emails** -1. Open Visual Studio, and then open the web.config file from your deployment directory. - -2. Update the SMTP server and port info with your info, using this format: - - ``` - - - ``` -3. Open the **Settings** page in the Enterprise Mode Site List Portal, and then update the email account and password info. - -## Step 8 - Register the scheduler service -Register the EMIEScheduler tool and service for production site list changes. - -**To register the scheduler service** - -1. Open File Explorer and go to EMIEWebPortal.SchedulerService\EMIEWebPortal.SchedulerService in your deployment directory, and then copy the **App_Data**, **bin**, and **Logs** folders to a separate folder. For example, C:\EMIEService\. - - > [!IMPORTANT] - > If you can't find the **bin** and **Logs** folders, you probably haven't built the Visual Studio solution. Building the solution creates the folders and files. - -2. In Visual Studio start the Developer Command Prompt as an administrator, and then change the directory to the location of the InstallUtil.exe file. For example, _C:\Windows\Microsoft.NET\Framework\v4.0.30319_. - -3. Run the command, `InstallUtil ""`. For example, _InstallUtil "C:\EMIEService\bin\Debug\EMIEWebPortal.SchedulerService.exe"._ - - You'll be asked for your user name and password for the service. - -4. Open the **Run** command, type `Services.msc`, and then start the EMIEScheduler service. - -## Related topics -- [Enterprise Mode Site List Portal source code](https://github.com/MicrosoftEdge/enterprise-mode-site-list-portal) - -- [Enterprise Mode and the Enterprise Mode Site List](what-is-enterprise-mode.md) - -- [Use the Enterprise Mode Site List Manager tool or page](use-the-enterprise-mode-site-list-manager.md) diff --git a/browsers/enterprise-mode/turn-off-enterprise-mode.md b/browsers/enterprise-mode/turn-off-enterprise-mode.md deleted file mode 100644 index d34ccca8ce..0000000000 --- a/browsers/enterprise-mode/turn-off-enterprise-mode.md +++ /dev/null @@ -1,80 +0,0 @@ ---- -ms.localizationpriority: low -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: How to turn Enterprise Mode off temporarily while testing websites and how to turn it off completely if you no longer want to to use it. -author: dansimp -ms.prod: ie11 -ms.assetid: 5027c163-71e0-49b8-9dc0-f0a7310c7ae3 -ms.reviewer: -manager: dansimp -ms.author: dansimp -title: Turn off Enterprise Mode (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Turn off Enterprise Mode - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -It’s important that you test the sites you’re adding, or considering removing, from your Enterprise Mode site list. To make this testing easier, you can turn off the site list or the entire Enterprise Mode functionality. For example, you might have an intranet site on your list that you’ve upgraded to be compatible with the new web standards . If you test the site while the site list is active, Internet Explorer 11 will automatically switch to Enterprise Mode. By turning off the site list, you can see what the page actually looks like and decide whether to remove it from your site list. - -In addition, if you no longer want your users to be able to turn Enterprise Mode on locally, you can remove Enterprise Mode from the local **Tools** menu. - -**Important**
        -Turning off both of these features turns off Enterprise Mode for your company. Turning off Enterprise Mode also causes any websites included in your employee’s manual site lists to not appear in Enterprise Mode. - -  **To turn off the site list using Group Policy** - -1. Open your Group Policy editor, like Group Policy Management Console (GPMC). - -2. Go to the **Use the Enterprise Mode IE website list** setting, and then click **Disabled**.

        -Enterprise Mode will no longer look for the site list, effectively turning off Enterprise Mode. However, if you previously turned on local control for your employees, Enterprise Mode will still be available from the **Tools** menu. You need to turn that part of the functionality off separately. - - **To turn off local control using Group Policy** - -1. Open your Group Policy editor, like Group Policy Management Console (GPMC). - -2. Go to the **Let users turn on and use Enterprise Mode from the Tools menu** setting, and then click **Disable**. - -3. Enterprise Mode no longer shows up on the **Tools** menu for your employees. However, if you are still using an Enterprise Mode site list, all of the globally listed sites will still appear in Enterprise Mode. If you want to turn off all of Enterprise Mode, you will need to also turn off the site list functionality. - - **To turn off the site list using the registry** - -1. Open a registry editor, such as regedit.exe. - -2. Go to `HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\EnterpriseMode`, and then delete the **SiteList** value.

        -You can also use HKEY_LOCAL_MACHINE, depending whether you want to turn off the Enterprise Mode site list for users or for computers. - -3. Close all and restart all instances of Internet Explorer.

        -IE11 stops looking at the site list for rendering instructions. However, Enterprise Mode is still available to your users locally (if it was turned on). - - **To turn off local control using the registry** - -1. Open a registry editor, such as regedit.exe. - -2. Go `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Main\EnterpriseMode`, and then delete the **Enable** value.

        -You can also use HKEY_CURRENT_USER, depending whether you want to turn off Enterprise Mode for users or for computers. - -3. Close and restart all instances of IE.

        -Enterprise Mode is no longer a user option on the **Tools** menu in IE11. However, IE11 still looks at the site list (if it was turned on). - -## Related topics -- [What is Enterprise Mode?](what-is-enterprise-mode.md) -- [Turn on Enterprise Mode and use a site list](turn-on-enterprise-mode-and-use-a-site-list.md) -- [Turn on local control and logging for Enterprise Mode](turn-on-local-control-and-logging-for-enterprise-mode.md) -- [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) -  - -  - - - diff --git a/browsers/enterprise-mode/turn-on-enterprise-mode-and-use-a-site-list.md b/browsers/enterprise-mode/turn-on-enterprise-mode-and-use-a-site-list.md deleted file mode 100644 index 2cfad8e8db..0000000000 --- a/browsers/enterprise-mode/turn-on-enterprise-mode-and-use-a-site-list.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -ms.date: 07/17/2018 ---- -Before you can use a site list with Enterprise Mode, you must turn the functionality on and set up the system for centralized control. By allowing -centralized control, you can create one global list of websites that render using Enterprise Mode. Approximately 65 seconds after Internet Explorer 11 starts, it looks for a properly formatted site list. If a new site list if found, with a different version number than the active list, IE11 loads and uses the newer version. After the initial check, IE11 won’t look for an updated list again until you restart the browser. - -> [!NOTE] -> We recommend that you store and download your website list from a secure web server (https://), to help protect against data tampering. After the list is downloaded, it's stored locally on your employees' computers so if the centralized file location is unavailable, they can still use Enterprise Mode. - -**Group Policy** - -1. Open your Group Policy editor and go to the **Administrative Templates\\Windows Components\\Microsoft Edge\\Configure the Enterprise Mode Site List** setting.

        Turning this setting on also requires you to create and store a site list. - - - -2. Click **Enabled**, and then in the **Options** area, type the location to your site list. - -3. Refresh your policy and then view the affected sites in Microsoft Edge.

        The site shows a message in Microsoft Edge, saying that the page needs IE. At the same time, the page opens in IE11; in a new frame if it's not yet running, or in a new tab if it is. - -**Registry** - -All of your managed devices must have access to this location if you want them to be able to access and use Enterprise Mode and your site list. - -1. **To turn on Enterprise Mode for all users on the PC:** Open the registry editor and go to `HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\MicrosoftEdge\Main\EnterpriseMode`. - -2. Edit the `SiteList` registry key to point to where you want to keep your Enterprise Mode site list file.

        For example: - - - - **HTTPS location:** `"SiteList"="https://localhost:8080/sites.xml"` - - - **Local network:** `"SiteList"="\\network\shares\sites.xml"` - - - **Local file:** `"SiteList"="file:///c:\\Users\\\\Documents\\testList.xml"` - - > **Example:** - >> _Web URL_ https://localhost:8080/EnterpriseMode.xml - >> - >> _Network Share_ \\NetworkShare.xml (Place this inside the group policy folder on Sysvol) - >> - >> _Drive Letter_ C:.xml - - All of your managed devices must have access to this location if you want them to use Enterprise Mode and your site list. - -3. Refresh the policy in your organization and then view the affected sites in - Microsoft Edge.

        The site shows a message in Microsoft Edge, saying that the page needs IE. - At the same time, the page opens in IE11; in a new frame if it is not yet - running, or in a new tab if it is. diff --git a/browsers/enterprise-mode/turn-on-local-control-and-logging-for-enterprise-mode.md b/browsers/enterprise-mode/turn-on-local-control-and-logging-for-enterprise-mode.md deleted file mode 100644 index c8ef3d030c..0000000000 --- a/browsers/enterprise-mode/turn-on-local-control-and-logging-for-enterprise-mode.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -ms.localizationpriority: low -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Turn on local user control and logging for Enterprise Mode. -author: dansimp -ms.prod: ie11 -ms.assetid: 6622ecce-24b1-497e-894a-e1fd5a8a66d1 -ms.reviewer: -manager: dansimp -ms.author: dansimp -title: Turn on local control and logging for Enterprise Mode (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Turn on local control and logging for Enterprise Mode - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -You can turn on local control of Enterprise Mode so that your users can turn Enterprise Mode on from the **Tools** menu. Turning on this feature also adds the **Enterprise** browser profile to the **Emulation** tab of the F12 developer tools. - -Besides turning on this feature, you also have the option to provide a URL for Enterprise Mode logging. If you turn logging on, Internet Explorer initiates a simple POST back to the supplied address, including the URL and a specification that **EnterpriseMode** was turned on or off through the **Tools** menu. - - **To turn on local control of Enterprise Mode using Group Policy** - -1. Open your Group Policy editor and go to the **Administrative Templates\\Windows Components\\Internet Explorer\\Let users turn on and use Enterprise Mode from the Tools menu** setting. - - ![group policy editor with emie setting.](images/ie-emie-editpolicy.png) - -2. Click **Enabled**, and then in the **Options** area, type the location for where to receive reports about when your employees use this functionality to turn Enterprise Mode on or off from the **Tools** menu. - - **To turn on local control of Enterprise Mode using the registry** - -1. Open a registry editor, like regedit.exe and go to `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Main\EnterpriseMode`. - -2. In the right pane, right-click and click **New**, click **String Value**, and then name the new value **Enable**. - -3. Right-click the **Enable** key, click **Modify**, and then type a **Value data** to point to a server that you can listen to for updates. - - ![edit registry string for data collection location.](images/ie-emie-editregistrystring.png) - -Your **Value data** location can be any of the following types: - -- **URL location (like, https://www.emieposturl.com/api/records or https://localhost:13000)**. IE sends a POST message to the URL every time a change is made to Enterprise Mode from the **Tools** menu.

        **Important**
        -The `https://www.emieposturl.com/api/records` example will only work if you’ve downloaded the sample discussed in the [Set up Enterprise Mode logging and data collection](set-up-enterprise-mode-logging-and-data-collection.md) topic. If you don’t have the sample, you won’t have the web API. -- **Local network location (like, https://*emieposturl*/)**. IE sends a POST message to your specified local network location every time a change is made to Enterprise Mode from the **Tools** menu. -- **Empty string**. If you leave the **Value data** box blank; your employees will be able to turn Enterprise Mode on and off from the **Tools** menu, but you won’t collect any logging data. - -For information about how to collect the data provided when your employees turn Enterprise Mode on or off from the **Tools** menu, see [Set up Enterprise Mode logging and data collection](set-up-enterprise-mode-logging-and-data-collection.md). - -  - -  - - - diff --git a/browsers/enterprise-mode/use-the-enterprise-mode-portal.md b/browsers/enterprise-mode/use-the-enterprise-mode-portal.md deleted file mode 100644 index 010448c58d..0000000000 --- a/browsers/enterprise-mode/use-the-enterprise-mode-portal.md +++ /dev/null @@ -1,84 +0,0 @@ ---- -ms.localizationpriority: low -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Use the topics in this section to learn about how to use the Enterprise Mode Site List Portal. -ms.prod: ie11 -title: Use the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 -ms.reviewer: -manager: dansimp -ms.author: dansimp -author: dansimp ---- - -# Use the Enterprise Mode Site List Portal - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -Enterprise Mode is a compatibility mode that runs on Internet Explorer 11, letting websites render using a modified browser configuration that’s designed to emulate either Windows Internet Explorer 8 or Windows Internet Explorer 7, avoiding the common compatibility problems associated with web apps written and tested on older versions of Internet Explorer. - -The Enterprise Mode Site List Portal is an open-source web tool on GitHub that allows you to manage your Enterprise Mode Site List, hosted by the app, with multiple users. The portal is designed to use IIS and a SQL Server backend, leveraging Active Directory (AD) for employee management. Updates to your site list are made by submitting new change requests, which are then approved by a designated group of people, put into a pre-production environment for testing, and then deployed immediately, or scheduled for deployment later. - -You can use IE11 and the Enterprise Mode Site List Portal to manage your Enterprise Mode Site List, hosted by the app, with multiple users. - -## Minimum system requirements for portal and test machines -Some of the components in this table might also need additional system resources. Check the component's documentation for more information. - -|Item |Description | -|-----|------------| -|Operating system |Windows 7 or later | -|Memory |16 GB RAM | -|Hard drive space |At least 8 GB of free space, formatted using the NTFS file system for better security | -|Active Directory (AD) |Devices must be domain-joined | -|SQL Server |Microsoft SQL Server Enterprise Edition 2012 or later | -|Visual Studio |Visual Studio 2015 or later | -|Node.js® package manager |npm Developer version or higher | -|Additional server infrastructure |Internet Information Service (IIS) 6.0 or later | - -## Role assignments and available actions -Admins can assign roles to employees for the Enterprise Mode Site List Portal, allowing the employees to perform specific actions, as described in this table. - -|Role assignment |Available actions | -|----------------|------------------| -|Requester |

        • Create a change request


        • Validate changes in the pre-production environment


        • Rollback pre-production and production changes in case of failure


        • Send approval requests


        • View own requests


        • Sign off and close own requests
        | -|Approver

        (includes the App Manager and Group Head roles) |
        • All of the Requester actions, plus:


        • Approve requests
        | -|Administrator |
        • All of the Requester and Approver actions, plus:


        • Add employees to the portal


        • Assign employee roles


        • Approve registrations to the portal


        • Configure portal settings (for example, determine the freeze schedule, determine the pre-production and production XML paths, and determine the attachment upload location)


        • Use the standalone Enterprise Mode Site List Manager page


        • View reports
        | - -## Enterprise Mode Site List Portal workflow by employee role -The following workflow describes how to use the Enterprise Mode Site List Portal. - -1. [The Requester submits a change request for an app](create-change-request-enterprise-mode-portal.md) - -2. [The Requester tests the change request info, verifying its accuracy](verify-changes-preprod-enterprise-mode-portal.md) - -3. [The Approver(s) group accepts the change request](approve-change-request-enterprise-mode-portal.md) - -4. [The Requester schedules the change for the production environment](schedule-production-change-enterprise-mode-portal.md) - -5. [The change is verified against the production site list and signed off](verify-changes-production-enterprise-mode-portal.md) - - -## Related topics -- [Set up the Enterprise Mode Site List Portal](set-up-enterprise-mode-portal.md) - -- [Workflow-based processes for employees using the Enterprise Mode Site List Portal](workflow-processes-enterprise-mode-portal.md) - -- [How to use the Enterprise Mode Site List Manager tool or page](use-the-enterprise-mode-site-list-manager.md) - -- [Enterprise Mode Site List Portal source code](https://github.com/MicrosoftEdge/enterprise-mode-site-list-portal) - -- [Enterprise Mode and the Enterprise Mode Site List](what-is-enterprise-mode.md) -  - -  - - - diff --git a/browsers/enterprise-mode/use-the-enterprise-mode-site-list-manager.md b/browsers/enterprise-mode/use-the-enterprise-mode-site-list-manager.md deleted file mode 100644 index f68c42ca3c..0000000000 --- a/browsers/enterprise-mode/use-the-enterprise-mode-site-list-manager.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -ms.localizationpriority: low -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Use the topics in this section to learn about how to use the Enterprise Mode Site List Manager. -author: dansimp -ms.prod: ie11 -ms.assetid: f4dbed4c-08ff-40b1-ab3f-60d3b6e8ec9b -ms.reviewer: -manager: dansimp -ms.author: dansimp -title: Use the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 12/04/2017 ---- - - -# Use the Enterprise Mode Site List Manager - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -Enterprise Mode is a compatibility mode that runs on Internet Explorer 11, letting websites render using a modified browser configuration that’s designed to emulate either Windows Internet Explorer 8 or Windows Internet Explorer 7, avoiding the common compatibility problems associated with web apps written and tested on older versions of Internet Explorer. - -You can use IE11 and the Enterprise Mode Site List Manager to add individual website domains and domain paths and to specify whether the site renders using Enterprise Mode or the default mode. - -[!INCLUDE [enterprise-mode-site-list-mgr-versions-include](../../enterprise-mode/enterprise-mode-site-list-mgr-versions-include.md)] - -## Using the Enterprise Mode Site List Manager -The following topics give you more information about the things that you can do with the Enterprise Mode Site List Manager. - -|Topic |Description | -|------|------------| -|[Add sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.2)](add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md) |How to add websites to your site list using the Enterprise Mode Site List Manager (schema v.2). | -|[Add sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.1)](add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md) |How to add websites to your site list using the Enterprise Mode Site List Manager (schema v.1). | -|[Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md) |How to add several websites to your site list at the same time, using a text or XML file and the Enterprise Mode Site List Manager (schema v.2). | -|[Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md) |How to add several websites to your site list at the same time, using a text or XML file and the WEnterprise Mode Site List Manager (schema v.1). | -|[Edit the Enterprise Mode site list using the Enterprise Mode Site List Manager](edit-the-enterprise-mode-site-list-using-the-enterprise-mode-site-list-manager.md) |How to edit the compatibility mode for specific websites.

        This topic applies to both versions of the Enterprise Mode Site List Manager. | -|[Fix validation problems using the Enterprise Mode Site List Manager](fix-validation-problems-using-the-enterprise-mode-site-list-manager.md) |How to fix common site list validation errors.

        This topic applies to both versions of the Enterprise Mode Site List Manager. | -|[Search your Enterprise Mode site list in the Enterprise Mode Site List Manager](search-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md) |How to look to see if a site is already in your global Enterprise Mode site list.

        This topic applies to both versions of the Enterprise Mode Site List Manager. | -|[Save your site list to XML in the Enterprise Mode Site List Manager](save-your-site-list-to-xml-in-the-enterprise-mode-site-list-manager.md) |How to save a site list as XML, so you can deploy and use it with your managed systems.

        This topic applies to both versions of the Enterprise Mode Site List Manager. | -|[Export your Enterprise Mode site list from the Enterprise Mode Site List Manager](export-your-enterprise-mode-site-list-from-the-enterprise-mode-site-list-manager.md) |How to export your site list so you can transfer your data and contents to someone else.

        This topic applies to both versions of the Enterprise Mode Site List Manager. | -|[Import your Enterprise Mode site list to the Enterprise Mode Site List Manager](import-into-the-enterprise-mode-site-list-manager.md) |How to import your site list to replace a corrupted or out-of-date list.

        This topic applies to both versions of the Enterprise Mode Site List Manager. | -|[Delete sites from your Enterprise Mode site list in the Enterprise Mode Site List Manager](delete-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md) |How to delete a website from your site list.

        This topic applies to both versions of the Enterprise Mode Site List Manager. | -|[Remove all sites from your Enterprise Mode site list in the Enterprise Mode Site List Manager](remove-all-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md) |How to delete all of the websites in a site list.

        This topic applies to both versions of the Enterprise Mode Site List Manager. | - -## Related topics - - -- [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) -- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) -- [Enterprise Mode schema v.2 guidance](enterprise-mode-schema-version-2-guidance.md) -- [Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md) -  - -  - - - diff --git a/browsers/enterprise-mode/using-enterprise-mode.md b/browsers/enterprise-mode/using-enterprise-mode.md deleted file mode 100644 index c6f3e6048e..0000000000 --- a/browsers/enterprise-mode/using-enterprise-mode.md +++ /dev/null @@ -1,60 +0,0 @@ ---- -ms.localizationpriority: low -ms.mktglfcycl: deploy -ms.pagetype: security -description: Use this section to learn about how to turn on and use IE7 Enterprise Mode or IE8 Enterprise Mode. -author: dansimp -ms.prod: ie11 -ms.assetid: 238ead3d-8920-429a-ac23-02f089c4384a -ms.reviewer: -manager: dansimp -ms.author: dansimp -title: Using IE7 Enterprise Mode or IE8 Enterprise Mode (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Using IE7 Enterprise Mode or IE8 Enterprise Mode - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -Enterprise Mode gives you a way for your legacy websites and apps to run using emulated versions of Windows Internet Explorer 7 or Windows Internet Explorer 8, while your new sites and apps run using Internet Explorer 11, including modern standards and features. - -Although it’s called IE7 Enterprise Mode, it actually turns on Enterprise Mode along with Internet Explorer 7 or Microsoft Internet Explorer 5 Compatibility View. Compatibility View chooses which document mode to use based on whether there’s a `DOCTYPE` tag in your code: - -- **DOCTYPE tag found.** Webpages render using the Internet Explorer 7 document mode. -- **No DOCTYPE tag found.** Webpages render using the Internet Explorer 5 document mode. - -**Important**
        -Because we’ve added the IE7 Enterprise Mode option, we’ve had to rename the original functionality of Enterprise Mode to be IE8 Enterprise Mode. We’ve also replaced Edge Mode with IE11 Document Mode, so you can explicitly use IE11 on Windows 10. - -## Turning on and using IE7 Enterprise Mode or IE8 Enterprise Mode -For instructions about how to add IE7 Enterprise Mode or IE8 Enterprise Mode to your webpages and apps, see: - -- [Add single sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.2)](add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md) - -- [Add single sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.1)](add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md) - -- [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md) - -- [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md) - -For instructions and more info about how to fix your compatibility issues using Enterprise Mode, see [Fix web compatibility issues using document modes and the Enterprise Mode site list](fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md). - -## Related topics -- [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) -- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) -- [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) -  - -  - - - diff --git a/browsers/enterprise-mode/verify-changes-preprod-enterprise-mode-portal.md b/browsers/enterprise-mode/verify-changes-preprod-enterprise-mode-portal.md deleted file mode 100644 index 3e06b8b806..0000000000 --- a/browsers/enterprise-mode/verify-changes-preprod-enterprise-mode-portal.md +++ /dev/null @@ -1,70 +0,0 @@ ---- -ms.localizationpriority: low -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Details about how to make sure your change request info is accurate within the pre-production environment of the Enterprise Mode Site List Portal. -author: dansimp -ms.prod: ie11 -title: Verify your changes using the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 -ms.reviewer: -manager: dansimp -ms.author: dansimp ---- - -# Verify your changes using the Enterprise Mode Site List Portal - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -> [!Important] -> This step requires that each Requester have access to a test machine with Administrator rights, letting him or her get to the pre-production environment to make sure that the requested change is correct. - -The Requester successfully submits a change request to the Enterprise Mode Site List Portal and then gets an email, including: - -- **EMIE_RegKey**. A batch file that when run, sets the registry key to point to the local pre-production Enterprise Mode Site List. - -- **Test steps**. The suggested steps about how to test the change request details to make sure they're accurate in the pre-production environment. - -- **EMIE_Reset**. A batch file that when run, reverts the changes made to the pre-production registry. - -## Verify and send the change request to Approvers -The Requester tests the changes and then goes back into the Enterprise Mode Site List Portal, **Pre-production verification** page to verify whether the testing was successful. - -**To verify changes and send to the Approver(s)** -1. On the **Pre-production verification** page, the Requester clicks **Successful** and optionally includes any attachments (only .jpeg, .png, .jpg and .txt files are allowed) to support the change request and testing results. - -2. The Requester reviews the pre-defined Approver(s), and then clicks **Send for approval**. - - The Requester, the Approver group, and the Administrator group all get an email, stating that the change request is waiting for approval. - - -**To rollback your pre-production changes** -1. On the **Pre-production verification** page, the Requester clicks **Failed** and optionally includes any attachments (only .jpeg, .png, .jpg and .txt files are allowed) to support the change request and testing results. - -2. Add a description about the issue into the **Issue description** box, and then click **Send failure details**. - - The change request and issue info are sent to the Administrators. - -3. The Requester clicks **Roll back** to roll back the changes in the pre-production environment. - - After the Requester rolls back the changes, the request can be updated and re-submitted. - - -## View rolled back change requests -The original Requester and the Administrator(s) group can view the rolled back change requests. - -**To view the rolled back change request** - -- In the Enterprise Mode Site List Portal, click **Rolled back** from the left pane. - - All rolled back change requests appear, with role assignment determining which ones are visible. - -## Next steps -If the change request is certified as successful, the Requester must next send it to the Approvers for approval. For the Approver-related steps, see the [Approve a change request using the Enterprise Mode Site List Portal](approve-change-request-enterprise-mode-portal.md) topic. diff --git a/browsers/enterprise-mode/verify-changes-production-enterprise-mode-portal.md b/browsers/enterprise-mode/verify-changes-production-enterprise-mode-portal.md deleted file mode 100644 index 8387697841..0000000000 --- a/browsers/enterprise-mode/verify-changes-production-enterprise-mode-portal.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -ms.localizationpriority: low -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Details about how the Requester makes sure that the change request update is accurate within the production environment using the Enterprise Mode Site List Portal. -author: dansimp -ms.prod: ie11 -title: Verify the change request update in the production environment using the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 -ms.reviewer: -manager: dansimp -ms.author: dansimp ---- - -# Verify the change request update in the production environment using the Enterprise Mode Site List Portal - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -## Verify and sign off on the update in the production environment -The Requester tests the changes in the production environment and then goes back into the Enterprise Mode Site List Portal, **Production verification** page to verify whether the testing was successful. - -**To verify the changes and sign off** -- On the **Production verification** page, the Requester clicks **Successful**, optionally includes any attachments (only .jpeg, .png, .jpg and .txt files are allowed) to support the testing results, optionally includes a description of the change, and then clicks **Sign off**. - - The Requester, Approver group, and Administrator group all get an email, stating that the change request has been signed off. - - -**To rollback production changes** -1. On the **Production verification** page, the Requester clicks **Failed** and optionally includes any attachments (only .jpeg, .png, .jpg and .txt files are allowed) to support the testing results. - -2. Add a description about the issue into the **Change description** box, and then click **Send failure details**. - - The info is sent to the Administrators. - -3. The Requester clicks **Roll back** to roll back the changes in the production environment. - - After the Requester rolls back the changes, the request is automatically handled in the production and pre-production environment site lists. - diff --git a/browsers/enterprise-mode/view-apps-enterprise-mode-site-list.md b/browsers/enterprise-mode/view-apps-enterprise-mode-site-list.md deleted file mode 100644 index 6ae2c865ea..0000000000 --- a/browsers/enterprise-mode/view-apps-enterprise-mode-site-list.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -ms.localizationpriority: low -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Details about how to view the active Enterprise Mode Site List from the Enterprise Mode Site List Portal. -author: dansimp -ms.prod: ie11 -title: View the apps included in the active Enterprise Mode Site List from the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 -ms.reviewer: -manager: dansimp -ms.author: dansimp ---- - -# View the apps included in the active Enterprise Mode Site List from the Enterprise Mode Site List Portal - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -Any employee with access to the Enterprise Mode Site List Portal can view the apps included in the current Enterprise Mode Site List. - -**To view the active Enterprise Mode Site List** -1. Open the Enterprise Mode Site List Portal and click the **Production sites list** icon in the upper-right area of the page. - - The **Production sites list** page appears, with each app showing its URL, the compatibility mode to use, and the assigned browser to open the site. - -2. Click any URL to view the actual site, using the compatibility mode and opening in the correct browser. - - -**To export the active Enterprise Mode Site List** -1. On the **Production sites list** page, click **Export**. - -2. Save the ProductionSiteList.xlsx file. - - The Excel file includes all apps in the current Enterprise Mode Site List, including URL, compatibility mode, and assigned browser. diff --git a/browsers/enterprise-mode/what-is-enterprise-mode-include.md b/browsers/enterprise-mode/what-is-enterprise-mode-include.md deleted file mode 100644 index b10897a3d3..0000000000 --- a/browsers/enterprise-mode/what-is-enterprise-mode-include.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -ms.date: 07/17/2018 ---- -## What is Enterprise Mode? -Enterprise Mode, a compatibility mode that runs on Internet Explorer 11 on Windows 10, Windows 8.1, and Windows 7 devices, lets websites render using a modified browser configuration that’s designed to emulate either Windows Internet Explorer 7 or Windows Internet Explorer 8. Running in this mode helps to avoid many of the common compatibility problems associated with web apps written and tested on older versions of Internet Explorer. - -Many customers identify web app compatibility as a significant cost to upgrading because web apps need to be tested and upgraded before adopting a new browser. The improved compatibility provided by Enterprise Mode can help give customers confidence to upgrade to IE11, letting customers benefit from modern web standards, increased performance, improved security, and better reliability. diff --git a/browsers/includes/available-duel-browser-experiences-include.md b/browsers/includes/available-duel-browser-experiences-include.md deleted file mode 100644 index e506d779b2..0000000000 --- a/browsers/includes/available-duel-browser-experiences-include.md +++ /dev/null @@ -1,22 +0,0 @@ ---- -author: eavena -ms.author: eravena -ms.date: 10/02/2018 -ms.reviewer: -audience: itpro manager: dansimp -ms.prod: edge -ms.topic: include ---- - -## Available dual-browser experiences -Based on the size of your legacy web app dependency, determined by the data collected with [Windows Upgrade Analytics](https://blogs.windows.com/windowsexperience/2016/09/26/new-windows-10-and-office-365-features-for-the-secure-productive-enterprise/), there are several options from which you can choose to configure your enterprise browsing environment: - -- Use Microsoft Edge as your primary browser. - -- Use Microsoft Edge as your primary browser and use Enterprise Mode to open sites in Internet Explorer 11 (IE11) that use IE proprietary technologies. - -- Use Microsoft Edge as your primary browser and open all intranet sites in IE11. - -- Use IE11 as your primary browser and use Enterprise Mode to open sites in Microsoft Edge that use modern web technologies. - -For more info about when to use which option, and which option is best for you, see the [Continuing to make it easier for Enterprise customers to upgrade to Internet Explorer 11 — and Windows 10](https://blogs.windows.com/msedgedev/2015/11/23/windows-10-1511-enterprise-improvements) blog. diff --git a/browsers/includes/helpful-topics-include.md b/browsers/includes/helpful-topics-include.md deleted file mode 100644 index 21e15f6d8d..0000000000 --- a/browsers/includes/helpful-topics-include.md +++ /dev/null @@ -1,38 +0,0 @@ ---- -author: eavena -ms.author: eravena -ms.date: 10/02/2018 -ms.reviewer: -audience: itpro manager: dansimp -ms.prod: edge -ms.topic: include ---- - - -## Helpful information and additional resources -- [Enterprise Mode Site List Portal source code](https://github.com/MicrosoftEdge/enterprise-mode-site-list-portal) - -- [Technical guidance, tools, and resources on Enterprise browsing](https://technet.microsoft.com/ie) - -- [Enterprise Mode Site List Manager (schema v.1)](https://www.microsoft.com/download/details.aspx?id=42501) - -- [Enterprise Mode Site List Manager (schema v.2)](https://www.microsoft.com/download/details.aspx?id=49974) - -- [Use the Enterprise Mode Site List Manager](../enterprise-mode/use-the-enterprise-mode-site-list-manager.md) - -- [Collect data using Enterprise Site Discovery](../enterprise-mode/collect-data-using-enterprise-site-discovery.md) - -- [Web Application Compatibility Lab Kit](https://technet.microsoft.com/microsoft-edge/mt612809.aspx) - -- [Microsoft Services Support](https://www.microsoft.com/microsoftservices/support.aspx) - -- [Find a Microsoft partner on Pinpoint](https://partnercenter.microsoft.com/pcv/search) - - - - - -- [Web Application Compatibility Lab Kit for Internet Explorer 11](https://technet.microsoft.com/browser/mt612809.aspx) -- [Download Internet Explorer 11](https://go.microsoft.com/fwlink/p/?linkid=290956) -- [Internet Explorer Administration Kit 11 (IEAK 11) - Administrator's Guide](https://go.microsoft.com/fwlink/p/?LinkId=760646) -- [Fix web compatibility issues using document modes and the Enterprise Mode site list](/internet-explorer/ie11-deploy-guide/fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list) diff --git a/browsers/includes/import-into-the-enterprise-mode-site-list-mgr-include.md b/browsers/includes/import-into-the-enterprise-mode-site-list-mgr-include.md deleted file mode 100644 index 31961c97a1..0000000000 --- a/browsers/includes/import-into-the-enterprise-mode-site-list-mgr-include.md +++ /dev/null @@ -1,23 +0,0 @@ ---- -author: eavena -ms.author: eravena -ms.date: 10/02/2018 -ms.reviewer: -audience: itpro -manager: dansimp -ms.prod: edge -ms.topic: include ---- - -If you need to replace your entire site list because of errors, or simply because it’s out of date, you can import your exported Enterprise Mode site list using the Enterprise Mode Site List Manager. - -> [!IMPORTANT] -> Importing your file overwrites everything that’s currently in the tool, so make sure it’s what want to do. - -1. In the Enterprise Mode Site List Manager, click **File \> Import**. - -2. Go to the exported .EMIE file.

        For example, `C:\users\\documents\sites.emie` - -1. Click **Open**. - -2. Review the alert message about all of your entries being overwritten and click **Yes**. diff --git a/browsers/internet-explorer/TOC.yml b/browsers/internet-explorer/TOC.yml deleted file mode 100644 index 2c6602e1de..0000000000 --- a/browsers/internet-explorer/TOC.yml +++ /dev/null @@ -1,361 +0,0 @@ -- name: IE11 Deployment Guide for IT Pros - href: ie11-deploy-guide/index.md - items: - - name: Change history for the Internet Explorer 11 (IE11) Deployment Guide - href: ie11-deploy-guide/change-history-for-internet-explorer-11.md - - name: System requirements and language support for Internet Explorer 11 - href: ie11-deploy-guide/system-requirements-and-language-support-for-ie11.md - - name: List of updated features and tools - Internet Explorer 11 (IE11) - href: ie11-deploy-guide/updated-features-and-tools-with-ie11.md - - name: Install and Deploy Internet Explorer 11 (IE11) - href: ie11-deploy-guide/install-and-deploy-ie11.md - items: - - name: Customize Internet Explorer 11 installation packages - href: ie11-deploy-guide/customize-ie11-install-packages.md - items: - - name: Using IEAK 11 to create packages - href: ie11-deploy-guide/using-ieak11-to-create-install-packages.md - - name: Create packages for multiple operating systems or languages - href: ie11-deploy-guide/create-install-packages-for-multiple-operating-systems-or-languages.md - - name: Using .INF files to create packages - href: ie11-deploy-guide/using-inf-files-to-create-install-packages.md - - name: Choose how to install Internet Explorer 11 (IE11) - href: ie11-deploy-guide/choose-how-to-install-ie11.md - items: - - name: Install Internet Explorer 11 (IE11) - System Center 2012 R2 Configuration Manager - href: ie11-deploy-guide/install-ie11-using-system-center-configuration-manager.md - - name: Install Internet Explorer 11 (IE11) - Windows Server Update Services (WSUS) - href: ie11-deploy-guide/install-ie11-using-windows-server-update-services-wsus.md - - name: Install Internet Explorer 11 (IE11) - Microsoft Intune - href: ie11-deploy-guide/install-ie11-using-microsoft-intune.md - - name: Install Internet Explorer 11 (IE11) - Network - href: ie11-deploy-guide/install-ie11-using-the-network.md - - name: Install Internet Explorer 11 (IE11) - Operating system deployment systems - href: ie11-deploy-guide/install-ie11-using-operating-system-deployment-systems.md - - name: Install Internet Explorer 11 (IE11) - Third-party tools - href: ie11-deploy-guide/install-ie11-using-third-party-tools.md - - name: Choose how to deploy Internet Explorer 11 (IE11) - href: ie11-deploy-guide/choose-how-to-deploy-ie11.md - items: - - name: Deploy Internet Explorer 11 using Automatic Version Synchronization (AVS) - href: ie11-deploy-guide/deploy-ie11-using-automatic-version-synchronization-avs.md - - name: Deploy Internet Explorer 11 using software distribution tools - href: ie11-deploy-guide/deploy-ie11-using-software-distribution-tools.md - - name: Virtualization and compatibility with Internet Explorer 11 - href: ie11-deploy-guide/virtualization-and-compatibility-with-ie11.md - - name: Collect data using Enterprise Site Discovery - href: ie11-deploy-guide/collect-data-using-enterprise-site-discovery.md - - name: Enterprise Mode for Internet Explorer 11 (IE11) - href: ie11-deploy-guide/enterprise-mode-overview-for-ie11.md - items: - - name: Tips and tricks to manage Internet Explorer compatibility - href: ie11-deploy-guide/tips-and-tricks-to-manage-ie-compatibility.md - - name: Enterprise Mode and the Enterprise Mode Site List - href: ie11-deploy-guide/what-is-enterprise-mode.md - - name: Set up Enterprise Mode logging and data collection - href: ie11-deploy-guide/set-up-enterprise-mode-logging-and-data-collection.md - - name: Turn on Enterprise Mode and use a site list - href: ie11-deploy-guide/turn-on-enterprise-mode-and-use-a-site-list.md - - name: Enterprise Mode schema v.2 guidance - href: ie11-deploy-guide/enterprise-mode-schema-version-2-guidance.md - - name: Enterprise Mode schema v.1 guidance - href: ie11-deploy-guide/enterprise-mode-schema-version-1-guidance.md - - name: Check for a new Enterprise Mode site list xml file - href: ie11-deploy-guide/check-for-new-enterprise-mode-site-list-xml-file.md - - name: Turn on local control and logging for Enterprise Mode - href: ie11-deploy-guide/turn-on-local-control-and-logging-for-enterprise-mode.md - - name: Use the Enterprise Mode Site List Manager - href: ie11-deploy-guide/use-the-enterprise-mode-site-list-manager.md - items: - - name: Add single sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.2) - href: ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md - - name: Add single sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.1) - href: ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md - - name: Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2) - href: ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md - - name: Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1) - href: ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md - - name: Edit the Enterprise Mode site list using the Enterprise Mode Site List Manager - href: ie11-deploy-guide/edit-the-enterprise-mode-site-list-using-the-enterprise-mode-site-list-manager.md - - name: Fix validation problems using the Enterprise Mode Site List Manager - href: ie11-deploy-guide/fix-validation-problems-using-the-enterprise-mode-site-list-manager.md - - name: Search your Enterprise Mode site list in the Enterprise Mode Site List Manager - href: ie11-deploy-guide/search-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md - - name: Save your site list to XML in the Enterprise Mode Site List Manager - href: ie11-deploy-guide/save-your-site-list-to-xml-in-the-enterprise-mode-site-list-manager.md - - name: Export your Enterprise Mode site list from the Enterprise Mode Site List Manager - href: ie11-deploy-guide/export-your-enterprise-mode-site-list-from-the-enterprise-mode-site-list-manager.md - - name: Import your Enterprise Mode site list to the Enterprise Mode Site List Manager - href: ie11-deploy-guide/import-into-the-enterprise-mode-site-list-manager.md - - name: Delete sites from your Enterprise Mode site list in the Enterprise Mode Site List Manager - href: ie11-deploy-guide/delete-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md - - name: Remove all sites from your Enterprise Mode site list in the Enterprise Mode Site List Manager - href: ie11-deploy-guide/remove-all-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md - - name: Review neutral sites for Internet Explorer mode using the Enterprise Mode Site List Manager - href: ie11-deploy-guide/review-neutral-sites-with-site-list-manager.md - - name: Use the Enterprise Mode Site List Portal - href: ie11-deploy-guide/use-the-enterprise-mode-portal.md - items: - - name: Set up the Enterprise Mode Site List Portal - href: ie11-deploy-guide/set-up-enterprise-mode-portal.md - items: - - name: Use the Settings page to finish setting up the Enterprise Mode Site List Portal - href: ie11-deploy-guide/configure-settings-enterprise-mode-portal.md - - name: Add employees to the Enterprise Mode Site List Portal - href: ie11-deploy-guide/add-employees-enterprise-mode-portal.md - - name: Workflow-based processes for employees using the Enterprise Mode Site List Portal - href: ie11-deploy-guide/workflow-processes-enterprise-mode-portal.md - items: - - name: Create a change request using the Enterprise Mode Site List Portal - href: ie11-deploy-guide/create-change-request-enterprise-mode-portal.md - - name: Verify your changes using the Enterprise Mode Site List Portal - href: ie11-deploy-guide/verify-changes-preprod-enterprise-mode-portal.md - - name: Approve a change request using the Enterprise Mode Site List Portal - href: ie11-deploy-guide/approve-change-request-enterprise-mode-portal.md - - name: Schedule approved change requests for production using the Enterprise Mode Site List Portal - href: ie11-deploy-guide/schedule-production-change-enterprise-mode-portal.md - - name: Verify the change request update in the production environment using the Enterprise Mode Site List Portal - href: ie11-deploy-guide/verify-changes-production-enterprise-mode-portal.md - - name: View the apps currently on the Enterprise Mode Site List - href: ie11-deploy-guide/view-apps-enterprise-mode-site-list.md - - name: View the available Enterprise Mode reports from the Enterprise Mode Site List Portal - href: ie11-deploy-guide/view-enterprise-mode-reports-for-portal.md - - name: Using IE7 Enterprise Mode or IE8 Enterprise Mode - href: ie11-deploy-guide/using-enterprise-mode.md - - name: Fix web compatibility issues using document modes and the Enterprise Mode site list - href: ie11-deploy-guide/fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md - - name: Remove sites from a local Enterprise Mode site list - href: ie11-deploy-guide/remove-sites-from-a-local-enterprise-mode-site-list.md - - name: Remove sites from a local compatibility view list - href: ie11-deploy-guide/remove-sites-from-a-local-compatibililty-view-list.md - - name: Turn off Enterprise Mode - href: ie11-deploy-guide/turn-off-enterprise-mode.md - - name: Group Policy and Internet Explorer 11 (IE11) - href: ie11-deploy-guide/group-policy-and-ie11.md - items: - - name: Group Policy management tools - href: ie11-deploy-guide/group-policy-objects-and-ie11.md - items: - - name: Group Policy and the Group Policy Management Console (GPMC) - href: ie11-deploy-guide/group-policy-and-group-policy-mgmt-console-ie11.md - - name: Group Policy and the Local Group Policy Editor - href: ie11-deploy-guide/group-policy-and-local-group-policy-editor-ie11.md - - name: Group Policy and Advanced Group Policy Management (AGPM) - href: ie11-deploy-guide/group-policy-and-advanced-group-policy-mgmt-ie11.md - - name: Group Policy and Windows Powershell - href: ie11-deploy-guide/group-policy-windows-powershell-ie11.md - - name: Group Policy and Shortcut Extensions - href: ie11-deploy-guide/group-policy-shortcut-extensions-ie11.md - - name: New group policy settings for Internet Explorer 11 - href: ie11-deploy-guide/new-group-policy-settings-for-ie11.md - - name: Set the default browser using Group Policy - href: ie11-deploy-guide/set-the-default-browser-using-group-policy.md - - name: ActiveX installation using group policy - href: ie11-deploy-guide/activex-installation-using-group-policy.md - - name: Group Policy and compatibility with Internet Explorer 11 - href: ie11-deploy-guide/group-policy-compatibility-with-ie11.md - - name: Group policy preferences and Internet Explorer 11 - href: ie11-deploy-guide/group-policy-preferences-and-ie11.md - - name: Administrative templates and Internet Explorer 11 - href: ie11-deploy-guide/administrative-templates-and-ie11.md - - name: Enable and disable add-ons using administrative templates and group policy - href: ie11-deploy-guide/enable-and-disable-add-ons-using-administrative-templates-and-group-policy.md - - name: Manage Internet Explorer 11 - href: ie11-deploy-guide/manage-ie11-overview.md - items: - - name: Auto detect settings Internet Explorer 11 - href: ie11-deploy-guide/auto-detect-settings-for-ie11.md - - name: Auto configuration settings for Internet Explorer 11 - href: ie11-deploy-guide/auto-configuration-settings-for-ie11.md - - name: Auto proxy configuration settings for Internet Explorer 11 - href: ie11-deploy-guide/auto-proxy-configuration-settings-for-ie11.md - - name: Troubleshoot Internet Explorer 11 (IE11) - href: ie11-deploy-guide/troubleshoot-ie11.md - items: - - name: Setup problems with Internet Explorer 11 - href: ie11-deploy-guide/setup-problems-with-ie11.md - - name: Install problems with Internet Explorer 11 - href: ie11-deploy-guide/install-problems-with-ie11.md - - name: Problems after installing Internet Explorer 11 - href: ie11-deploy-guide/problems-after-installing-ie11.md - - name: Auto configuration and auto proxy problems with Internet Explorer 11 - href: ie11-deploy-guide/auto-configuration-and-auto-proxy-problems-with-ie11.md - - name: User interface problems with Internet Explorer 11 - href: ie11-deploy-guide/user-interface-problems-with-ie11.md - - name: Group Policy problems with Internet Explorer 11 - href: ie11-deploy-guide/group-policy-problems-ie11.md - - name: .NET Framework problems with Internet Explorer 11 - href: ie11-deploy-guide/net-framework-problems-with-ie11.md - - name: Enhanced Protected Mode problems with Internet Explorer - href: ie11-deploy-guide/enhanced-protected-mode-problems-with-ie11.md - - name: Fix font rendering problems by turning off natural metrics - href: ie11-deploy-guide/turn-off-natural-metrics.md - - name: Intranet problems with Internet Explorer 11 - href: ie11-deploy-guide/intranet-problems-and-ie11.md - - name: Browser cache changes and roaming profiles - href: ie11-deploy-guide/browser-cache-changes-and-roaming-profiles.md - - name: Out-of-date ActiveX control blocking - href: ie11-deploy-guide/out-of-date-activex-control-blocking.md - items: - - name: Blocked out-of-date ActiveX controls - href: ie11-deploy-guide/blocked-out-of-date-activex-controls.md - - name: Deprecated document modes and Internet Explorer 11 - href: ie11-deploy-guide/deprecated-document-modes.md - - name: What is the Internet Explorer 11 Blocker Toolkit? - href: ie11-deploy-guide/what-is-the-internet-explorer-11-blocker-toolkit.md - items: - - name: Internet Explorer 11 delivery through automatic updates - href: ie11-deploy-guide/ie11-delivery-through-automatic-updates.md - - name: Internet Explorer 11 Blocker Toolkit FAQ - href: ie11-faq/faq-ie11-blocker-toolkit.yml - - name: Missing Internet Explorer Maintenance settings for Internet Explorer 11 - href: ie11-deploy-guide/missing-internet-explorer-maintenance-settings-for-ie11.md - - name: Missing the Compatibility View Button - href: ie11-deploy-guide/missing-the-compatibility-view-button.md - - name: Deploy pinned websites using Microsoft Deployment Toolkit (MDT) 2013 - href: ie11-deploy-guide/deploy-pinned-sites-using-mdt-2013.md -- name: IE11 Frequently Asked Questions (FAQ) Guide for IT Pros - href: ie11-faq/faq-for-it-pros-ie11.yml -- name: Internet Explorer Administration Kit 11 (IEAK 11) - Administration Guide for IT Pros - href: ie11-ieak/index.md - items: - - name: What IEAK can do for you - href: ie11-ieak/what-ieak-can-do-for-you.md - - name: Internet Explorer Administration Kit (IEAK) information and downloads - href: ie11-ieak/ieak-information-and-downloads.md - - name: Before you start using IEAK 11 - href: ie11-ieak/before-you-create-custom-pkgs-ieak11.md - items: - - name: Hardware and software requirements for IEAK 11 - href: ie11-ieak/hardware-and-software-reqs-ieak11.md - - name: Determine the licensing version and features to use in IEAK 11 - href: ie11-ieak/licensing-version-and-features-ieak11.md - - name: Security features and IEAK 11 - href: ie11-ieak/security-and-ieak11.md - - name: File types used or created by IEAK 11 - href: ie11-ieak/file-types-ieak11.md - - name: Tasks and references to consider before creating and deploying custom packages using IEAK 11 - href: ie11-ieak/create-manage-deploy-custom-pkgs-ieak11.md - - name: Create the build computer folder structure using IEAK 11 - href: ie11-ieak/create-build-folder-structure-ieak11.md - - name: Set up auto detection for DHCP or DNS servers using IEAK 11 - href: ie11-ieak/auto-detection-dhcp-or-dns-servers-ieak11.md - - name: Use proxy auto-configuration (.pac) files with IEAK 11 - href: ie11-ieak/proxy-auto-config-examples.md - - name: Customize the toolbar button and Favorites List icons using IEAK 11 - href: ie11-ieak/guidelines-toolbar-and-favorites-list-ieak11.md - - name: Use the uninstallation .INF files to uninstall custom components - href: ie11-ieak/create-uninstall-inf-files-for-custom-components.md - - name: Add and approve ActiveX controls using the IEAK 11 - href: ie11-ieak/add-and-approve-activex-controls-ieak11.md - - name: Register an uninstall app for custom components using IEAK 11 - href: ie11-ieak/register-uninstall-app-ieak11.md - - name: Customize Automatic Search for Internet Explorer using IEAK 11 - href: ie11-ieak/customize-automatic-search-for-ie.md - - name: Create multiple versions of your custom package using IEAK 11 - href: ie11-ieak/create-multiple-browser-packages-ieak11.md - - name: Before you install your package over your network using IEAK 11 - href: ie11-ieak/prep-network-install-with-ieak11.md - - name: Use the RSoP snap-in to review policy settings - href: ie11-ieak/rsop-snapin-for-policy-settings-ieak11.md - - name: IEAK 11 - Frequently Asked Questions - href: ie11-faq/faq-ieak11.yml - - name: Troubleshoot custom package and IEAK 11 problems - href: ie11-ieak/troubleshooting-custom-browser-pkg-ieak11.md - - name: Internet Explorer Administration Kit 11 (IEAK 11) Customization Wizard options - href: ie11-ieak/ieak11-wizard-custom-options.md - items: - - name: Use the File Locations page in the IEAK 11 Wizard - href: ie11-ieak/file-locations-ieak11-wizard.md - - name: Use the Platform Selection page in the IEAK 11 Wizard - href: ie11-ieak/platform-selection-ieak11-wizard.md - - name: Use the Language Selection page in the IEAK 11 Wizard - href: ie11-ieak/language-selection-ieak11-wizard.md - - name: Use the Package Type Selection page in the IEAK 11 Wizard - href: ie11-ieak/pkg-type-selection-ieak11-wizard.md - - name: Use the Feature Selection page in the IEAK 11 Wizard - href: ie11-ieak/feature-selection-ieak11-wizard.md - - name: Use the Automatic Version Synchronization page in the IEAK 11 Wizard - href: ie11-ieak/auto-version-sync-ieak11-wizard.md - - name: Use the Custom Components page in the IEAK 11 Wizard - href: ie11-ieak/custom-components-ieak11-wizard.md - - name: Use the Internal Install page in the IEAK 11 Wizard - href: ie11-ieak/internal-install-ieak11-wizard.md - - name: Use the User Experience page in the IEAK 11 Wizard - href: ie11-ieak/user-experience-ieak11-wizard.md - - name: Use the Browser User Interface page in the IEAK 11 Wizard - href: ie11-ieak/browser-ui-ieak11-wizard.md - - name: Use the Search Providers page in the IEAK 11 Wizard - href: ie11-ieak/search-providers-ieak11-wizard.md - - name: Use the Important URLs - Home Page and Support page in the IEAK 11 Wizard - href: ie11-ieak/important-urls-home-page-and-support-ieak11-wizard.md - - name: Use the Accelerators page in the IEAK 11 Wizard - href: ie11-ieak/accelerators-ieak11-wizard.md - - name: Use the Favorites, Favorites Bar, and Feeds page in the IEAK 11 Wizard - href: ie11-ieak/favorites-favoritesbar-and-feeds-ieak11-wizard.md - - name: Use the Browsing Options page in the IEAK 11 Wizard - href: ie11-ieak/browsing-options-ieak11-wizard.md - - name: Use the First Run Wizard and Welcome Page Options page in the IEAK 11 Wizard - href: ie11-ieak/first-run-and-welcome-page-ieak11-wizard.md - - name: Use the Compatibility View page in the IEAK 11 Wizard - href: ie11-ieak/compat-view-ieak11-wizard.md - - name: Use the Connection Manager page in the IEAK 11 Wizard - href: ie11-ieak/connection-mgr-ieak11-wizard.md - - name: Use the Connection Settings page in the IEAK 11 Wizard - href: ie11-ieak/connection-settings-ieak11-wizard.md - - name: Use the Automatic Configuration page in the IEAK 11 Wizard - href: ie11-ieak/auto-config-ieak11-wizard.md - - name: Use the Proxy Settings page in the IEAK 11 Wizard - href: ie11-ieak/proxy-settings-ieak11-wizard.md - - name: Use the Security and Privacy Settings page in the IEAK 11 Wizard - href: ie11-ieak/security-and-privacy-settings-ieak11-wizard.md - - name: Use the Add a Root Certificate page in the IEAK 11 Wizard - href: ie11-ieak/add-root-certificate-ieak11-wizard.md - - name: Use the Programs page in the IEAK 11 Wizard - href: ie11-ieak/programs-ieak11-wizard.md - - name: Use the Additional Settings page in the IEAK 11 Wizard - href: ie11-ieak/additional-settings-ieak11-wizard.md - - name: Use the Wizard Complete - Next Steps page in the IEAK 11 Wizard - href: ie11-ieak/wizard-complete-ieak11-wizard.md - - name: Using Internet Settings (.INS) files with IEAK 11 - href: ie11-ieak/using-internet-settings-ins-files.md - items: - - name: Use the Branding .INS file to create custom branding and setup info - href: ie11-ieak/branding-ins-file-setting.md - - name: Use the BrowserToolbars .INS file to customize the Internet Explorer toolbar - href: ie11-ieak/browsertoolbars-ins-file-setting.md - - name: Use the CabSigning .INS file to review the digital signatures for your apps - href: ie11-ieak/cabsigning-ins-file-setting.md - - name: Use the ConnectionSettings .INS file to review the network connections for install - href: ie11-ieak/connectionsettings-ins-file-setting.md - - name: Use the CustomBranding .INS file to specify the custom branding location - href: ie11-ieak/custombranding-ins-file-setting.md - - name: Use the ExtRegInf .INS file to specify installation files and mode - href: ie11-ieak/extreginf-ins-file-setting.md - - name: Use the FavoritesEx .INS file for your Favorites icon and URLs - href: ie11-ieak/favoritesex-ins-file-setting.md - - name: Use the HideCustom .INS file to hide GUIDs - href: ie11-ieak/hidecustom-ins-file-setting.md - - name: Use the ISP_Security .INS file to add your root certificate - href: ie11-ieak/isp-security-ins-file-setting.md - - name: Use the Media .INS file to specify your install media - href: ie11-ieak/media-ins-file-setting.md - - name: Use the Proxy .INS file to specify a proxy server - href: ie11-ieak/proxy-ins-file-setting.md - - name: Use the Security Imports .INS file to import security info - href: ie11-ieak/security-imports-ins-file-setting.md - - name: Use the URL .INS file to use an auto-configured proxy server - href: ie11-ieak/url-ins-file-setting.md - - name: IExpress Wizard for Windows Server 2008 R2 with SP1 - href: ie11-ieak/iexpress-wizard-for-win-server.md - items: - - name: IExpress Wizard command-line options - href: ie11-ieak/iexpress-command-line-options.md - - name: Internet Explorer Setup command-line options and return codes - href: ie11-ieak/ie-setup-command-line-options-and-return-codes.md - - name: KB Troubleshoot - items: - - name: Internet Explorer and Microsoft Edge FAQ for IT Pros - href: kb-support/ie-edge-faqs.yml -- name: Microsoft Edge and Internet Explorer troubleshooting - href: /troubleshoot/browsers/welcome-browsers diff --git a/browsers/internet-explorer/breadcrumb/toc.yml b/browsers/internet-explorer/breadcrumb/toc.yml deleted file mode 100644 index a0baa945df..0000000000 --- a/browsers/internet-explorer/breadcrumb/toc.yml +++ /dev/null @@ -1,7 +0,0 @@ -- name: Docs - tocHref: / - topicHref: / - items: - - name: Internet Explorer - tocHref: /internet-explorer - topicHref: /internet-explorer/index \ No newline at end of file diff --git a/browsers/internet-explorer/docfx.json b/browsers/internet-explorer/docfx.json deleted file mode 100644 index c62ca17200..0000000000 --- a/browsers/internet-explorer/docfx.json +++ /dev/null @@ -1,62 +0,0 @@ -{ - "build": { - "content": [ - { - "files": [ - "**/*.md", - "**/*.yml" - ], - "exclude": [ - "**/includes/**", - "**/obj/**" - ] - } - ], - "resource": [ - { - "files": [ - "**/images/**" - ], - "exclude": [ - "**/obj/**" - ] - } - ], - "globalMetadata": { - "recommendations": true, - "adobe-target": true, - "ms.collection": [ - "tier3" - ], - "breadcrumb_path": "/internet-explorer/breadcrumb/toc.json", - "ROBOTS": "INDEX, FOLLOW", - "ms.topic": "article", - "feedback_system": "None", - "hideEdit": true, - "_op_documentIdPathDepotMapping": { - "./": { - "depot_name": "Win.internet-explorer", - "folder_relative_path_in_docset": "./" - } - }, - "titleSuffix": "Internet Explorer", - "contributors_to_exclude": [ - "rjagiewich", - "traya1", - "rmca14", - "claydetels19", - "jborsecnik", - "tiburd", - "garycentric", - "beccarobins", - "Stacyrch140", - "v-stsavell", - "American-Dipper" - ] - }, - "externalReference": [], - "template": "op.html", - "dest": "edges/internet-explorer", - "markdownEngineName": "markdig" - } -} diff --git a/browsers/internet-explorer/ie11-deploy-guide/.vscode/settings.json b/browsers/internet-explorer/ie11-deploy-guide/.vscode/settings.json deleted file mode 100644 index d6332e1831..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/.vscode/settings.json +++ /dev/null @@ -1,5 +0,0 @@ -// Place your settings in this file to overwrite default and user settings. -{ - "editor.snippetSuggestions": "none", - "editor.quickSuggestions": false -} \ No newline at end of file diff --git a/browsers/internet-explorer/ie11-deploy-guide/activex-installation-using-group-policy.md b/browsers/internet-explorer/ie11-deploy-guide/activex-installation-using-group-policy.md deleted file mode 100644 index 855b556dd8..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/activex-installation-using-group-policy.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: security -description: How to use Group Policy to install ActiveX controls. -author: dansimp -ms.prod: ie11 -ms.assetid: 59185370-558c-47e0-930c-8a5ed657e9e3 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: ActiveX installation using group policy (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Group Policy and ActiveX installation - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - - -ActiveX controls are installed and invoked using the HTML object tag with the CODEBASE attribute. This attribute, through a URL, makes Internet Explorer: - -- Get the ActiveX control if it's not already installed. - -- Download the installation package. - -- Perform trust verification on the object. - -- Prompt for installation permission, using the IE Information Bar. - -During installation, the rendering page registers and invokes the control, so that after installation, any standard user can invoke the control. - -**Important**
        ActiveX control installation requires administrator-level permissions. - -## Group Policy for the ActiveX Installer Service - -You use the ActiveX Installer Service (AXIS) and Group Policy to manage your ActiveX control deployment. The AXIS-related settings can be changed using either the Group Policy Management Console (GPMC) or the Local Group Policy Editor, and include: - -- **Approved Installation Sites for ActiveX Controls.** A list of approved installation sites used by AXIS to determine whether it can install a particular ActiveX control. - -- **ActiveX installation policy for sites in trusted zones.** Identifies how AXIS should behave when a website tries to install an ActiveX control. First, AXIS looks to see if the site appears in either the list of approved installation sites or in the **Trusted sites** zone. If the does, then AXIS checks to make sure the control meets your company's policy requirements. If the ActiveX control meets all of these requirements, the control is installed. - -For more information about the ActiveX Installer Service, see [Administering the ActiveX Installer Service in Windows 7](/previous-versions/windows/it-pro/windows-7/dd631688(v=ws.10)). - -  - -  \ No newline at end of file diff --git a/browsers/internet-explorer/ie11-deploy-guide/add-employees-enterprise-mode-portal.md b/browsers/internet-explorer/ie11-deploy-guide/add-employees-enterprise-mode-portal.md deleted file mode 100644 index 455bae28bd..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/add-employees-enterprise-mode-portal.md +++ /dev/null @@ -1,72 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Details about how to add employees to the Enterprise Mode Site List Portal. -author: dansimp -ms.prod: ie11 -title: Add employees to the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp ---- - -# Add employees to the Enterprise Mode Site List Portal - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -After you get the Enterprise Mode Site List Portal up and running, you must add your employees. During this process, you'll also assign roles and groups. - -The available roles are: - -- **Requester.** The primary role to assign to employees that need to access the Enterprise Mode Site List Portal. The Requester can create change requests, validate changes in the pre-production environment, rollback pre-production and production changes in case of failure, send personal approval requests, view personal change requests, and sign off and close personal change requests. - -- **App Manager.** This role is considered part of the Approvers group. The App Manager can approve change requests, validate changes in the pre-production environment, rollback pre-production and production changes in case of failure, send personal approval requests, view personal requests, and sign off and close personal requests. - -- **Group Head.** This role is considered part of the Approvers group. The Group Head can approve change requests, validate changes in the pre-production environment, rollback pre-production and production changes in case of failure, send personal approval requests, view personal requests, and sign off and close personal requests. - -- **Administrator.** The role with the highest-level rights; we recommend limiting the number of employees you grant this role. The Administrator can perform any task that can be performed by the other roles, in addition to adding employees to the portal, assigning employee roles, approving registrations to the portal, configuring portal settings (for example, determining the freeze schedule, determining the pre-production and production XML paths, and determining the attachment upload location), and using the standalone Enterprise Mode Site List Manager page. - -**To add an employee to the Enterprise Mode Site List Portal** -1. Open the Enterprise Mode Site List Portal and click the **Employee Management** icon in the upper-right area of the page. - - The **Employee management** page appears. - -2. Click **Add a new employee**. - - The **Add a new employee** page appears. - -3. Fill out the fields for each employee, including: - - - **Email.** Add the employee's email address. - - - **Name.** This box autofills based on the email address. - - - **Role.** Pick a single role for the employee, based on the list above. - - - **Group name.** Pick the name of the employee's group. The group association also assigns a group of Approvers. - - - **Comments.** Add optional comments about the employee. - - - **Active.** Click the check box to make the employee active in the system. If you want to keep the employee in the system, but you want to prevent access, clear this check box. - -4. Click **Save**. - -**To export all employees to an Excel spreadsheet** -1. On the **Employee management** page, click **Export to Excel**. - -2. Save the EnterpriseModeUsersList.xlsx file. - - The Excel file includes all employees with access to the Enterprise Mode Site List Portal, including user name, email address, role, and group name. diff --git a/browsers/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md b/browsers/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md deleted file mode 100644 index 57c8991c7d..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md +++ /dev/null @@ -1,116 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: You can add multiple sites to your Enterprise Mode site list by creating a custom text (TXT) or Extensible Markup Language (XML) file of problematic sites and then adding it in the Bulk add from file area of the Enterprise Mode Site List Manager. -author: dansimp -ms.prod: ie11 -ms.assetid: 20aF07c4-051a-451f-9c46-5a052d9Ae27c -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1) (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1) - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - - -**Applies to:** - -- Windows 8.1 -- Windows 7 - -You can add multiple sites to your Enterprise Mode site list by creating a custom text (TXT) or Extensible Markup Language (XML) file of problematic sites and then adding it in the **Bulk add from file** area of the Enterprise Mode Site List Manager. You can only add specific URLs, not Internet or Intranet Zones. - -If you want to add your websites one at a time, see Add sites to the [Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.1)](add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md). - -## Create an Enterprise Mode site list (TXT) file -You can create and use a custom text file to add multiple sites to your Enterprise Mode site list at the same time.

        **Important**
        This text file is only lets you add multiple sites at the same time. You can’t use this file to deploy Enterprise Mode into your company. - -You must separate each site using commas or carriage returns. For example: - -``` -microsoft.com, bing.com, bing.com/images -``` -**-OR-** - -``` -microsoft.com -bing.com -bing.com/images -``` - -## Create an Enterprise Mode site list (XML) file using the v.1 version of the Enterprise Mode schema -You can create and use a custom XML file with the Enterprise Mode Site List Manager to add multiple sites to your Enterprise Mode site list at the same time. For more info about the v.1 version of the Enterprise Mode schema, see [Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md). - -Each XML file must include: - -- **Version number.** This number must be incremented with each version of the Enterprise Mode site list, letting Internet Explorer know whether the list is new. Approximately 65 seconds after Internet Explorer 11 starts, it compares your site list version to the stored version number. If your file has a higher number, the newer version is loaded.

        **Important**
        After this check, IE11 won’t look for an updated list again until you restart the browser. - -- **<emie> tag.** This tag specifies the domains and domain paths that must be rendered using IE7 Enterprise Mode, IE8 Enterprise Mode, or the default IE11 browser environment.

        **Important**
        If you decide a site requires IE7 Enterprise Mode, you must add `forceCompatView=”true”` to your XML file. That code tells Enterprise Mode to check for a `DOCTYPE` tag on the specified webpage. If there is, the site renders using Windows Internet Explorer 7. If there’s no tag, the site renders using Microsoft Internet Explorer 5. - -- <docMode> tag.This tag specifies the domains and domain paths that need either to appear using the specific doc mode you assigned to the site. Enterprise Mode takes precedence over document modes, so sites that are already included in the Enterprise Mode site list won’t be affected by this update and will continue to load in Enterprise Mode, as usual. For more specific info about using document modes, see [Fix web compatibility issues using document modes and the Enterprise Mode site list](fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md). - -### Enterprise Mode v.1 XML schema example -The following is an example of what your XML file should look like when you’re done adding your sites. For more info about how to create your XML file, see [Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md). - -``` - - - www.cpandl.com - www.woodgrovebank.com - adatum.com - contoso.com - relecloud.com - /about - - fabrikam.com - /products - - - - contoso.com - /travel - - fabrikam.com - /products - - - -``` - -To make sure your site list is up-to-date; wait 65 seconds after opening IE and then check that the `CurrentVersion` value in the `HKEY\CURRENT\USER\Software\Microsoft\Internet Explorer\Main\EnterpriseMode\` registry key matches the version number in your file.

        **Important**
        If `CurrentVersion` is not set or is wrong, it means that the XML parsing failed. This can mean that the XML file isn’t there, that there are access problems, or that the XML file format is wrong. Don’t manually change the `CurrentVersion` registry setting. You must make your changes to your site list and then update the list using the import function in the Enterprise Mode Site List Manager (. - -## Add multiple sites to the Enterprise Mode Site List Manager (schema v.1) -After you create your .xml or .txt file, you can bulk add the sites to the Enterprise Mode Site List Manager (schema v.1). - - **To add multiple sites** - -1. In the Enterprise Mode Site List Manager (schema v.1), click **Bulk add from file**. - -2. Go to your site list (either .txt or .xml) to add the included sites to the tool, and then click **Open**.

        -Each site is validated and if successful, added to the global site list when you click **OK** to close the menu. If a site doesn’t pass validation, you can try to fix the issues or pick the site and click **Add to list** to ignore the validation problem. For more information about fixing validation problems, see [Fix validation problems using the Enterprise Mode Site List Manager](fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md). - -3. Click **OK** to close the **Bulk add sites to the list** menu. - -4. On the **File** menu, click **Save to XML**, and save your file.

        -You can save the file locally or to a network share. However, you must make sure you deploy it to the location specified in your registry key. For more information about the registry key, see [Turn on Enterprise Mode and use a site list](turn-on-enterprise-mode-and-use-a-site-list.md). - -## Next steps -After you’ve added all of your sites to the tool and saved the file to XML, you can configure the rest of the Enterprise Mode functionality to use it. You can also turn Enterprise Mode on locally, so your users have the option to use Enterprise Mode on individual websites from the **Tools** menu. For more information, see [Turn on local control and logging for Enterprise Mode](turn-on-local-control-and-logging-for-enterprise-mode.md). - -## Related topics -- [Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md) -- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) - - - - - - diff --git a/browsers/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md b/browsers/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md deleted file mode 100644 index 18c0b63cac..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md +++ /dev/null @@ -1,121 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Add multiple sites to your Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2). -author: dansimp -ms.prod: ie11 -ms.assetid: da659ff5-70d5-4852-995e-4df67c4871dd -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2) (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 10/24/2017 ---- - - -# Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2) - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 - -You can add multiple sites to your Enterprise Mode site list by creating a custom text (TXT) or Extensible Markup Language (XML) file of problematic sites and then adding it in the **Bulk add from file** area of the Enterprise Mode Site List Manager (schema v.2). You can only add specific URLs, not Internet or Intranet Zones. - -To add your websites one at a time, see [Add sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.2)](add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md). - -## Create an Enterprise Mode site list (TXT) file - -You can create and use a custom text file with the Enterprise Mode Site List Manager (schema v.2) to add multiple sites to your Enterprise Mode site list at the same time. - ->**Important:**
        This text file is only lets you add multiple sites at the same time. You can’t use this file to deploy Enterprise Mode into your company. - -You must separate each site using commas or carriage returns. For example: - -``` -microsoft.com, bing.com, bing.com/images -``` -**-OR-** - -``` -microsoft.com -bing.com -bing.com/images -``` - -## Create an Enterprise Mode site list (XML) file using the v.2 version of the Enterprise Mode schema - -You can create and use a custom XML file with the Enterprise Mode Site List Manager (schema v.2) to add multiple sites to your Enterprise Mode site list at the same time. - -Each XML file must include: - -- **site-list version number**. This number must be incremented with each version of the Enterprise Mode site list, letting Internet Explorer know whether the list is new. Approximately 65 seconds after Internet Explorer 11 starts, it compares your site list version to the stored version number. If your file has a higher number, the newer version is loaded.

        **Important**
        After this check, IE11 won’t look for an updated list again until you restart the browser.  - -- **<compat-mode> tag.** This tag specifies what compatibility setting are used for specific sites or domains. - -- **<open-in> tag.** This tag specifies what browser opens for each sites or domain. - -### Enterprise Mode v.2 XML schema example - -The following is an example of what your XML file should look like when you’re done adding your sites. For more info about how to create your XML file, see [Enterprise Mode schema v.2 guidance](enterprise-mode-schema-version-2-guidance.md). - -```xml - - - - EnterpriseSitelistManager - 10240 - 20150728.135021 - - - - IE8Enterprise - MSEdge - - - IE7Enterprise - IE11 - - - default - IE11 - - -``` -In the above example, the following is true: - -- ```www.cpandl.com```, as the main domain, must use IE8 Enterprise Mode. However, ```www.cpandl.com/images``` must use IE7 Enterprise Mode. - -- contoso.com, and all of its domain paths, can use the default compatibility mode for the site. - -To make sure your site list is up-to-date; wait 65 seconds after opening IE and then check that the `CurrentVersion` value in the `HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\EnterpriseMode\` registry key matches the version number in your file.

        **Important**
        If `CurrentVersion` is not set or is wrong, it means that the XML parsing failed. This can mean that the XML file isn’t there, that there are access problems, or that the XML file format is wrong. Don’t manually change the `CurrentVersion` registry setting. You must make your changes to your site list and then update the list using the import function in the Enterprise Mode Site List Manager (schema v.2). - -## Add multiple sites to the Enterprise Mode Site List Manager (schema v.2) -After you create your .xml or .txt file, you can bulk add the sites to the Enterprise Mode Site List Manager (schema v.2). - - **To add multiple sites** - -1. In the Enterprise Mode Site List Manager (schema v.2), click **Bulk add from file**. - -2. Go to your site list (either .txt or .xml) to add the included sites to the tool, and then click **Open**.

        -Each site is validated and if successful, added to the global site list when you click **OK** to close the menu. If a site doesn’t pass validation, you can try to fix the issues or pick the site and click **Add to list** to ignore the validation problem. For more information about fixing validation problems, see [Fix validation problems using the Enterprise Mode Site List Manager](fix-validation-problems-using-the-enterprise-mode-site-list-manager.md). - -3. Click **OK** to close the **Bulk add sites to the list** menu. - -4. On the **File** menu, click **Save to XML**, and save your file.

        -You can save the file locally or to a network share. However, you must make sure you deploy it to the location specified in your registry key. For more information about the registry key, see [Turn on Enterprise Mode and use a site list](turn-on-enterprise-mode-and-use-a-site-list.md). - -## Next steps -After you’ve added all of your sites to the tool and saved the file to XML, you can configure the rest of the Enterprise Mode functionality to use it. You can also turn Enterprise Mode on locally, so your users have the option to use Enterprise Mode on individual websites from the **Tools** menu. For more information, see [Turn on local control and logging for Enterprise Mode](turn-on-local-control-and-logging-for-enterprise-mode.md). - -## Related topics -- [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) -- [Enterprise Mode schema v.2 guidance](enterprise-mode-schema-version-2-guidance.md) - diff --git a/browsers/internet-explorer/ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md b/browsers/internet-explorer/ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md deleted file mode 100644 index 8c5e4b4426..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md +++ /dev/null @@ -1,70 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Enterprise Mode is a compatibility mode that runs on Internet Explorer 11, letting websites render using a modified browser configuration that's designed to emulate either Windows Internet Explorer 7 or Windows Internet Explorer 8, avoiding the common compatibility problems associated with web apps written and tested on older versions of Internet Explorer. -author: dansimp -ms.prod: ie11 -ms.assetid: 042e44e8-568d-4717-8fd3-69dd198bbf26 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Add sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.1) (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Add single sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.1) - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - - -**Applies to:** - -- Windows 8.1 -- Windows 7 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -Enterprise Mode is a compatibility mode that runs on Internet Explorer 11, letting websites render using a modified browser configuration that’s designed to emulate either Windows Internet Explorer 7 or Windows Internet Explorer 8, avoiding the common compatibility problems associated with web apps written and tested on older versions of Internet Explorer.

        **Important**
        You can only add specific URLs, not Internet or Intranet Zones. - -

        Note
        If you need to include a lot of sites, instead of adding them one at a time, you can create a list of websites and add them all at the same time. For more information, see Add multiple sites to the Enterprise Mode site list using a file and the Windows 7 and 8.1 Enterprise Mode Site List Manager. - -## Adding a site to your compatibility list -You can add individual sites to your compatibility list by using the Enterprise Mode Site List Manager. -

        Note
        If you're using the v.2 version of the Enterprise Mode schema, you'll need to use the Enterprise Mode Site List Manager (schema v.1). For more info, see Add sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.2). - - **To add a site to your compatibility list using the Enterprise Mode Site List Manager (schema v.1)** - -1. In the Enterprise Mode Site List Manager (schema v.1), click **Add**. - -2. Type the URL for the website that’s experiencing compatibility problems, like *<domain>.com* or *<domain>.com*/*<path>* into the **URL** box.

        -Don't include the `https://` or `https://` designation. The tool automatically tries both versions during validation. - -3. Type any comments about the website into the **Notes about URL** box.

        -Administrators can only see comments while they’re in this tool. - -4. Choose **IE7 Enterprise Mode**, **IE8 Enterprise Mode**, or the appropriate document mode for sites that must be rendered using the emulation of a previous version of IE, or pick **Default IE** if the site should use the latest version of IE. - -The path within a domain can require a different compatibility mode from the domain itself. For example, the domain might look fine in the default IE11 browser, but the path might have problems and require the use of Enterprise Mode. If you added the domain previously, your original compatibility choice is still selected. However, if the domain is new, **IE8 Enterprise Mode** is automatically selected. - -Enterprise Mode takes precedence over document modes, so sites that are already included in the Enterprise Mode site list won’t be affected by this update and will continue to load in Enterprise Mode, as usual. For more specific info about using document modes, see [Fix web compatibility issues using document modes and the Enterprise Mode site list](fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md). - -5. Click **Save** to validate your website and to add it to the site list for your enterprise.

        - If your site passes validation, it’s added to the global compatibility list. If the site doesn’t pass validation, you’ll get an error message explaining the problem. You’ll then be able to either cancel the site or ignore the validation problem and add it to your list anyway. - -6. On the **File** menu, go to where you want to save the file, and then click **Save to XML**.

        - You can save the file locally or to a network share. However, you must make sure you deploy it to the location specified in your registry key. For more information about the registry key, see [Turn on local control and logging for Enterprise Mode](turn-on-local-control-and-logging-for-enterprise-mode.md). - -## Next steps -After you’ve added all of your sites to the tool and saved the file to XML, you can configure the rest of the Enterprise Mode functionality to use it. You can also turn Enterprise Mode on locally, so your users have the option to use Enterprise Mode on individual websites from the **Tools** menu. For more information, see [Turn on local control and logging for Enterprise Mode](turn-on-local-control-and-logging-for-enterprise-mode.md). - -## Related topics -- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) - - - - - - diff --git a/browsers/internet-explorer/ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md b/browsers/internet-explorer/ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md deleted file mode 100644 index 10f60620a8..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md +++ /dev/null @@ -1,86 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Enterprise Mode is a compatibility mode that runs on Internet Explorer 11, letting websites render using a modified browser configuration that''s designed to emulate either Windows Internet Explorer 8 or Windows Internet Explorer 7, avoiding the common compatibility problems associated with web apps written and tested on older versions of Internet Explorer. -author: dansimp -ms.prod: ie11 -ms.assetid: 513e8f3b-fedf-4d57-8d81-1ea4fdf1ac0b -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Add sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.2) (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Add single sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.2) - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 - -Enterprise Mode is a compatibility mode that runs on Internet Explorer 11, letting websites render using a modified browser configuration that’s designed to emulate either Windows Internet Explorer 8 or Windows Internet Explorer 7, avoiding the common compatibility problems associated with web apps written and tested on older versions of Internet Explorer.

        **Important**
        You can only add specific URLs, not Internet or Intranet Zones. - -

        Note
        If you need to include a lot of sites, instead of adding them one at a time, you can create a list of websites and add them all at the same time. For more information, see the Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2) or the Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1) topic, based on your operating system. - -## Adding a site to your compatibility list -You can add individual sites to your compatibility list by using the Enterprise Mode Site List Manager.

        -**Note**
        If you're using the v.1 version of the Enterprise Mode schema, you'll need to use the Enterprise Mode Site List Manager (schema v.1). For more info, see [Add sites to the Enterprise Mode site list using the WEnterprise Mode Site List Manager (schema v.1)](add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md). - - **To add a site to your compatibility list using the Enterprise Mode Site List Manager (schema v.2)** - -1. In the Enterprise Mode Site List Manager (schema v.2), click **Add**. - -2. Type the URL for the website that’s experiencing compatibility problems, like *<domain>.com* or *<domain>.com*/*<path>* into the **URL** box.

        - Don't include the `https://` or `https://` designation. The tool automatically tries both versions during validation. - -3. Type any comments about the website into the **Notes about URL** box.

        - Administrators can only see comments while they’re in this tool. - -4. In the **Compat Mode** box, choose one of the following: - - - **IE8Enterprise**. Loads the site in IE8 Enterprise Mode. - - - **IE7Enterprise**. Loads the site in IE7 Enterprise Mode. - - - **IE\[*x*\]**. Where \[x\] is the document mode number and the site loads in the specified document mode. - - - **Default Mode**. Loads the site using the default compatibility mode for the page. - - The path within a domain can require a different compatibility mode from the domain itself. For example, the domain might look fine in the default IE11 browser, but the path might have problems and require the use of Enterprise Mode. If you added the domain previously, your original compatibility choice is still selected. However, if the domain is new, **IE8 Enterprise Mode** is automatically selected. - - Enterprise Mode takes precedence over document modes, so sites that are already included in the Enterprise Mode site list won’t be affected by this update and will continue to load in Enterprise Mode, as usual. For more specific info about using document modes, see [Fix web compatibility issues using document modes and the Enterprise Mode site list](fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md). - -5. In conjunction with the compatibility mode, you'll need to use the **Open in** box to pick which browser opens the site. - - - **IE11**. Opens the site in IE11, regardless of which browser is opened by the employee. If you have enabled [Internet Explorer mode integration on Microsoft Edge](/deployedge/edge-ie-mode), this option will open sites in Internet Explorer mode. - - - **MSEdge**. Opens the site in Microsoft Edge, regardless of which browser is opened by the employee. - - - **None**. Opens in whatever browser the employee chooses. - -6. If you have enabled [Internet Explorer mode integration on Microsoft Edge](/deployedge/edge-ie-mode), and you have sites that still need to opened in the standalone Internet Explorer 11 application, you can check the box for **Standalone IE**. This checkbox is only relevant when associated to 'Open in' IE11. Checking the box when 'Open In' is set to MSEdge or None will not change browser behavior. - -7. The checkbox **Allow Redirect** applies to the treatment of server side redirects. If you check this box, server side redirects will open in the browser specified by the open-in tag. For more information, see [here](./enterprise-mode-schema-version-2-guidance.md#updated-schema-attributes). - -8. Click **Save** to validate your website and to add it to the site list for your enterprise.

        - If your site passes validation, it’s added to the global compatibility list. If the site doesn’t pass validation, you’ll get an error message explaining the problem. You’ll then be able to either cancel the site or ignore the validation problem and add it to your list anyway. - -9. On the **File** menu, go to where you want to save the file, and then click **Save to XML**.

        - You can save the file locally or to a network share. However, you must make sure you deploy it to the location specified in your registry key. For more information about the registry key, see [Turn on local control and logging for Enterprise Mode](turn-on-local-control-and-logging-for-enterprise-mode.md). - -## Next steps -After you’ve added all of your sites to the tool and saved the file to XML, you can configure the rest of the Enterprise Mode functionality to use it. You can also turn Enterprise Mode on locally, so your users have the option to use Enterprise Mode on individual websites from the **Tools** menu. For more information, see [Turn on local control and logging for Enterprise Mode](turn-on-local-control-and-logging-for-enterprise-mode.md). - -## Related topics -- [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) - - diff --git a/browsers/internet-explorer/ie11-deploy-guide/administrative-templates-and-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/administrative-templates-and-ie11.md deleted file mode 100644 index 4de574cbe2..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/administrative-templates-and-ie11.md +++ /dev/null @@ -1,86 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: security -description: Administrative templates and Internet Explorer 11 -author: dansimp -ms.prod: ie11 -ms.assetid: 2b390786-f786-41cc-bddc-c55c8a4c5af3 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Administrative templates and Internet Explorer 11 (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Administrative templates and Internet Explorer 11 - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - - -Administrative Templates are made up of a hierarchy of policy categories and subcategories that define how your policy settings appear in the Local Group Policy Editor, including: - -- What registry locations correspond to each setting. - -- What value options or restrictions are associated with each setting. - -- The default value for many settings. - -- Text explanations about each setting and the supported version of Internet Explorer. - -For a conceptual overview of Administrative Templates, see [Managing Group Policy ADMX Files Step-by-Step Guide](/previous-versions/windows/it-pro/windows-vista/cc709647(v=ws.10)). - -## What are Administrative Templates? -Administrative Templates are XML-based, multi-language files that define the registry-based Group Policy settings in the Local Group Policy Editor. There are two types of Administrative Templates: - -- **ADMX.** A language-neutral setup file that states the number and type of policy setting, and the location by category, as it shows up in the Local Group Policy Editor. - -- **ADML.** A language-specific setup file that provides language-related information to the ADMX file. This file lets the policy setting show up in the right language in the Local Group Policy Editor. You can add new languages by adding new ADML files in the required language. - -## How do I store Administrative Templates? -As an admin, you can create a central store folder on your SYSVOL directory, named **PolicyDefinitions**. For example, %*SystemRoot*%\\PolicyDefinitions. This folder provides a single, centralized storage location for your Administrative Templates (both ADMX and ADML) files, so they can be used by your domain-based Group Policy Objects (GPOs). -

        Important
        Your Group Policy tools use the ADMX files in your store, ignoring any local copies. For more information about creating a central store, see Scenario 1: Editing the Local GPO Using ADMX Files. - -## Administrative Templates-related Group Policy settings -When you install Internet Explorer 11, it updates the local administrative files, Inetres.admx and Inetres.adml, both located in the **PolicyDefinitions** folder. -

        Note
        You won't see the new policy settings if you try to view or edit your policy settings on a computer that isn't running IE11. To fix this, you can either install IE11, or you can copy the updated Inetres.admx and Inetres.adml files from another computer to the PolicyDefinitions folder on this computer. - -IE11 provides these new policy settings, which are editable in the Local Group Policy Editor, and appear in the following policy paths: - -- Computer Configuration\\Administrative Templates\\Windows Components\\ - -- User Configuration\\Administrative Templates\\Windows Components\\ - - -|Catalog |Description | -| ------------------------------------------------ | --------------------------------------------| -|IE |Turns standard IE configuration on and off. | -|Internet Explorer\Accelerators |Sets up and manages Accelerators. | -|Internet Explorer\Administrator Approved Controls |Turns ActiveX controls on and off. | -|Internet Explorer\Application Compatibility |Turns the **Cut**, **Copy**, or **Paste** operations on or off. This setting also requires that `URLACTION_SCRIPT_PASTE` is set to **Prompt**. | -|Internet Explorer\Browser Menus |Shows or hides the IE menus and menu options.| -|Internet Explorer\Corporate Settings |Turns off whether you specify the code download path for each computer. | -|Internet Explorer\Delete Browsing History |Turns the **Delete Browsing History** settings on and off. | -|Internet Explorer\Internet Control Panel |Turns pages on and off in the **Internet Options** dialog box. Also turns on and off the subcategories that manage settings on the **Content**, **General**, **Security** and **Advanced** pages. | -|Internet Explorer\Internet Settings |Sets up and manages the **Advanced settings**, **AutoComplete**, **Display Settings**, and **URL Encoding** options. | -|Internet Explorer\Persistence Behavior |Sets up and manages the file size limits for Internet security zones. | -|Internet Explorer\Privacy |Turns various privacy-related features on and off. | -|Internet Explorer\Security Features |Turns various security-related features on and off in the browser, Windows Explorer, and other applications. | -|Internet Explorer\Toolbars |Turns on and off the ability for users to edit toolbars in the browser. You can also set the default toolbar buttons here. | -|RSS Feeds |Sets up and manages RSS feeds in the browser. | - - -## Editing Group Policy settings -Regardless which tool you're using to edit your Group Policy settings, you'll need to follow one of these guides for step-by-step editing instructions: - -- **If you're using the Group Policy Management Console (GPMC) or the Local Group Policy Editor.** See [Edit Administrative Template Policy Settings](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc771479(v=ws.11)) for step-by-step instructions about editing your Administrative Templates. - -- **If you're using GPMC with Advanced Group Policy Management (AGPM).** See [Checklist: Create, Edit, and Deploy a GPO](/microsoft-desktop-optimization-pack/agpm/checklist-create-edit-and-deploy-a-gpo-agpm40) for step-by-step instructions about how to check out a GPO from the AGPM archive, edit it, and request deployment. - -## Related topics -- [Administrative templates (.admx) for Windows 10 April 2018 Update](https://www.microsoft.com/download/details.aspx?id=56880) -- [Administrative templates (.admx) for Windows 10 October 2018 Update](https://www.microsoft.com/download/details.aspx?id=57576) -- [Administrative Templates (.admx) for Windows 8.1 and Windows Server 2012 R2](https://go.microsoft.com/fwlink/p/?LinkId=746580) \ No newline at end of file diff --git a/browsers/internet-explorer/ie11-deploy-guide/approve-change-request-enterprise-mode-portal.md b/browsers/internet-explorer/ie11-deploy-guide/approve-change-request-enterprise-mode-portal.md deleted file mode 100644 index 07687792a3..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/approve-change-request-enterprise-mode-portal.md +++ /dev/null @@ -1,66 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Details about how Approvers can approve open change requests in the Enterprise Mode Site List Portal. -author: dansimp -ms.prod: ie11 -title: Approve a change request using the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp ---- - -# Approve a change request using the Enterprise Mode Site List Portal - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -After a change request is successfully submitted to the pre-defined Approver(s), employees granted the role of **App Manager**, **Group Head**, or **Administrator**, they must approve the changes. - -## Approve or reject a change request -The Approvers get an email stating that a Requester successfully opened, tested, and submitted the change request to the Approvers group. The Approvers can accept or reject a change request. - -**To approve or reject a change request** -1. The Approver logs onto the Enterprise Mode Site List Portal, **All Approvals** page. - - The Approver can also get to the **All Approvals** page by clicking **Approvals Pending** from the left pane. - -2. The Approver clicks the expander arrow (**\/**) to the right side of the change request, showing the list of Approvers and the **Approve** and **Reject** buttons. - -3. The Approver reviews the change request, making sure it's correct. If the info is correct, the Approver clicks **Approve** to approve the change request. If the info seems incorrect, or if the app shouldn't be added to the site list, the Approver clicks **Reject**. - - An email is sent to the Requester, the Approver(s) group, and the Administrator(s) group, with the updated status of the request. - - -## Send a reminder to the Approver(s) group -If the change request is sitting in the approval queue for too long, the Requester can send a reminder to the group. - -- From the **My Approvals** page, click the checkbox next to the name of each Approver to be reminded, and then click **Send reminder**. - - An email is sent to the selected Approver(s). - - -## View rejected change requests -The original Requester, the Approver(s) group, and the Administrator(s) group can all view the rejected change request. - -**To view the rejected change request** - -- In the Enterprise Mode Site List Portal, click **Rejected** from the left pane. - - All rejected change requests appear, with role assignment determining which ones are visible. - - -## Next steps -After an Approver approves the change request, it must be scheduled for inclusion in the production Enterprise Mode Site List. For the scheduling steps, see the [Schedule approved change requests for production using the Enterprise Mode Site List Portal](schedule-production-change-enterprise-mode-portal.md) topic. diff --git a/browsers/internet-explorer/ie11-deploy-guide/auto-configuration-and-auto-proxy-problems-with-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/auto-configuration-and-auto-proxy-problems-with-ie11.md deleted file mode 100644 index f87e4e9cc9..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/auto-configuration-and-auto-proxy-problems-with-ie11.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: networking -description: Auto configuration and auto proxy problems with Internet Explorer 11 -author: dansimp -ms.prod: ie11 -ms.assetid: 3fbbc2c8-859b-4b2e-abc3-de2c299e0938 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Auto configuration and auto proxy problems with Internet Explorer 11 (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Auto configuration and auto proxy problems with Internet Explorer 11 - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -You might experience some problems using automatic configuration and auto-proxy with Internet Explorer 11. - -## Branding changes aren't distributed using automatic configuration -If you've turned on the **Disable external branding of Internet Explorer** Group Policy Object, you won't be able to use automatic configuration to distribute your branding changes to your users' computers. When this object is turned on, it prevents the branding of IE by a non-Microsoft company or entity, such as an Internet service provider or Internet content provider. For more information about automatic configuration, see [Auto configuration settings for Internet Explorer 11](auto-configuration-settings-for-ie11.md) and [Use the Automatic Configuration page in the IEAK 11 Wizard](../ie11-ieak/auto-config-ieak11-wizard.md). For more information about Group Policy settings, see [Group policy objects and Internet Explorer 11 (IE11)](group-policy-objects-and-ie11.md). - -## Proxy server setup issues -If you experience issues while setting up your proxy server, you can try these troubleshooting steps: - -- Check to make sure the proxy server address is right. - -- Check that both **Automatically detect settings** and **Automatic configuration** are turned on in the browser. - -- Check that the browser is pointing to the right automatic configuration script location. - - **To check your proxy server address** - -1. On the **Tools** menu, click **Internet Options**, and then **Connections**. - -2. Click **Settings** or **LAN Settings**, and then look at your proxy server address. - -3. If you have multiple proxy servers, click **Advanced** to look at all of the additional addresses.

        **Note**
        If IE11 uses a proxy server for local IP addresses, regardless whether you turned on the **Bypass Proxy Server for Local Addresses** option, see [Internet Explorer Uses Proxy Server for Local IP Address Even if the "Bypass Proxy Server for Local Addresses" Option Is Turned On](/troubleshoot/browsers/internet-explorer-uses-proxy-server-local-ip-address). - - **To check that you've turned on the correct settings** - -4. On the **Tools** menu, click **Internet Options**, and then click **Connections**. - -5. Click **Settings** or **LAN Settings**. - -6. In the **Automatic configuration** area, check that you've clicked the **Automatically detect settings** box. If you've turned on automatic configuration, check to make sure that you've also clicked the **Use automatic configuration script** box.

        **Note**
        If at this point everything is set up correctly, but the proxy server still isn't behaving properly, click the **Detect my network settings** box in the **Error** dialog box to try to detect the proxy server, again. - - **To check that you're pointing to the correct automatic configuration script location** - -7. On the **Tools** menu, click **Internet Options**, and then click **Connections**. - -8. Click **Settings** or **LAN Settings**. - -9. In the **Automatic configuration** area, check that you've chosen the **Use automatic configuration script** box, and that it has the correct location to your automatic configuration script or for your automatic proxy URL. - - - diff --git a/browsers/internet-explorer/ie11-deploy-guide/auto-configuration-settings-for-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/auto-configuration-settings-for-ie11.md deleted file mode 100644 index 10ff22508d..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/auto-configuration-settings-for-ie11.md +++ /dev/null @@ -1,74 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: networking -description: Auto configuration settings for Internet Explorer 11 -author: dansimp -ms.prod: ie11 -ms.assetid: 90308d59-45b9-4639-ab1b-497e5ba19023 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Auto configuration settings for Internet Explorer 11 (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Auto configuration settings for Internet Explorer 11 - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -Automatic configuration lets you apply custom branding and graphics to your internal Internet Explorer installations, running on Windows 8.1 or Windows Server 2012 R2. For more information about adding custom branding and graphics to your IE package, see [Customize the toolbar button and Favorites List icons using IEAK 11](../ie11-ieak/guidelines-toolbar-and-favorites-list-ieak11.md).

        **Important**
        You'll only see and be able to use the **IE Customization Wizard 11 - Automatic Configuration** page if you're creating an internal IE installation package. For more information about the **IE Customization Wizard 11 - Automatic Configuration** page, see [Use the Automatic Configuration page in the IEAK 11 Wizard](../ie11-ieak/auto-config-ieak11-wizard.md). - -## Adding the automatic configuration registry key -For custom graphics and branding, add the `FEATURE\AUTOCONFIG\BRANDING` registry key to your IE installation package.

        **Important**
        Follow these directions carefully because serious problems can occur if you update your registry incorrectly. For added protection, back up your registry so you can restore it if a problem occurs. - - **To add the registry key** - -1. On the **Start** screen, type **regedit**, and then click **Regedit.exe**. - -2. Right-click the `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl` subkey, point to **New**, and then click **Key**. - -3. Enter the new key name, `FEATURE\AUTOCONFIG\BRANDING`, and then press Enter. - -4. Right-click `FEATURE\AUTOCONFIG\BRANDING`, point to **New**, and then click **DWORD (32-bit) Value**. - -5. Enter the new DWORD value name, **iexplore.exe**, and then press Enter. - -6. Right-click **iexplore.exe**, and then click **Modify**. - -7. In the **Value data** box, enter **1**, and then click **OK**. - -8. Exit the registry editor. - -## Updating your automatic configuration settings -After adding the `FEATURE\AUTOCONFIG\BRANDING` registry key, you can change your automatic configuration settings to pick up the updated branding. -

        Important
        Your branding changes won't be added or updated if you've previously chosen the Disable external branding of IE setting in the User Configuration\Administrative Templates\Windows Components\Internet Explorer Group Policy object. This setting is intended to prevent branding by a third-party, like an Internet service or content provider. For more information about Group Policy, including videos and the latest technical documentation, see the Group Policy TechCenter. - - **To update your settings** - -1. Open the IE Customization Wizard 11, and go to the **Automatic Configuration** page. - -2. Choose the **Automatically detect configuration settings** check box to allow automatic detection of browser settings. - -3. Choose the **Enable Automatic Configuration** box to let you change the rest of the configuration options, including: - - - **Automatically configure every box:** Type how often IE should check for configuration updates. Typing **0** (zero), or not putting in any number, means that automatic configuration only happens when the computer restarts. - - - **Automatic Configuration URL (.INS file) box:** Type the location of your automatic configuration script. - - - **Automatic proxy URL (.JS, .JVS, or .PAC file) box:** Type the location of your automatic proxy script.

        **Important**
        Internet Explorer 11 no longer supports using file server locations with your proxy configuration (.pac) files. To keep using your .pac files, you have to keep them on a web server and reference them using a URL, like `https://share/test.ins`. - -If your branding changes aren't correctly deployed after running through this process, see [Auto configuration and auto proxy problems with Internet Explorer 11](auto-configuration-and-auto-proxy-problems-with-ie11.md). - -## Locking your automatic configuration settings -You have two options to restrict your users' ability to override the automatic configuration settings, based on your environment. - -- **Using Microsoft Active Directory.** Choose **Disable changing Automatic Configuration settings** from the Administrative Templates setting. - -- **Not Using Active Directory.** Choose the **Disable changing Automatic Configuration settings** setting in the `User Configuration\Administrative Templates\Windows Components\Internet Explorer` Group Policy object. - - - diff --git a/browsers/internet-explorer/ie11-deploy-guide/auto-detect-settings-for-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/auto-detect-settings-for-ie11.md deleted file mode 100644 index bf9f448755..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/auto-detect-settings-for-ie11.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: networking -description: Auto detect settings Internet Explorer 11 -author: dansimp -ms.prod: ie11 -ms.assetid: c6753cf4-3276-43c5-aae9-200e9e82753f -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Auto detect settings Internet Explorer 11 (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Auto detect settings Internet Explorer 11 - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -After you specify the specific settings related to automatic detection on your Dynamic Host Configuration Protocol (DHCP) and Domain Name System (DNS) servers, you can set up your users' browser settings from a central location. - -Automatic detection works even if the browser wasn't originally set up or installed by the administrator. - -- **Using DHCP servers:** For local area network (LAN)-based users. This server type lets you specify your global and subnet TCP/IP parameters centrally, defining your users' parameters by using reserved addresses. By doing it this way, a computer can move between subnets, automatically reconfiguring for TCP/IP when it starts. - -- **Using DNS servers:** For users on dial-up connections. This server type uses a set of protocols and services on a TCP/IP network, which lets users search for other computers by using hierarchical, user-friendly names (hosts), instead of numeric IP addresses.

        **Note**
        DHCP has a higher priority than DNS for automatic configuration. If DHCP provides the URL to a .pac, .jvs, .js, or .ins configuration file, the process stops and the DNS lookup doesn't happen. - -## Updating your automatic detection settings -To use automatic detection, you have to set up your DHCP and DNS servers.

        **Note**
        Your DHCP servers must support the `DHCPINFORM` message, to obtain the DHCP options. - - **To turn on automatic detection for DHCP servers** - -1. Open the Internet Explorer Customization Wizard 11, and go to the **Automatic Configuration** page. - -2. Choose the **Automatically detect configuration settings** box to automatically detect your browser settings. For more information about the **Automatic Configuration** page, see [Use the Automatic Configuration page in the IEAK 11 Wizard](../ie11-ieak/auto-config-ieak11-wizard.md). - -3. Open the [DHCP Administrative Tool](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd145324(v=ws.10)), create a new option type, using the code number 252, and then associate it with the URL to your configuration file. For detailed instructions about how to do this, see [Create an option 252 entry in DHCP](/previous-versions/tn-archive/bb794881(v=technet.10)). - - **To turn on automatic detection for DNS servers** - -4. Open the IE Customization Wizard 11, and go to the **Automatic Configuration** page. - -5. Choose the **Automatically detect configuration settings** box to automatically detect your browser settings. - -6. In your DNS database file, create a host record named, **WPAD**. This record has the IP address of the web server storing your automatic configuration (.js, .jvs, .pac, or .ins) file.

        **-OR-**

        Create a canonical name (CNAME) alias record named, **WPAD**. This record has the resolved name (not the IP address) of the server storing your automatic configuration (.pac) file.

        **Note**
        For more information about creating a **WPAD** entry, see [Creating a WPAD entry in DNS](/previous-versions/tn-archive/cc995062(v=technet.10)). - -7. After the database file propagates to the server, the DNS name, `wpad..com` resolves to the server name that includes your automatic configuration file.

        **Note**
        Internet Explorer 11 creates a default URL template based on the host name, **wpad**. For example, `https://wpad..com/wpad.dat`. Because of this, you need to set up a file or redirection point in your web server **WPAD** record, named **wpad.dat**. The **wpad.dat** record delivers the contents of your automatic configuration file. - - - - - diff --git a/browsers/internet-explorer/ie11-deploy-guide/auto-proxy-configuration-settings-for-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/auto-proxy-configuration-settings-for-ie11.md deleted file mode 100644 index faba1eb9ac..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/auto-proxy-configuration-settings-for-ie11.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: networking -description: Auto proxy configuration settings for Internet Explorer 11 -author: dansimp -ms.prod: ie11 -ms.assetid: 5120aaf9-8ead-438a-8472-3cdd924b7d9e -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Auto proxy configuration settings for Internet Explorer 11 (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Auto proxy configuration settings for Internet Explorer 11 - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -Configure and maintain your proxy settings, like pointing your users' browsers to your automatic proxy script, through the Internet Explorer Customization Wizard 11 running on either Windows 8.1 or Windows Server 2012 R2. - -## Updating your auto-proxy settings -You can use your Internet settings (.ins) files to set up your standard proxy settings. You can also specify script files (.js, .jvs, or .pac) to configure and maintain your advanced proxy settings. IE uses your auto-proxy script files to dynamically determine whether to connect to a host or use a proxy server. If a proxy server connection fails, Internet Explorer 11 automatically attempts to connect to another proxy server that you have specified. - - **To update your settings** - -1. Create a script file with your proxy information, copying it to a server location. - -2. Open the IE Customization Wizard 11, and go to the **Automatic Configuration** page. - -3. Choose the **Enable Automatic Configuration** box to let you change the rest of the configuration options, including: - - - **Automatically configure every box:** Type how often IE should check for configuration updates. Typing **0** (zero), or not putting in any number, means that updates only happen when the computer restarts. - - - **Automatic Configuration URL (.INS file) box:** Type the location of the .ins file you want to use for automatic configuration. For more information about setting up **Automatic Configuration**, see [Auto configuration settings for Internet Explorer 11](auto-configuration-settings-for-ie11.md). - - - **Automatic proxy URL (.JS, .JVS, or .PAC file) box:** Type the location of your automatic proxy script. This script runs whenever IE11 makes a network request and can include multiple proxy servers for each protocol type.

        **Important**
        IE11 no longer supports using file server locations with your proxy configuration (.pac) files. To keep using your .pac files, you have to keep them on a web server and reference them using a URL, like `https://share/test.ins`. - -## Locking your auto-proxy settings -You have two options to restrict your users' ability to override the automatic configuration settings, based on your environment. - -- **Using Microsoft Active Directory.** Choose **Disable changing proxy settings** from the Administrative Templates setting. - -- **Not Using Active Directory.** Choose the **Prevent changing proxy settings** setting in the `User Configuration\Administrative Templates\Windows Components\Internet Explorer` Group Policy object. For more information about Group Policy, see the [Group Policy TechCenter](/windows/deployment/deploy-whats-new). - -  - -  \ No newline at end of file diff --git a/browsers/internet-explorer/ie11-deploy-guide/blocked-out-of-date-activex-controls.md b/browsers/internet-explorer/ie11-deploy-guide/blocked-out-of-date-activex-controls.md deleted file mode 100644 index 17f6488e0a..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/blocked-out-of-date-activex-controls.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: Blocked out-of-date ActiveX controls -description: This page is periodically updated with new ActiveX controls blocked by this feature. -author: dansimp -ms.author: dansimp -audience: itpro -manager: dansimp -ms.date: 05/10/2018 -ms.topic: article -ms.prod: ie11 -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: security -ms.assetid: '' -ms.reviewer: -ms.sitesec: library ---- - -# Blocked out-of-date ActiveX controls - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - - -ActiveX controls are small apps that let websites provide content, like videos and games, and let you interact with content, like toolbars. Unfortunately, because many ActiveX controls aren't automatically updated, they can become outdated as new versions are released. It's very important that you keep your ActiveX controls up to date because malicious software (or malware) can target security flaws in outdated controls, damaging your computer by collecting info from it, installing unwanted software, or by letting someone else control it remotely. To help avoid this situation, Internet Explorer includes a security feature called _out-of-date ActiveX control blocking_. - -We'll periodically update this page with new ActiveX controls blocked by this feature. We'll typically provide one month's advance notice before adding new controls to the list. - -You will receive a notification if a webpage tries to load one of the following of ActiveX control versions: - -**Java** - -| Java 2 Platform, Standard Edition (J2SE) 1.4, everything below (but not including) update 43 | -|----------------------------------------------------------------------------------------------| -| J2SE 5.0, everything below (but not including) update 99 | -| Java SE 6, everything below (but not including) update 181 | -| Java SE 7, everything below (but not including) update 171 | -| Java SE 8, everything below (but not including) update 161 | -| Java SE 9, everything below (but not including) update 4 | - -**Silverlight** - - -| Everything below (but not including) Silverlight 5.1.50907.0 | -|--------------------------------------------------------------| -| | - -For more information, see [Out-of-date ActiveX control blocking](out-of-date-activex-control-blocking.md) and [Internet Explorer begins blocking out-of-date ActiveX controls](https://blogs.msdn.com/b/ie/archive/2014/08/06/internet-explorer-begins-blocking-out-of-date-activex-controls.aspx). You can also view Microsoft's complete list of out-of-date ActiveX controls in the XML-based [version list](https://go.microsoft.com/fwlink/?LinkId=403864). diff --git a/browsers/internet-explorer/ie11-deploy-guide/browser-cache-changes-and-roaming-profiles.md b/browsers/internet-explorer/ie11-deploy-guide/browser-cache-changes-and-roaming-profiles.md deleted file mode 100644 index 3fc8a84465..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/browser-cache-changes-and-roaming-profiles.md +++ /dev/null @@ -1,39 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: performance -description: Browser cache changes and roaming profiles -author: dansimp -ms.prod: ie11 -ms.assetid: 85f0cd01-6f82-4bd1-9c0b-285af1ce3436 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Browser cache changes and roaming profiles (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 10/16/2017 ---- - - -# Browser cache changes and roaming profiles - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -We’ve redesigned the browser cache to improve the performance, flexibility, reliability, and scalability of Internet Explorer and the apps that rely on the Windows Internet (WinINet) cache. Our new database design stops multiple clients from simultaneously accessing and using cached information, while also providing a higher level of data integrity. - -You won’t notice any changes to the management of your roaming profile data if you use our new database implementation in conjunction with the [roaming user profile guidelines](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/jj649079(v=ws.11)). This means that IE data that’s stored in the `AppData\Roaming` user profile folder is still be uploaded to your normal profile storage location after a user successfully logs off.

        **Note**
        Cookies in a roaming profile can only be set by Internet Explorer for the desktop, with Enhanced Protected Mode turned off. Cookies set by the immersive version of IE or by Microsoft Store apps, can’t be part of a roaming profile. For more information about persistent cookies and roaming, see [Persistent cookies are not roamed in Internet Explorer](https://go.microsoft.com/fwlink/p/?LinkId=401545). - -To get the best results while using roaming profiles, we strongly recommend the following: - -- Create a separate roaming repository for each domain account that uses roaming. - -- Restrict roaming user profiles so they work on only one computer at a time. Using a single roaming profile on multiple computers isn’t supported (via console or Remote Desktop) and can cause unpredictable results, including cookie loss. - -- Allow all computers that let users sign-on with a roaming profile have identical IE cookie policies and settings. - -- Make sure to delete the user’s local roaming profile at sign off for any computer using user profile roaming. You can do this by turning on the **Delete cached copies of roaming profiles** Group Policy Object. - -  - -  \ No newline at end of file diff --git a/browsers/internet-explorer/ie11-deploy-guide/change-history-for-internet-explorer-11.md b/browsers/internet-explorer/ie11-deploy-guide/change-history-for-internet-explorer-11.md deleted file mode 100644 index 1617af18d5..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/change-history-for-internet-explorer-11.md +++ /dev/null @@ -1,60 +0,0 @@ ---- -ms.localizationpriority: medium -title: Change history for Internet Explorer 11 (IE11) - Deployment Guide for IT Pros (Internet Explorer 11 for IT Pros) -description: This topic lists new and updated topics in the Internet Explorer 11 Deployment Guide documentation for Windows 10. -ms.mktglfcycl: deploy -ms.prod: windows-client -ms.sitesec: library -author: dansimp -ms.date: 07/27/2017 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp ---- - - -# Change history for Internet Explorer 11 - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -This topic lists new and updated topics in the Internet Explorer 11 documentation for Windows 10. - -## April 2017 -|New or changed topic | Description | -|----------------------|-------------| -|[Enterprise Mode for Internet Explorer 11](enterprise-mode-overview-for-ie11.md)|Updates to the Enterprise Mode section to include info about the Enterprise Mode Site List Portal. | - -## March 2017 -|New or changed topic | Description | -|----------------------|-------------| -|[New group policy settings for Internet Explorer 11](new-group-policy-settings-for-ie11.md) |Updated to add the Allow VBScript to run in Internet Explorer and the Hide the button (next to the New Tab button) that opens Microsoft Edge settings. | - -## November 2016 -|New or changed topic | Description | -|----------------------|-------------| -|[Collect data using Enterprise Site Discovery](collect-data-using-enterprise-site-discovery.md) |Updated the DocMode reason section to correct Code 8 and to add Code 9.| - -## August 2016 -|New or changed topic | Description | -|----------------------|-------------| -|[Enterprise Mode schema v.2 guidance](enterprise-mode-schema-version-2-guidance.md) |Updated to remove the IP range restrictions and to add code examples for both IPv4 and IPv6 addresses. | -|[Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md) |Updated to remove the IP range restrictions and to add code examples for both IPv4 and IPv6 addresses. | -|[Collect data using Enterprise Site Discovery](collect-data-using-enterprise-site-discovery.md)|Added the Understanding the returned reason codes section to the topic. | - -## July 2016 -|New or changed topic | Description | -|----------------------|-------------| -|[New group policy settings for Internet Explorer 11](new-group-policy-settings-for-ie11.md) |Updated to include the comprehensive list of Group Policies that were added with Internet Explorer 11. | - -## June 2016 -|New or changed topic | Description | -|----------------------|-------------| -|[New group policy settings for Internet Explorer 11](new-group-policy-settings-for-ie11.md) |Updated with 2 new policies, Send all sites not included in the Enterprise Mode Site List to Microsoft Edge and Show message when opening sites in Microsoft Edge using Enterprise Mode. | - - -## May 2016 -|New or changed topic | Description | -|----------------------|-------------| -|[Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md) | Added info about using <emie> and <docMode> together. | - diff --git a/browsers/internet-explorer/ie11-deploy-guide/check-for-new-enterprise-mode-site-list-xml-file.md b/browsers/internet-explorer/ie11-deploy-guide/check-for-new-enterprise-mode-site-list-xml-file.md deleted file mode 100644 index 9b4b3e6f1f..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/check-for-new-enterprise-mode-site-list-xml-file.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: Check for a new Enterprise Mode site list xml file (Internet Explorer 11 for IT Pros) -description: You can have centralized control over Enterprise Mode by creating a single, global XML site list that includes the list of websites to render using Enterprise Mode. -ms.assetid: 2bbc7017-622e-4baa-8981-c0bbda10e9df -ms.reviewer: -audience: itpro -manager: dansimp -ms.prod: ie11 -ms.mktglfcycl: deploy -ms.pagetype: appcompat -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.date: 08/14/2017 -ms.localizationpriority: medium ---- - - -# Check for a new Enterprise Mode site list xml file - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -You can have centralized control over Enterprise Mode by creating a single, global XML site list that includes the list of websites to render using Enterprise Mode. You can add and remove sites from your XML list as frequently as you want, changing which sites should render in Enterprise Mode for your employees. For information about turning on Enterprise Mode and using site lists, see [Turn on Enterprise Mode and use a site list](turn-on-enterprise-mode-and-use-a-site-list.md). - -The information in this topic only covers HTTPS protocol. We strongly recommend that you use HTTPS protocol instead of file protocol due to increased performance. - -**How Internet Explorer 11 looks for an updated site list** - -1. Internet Explorer starts up and looks for an updated site list in the following places: - - 1. **In the cache container.** IE first checks the cache container to see if it finds your XML site list. - - 2. **In the local cache.** If there’s nothing in the cache container, IE checks your local cache for the site list. - - 3. **On the server.** Based on standard IE caching rules, IE might look for a copy of your site list in the location you put specified in the **SiteList** value of the registry. - -2. If there’s an .xml file in the cache container, IE waits 65 seconds and then checks the local cache for a newer version of the file from the server, based on standard caching rules. If the server file has a different version number than the version in the cache container, the server file is used and stored in the cache container.

        **Note**
        If you’re already using a site list, enterprise mode continues to work during the 65 second wait; it just uses your existing site list instead of your new one. - -   - -  - -  - - - diff --git a/browsers/internet-explorer/ie11-deploy-guide/choose-how-to-deploy-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/choose-how-to-deploy-ie11.md deleted file mode 100644 index 810264c501..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/choose-how-to-deploy-ie11.md +++ /dev/null @@ -1,35 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: Choose how to deploy Internet Explorer 11 (IE11) -author: dansimp -ms.prod: ie11 -ms.assetid: 21b6a301-c222-40bc-ad0b-27f66fc54d9d -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Choose how to deploy Internet Explorer 11 (IE11) (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Choose how to deploy Internet Explorer 11 (IE11) - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -In this section, you can learn about how to deploy your custom version of Internet Explorer using Automatic Version Synchronization (AVS) or using your software distribution tools. - -## In this section - -| Topic | Description | -|------------------------------------------------------------- | ------------------------------------------------------ | -|[Deploy IE11 using Automatic Version Synchronization (AVS)](deploy-ie11-using-automatic-version-synchronization-avs.md) |Guidance about how to deploy your custom browser packages using Automatic Version Synchronization (AVS). | -|[Deploy IE11 using software distribution tools](deploy-ie11-using-software-distribution-tools.md) |Guidance about how to deploy your custom browser packages using System Center 2012 R2, Windows Server Update Services (WSUS), Group Policy software installation, or Microsoft Deployment toolkit (MDT). | - - - - - - diff --git a/browsers/internet-explorer/ie11-deploy-guide/choose-how-to-install-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/choose-how-to-install-ie11.md deleted file mode 100644 index 0175cb7bbe..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/choose-how-to-install-ie11.md +++ /dev/null @@ -1,38 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: Choose how to install Internet Explorer 11 (IE11) -author: dansimp -ms.prod: ie11 -ms.assetid: 9572f5f1-5d67-483e-bd63-ffea95053481 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Choose how to install Internet Explorer 11 (IE11) (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Choose how to install Internet Explorer 11 (IE11) - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -Before you install Internet Explorer 11, you should: - -- **Migrate Group Policy Objects.** Decide if your Group Policy Objects should migrate to the new version. - -- **Check vendor support for updated functionality.** Check whether third-party vendors have new versions or updates to necessary add-ons, apps, or code libraries. - -- **Choose the right version of Internet Explorer.** IE11 comes pre-installed on Windows 8.1 and Windows Server 2012 R2 or you can download it for Windows 7 SP1 or Windows Server 2008 R2 with Service Pack 1 (SP1) from the [Internet Explorer Downloads](https://go.microsoft.com/fwlink/p/?LinkId=214251) site. - -- **Choose how you'll deploy your installation package.** Your deployment method should be based on whether you're installing to computers already running Windows, or if you're deploying IE11 as part of a Windows installation. - - - **Existing computers running Windows.** Use Configuration Manager, System Center Essentials 2010, Windows Server Updates Services (WSUS), or Microsoft Intune to deploy IE11. For more information about how to use these systems, see [Configuration Manager](/previous-versions/system-center/system-center-2012-R2/gg682129(v=technet.10)), [System Center Essentials 2010](https://go.microsoft.com/fwlink/p/?LinkId=395200), [Windows Server Update Services](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh852345(v=ws.11)), and [Microsoft Intune Overview](https://www.microsoft.com/cloud-platform/microsoft-intune). - - - **As part of a Windows deployment.** Update your Windows images to include IE11, and then add the update to your MDT deployment share or to your Windows image. For instructions about how to create and use Windows images, see [Create and Manage a Windows Image Using DISM](/previous-versions/windows/it-pro/windows-8.1-and-8/hh825251(v=win.10)). For general information about deploying IE, see [Microsoft Deployment Toolkit (MDT)](/mem/configmgr/mdt/), [Windows ADK Overview](/previous-versions/windows/it-pro/windows-8.1-and-8/hh825486(v=win.10)). - -  - -  \ No newline at end of file diff --git a/browsers/internet-explorer/ie11-deploy-guide/collect-data-using-enterprise-site-discovery.md b/browsers/internet-explorer/ie11-deploy-guide/collect-data-using-enterprise-site-discovery.md deleted file mode 100644 index 961f15218c..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/collect-data-using-enterprise-site-discovery.md +++ /dev/null @@ -1,446 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: Use Internet Explorer to collect data on computers running Windows Internet Explorer 8 through Internet Explorer 11 on Windows 10, Windows 8.1, or Windows 7. -author: dansimp -ms.prod: windows-client -ms.assetid: a145e80f-eb62-4116-82c4-3cc35fd064b6 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Collect data using Enterprise Site Discovery -ms.sitesec: library -ms.date: 07/27/2017 ---- - -# Collect data using Enterprise Site Discovery - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 with Service Pack 1 (SP1) - -Use Internet Explorer to collect data on computers running Windows Internet Explorer 8 through Internet Explorer 11 on Windows 10, Windows 8.1, or Windows 7. This inventory information helps you build a list of websites used by your company so you can make more informed decisions about your IE deployments, including figuring out which sites might be at risk or require overhauls during future upgrades. - ->**Upgrade Readiness and Windows upgrades**
        ->You can use Upgrade Readiness to help manage your Windows 10 upgrades on devices running Windows 8.1 and Windows 7 (SP1). You can also use Upgrade Readiness to review several site discovery reports. For more information, see [Manage Windows upgrades with Upgrade Readiness](/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness). - - -## Before you begin -Before you start, you need to make sure you have the following: - -- Latest cumulative security update (for all supported versions of Internet Explorer): - - 1. Go to the [Microsoft Security Bulletin](/security-updates/) page, and change the filter to **Windows Internet Explorer 11**. - - ![microsoft security bulletin techcenter.](images/securitybulletin-filter.png) - - 2. Click the title of the latest cumulative security update, and then scroll down to the **Affected software** table. - - ![affected software section.](images/affectedsoftware.png) - - 3. Click the link that represents both your operating system version and Internet Explorer 11, and then follow the instructions in the **How to get this update** section. - -- [Setup and configuration package](https://go.microsoft.com/fwlink/p/?LinkId=517719), including: - - - Configuration-related PowerShell scripts - - - IETelemetry.mof file - - - Sample System Center 2012 report templates - - You must use System Center 2012 R2 Configuration Manager or later for these samples to work. - -Both the PowerShell script and the Managed Object Format (.MOF) file need to be copied to the same location on the client device, before you run the scripts. - -## What data is collected? -Data is collected on the configuration characteristics of IE and the sites it browses, as shown here. - -|Data point |IE11 |IE10 |IE9 |IE8 |Description | -|------------------------|-----|-----|-----|-----|------------------------------------------------------------------------| -|URL | ✔️ | ✔️ | ✔️ | ✔️ |URL of the browsed site, including any parameters included in the URL. | -|Domain | ✔️ | ✔️ | ✔️ | ✔️ |Top-level domain of the browsed site. | -|ActiveX GUID | ✔️ | ✔️ | ✔️ | ✔️ |GUID of the ActiveX controls loaded by the site. | -|Document mode | ✔️ | ✔️ | ✔️ | ✔️ |Document mode used by IE for a site, based on page characteristics. | -|Document mode reason | ✔️ | ✔️ | | |The reason why a document mode was set by IE. | -|Browser state reason | ✔️ | ✔️ | | |Additional information about why the browser is in its current state. Also called, browser mode. | -|Hang count | ✔️ | ✔️ | ✔️ | ✔️ |Number of visits to the URL when the browser hung. | -|Crash count | ✔️ | ✔️ | ✔️ | ✔️ |Number of visits to the URL when the browser crashed. | -|Most recent navigation failure (and count) | ✔️ | ✔️ | ✔️ | ✔️ |Description of the most recent navigation failure (like, a 404 bad request or 500 internal server error) and the number of times it happened. | -|Number of visits | ✔️ | ✔️ | ✔️ | ✔️ |Number of times a site has been visited. | -|Zone | ✔️ | ✔️ | ✔️ | ✔️ |Zone used by IE to browse sites, based on browser settings. | - - ->**Important**
        By default, IE doesn’t collect this data; you have to turn this feature on if you want to use it. After you turn on this feature, data is collected on all sites visited by IE, except during InPrivate sessions. Additionally, the data collection process is silent, so there’s no notification to the employee. Therefore, you must get consent from the employee before you start collecting info. You must also make sure that using this feature complies with all applicable local laws and regulatory requirements. - -### Understanding the returned reason codes -The following tables provide more info about the Document mode reason, Browser state reason, and the Zone codes that are returned as part of your data collection. - -#### DocMode reason -The codes in this table can tell you what document mode was set by IE for a webpage.
        These codes only apply to Internet Explorer 10 and Internet Explorer 11. - -|Code |Description | -|-----|------------| -|3 |Page state is set by the `FEATURE_DOCUMENT_COMPATIBLE_MODE` feature control key.| -|4 |Page is using an X-UA-compatible meta tag. | -|5 |Page is using an X-UA-compatible HTTP header. | -|6 |Page appears on an active **Compatibility View** list. | -|7 |Page is using native XML parsing. | -|8 |Page is using a special Quirks Mode Emulation (QME) mode that uses the modern layout engine, but the quirks behavior of Internet Explorer 5. | -|9 |Page state is set by the browser mode and the page's DOCTYPE.| - -#### Browser state reason -The codes in this table can tell you why the browser is in its current state. Also called “browser mode”.
        These codes only apply to Internet Explorer 10 and Internet Explorer 11. - -|Code |Description | -|-----|------------| -|1 |Site is on the intranet, with the **Display intranet sites in Compatibility View** box checked. | -|2 |Site appears on an active **Compatibility View** list, created in Group Policy. | -|3 |Site appears on an active **Compatibility View** list, created by the user. | -|4 |Page is using an X-UA-compatible tag. | -|5 |Page state is set by the **Developer** toolbar. | -|6 |Page state is set by the `FEATURE_BROWSER_EMULATION` feature control key. | -|7 |Site appears on the Microsoft **Compatibility View (CV)** list. | -|8 |Site appears on the **Quirks** list, created in Group Policy. | -|11 |Site is using the default browser. | - -#### Zone -The codes in this table can tell you what zone is being used by IE to browse sites, based on browser settings.
        These codes apply to Internet Explorer 8, Internet Explorer 9, Internet Explorer 10, and Internet Explorer 11. - -|Code |Description | -|-----|------------| -|-1 |Internet Explorer is using an invalid zone. | -|0 |Internet Explorer is using the Local machine zone. | -|1 |Internet Explorer is using the Local intranet zone. | -|2 |Internet Explorer is using the Trusted sites zone. | -|3 |Internet Explorer is using the Internet zone. | -|4 |Internet Explorer is using the Restricted sites zone. | - -## Where is the data stored and how do I collect it? -The data is stored locally, in an industry-standard WMI class, .MOF file or in an XML file, depending on your configuration. This file remains on the client computer until it’s collected. To collect the files, we recommend: - -- **WMI file**. Use Microsoft Configuration Manager or any agent that can read the contents of a WMI class on your computer. - -- **XML file**. Any agent that works with XML can be used. - -## WMI Site Discovery suggestions -We recommend that you collect your data for at most a month at a time, to capture a user’s typical workflow. We don’t recommend collecting data longer than that because the data is stored in a WMI provider and can fill up your computer’s hard drive. You may also want to collect data only for pilot users or a representative sample of people, instead of turning this feature on for everyone in your company. - -On average, a website generates about 250bytes of data for each visit, causing only a minor impact to Internet Explorer’s performance. Over the course of a month, collecting data from 20 sites per day from 1,000 users, you’ll get about 150MB of data:

        250 bytes (per site visit) X 20 sites/day X 30 days = (approximately) 150KB X 1000 users = (approximately) 150MB - ->**Important**
        The data collection process is silent, so there’s no notification to the employee. Therefore, you must get consent from the employee before you start collecting info. You must also make sure that using this feature complies with all applicable local laws and regulatory requirements. - -## Getting ready to use Enterprise Site Discovery -Before you can start to collect your data, you must run the provided PowerShell script (IETelemetrySetUp.ps1) on your client devices to start generating the site discovery data and to set up a place to store this data locally. Then, you must start collecting the site discovery data from the client devices, using one of these three options: - -- Collect your hardware inventory using the MOF Editor, while connecting to a client device.

        --OR- -- Collect your hardware inventory using the MOF Editor with a .MOF import file.

        --OR- -- Collect your hardware inventory using the SMS\DEF.MOF file (Configuration Manager 2007 only) - -### WMI only: Running the PowerShell script to compile the .MOF file and to update security privileges -You need to set up your computers for data collection by running the provided PowerShell script (IETelemetrySetUp.ps1) to compile the .mof file and to update security privileges for the new WMI classes. - ->**Important**
        You must run this script if you’re using WMI as your data output. It's not necessary if you're using XML as your data output. - -**To set up Enterprise Site Discovery** - -- Start PowerShell in elevated mode (using admin privileges) and run IETelemetrySetUp.ps1 by by-passing the PowerShell execution policy, using this command: `powershell -ExecutionPolicy Bypass .\IETelemetrySetUp.ps1`. For more info, see [about Execution Policies](/powershell/module/microsoft.powershell.core/about/about_execution_policies). - -### WMI only: Set up your firewall for WMI data -If you choose to use WMI as your data output, you need to make sure that your WMI data can travel through your firewall for the domain. If you’re sure, you can skip this section; otherwise, follow these steps: - -**To set up your firewall** - -1. In **Control Panel**, click **System and Security**, and then click **Windows Firewall**. - -2. In the left pane, click **Allow an app or feature through Windows Firewall** and scroll down to check the box for **Windows Management Instrumentation (WMI)**. - -3. Restart your computer to start collecting your WMI data. - -## Use PowerShell to finish setting up Enterprise Site Discovery -You can determine which zones or domains are used for data collection, using PowerShell. If you don’t want to use PowerShell, you can do this using Group Policy. For more info, see [Use Group Policy to finish setting up Enterprise Site Discovery](#use-group-policy-to-finish-setting-up-enterprise-site-discovery). - ->**Important**
        The .ps1 file updates turn on Enterprise Site Discovery and WMI collection for all users on a device. - -- **Domain allow list.** If you have a domain allow list, a comma-separated list of domains that should have this feature turned on, you should use this process. - -- **Zone allow list.** If you have a zone allow list, a comma-separated list of zones that should have this feature turned on, you should use this process. - -**To set up data collection using a domain allow list** - -- Start PowerShell in elevated mode (using admin privileges) and run IETelemetrySetUp.ps1, using this command: `.\IETelemetrySetUp.ps1 [other args] -SiteAllowList sharepoint.com,outlook.com,onedrive.com`. - - >**Important**
        Wildcards, like \*.microsoft.com, aren’t supported. - -**To set up data collection using a zone allow list** - -- Start PowerShell in elevated mode (using admin privileges) and run IETelemetrySetUp.ps1, using this command: `.\IETelemetrySetUp.ps1 [other args] -ZoneAllowList Computer,Intranet,TrustedSites,Internet,RestrictedSites`. - - >**Important**
        Only Computer, Intranet, TrustedSites, Internet, and RestrictedSites are supported. - -## Use Group Policy to finish setting up Enterprise Site Discovery -You can use Group Policy to finish setting up Enterprise Site Discovery. If you don’t want to use Group Policy, you can do this using PowerShell. For more info, see [Use Powershell to finish setting up Enterprise Site Discovery](#use-powershell-to-finish-setting-up-enterprise-site-discovery). - ->**Note**
         All of the Group Policy settings can be used individually or as a group. - - **To set up Enterprise Site Discovery using Group Policy** - -- Open your Group Policy editor, and go to these new settings: - - |Setting name and location |Description |Options | - |---------------------------|-------------|---------| - |Administrative Templates\Windows Components\Internet Explorer\Turn on Site Discovery WMI output |Writes collected data to a WMI class, which can be aggregated using a client-management solution like Configuration Manager. |

        • **On.** Turns on WMI recording.
        • **Off.** Turns off WMI recording.
        | - |Administrative Templates\Windows Components\Internet Explorer\Turn on Site Discovery XML output |Writes collected data to an XML file, which is stored in your specified location. |
        • **XML file path.** Including this turns on XML recording.
        • **Blank.** Turns off XML recording.
        | - |Administrative Templates\Windows Components\Internet Explorer\Limit Site Discovery output by Zone |Manages which zone can collect data. |To specify which zones can collect data, you must include a binary number that represents your selected zones, based on this order:

        0 – Restricted Sites zone
        0 – Internet zone
        0 – Trusted Sites zone
        0 – Local Intranet zone
        0 – Local Machine zone

        **Example 1:** Include only the Local Intranet zone

        Binary representation: *00010*, based on:

        0 – Restricted Sites zone
        0 – Internet zone
        0 – Trusted Sites zone
        1 – Local Intranet zone
        0 – Local Machine zone

        **Example 2:** Include only the Restricted Sites, Trusted Sites, and Local Intranet zones

        Binary representation: *10110*, based on:

        1 – Restricted Sites zone
        0 – Internet zone
        1 – Trusted Sites zone
        1 – Local Intranet zone
        1 – Local Machine zone | - |Administrative Templates\Windows Components\Internet Explorer\Limit Site Discovery output by domain |Manages which domains can collect data |To specify which domains can collect data, you must include your selected domains, one domain per line, in the provided box. It should look like:

        microsoft.sharepoint.com
        outlook.com
        onedrive.com
        timecard.contoso.com
        LOBApp.contoso.com | - -### Combining WMI and XML Group Policy settings -You can use both the WMI and XML settings individually or together: - -**To turn off Enterprise Site Discovery** - -|Setting name|Option| -|--- |--- | -|Turn on Site Discovery WMI output|Off| -|Turn on Site Discovery XML output|Blank| - -**Turn on WMI recording only** - -|Setting name|Option| -|--- |--- | -|Turn on Site Discovery WMI output|On| -|Turn on Site Discovery XML output|Blank| - -**To turn on XML recording only** - -|Setting name|Option| -|--- |--- | -|Turn on Site Discovery WMI output|Off| -|Turn on Site Discovery XML output|XML file path| - -**To turn on both WMI and XML recording** - -|Setting name|Option| -|--- |--- | -|Turn on Site Discovery WMI output|On| -|Turn on Site Discovery XML output|XML file path| - -## Use Configuration Manager to collect your data -After you’ve collected your data, you’ll need to get the local files off of your employee’s computers. To do this, use the hardware inventory process in Configuration Manager, using one of these options: - -- Collect your hardware inventory using the MOF Editor, while connecting to a client device.

        --OR- -- Collect your hardware inventory using the MOF Editor with a .MOF import file.

        --OR- -- Collect your hardware inventory using the SMS\DEF.MOF file (Configuration Manager 2007 only) - -### Collect your hardware inventory using the MOF Editor while connected to a client device -You can collect your hardware inventory using the MOF Editor, while you’re connected to your client devices. - - **To collect your inventory** - -1. From the Configuration Manager, click **Administration**, click **Client Settings**, double-click **Default Client Settings**, click **Hardware Inventory**, and then click **Set Classes**. - - ![Configuration Manager, showing the hardware inventory settings for client computers.](images/configmgrhardwareinventory.png) - -2. Click **Add**, click **Connect**, and connect to a computer that has completed the setup process and has already existing classes. - -3. Change the **WMI Namespace** to `root\cimv2\IETelemetry`, and click **Connect**. - - ![Configuration Manager, with the Connect to Windows Management Instrumentation (WMI) box.](images/ie11-inventory-addclassconnectscreen.png) - -4. Select the check boxes next to the following classes, and then click **OK**: - - - IESystemInfo - - - IEURLInfo - - - IECountInfo - -5. Click **OK** to close the default windows.
        -Your environment is now ready to collect your hardware inventory and review the sample reports. - -### Collect your hardware inventory using the MOF Editor with a .MOF import file -You can collect your hardware inventory using the MOF Editor and a .MOF import file. - - **To collect your inventory** - -1. From the Configuration Manager, click **Administration**, click **Client Settings**, double-click **Default Client Settings**, click **Hardware Inventory**, and then click **Set Classes**. - -2. Click **Import**, choose the MOF file from the downloaded package we provided, and click **Open**. - -3. Pick the inventory items to install, and then click **Import**. - -4. Click **OK** to close the default windows.
        -Your environment is now ready to collect your hardware inventory and review the sample reports. - -### Collect your hardware inventory using the SMS\DEF.MOF file (Configuration Manager 2007 only) -You can collect your hardware inventory using the using the Systems Management Server (SMS\DEF.MOF) file. Editing this file lets you collect your data for Configuration Manager 2007. If you aren’t using this version of Configuration Manager, you won’t want to use this option. - -**To collect your inventory** - -1. Using a text editor like Notepad, open the SMS\DEF.MOF file, located in your `\inboxes\clifiles.src\hinv` directory. - -2. Add this text to the end of the file: - - ``` - [SMS_Report (TRUE), - SMS_Group_Name ("IESystemInfo"), - SMS_Class_ID ("MICROSOFT|IESystemInfo|1.0"), - Namespace ("root\\\\cimv2\\\\IETelemetry") ] - Class IESystemInfo: SMS_Class_Template - { - [SMS_Report (TRUE), Key ] - String SystemKey; - [SMS_Report (TRUE) ] - String IEVer; - }; - - [SMS_Report (TRUE), - SMS_Group_Name ("IEURLInfo"), - SMS_Class_ID ("MICROSOFT|IEURLInfo|1.0"), - Namespace ("root\\\\cimv2\\\\IETelemetry") ] - Class IEURLInfo: SMS_Class_Template - { - [SMS_Report (TRUE), Key ] - String URL; - [SMS_Report (TRUE) ] - String Domain; - [SMS_Report (TRUE) ] - UInt32 DocMode; - [SMS_Report (TRUE) ] - UInt32 DocModeReason; - [SMS_Report (TRUE) ] - UInt32 Zone; - [SMS_Report (TRUE) ] - UInt32 BrowserStateReason; - [SMS_Report (TRUE) ] - String ActiveXGUID[]; - [SMS_Report (TRUE) ] - UInt32 CrashCount; - [SMS_Report (TRUE) ] - UInt32 HangCount; - [SMS_Report (TRUE) ] - UInt32 NavigationFailureCount; - [SMS_Report (TRUE) ] - UInt32 NumberOfVisits; - [SMS_Report (TRUE) ] - UInt32 MostRecentNavigationFailure; - }; - - [SMS_Report (TRUE), - SMS_Group_Name ("IECountInfo"), - SMS_Class_ID ("MICROSOFT|IECountInfo|1.0"), - Namespace ("root\\\\cimv2\\\\IETelemetry") ] - Class IECountInfo: SMS_Class_Template - { - [SMS_Report (TRUE), Key ] - String CountKey; - [SMS_Report (TRUE) ] - UInt32 CrashCount; - [SMS_Report (TRUE) ] - UInt32 HangCount; - [SMS_Report (TRUE) ] - UInt32 NavigationFailureCount; - }; - ``` - -3. Save the file and close it to the same location. - Your environment is now ready to collect your hardware inventory and review the sample reports. - -## View the sample reports with your collected data -The sample reports, **Configuration Manager Report Sample – ActiveX.rdl** and **Configuration Manager Report Sample – Site Discovery.rdl**, work with System Center 2012, so you can review your collected data. - -### Configuration Manager Report Sample – ActiveX.rdl -Gives you a list of all of the ActiveX-related sites visited by the client computer. - -![ActiveX.rdl report, lists all ActiveX-related sites visited by the client computer.](images/configmgractivexreport.png) - -### Configuration Manager Report Sample – Site Discovery.rdl -Gives you a list of all of the sites visited by the client computer. - -![Site Discovery.rdl report, lists all websites visited by the client computer.](images/ie-site-discovery-sample-report.png) - -## View the collected XML data -After the XML files are created, you can use your own solutions to extract and parse the data. The data will look like: - -``` xml - - - [dword] - [dword] - [dword] - - - [string] - - [guid] - - [dword] - [dword] - [dword] - [dword] - [dword] - [dword] - [dword] - [dword] - [string] - [dword] - - - - -``` -You can import this XML data into the correct version of the Enterprise Mode Site List Manager, automatically adding the included sites to your Enterprise Mode site list. - -**To add your XML data to your Enterprise Mode site list** - -1. Open the Enterprise Mode Site List Manager, click **File**, and then click **Bulk add from file**. - - ![Enterprise Mode Site List Manager with Bulk add from file option.](images/bulkadd-emiesitelistmgr.png) - -2. Go to your XML file to add the included sites to the tool, and then click **Open**.
        Each site is validated and if successful, added to the global site list when you click **OK** to close the menu. If a site doesn’t pass validation, you can try to fix the issues or pick the site and click **Add to list** to ignore the validation problem. For more information about fixing validation problems, see [Fix validation problems using the Enterprise Mode Site List Manager](fix-validation-problems-using-the-enterprise-mode-site-list-manager.md). - -3. Click **OK** to close the **Bulk add sites to the list** menu. - -## Turn off data collection on your client devices -After you’ve collected your data, you’ll need to turn Enterprise Site Discovery off. - -**To stop collecting data, using PowerShell** - -- On your client computer, start Windows PowerShell in elevated mode (using admin privileges) and run `IETelemetrySetUp.ps1`, using this command: `powershell -ExecutionPolicy Bypass .\IETelemetrySetUp.ps1 –IEFeatureOff`. - - >**Note**
        Turning off data collection only disables the Enterprise Site Discovery feature – all data already written to WMI stays on your employee’s computer. - - -**To stop collecting data, using Group Policy** - -1. Open your Group Policy editor, go to `Administrative Templates\Windows Components\Internet Explorer\Turn on Site Discovery WMI output`, and click **Off**. - -2. Go to `Administrative Templates\Windows Components\Internet Explorer\Turn on Site Discovery XML output`, and clear the file path location. - -### Delete already stored data from client computers -You can completely remove the data stored on your employee’s computers. - -**To delete all existing data** - -- On the client computer, start PowerShell in elevated mode (using admin privileges) and run these four commands: - - - `Remove-WmiObject -Namespace root/cimv2/IETelemetry IEURLInfo` - - - `Remove-WmiObject -Namespace root/cimv2/IETelemetry IESystemInfo` - - - `Remove-WmiObject -Namespace root/cimv2/IETelemetry IECountInfo` - - - `Remove-Item -Path 'HKCU:\Software\Microsoft\Internet Explorer\WMITelemetry'` - -## Related topics -* [Enterprise Mode Site List Manager (schema v.2) download](https://go.microsoft.com/fwlink/?LinkId=746562) -* [Enterprise Mode for Internet Explorer 11 (IE11)](enterprise-mode-overview-for-ie11.md) diff --git a/browsers/internet-explorer/ie11-deploy-guide/configure-settings-enterprise-mode-portal.md b/browsers/internet-explorer/ie11-deploy-guide/configure-settings-enterprise-mode-portal.md deleted file mode 100644 index db62af6aab..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/configure-settings-enterprise-mode-portal.md +++ /dev/null @@ -1,101 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Details about how the Administrator can use the Settings page to set up Groups and roles, the Enterprise Mode Site List Portal environment, and the freeze dates for production changes. -author: dansimp -ms.prod: ie11 -title: Use the Settings page to finish setting up the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp ---- - -# Use the Settings page to finish setting up the Enterprise Mode Site List Portal - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -The **Settings** page lets anyone with Administrator rights set up groups and roles, set up the Enterprise Mode Site List Portal environment, and choose the freeze dates for production changes. - -## Use the Environment settings area -This area lets you specify the location of your production and pre-production environments, where to store your attachments, your settings location, and the website domain for email notifications. - -**To add location info** -1. Open the Enterprise Mode Site List Portal and click the **Settings** icon in the upper-right area of the page. - - The **Settings** page appears. - -2. In the **Environment settings** area of the page, provide the info for your **Pre-production environment**, your **Production environment**, your **Attachments location**, your **Settings location**, and your **Website domain for email notifications**. - -3. Click **Credentials** to add the appropriate domain, user name, and password for each location, and then click **OK**. - -## Use the Group and role settings area -After you set up your email credentials, you'll be able to add or edit your Group info, along with picking which roles must be Approvers for the group. - -**To add a new group and determine the required change request Approvers** -1. Open the Enterprise Mode Site List Portal and click the **Settings** icon in the upper-right area of the page. - - The **Settings** page appears. - -2. In the **Group and role settings** area of the page, click **Group details**. - - The **Add or edit group names** box appears. - -3. Click the **Add group** tab, and then add the following info: - - - **New group name.** Type name of your new group. - - - **Group head email.** Type the email address for the primary contact for the group. - - - **Group head name.** This box automatically fills, based on the email address. - - - **Active.** Click the check box to make the group active in the system. If you want to keep the group in the system, but you want to prevent access, clear this check box. - -4. Click **Save**. - - -**To set a group's required Approvers** -1. In the **Group and role settings** area of the page, choose the group name you want to update with Approvers from the **Group name** box. - -2. In the **Required approvers** area, choose which roles are required to approve a change request for the group. You can choose one or many roles. - - - **App Manager.** All employees in the selected group must get change request approval by someone assigned this role. - - You can change the name of this role by clicking the pencil icon and providing a new name in the **Edit role name** box. - - - **Group Head.** All employees in the selected group must get change request approval by someone assigned this role. - - You can change the name of this role by clicking the pencil icon and providing a new name in the **Edit role name** box. - - - **Administrator.** All employees in the selected group must get change request approval by someone assigned this role. - -## Use the Freeze production changes area -This optional area lets you specify a period when your employees must stop adding changes to the current Enterprise Mode Site List. This must include both a start and an end date. - -**To add the start and end dates** -1. Open the Enterprise Mode Site List Portal and click the **Settings** icon in the upper-right area of the page. - - The **Settings** page appears. - -2. In the **Freeze production changes** area of the page, use the calendars to provide the **Freeze start date** and the **Freeze end date**. Your employees can't add apps to the production Enterprise Mode Site List during this span of time. - -3. Click **Save**. - -## Related topics -- [Enterprise Mode Site List Portal source code](https://github.com/MicrosoftEdge/enterprise-mode-site-list-portal) - -- [Enterprise Mode and the Enterprise Mode Site List](what-is-enterprise-mode.md) - -- [Use the Enterprise Mode Site List Manager tool or page](use-the-enterprise-mode-site-list-manager.md) diff --git a/browsers/internet-explorer/ie11-deploy-guide/create-change-request-enterprise-mode-portal.md b/browsers/internet-explorer/ie11-deploy-guide/create-change-request-enterprise-mode-portal.md deleted file mode 100644 index cffb48a00d..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/create-change-request-enterprise-mode-portal.md +++ /dev/null @@ -1,78 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Details about how to create a change request within the Enterprise Mode Site List Portal. -author: dansimp -ms.prod: ie11 -title: Create a change request using the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp ---- - -# Create a change request using the Enterprise Mode Site List Portal - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -Employees assigned to the Requester role can create a change request. A change request is used to tell the Approvers and the Administrator that a website needs to be added or removed from the Enterprise Mode Site List. The employee can navigate to each stage of the process by using the workflow links provided at the top of each page of the portal. - -> [!Important] -> Each Requester must have access to a test machine with Administrator rights, letting him or her get to the pre-production environment to make sure that the requested change is correct. - -**To create a new change request** -1. The Requester (an employee that has been assigned the Requester role) signs into the Enterprise Mode Site List Portal, and clicks **Create new request**. - - The **Create new request** page appears. - -2. Fill out the required fields, based on the group and the app, including: - - - **Group name.** Select the name of your group from the dropdown box. - - - **App name.** Type the name of the app you want to add, delete, or update in the Enterprise Mode Site List. - - - **Search all apps.** If you can't remember the name of your app, you can click **Search all apps** and search the list. - - - **Add new app.** If your app isn't listed, you can click **Add new app** to add it to the list. - - - **Requested by.** Automatically filled in with your name. - - - **Description.** Add descriptive info about the app. - - - **Requested change.** Select whether you want to **Add to EMIE**, **Delete from EMIE**, or **Update to EMIE**. - - - **Reason for request.** Select the best reason for why you want to update, delete, or add the app. - - - **Business impact (optional).** An optional area where you can provide info about the business impact of this app and the change. - - - **App location (URL).** The full URL location to the app, starting with https:// or https://. - - - **App best viewed in.** Select the best browser experience for the app. This can be Internet Explorer 5 through Internet Explorer 11 or one of the IE7Enterprise or IE8Enterprise modes. - - - **Is an x-ua tag used?** Select **Yes** or **No** whether an x-ua-compatible tag is used by the app. For more info about x-ua-compatible tags, see the topics in [Defining document compatibility](/previous-versions/windows/internet-explorer/ie-developer/compatibility/cc288325(v=vs.85)). - -4. Click **Save and continue** to save the request and get the app info sent to the pre-production environment site list for testing. - - A message appears that the request was successful, including a **Request ID** number, saying that the change is being made to the pre-production environment site list. - -5. The Requester gets an email with a batch script, that when run, configures their test machine for the pre-production environment, along with the necessary steps to make sure the changed info is correct. - - - **If the change is correct.** The Requester asks the approvers to approve the change request by selecting **Successful** and clicking **Send for approval**. - - - **If the change is incorrect.** The Requester can rollback the change in pre-production or ask for help from the Administrator. - -## Next steps - -After the change request is created, the Requester must make sure the suggested changes work in the pre-production environment. For these steps, see [Verify your changes using the Enterprise Mode Site List Portal](verify-changes-preprod-enterprise-mode-portal.md). \ No newline at end of file diff --git a/browsers/internet-explorer/ie11-deploy-guide/create-install-packages-for-multiple-operating-systems-or-languages.md b/browsers/internet-explorer/ie11-deploy-guide/create-install-packages-for-multiple-operating-systems-or-languages.md deleted file mode 100644 index 395703b43d..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/create-install-packages-for-multiple-operating-systems-or-languages.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: Create packages for multiple operating systems or languages -author: dansimp -ms.prod: ie11 -ms.assetid: 44051f9d-63a7-43bf-a427-d0a0a1c717da -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Create packages for multiple operating systems or languages (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Create packages for multiple operating systems or languages - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -You'll create multiple versions of your custom browser package if: - -- You support more than 1 version of Windows®. - -- You support more than 1 language. - -- You have custom installation packages with only minor differences. Like, having a different phone number. - - **To create a new package** - -1. Create an installation package using the Internet Explorer Customization Wizard 11, as described in the [Internet Explorer Administration Kit 11 (IEAK 11) Customization Wizard options](../ie11-ieak/ieak11-wizard-custom-options.md) topic. - -2. Go to your **CIE/Custom** folder and rename the `Install.ins`file. For example, if you need a version for employees in Texas, rename the file to Texas.ins. - -3. Run the wizard again, using the Custom folder as the destination directory.

        -**Important**
        -Except for the **Title bar** text, **Favorites**, **Links bar**, **Home page**, and **Search bar**, keep all of your wizard settings the same for all of your build computers. - - - - - - - - - diff --git a/browsers/internet-explorer/ie11-deploy-guide/customize-ie11-install-packages.md b/browsers/internet-explorer/ie11-deploy-guide/customize-ie11-install-packages.md deleted file mode 100644 index ddaef22325..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/customize-ie11-install-packages.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: Customize Internet Explorer 11 installation packages -author: dansimp -ms.prod: windows-client -ms.assetid: 10a14a09-673b-4f8b-8d12-64036135e7fd -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Customize Internet Explorer 11 installation packages (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Customize Internet Explorer 11 installation packages - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -You can customize Internet Explorer 11 to support various browser behaviors, multiple operating system versions and languages, and Setup information (.inf) files. - -|Topic |Description | -|------------------------------------------------------------------------|----------------------------------------------------| -|[Using IEAK 11 to create packages](using-ieak11-to-create-install-packages.md) |How to use the Internet Explorer Administration Kit 11 (IEAK 11) and the IE Customization Wizard 11 to set up, configure, deploy, and maintain IE11. | -|[Create packages for multiple operating systems or languages](create-install-packages-for-multiple-operating-systems-or-languages.md) |How to create multiple versions of your custom installation package, to support multiple operating systems or languages. | -|[Using .INF files to create packages](using-inf-files-to-create-install-packages.md) |How to use the Microsoft® Windows Setup Engine to automate setup tasks and customize your component installations. | - - - -In addition, you can configure IE before, during, or after deployment, using these tools: - -- **IE Administration Kit 11 (IEAK 11)**. Creates customized installation packages that can be deployed through your software distribution system. For more information about the IEAK 11, see [Internet Explorer Administration Kit 11 (IEAK 11) - Administration Guide for IT Pros](../ie11-ieak/index.md). - -- **Group Policy**. Configures and enforces IE11 settings. For more information about settings and configuration options, see [Group policy objects and Internet Explorer 11 (IE11)](group-policy-objects-and-ie11.md). - -- **Unattend.xml**. Customizes some of the IE settings during your Windows installation. This option only applies if you're updating a Windows image with IE11.

        **Note**
        -You'll only see the new IE11 Unattend.xml settings if your Unattend.xml file's associated with a Windows image that includes the IE11 update. For more information about editing and using the Unattend.xml file, see [Unattended Windows Setup Reference](/previous-versions/windows/it-pro/windows-8.1-and-8/ff699026(v=win.10)). For more information about using the Windows System Image Manager, see [Windows System Image Manager Technical Reference](/previous-versions/windows/it-pro/windows-8.1-and-8/hh824929(v=win.10)). - -   - -  - -  \ No newline at end of file diff --git a/browsers/internet-explorer/ie11-deploy-guide/delete-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md b/browsers/internet-explorer/ie11-deploy-guide/delete-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md deleted file mode 100644 index 843d917596..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/delete-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md +++ /dev/null @@ -1,53 +0,0 @@ ---- -ms.localizationpriority: medium -description: Delete a single site from your global Enterprise Mode site list. -ms.pagetype: appcompat -ms.mktglfcycl: deploy -author: dansimp -ms.prod: ie11 -ms.assetid: 41413459-b57f-48da-aedb-4cbec1e2981a -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Delete sites from your Enterprise Mode site list in the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Delete sites from your Enterprise Mode site list in the Enterprise Mode Site List Manager - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - - - **To delete a single site from your global Enterprise Mode site list** - -- From the Enterprise Mode Site List Manager, pick the site you want to delete, and then click **Delete**.
        -The site is permanently removed from your list. - -If you delete a site by mistake, you’ll need to manually add it back using the instructions in the following topics, based on operating system. - -- [Add sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.2)](add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md) - -- [Add sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.1)](add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md) - -## Related topics -- [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) -- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) -- [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) -  - -  - - - diff --git a/browsers/internet-explorer/ie11-deploy-guide/deploy-ie11-using-automatic-version-synchronization-avs.md b/browsers/internet-explorer/ie11-deploy-guide/deploy-ie11-using-automatic-version-synchronization-avs.md deleted file mode 100644 index 0f0c56de35..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/deploy-ie11-using-automatic-version-synchronization-avs.md +++ /dev/null @@ -1,39 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: You can deploy Internet Explorer 11 to your users' computers by using your custom browser packages and Automatic Version Synchronization (AVS). -author: dansimp -ms.prod: ie11 -ms.assetid: f51224bd-3371-4551-821d-1d62310e3384 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Deploy Internet Explorer 11 using Automatic Version Synchronization (AVS) (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - -# Deploy Internet Explorer 11 using Automatic Version Synchronization (AVS) - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -You can deploy Internet Explorer 11 to your users' computers by using your custom browser packages and Automatic Version Synchronization (AVS). - -## What is Automatic Version Synchronization? -Automatic Version Synchronization (AVS) lets you use the Internet Explorer Administration Kit 11 (IEAK 11) to synchronize the IE11 setup files on a local computer with the latest setup files on the web. - -You must synchronize the setup files at least once on the local computer, for each language and operating system combination, before proceeding through the rest of the wizard. If your packages have more than one version of IE, you need to keep the versions in separate component download folders, which can be pointed to from the **File Locations** page of the IEAK 11. For more information about using the AVS feature, see [Use the Automatic Version Synchronization page in the IEAK 11 Wizard](../ie11-ieak/auto-version-sync-ieak11-wizard.md) -. - -## Related topics -- [Internet Explorer Administration Kit 11 (IEAK 11) - Administration Guide for IT Pros](../ie11-ieak/index.md) -- [Customize Internet Explorer 11 installation packages](customize-ie11-install-packages.md) - - - - - - - - diff --git a/browsers/internet-explorer/ie11-deploy-guide/deploy-ie11-using-software-distribution-tools.md b/browsers/internet-explorer/ie11-deploy-guide/deploy-ie11-using-software-distribution-tools.md deleted file mode 100644 index 7eaac18e22..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/deploy-ie11-using-software-distribution-tools.md +++ /dev/null @@ -1,34 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: Deploy Internet Explorer 11 using software distribution tools -author: dansimp -ms.prod: ie11 -ms.assetid: fd027775-651a-41e1-8ec3-d32eca876d8a -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Deploy Internet Explorer 11 using software distribution tools (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Deploy Internet Explorer 11 using software distribution tools - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -If you already manage software distribution and updates on your network through software distribution tools, you can also use these tools for ongoing deployments of Internet Explorer. Software distribution tools include: - -- **Configuration Manager** Deploy and install Internet Explorer 11 on your user's computers through a software distribution package. For more information about using this tool, see [Configuration Manager](/previous-versions/system-center/system-center-2012-R2/gg682129(v=technet.10)). - -- **Windows Server Update Services (WSUS).** Download a single copy of the IE11 updates, caching them to local servers so your users' computers can receive the updates directly from the WSUS servers, instead of through Windows Update. For more information about using this tool, see [Windows Server Update Services](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh852345(v=ws.11)). - -- **Group Policy Software Installation.** Deploy and install IE11 on your user's computers through a combination of Group Policy and Microsoft Active Directory. For more information about using this tool, see [Group Policy Software Installation overview](/previous-versions/windows/it-pro/windows-server-2003/cc738858(v=ws.10)). - -- **Microsoft Deployment Toolkit (MDT).** Add the IE11 update to your deployment share, using MDT to update your previously-deployed Windows image. For more information about using this tool, see [Microsoft Deployment Toolkit (MDT)](/mem/configmgr/mdt/). - -  - -  \ No newline at end of file diff --git a/browsers/internet-explorer/ie11-deploy-guide/deploy-pinned-sites-using-mdt-2013.md b/browsers/internet-explorer/ie11-deploy-guide/deploy-pinned-sites-using-mdt-2013.md deleted file mode 100644 index 513e6e6b22..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/deploy-pinned-sites-using-mdt-2013.md +++ /dev/null @@ -1,122 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: You can pin websites to the Windows 8.1 taskbar for quick access using the Microsoft Deployment Toolkit (MDT) 2013. -author: dansimp -ms.prod: windows-client -ms.assetid: 24f4dcac-9032-4fe8-bf6d-2d712d61cb0c -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Deploy pinned websites using Microsoft Deployment Toolkit (MDT) 2013 (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Deploy pinned websites using Microsoft Deployment Toolkit (MDT) 2013 - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -You can pin websites to the Windows 8.1 taskbar for quick access. You pin a website simply by dragging its tab to the taskbar. Some websites can also extend the icon’s Jump List. - -The ability to pin websites to the Windows 8.1 taskbar can help make end users in businesses more productive. As an IT professional, for example, you can pin intranet and SharePoint websites to the taskbar to make them immediately available to users. In this article, you learn how to deploy pinned websites by using Lite Touch Installation in the [Microsoft Deployment Toolkit (MDT) 2013](/mem/configmgr/mdt/). - -## Deploying pinned websites in MDT 2013 -This topic requires that you have a complete MDT 2013 deployment share that contains Windows 8.1 which comes with Internet Explorer 11. If you’re deploying to Windows 7 clients and need to learn how to add IE11 to an MDT 2013 deployment share as an update, see [Installing Internet Explorer 11 using Microsoft Deployment Toolkit (MDT)](./install-ie11-using-operating-system-deployment-systems.md) in the TechNet library. - -Deploying pinned websites in MDT 2013 is a 4-step process: - -1. Create a .website file for each website that you want to deploy. When you pin a website to the taskbar, Windows 8.1 creates a .website file that describes how the icon should look and feel. - -2. Copy the .website files to your deployment share. - -3. Copy the .website files to your target computers. - -4. Edit the task sequence of your Unattend.xml answer files to pin the websites to the taskbar. In particular, you want to add each .website file to the **TaskbarLinks** item in Unattend.xml during oobeSystem phase. You can add up to six .website files to the **TaskbarLinks** item. - -Pinned websites are immediately available to every user who logs on to the computer although the user must click each icon to populate its Jump List. - -**Important**
        -To follow the examples in this topic, you’ll need to pin the Bing (https://www.bing.com/) and MSN (https://www.msn.com/) websites to the taskbar. - -### Step 1: Creating .website files -The first step is to create a .website file for each website that you want to pin to the Windows 8.1 taskbar during deployment. A .website file is like a shortcut, except it’s a plain text file that describes not only the website’s URL but also how the icon looks. - - **To create each .website file** - -1. Open the website in IE11. - -2. Drag the website’s tab and drop it on the Windows 8.1 taskbar. - -3. Go to `%USERPROFILE%\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar` in Windows Explorer, and copy the bing.website and msn.website files to your desktop. - -### Step 2: Copying the .website files to the deployment share -Next, you must enable your deployment share to copy the bing.website and msn.website files to the **Start** menu on each target computer. - - **To copy .website files to the deployment share** - -1. Open your MDT 2013 deployment share in Windows Explorer. - -2. In the `$OEM$` folder, create the path `$1\Users\Public\Public Links`. If the `$OEM$` folder doesn’t exist, create it at the root of your deployment share. - -3. Copy the bing.website and msn.website files from your desktop to `$OEM$\$1\Users\Public\Public Links` in your deployment share. - -### Step 3: Copying .website files to target computers -After your operating system is installed on the target computer, you need to copy the .website files over so they can be pinned to the taskbar. - - **To copy .website files to target computers** - -1. In the **Deployment Workbench** of MDT 2013, open the deployment share containing the task sequence during which you want to deploy pinned websites, and then click **Task Sequences**. - -2. In the right pane of the **Deployment Workbench**, right-click your task sequence (create a new one if you don’t have one yet), and click **Properties**. - -3. In the **Task Sequence** tab, click the **Postinstall** folder, click **General** from the **Add** button, and then click **Run Command Line**. - -4. Rename the newly created item to *Copy Files* and move it up to the top of the **Postinstall** folder. - -5. In the **Command Line** box enter the following text, `xcopy "%DEPLOYROOT%\$OEM$\$1" "%OSDisk%\" /yqe`. - -6. Click the **Apply** button to save your changes. - -### Step 4: Pinning .website files to the Taskbar -With the .website files ready to copy to the **Public Links** folder on target computers for all users, the last step is to edit the Unattend.xml answer files to pin those .website files to the taskbar. You will need to complete the following steps for each task sequence during which you want to pin these websites to the taskbar. - - **To pin .website files to the Taskbar** - -1. Open the Windows System Image Manager (Windows SIM). - -2. On the **OS Info** tab, click **Edit Unattend.xml** to open the Unattend.xml file. - -2. In the **Windows Image** pane, under **Components** and then **Microsoft-Windows-Shell-Setup**, right-click **TaskbarLinks**, and then click **Add Setting to Pass 7 oobeSystem**. - -3. In the **TaskbarLinks Properties** pane, add the relative path to the target computer’s (not the deployment share’s) .website files that you created earlier. You can add up to six links to the **TaskbarLinks** item. For example, `%PUBLIC%\Users\Public\Public Links\Bing.website` and `%PUBLIC%\Users\Public\Public Links\MSN.website` - -4. On the **File** menu, click **Save Answer File**, and then close Windows SIM. - -5. To close the task sequence, click **OK**. - -## Updating intranet websites for pinning -The MDT 2013 deployment share and task sequences are now ready to pin websites to the taskbar during deployment. This pinning feature can include intranet sites important in your organization. - -You can make your intranet websites act more like applications by extending them to fully support the Windows 8.1 taskbar. This includes creating custom Jump Lists, thumbnail previews, and notifications. For info about extending your intranet websites, see [Pinned Sites Developer Documentation](/previous-versions/windows/internet-explorer/ie-developer/samples/gg491731(v=vs.85)) on MSDN. For more ideas about what to pin, see [Add-ons](https://go.microsoft.com/fwlink/p/?LinkId=398483) in the Internet Explorer Gallery. - -## Related topics -- [Unattended Windows Setup Reference](/previous-versions/windows/it-pro/windows-8.1-and-8/ff699026(v=win.10)) -- [Windows System Image Manager Technical Reference](/previous-versions/windows/it-pro/windows-8.1-and-8/hh824929(v=win.10)) -- [Microsoft Deployment Toolkit (MDT)](/mem/configmgr/mdt/) -- [Windows ADK Overview](/previous-versions/windows/it-pro/windows-8.1-and-8/hh825486(v=win.10)) - -  - -  \ No newline at end of file diff --git a/browsers/internet-explorer/ie11-deploy-guide/deprecated-document-modes.md b/browsers/internet-explorer/ie11-deploy-guide/deprecated-document-modes.md deleted file mode 100644 index 5cfa201d18..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/deprecated-document-modes.md +++ /dev/null @@ -1,65 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Windows Internet Explorer 8 introduced document modes as a way to move from the proprietary coding of web features to a more standardized type of coding that could run on multiple browsers and devices. -author: dansimp -ms.prod: ie11 -ms.assetid: 00cb1f39-2b20-4d37-9436-62dc03a6320b -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Deprecated document modes and Internet Explorer 11 (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - -# Deprecated document modes and Internet Explorer 11 - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -Windows Internet Explorer 8 introduced document modes as a way to move from the proprietary coding of web features to a more standardized type of coding that could run on multiple browsers and devices. Starting with Windows 10, we’re deprecating document modes. - -This means that while Internet Explorer 11 will continue to support document modes, Microsoft Edge won’t. And because of that, it also means that if you want to use Microsoft Edge, you’re going to have to update your legacy webpages and apps to support modern features, browsers, and devices. - ->**Note**
        ->For specific details about the technologies and APIs that are no longer supported in Microsoft Edge, see [A break from the past, part 2: Saying goodbye to ActiveX, VBScript, attachEvent](https://go.microsoft.com/fwlink/p/?LinkId=615953). - -## What is document mode? -Each release after Internet Explorer 8 has helped with the transition by introducing additional document modes that emulated previously supported versions, while also introducing support for features defined by industry standards. During this time, numerous websites and apps were updated to the latest and greatest industry standards, while many other sites and apps continued to simply rely on document modes to work properly. - -Because our goal with Microsoft Edge is to give users the best site and app viewing experience possible, we’ve decided to stop support for document modes. All websites and apps using legacy features and code will need to be updated to rely on the new modern standards and practices. - -If you have legacy sites and apps that can’t be updated to modern standards, you can continue to use IE11 and document modes. We recommend that you use the **IE11 Standards document mode** because it represents the highest support available for modern standards. You should also use the HTML5 document type declaration to turn on the latest supported standards while using IE11:``. - -## Document modes and IE11 -The compatibility improvements made in IE11 lets older websites just work in the latest standards mode, by default, without requiring emulation of the previous browser behavior. Because older websites are now just working, we’ve decided that Internet Explorer 10 document mode will be the last new document mode. Instead, developers will need to move to using the IE11 document mode going forward. - -## Document mode selection flowchart -This flowchart shows how IE11 works when document modes are used. - -![Flowchart detailing how document modes are chosen in IE11.](images/docmode-decisions-sm.png)
        -[Click this link to enlarge image](img-ie11-docmode-lg.md) - -## Known Issues with Internet Explorer 8 document mode in Enterprise Mode -The default document mode for Enterprise Mode is Internet Explorer 8. While this mode provides a strong emulation of that browser, it isn’t an exact match. For example, Windows Internet Explorer 9 fundamentally changed how document modes work with iframes and document modes can’t undo architectural changes. It’s also a known issue that Windows 10 supports GDI font rendering while using Enterprise Mode, but uses natural metrics once outside of Enterprise Mode. - -## Related topics -- [Enterprise Mode for Internet Explorer 11](enterprise-mode-overview-for-ie11.md) - -  - -  - - - diff --git a/browsers/internet-explorer/ie11-deploy-guide/edit-the-enterprise-mode-site-list-using-the-enterprise-mode-site-list-manager.md b/browsers/internet-explorer/ie11-deploy-guide/edit-the-enterprise-mode-site-list-using-the-enterprise-mode-site-list-manager.md deleted file mode 100644 index 29574ab860..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/edit-the-enterprise-mode-site-list-using-the-enterprise-mode-site-list-manager.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: You can use Internet Explorer 11 and the Enterprise Mode Site List Manager to change whether page rendering should use Enterprise Mode or the default Internet Explorer browser configuration. You can also add, remove, or delete associated comments. -author: dansimp -ms.prod: ie11 -ms.assetid: 76aa9a85-6190-4c3a-bc25-0f914de228ea -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Edit the Enterprise Mode site list using the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Edit the Enterprise Mode site list using the Enterprise Mode Site List Manager - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -You can use Internet Explorer 11 and the Enterprise Mode Site List Manager to change whether page rendering should use Enterprise Mode or the default Internet Explorer browser configuration. You can also add, remove, or delete associated comments. - -If you need to edit a lot of websites, you probably don’t want to do it one at a time. Instead, you can edit your saved XML or TXT file and add the sites back again. For information about how to do this, depending on your operating system and schema version, see [Add multiple sites to the Enterprise Mode site list using a file and Enterprise Mode Site List Manager (schema v.2)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md) or [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md). - - **To change how your page renders** - -1. In the Enterprise Mode Site List Manager, double-click the site you want to change. - -2. Change the comment or the compatibility mode option. - -3. Click **Save** to validate your changes and to add the updated information to your site list.
        -If your change passes validation, it’s added to the global site list. If the update doesn’t pass validation, you’ll get an error message explaining the problem. You’ll then be able to either cancel the update or ignore the validation problem and add it to your list anyway. For more information about fixing validation issues, see [Fix validation problems using the Enterprise Mode Site List Manager](fix-validation-problems-using-the-enterprise-mode-site-list-manager.md). - -4. On the **File** menu, click **Save to XML**, and save the updated file.
        -You can save the file locally or to a network share. However, you must make sure you deploy it to the location specified in your registry key. For more information about the registry key, see [Turn on Enterprise Mode and use a site list](turn-on-enterprise-mode-and-use-a-site-list.md). - -## Related topics -- [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) -- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) -- [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) -  - -  - - - diff --git a/browsers/internet-explorer/ie11-deploy-guide/enable-and-disable-add-ons-using-administrative-templates-and-group-policy.md b/browsers/internet-explorer/ie11-deploy-guide/enable-and-disable-add-ons-using-administrative-templates-and-group-policy.md deleted file mode 100644 index e21f3e41ed..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/enable-and-disable-add-ons-using-administrative-templates-and-group-policy.md +++ /dev/null @@ -1,114 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: security -description: Enable and disable add-ons using administrative templates and group policy -ms.author: dansimp -author: dansimp -ms.prod: ie11 -ms.assetid: c6fe1cd3-0bfc-4d23-8016-c9601f674c0b -ms.reviewer: -audience: itpro -manager: dansimp -title: Enable and disable add-ons using administrative templates and group policy (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 4/12/2018 ---- - - -# Enable and disable add-ons using administrative templates and group policy - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -Add-ons let your employees personalize Internet Explorer. You can manage IE add-ons using Group Policy and Group Policy templates. - -There are four types of add-ons: - -- **Search Providers.** Type a term and see suggestions provided by your search provider. - -- **Accelerators.** Highlight text on a web page and then click the blue **Accelerator** icon to email, map, search, translate, or do many other tasks. - -- **Web Slices.** Subscribe to parts of a website to get real-time information on the Favorites bar. - -- **Toolbars.** Add features (like stock tickers) to your browser. - -## Using the Local Group Policy Editor to manage group policy objects -You can use the Local Group Policy Editor to change how add-ons work in your organization. - - **To manage add-ons** - -1. In the Local Group Policy Editor, go to `Computer Configuration\Administrative Templates\Windows Components\Internet Explorer`. - -2. Change any or all of these settings to match your company’s policy and requirements. - - - Turn off add-on performance notifications - - - Automatically activate newly installed add-ons - - - Do not allow users to enable or disable add-ons - -3. Go into the **Internet Control Panel\\Advance Page** folder, where you can change: - - - Do not allow resetting IE settings - - - Allow third-party browser extensions - -4. Go into the **Security Features\\Add-on Management** folder, where you can change: - - - Add-on List - - - Deny all add-ons unless specifically allowed in the Add-on List - - - Turn off Adobe Flash in IE and prevent applications from using IE technology to instantiate Flash objects - -5. Close the Local Group Policy Editor when you’re done. - -## Using the CLSID and Administrative Templates to manage group policy objects -Every add-on has a Class ID (CLSID) that you use to enable and disable specific add-ons, using Group Policy and Administrative Templates. - - **To manage add-ons** - -1. Get the CLSID for the add-on you want to enable or disable: - - 1. Open IE, click **Tools**, and then click **Manage Add-ons**. - - 2. Double-click the add-on you want to change. - - 3. In the More Information dialog, click **Copy** and then click **Close**. - - 4. Open Notepad and paste the information for the add-on. - - 5. On the Manage Add-ons windows, click **Close**. - - 6. On the Internet Options dialog, click **Close** and then close IE. - -2. From the copied information, select and copy just the **Class ID** value. - - > [!NOTE] - > You want to copy the curly brackets as well as the CLSID: **{47833539-D0C5-4125-9FA8-0819E2EAAC93}**. - -3. Open the Group Policy Management Editor and go to: Computer Configuration\Policies\Administrative Templates\Windows Components\Internet Explorer\Security Features\Add-on Management. -
        **-OR-**
        -Open the Local Group Policy Editor and go to: User Configuration\Administrative Templates\Windows Components\Internet Explorer\Security Features\Add-on Management. - -4. Open the **Add-on List** Group Policy Object, select **Enabled**, and then click **Show**.
        The Show Contents dialog appears. - -6. In **Value Name**, paste the Class ID for your add-on, for example, **{47833539-D0C5-4125-9FA8-0819E2EAAC93}**. - -6. In **Value**, enter one of the following: - - - **0**. The add-on is disabled and your employees can’t change it. - - - **1**. The add-on is enabled and your employees can’t change it. - - - **2**. The add-on is enabled and your employees can change it. - -7. Close the Show Contents dialog. - -7. In the Group Policy editor, go to: Computer Configuration\Administrative Templates\Windows Components\Internet Explorer. - -8. Double-click **Automatically activate/enable newly installed add-ons** and select **Enabled**.

        Enabling turns off the message prompting you to Enable or Don't enable the add-on. - -7. Click **OK** twice to close the Group Policy editor. - - diff --git a/browsers/internet-explorer/ie11-deploy-guide/enhanced-protected-mode-problems-with-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/enhanced-protected-mode-problems-with-ie11.md deleted file mode 100644 index e284e24e3f..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/enhanced-protected-mode-problems-with-ie11.md +++ /dev/null @@ -1,31 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: security -description: Enhanced Protected Mode problems with Internet Explorer -author: dansimp -ms.prod: windows-client -ms.assetid: 15890ad1-733d-4f7e-a318-10399b389f45 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Enhanced Protected Mode problems with Internet Explorer (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Enhanced Protected Mode problems with Internet Explorer - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -Enhanced Protected Mode further restricts Protected Mode to deny potential attackers access to sensitive or personal information. If this feature is turned on, users might start to see errors asking them to turn it off, like **This webpage wants to run "npctrl.dll. If you trust this site, you can disable Enhanced Protected Mode for this site to run the control**. If your users click the **Disable** box, Enhanced Protected Mode is turned off for only the single visit to that specific site. After the user leaves the site, Enhanced Protected Mode is automatically turned back on. - -You can use your company’s Group Policy to turn Enhanced Protected Mode on or off for all users. For more information, see the [Group policy objects and Internet Explorer 11 (IE11)](group-policy-objects-and-ie11.md) information in this guide. - -For more information about Enhanced Protected Mode, see the [Enhanced Protected Mode](https://go.microsoft.com/fwlink/p/?LinkId=267512) post on IEBlog, and both the [Understanding Enhanced Protected Mode](/archive/blogs/ieinternals/understanding-enhanced-protected-mode) and the [Enhanced Protected Mode and Local Files](https://go.microsoft.com/fwlink/p/?LinkId=282663) blog posts on IEInternals. - -  - -  \ No newline at end of file diff --git a/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-overview-for-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-overview-for-ie11.md deleted file mode 100644 index e5e3c31095..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-overview-for-ie11.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Use the topics in this section to learn how to set up and use Enterprise Mode, Enterprise Mode Site List Manager, and the Enterprise Mode Site List Portal for your company. -author: dansimp -ms.prod: ie11 -ms.assetid: d52ba8ba-b3c7-4314-ba14-0610e1d8456e -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Enterprise Mode for Internet Explorer 11 (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Enterprise Mode for Internet Explorer 11 - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -Use the topics in this section to learn how to set up and use Enterprise Mode and the Enterprise Mode Site List Manager in your company. - -## In this section - -|Topic |Description | -|---------------------------------------------------------------|-----------------------------------------------------------------------------------| -|[Enterprise Mode and the Enterprise Mode Site List](what-is-enterprise-mode.md)|Includes descriptions of the features of Enterprise Mode. | -|[Set up Enterprise Mode logging and data collection](set-up-enterprise-mode-logging-and-data-collection.md) |Guidance about how to turn on local control of Enterprise Mode and how to use ASP or the GitHub sample to collect data from your local computers. | -|[Turn on Enterprise Mode and use a site list](turn-on-enterprise-mode-and-use-a-site-list.md) |Guidance about how to turn on Enterprise Mode and set up a site list, using Group Policy or the registry. | -|[Enterprise Mode schema v.2 guidance](enterprise-mode-schema-version-2-guidance.md) |Guidance about how to write the XML for your site list, including what not to include, how to use trailing slashes, and info about how to target specific sites. | -|[Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md) |Guidance about how to write the XML for your site list, including what not to include, how to use trailing slashes, and info about how to target specific sites. | -|[Check for a new Enterprise Mode site list xml file](check-for-new-enterprise-mode-site-list-xml-file.md) |Guidance about how the Enterprise Mode functionality looks for your updated site list. | -|[Turn on local control and logging for Enterprise Mode](turn-on-local-control-and-logging-for-enterprise-mode.md) |Guidance about how to turn on local control of Enterprise Mode, using Group Policy or the registry.| -|[Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) |Guidance about how to use the Enterprise Mode Site List Manager, including how to add and update sites on your site list. | -|[Use the Enterprise Mode Site List Portal](use-the-enterprise-mode-portal.md) |Guidance about how to set up and use the Enterprise Mode Site List Manager, including how to add and update sites on your site list. | -|[Using Enterprise Mode](using-enterprise-mode.md) |Guidance about how to turn on either IE7 Enterprise Mode or IE8 Enterprise Mode. | -|[Fix web compatibility issues using document modes and the Enterprise Mode Site List](fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md) |Guidance about how to decide and test whether to use document modes or Enterprise Mode to help fix compatibility issues. | -|[Remove sites from a local Enterprise Mode site list](remove-sites-from-a-local-enterprise-mode-site-list.md) |Guidance about how to remove websites from a device's local Enterprise Mode site list. | -|[Remove sites from a local compatibility view list](remove-sites-from-a-local-compatibililty-view-list.md) |Guidance about how to remove websites from a device's local compatibility view list. | -|[Turn off Enterprise Mode](turn-off-enterprise-mode.md) |Guidance about how to stop using your site list and how to turn off local control, using Group Policy or the registry. | - - - - - - - - diff --git a/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-1-guidance.md b/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-1-guidance.md deleted file mode 100644 index e486ed248d..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-1-guidance.md +++ /dev/null @@ -1,133 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Use the Enterprise Mode Site List Manager to create and update your Enterprise Mode site list for devices running Windows 7 or Windows 8.1 Update. -author: dansimp -ms.prod: ie11 -ms.assetid: 17c61547-82e3-48f2-908d-137a71938823 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Enterprise Mode schema v.1 guidance (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Enterprise Mode schema v.1 guidance - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 - -Use the Enterprise Mode Site List Manager (schema v.1) to create and update your Enterprise Mode site list for devices running the v.1 version of the schema, or the Enterprise Mode Site List Manager (schema v.2) to create and update your Enterprise Mode site list for devices running the v.2 version of the schema. We strongly recommend moving to the new schema, v.2. For more info, see [Enterprise Mode schema v.2 guidance](enterprise-mode-schema-version-2-guidance.md). - -If you don't want to use the Enterprise Mode Site List Manager, you also have the option to update your XML schema using Notepad, or any other XML-editing app. - -## Enterprise Mode schema v.1 example -The following is an example of the Enterprise Mode schema v.1. This schema can run on devices running Windows 7 and Windows 8.1. - -> [!IMPORTANT] -> Make sure that you don't specify a protocol when adding your URLs. Using a URL like `contoso.com` automatically applies to both `http://contoso.com` and `https://contoso.com`. - -```xml - - - www.cpandl.com - www.woodgrovebank.com - adatum.com - contoso.com - relecloud.com - /about - - fabrikam.com - /products - - - - contoso.com - /travel - - fabrikam.com - /products - - - -``` - -### Schema elements -This table includes the elements used by the Enterprise Mode schema. - -|Element |Description |Supported browser | -|---------|---------|---------| -|<rules> | Root node for the schema.
        **Example**

        <rules version="205"> 
        <emie>
        <domain>contoso.com</domain>
        </emie>
        </rules> |Internet Explorer 11 and Microsoft Edge | -|<emie> |The parent node for the Enterprise Mode section of the schema. All <domain> entries will have either IE8 Enterprise Mode or IE7 Enterprise Mode applied.
        **Example**
        <rules version="205"> 
        <emie>
        <domain>contoso.com</domain>
        </emie>
        </rules>

        **or**
        For IPv6 ranges:


        <rules version="205">
        <emie>
        <domain>[10.122.34.99]:8080</domain>
        </emie>
        </rules>


        **or**
        For IPv4 ranges:

        <rules version="205"> 
        <emie>
        <domain>[10.122.34.99]:8080</domain>
        </emie>
        </rules> | Internet Explorer 11 and Microsoft Edge | -|<docMode> |The parent node for the document mode section of the section. All <domain> entries will get IE5 - IE11 document modes applied. If there's a <domain> element in the docMode section that uses the same value as a <domain> element in the emie section, the emie element is applied.
        **Example**
         
        <rules version="205">
        <docmode>
        <domain docMode="7">contoso.com</domain>
        </docmode>
        </rules> |Internet Explorer 11 | -|<domain> |A unique entry added for each site you want to put on the Enterprise Mode site list. The first <domain> element will overrule any additional <domain> elements that use the same value for the section. You can use port numbers for this element.
        **Example**
         
        <emie>
        <domain>contoso.com:8080</domain>
        </emie> |Internet Explorer 11 and Microsoft Edge | -|<path> |A unique entry added for each path under a domain you want to put on the Enterprise Mode site list. The <path> element is a child of the <domain> element. Additionally, the first <path> element will overrule any additional <path> elements in the schema section.
        **Example**
         
        <emie>
        <domain exclude="true">fabrikam.com
        <path exclude="false">/products</path>
        </domain>
        </emie>


        Where `https://fabrikam.com` doesn't use IE8 Enterprise Mode, but `https://fabrikam.com/products` does. |Internet Explorer 11 and Microsoft Edge | - -### Schema attributes -This table includes the attributes used by the Enterprise Mode schema. - -|Attribute|Description|Supported browser| -|--- |--- |--- | -|version|Specifies the version of the Enterprise Mode Site List. This attribute is supported for the <rules> element.|Internet Explorer 11 and Microsoft Edge| -|exclude|Specifies the domain or path that is excluded from getting the behavior applied. This attribute is supported on the <domain> and <path> elements.
        **Example**

        <emie>
        <domain exclude="false">fabrikam.com
        <path exclude="true">/products</path>
        </domain>
        </emie>

        Where `https://fabrikam.com` doesn't use IE8 Enterprise Mode, but `https://fabrikam.com/products` does.|Internet Explorer 11 and Microsoft Edge| -|docMode|Specifies the document mode to apply. This attribute is only supported on <domain> or <path>elements in the <docMode> section.
        **Example**

        <docMode> 
        <domain exclude="false">fabrikam.com
        <path docMode="9">/products</path>
        </domain>
        </docMode>|Internet Explorer 11| -|doNotTransition| Specifies that the page should load in the current browser, otherwise it will open in IE11. This attribute is supported on all <domain> or <path> elements. If this attribute is absent, it defaults to false.
        **Example**
        <emie>
        <domain doNotTransition="false">fabrikam.com
        <path doNotTransition="true">/products</path>
        </domain>
        </emie>

        Where `https://fabrikam.com` opens in the IE11 browser, but `https://fabrikam.com/products` loads in the current browser (eg. Microsoft Edge)|Internet Explorer 11 and Microsoft Edge| -|forceCompatView|Specifies that the page should load in IE7 document mode (Compat View). This attribute is only supported on <domain> or <path> elements in the <emie> section. If the page is also configured to load in Enterprise Mode, it will load in IE7 Enterprise Mode. Otherwise (exclude="true"), it will load in IE11's IE7 document mode. If this attribute is absent, it defaults to false.
        **Example**

        <emie>
        <domain exclude="true">fabrikam.com
        <path forcecompatview="true">/products</path>
        </domain>
        </emie>

        Where `https://fabrikam.com` does not use Enterprise Mode, but `https://fabrikam.com/products` uses IE7 Enterprise Mode.|Internet Explorer 11| - -### Using Enterprise Mode and document mode together -If you want to use both Enterprise Mode and document mode together, you need to be aware that <emie> entries override <docMode> entries for the same domain. - -For example, say you want all of the sites in the contoso.com domain to open using IE8 Enterprise Mode, except test.contoso.com, which needs to open in document mode 11. Because Enterprise Mode takes precedence over document mode, if you want test.contoso.com to open using document mode, you'll need to explicitly add it as an exclusion to the <emie> parent node. - -```xml - - - contoso.com - test.contoso.com - - - test.contoso.com - - -``` - -### What not to include in your schema -We recommend that you not add any of the following items to your schema because they can make your compatibility list behave in unexpected ways: -- Don’t use protocols. For example, `http://`, `https://`, or custom protocols. They break parsing. -- Don’t use wildcards. -- Don’t use query strings, ampersands break parsing. - -## How to use trailing slashes -You can use trailing slashes at the path-level, but not at the domain-level: -- **Domain-level.** Don’t add trailing slashes to a domain, it breaks parsing. -- **Path-level.** Adding a trailing slash to a path means that the path ends at that point. By not adding a trailing slash, the rule applies to all of the sub-paths. - -**Example** - -```xml -contoso.com - /about/ - -``` -In this example, `contoso.com/about/careers` will use the default version of Internet Explorer, even though `contoso.com/about/` uses Enterprise Mode. - - -## How to target specific sites -If you want to target specific sites in your organization. - -|Targeted site |Example |Explanation | -|--------------|--------|------------| -|You can specify subdomains in the domain tag. |<docMode>
        <domain docMode="5">contoso.com</domain>
        <domain docMode="9">info.contoso.com</domain>
        <docMode>
        |

        • contoso.com uses document mode 5.
        • info.contoso.com uses document mode 9.
        • test.contoso.com also uses document mode 5.
        | -|You can specify exact URLs by listing the full path. |<emie>
        <domain exclude="false">bing.com</domain>
        <domain exclude="false" forceCompatView="true">contoso.com</domain>
        <emie>
        |
        • bing.com uses IE8 Enterprise Mode.
        • contoso.com uses IE7 Enterprise Mode.
        | -|You can nest paths underneath domains. |<emie>
        <domain exclude="true">contoso.com
        <path exclude="false">/about</path>
        <path exclude="true">
        /about/business</path>
        </domain>
        </emie>
        |
        • contoso.com will use the default version of IE.
        • contoso.com/about and everything underneath that node will load in Enterprise Mode, except contoso.com/about/business, which will load in the default version of IE.
        | -|You can’t add a path underneath a path. The file will still be parsed, but the sub-path will be ignored. |<emie>
        <domain exclude="true">contoso.com
        <path>/about
        <path exclude="true">/business</path>
        </path>
        </domain>
        </emie>
        |
        • contoso.com will use the default version of IE.
        • contoso.com/about and everything underneath that node will load in Enterprise Mode, including contoso.com/about/business because the last rule is ignored.
        | diff --git a/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-2-guidance.md b/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-2-guidance.md deleted file mode 100644 index 5af6fab521..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-2-guidance.md +++ /dev/null @@ -1,139 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Use the Enterprise Mode Site List Manager to create and update your Enterprise Mode site list for devices running Windows 10. -author: dansimp -ms.prod: ie11 -ms.assetid: 909ca359-5654-4df9-b9fb-921232fc05f5 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Enterprise Mode schema v.2 guidance (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 12/04/2017 ---- - - -# Enterprise Mode schema v.2 guidance - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 - -Use the Enterprise Mode Site List Manager to create and update your site list for devices running Windows 7, Windows 8.1, and Windows 10, using the version 2.0 (v.2) of the Enterprise Mode schema. If you don't want to use the Enterprise Mode Site List Manager, you also have the option to update your XML schema using Notepad, or any other XML-editing app. - -> [!IMPORTANT] -> If you're running Windows 7 or Windows 8.1 and you've been using the version 1.0 (v.1) of the schema, you can continue to do so, but you won't get the benefits that come with the updated schema. For info about the v.1 schema, see [Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md). - -## Enterprise Mode schema v.2 updates -Because of the schema changes, you can't combine the old version (v.1) with the new version (v.2) of the schema. If you look at your XML file, you can tell which version you're using by: - -- <rules>. If your schema root node includes this key, you're using the v.1 version of the schema. - -- <site-list>. If your schema root node includes this key, you're using the v.2 version of the schema. - -You can continue to use the v.1 version of the schema on Windows 10, but you won't have the benefits of the new v.2 version schema updates and new features. Additionally, saving the v.1 version of the schema in the new Enterprise Mode Site List Manager (schema v.2) automatically updates the file to use the v.2 version of the schema. - -### Enterprise Mode v.2 schema example -The following is an example of the v.2 version of the Enterprise Mode schema. - -> [!IMPORTANT] -> Make sure that you don't specify a protocol when adding your URLs. Using a URL like ``, automatically applies to both `http://contoso.com` and `https://contoso.com`. - -```xml - - - - EnterpriseSitelistManager - 10240 - 20150728.135021 - - - - IE8Enterprise - MSEdge - - - Default - IE11 - - - IE7Enterprise - IE11 - - - Default - IE11 - - - Default - None - - IE8Enterprise" - None - - - IE7 - IE11 - - - IE8Enterprise - IE11 - - - IE7 - IE11 - - -``` - -### Updated schema elements -This table includes the elements used by the v.2 version of the Enterprise Mode schema. - -|Element |Description |Supported browser | -|---------|---------|---------| -|<site-list> |A new root node with this text is using the updated v.2 version of the schema. It replaces <rules>.
        **Example**
        <site-list version="205">
        <site url="contoso.com">
        <compat-mode>IE8Enterprise</compat-mode>
        <open-in>IE11</open-in>
        </site>
        </site-list>
        | Internet Explorer 11 and Microsoft Edge | -|<site> |A unique entry added for each site you want to put on the Enterprise Mode site list. The first <site> element will overrule any additional <site> elements that use the same value for the <url> element.
        **Example**
        <site url="contoso.com">
        <compat-mode>default</compat-mode>
        <open-in>none</open-in>
        </site>

        **or** For IPv4 ranges:
        <site url="10.122.34.99:8080">
        <compat-mode>IE8Enterprise</compat-mode>
        <site>


        **or** For IPv6 ranges:

        <site url="[10.122.34.99]:8080">
        <compat-mode>IE8Enterprise</compat-mode>
        <site>


        You can also use the self-closing version, <url="contoso.com" />, which also sets:

        • <compat-mode>default</compat-mode>
        • <open-in>none</open-in>
        • | Internet Explorer 11 and Microsoft Edge | -|<compat-mode> |A child element that controls what compatibility setting is used for specific sites or domains. This element is only supported in IE11.
          **Example**

          <site url="contoso.com">
          <compat-mode>IE8Enterprise</compat-mode>
          </site>
          **or**
          For IPv4 ranges:
          <site url="10.122.34.99:8080">
          <compat-mode>IE8Enterprise</compat-mode>
          <site>

          **or** For IPv6 ranges:

          <site url="[10.122.34.99]:8080">
          <compat-mode>IE8Enterprise</compat-mode>
          <site>

          Where

          • **IE8Enterprise.** Loads the site in IE8 Enterprise Mode.
            This element is required for sites included in the **EmIE** section of the v.1 schema and is needed to load in IE8 Enterprise Mode.
          • **IE7Enterprise.** Loads the site in IE7 Enterprise Mode.
            This element is required for sites included in the **EmIE** section of the v.1 schema and is needed to load in IE7 Enterprise Mode

            **Important**
            This tag replaces the combination of the `"forceCompatView"="true"` attribute and the list of sites specified in the EmIE section of the v.1 version of the schema.

          • **IE[x]**. Where [x] is the document mode number into which the site loads.
          • **Default or not specified.** Loads the site using the default compatibility mode for the page. In this situation, X-UA-compatible meta tags or HTTP headers are honored.
          • |Internet Explorer 11 | -|<open-in> |A child element that controls what browser is used for sites. This element supports the **Open in IE11** or **Open in Microsoft Edge** experiences, for devices running Windows 10.
            **Examples**
            <site url="contoso.com">
            <open-in>none</open-in>
            </site>


            Where

            • IE11. Opens the site in IE11, regardless of which browser is opened by the employee.
            • MSEdge. Opens the site in Microsoft Edge, regardless of which browser is opened by the employee.
            • None or not specified. Opens in whatever browser the employee chooses.
            • | Internet Explorer 11 and Microsoft Edge | - -### Updated schema attributes -The <url> attribute, as part of the <site> element in the v.2 version of the schema, replaces the <domain> element from the v.1 version of the schema. - -|Attribute|Description|Supported browser| -|---------|---------|---------| -|allow-redirect|A boolean attribute of the <open-in> element that controls the behavior for redirected sites. Setting this attribute to "true" indicates that the site will open in IE11 or Microsoft Edge even if the site is navigated to as part of a HTTP or meta refresh redirection chain. Omitting the attribute is equivalent to "false" (sites in redirect chain will not open in another browser).
              **Example**
              <site url="contoso.com/travel">
              <open-in allow-redirect="true">IE11 </open-in>
              </site>
              In this example, if `https://contoso.com/travel` is encountered in a redirect chain in Microsoft Edge, it will be opened in Internet Explorer. | Internet Explorer 11 and Microsoft Edge| -|version |Specifies the version of the Enterprise Mode Site List. This attribute is supported for the <site-list> element. | Internet Explorer 11 and Microsoft Edge| -|url|Specifies the URL (and port number using standard port conventions) to which the child elements apply. The URL can be a domain, sub-domain, or any path URL.
              **Note**
              Make sure that you don't specify a protocol. Using <site url="contoso.com"> applies to both `http://contoso.com` and `https://contoso.com`.
              **Example**
              <site url="contoso.com:8080">
              <compat-mode>IE8Enterprise</compat-mode>
              <open-in>IE11</open-in>
              </site>
              In this example, going to `https://contoso.com:8080` using Microsoft Edge, causes the site to open in IE11 and load in IE8 Enterprise Mode. | Internet Explorer 11 and Microsoft Edge| - -### Deprecated attributes -These v.1 version schema attributes have been deprecated in the v.2 version of the schema: - -|Deprecated attribute|New attribute|Replacement example| -|--- |--- |--- | -|forceCompatView|<compat-mode>|Replace <forceCompatView="true"> with <compat-mode>IE7Enterprise</compat-mode>| -|docMode|<compat-mode>|Replace <docMode="IE5"> with <compat-mode>IE5</compat-mode>| -|doNotTransition|<open-in>|Replace:
              <doNotTransition="true"> with <open-in>none</open-in>| -|<domain> and <path>|<site>|Replace:
              <emie>
              <domain>contoso.com</domain>
              </emie>
              With:
              <site url="contoso.com"/> 
              <compat-mode>IE8Enterprise</compat-mode>
              <open-in>IE11</open-in>
              </site>
              **-AND-**
              Replace:
              <emie> 
              <domain exclude="true" donotTransition="true">contoso.com
              <path forceCompatView="true">/about</path>
              </domain>
              </emie>

              With:
              <site url="contoso.com/about">
              <compat-mode>IE7Enterprise</compat-mode>
              <open-in>IE11</open-in>
              </site>| - -While the old, replaced attributes aren't supported in the v.2 version of the schema, they'll continue to work in the v.1 version of the schema. If, however, you're using the v.2 version of the schema and these attributes are still there, the v.2 version schema takes precedence. We don’t recommend combining the two schemas, and instead recommend that you move to the v.2 version of the schema to take advantage of the new features. - -> [!IMPORTANT] -> Saving your v.1 version of the file using the new Enterprise Mode Site List Manager (schema v.2) automatically updates the XML to the new v.2 version of the schema. - -### What not to include in your schema -We recommend that you not add any of the following items to your schema because they can make your compatibility list behave in unexpected ways: - -- Don’t use protocols. For example, `http://`, `https://`, or custom protocols. They break parsing. -- Don’t use wildcards. -- Don’t use query strings, ampersands break parsing. - -## Related topics -- [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) diff --git a/browsers/internet-explorer/ie11-deploy-guide/export-your-enterprise-mode-site-list-from-the-enterprise-mode-site-list-manager.md b/browsers/internet-explorer/ie11-deploy-guide/export-your-enterprise-mode-site-list-from-the-enterprise-mode-site-list-manager.md deleted file mode 100644 index 602eeb31b1..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/export-your-enterprise-mode-site-list-from-the-enterprise-mode-site-list-manager.md +++ /dev/null @@ -1,53 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: After you create your Enterprise Mode site list in the Enterprise Mode Site List Manager, you can export the contents to an Enterprise Mode (.EMIE) file. -author: dansimp -ms.prod: windows-client -ms.assetid: 9ee7c13d-6fca-4446-bc22-d23a0213a95d -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Export your Enterprise Mode site list from the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Export your Enterprise Mode site list from the Enterprise Mode Site List Manager - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -After you create your Enterprise Mode site list in the Enterprise Mode Site List Manager, you can export the contents to an Enterprise Mode (.EMIE) file. This file includes all of your URLs, including your compatibility mode selections and should be stored somewhere safe. If your list gets deleted by mistake you can easily import this file and return everything back to when this file was last saved. - -**Important**
                -This file is not intended for distribution to your managed devices. Instead, it is only for transferring data and comments from one manager to another. For example, if one administrator leaves and passes the existing data to another administrator. Internet Explorer doesn’t read this file. - - **To export your compatibility list** - -1. On the **File** menu of the Enterprise Mode Site List Manager, click **Export**. - -2. Export the file to your selected location. For example, `C:\Users\\Documents\sites.emie`. - -## Related topics - -- [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) -- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) -- [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) -  - -  - - - diff --git a/browsers/internet-explorer/ie11-deploy-guide/fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md b/browsers/internet-explorer/ie11-deploy-guide/fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md deleted file mode 100644 index 9ec7ddf862..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md +++ /dev/null @@ -1,110 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: The Internet Explorer 11 Enterprise Mode site list lets you specify document modes for specific websites, helping you fix compatibility issues without changing a single line of code on the site. -author: dansimp -ms.prod: ie11 -ms.assetid: 4b21bb27-aeac-407f-ae58-ab4c6db2baf6 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Fix web compatibility issues using document modes and the Enterprise Mode site list (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Fix web compatibility issues using document modes and the Enterprise Mode site list - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -The Internet Explorer 11 Enterprise Mode site list lets you specify document modes for specific websites, helping you fix compatibility issues without changing a single line of code on the site. This addition to the site list is a continuation of our commitment to help you upgrade and stay up-to-date on the latest version of Internet Explorer, while still preserving your investments in existing apps. - -## What does this mean for me? -Enterprises can have critical apps that are coded explicitly for a specific browser version and that might not be in their direct control, making it very difficult and expensive to update to modern standards or newer browser versions. Because you can decide which URLs should open using specific document modes, this update helps ensure better compatibility, faster upgrades, and reduced testing and fixing costs. - -## How does this fix work? -You can continue to use your legacy and orphaned web apps, by specifying a document mode in the centralized Enterprise Mode site list. Then, when IE11 goes to a site on your list, the browser loads the page in the specified document mode just as it would if it were specified through an X-UA-Compatible meta tag on the site. For more information about document modes and X-UA-compatible headers, see [Defining document compatibility](/previous-versions/windows/internet-explorer/ie-developer/compatibility/cc288325(v=vs.85)). - -**Important**
              -Enterprise Mode takes precedence over document modes, so sites that are already included in the Enterprise Mode site list won’t be affected by this update and will continue to load in Enterprise Mode, as usual. - -### When do I use document modes versus Enterprise Mode? -While the `` functionality provides great compatibility for you on Windows Internet Explorer 8 or Windows Internet Explorer 7, the new `` capabilities can help you stay up-to-date regardless of which versions of IE are running in your environment. Because of this, we recommend starting your testing process like this: - -- If your enterprise primarily uses Internet Explorer 8 or Internet Explorer 7 start testing using Enterprise Mode. - -- If your enterprise primarily uses Windows Internet Explorer 9 or Internet Explorer 10, start testing using the various document modes. - -Because you might have multiple versions of IE deployed, you might need to use both Enterprise Mode and document modes to effectively move to IE11. - -### Test your sites for document mode compatibility -To see if this fix might help you, run through this process one step at a time, for each of your problematic sites: - -1. Go to a site having compatibility problems, press **F12** to open the **F12 Developer Tools**, and go to the **Emulation** tool. - - ![Emulation tool showing document mode selection.](images/docmode-f12.png) - -2. Starting with the **11 (Default)** option, test your broken scenario.
              -If that doesn’t work, continue down to the next lowest document mode, stopping as soon as you find a document mode that fixes your problems. For more information about the Emulation tool, see [Emulate browsers, screen sizes, and GPS locations](/previous-versions/windows/internet-explorer/ie-developer/samples/dn255001(v=vs.85)). - -3. If none of the document modes fix your issue, change the **Browser Profile** to **Enterprise**, pick the mode you want to test with starting with **8** (IE8 Enterprise Mode), and then test your broken scenario. - -### Add your site to the Enterprise Mode site list -After you’ve figured out the document mode that fixes your compatibility problems, you can add the site to your Enterprise Mode site list. - -**Note**
              -There are two versions of the Enterprise Mode site list schema and the Enterprise Mode Site List Manager, based on your operating system. For more info about the schemas, see [Enterprise Mode schema v.2 guidance](enterprise-mode-schema-version-2-guidance.md) or [Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md). For more info about the different site list management tools, see [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md). - - **To add your site to the site list** - -1. Open the Enterprise Mode Site List Manager, and click **Add**. - - ![Enterprise Mode Site List Manager, showing the available modes.](images/emie-listmgr.png) - -2. Add the **URL** and pick the document mode from the **Launch in** box. This should be the same document mode you found fixed your problems while testing the site.
              -Similar to Enterprise Mode, you can specify a document mode for a particular web path—such as contoso.com/ERP—or at a domain level. In the above, the entire contoso.com domain loads in Enterprise Mode, while microsoft.com is forced to load into IE8 Document Mode and bing.com loads in IE11. - -**Note**
              -For more information about Enterprise Mode, see [What is Enterprise Mode?](what-is-enterprise-mode.md) For more information about the Enterprise Mode Site List Manager and how to add sites to your site list, see [Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md). - - -### Review your Enterprise Mode site list -Take a look at your Enterprise Mode site list and make sure everything is the way you want it. The next step will be to turn the list on and start to use it in your company. The Enterprise Mode Site List Manager will look something like: - -![Enterprise Mode Site List Manager, showing the different modes.](images/emie-sitelistmgr.png) - -And the underlying XML code will look something like: - -``` xml - - - bing.com/images - www.msn.com/news - - - - timecard - tar - msdn.microsoft.com - - -``` - -### Turn on Enterprise Mode and using your site list -If you haven’t already turned on Enterprise Mode for your company, you’ll need to do that. You can turn on Enterprise Mode using Group Policy or your registry. For specific instructions and details, see [Turn on Enterprise Mode and use a site list](turn-on-enterprise-mode-and-use-a-site-list.md). - -## Turn off default Compatibility View for your intranet sites -By default, IE11 uses the **Display intranet sites in Compatibility View** setting. However, we’ve heard your feedback and know that you might want to turn this functionality off so you can continue to upgrade your web apps to more modern standards. - -To help you move forward, you can now use the Enterprise Mode site list to specify sites or web paths to use the IE7 document mode, which goes down to IE5 “Quirks” mode if the page doesn’t have an explicit `DOCTYPE` tag. Using this document mode effectively helps you provide the Compatibility View functionality for single sites or a group of sites, which after thorough testing, can help you turn off Compatibility View as the default setting for your intranet sites. - -## Related topics -- [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) -- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) -- [Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) -  - -  \ No newline at end of file diff --git a/browsers/internet-explorer/ie11-deploy-guide/fix-validation-problems-using-the-enterprise-mode-site-list-manager.md b/browsers/internet-explorer/ie11-deploy-guide/fix-validation-problems-using-the-enterprise-mode-site-list-manager.md deleted file mode 100644 index 54da1d4ba1..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/fix-validation-problems-using-the-enterprise-mode-site-list-manager.md +++ /dev/null @@ -1,52 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: When you add multiple sites to your Enterprise Mode site list entries, they’re validated by the Enterprise Mode Site List Manager before they’re entered into your global list. -author: dansimp -ms.prod: ie11 -ms.assetid: 9f80e39f-dcf1-4124-8931-131357f31d67 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Fix validation problems using the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Fix validation problems using the Enterprise Mode Site List Manager - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -When you add multiple sites to your Enterprise Mode site list entries, they’re validated by the Enterprise Mode Site List Manager before they’re entered into your global list. If a site doesn’t pass validation, you’ll have a couple of options to address it. - -There are typically 3 types of errors you’ll see: - -- **Validation**. The site caused a validation error. Typically these occur because of typos, malformed URLs, or access-related issues. You can pick the site, click **Add to list** to ignore the problem and accept the site to your site list, or you can click **OK** to keep the site off of your site list. - -- **Duplicate**. The site already exists in the global compatibility list with a different compatibility mode. For example, the site was originally rendered in Enterprise Mode, but this update is for Default IE. You can pick the site, click **Add to list** to ignore the problem and accept the change to your site list, or you can click **OK** to keep your original compatibility mode. - -- **Redirection**. This is the least common type of validation error. Typically in this situation, a site redirects from an easy-to-remember URL to a longer URL. Like `\\tar` redirects to `\\timecard`. You can add the short URL or you can add both the short and long versions to your list.
              -Another possibility is that redirection happens multiple times, with an intermediary site experiencing compatibility issues. For example, an employee types a short URL that then redirects multiple times, finally ending up on a non-intranet site. In this situation, you might want to add the intermediary URLs to your Enterprise Mode site list, in case there’s logic in one of them that has compatibility issues. - -## Related topics -- [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) -- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) -- [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) -  - -  - - - diff --git a/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-advanced-group-policy-mgmt-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-advanced-group-policy-mgmt-ie11.md deleted file mode 100644 index 93486e7113..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-advanced-group-policy-mgmt-ie11.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: security -description: Overview about Group Policy, Advanced Group Policy Management (AGPM), and Internet Explorer 11 -author: dansimp -ms.prod: ie11 -ms.assetid: 63a7ef4a-6de2-4d08-aaba-0479131e3406 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Group Policy, Advanced Group Policy Management (AGPM), and Internet Explorer 11 (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Group Policy, Advanced Group Policy Management (AGPM), and Internet Explorer 11 - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -Advanced Group Policy Management (AGPM) is an add-on license that available for the Microsoft Desktop Optimization Pack (MDOP). This license gives you change control and a role assignment-model that helps optimize Group Policy management and reduce the risk of widespread failures. - -From AGPM you can: - -- **Edit GPOs outside of your production environment.** Your GPOs are stored in an outside archive for editing, reviewing, and approving. Then, when you deploy, AGPM moves the GPOs to your production environment. - -- **Assign roles to your employees.** You can assign 3 roles to your employees or groups, including: - - - **Reviewer.** Can view and compare GPOs in the archive. This role can't edit or deploy GPOs. - - - **Editor.** Can view, compare, check-in and out, and edit GPOs in the archive. This role can also request GPO deployment. - - - **Approver.** Can approve GPO creation and deployment to the production environment. - -- **Manage your GPO lifecycle with change control features.** You can use the available version-control, history, and auditing features to help you manage your GPOs while moving through your archive, to your editing process, and finally to your GPO deployment. - -**Note**
              -For more information about AGPM, and to get the license, see [Advanced Group Policy Management 4.0 Documents](https://www.microsoft.com/download/details.aspx?id=13975). - -  - -  - - - diff --git a/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-group-policy-mgmt-console-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-group-policy-mgmt-console-ie11.md deleted file mode 100644 index b56fd8d946..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-group-policy-mgmt-console-ie11.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: security -description: Overview about Group Policy, the Group Policy Management Console (GPMC), and Internet Explorer 11 -author: dansimp -ms.prod: windows-client -ms.assetid: ae3d227d-3da7-46b8-8a61-c71bfeae0c63 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Group Policy, the Group Policy Management Console (GPMC), and Internet Explorer 11 (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Group Policy, the Group Policy Management Console (GPMC), and Internet Explorer 11 - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -A Microsoft Management Console (MMC)-based tool that uses scriptable interfaces to manage Group Policy. The 32-bit and 64-bit versions are included with Windows Server R2 with Service Pack 1 (SP1) and Windows Server 2012 R2. - -## Why use the GPMC? -The GPMC lets you: - -- Import, export, copy, paste, backup and restore GPOs. - -- Search for existing GPOs. - -- Create reports, including providing the Resultant Set of Policy (RSoP) data in HTML reports that you can save and print. - -- Use simulated RSoP data to prototype your Group Policy before implementing it in the production environment. - -- Obtain RSoP data to view your GPO interactions and to troubleshoot your Group Policy deployment. - -- Create migration tables to let you import and copy GPOs across domains and across forests. Migration tables are files that map references to users, groups, computers, and Universal Naming Convention (UNC) paths in the source GPO to new values in the destination GPO. - -- Create scriptable interfaces to support all of the operations available within the GPMC. You can't use scripts to edit individual policy settings in a GPO. - -For more information about the GPMC, see [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc753298(v=ws.11)) on TechNet. - -## Searching for Group Policy settings -To search for Group Policy settings in the Group Policy Management Console (GPMC), use the [Group Policy Search tool](https://go.microsoft.com/fwlink/p/?LinkId=279857). To find the Group Policy settings, click **Windows Components**, and then click **Internet Explorer**. - -  - -  \ No newline at end of file diff --git a/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-ie11.md deleted file mode 100644 index 7e8c419582..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-ie11.md +++ /dev/null @@ -1,52 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: security -description: Use the topics in this section to learn about Group Policy and how to use it to manage Internet Explorer. -author: dansimp -ms.prod: ie11 -ms.assetid: 50383d3f-9ac9-4a30-8852-354b6eb9434a -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Group Policy and Internet Explorer 11 (IE11) (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Group Policy and Internet Explorer 11 (IE11) - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -Use the topics in this section to learn about Group Policy and how to use it to manage Internet Explorer. - -## In this section - -|Topic |Description | -|----------------------------------------------------|-----------------------------------------------------------------| -|[New group policy settings for Internet Explorer 11](new-group-policy-settings-for-ie11.md) |Info about many of the new group policy settings added for Internet Explorer 11. | -|[Group Policy management tools](group-policy-objects-and-ie11.md) |Guidance about how to use Microsoft Active Directory Domain Services (AD DS) to manage your Group Policy settings. | -|[ActiveX installation using group policy](activex-installation-using-group-policy.md) |Info about using the ActiveX Installer Service (AXIS) and Group Policy to manage your ActiveX control deployment. | -|[Group Policy and compatibility with Internet Explorer 11](group-policy-compatibility-with-ie11.md) |Our Group Policy recommendations for security, performance, and compatibility with previous versions of IE, regardless of which Zone the website is in. | -|[Group policy preferences and Internet Explorer 11](group-policy-preferences-and-ie11.md) |Info about Group Policy preferences, as compared to Group Policy settings. | -|[Administrative templates and Internet Explorer 11](administrative-templates-and-ie11.md) |Info about Administrative Templates, including where to store them and the related Group Policy settings. | -|[Enable and disable add\-ons using administrative templates and group policy](enable-and-disable-add-ons-using-administrative-templates-and-group-policy.md) |Guidance about how to use your local Group Policy editor or the CLSID and Administrative Templates to manage your Group Policy objects. - - - - - - - - diff --git a/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-local-group-policy-editor-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-local-group-policy-editor-ie11.md deleted file mode 100644 index c3a615888f..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-local-group-policy-editor-ie11.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: security -description: Group Policy, the Local Group Policy Editor, and Internet Explorer 11 -author: dansimp -ms.prod: ie11 -ms.assetid: 6fc30e91-efac-4ba5-9ee2-fa77dcd36467 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Group Policy, the Local Group Policy Editor, and Internet Explorer 11 (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Group Policy, the Local Group Policy Editor, and Internet Explorer 11 - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -A Microsoft Management Console (MMC)-based tool that manages both computer and user-related configurations for an individual computer policy. This tool is included with Windows® 7 Service Pack 1 (SP1) and Windows 8.1. - -Here's a list of the policy settings you can use, based on the configuration type. For more info, see [Local Group Policy Editor](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc725970(v=ws.11)). - -|Computer configuration |User configuration | -|-----------------------|-------------------| -|Windows settings:
              • Name Resolution policy
              • Scripts (Startup/Shutdown)
              • Deployed printers
              • Security settings
              • Policy-based Quality of Service (QoS)
              |Windows settings:
              • Scripts (Startup/Shutdown)
              • Deployed printers
              • Security settings
              • Policy-based Quality of Service (QoS)

              | -|Administrative templates:
              • Control Panel
              • Network
              • Printers
              • Server
              • System
              • Windows components
              • All settings

              |Administrative templates:
              • Control Panel
              • Desktop
              • Network
              • Shared folders
              • Start menu and taskbar
              • System
              • Windows components
              • All settings
              | - - -  - -  - -  \ No newline at end of file diff --git a/browsers/internet-explorer/ie11-deploy-guide/group-policy-compatibility-with-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/group-policy-compatibility-with-ie11.md deleted file mode 100644 index 12b360b126..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/group-policy-compatibility-with-ie11.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: security -description: Group Policy suggestions for compatibility with Internet Explorer 11 -author: dansimp -ms.prod: ie11 -ms.assetid: 7482c99f-5d79-4344-9e1c-aea9f0a68e18 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Group Policy and compatibility with Internet Explorer 11 (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Group Policy and compatibility with Internet Explorer 11 - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -Internet Explorer 11 has many Group Policy entries that can be configured for keeping your environment managed and safe. This table includes all of our recommendations around security, performance, and compatibility with the previous versions of Internet Explorer, regardless of which Zone the website is in. - -|Activity |Location |Setting the policy object | -|---------------------------------|----------------------------------------------|-------------------------------------------------------------------------| -|Turn on Compatibility View for all intranet zones |`Administrative Templates\Windows Components\Internet Explorer\Compatibility View` |Double-click **Turn on IE Standards Mode for local intranet** , and then click **Disabled**. | -|Turn on Compatibility View for selected websites, using Group Policy |`Administrative Templates\Windows Components\Internet Explorer\Compatibility View` |Double-click **Use Policy List of Windows Internet Explorer 7 sites** , and then click **Enabled**.Users will be able to add or remove sites manually to their local Compatibility View list, but they won’t be able to remove the sites you specifically added. | -|Turn on Quirks mode for selected websites, using Group Policy |`Administrative Templates\Windows Components\Internet Explorer\Compatibility View` |Double-click **Use Policy List of Quirks Mode sites**, and then click **Enabled**. | -|Ensure your users are using the most up-to-date version of Microsoft’s compatibility list. |`Administrative Templates\Windows Components\Internet Explorer\Compatibility View` |Double-click **Include updated Web site lists from Microsoft**, and then click **Enabled**. | -|Restrict users from making security zone configuration changes. |`Administrative Templates\ Windows Components\Internet Explorer\Internet Control Panel` |Double-click **Disable the Security Page**, and then click **Enabled**. | -|Control which security zone settings are applied to specific websites. |`Administrative Templates\ Windows Components\Internet Explorer\Internet Control Panel\Security Page` |Double-click **Site to Zone Assignment List**, click **Enabled**, and then enter your list of websites and their applicable security zones. | -|Turn off Data Execution Prevention (DEP). |`Administrative Templates\ Windows Components\Internet Explorer\Security Features` |Double-click **Turn off Data Execution Prevention**, and then click **Enabled**. | - -  - -  - -  - - - diff --git a/browsers/internet-explorer/ie11-deploy-guide/group-policy-objects-and-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/group-policy-objects-and-ie11.md deleted file mode 100644 index 4e6daed0d1..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/group-policy-objects-and-ie11.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: security -description: Overview of the available Group Policy management tools -author: dansimp -ms.prod: windows-client -ms.assetid: e33bbfeb-6b80-4e71-8bba-1d0369a87312 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Group Policy management tools (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Group Policy management tools - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -Group Policy, based on Microsoft Active Directory Domain Services (AD DS), lets you manage your organization's computer and user settings as part of your Group Policy objects (GPOs), which are added and changed in the Group Policy Management Console (GPMC). GPOs can include registry-based Administrative Template policy settings, security settings, software deployment information, scripts, folder redirection, and preferences. The most effective way to target a specific GPO is to use Windows Management Instrumentation (WMI) filters. Like, creating a WMI filter that applies a GPO only to computers with a specific make and model. - -By using Group Policy, you can set up a policy setting once, and then copy that setting onto many computers. For example, you can set up multiple Internet Explorer 11 security settings in a GPO that's linked to a domain, and then apply all of those settings to every computer in the domain. - -**Note**
                 -For more information about Group Policy, see the [Group Policy TechCenter](/windows/deployment/deploy-whats-new). This site provides links to the latest technical documentation, videos, and downloads for Group Policy. - -## Managing settings with GPOs -After deploying IE11 to your organization, you can continue to manage the browser settings by using Active Directory Domain Services (AD DS) together with the following Group Policy-related setting management groups: - -- [Administrative templates and Internet Explorer 11](administrative-templates-and-ie11.md). Used to manage registry-based policies and options. - -- [Group policy preferences and Internet Explorer 11](group-policy-preferences-and-ie11.md). Used to set up and manage options that can be changed by the user after installation. - -**Note**
              -Whenever possible, we recommend that you manage IE11 using Administrative Templates, because these settings are always written to secure policy branches in the registry. In addition, we recommend that you deploy using standard user accounts instead of letting your users log on to their computers as administrators. This helps to prevent your users from making unwanted changes to their systems or overriding Group Policy settings. - - -Users won't be able to use the IE11 user interface or the registry to change any managed settings on their computers. However, they will be able to change many of the preferences associated with the settings you set up using the Internet Explorer Administration Kit 11 (IEAK 11). - -## Which GPO tool should I use? -You can use any of these tools to create, manage, view, and troubleshoot Group Policy objects (GPOs). For information about each, see: - -- [Group Policy, the Group Policy Management Console (GPMC), and Internet Explorer 11](group-policy-and-group-policy-mgmt-console-ie11.md). Provides a single location to manage all GPOs, WMI filters, and Group Policy–related permissions across multiple forests in an organization. - -- [Group Policy, the Local Group Policy Editor, and Internet Explorer 11](group-policy-and-local-group-policy-editor-ie11.md). Provides a user interface that lets you edit settings within individual GPOs. - -- [Group Policy, Advanced Group Policy Management (AGPM), and Internet Explorer 11](group-policy-and-advanced-group-policy-mgmt-ie11.md). An add-on license for the Microsoft Desktop Optimization Pack (MDOP) that helps to extend Group Policy for Software Assurance customers. - -- [Group Policy, Windows Powershell, and Internet Explorer 11](group-policy-windows-powershell-ie11.md). A command-line shell and scripting language that helps automate Windows and application administration on a single computer locally, or across many computers remotely. - - - diff --git a/browsers/internet-explorer/ie11-deploy-guide/group-policy-preferences-and-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/group-policy-preferences-and-ie11.md deleted file mode 100644 index b30e90d746..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/group-policy-preferences-and-ie11.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: security -description: Info about Group Policy preferences versus Group Policy settings -author: dansimp -ms.prod: ie11 -ms.assetid: f2264c97-7f09-4f28-bb5c-58ab80dcc6ee -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Group policy preferences and Internet Explorer 11 (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Group policy preferences and Internet Explorer 11 - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -Group Policy preferences are less strict than Group Policy settings, based on: - -| Type |Group Policy preferences |Group Policy settings | -|-----|-------------------------|----------------------| -|Enforcement |
              • Not enforced
              • Has the user interface turned on
              • Can only be refreshed or applied once
              |
              • Enforced
              • Has the user interface turned off
              • Can be refreshed multiple times
              | -|Flexibility |Lets you create preference items for registry settings, files, and folders. |
              • Requires app support
              • Needs you to create Administrative Templates for new policy settings
              • Won't let you create policy settings to manage files and folders
              | -|Local Group Policy |Not available |Available -|Awareness |Supports apps that aren't Group Policy-aware |Requires apps to be Group Policy-aware | -|Storage |
              • Overwrites the original settings
              • Removing the preference doesn't restore the original setting
              |
              • Doesn't overwrite the original settings
              • Stored in the Policy branches of the registry
              • Removing the setting restores the original setting
              | -|Targeting and filtering |
              • Targeting is specific, with a user interface for each type of targeting item
              • Supports targeting at the individual preference item level
              |
              • Filtering is based on Windows Management Instrumentation (WMI), and requires writing WMI queries
              • Supports filtering at the Group Policy Object (GPO) level
              | - - -For more information about Group Policy preferences, see the [Group Policy Settings Reference for Windows and Windows Server](https://go.microsoft.com/fwlink/p/?LinkId=279876). - -  - -  - - - diff --git a/browsers/internet-explorer/ie11-deploy-guide/group-policy-problems-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/group-policy-problems-ie11.md deleted file mode 100644 index 8cec1052e4..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/group-policy-problems-ie11.md +++ /dev/null @@ -1,30 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: security -description: Links to troubleshooting topics and log files that can help address Group Policy problems with Internet Explorer 11. -author: dansimp -ms.prod: ie11 -ms.assetid: 0da0d9a9-200c-46c4-96be-630e82de017b -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Group Policy problems with Internet Explorer 11 (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Group Policy problems with Internet Explorer 11 - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -If you're having problems with Group Policy and Internet Explorer 11, or if you're looking for high-level information about the concepts and techniques used to troubleshoot Group Policy, as well as links to detailed reference topics, procedures, and troubleshooting scenario guides, see [Group Policy Analysis and Troubleshooting Overview](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/jj134223(v=ws.11)). - -## Group Policy Object-related Log Files -You can use the Event Viewer to review Group Policy-related messages in the **Windows Logs**, **System** file. All of the Group Policy-related events are shown with a source of **GroupPolicy** - -  - -  \ No newline at end of file diff --git a/browsers/internet-explorer/ie11-deploy-guide/group-policy-shortcut-extensions-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/group-policy-shortcut-extensions-ie11.md deleted file mode 100644 index 8a23dbf697..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/group-policy-shortcut-extensions-ie11.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: security -description: Instructions about how to create and configure shortcut preference extensions to file system objects, URLs, and shell objects. -author: dansimp -ms.prod: ie11 -ms.assetid: c6fbf990-13e4-4be7-9f08-5bdd43179b3b -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Group Policy, Shortcut Extensions, and Internet Explorer 11 (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Group Policy, Shortcut Extensions, and Internet Explorer 11 - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -Group Policy includes the Shortcuts preference extension, which lets you configure shortcuts to: - -- **File system objects.** Traditional shortcuts that link to apps, files, folders, drives, shares, or computers. For example, linking a shortcut to an app from the **Start** screen. - -- **URLs.** Shortcuts to webpages or FTP sites. For example, a link to your intranet site from your employee's **Favorites** folder. - -- **Shell objects.** Shortcuts to objects that appear in the shell namespace, such as printers, desktop items, Control Panel items, the Recycle Bin, and so on. - -## How do I configure shortcuts? -You can create and configure shortcuts for any domain-based Group Policy Object (GPO) in the Group Policy Management Console (GPMC). - - **To create a new Shortcut preference item** - -1. Open GPMC, right-click the Group Policy object that needs the new shortcut extension, and click **Edit**. - -2. From **Computer Configuration** or **User Configuration**, go to **Preferences**, and then go to **Windows Settings**. - -3. Right-click **Shortcuts**, click **New**, and then choose **Shortcut**. - -4. Choose what the shortcut should do, including **Create**, **Delete**, **Replace**, or **Update**. - -5. Type the required shortcut settings and your comments into the **Description** box, and click **OK**. - -For more information about shortcut extensions, including step-by-step guidance, see [Shortcuts Extension](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc730592(v=ws.11)) and [Configure a Shortcut Item](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc753580(v=ws.11)). - -  - -  \ No newline at end of file diff --git a/browsers/internet-explorer/ie11-deploy-guide/group-policy-windows-powershell-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/group-policy-windows-powershell-ie11.md deleted file mode 100644 index c3f3970e4d..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/group-policy-windows-powershell-ie11.md +++ /dev/null @@ -1,39 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: security -description: Overview about how Group Policy works with Windows Powershell and Internet Explorer 11 -author: dansimp -ms.prod: windows-client -ms.assetid: e3607cde-a498-4e04-9daa-b331412967fc -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Group Policy, Windows Powershell, and Internet Explorer 11 (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Group Policy, Windows Powershell, and Internet Explorer 11 - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -Your domain-joined Group Policy Objects (GPOs) can use any of Group Policy-related “cmdlets” that run within Windows PowerShell. - -Each cmdlet is a single-function command-line tool that can: - -- Create, edit, remove, back up, and import GPOs. - -- Create, update, and remove Group Policy links. - -- Set inheritance flags and permissions on organizational units (OU) and domains. - -- Configure registry-based policy settings and registry settings for Group Policy preferences. - -For more info about PowerShell and Group Policy management, see [Use Windows PowerShell to Manage Group Policy](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd759177(v=ws.11)). - -  - -  \ No newline at end of file diff --git a/browsers/internet-explorer/ie11-deploy-guide/ie11-delivery-through-automatic-updates.md b/browsers/internet-explorer/ie11-deploy-guide/ie11-delivery-through-automatic-updates.md deleted file mode 100644 index c8b17e2ff9..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/ie11-delivery-through-automatic-updates.md +++ /dev/null @@ -1,144 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: support -ms.pagetype: security -description: A high-level overview of the delivery process and your options to control deployment of Internet Explorer through automatic updates. -author: dansimp -ms.author: dansimp -ms.manager: dansimp -ms.prod: ie11 -ms.assetid: -ms.reviewer: -audience: itpro -manager: dansimp -title: Internet Explorer 11 delivery through automatic updates -ms.sitesec: library -ms.date: 05/22/2018 ---- - -# Internet Explorer 11 delivery through automatic updates - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -Internet Explorer 11 makes browsing the web faster, easier, safer, and more reliable than ever. To help customers become more secure and up-to-date, Microsoft will distribute Internet Explorer 11 through Automatic Updates and the Windows Update and Microsoft Update sites. Internet Explorer 11 will be available for users of the 32-bit and 64-bit versions of Windows 7 Service Pack 1 (SP1), and 64-bit version of Windows Server 2008 R2 SP1. This article provides an overview of the delivery process and options available for IT administrators to control how and when Internet Explorer 11 is deployed to their organization through Automatic Updates. - -- [Automatic updates delivery process](#automatic-updates-delivery-process) - -- [Internet Explorer 11 automatic upgrades](#internet-explorer-11-automatic-upgrades) - -- [Options for blocking automatic delivery](#options-for-blocking-automatic-delivery) - -- [Prevent automatic installation of Internet Explorer 11 with WSUS](#prevent-automatic-installation-of-internet-explorer-11-with-wsus) - -## Automatic updates delivery process - -Internet Explorer 11 only downloads and installs if it’s available for delivery through Automatic Updates; and Automatic Updates only offer Internet Explorer 11 -to users with local administrator accounts. User’s without local administrator accounts won’t be prompted to install the update and will continue using their -current version of Internet Explorer. - -Internet Explorer 11 replaces Internet Explorer 8, Internet Explorer 9, or Internet Explorer 10. If you decide you don’t want Internet Explorer 11, and you’re running Windows 7 SP1 or Windows Server 2008 R2 with SP1, you can uninstall it from the **View installed updates** section of the **Uninstall an update** page of the Control Panel. - -> [!NOTE] -> If a user installs Internet Explorer 11 and then removes it, it won’t be re-offered to that computer through Automatic Updates. Instead, the user will have to manually re-install the app. - -## Internet Explorer 11 automatic upgrades - -Internet Explorer 11 is offered through Automatic Updates and Windows Update as an Important update. Users running Windows 7 SP1, who have chosen to download and install updates automatically through Windows Update, are automatically upgraded to Internet Explorer 11. - -Users who were automatically upgraded to Internet Explorer 11 can decide to uninstall Internet Explorer 11. However, Internet Explorer 11 will still appear as an optional update through Windows Update. - -## Options for blocking automatic delivery - -If you use Automatic Updates in your company, but want to stop your users from automatically getting Internet Explorer 11, do one of the following: - -- **Download and use the Internet Explorer 11 Blocker Toolkit.** Includes a Group Policy template and a script that permanently blocks Internet Explorer 11 from being offered by Windows Update or Microsoft Update as a high-priority update. You can download this kit from the [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=40722). - - > [!NOTE] - > The toolkit won't stop users with local administrator accounts from manually installing Internet Explorer 11. Using this toolkit also prevents your users from receiving automatic upgrades from Internet Explorer 8, Internet Explorer 9, or Internet Explorer 10 to Internet Explorer 11. For more information, see the [Internet Explorer 11 Blocker Toolkit frequently asked questions](../ie11-faq/faq-ie11-blocker-toolkit.yml). - -- **Use an update management solution to control update deployment.** - If you already use an update management solution, like [Windows Server Update Services (WSUS)](/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus) or the more advanced [Microsoft Configuration Manager](/previous-versions/system-center/system-center-2012-R2/gg682129(v=technet.10)), you should use that instead of the Internet Explorer Blocker Toolkit. - - > [!NOTE] - > If you use WSUS to manage updates, and Update Rollups are configured for automatic installation, Internet Explorer will automatically install throughout your company. - -Additional information on Internet Explorer 11, including a Readiness Toolkit, technical overview, in-depth feature summary, and Internet Explorer 11 download is available on the [Internet Explorer 11 page of the Microsoft Edge IT Center](https://technet.microsoft.com/microsoft-edge/dn262703.aspx). - -## Availability of Internet Explorer 11 - -Automatic Updates will start to distribute Internet Explorer 11 shortly after the final release of the product and will distribute it through the Microsoft Configuration Manager and WSUS. - -## Prevent automatic installation of Internet Explorer 11 with WSUS - -Internet Explorer 11 will be released to WSUS as an Update Rollup package. Therefore, if you’ve configured WSUS to “auto-approve” Update Rollup packages, it’ll be automatically approved and installed. To stop Internet Explorer 11 from being automatically approved for installation, you need to: - -1. Click **Start**, click **Administrative Tools**, and then click **Microsoft - Windows Server Update Services 3.0**. - -2. Expand *ComputerName*, and then click **Options**. - -3. Click **Automatic Approvals**. - -4. Click the rule that automatically approves an update that is classified as - Update Rollup, and then click **Edit.** - - > [!NOTE] - > If you don’t see a rule like this, you most likely haven’t configured WSUS to automatically approve Update Rollups for installation. In this situation, you don’t have to do anything else. - -5. Click the **Update Rollups** property under the **Step 2: Edit the properties (click an underlined value)** section. - - > [!NOTE] - > The properties for this rule will resemble the following:
              • When an update is in Update Rollups
              • Approve the update for all computers
              - -6. Clear the **Update Rollup** check box, and then click **OK**. - -7. Click **OK** to close the **Automatic Approvals** dialog box.

              After the new Internet Explorer 11 package is available for download, you should manually synchronize the new package to your WSUS server, so that when you re-enable auto-approval it won’t be automatically installed. - -8. Click **Start**, click **Administrative Tools**, and then click **Microsoft Windows Server Update Services 3.0**. - -9. Expand *ComputerName*, and then click **Synchronizations**. - -10. Click **Synchronize Now**. - -11. Expand *ComputerName*, expand **Updates**, and then click **All Updates**. - -12. Choose **Unapproved** in the **Approval** drop down box. - -13. Check to make sure that Microsoft Internet Explorer 11 is listed as an unapproved update. - - > [!NOTE] - > There may be multiple updates, depending on the imported language and operating system updates. - -**Optional** - -If you need to reset your Update Rollups packages to auto-approve, do this: - -1. Click **Start**, click **Administrative Tools**, and then click **Microsoft Windows Server Update Services 3.0**. - -2. Expand *ComputerName*, and then click **Options**. - -3. Click **Automatic Approvals**. - -4. Click the rule that automatically approves updates of different classifications, and then click **Edit**. - -5. Click the **Update Rollups** property under the **Step 2: Edit the properties (click an underlined value)** section. - -6. Check the **Update Rollups** check box, and then click **OK**. - -7. Click **OK** to close the **Automatic Approvals** dialog box. - -> [!NOTE] -> Because auto-approval rules are only evaluated when an update is first imported into WSUS, turning this rule back on after the Internet Explorer 11 update has been imported and synchronized to the server won’t cause this update to be auto-approved. - - -## Additional resources - -- [Automatic delivery process](what-is-the-internet-explorer-11-blocker-toolkit.md#automatic-delivery-process) - -- [Internet Explorer 11 Blocker Toolkit download](https://www.microsoft.com/download/details.aspx?id=40722) - -- [Internet Explorer 11 FAQ for IT pros](../ie11-faq/faq-for-it-pros-ie11.yml) - -- [Internet Explorer 11 delivery through automatic updates]() - -- [Internet Explorer 11 deployment guide](./index.md) \ No newline at end of file diff --git a/browsers/internet-explorer/ie11-deploy-guide/images/affectedsoftware.png b/browsers/internet-explorer/ie11-deploy-guide/images/affectedsoftware.png deleted file mode 100644 index df63b88432..0000000000 Binary files a/browsers/internet-explorer/ie11-deploy-guide/images/affectedsoftware.png and /dev/null differ diff --git a/browsers/internet-explorer/ie11-deploy-guide/images/bulkadd-emiesitelistmgr.png b/browsers/internet-explorer/ie11-deploy-guide/images/bulkadd-emiesitelistmgr.png deleted file mode 100644 index 040df5bb07..0000000000 Binary files a/browsers/internet-explorer/ie11-deploy-guide/images/bulkadd-emiesitelistmgr.png and /dev/null differ diff --git a/browsers/internet-explorer/ie11-deploy-guide/images/configmgractivexreport.png b/browsers/internet-explorer/ie11-deploy-guide/images/configmgractivexreport.png deleted file mode 100644 index a782b6657c..0000000000 Binary files a/browsers/internet-explorer/ie11-deploy-guide/images/configmgractivexreport.png and /dev/null differ diff --git a/browsers/internet-explorer/ie11-deploy-guide/images/configmgrhardwareinventory.png b/browsers/internet-explorer/ie11-deploy-guide/images/configmgrhardwareinventory.png deleted file mode 100644 index 7626296e87..0000000000 Binary files a/browsers/internet-explorer/ie11-deploy-guide/images/configmgrhardwareinventory.png and /dev/null differ diff --git a/browsers/internet-explorer/ie11-deploy-guide/images/docmode-decisions-lg.png b/browsers/internet-explorer/ie11-deploy-guide/images/docmode-decisions-lg.png deleted file mode 100644 index 07a182461b..0000000000 Binary files a/browsers/internet-explorer/ie11-deploy-guide/images/docmode-decisions-lg.png and /dev/null differ diff --git a/browsers/internet-explorer/ie11-deploy-guide/images/docmode-decisions-sm.png b/browsers/internet-explorer/ie11-deploy-guide/images/docmode-decisions-sm.png deleted file mode 100644 index c887d9c193..0000000000 Binary files a/browsers/internet-explorer/ie11-deploy-guide/images/docmode-decisions-sm.png and /dev/null differ diff --git a/browsers/internet-explorer/ie11-deploy-guide/images/docmode-f12.png b/browsers/internet-explorer/ie11-deploy-guide/images/docmode-f12.png deleted file mode 100644 index 28adf37af6..0000000000 Binary files a/browsers/internet-explorer/ie11-deploy-guide/images/docmode-f12.png and /dev/null differ diff --git a/browsers/internet-explorer/ie11-deploy-guide/images/emie-listmgr.png b/browsers/internet-explorer/ie11-deploy-guide/images/emie-listmgr.png deleted file mode 100644 index f3a1773a45..0000000000 Binary files a/browsers/internet-explorer/ie11-deploy-guide/images/emie-listmgr.png and /dev/null differ diff --git a/browsers/internet-explorer/ie11-deploy-guide/images/emie-sitelistmgr.png b/browsers/internet-explorer/ie11-deploy-guide/images/emie-sitelistmgr.png deleted file mode 100644 index ccd5c9cd4b..0000000000 Binary files a/browsers/internet-explorer/ie11-deploy-guide/images/emie-sitelistmgr.png and /dev/null differ diff --git a/browsers/internet-explorer/ie11-deploy-guide/images/ie-emie-editbindings.png b/browsers/internet-explorer/ie11-deploy-guide/images/ie-emie-editbindings.png deleted file mode 100644 index 3d22ce267e..0000000000 Binary files a/browsers/internet-explorer/ie11-deploy-guide/images/ie-emie-editbindings.png and /dev/null differ diff --git a/browsers/internet-explorer/ie11-deploy-guide/images/ie-emie-editpolicy.png b/browsers/internet-explorer/ie11-deploy-guide/images/ie-emie-editpolicy.png deleted file mode 100644 index f2b011d717..0000000000 Binary files a/browsers/internet-explorer/ie11-deploy-guide/images/ie-emie-editpolicy.png and /dev/null differ diff --git a/browsers/internet-explorer/ie11-deploy-guide/images/ie-emie-editregistrystring.png b/browsers/internet-explorer/ie11-deploy-guide/images/ie-emie-editregistrystring.png deleted file mode 100644 index dc365fc8ad..0000000000 Binary files a/browsers/internet-explorer/ie11-deploy-guide/images/ie-emie-editregistrystring.png and /dev/null differ diff --git a/browsers/internet-explorer/ie11-deploy-guide/images/ie-emie-grouppolicy.png b/browsers/internet-explorer/ie11-deploy-guide/images/ie-emie-grouppolicy.png deleted file mode 100644 index 115e7d8a05..0000000000 Binary files a/browsers/internet-explorer/ie11-deploy-guide/images/ie-emie-grouppolicy.png and /dev/null differ diff --git a/browsers/internet-explorer/ie11-deploy-guide/images/ie-emie-grouppolicysitelist.png b/browsers/internet-explorer/ie11-deploy-guide/images/ie-emie-grouppolicysitelist.png deleted file mode 100644 index 14079ffd7c..0000000000 Binary files a/browsers/internet-explorer/ie11-deploy-guide/images/ie-emie-grouppolicysitelist.png and /dev/null differ diff --git a/browsers/internet-explorer/ie11-deploy-guide/images/ie-emie-logfile.png b/browsers/internet-explorer/ie11-deploy-guide/images/ie-emie-logfile.png deleted file mode 100644 index b58e2a21b8..0000000000 Binary files a/browsers/internet-explorer/ie11-deploy-guide/images/ie-emie-logfile.png and /dev/null differ diff --git a/browsers/internet-explorer/ie11-deploy-guide/images/ie-emie-logging.png b/browsers/internet-explorer/ie11-deploy-guide/images/ie-emie-logging.png deleted file mode 100644 index becf942ecd..0000000000 Binary files a/browsers/internet-explorer/ie11-deploy-guide/images/ie-emie-logging.png and /dev/null differ diff --git a/browsers/internet-explorer/ie11-deploy-guide/images/ie-emie-packageupdate.png b/browsers/internet-explorer/ie11-deploy-guide/images/ie-emie-packageupdate.png deleted file mode 100644 index 66480b5f6c..0000000000 Binary files a/browsers/internet-explorer/ie11-deploy-guide/images/ie-emie-packageupdate.png and /dev/null differ diff --git a/browsers/internet-explorer/ie11-deploy-guide/images/ie-emie-publishsolution.png b/browsers/internet-explorer/ie11-deploy-guide/images/ie-emie-publishsolution.png deleted file mode 100644 index a3daa4e483..0000000000 Binary files a/browsers/internet-explorer/ie11-deploy-guide/images/ie-emie-publishsolution.png and /dev/null differ diff --git a/browsers/internet-explorer/ie11-deploy-guide/images/ie-emie-publishweb.png b/browsers/internet-explorer/ie11-deploy-guide/images/ie-emie-publishweb.png deleted file mode 100644 index eaf44305e2..0000000000 Binary files a/browsers/internet-explorer/ie11-deploy-guide/images/ie-emie-publishweb.png and /dev/null differ diff --git a/browsers/internet-explorer/ie11-deploy-guide/images/ie-emie-registrysitelist.png b/browsers/internet-explorer/ie11-deploy-guide/images/ie-emie-registrysitelist.png deleted file mode 100644 index 3c32b1af1a..0000000000 Binary files a/browsers/internet-explorer/ie11-deploy-guide/images/ie-emie-registrysitelist.png and /dev/null differ diff --git a/browsers/internet-explorer/ie11-deploy-guide/images/ie-emie-reportwdetails.png b/browsers/internet-explorer/ie11-deploy-guide/images/ie-emie-reportwdetails.png deleted file mode 100644 index 7209452cf3..0000000000 Binary files a/browsers/internet-explorer/ie11-deploy-guide/images/ie-emie-reportwdetails.png and /dev/null differ diff --git a/browsers/internet-explorer/ie11-deploy-guide/images/ie-emie-toolsmenu.png b/browsers/internet-explorer/ie11-deploy-guide/images/ie-emie-toolsmenu.png deleted file mode 100644 index 66e8ecf082..0000000000 Binary files a/browsers/internet-explorer/ie11-deploy-guide/images/ie-emie-toolsmenu.png and /dev/null differ diff --git a/browsers/internet-explorer/ie11-deploy-guide/images/ie-site-discovery-sample-report.png b/browsers/internet-explorer/ie11-deploy-guide/images/ie-site-discovery-sample-report.png deleted file mode 100644 index c53b4d160e..0000000000 Binary files a/browsers/internet-explorer/ie11-deploy-guide/images/ie-site-discovery-sample-report.png and /dev/null differ diff --git a/browsers/internet-explorer/ie11-deploy-guide/images/ie11-inventory-addclassconnectscreen.png b/browsers/internet-explorer/ie11-deploy-guide/images/ie11-inventory-addclassconnectscreen.png deleted file mode 100644 index 629267fb62..0000000000 Binary files a/browsers/internet-explorer/ie11-deploy-guide/images/ie11-inventory-addclassconnectscreen.png and /dev/null differ diff --git a/browsers/internet-explorer/ie11-deploy-guide/images/ieoutdatedcontroloutsideofie.png b/browsers/internet-explorer/ie11-deploy-guide/images/ieoutdatedcontroloutsideofie.png deleted file mode 100644 index 8c1d246aaf..0000000000 Binary files a/browsers/internet-explorer/ie11-deploy-guide/images/ieoutdatedcontroloutsideofie.png and /dev/null differ diff --git a/browsers/internet-explorer/ie11-deploy-guide/images/ieoutdatedcontrolwarning.png b/browsers/internet-explorer/ie11-deploy-guide/images/ieoutdatedcontrolwarning.png deleted file mode 100644 index 4a6ea00e6f..0000000000 Binary files a/browsers/internet-explorer/ie11-deploy-guide/images/ieoutdatedcontrolwarning.png and /dev/null differ diff --git a/browsers/internet-explorer/ie11-deploy-guide/images/img-enterprise-mode-site-list-xml.jpg b/browsers/internet-explorer/ie11-deploy-guide/images/img-enterprise-mode-site-list-xml.jpg deleted file mode 100644 index 0bcfd3b650..0000000000 Binary files a/browsers/internet-explorer/ie11-deploy-guide/images/img-enterprise-mode-site-list-xml.jpg and /dev/null differ diff --git a/browsers/internet-explorer/ie11-deploy-guide/images/img-f12-developer-tools-emulation.jpg b/browsers/internet-explorer/ie11-deploy-guide/images/img-f12-developer-tools-emulation.jpg deleted file mode 100644 index 48ed75b701..0000000000 Binary files a/browsers/internet-explorer/ie11-deploy-guide/images/img-f12-developer-tools-emulation.jpg and /dev/null differ diff --git a/browsers/internet-explorer/ie11-deploy-guide/images/outdatedcontrolwarning.png b/browsers/internet-explorer/ie11-deploy-guide/images/outdatedcontrolwarning.png deleted file mode 100644 index 87e49b5093..0000000000 Binary files a/browsers/internet-explorer/ie11-deploy-guide/images/outdatedcontrolwarning.png and /dev/null differ diff --git a/browsers/internet-explorer/ie11-deploy-guide/images/securitybulletin-filter.png b/browsers/internet-explorer/ie11-deploy-guide/images/securitybulletin-filter.png deleted file mode 100644 index 73d11e3644..0000000000 Binary files a/browsers/internet-explorer/ie11-deploy-guide/images/securitybulletin-filter.png and /dev/null differ diff --git a/browsers/internet-explorer/ie11-deploy-guide/images/setdefaultbrowsergp.png b/browsers/internet-explorer/ie11-deploy-guide/images/setdefaultbrowsergp.png deleted file mode 100644 index 2a52b20e23..0000000000 Binary files a/browsers/internet-explorer/ie11-deploy-guide/images/setdefaultbrowsergp.png and /dev/null differ diff --git a/browsers/internet-explorer/ie11-deploy-guide/images/wedge.gif b/browsers/internet-explorer/ie11-deploy-guide/images/wedge.gif deleted file mode 100644 index aa3490aee9..0000000000 Binary files a/browsers/internet-explorer/ie11-deploy-guide/images/wedge.gif and /dev/null differ diff --git a/browsers/internet-explorer/ie11-deploy-guide/img-ie11-docmode-lg.md b/browsers/internet-explorer/ie11-deploy-guide/img-ie11-docmode-lg.md deleted file mode 100644 index 83c7c6b9b8..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/img-ie11-docmode-lg.md +++ /dev/null @@ -1,21 +0,0 @@ ---- -description: A full-sized view of how document modes are chosen in IE11. -title: Full-sized flowchart detailing how document modes are chosen in IE11 -author: dansimp -ms.date: 04/19/2017 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -ms.prod: ie11 ---- - -# Full-sized flowchart detailing how document modes are chosen in IE11 - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - - -Return to: [Deprecated document modes and Internet Explorer 11](deprecated-document-modes.md) - -:::image type="content" source="images/docmode-decisions-lg.png" alt-text="Full-sized flowchart detailing how document modes are chosen in IE11" lightbox="images/docmode-decisions-lg.png"::: - diff --git a/browsers/internet-explorer/ie11-deploy-guide/import-into-the-enterprise-mode-site-list-manager.md b/browsers/internet-explorer/ie11-deploy-guide/import-into-the-enterprise-mode-site-list-manager.md deleted file mode 100644 index f585e3210d..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/import-into-the-enterprise-mode-site-list-manager.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: If you need to replace your entire site list because of errors, or simply because it’s out of date, you can import your exported Enterprise Mode site list using the Enterprise Mode Site List Manager. -author: dansimp -ms.prod: ie11 -ms.assetid: cacd5d68-700b-4a96-b4c9-ca2c40c1ac5f -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Import your Enterprise Mode site list to the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Import your Enterprise Mode site list to the Enterprise Mode Site List Manager - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -If you need to replace your entire site list because of errors, or simply because it’s out of date, you can import your exported Enterprise Mode site list using the Enterprise Mode Site List Manager. - -**Important**   -Importing your file overwrites everything that’s currently in the tool, so make sure it’s what you really mean to do. - - **To import your compatibility list** - -1. On the **File** menu of the Enterprise Mode Site List Manager, click **Import**. - -2. Go to your exported .EMIE file (for example, `C:\users\\documents\sites.emie`), and then click **Open**. - -3. Review the alert message about all of your entries being overwritten. If you still want to import the file, click **Yes**. - -## Related topics -- [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) -- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) -- [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) - - - - - - diff --git a/browsers/internet-explorer/ie11-deploy-guide/index.md b/browsers/internet-explorer/ie11-deploy-guide/index.md deleted file mode 100644 index 75027dfd9d..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/index.md +++ /dev/null @@ -1,66 +0,0 @@ ---- -ms.mktglfcycl: deploy -description: Use this guide to learn about the several options and processes you'll need to consider while you're planning for, deploying, and customizing Internet Explorer 11 for your employee's devices. -author: dansimp -ms.author: dansimp -ms.prod: windows-client -ms.assetid: bddc2d97-c38d-45c5-9588-1f5bbff2e9c3 -title: Internet Explorer 11 (IE11) - Deployment Guide for IT Pros (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.localizationpriority: medium -manager: dansimp -ms.date: 02/24/2016 ---- - - -# Internet Explorer 11 (IE11) - Deployment Guide for IT Pros - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -Use this guide to learn about the several options and processes you'll need to consider while you're planning for, deploying, and customizing Internet Explorer 11 for your employee's computers. - -**Important**
              -Because this content isn't intended to be a step-by-step guide, not all of the steps are necessary to deploy IE11. - -## In this guide -|Topic |Description | -|------|------------| -|[Change history for Internet Explorer 11](change-history-for-internet-explorer-11.md) |Lists new and updated topics in the Internet Explorer 11 documentation for Windows 10. | -|[System requirements and language support for Internet Explorer 11 (IE11)](system-requirements-and-language-support-for-ie11.md) |IE11 is available for a number of systems and languages. This topic provides info about the minimum system requirements and language support. | -|[List of updated features and tools - Internet Explorer 11 (IE11)](updated-features-and-tools-with-ie11.md) |IE11 includes several new features and tools. This topic includes high-level info about the each of them. | -|[Install and Deploy Internet Explorer 11 (IE11)](install-and-deploy-ie11.md) |Use the topics in this section to learn how to customize your Internet Explorer installation package, how to choose the right method for installation, and how to deploy IE into your environment. You can also find more info about your virtualization options for legacy apps. | -|[Collect data using Enterprise Site Discovery](collect-data-using-enterprise-site-discovery.md) |Use IE to collect data on computers running Windows Internet Explorer 8 through IE11 on Windows 10, Windows 8.1, or Windows 7. This inventory information helps you build a list of websites used by your company so you can make more informed decisions about your IE deployments, including figuring out which sites might be at risk or require overhauls during future upgrades. | -|[Enterprise Mode for Internet Explorer 11 (IE11)](enterprise-mode-overview-for-ie11.md) |Use the topics in this section to learn how to set up and use Enterprise Mode, the Enterprise Mode Site List Manager, and the Enterprise Mode Site List Portal in your company. | -|[Group Policy and Internet Explorer 11 (IE11)](group-policy-and-ie11.md) |Use the topics in this section to learn about Group Policy and how to use it to manage IE. | -|[Manage Internet Explorer 11](manage-ie11-overview.md) |Use the topics in this section to learn about how to auto detect your settings, auto configure your configuration settings, and auto configure your proxy configuration settings for IE. | -|[Troubleshoot Internet Explorer 11 (IE11)](troubleshoot-ie11.md) |Use the topics in this section to learn how to troubleshoot several of the more common problems experienced with IE. | -|[Out-of-date ActiveX control blocking](out-of-date-activex-control-blocking.md) |ActiveX controls are small apps that let websites provide content, like videos, games, and let you interact with content like toolbars. Unfortunately, because many ActiveX controls aren’t automatically updated, they can become outdated as new versions are released. It’s important that you keep your ActiveX controls up-to-date because malicious software (or malware) can target security flaws in outdated controls, damaging your computer by collecting info from it, installing unwanted software, or by letting someone else control it remotely. To help avoid this situation, IE includes a new security feature, called out-of-date ActiveX control blocking. | -|[Deprecated document modes and Internet Explorer 11](deprecated-document-modes.md) |Internet Explorer 8 introduced document modes as a way to move from the proprietary coding of web features to a more standardized type of coding that could run on multiple browsers and devices. Starting with Windows 10, we’re deprecating document modes.

              This means that while IE11 will continue to support document modes, Microsoft Edge won’t. And because of that, it also means that if you want to use Microsoft Edge, you’re going to have to update your legacy webpages and apps to support modern features, browsers, and devices.

              Note
              For specific details about the technologies and APIs that are no longer supported in Microsoft Edge, see [A break from the past, part 2: Saying goodbye to ActiveX, VBScript, attachEvent](https://go.microsoft.com/fwlink/p/?LinkId=615953). | -|[What is the Internet Explorer 11 Blocker Toolkit?](what-is-the-internet-explorer-11-blocker-toolkit.md) |The IE11 Blocker Toolkit lets you turn off the automatic delivery of IE11 through the Automatic Updates feature of Windows Update. | -|[Missing Internet Explorer Maintenance (IEM) settings for Internet Explorer 11](missing-internet-explorer-maintenance-settings-for-ie11.md) |The Internet Explorer Maintenance (IEM) settings have been deprecated in favor of Group Policy preferences, Administrative Templates (.admx), and the Internet Explorer Administration Kit 11 (IEAK 11).

              Because of this change, your IEM-configured settings will no longer work on computers running Internet Explorer 10 or newer. To fix this, you need to update the affected settings using Group Policy preferences, Administrative Templates (.admx), or the IEAK 11.

              Because Group Policy Preferences and IEAK 11 run using asynchronous processes, you should choose to use only one of the tools within each group of settings. For example, using only IEAK 11 in the Security settings or Group Policy Preferences within the Internet Zone settings. Also, it's important to remember that policy is enforced and can't be changed by the user, while preferences are configured, but can be changed by the user. | -|[Missing the Compatibility View Button](missing-the-compatibility-view-button.md) |Compatibility View was introduced in Internet Explorer 8 to help existing content continue to work with Windows Internet Explorer 7, while developers updated their content to support modern interoperable web standards. Since then, the IE web platform, and the web itself, have changed so that most public web content looks for standards-based features instead of IE 7-compatible behavior.

              Thanks to these changes, using IE11 in the latest standards mode is more compatible with the web than ever before. As a result, IE11 simplifies web page compatibility for users by removing the Compatibility View button and reducing the number of compatibility options in the F12 developer tools for developers. | -|[Deploy pinned websites using Microsoft Deployment Toolkit (MDT) 2013](deploy-pinned-sites-using-mdt-2013.md) |You can pin websites to the Windows 8.1 taskbar for quick access. You pin a website simply by dragging its tab to the taskbar. Some websites can also extend the icon’s Jump List.

              The ability to pin websites to the Windows 8.1 taskbar can help make end-users in businesses more productive. As an IT professional, for example, you can pin intranet and SharePoint websites to the taskbar to make them immediately available to employees. In this article, you learn how to deploy pinned websites by using Lite Touch Installation in the [Microsoft Deployment Toolkit (MDT) 2013](/mem/configmgr/mdt/). - - -## IE11 naming conventions -IE11 offers differing experiences in Windows 8.1: - -|Name |Description | -|-----|------------| -|Internet Explorer or IE |The immersive browser, or IE, without a specific version. | -|Internet Explorer for the desktop |The desktop browser. This is the only experience available when running IE11 on Windows 7 SP1 | -|Internet Explorer 11 or IE11 |The whole browser, which includes both IE and Internet Explorer for the desktop. | - -## Related topics -- [Internet Explorer 11 - FAQ for IT Pros](../ie11-faq/faq-for-it-pros-ie11.yml) -- [Internet Explorer Administration Kit 11 (IEAK 11) - Administrator's Guide](../ie11-ieak/index.md) -- [Microsoft Edge - Deployment Guide for IT Pros](/microsoft-edge/deploy/) diff --git a/browsers/internet-explorer/ie11-deploy-guide/install-and-deploy-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/install-and-deploy-ie11.md deleted file mode 100644 index 47a4d07569..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/install-and-deploy-ie11.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: Use the topics in this section to learn how to customize your Internet Explorer installation package, how to choose the right method for installation, and how to deploy IE into your environment. -author: dansimp -ms.prod: ie11 -ms.assetid: caca18c1-d5c4-4404-84f8-d02bc562915f -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Install and Deploy Internet Explorer 11 (IE11) (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Install and Deploy Internet Explorer 11 (IE11) - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - - -**Applies to:** - -- Windows 10 -- Windows 8.1 Update -- Windows 7 with Service Pack 1 (SP1) -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -Use the topics in this section to learn how to customize your Internet Explorer installation package, how to choose the right method for installation, and how to deploy IE into your environment. You can also find more info about your virtualization options for legacy apps. - -## In this section - -|Topic |Description | -|------|------------| -|[Customize Internet Explorer 11 installation packages](customize-ie11-install-packages.md) |Guidance about how to use .INF files or the IE Administration Kit 11 (IEAK 11) to create custom packages and about how to create those packages for multiple operating systems. | -|[Choose how to install Internet Explorer 11 (IE11)](choose-how-to-install-ie11.md) |Guidance for the different ways you can install IE, including using System Center 2012 R2 Configuration Manager, Windows Server Update Services (WSUS), Microsoft Intune, your network, the operating system deployment system, or third-party tools. | -|[Choose how to deploy Internet Explorer 11 (IE11)](choose-how-to-deploy-ie11.md) |Guidance about how to deploy your custom version of IE using Automatic Version Synchronization (AVS) or using your software distribution tools. | -|[Virtualization and compatibility with Internet Explorer 11](virtualization-and-compatibility-with-ie11.md) |Info about the Microsoft-supported options for virtualizing web apps. | - - - - - - - - diff --git a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-microsoft-intune.md b/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-microsoft-intune.md deleted file mode 100644 index 0ec2a15346..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-microsoft-intune.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to add and deploy the Internet Explorer 11 update using Microsoft Intune. -author: dansimp -ms.prod: ie11 -ms.assetid: b2dfc08c-78af-4c22-8867-7be3b92b1616 -ms.reviewer: -manager: dansimp -ms.author: dansimp -title: Install Internet Explorer 11 (IE11) using Microsoft Intune (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Install Internet Explorer 11 (IE11) using Microsoft Intune - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -Internet Explorer 11 is available as an update in Microsoft Intune. Microsoft Intune uses Windows cloud services to help you manage updates, monitor and protect your computers, provide remote assistance, track hardware and software inventory, and set security policies. For more information, see the [Documentation Library for Microsoft Intune](/mem/intune/). - -## Adding and deploying the IE11 package -You can add and then deploy the IE11 package to any computer that's managed by Microsoft Intune. - - **To add the IE11 package** - -1. From the Microsoft Intune administrator console, start the Microsoft Intune Software Publisher. - -2. Add your IE11 package as either an external link or as a Windows installer package (.exe or .msi). - -For more info about how to decide which one to use, and how to use it, see [Deploy and configure apps](/mem/intune/). - - **To automatically deploy and install the IE11 package** - -1. From the Microsoft Intune administrator console, start and run through the Deploy Software wizard. - -2. Deploy the package to any of your employee computers that are managed by Microsoft Intune. - -3. After the package is on your employee's computers, the installation process runs, based on what you set up in your wizard. - -For more info about this, see [Deploy and configure apps](/mem/intune/). - - **To let your employees install the IE11 package** - -1. Install the package on your company's Microsoft Intune site, marking it as **Available** for the appropriate groups. - -2. Any employee in the assigned group can now install the package. - -For more info about this, see [Update apps using Microsoft Intune](/mem/intune/apps/apps-windows-10-app-deploy) - -  - -  \ No newline at end of file diff --git a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-operating-system-deployment-systems.md b/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-operating-system-deployment-systems.md deleted file mode 100644 index 469b700481..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-operating-system-deployment-systems.md +++ /dev/null @@ -1,60 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to install the Internet Explorer 11 update using Microsoft Deployment Toolkit (MDT) and your Windows images. -author: dansimp -ms.prod: ie11 -ms.assetid: e16f9144-170c-4964-a62d-0d1a16f4cd1f -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Install Internet Explorer 11 (IE11) using Microsoft Deployment Toolkit (MDT) and your Windows images (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Install Internet Explorer 11 (IE11) using Microsoft Deployment Toolkit (MDT) and your Windows images - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - - -You can install Internet Explorer 11 (IE11) using Microsoft Deployment Toolkit (MDT) and your Windows images. - -You'll need to extract the .cab file for each supported operating system and platform combination and the .msu file for each prerequisite update. Download the IE11 update and prerequisites here: - -- [Microsoft Download Center](https://go.microsoft.com/fwlink/p/?LinkId=279697) - -- [Microsoft Update Catalog](https://go.microsoft.com/fwlink/p/?LinkId=214287) - -After you install the .msu file updates, you'll need to add them to your MDT deployment. You'll also need to extract the IE11 .cab update file from the IE11 installation package, using the `/x` command-line option. For example, `IE11-Windows6.1-x64-en-us.exe /x:c:\ie11cab`. - -## Installing IE11 using Microsoft Deployment Toolkit (MDT) - -MDT adds IE11 to your Windows images, regardless whether you are creating or deploying a customized or non-customized image. MDT also lets you perform offline servicing during the System Center 2012 R2 Configuration Manager task sequence, letting you add IE11 before starting Windows. For info, see [Microsoft Deployment Toolkit (MDT)](/mem/configmgr/mdt/). - - **To add IE11 to a MDT deployment share** - -1. Right-click **Packages** from each **Deployment Shares** location, and then click **Import OS Packages**. - -2. Go to the **Specify Directory** page, search for your folder with your update files (.cab and .msu) for import, and click **Next**. - -3. Go to the **Summary** page and click **Next**.

              -MDT starts importing your update files.

              **Note**
              Ignore any warnings that say, "Skipping invalid CAB file". This shows up because the **Import OS Packages** wizard skips the IE11\_Support.cab file, which isn't an actual update file. - -4. After the import finishes, click **Finish**. - -### Offline servicing with MDT - -You can add the IE11 update while you're performing offline servicing, or slipstreaming, of your Windows images. This method lets you deploy IE11 without needing any additional installation after you've deployed Windows. - -These articles have step-by-step details about adding packages to your Windows images: - -- For Windows 8.1, see [Add or Remove Packages Offline Using DISM](/previous-versions/windows/it-pro/windows-8.1-and-8/hh824838(v=win.10)). - -- For Windows 7 SP1, see [Add or Remove Packages Offline](/previous-versions/windows/it-pro/windows-7/dd744559(v=ws.10)). - -  - -  \ No newline at end of file diff --git a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-system-center-configuration-manager.md b/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-system-center-configuration-manager.md deleted file mode 100644 index b8083e1f8d..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-system-center-configuration-manager.md +++ /dev/null @@ -1,39 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: How to install the Internet Explorer 11 update using System Center 2012 R2 Configuration Manager -author: dansimp -ms.prod: windows-client -ms.assetid: 9ede9722-29b3-4cb7-956d-ffa91e7bedbd -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Install Internet Explorer 11 (IE11) using System Center 2012 R2 Configuration Manager (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Install Internet Explorer 11 (IE11) using System Center 2012 R2 Configuration Manager - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -You can install Internet Explorer 11 (IE11) by using [System Center R2 2012 Configuration Manager](/previous-versions/system-center/system-center-2012-R2/gg682129(v=technet.10)). Complete these steps for each operating system and platform combination. - - **To install IE11** - -1. Download and approve the [System requirements and language support for Internet Explorer 11 (IE11)](system-requirements-and-language-support-for-ie11.md). - -2. Create a software distribution package that includes the IE11 installation package. - -3. Create a program that includes the command-line needed to run the IE11 installation package. To run the package silently, without restarting and without checking the Internet for updates, use:`ie11_package.exe /quiet /norestart /update-no`. - -4. Move the installation package to your distribution points, and then advertise the package. - -You can also use System Center Essentials 2010 to deploy IE11 installation packages. For info, see [System Center Essentials 2010](https://go.microsoft.com/fwlink/p/?linkid=395200) and the [System Center Essentials 2010 Operations Guide](https://go.microsoft.com/fwlink/p/?LinkId=214266). - -  - -  \ No newline at end of file diff --git a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-the-network.md b/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-the-network.md deleted file mode 100644 index d0d9d17be1..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-the-network.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to install the Internet Explorer 11 update using your network -author: dansimp -ms.prod: ie11 -ms.assetid: 85f6429d-947a-4031-8f93-e26110a35828 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Install Internet Explorer 11 (IE11) using your network (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Install Internet Explorer 11 (IE11) using your network - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -You can install Internet Explorer 11 (IE11) over your network by putting your custom IE11 installation package in a shared network folder and letting your employees run the Setup program on their own computers. You can create the network folder structure manually, or you can run Internet Explorer Administration Kit 11 (IEAK 11). - -**Note**
              If you support multiple architectures and operating systems, create a subfolder for each combination. If you support multiple languages, create a subfolder for each localized installation file. - - **To manually create the folder structure** - -- Copy your custom IE11 installation file into a folder on your network, making sure it's available to your employees. - - **To create the folder structure using IEAK 11** - -- Run the Internet Explorer Customization Wizard 11 in IEAK 11, using the **Full Installation Package** option.

              - The wizard automatically puts your custom installation files in your `\\Flat` folder. Where the `` is the location of your other build files. - -**Note**
              Use the localized versions of the IE Customization Wizard 11 to create localized IE11 installation packages. - -## Related topics -- [Internet Explorer Administration Kit 11 (IEAK 11) - Administration Guide for IT Pros](../ie11-ieak/index.md) - - - - - - - - diff --git a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-third-party-tools.md b/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-third-party-tools.md deleted file mode 100644 index d593de27c6..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-third-party-tools.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to install the Internet Explorer 11 update using third-party tools and command-line options. -author: dansimp -ms.prod: ie11 -ms.assetid: 30190c66-49f7-4ca4-8b57-a47656aa0c7e -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Install Internet Explorer 11 (IE11) using third-party tools (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Install Internet Explorer 11 (IE11) using third-party tools - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -You can install Internet Explorer 11 (IE11) using third-party electronic software distribution (ESD) systems and these command-line options: - -## Setup Modes - -|Command-line options |Description | -|---------------------|------------------------------------------------------| -|`/passive` |Installs without customer involvement. | -|`/quiet` |Installs without customer involvement and without showing the UI. | - -## Setup Options - -|Command-line options |Description | -|---------------------|------------------------------------------------------| -|`/update-no` |Installs without checking for updates.

              **Important**
              If you don't use this option, you'll need an Internet connection to finish your installation. | -|`/no-default` |Installs without making IE11 the default web browser. | -|`/closeprograms` |Automatically closes running programs. | - - -## Restart Options - -|Command-line options |Description | -|---------------------|------------------------------------------------------| -|`/norestart` |Installs without restarting the computer. | -|`/forcerestart` |Installs and restarts after installation. | - -  - -  - -  - - - diff --git a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-windows-server-update-services-wsus.md b/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-windows-server-update-services-wsus.md deleted file mode 100644 index 07b0485309..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-windows-server-update-services-wsus.md +++ /dev/null @@ -1,52 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to install the Internet Explorer 11 update using Windows Server Update Services (WSUS)' -author: dansimp -ms.prod: ie11 -ms.assetid: 6cbd6797-c670-4236-8423-e0919478f2ce -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Install Internet Explorer 11 (IE11) using Windows Server Update Services (WSUS) (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Install Internet Explorer 11 (IE11) using Windows Server Update Services (WSUS) - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -Windows Server Update Services (WSUS) lets you download a single copy of the Microsoft product update and cache it on your local WSUS servers. You can then configure your computers to get the update from your local servers instead of Windows Update. For more information about WSUS, see [Windows Server Update Services](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh852345(v=ws.11)). - - **To import from Windows Update to WSUS** - -1. Open your WSUS admin site. For example, `https:///WSUSAdmin/`.

              - Where `` is the name of your WSUS server. - -2. Choose the top server node or the **Updates** node, and then click **Import Updates**. - -3. To get the updates, install the Microsoft Update Catalog ActiveX control. - -4. Search for Internet Explorer 11 and add its contents to your basket. - -5. After you're done browsing, go to your basket and click **Import**. - - You can also download the updates without importing them by unchecking the **Import directly into Windows Server Update Services** box. - - **To approve Internet Explorer in WSUS for installation** - -6. Open your WSUS admin site and check the **Review synchronization settings** box from the **To Do** list. - -7. Click **Synchronize now** to sync your WSUS server with Windows Update, and then click **Updates** from the navigation bar. - -8. Enter **Internet Explorer 11** into the **Search Contains** box, and then click **Apply**. - -9. Choose the right version of IE11 for your operating system, and click **Approve for installation**. - -10. Click each computer group you want to set up for the WSUS server, picking the right approval level, and then click **OK**. - - - diff --git a/browsers/internet-explorer/ie11-deploy-guide/install-problems-with-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/install-problems-with-ie11.md deleted file mode 100644 index 09442d827c..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/install-problems-with-ie11.md +++ /dev/null @@ -1,65 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to fix potential installation problems with Internet Explorer 11 -author: dansimp -ms.prod: windows-client -ms.assetid: 3ae77745-86ac-40a9-a37d-eebbf37661a3 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Install problems with Internet Explorer 11 (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Install problems with Internet Explorer 11 - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -Most Internet Explorer 11 installations are straightforward and work the way they should. But it's possible that you might have problems. - -If you do, you can: - -- Check that you meet the minimum operating system requirements and have the prerequisites installed. - -- Check that there are no other updates or restarts waiting. - -- Temporarily turn off your antispyware and antivirus software. - -- Try another IE11 installer. For example from [Windows Update](https://go.microsoft.com/fwlink/p/?LinkId=302315) or from the [Download Internet Explorer 11](https://go.microsoft.com/fwlink/p/?linkid=327753) website. - -- Review the `IE11_main.log` file in the `\Windows` folder. This log file has information about each installation and is appended for each subsequent installation. - -- Make sure you use the same download server URLs that you entered during the Setup process. - -## Internet Explorer didn't finish installing -If Internet Explorer doesn't finish installing, it might mean that Windows Update wasn't able to install an associated update, that you have a previous, unsupported version of IE installed, or that there's a problem with your copy of IE. We recommend you try this: - - **To fix this issue** - -1. Uninstall IE: - - 1. In the Control Panel, open the **Programs and Features** box, scroll down to IE11, and then click **Uninstall**. - - 2. After the uninstall finishes, restart your computer. - -2. Run [Windows Update](https://go.microsoft.com/fwlink/p/?LinkId=302315), clicking **Check for updates**. - -3. Check the list for IE11. If it's included in the list of updates for download, exclude it before you update your computer.

              -If you get an error during the Windows Update process, see [Fix the problem with Microsoft Windows Update that is not working](https://go.microsoft.com/fwlink/p/?LinkId=302316). - -4. Restart your computer, making sure all of your the updates are finished. - -5. Try to reinstall IE11 from either Windows Update (if you saw it in Step 3) or from the [Download Internet Explorer 11](https://go.microsoft.com/fwlink/p/?linkid=327753) website. - - - -  - -  - - - diff --git a/browsers/internet-explorer/ie11-deploy-guide/intranet-problems-and-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/intranet-problems-and-ie11.md deleted file mode 100644 index 803fc7fb83..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/intranet-problems-and-ie11.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to fix intranet search problems with Internet Explorer 11 -author: dansimp -ms.prod: ie11 -ms.assetid: 3ee71d93-d9d2-48e1-899e-07932c73faa6 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Fix intranet search problems with Internet Explorer 11 (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Fix intranet search problems with Internet Explorer 11 - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -After upgrading to Internet Explorer 11, you might experience search issues while using your intranet site. - -## Why is my intranet redirecting me to search results? -IE11 works differently with search, based on whether your organization is domain-joined. - -- **Domain-joined computers.** A single word entry is treated as a search term. However, IE11 also checks for available intranet sites and offers matches through the **Notification bar**. If you select **Yes** from the **Notification bar** to navigate to the intranet site, IE11 associates that word with the site so that the next time you type in the intranet site name, inline auto-complete will resolve to the intranet site address. - -- **Non-domain-joined computers.** A single word entry is treated as an intranet site. However, if the term doesn't resolve to a site, IE11 then treats the entry as a search term and opens your default search provider. - -To explicitly go to an intranet site, regardless of the environment, users can type either a trailing slash like `contoso/` or the `https://` prefix. Either of these will cause IE11 to treat the entry as an intranet search. You can also change the default behavior so that IE11 treats your single word entry in the address bar as an intranet site, regardless of your environment. - - **To enable single-word intranet search** - -1. Open Internet Explorer for the desktop, click the **Tools** menu, and then click **Internet Options**. - -2. Click **Advanced**, check the **Go to an intranet site for a single word entry in the Address bar** box, and then click **OK**. - -If you'd like your entire organization to have single word entries default to an intranet site, you can turn on the **Go to an intranet site for a single word entry in the Address bar** Group Policy. With this policy turned on, a search for `contoso` automatically resolves to `https://contoso`. - -  - -  - - - diff --git a/browsers/internet-explorer/ie11-deploy-guide/manage-ie11-overview.md b/browsers/internet-explorer/ie11-deploy-guide/manage-ie11-overview.md deleted file mode 100644 index 58a2d5298b..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/manage-ie11-overview.md +++ /dev/null @@ -1,39 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: Use the topics in this section to learn about how to auto detect your settings, auto configure your configuration settings, and auto configure your proxy configuration settings for Internet Explorer. -author: dansimp -ms.prod: ie11 -ms.assetid: eb3cce62-fc7b-41e3-97b6-2916b85bcf55 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Manage Internet Explorer 11 (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Manage Internet Explorer 11 - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -Use the topics in this section to learn about how to auto detect your settings, auto configure your configuration settings, and auto configure your proxy configuration settings for Internet Explorer. - -## In this section - -|Topic |Description | -|------|------------| -|[Auto detect settings Internet Explorer 11](auto-detect-settings-for-ie11.md) |Guidance about how to update your automatic detection of DHCP and DNS servers. | -|[Auto configuration settings for Internet Explorer 11](auto-configuration-settings-for-ie11.md) |Guidance about how to add, update and lock your auto configuration settings. | -|[Auto proxy configuration settings for Internet Explorer 11](auto-proxy-configuration-settings-for-ie11.md) |Guidance about how to add, update, and lock your auto-proxy settings. | diff --git a/browsers/internet-explorer/ie11-deploy-guide/missing-internet-explorer-maintenance-settings-for-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/missing-internet-explorer-maintenance-settings-for-ie11.md deleted file mode 100644 index e3e56157b3..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/missing-internet-explorer-maintenance-settings-for-ie11.md +++ /dev/null @@ -1,101 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: support -description: IEM-configured settings have been deprecated for Internet Explorer 10 and newer. Use this topic to learn where to go to fix the affected settings through Group Policy Preferences, Administrative Templates (.admx), or the IEAK. -author: dansimp -ms.prod: ie11 -ms.assetid: 89084e01-4e3f-46a6-b90e-48ee58d6821c -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Missing Internet Explorer Maintenance settings for Internet Explorer 11 (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Missing Internet Explorer Maintenance settings for Internet Explorer 11 - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -The Internet Explorer Maintenance (IEM) settings have been deprecated in favor of Group Policy Preferences, Administrative Templates (.admx), and the IE Administration Kit 11 (IEAK 11). - -Because of this change, your IEM-configured settings will no longer work on computers running Internet Explorer 10 or newer. To fix this, you need to update the affected settings using Group Policy Preferences, Administrative Templates (.admx), or IE Administration Kit 11 (IEAK 11). - -Because Group Policy Preferences and IEAK 11 run using asynchronous processes, you should choose to use only one of the tools within each group of settings. For example, using only IEAK 11 in the **Security** settings or Group Policy Preferences within the **Internet Zone** settings. Also, it's important to remember that policy is enforced and can't be changed by the user, while preferences are configured, but can be changed by the user. - -For more information about all of the new options and Group Policy, see: - -- [Group policy preferences and Internet Explorer 11](group-policy-preferences-and-ie11.md) - -- [Administrative templates and Internet Explorer 11](administrative-templates-and-ie11.md) - -- [Internet Explorer Administration Kit 11 (IEAK 11) - Administration Guide for IT Pros](../ie11-ieak/index.md) - -- [Group Policy Settings Reference for Windows and Windows Server](https://go.microsoft.com/fwlink/p/?LinkId=279876) - -- [Group Policy ADMX Syntax Reference Guide](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc753471(v=ws.10)) - -- [Enable and Disable Settings in a Preference Item](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc754299(v=ws.11)) - -## IEM replacements -The IEM settings have replacements you can use in either Group Policy Preferences or IEAK 11. - -### Browser user interface replacements - -|IEM setting |Description |Replacement tool | -|------------|------------|-----------------| -|Browser title |Lets you customize the text that shows up in the title bar of the browser.|On the **Browser User Interface** page of IEAK 11, click **Customize Title Bars**, and then type the text that appears on the title bar of the **Title Bar Text** box.

              Your text is appended to the text," Microsoft Internet Explorer provided by". | -|Browser toolbar customizations (background and buttons) |Lets you customize the buttons on the browser toolbar.

              • **Buttons.** Customizes the buttons on the Internet Explorer 11 toolbar.
              • **Background.** No longer available.
              |On the **Browser User Interface** page of IEAK 11, click **Add**, type your new toolbar caption, action, and icon, and if the button should appear by default, and then click **OK**. You can also edit, remove, or delete an existing toolbar button from this page. | -|Custom logo and animated bitmaps |Lets you replace the static and animated logos in the upper-right corner of the IE window with customized logos. |This setting isn't available anymore. | - - -### Connection replacements - -|IEM setting |Description |Replacement tool | -|------------|------------|-----------------| -|Connection settings|Lets you import your connection settings from a previously set up computer. These settings define how your employees interact with the connection settings on the **System Polices and Restrictions** page. You can also remove old dial-up connections settings from your employee's computers.|In the **Internet Settings Group Policy Preferences** dialog box, click the **Connections** tab, and set up your proxy settings.

              -OR-

              On the **Connection Settings** page of IEAK 11, change your connection settings, including importing your current connection settings and deleting existing dial-up connection settings (as needed). | -|Automatic browser configuration |Lets you update your employee's computer after you've deployed IE11, by specifying a URL to an .ins file, an auto-proxy URL, or both. You can decide when the update occurs, in minutes. Typing zero, or not putting in any number, means that automatic configuration only happens after the browser is started and used to go to a page. |In the **Internet Settings Group Policy Preferences** dialog box, click the **Automatic Configuration** tab, and then add your URL.

              On the **Automatic Configuration** page of IEAK 11, modify the configuration settings, including providing the URL to an .ins file or an auto-proxy site. | -|Proxy settings |Lets you specify your proxy servers. |In the **Internet Settings Group Policy Preferences** dialog box, click the **Connections** tab, click **LAN Settings**, and then choose whether to turn on automatic detection of your configuration settings and if you want to use proxy servers.

              -OR-

              On the **Proxy Settings** page of IEAK 11, turn on your proxy settings, adding your proxy server addresses and exceptions. | -|User Agent string |Lets the browser provide identification to visited servers. This string is often used to keep Internet traffic statistics. |This setting isn't available anymore. | - -### URLs replacements - -|IEM setting |Description |Replacement tool | -|------------|------------|-----------------| -|Favorites and links |Lets you use custom URLs for the **Favorites** and **Links** folders. You can also specify the folder order, disable IE Suggested Sites, and import an existing folder structure. |On the **Favorites, Favorites Bar and Feeds** page of IEAK 11, add your custom URLs to the **Favorites**, **Favorites Bar**, or **RSS Feeds** folders, or create new folders.

              You can also edit, test, or remove your URLs, sort the list order, or disable IE Suggested Sites. | -|Important URLs |Lets you add custom **Home** pages that can open different tabs. You can also add a **Support** page that shows up when an employee clicks online Help.|In the **Internet Settings Group Policy Preferences** dialog box, click the **General** tab, and add your custom **Home** page.

              On the **Important URLs - Home page and Support** page of IEAK 11, add the custom URLs to your **Home** and **Support** pages.

              You can also click to retain the previous home page information when the user upgrades to a newer version of IE. | - -### Security Zones and Content Ratings - -|IEM setting |Description |Replacement tool | -|------------|------------|-----------------| -|Security zones |Lets you change your security settings, by zone |In the **Internet Settings Group Policy Preferences** dialog box, click the **Security** tab, and update your security settings, based on zone.

              -OR-

              On the **Security and Privacy Settings** page of IEAK 11, choose your **Security Zones and Privacy** setting, changing it, as necessary. | -|Content ratings |Lets you change your content ratings so your employees can't view sites with risky content. |On the **Security and Privacy Settings** page of IEAK 11, choose your **Content Ratings** setting, changing it, as necessary. | -|Authenticode settings |Lets you pick your trustworthy software publishers and stop your employees from adding new, untrusted publishers while browsing. |These settings aren't available anymore. | - -### Programs - -|IEM setting |Description |Replacement tool | -|------------|------------|-----------------| -|Programs |Lets you import your default program settings, which specify the programs Windows uses for each Internet service. |In the **Internet Settings Group Policy Preferences** dialog box, click the **Programs** tab, and choose how to open IE11 links.

              -OR-

              On the **Programs** page of IEAK 11, choose whether to customize or import your program settings. | - -#### Advanced IEM settings -The Advanced IEM settings, including Corporate and Internet settings, were also deprecated. However, they also have replacements you can use in either Group Policy Preferences or IEAK 11. - -**Note**
              Advanced IEM Settings were shown under **Programs** and only available when running in **Preference** mode. - -|IEM setting |Description |Replacement tool | -|------------|------------|-----------------| -|Corporate settings |Specifies the location of the file with the settings you use to make IE work best in your organization. |On the Additional Settings page of IEAK 11, expand Corporate Settings, and then customize how your organization handles temporary Internet files, code downloads, menu items, and toolbar buttons. | -|Internet settings |Specifies the location of the file that includes your default IE settings. |In the Internet Settings Group Policy Preferences dialog box, click the Advanced tab, and then update your Internet-related settings, as required

              -OR-

              On the Additional Settings page of IEAK 11, expand Internet Settings, and then customize your default values in the Internet Options dialog box. | \ No newline at end of file diff --git a/browsers/internet-explorer/ie11-deploy-guide/missing-the-compatibility-view-button.md b/browsers/internet-explorer/ie11-deploy-guide/missing-the-compatibility-view-button.md deleted file mode 100644 index a002fae480..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/missing-the-compatibility-view-button.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: support -description: Internet Explorer 11 uses the latest standards mode, which simplifies web page compatibility for users by removing the **Compatibility View** button and reducing the number of compatibility options in the F12 developer tools for developers. -author: dansimp -ms.prod: windows-client -ms.assetid: 501c96c9-9f03-4913-9f4b-f67bd9edbb61 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Missing the Compatibility View Button (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Missing the Compatibility View Button - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -Compatibility View was introduced in Windows Internet Explorer 8 to help existing content continue to work with Windows Internet Explorer 7, while developers updated their content to support modern interoperable web standards. Since then, the Internet Explorer web platform, and the web itself, have changed so that most public web content looks for standards-based features instead of IE 7-compatible behavior. - -Thanks to these changes, using Internet Explorer 11 in the latest standards mode is more compatible with the web than ever before. As a result, IE11 simplifies web page compatibility for users by removing the **Compatibility View** button and reducing the number of compatibility options in the F12 developer tools for developers. - -## What happened to the Compatibility View button? -In previous versions of IE, the **Compatibility View** button would attempt to fix a broken standards-based website, by getting the page to appear like it did in Internet Explorer 7. Today however, more standards-based websites are broken by attempting to appear like they did in Internet Explorer 7. So instead of implementing and using Compatibility View, developers are updating their server configuration to add X-UA-Compatible meta tags, which forces the content to the “edge”, making the **Compatibility View** button disappear. In support of these changes, the Compatibility View button has been completely removed for IE11. - -## What if I still need Compatibility View? -There might be extenuating circumstances in your company, which require you to continue to use Compatibility View. In this situation, this process should be viewed strictly as a workaround. You should work with the website vendor to make sure that the affected pages are updated to match the latest web standards. The functionality described here is currently deprecated and will be removed at a time in the future. - -**Important**
              This functionality is only available in Internet Explorer for the desktop. - - **To change your Compatibility View settings** - -1. Open Internet Explorer for the desktop, click **Tools**, and then click **Compatibility View settings**. - -2. In the **Compatibility View Settings** box, add the problematic website URL, and then click **Add**.

              -Compatibility View is turned on for this single website, for this specific computer. - -3. Decide if you want your intranet sites displayed using Compatibility View, decide whether to use Microsoft compatibility lists, and then click **Close**. - -  - -  - - - diff --git a/browsers/internet-explorer/ie11-deploy-guide/net-framework-problems-with-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/net-framework-problems-with-ie11.md deleted file mode 100644 index 6c68a1ec01..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/net-framework-problems-with-ie11.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: support -description: How to turn managed browser hosting controls back on in Internet Explorer 11. -author: dansimp -ms.prod: ie11 -ms.assetid: b0b7f60f-9099-45ab-84f4-4ac64d7bcb43 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: .NET Framework problems with Internet Explorer 11 (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# .NET Framework problems with Internet Explorer 11 - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - - -## Summary - -If you’re having problems launching your legacy apps while running Internet Explorer 11, it’s most likely because Internet Explorer no longer starts apps that use managed browser hosting controls, like in .NET Framework 1.1 and 2.0. - - **To turn managed browser hosting controls back on** - -1. **For x86 systems or for 64-bit processes on x64 systems:** Go to the `HKLM\SOFTWARE\MICROSOFT\.NETFramework` registry key and change the **EnableIEHosting** value to **1**. - -2. **For 32-bit processes on x64 systems:** Go to the `HKLM\SOFTWARE\Wow6432Node\MICROSOFT\.NETFramework` registry key and change the **EnableIEHosting** value to **1**. - -## More information - -IEHost is a Microsoft .NET Framework 1.1-based technology that provides a better model than ActiveX controls to host controls within the browser. The IEHost controls are lightweight and are operated under the .NET security model where they are operated inside a sandbox.  - -From the .NET Framework 4, we remove the IEHost.dll file for the following reasons: - -- IEHost/HREF-EXE-style controls are exposed to the Internet. This poses a high security risk, and most customers who install the Framework are benefiting very little from this security risk. -- Managed hosting controls and invoking random ActiveX controls may be unsafe, and this risk cannot be countered in the .NET Framework. Therefore, the ability to host is disabled. We strongly suggest that IEHost should be disabled in any production environment. -- Potential security vulnerabilities and assembly versioning conflicts in the default application domain. By relying on COM Interop wrappers to load your assembly, it is implicitly loaded in the default application domain. If other browser extensions do the same function, they have the risks in the default application domain such as disclosing information, and so on. If you are not using strong-named assemblies as dependencies, type loading exceptions can occur. You cannot freely configure the common language runtime (CLR), because you do not own the host process, and you cannot run any code before your extension is loaded. - -For more information about .NET Framework application compatibility, see [Application compatibility in the .NET Framework](/dotnet/framework/migration-guide/application-compatibility). diff --git a/browsers/internet-explorer/ie11-deploy-guide/new-group-policy-settings-for-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/new-group-policy-settings-for-ie11.md deleted file mode 100644 index 1dd3438086..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/new-group-policy-settings-for-ie11.md +++ /dev/null @@ -1,78 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: security -description: New group policy settings for Internet Explorer 11 -author: dansimp -ms.prod: windows-client -ms.assetid: 669cc1a6-e2cb-403f-aa31-c1de52a615d1 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: New group policy settings for Internet Explorer 11 (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# New group policy settings for Internet Explorer 11 - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -Internet Explorer 11 gives you some new Group Policy settings to help you manage your company's web browser configurations, including: - - -| Policy | Category Path | Supported on | Explanation | -|-----------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Allow IE to use the HTTP2 network protocol | Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page | IE11 on Windows 10 | This policy setting determines whether IE uses the HTTP2 network protocol. HTTP2 works with HTTP requests to optimize the latency of network requests through compression, multiplexing, and prioritization.

              If you enable this policy setting, IE uses the HTTP2 network protocol.

              If you disable this policy setting, IE won't use the HTTP2 network protocol.

              If you don't configure this policy setting, users can turn this behavior on or off, using the **Internet Explorer Advanced Internet Options** settings. The default is on. | -| Allow IE to use the SPDY/3 network protocol | Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page | IE11 on Windows 10 | This policy setting determines whether Internet Explorer uses the SPDY/3 network protocol. SPDY/3 works with HTTP requests to optimize the latency of network requests through compression, multiplexing and prioritization.

              If you enable this policy setting, Internet Explorer uses the SPDY/3 network protocol.

              If you disable this policy setting, Internet Explorer won't use the SPDY/3 network protocol.

              If you don't configure this policy setting, users can turn this behavior on or off, on the **Advanced\* tab of the \*\*Internet Options** dialog box. The default is on.

              **Note**
              We've replaced the SPDY/3 protocol with the HTTP2 protocol in Windows 10. You can configure the HTTP2 protocol by using the **Allow IE to use the HTTP2 network protocol** setting. | -| Allow Microsoft services to provide enhanced suggestions as the user types in the Address bar | Administrative Templates\Windows Components\Internet Explorer | IE11 on Windows 10 | This policy setting allows IE to provide enhanced suggestions as the user types in the Address bar. To provide enhanced suggestions, the user’s keystrokes are sent to Microsoft through Microsoft services.

              If you enable this policy setting, users receive enhanced suggestions while typing in the Address bar. In addition, users won’t be able to change the **Suggestions** setting on the **Settings** charm.

              If you disable this policy setting, users won’t receive enhanced suggestions while typing in the Address bar. In addition, users won’t be able to change the **Suggestions** setting on the **Settings** charm.

              If you don’t configure this policy setting, users can change the **Suggestions** setting on the **Settings** charm. | -| Allow only approved domains to use the TDC ActiveX control |

              • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone
              • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone
              • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted Sites Zone
              • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone
              • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone
              • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone
              | IE11 in Windows 10 | This policy setting determines whether users can run the Tabular Data Control (TDC) ActiveX control, based on security zone. By default, the TDC ActiveX Control is disabled in the **Internet** and **Restricted Sites** security zones.

              If you enable this policy setting, users won’t be able to run the TDC ActiveX control from all sites in the specified zone.

              If you disable this policy setting, users can run the TDC Active X control from all sites in the specified zone. | -| Allow SSL3 Fallback | Administrative Templates\Windows Components\Internet Explorer\Security Features | Internet Explorer 11 on Windows 10 | This policy setting allows you to stop websites from falling back to using Secure Socket Layer (SSL) 3.0 or lower, if Transport Layer Security (TLS) 1.0 or higher, fails. This setting doesn’t affect which security protocols are enabled.

              If you enable this policy setting and a website fails while using the TLS 1.0 or higher security protocols, Internet Explorer will try to fallback and use SSL 3.0 or lower security protocols.

              If you disable or don’t configure this setting, Internet Explorer uses the default system protocols.

              **Important:**
              By default, SSL 3.0 is disabled. If you choose to enable SSL 3.0, we recommend that you disable or don't configure this setting to help mitigate potential man-in-the-middle attacks. | -| Allow VBScript to run in Internet Explorer |

              • Administrative Templates/Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone/Internet Zone
              • Administrative Templates/Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone/Intranet Zone
              • Administrative Templates/Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone/Local Machine Zone
              • Administrative Templates/Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone/Locked-Down Internet Zone
              • Administrative Templates/Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone/Locked-Down Intranet Zone
              • Administrative Templates/Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone/Locked-Down Local Machine Zone
              • Administrative Templates/Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone/Locked-Down Restricted Sites Zone
              • Administrative Templates/Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone/Locked-Down Trusted Sites Zone
              • Administrative Templates/Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone/Restricted Sites Zone
              • Administrative Templates/Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone/Trusted Sites Zone
              | Internet Explorer 11 | This policy setting lets you decide whether VBScript can run on pages in specific Internet Explorer zones.

              If you enable this policy setting (default), you must also pick one of the following options from the Options box:

              • Enable. VBScript runs on pages in specific zones, without any interaction.
              • Prompt. Employees are prompted whether to allow VBScript to run in the zone.
              • Disable. VBScript is prevented from running in the zone.

              If you disable or don’t configure this policy setting, VBScript runs without any interaction in the specified zone. | -| Always send Do Not Track header | Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page | At least Internet Explorer 10 | This policy setting allows you to configure how IE sends the Do Not Track (DNT) header.

              If you enable this policy setting, IE sends a `DNT:1` header with all HTTP and HTTPS requests. The `DNT:1` header signals to the servers not to track the user.

              **In Internet Explorer 9 and 10:**
              If you disable this policy setting, IE only sends the Do Not Track header if a Tracking Protection List is enabled or inPrivate Browsing mode is used.

              **In at least IE11:**
              If you disable this policy setting, IE only sends the Do Not Track header if inPrivate Browsing mode is used.

              If you don't configure the policy setting, users can select the **Always send Do Not Track header** option on the **Advanced\* tab of the \*\*Internet Options** dialog box. By selecting this option, IE sends a `DNT:1` header with all HTTP and HTTPS requests; unless the user grants a site-specific exception, in which case IE sends a `DNT:0` header. By default, this option is enabled. | -| Don't run antimalware programs against ActiveX controls
              (Internet, Restricted Zones) |

              • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone
              • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone
              • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone
              • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone
              | IE11 on Windows 10 | This policy setting determines whether IE runs antimalware programs against ActiveX controls, to check if they're safe to load on pages.

              If you enable this policy setting, IE won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control.

              If you disable this policy setting, IE always checks with your antimalware program to see if it's safe to create an instance of the ActiveX control.

              If you don't configure this policy setting, IE always checks with your antimalware program to see if it's safe to create an instance of the ActiveX control. Users can turn this behavior on or off, using the Internet Explorer's **Security** settings. | -| Don't run antimalware programs against ActiveX controls
              (Intranet, Trusted, Local Machine Zones) |

              • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone
              • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone
              • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted Sites Zone
              • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone
              • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone
              • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone
              | IE11 on Windows 10 | This policy setting determines whether IE runs antimalware programs against ActiveX controls, to check if they're safe to load on pages.

              If you enable this policy setting, IE won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control.

              If you disable this policy setting, IE always checks with your antimalware program to see if it's safe to create an instance of the ActiveX control.

              If you don't configure this policy setting, IE won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control. Users can turn this behavior on or off, using Internet Explorer's **Security** settings. | -| Hide Internet Explorer 11 Application Retirement Notification | Administrative Templates\Windows Components\Internet Explorer | Internet Explorer 11 on Windows 10 20H2 & newer | This policy setting allows you to prevent the notification bar that informs users of Internet Explorer 11’s retirement from showing up.
              If you disable or don’t configure this setting, the notification will be shown. | -| Hide the button (next to the New Tab button) that opens Microsoft Edge | User Configuration\Administrative Templates\Windows Components/Internet Explorer\Internet Settings\Advanced Settings\Browsing\ | IE11 on Windows 10, version 1703 | This policy setting lets you decide whether employees can see the open Microsoft Edge button, which appears next to the New Tab button.

              If you enable this policy setting, the button to open Microsoft Edge from Internet Explorer will be hidden.

              If you disable this policy setting, the button to open Microsoft Edge from Internet Explorer appears.

              If you don't configure this policy setting, the button to open Microsoft Edge from Internet Explorer can be configured by your employees. | -| Let users turn on and use Enterprise Mode from the **Tools** menu | Administrative Templates\Windows Components\Internet Explorer | IE11 on Windows 10 | This policy setting lets you decide whether users can turn on Enterprise Mode for websites with compatibility issues. Optionally, this policy also lets you specify where to get reports (through post messages) about the websites for which users turn on Enterprise Mode using the **Tools** menu.

              If you enable this policy setting, users can see and use the **Enterprise Mode** option from the **Tools** menu. If you enable this setting, but don’t specify a report location, Enterprise Mode will still be available to your users, but you won’t get any reports.

              If you disable or don’t configure this policy setting, the menu option won’t appear and users won’t be able to turn on Enterprise Mode locally. | -| Limit Site Discovery output by Domain | Administrative Templates\Windows Components\Internet Explorer | At least Internet Explorer 8 | This policy setting allows you to control which domains are included in the discovery function of the Internet Explorer Site Discovery Toolkit.

              If you enable this policy setting, the Internet Explorer Site Discovery Toolkit collects data from all sites in your specified domains, configured by adding one domain per line to the included text box.

              If you disable or don’t configure this setting, the Internet Explorer Site Discovery Toolkit collects data from all sites in all domains.

              **Note:**
              You can use this setting in conjunction with the other settings that control the Internet Explorer Site Discovery Toolkit. | -| Limit Site Discovery output by Zone | Administrative Templates\Windows Components\Internet Explorer | At least Internet Explorer 8 | This policy setting allows you to control which zones are included in the discovery function of the Internet Explorer Site Discovery Toolkit.

              If you enable this policy setting, the Internet Explorer Site Discovery Toolkit collects data from all specified security zones.

              If you disable or don’t configure this setting, the Internet Explorer Site Discovery Toolkit collects data from all sites in all security zones.

              To specify which zones can collect data, you must include a binary number that represents your selected zones, based on this order:

              • 0 – Restricted Sites zone
              • 0 – Internet zone
              • 0 – Trusted Sites zone
              • 0 – Local Intranet zone
              • 0 – Local Machine zone

              **Example 1:** Include only the Local Intranet zone (binary representation: 00010), based on:
              • 0 – Restricted Sites zone
              • 0 – Internet zone
              • 0 – Trusted Sites zone
              • 1 – Local Intranet zone
              • 0 – Local Machine zone

              **Example 2:** Include only the Restricted Sites, Trusted Sites, and Local Intranet zones (binary representation: 10110), based on:
              • 1 – Restricted Sites zone
              • 0 – Internet zone
              • 1 – Trusted Sites zone
              • 1 – Local Intranet zone
              • 1 – Local Machine zone

              **Note:**
              You can use this setting in conjunction with the other settings that control the Internet Explorer Site Discovery Toolkit. | -| Prevent deleting ActiveX Filtering, Tracking Protection and Do Not Track data | Administrative Templates\Windows Components\Internet Explorer\Delete Browsing History | At least Windows Internet Explorer 9 | **In Internet Explorer 9 and Internet Explorer 10:**
              This policy setting prevents users from deleting ActiveX Filtering and Tracking Protection data, which includes the list of websites for which the user has chosen to disable ActiveX Filtering or Tracking Protection. In addition, Tracking Protection data is also collected if users turn on the **Personalized Tracking Protection List**, which blocks third-party items while the user is browsing.

              **In IE11:**
              This policy setting prevents users from deleting ActiveX Filtering, Tracking Protection data, and Do Not Track exceptions, stored in the **Delete Browsing History** dialog box, for visited websites.

              If you enable this policy setting, ActiveX Filtering, Tracking Protection and Do Not Track data is preserved when the user clicks **Delete**.

              If you disable this policy setting, ActiveX Filtering, Tracking Protection and Do Not Track data is deleted when the user clicks **Delete**.

              If you don’t configure this policy setting, users can turn this feature on and off, determining whether to delete ActiveX Filtering, Tracking Protection, and Do Not Track data when clicking **Delete**. | -| Send all sites not included in the Enterprise Mode Site List to Microsoft Edge | Administrative Templates\Windows Components\Internet Explorer | IE11 on Windows 10, version 1607 | This policy setting lets you decide whether to open all sites that aren’t specified to open in IE11 by the Enterprise Mode site list, to open in Microsoft Edge.

              If you enable this policy setting, you must also enable the Administrative Templates\Windows Components\Internet Explorer\Use the Enterprise Mode IE website list policy setting and you must include at least one site in the Enterprise Mode site list.

              If you disable or don't configure this policy setting, all sites will open based on the currently active browser.

              **Note:**
              If you’ve also enabled the Administrative Templates\Windows Components\Microsoft Edge\Send all intranet sites to Internet Explorer 11 policy setting, then all intranet sites will continue to open in Internet Explorer 11. | -| Show message when opening sites in Microsoft Edge using Enterprise Mode | Administrative Templates\Windows Components\Internet Explorer | IE11 on Windows 10, version 1607 | This policy setting lets you decide whether employees see an additional page in Internet Explorer 11, stating that a site has been opened using Microsoft Edge with Enterprise Mode.

              If you enable this policy setting, employees see an additional page in Internet Explorer 11, stating that a site has been opened using Microsoft Edge with Enterprise Mode.

              If you disable or don't configure this policy setting, the default app behavior occurs and no additional page appears. | -| Turn off automatic download of the ActiveX VersionList | Administrative Templates\Windows Components\Internet Explorer\Security Features\Add-on Management | At least Windows Internet Explorer 8 | This policy setting allows you to decide whether Internet Explorer automatically downloads updated versions of Microsoft's VersionList.XML file. This file tells Internet Explorer whether to stop specific ActiveX controls from loading.

              If you enable this policy setting, Internet Explorer stops automatically downloading updated versions of the VersionList.XML file.

              If you disable or don’t configure this setting, Internet Explorer continues to download updated versions of the VersionList.XML file.

              **Important:**
              Stopping this file from updating breaks the out-of-date ActiveX control blocking feature, potentially compromising the security of the device. For more info, see the Out-of-Date ActiveX Control Blocking () topic. | -| Turn off loading websites and content in the background to optimize performance | Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page | IE11 on Windows 10 | This policy setting determines whether Internet Explorer preemptively loads websites and content in the background, speeding up performance such that when the user clicks a hyperlink, the background page seamlessly switches into view.

              If you enable this policy setting, IE doesn't load any websites or content in the background.

              If you disable this policy setting, IE preemptively loads websites and content in the background.

              If you don’t configure this policy setting, users can turn this behavior on or off, using IE settings. This feature is turned on by default. | -| Turn off phone number detection | Administrative Templates\Windows Components\Internet Explorer\Internet Settings\Advanced settings\Browsing | IE11 on Windows 10 | This policy setting determines whether phone numbers are recognized and turned into hyperlinks, which can be used to invoke the default phone application on the system.

              If you enable this policy setting, phone number detection is turned off. Users won’t be able to modify this setting.

              If you disable this policy setting, phone number detection is turned on. Users won’t be able to modify this setting.

              If you don't configure this policy setting, users can turn this behavior on or off, using IE settings. The default is on. | -| Turn off sending URL path as UTF-8 | User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Settings\URL Encoding | At least Windows Internet Explorer 7 | This policy setting determines whether to let IE send the path portion of a URL using the UTF-8 standard. This standard defines characters so they're readable in any language and lets you exchange Internet addresses (URLs) with characters included in any language.

              If you enable this policy setting, UTF-8 is not allowed. Users won't be able to change this setting.

              If you disable this policy setting, UTF-8 is allowed. Users won't be able to change this setting.

              If you don't configure this policy setting, users can turn this behavior on or off. | -| Turn off sending UTF-8 query strings for URLs | Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page | IE11 on Windows 10 | This policy setting determines whether IE uses 8-bit Unicode Transformation Format (UTF-8) to encode query strings in URLs before sending them to servers or to proxy servers.

              If you enable this policy setting, you must specify when to use UTF-8 to encode query strings:

              • **0.** Never encode query strings.
              • **1.** Only encode query strings for URLs that aren't in the Intranet zone.
              • **2.** Only encode query strings for URLs that are in the Intranet zone.
              • **3.** Always encode query strings.

              If you disable or don't configure this policy setting, users can turn this behavior on or off, using IE Advanced Options settings. The default is to encode all query strings in UTF-8. | -| Turn off the ability to launch report site problems using a menu option | Administrative Templates\Windows Components\Internet Explorer\Browser menus | Internet Explorer 11 | This policy setting allows you to manage whether users can start the **eport Site Problems** dialog box from the **Internet Explorer** settings area or from the **Tools** menu.

              If you enable this policy setting, users won’t be able to start the **Report Site Problems** dialog box from the Internet Explorer settings or the Tools menu.

              If you disable or don’t configure this policy setting, users will be able to start the **Report Site Problems** dialog box from the **Internet Explorer** settings area or from the **Tools** menu. | -| Turn off the flip ahead with page prediction feature | Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page | At least Internet Explorer 10 on Windows 8 | This policy setting determines whether a user can swipe across a screen or click Forward to go to the next pre-loaded page of a website.

              If you enable this policy setting, flip ahead with page prediction is turned off and the next webpage isn’t loaded into the background.

              If you disable this policy setting, flip ahead with page prediction is turned on and the next webpage is loaded into the background.

              If you don’t configure this setting, users can turn this behavior on or off, using the **Settings** charm.

              **Note**
              Microsoft collects your browsing history to improve how flip ahead with page prediction works. This feature isn’t available for Internet Explorer for the desktop. | -| Turn on 64-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows | Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page | IE11 on Windows 10 | This policy setting determines whether IE11 uses 64-bit processes (for greater security) or 32-bit processes (for greater compatibility) when running in Enhanced Protected Mode on 64-bit versions of Windows.

              If you enable this policy setting, IE11 will use 64-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows.

              If you disable this policy setting, IE11 will use 32-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows.

              If you don't configure this policy setting, users can turn this feature on or off using IE settings. This feature is turned off by default.

              **Important**
              When using 64-bit processes, some ActiveX controls and toolbars might not be available. | -| Turn on Site Discovery WMI output | Administrative Templates\Windows Components\Internet Explorer | At least Internet Explorer 8 | This policy setting allows you to manage the WMI output functionality of the Internet Explorer Site Discovery Toolkit.

              If you enable this policy setting, the Internet Explorer Site Discovery Toolkit will log its collected data to an WMI class, which can be aggregated by using a client-management solution, such as Microsoft Configuration Manager.

              If you disable or don’t configure this setting, the Internet Explorer Site Discovery Toolkit won’t log its collected data to an WMI class.

              **Note:**
              Enabling or disabling this setting won’t impact any other output methods available to the Internet Explorer Site Discovery Toolkit. | -| Turn on Site Discovery XML output | Administrative Templates\Windows Components\Internet Explorer | At least Internet Explorer 8 | This policy setting allows you to manage the XML output functionality of the Internet Explorer Site Discovery Toolkit.

              If you enable this policy setting, the Internet Explorer Site Discovery Toolkit will log its collected data to an XML file, stored in your specified location.

              If you disable or don’t configure this setting, the Internet Explorer Site Discovery Toolkit won’t log its collected data to an XML file.

              **Note:**
              Enabling or disabling this setting won’t impact any other output methods available to the Internet Explorer Site Discovery Toolkit. | -| Use the Enterprise Mode IE website list | Administrative Templates\Windows Components\Internet Explorer | IE11 on Windows 10, version 1511 | This policy setting lets you specify where to find the list of websites you want opened using Enterprise Mode, instead of Standard mode, because of compatibility issues. Users can’t edit this list.

              If you enable this policy setting, Internet Explorer downloads the Enterprise Mode website list from the `HKEY_CURRENT_USER or HKEY_LOCAL_MACHINE`\Software\Policies\Microsoft\Internet Explorer\Main\EnterpriseMode hive, opening all included websites using Enterprise Mode. We recommend storing and downloading your list from a secure web server `(https://)`, to help protect against data tampering.

              If you disable or don’t configure this policy setting, Internet Explorer opens all websites using **Standard** mode. | - -## Removed Group Policy settings -IE11 no longer supports these Group Policy settings: - -- Turn on Internet Explorer 7 Standards Mode - -- Turn off Compatibility View button - -- Turn off Quick Tabs functionality - -- Turn off the quick pick menu - -- Use large icons for command buttons - -## Viewing your policy settings -After you've finished updating and deploying your Group Policy, you can use the Resultant Set of Policy (RSoP) snap-in to view your settings. - -**To use the RSoP snap-in** - -1. Open and run the Resultant Set of Policy (RSoP) wizard, specifying the information you want to see. - -2. Open your wizard results in the Group Policy Management Console (GPMC).

              -For complete instructions about how to add, open, and use RSoP, see [Use the RSoP Snap-in](/previous-versions/windows/it-pro/windows-server-2003/cc736424(v=ws.10)) \ No newline at end of file diff --git a/browsers/internet-explorer/ie11-deploy-guide/out-of-date-activex-control-blocking.md b/browsers/internet-explorer/ie11-deploy-guide/out-of-date-activex-control-blocking.md deleted file mode 100644 index 4eed39657f..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/out-of-date-activex-control-blocking.md +++ /dev/null @@ -1,211 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: security -description: Use out-of-date ActiveX control blocking to help you know when IE prevents a webpage from loading outdated ActiveX controls and to update the outdated control, so that it’s safer to use. -author: dansimp -ms.author: dansimp -ms.prod: ie11 -ms.assetid: e61866bb-1ff1-4a8d-96f2-61d3534e8199 -ms.reviewer: -audience: itpro -manager: dansimp -title: Out-of-date ActiveX control blocking (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 05/10/2018 ---- - - -# Out-of-date ActiveX control blocking - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) -- Windows Vista SP2 - -ActiveX controls are small apps that let websites provide content, like videos, games, and let you interact with content like toolbars. Unfortunately, because many ActiveX controls aren’t automatically updated, they can become outdated as new versions are released. It’s very important that you keep your ActiveX controls up-to-date because malicious software (or malware) can target security flaws in outdated controls, damaging your computer by collecting info from it, installing unwanted software, or by letting someone else control it remotely. To help avoid this situation, Internet Explorer includes a new security feature, called *out-of-date ActiveX control blocking*. - -Out-of-date ActiveX control blocking lets you: - -- Know when IE prevents a webpage from loading common, but outdated ActiveX controls. - -- Interact with other parts of the webpage that aren’t affected by the outdated control. - -- Update the outdated control, so that it’s up-to-date and safer to use. - -The out-of-date ActiveX control blocking feature works with all [Security Zones](https://go.microsoft.com/fwlink/p/?LinkId=403863), except the Local Intranet Zone and the Trusted Sites Zone. - -It also works with these operating system and IE combinations: - -|Windows operating system |IE version | -|----------------------------------------|---------------------------------| -|Windows 10 |All supported versions of IE.
              Microsoft Edge doesn't support ActiveX controls. | -|Windows 8.1 and Windows 8.1 Update |All supported versions of IE | -|Windows 7 SP1 |All supported versions of IE | -|Windows Server 2012 |All supported versions of IE | -|Windows Server 2008 R2 SP1 |All supported versions of IE | -|Windows Server 2008 SP2 |Windows Internet Explorer 9 only | -|Windows Vista SP2 |Windows Internet Explorer 9 only | - -For more info about this new feature, see the [Internet Explorer begins blocking out-of-date ActiveX controls](https://go.microsoft.com/fwlink/p/?LinkId=507691) blog. To see the complete list of out-of-date Active controls blocked by this feature, see [Blocked out-of-date ActiveX controls](blocked-out-of-date-activex-controls.md). - - -## What does the out-of-date ActiveX control blocking notification look like? -When IE blocks an outdated ActiveX control, you’ll see a notification bar similar to this, depending on your version of IE: - -**Internet Explorer 9 through Internet Explorer 11** - -![Warning about outdated activex controls (ie9+).](images/outdatedcontrolwarning.png) - -**Windows Internet Explorer 8** - -![Warning about outdated activex controls (ie8).](images/ieoutdatedcontrolwarning.png) - -Out-of-date ActiveX control blocking also gives you a security warning that tells you if a webpage tries to launch specific outdated apps, outside of IE: - -![Warning about outdated activex controls outside ie.](images/ieoutdatedcontroloutsideofie.png) - - -## How do I fix an outdated ActiveX control or app? -From the notification about the outdated ActiveX control, you can go to the control’s website to download its latest version. - - **To get the updated ActiveX control** - -1. From the notification bar, tap or click **Update**.

              -IE opens the ActiveX control’s website. - -2. Download the latest version of the control. - -**Security Note:**
              If you don’t fully trust a site, you shouldn’t allow it to load an outdated ActiveX control. However, although we don’t recommend it, you can view the missing webpage content by tapping or clicking **Run this time**. This option runs the ActiveX control without updating or fixing the problem. The next time you visit a webpage running the same outdated ActiveX control, you’ll get the notification again. - - **To get the updated app** - -1. From the security warning, tap or click **Update** link.

              -IE opens the app’s website. - -2. Download the latest version of the app. - -**Security Note:**
              If you don’t fully trust a site, you shouldn’t allow it to launch an outdated app. However, although we don’t recommend it, you can let the webpage launch the app by tapping or clicking **Allow**. This option opens the app without updating or fixing the problem. The next time you visit a webpage running the same outdated app, you’ll get the notification again. - -## How does IE decide which ActiveX controls to block? -IE uses Microsoft’s versionlist.xml or versionlistWin7.xml file to determine whether an ActiveX control should be stopped from loading. These files are updated with newly-discovered out-of-date ActiveX controls, which IE automatically downloads to your local copy of the file. - -You can see your copy of the file here `%LOCALAPPDATA%\Microsoft\Internet Explorer\VersionManager\versionlist.xml` or you can view Microsoft’s version, based on your operating system and version of IE, here: -- [Internet Explorer 11 on Windows 7 SP1 or Windows Server 2008 R2](https://go.microsoft.com/fwlink/p/?LinkId=798230) -- [All other configurations](https://go.microsoft.com/fwlink/p/?LinkId=403864) - -**Security Note:**
              Although we strongly recommend against it, if you don’t want your computer to automatically download the updated version list from Microsoft, run the following command from a command prompt: - -``` -reg add "HKCU\Software\Microsoft\Internet Explorer\VersionManager" /v DownloadVersionList /t REG_DWORD /d 0 /f -``` -Turning off this automatic download breaks the out-of-date ActiveX control blocking feature by not letting the version list update with newly outdated controls, potentially compromising the security of your computer. Use this configuration option at your own risk. - -## Out-of-date ActiveX control blocking - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - on managed devices -Out-of-date ActiveX control blocking includes four new Group Policy settings that you can use to manage your web browser configuration, based on your domain controller. You can download the administrative templates, including the new settings, from the [Administrative templates (.admx) for Windows 10](https://go.microsoft.com/fwlink/p/?LinkId=746579) page or the [Administrative Templates (.admx) for Windows 8.1 and Windows Server 2012 R2](https://go.microsoft.com/fwlink/p/?LinkId=746580) page, depending on your operating system. - -### Group Policy settings -Here’s a list of the new Group Policy info, including the settings, location, requirements, and Help text strings. All of these settings can be set in either the Computer Configuration or User Configuration scope, but Computer Configuration takes precedence over User Configuration. - -**Important**
              -Out-of-date ActiveX control blocking is turned off in the Local Intranet Zone and the Trusted Sites Zone; therefore, intranet websites and line-of-business apps will continue to use out-of-date ActiveX controls without disruption. - -|Setting |Category path |Supported on |Help text | -|--------|--------------|-------------|----------| -|Turn on ActiveX control logging in IE |`Administrative Templates\Windows Components\Internet Explorer\Security Features\Add-on Management` |Internet Explorer 8 through IE11 |This setting determines whether IE saves log information for ActiveX controls.

              If you enable this setting, IE logs ActiveX control information (including the source URI that loaded the control and whether it was blocked) to a local file.

              If you disable or don't configure this setting, IE won't log ActiveX control information.

              Note that you can turn this setting on or off regardless of the **Turn off blocking of outdated ActiveX controls for IE** or **Turn off blocking of outdated ActiveX controls for IE on specific domains** settings. | -|Remove the **Run this time** button for outdated ActiveX controls in IE |`Administrative Templates\Windows Components\Internet Explorer\Security Features\Add-on Management`|Internet Explorer 8 through IE11 |This setting allows you stop users from seeing the **Run this time** button and from running specific outdated ActiveX controls in IE.

              If you enable this setting, users won't see the **Run this time** button on the warning message that appears when IE blocks an outdated ActiveX control.

              If you disable or don't configure this setting, users will see the **Run this time** button on the warning message that appears when IE blocks an outdated ActiveX control. Clicking this button lets the user run the outdated ActiveX control once. | -|Turn off blocking of outdated ActiveX controls for IE on specific domains |`Administrative Templates\Windows Components\Internet Explorer\Security Features\Add-on Management` |Internet Explorer 8 through IE11 |This setting allows you to manage a list of domains on which IE will stop blocking outdated ActiveX controls. Outdated ActiveX controls are never blocked in the Intranet Zone.

              If you enable this setting, you can enter a custom list of domains for which outdated ActiveX controls won't be blocked in IE. Each domain entry must be formatted like one of the following:

              • **"domainname.TLD".** For example, if you want to include `*.contoso.com/*`, use "contoso.com".
              • **"hostname".** For example, if you want to include `https://example`, use "example".
              • **"file:///path/filename.htm"**. For example, use `file:///C:/Users/contoso/Desktop/index.htm`.

              If you disable or don't configure this setting, the list is deleted and IE continues to block specific outdated ActiveX controls on all domains in the Internet Zone. | -|Turn off blocking of outdated ActiveX controls for IE |`Administrative Templates\Windows Components\Internet Explorer\Security Features\Add-on Management` |Internet Explorer 8 through IE11 |This setting determines whether IE blocks specific outdated ActiveX controls. Outdated ActiveX controls are never blocked in the Intranet Zone.

              If you enable this setting, IE stops blocking outdated ActiveX controls.

              If you disable or don't configure this setting, IE continues to block specific outdated ActiveX controls. | -|Remove the **Update** button in the out-of-date ActiveX control blocking notification for IE |This functionality is only available through the registry |Internet Explorer 8 through IE11 |This setting determines whether the out-of-date ActiveX control blocking notification shows the **Update** button. This button points users to update specific out-of-date ActiveX controls in IE. | - - -If you don't want to use Group Policy, you can also turn these settings on or off using the registry. You can update the registry manually. - -|Setting |Registry setting | -|-------------------------|----------------------------------------------------------------| -|Turn on ActiveX control logging in IE |`reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Ext" /v AuditModeEnabled /t REG_DWORD /d 1 /f`

              Where:

              • **0 or not configured.** Logs ActiveX control information (including the source URI that loaded the control and whether it was blocked) to a local file.
              • **1.** Logs ActiveX control information.
              | -|Remove **Run this time** button for outdated ActiveX controls in IE |`reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Ext" /v RunThisTimeEnabled /t REG_DWORD /d 0 /f`

              Where:

              • **0.** Removes the **Run this time** button.
              • **1 or not configured.** Leaves the **Run this time** button.
              | -|Turn off blocking of outdated ActiveX controls for IE on specific domains |reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Ext\Domain" /v contoso.com /t REG_SZ /f

              Where:

              • **contoso.com.** A single domain on which outdated ActiveX controls won't be blocked in IE. Use a new `reg add` command for each domain you wish to add to the **Allow** list.
              | -|Turn off blocking of outdated ActiveX controls for IE |`reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Ext" /v VersionCheckEnabled /t REG_DWORD /d 0 /f`

              Where:

              • **0.** Stops blocking outdated ActiveX controls.
              • **1 or not configured.** Continues to block specific outdated ActiveX controls.
              | -|Remove the **Update** button in the out-of-date ActiveX control blocking notification for IE |`reg add "HKCU\Software\Microsoft\Internet Explorer\VersionManager" /v UpdateEnabled /t REG_DWORD /d 0 /f`

              Where:

              • **0.** Removes the **Update** button
              • **1 or not configured.** Leaves the **Update** button.
              - -## Inventory your ActiveX controls -You can inventory the ActiveX controls being used in your company, by turning on the **Turn on ActiveX control logging in IE** setting: - -- **Windows 10:** Through a comma-separated values (.csv) file or through a local Windows Management Instrumentation (WMI) class. - -- **All other versions of Microsoft Windows:** Through a .csv file only. - - -### Inventory your ActiveX controls by using a .CSV file -If you decide to inventory the ActiveX controls being used in your company by turning on the **Turn on ActiveX control logging in IE** setting, IE logs the ActiveX control information to the `%LOCALAPPDATA%\Microsoft\Internet Explorer\AuditMode\VersionAuditLog.csv` file. - -Here’s a detailed example and description of what’s included in the VersionAuditLog.csv file. - -|Source URI |File path |Product version |File version |Allowed/Blocked |Reason |EPM-compatible | -|-----------|----------|----------------|-------------|----------------|-------|---------------| -|`https://contoso.com/test1.html` |C:\Windows\System32\Macromed\Flash\Flash.ocx |14.0.0.125 |14.0.0.125 |Allowed |Not in blocklist |EPM-compatible | -|`https://contoso.com/test2.html` |C:\Program Files\Java\jre6\bin\jp2iexp.dll |6.0.410.2 |6.0.410.2 |Blocked |Out of date |Not EPM-compatible | - -**Where:** -- **Source URI.** The URL of the page that loaded the ActiveX control. - -- **File path.** The location of the binary that implements the ActiveX control. - -- **Product version.** The product version of the binary that implements the ActiveX control. - -- **File version.** The file version of the binary that implements the ActiveX control. - -- **Allowed/Blocked** Whether IE blocked the ActiveX control. - -- **Enhanced Protected Mode (EPM)-compatible.** Whether the loaded ActiveX control is compatible with [Enhanced Protected Mode](/troubleshoot/browsers/enhanced-protected-mode-add-on-compatibility).

              **Note**
              Enhanced Protected Mode isn’t supported on Internet Explorer 9 or earlier versions of IE. Therefore, if you’re using Internet Explorer 8 or Internet Explorer 9, all ActiveX controls will always be marked as not EPM-compatible. - -- **Reason.** The ActiveX control can be blocked or allowed for any of these reasons: - -|Reason |Corresponds to |Description | -|-------------------------|---------------|-------------------------------------------------| -|Version not in blocklist |Allowed |The version of the loaded ActiveX control is explicitly allowed by the IE version list. | -|Trusted domain |Allowed |The ActiveX control was loaded on a domain listed in the **Turn off blocking of outdated ActiveX controls for IE on specific domains** setting. | -|File doesn’t exist |Allowed |The loaded ActiveX control is missing required binaries to run correctly. | -|Out-of-date |Blocked |The loaded ActiveX control is explicitly blocked by the IE version list because it is out-of-date. | -|Not in blocklist |Allowed |The loaded ActiveX control isn’t in the IE version list. | -|Managed by policy |Allowed |The loaded ActiveX control is managed by a Group Policy setting that isn’t listed here, and will be managed in accordance with that Group Policy setting. | -|Trusted Site Zone or intranet |Allowed |The ActiveX control was loaded in the Trusted Sites Zone or the Local Intranet Zone. | -|Hardblocked |Blocked |The loaded ActiveX control is blocked in IE because it contains known security vulnerabilities. | -|Unknown |Allowed or blocked |None of the above apply. | - -### Inventory your ActiveX controls by using a local WMI class -For Windows 10 you also have the option to log your inventory info to a local WMI class. Info logged to this class includes all of info you get from the .csv file, plus the CLSID of the loaded ActiveX control or the name of any apps started from an ActiveX control. - -#### Before you begin -Before you can use WMI to inventory your ActiveX controls, you need to [download the configuration package (.zip file)](https://go.microsoft.com/fwlink/p/?LinkId=616971), which includes: - -- **ConfigureWMILogging.ps1**. A Windows PowerShell script. - -- **ActiveXWMILogging.mof**. A managed object file. - -Before running the PowerShell script, you must copy both the .ps1 and .mof file to the same directory location, on the client computer. - - **To configure IE to use WMI logging** - -1. Open your Group Policy editor and turn on the `Administrative Templates\Windows Components\Internet Explorer\Turn on ActiveX control logging in IE` setting. - -2. On the client device, start PowerShell in elevated mode (using admin privileges) and run `ConfigureWMILogging.ps1` by by-passing the PowerShell execution policy, using this command: - ``` - powershell –ExecutionPolicy Bypass .\ConfigureWMILogging.ps1 - ``` - For more info, see [about_Execution_Policies](/powershell/module/microsoft.powershell.core/about/about_execution_policies). - -3. **Optional:** Set up your domain firewall for WMI data. For more info, see [Collect data using Enterprise Site Discovery](collect-data-using-enterprise-site-discovery.md). - -The inventory info appears in the WMI class, `IEAXControlBlockingAuditInfo`, located in the WMI namespace, *root\\cimv2\\IETelemetry*. To collect the inventory info from your client computers, we recommend using System Center 2012 R2 Configuration Manager or any agent that can access the WMI data. For more info, see [Collect data using Enterprise Site Discovery](collect-data-using-enterprise-site-discovery.md). \ No newline at end of file diff --git a/browsers/internet-explorer/ie11-deploy-guide/problems-after-installing-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/problems-after-installing-ie11.md deleted file mode 100644 index 41a67c1f65..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/problems-after-installing-ie11.md +++ /dev/null @@ -1,77 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: support -description: Possible solutions to the problems you might encounter after installing IE11, such as crashing or seeming slow, getting into an unusable state, or problems with adaptive streaming and DRM playback. -author: dansimp -ms.prod: windows-client -ms.assetid: c4b75ad3-9c4a-4dd2-9fed-69f776f542e6 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Problems after installing Internet Explorer 11 (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 10/16/2017 ---- - - -# Problems after installing Internet Explorer 11 - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -After you install Internet Explorer 11 in your organization, you might run into the following issues. By following these suggestions, you should be able to fix them. - -## Internet Explorer is in an unusable state -If IE11 gets into an unusable state on an employee's computer, you can use the **Reset Internet Explorer Settings (RIES)** feature to restore the default settings for many of the browser features, including: - -- Search scopes - -- Appearance settings - -- Toolbars - -- ActiveX® controls (resets to the opt-in state, unless they're pre-approved) - -- Branding settings created with IEAK 11 - -RIES does not: - -- Clear the Favorites list, RSS feeds, or Web slices. - -- Reset connection or proxy settings. - -- Affect the applied Administrative Template Group Policy settings. - -RIES turns off all custom toolbars, browser extensions, and customizations installed with IE11. If you change your mind, you can turn each of the customizations back on through the **Manage Add-ons** dialog box. For more information about resetting IE settings, see [How to Reset Internet Explorer Settings](https://support.microsoft.com/windows/change-or-reset-internet-explorer-settings-2d4bac50-5762-91c5-a057-a922533f77d5). - -## IE is crashing or seems slow -If you notice that CPU usage is running higher than normal, or that IE is frequently crashing or slowing down, you should check your browser add-ons and video card. By default, IE11 uses graphics processing unit (GPU) rendering mode. However, some outdated video cards and video drivers don't support GPU hardware acceleration. If IE11 determines that your current video card or video driver doesn't support GPU hardware acceleration, it'll use Software Rendering mode. - - **To check your browser add-ons** - -1. Start IE11 in **No Add-ons mode** by running the **Run** command from the **Start** menu, and then typing `iexplore.exe -extoff` into the box. - -2. Check if IE still crashes.

              - If the browser doesn't crash, open Internet Explorer for the desktop, click the **Tools** menu, and click **Manage Add-ons**. - -3. Click **Toolbars and Extensions**, click each toolbar or extension, clicking **Disable** to turn off all of the browser extensions and toolbars. - -4. Restart IE11. Go back to the **Manage Add-Ons** window and turn on each item, one-by-one.

              - After you turn each item back on, see if IE crashes or slows down. Doing it this way will help you identify the add-on that's causing IE to crash. After you've figured out which add-on was causing the problem, turn it off until you have an update from the manufacturer. - - **To check for Software Rendering mode** - -5. Open Internet Explorer for the desktop, click the **Tools** menu, and then click **Internet Options**. - -6. On the **Advanced** tab, go to the **Accelerated graphics** section, and then turn on Software Rendering mode by choosing the **Use software rendering instead of GPU rendering** box.

              - If the **Use software rendering instead of GPU rendering** option is greyed out, it means that your current video card or video driver doesn't support GPU hardware acceleration. For more information, see [Windows 10 Support](https://go.microsoft.com/fwlink/?LinkId=746588). - -## Adaptive streaming and DRM playback don’t work with Windows Server 2012 R2 -IE11 in Windows Server 2012 R2 doesn’t include media features like adaptive streaming or Digital Rights Management (DRM) playback. To add these features, you’ll need to download and install the Media Feature Pack from the [Microsoft Download Center](https://go.microsoft.com/fwlink/p/?LinkId=320789), as well as an app that uses PlayReady DRM from the Microsoft Store, such as the Xbox Music app or Xbox Video app. The app must be installed to specifically turn on DRM features, while all other media features are installed with the Media Feature Pack. - - - - - - - diff --git a/browsers/internet-explorer/ie11-deploy-guide/remove-all-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md b/browsers/internet-explorer/ie11-deploy-guide/remove-all-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md deleted file mode 100644 index 4c973ffad6..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/remove-all-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md +++ /dev/null @@ -1,52 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Instructions about how to clear all of the sites from your global Enterprise Mode site list. -author: dansimp -ms.prod: ie11 -ms.assetid: 90f38a6c-e0e2-4c93-9a9e-c425eca99e97 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Remove all sites from your Enterprise Mode site list using the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Remove all sites from your Enterprise Mode site list using the Enterprise Mode Site List Manager - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -You can clear all of the sites from your global Enterprise Mode site list. - -**Important**   -This is a permanent removal and erases everything. However, if you determine it was a mistake, and you saved an XML copy of your list, you can add the file again by following the steps in the [Add multiple sites to the Enterprise Mode site list using a file and Enterprise Mode Site List Manager (schema v.2)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md) or [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md), depending on your operating system. - - **To clear your compatibility list** - -1. On the **File** menu of the Enterprise Mode Site List Manager, click **Clear list**. - -2. Click **Yes** in the warning message.

              Your sites are all cleared from your list. - -## Related topics -- [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) -- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) -- [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) - - - - - - diff --git a/browsers/internet-explorer/ie11-deploy-guide/remove-sites-from-a-local-compatibililty-view-list.md b/browsers/internet-explorer/ie11-deploy-guide/remove-sites-from-a-local-compatibililty-view-list.md deleted file mode 100644 index 4a0eace5e7..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/remove-sites-from-a-local-compatibililty-view-list.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Instructions about how to remove sites from a local compatibility view list. -author: dansimp -ms.prod: windows-client -ms.assetid: f6ecaa75-ebcb-4f8d-8721-4cd6e73c0ac9 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Remove sites from a local compatibility view list (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Remove sites from a local compatibility view list - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -Remove websites that were added to a local compatibility view list by mistake or because they no longer have compatibility problems. - - **To remove sites from a local compatibility view list** - -1. Open Internet Explorer 11, click **Tools**, and then click **Compatibility View Settings**. - -2. Pick the site to remove, and then click **Remove**.

              -Sites can only be removed one at a time. If one is removed by mistake, it can be added back using this same box and the **Add** section. - -  - -  - - - diff --git a/browsers/internet-explorer/ie11-deploy-guide/remove-sites-from-a-local-enterprise-mode-site-list.md b/browsers/internet-explorer/ie11-deploy-guide/remove-sites-from-a-local-enterprise-mode-site-list.md deleted file mode 100644 index d6bb2e98eb..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/remove-sites-from-a-local-enterprise-mode-site-list.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Instructions about how to remove sites from a local Enterprise Mode site list. -author: dansimp -ms.prod: ie11 -ms.assetid: c7d6dd0b-e264-42bb-8c9d-ac2f837018d2 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Remove sites from a local Enterprise Mode site list (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Remove sites from a local Enterprise Mode site list - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -Remove websites that were added to a local Enterprise Mode site list by mistake or because the sites no longer have compatibility problems. - -> [!NOTE] -> The changes described in this topic only impact sites added to a local Enterprise Mode site list and not the list of sites deployed to all employees by an administrator. Employees can't delete sites added to the list by an administrator. - -**To remove single sites from a local Enterprise Mode site list** - -1. Open Internet Explorer 11 and go to the site you want to remove. - -2. Click **Tools**, and then click **Enterprise Mode**. - - The checkmark disappears from next to Enterprise Mode and the site is removed from the list. - - > [!NOTE] - > If the site is removed by mistake, it can be added back by clicking **Enterprise Mode** again. - -**To remove all sites from a local Enterprise Mode site list** - -1. Open Internet Explorer 11, click **Tools**, and then click **Internet options**. - -2. Click the **Delete** button from the **Browsing history** area. - -3. Click the box next to **Cookies and website data**, and then click **Delete**. - - > [!NOTE] - > This removes all of the sites from a local Enterprise Mode site list. diff --git a/browsers/internet-explorer/ie11-deploy-guide/review-neutral-sites-with-site-list-manager.md b/browsers/internet-explorer/ie11-deploy-guide/review-neutral-sites-with-site-list-manager.md deleted file mode 100644 index 4b385be382..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/review-neutral-sites-with-site-list-manager.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: How to use Site List Manager to review neutral sites for IE mode -author: dansimp -ms.prod: windows-client -ms.assetid: f4dbed4c-08ff-40b1-ab3f-60d3b6e8ec9b -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Review neutral sites for Internet Explorer mode using the Enterprise Mode Site List Manager -ms.sitesec: library -ms.date: 04/02/2020 ---- - -# Review neutral sites for Internet Explorer mode using the Enterprise Mode Site List Manager - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - - -**Applies to:** - -- Windows 10 -- Windows 8 -- Windows Server 2012 R2 -- Microsoft Edge version 77 or later - -> [!NOTE] -> This feature is available on the Enterprise Mode Site List Manager version 11.0. - -## Overview - -While converting your site from v.1 schema to v.2 schema using the latest version of the Enterprise Mode Site List Manager, sites with the *doNotTransition=true* in v.1 convert to *open-in=None* in the v.2 schema, which is characterized as a "neutral site". This is the expected behavior for conversion unless you are using Internet Explorer mode (IE mode). When IE mode is enabled, only authentication servers that are used for modern and legacy sites should be set as neutral sites. For more information, see [Configure neutral sites](/deployedge/edge-ie-mode-sitelist#configure-neutral-sites). Otherwise, a site meant to open in Edge might potentially be tagged as neutral, which results in inconsistent experiences for users. - -The Enterprise Mode Site List Manager provides the ability to flag sites that are listed as neutral sites, but might have been added in error. This check is automatically performed when you are converting from v.1 to v.2 through the tool. This check might flag sites even if there was no prior schema conversion. - -## Flag neutral sites - -To identify neutral sites to review: - -1. In the Enterprise Mode Site List Manager (schema v.2), click **File > Flag neutral sites**. -2. If selecting this option has no effect, there are no sites that needs to be reviewed. Otherwise, you will see a message **"Engine neutral sites flagged for review"**. When a site is flagged, you can assess if the site needs to be removed entirely, or if it needs the open-in attribute changed from None to MSEdge. -3. If you believe that a flagged site is correctly configured, you can edit the site entry and click on **"Clear Flag"**. Once you select that option for a site, it will not be flagged again. - -## Related topics - -- [About IE Mode](/deployedge/edge-ie-mode) -- [Configure neutral sites](/deployedge/edge-ie-mode-sitelist#configure-neutral-sites) \ No newline at end of file diff --git a/browsers/internet-explorer/ie11-deploy-guide/save-your-site-list-to-xml-in-the-enterprise-mode-site-list-manager.md b/browsers/internet-explorer/ie11-deploy-guide/save-your-site-list-to-xml-in-the-enterprise-mode-site-list-manager.md deleted file mode 100644 index 7b80dd178d..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/save-your-site-list-to-xml-in-the-enterprise-mode-site-list-manager.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: You can save your current Enterprise Mode compatibility site list as an XML file, for distribution and use by your managed systems. -author: dansimp -ms.prod: ie11 -ms.assetid: 254a986b-494f-4316-92c1-b089ee8b3e0a -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Save your site list to XML in the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Save your site list to XML in the Enterprise Mode Site List Manager - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -You can save your current Enterprise Mode compatibility site list as an XML file, for distribution and use by your managed systems. - - **To save your list as XML** - -1. On the **File** menu of the Enterprise Mode Site List Manager, click **Save to XML**. - -2. Save the file to the location you specified in your Enterprise Mode registry key, set up when you turned on Enterprise Mode for use in your company. For information about the Enterprise Mode registry key, see [Turn on local control and logging for Enterprise Mode](turn-on-local-control-and-logging-for-enterprise-mode.md).

              -The first time a user starts Internet Explorer 11 on a managed device; Internet Explorer will look for a new version of the site list at the specified location. If the browser finds an updated site list, IE downloads the new XML site list and uses it. - -## Related topics -- [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) -- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) -- [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) -  - -  - - - diff --git a/browsers/internet-explorer/ie11-deploy-guide/schedule-production-change-enterprise-mode-portal.md b/browsers/internet-explorer/ie11-deploy-guide/schedule-production-change-enterprise-mode-portal.md deleted file mode 100644 index 52343886ce..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/schedule-production-change-enterprise-mode-portal.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Details about how Administrators can schedule approved change requests for production in the Enterprise Mode Site List Portal. -author: dansimp -ms.prod: windows-client -title: Schedule approved change requests for production using the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 -ms.reviewer: -audience: itprom -manager: dansimp -ms.author: dansimp ---- - -# Schedule approved change requests for production using the Enterprise Mode Site List Portal - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -After a change request is approved, the original Requester can schedule the change for the production environment. The change can be immediate or set for a future time. - -**To schedule an immediate change** -1. The Requester logs onto the Enterprise Mode Site List Portal and clicks **In Progress** from the left pane. - -2. The Requester clicks the **Approved** status for the change request. - - The **Schedule changes** page appears. - -3. The Requester clicks **Now**, and then clicks **Save**. - - The update is scheduled to immediately update the production environment, and an email is sent to the Requester. After the update finishes, the Requester is asked to verify the changes. - - -**To schedule the change for a different day or time** -1. The Requester logs onto the Enterprise Mode Site List Portal and clicks **In Progress** from the left pane. - -2. The Requester clicks the **Approved** status for the change request. - - The **Schedule changes** page appears. - -3. The Requester clicks **Schedule**, sets the **Preferred day**, **Preferred start time**, and the **Preferred end time**, and then clicks **Save**. - - The update is scheduled to update the production environment on that day and time and an email is sent to the Requester. After the update finishes, the Requester will be asked to verify the changes. - - -## Next steps -After the update to the production environment completes, the Requester must again test the change. If the testing succeeds, the Requester can sign off on the change request. If the testing fails, the Requester can contact the Administrator group for more help. For the production environment testing steps, see the [Verify the change request update in the production environment using the Enterprise Mode Site List Portal](verify-changes-production-enterprise-mode-portal.md) topic. diff --git a/browsers/internet-explorer/ie11-deploy-guide/search-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md b/browsers/internet-explorer/ie11-deploy-guide/search-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md deleted file mode 100644 index f96a952626..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/search-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Search to see if a specific site already appears in your global Enterprise Mode site list. -author: dansimp -ms.prod: ie11 -ms.assetid: e399aeaf-6c3b-4cad-93c9-813df6ad47f9 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Search your Enterprise Mode site list in the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Search your Enterprise Mode site list in the Enterprise Mode Site List Manager - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -You can search to see if a specific site already appears in your global Enterprise Mode site list so you don’t try to add it again. - - **To search your compatibility list** - -- From the Enterprise Mode Site List Manager, type part of the URL into the **Search** box.

              - The search query searches all of the text. For example, entering *“micro”* will return results like, `www.microsoft.com`, `microsoft.com`, and `microsoft.com/images`. Wildcard characters aren’t supported. - -## Related topics -- [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) -- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) -- [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) - - - - - - diff --git a/browsers/internet-explorer/ie11-deploy-guide/set-the-default-browser-using-group-policy.md b/browsers/internet-explorer/ie11-deploy-guide/set-the-default-browser-using-group-policy.md deleted file mode 100644 index 6ea7312b42..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/set-the-default-browser-using-group-policy.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: security -description: Use the Group Policy setting, Set a default associations configuration file, to set the default browser for your company devices running Windows 10. -author: dansimp -ms.prod: windows-client -ms.assetid: f486c9db-0dc9-4cd6-8a0b-8cb872b1d361 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Set the default browser using Group Policy (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Set the default browser using Group Policy - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -You can use the Group Policy setting, **Set a default associations configuration file**, to set the default browser for your company devices running Windows 10. - - **To set the default browser as Internet Explorer 11** - -1. Open your Group Policy editor and go to the **Computer Configuration\Administrative Templates\\Windows Components\\File Explorer\\Set a default associations configuration file** setting.

              -Turning this setting on also requires you to create and store a default associations configuration file, locally or on a network share. For more information about creating this file, see [Export or Import Default Application Associations]( https://go.microsoft.com/fwlink/p/?LinkId=618268). - - ![set default associations group policy setting.](images/setdefaultbrowsergp.png) - -2. Click **Enabled**, and then in the **Options** area, type the location to your default associations configuration file.

              -If this setting is turned on and your employee's device is domain-joined, this file is processed and default associations are applied at logon. If this setting isn't configured or is turned off, or if your employee's device isn't domain-joined, no default associations are applied at logon. - -Your employees can change this setting by changing the Internet Explorer default value from the **Set Default Programs** area of the Control Panel. - -  - -  - - - diff --git a/browsers/internet-explorer/ie11-deploy-guide/set-up-enterprise-mode-logging-and-data-collection.md b/browsers/internet-explorer/ie11-deploy-guide/set-up-enterprise-mode-logging-and-data-collection.md deleted file mode 100644 index b42426f1d7..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/set-up-enterprise-mode-logging-and-data-collection.md +++ /dev/null @@ -1,160 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Set up and turn on Enterprise Mode logging and data collection in your organization. -author: dansimp -ms.prod: ie11 -ms.assetid: 2e98a280-f677-422f-ba2e-f670362afcde -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Set up Enterprise Mode logging and data collection (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Set up Enterprise Mode logging and data collection - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -Using Group Policy, you can turn on Enterprise Mode for Internet Explorer and then you can turn on local user control using the **Let users turn on and use Enterprise Mode from the Tools menu** setting, located in the `Administrative Templates\Windows Components\Internet Explorer` category path. After you turn this setting on, your users can turn on Enterprise Mode locally, from the IE **Tools** menu. - -![enterprise mode option on the tools menu.](images/ie-emie-toolsmenu.png) - -The **Let users turn on and use Enterprise Mode from the Tools menu** setting also lets you decide where to send the user reports (as a URL). We recommend creating a custom HTTP port 81 to let your incoming user information go to a dedicated site. A dedicated site is important so you can quickly pick out the Enterprise Mode traffic from your other website traffic. - -![group policy to turn on enterprise mode.](images/ie-emie-grouppolicy.png) - -Getting these reports lets you find out about sites that aren’t working right, so you can add them to your Enterprise Mode site list, without having to locate them all yourself. For more information about creating and using a site list, see the [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md) or the [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md) topic, based on your operating system. - -## Using ASP to collect your data -When you turn logging on, you need a valid URL that points to a server that can be listened to for updates to a user’s registry key. This means you need to set up an endpoint server for the incoming POST messages, which are sent every time the user turns Enterprise Mode on or off from the **Tools** menu. - - **To set up an endpoint server** - -1. Configure an IIS server to work with your Enterprise Mode data collection process. If you’re unsure how to set up IIS, see the [IIS installation webpage](/iis/install/installing-iis-7/installing-necessary-iis-components-on-windows-vista). - -2. Open Internet Information Services (IIS) and turn on the ASP components from the **Add Roles and Features Wizard**, **Server Roles** page.

              - This lets you create an ASP form that accepts the incoming POST messages. - -3. Open the Internet Information Services (IIS) Manager, click **Bindings**, highlight **Port 81**, click **Edit**, and then change the website information to point to Port 81 so it matches your custom-created port. - - ![IIS Manager, editing website bindings.](images/ie-emie-editbindings.png) - -4. Open the **Logging** feature, pick **W3C** for the format, and click **Select Fields** to open the **W3C Logging Fields** box. - - ![IIS Manager, setting logging options.](images/ie-emie-logging.png) - -5. Change the WC3 logging fields to include only the **Date**, **Client IP**, **User Name**, and **URI Query** standard fields, and then click **OK**.

              - Using only these fields keeps the log file simple, giving you the date, client IP address, and the website URI information for any site changed by your users. - -6. Apply these changes to your default website and close the IIS Manager. - -7. Put your EmIE.asp file into the root of the web server, using this command: - - ``` - <% @ LANGUAGE=javascript %> - <% - Response.AppendToLog(" ;" + Request.Form("URL") + " ;" + Request.Form("EnterpriseMode")); - %> - ``` - This code logs your POST fields to your IIS log file, where you can review all of the collected data. - - -### IIS log file information -This is what your log files will look like after you set everything up and at least one of your users has turned on Enterprise Mode locally from the **Tools** menu. You can see the URL of the problematic website and client IP address of the user that turned on Enterprise Mode. - -![Enterprise Mode log file.](images/ie-emie-logfile.png) - - -## Using the GitHub sample to collect your data -Microsoft has created the [EMIE-Data-Collection_Sample](https://go.microsoft.com/fwlink/p/?LinkId=507401) that shows how to collect your Enterprise Mode reports. This sample only shows how to collect data, it doesn’t show how to aggregate the data into your Enterprise Mode site list.

              -This sample starts with you turning on Enterprise Mode and logging (either through Group Policy, or by manually setting the EnterpriseMode registry key) so that your users can use Enterprise Mode locally. For the steps to do this, go to [Turn on local control and logging for Enterprise Mode](turn-on-local-control-and-logging-for-enterprise-mode.md). - -**Note**
              If you decide to manually change the registry key, you can change the **Enable** setting to `[deployment url]/api/records/`, which automatically sends your reports to this page. - -### Setting up, collecting, and viewing reports -For logging, you’re going to need a valid URL that points to a server that can be listened to for updates to a user’s registry key. This means you need to set up an endpoint server for the incoming POST messages, which are sent every time the user turns Enterprise Mode on or off from the **Tools** menu. These POST messages go into your database, aggregating the report data by URL, giving you the total number of reports where users turned on Enterprise Mode, the total number of reports where users turned off Enterprise Mode, and the date of the last report. - - **To set up the sample** - -1. Set up a server to collect your Enterprise Mode information from your users. - -2. Go to the Internet Explorer/[EMIE-Data_Collection_Sample](https://go.microsoft.com/fwlink/p/?LinkId=507401) page on GitHub and tap or click the **Download ZIP** button to download the complete project. - -3. Open Microsoft Visual Studio 2013 with Update 2, and then open the PhoneHomeSample.sln file. - -4. On the **Build** menu, tap or click **Build Solution**.

              - The required packages are automatically downloaded and included in the solution. - - **To set up your endpoint server** - -5. Right-click on the name, PhoneHomeSample, and click **Publish**. - - ![Visual Studio, Publish menu.](images/ie-emie-publishsolution.png) - -6. In the **Publish Web** wizard, pick the publishing target and options that work for your organization. - - **Important**
              - Make sure you have a database associated with your publishing target. Otherwise, your reports won’t be collected and you’ll have problems deploying the website.  - - ![Visual Studio, Publish Web wizard.](images/ie-emie-publishweb.png) - - After you finish the publishing process, you need to test to make sure the app deployed successfully. - - **To test, deploy, and use the app** - -7. Open a registry editor on the computer where you deployed the app, go to the `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Main\EnterpriseMode` key, and change the **Enable** string to: - - ``` "Enable"="https:///api/records/" - ``` - Where `` points to your deployment URL. - -8. After you’re sure your deployment works, you can deploy it to your users using one of the following: - - - Turn on the **Let users turn on and use Enterprise Mode from the Tools menu** Group Policy setting, putting your `` information into the **Options** box. - - - Deploy the registry key in Step 3 using System Center or other management software. - -9. Get your users to visit websites, turning Enterprise Mode on or off locally, as necessary. - - **To view the report results** - -- Go to `https:///List` to see the report results.

              -If you’re already on the webpage, you’ll need to refresh the page to see the results. - - ![Enterprise Mode Result report with details.](images/ie-emie-reportwdetails.png) - - -### Troubleshooting publishing errors -If you have errors while you’re publishing your project, you should try to update your packages. - - **To update your packages** - -1. From the **Tools** menu of Microsoft Visual Studio, click **NuGet Package Manager**, and click **Manage NuGet Packages for Solution**. - - ![Nuget Package Manager for package updates.](images/ie-emie-packageupdate.png) - -2. Click **Updates** on the left side of the tool, and click the **Update All** button.

              -You may need to do some additional package cleanup to remove older package versions. - -## Related topics -- [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) -- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) -- [What is Enterprise Mode?](what-is-enterprise-mode.md) -- [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) -- [Turn on Enterprise Mode and use a site list](turn-on-enterprise-mode-and-use-a-site-list.md) - - diff --git a/browsers/internet-explorer/ie11-deploy-guide/set-up-enterprise-mode-portal.md b/browsers/internet-explorer/ie11-deploy-guide/set-up-enterprise-mode-portal.md deleted file mode 100644 index c022c08569..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/set-up-enterprise-mode-portal.md +++ /dev/null @@ -1,231 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Details about how to set up the Enterprise Mode Site List Portal for your organization. -author: dansimp -ms.prod: ie11 -title: Set up the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp ---- - -# Set up the Enterprise Mode Site List Portal - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -The Enterprise Mode Site List Portal is an open-source web tool on GitHub that allows you to manage your Enterprise Mode Site List, hosted by the app, with multiple users. The portal is designed to use IIS and a SQL Server backend, leveraging Active Directory (AD) for employee management. Updates to your site list are made by submitting new change requests, which are then approved by a designated group of people, put into a pre-production environment for testing, and then deployed immediately, or scheduled for deployment later. - -Before you can begin using the Enterprise Mode Site List Portal, you must set up your environment. - -## Step 1 - Copy the deployment folder to the web server -You must download the deployment folder (**EMIEWebPortal/**), which includes all of the source code for the website, from the [Enterprise Mode Site List Portal](https://github.com/MicrosoftEdge/enterprise-mode-site-list-portal) site to your web server. - -**To download the source code** -1. Download the deployment folder from the [Enterprise Mode Site List Portal](https://github.com/MicrosoftEdge/enterprise-mode-site-list-portal) source code to your web server. - -2. Install the Node.js® package manager, [npm](https://www.npmjs.com/). - - > [!NOTE] - > You need to install the npm package manager to replace all the third-party libraries we removed to make the Enterprise Mode Site List Portal open-source. - -3. Open File Explorer and then open the **EMIEWebPortal/** folder. - -4. Press and hold **Shift**, right-click the window, then click **Open PowerShell window here**. - -5. Type _npm i_ into the command prompt, then press **Enter**. - - Installs the npm package manager and bulk adds all the third-party libraries back into your codebase. - -6. Go back up a directory, open the solution file **EMIEWebPortal.sln** in Visual Studio, open **Web.config** from **EMIEWebPortal/** folder, and replace MSIT-LOB-COMPAT with your server name hosting your database, replace LOBMerged with your database name, and build the entire solution. - - > [!NOTE] - > Step 3 of this topic provides the steps to create your database. - -7. Copy the contents of the **EMIEWebPortal/** folder to a dedicated folder on your file system. For example, _D:\EMIEWebApp_. In a later step, you'll designate this folder as your website in the IIS Manager. - -## Step 2 - Create the Application Pool and website, by using IIS -Create a new Application Pool and the website, by using the IIS Manager. - -**To create a new Application Pool** -1. In IIS Manager, expand your local computer in the **Connections** pane, right-click **Application Pools**, then click **Add Application Pool**. - - The **Add Application Pool** box appears. - -2. In the **Add Application Pool** box, enter the following info: - - - **Name.** Type the name of your new application pool. For example, _EMIEWebAppPool_. - - - **.NET CLR version.** Pick the version of .NET CLR used by your application pool from the drop-down box. It must be version 4.0 or higher. - - - **Managed pipeline mode.** Pick **Integrated** from the drop-down box. IIS uses the integrated IIS and ASP.NET request-processing pipeline for managed content. - -3. Click **OK**. - -4. Select your new application pool from the **Application Pool** pane, click **Advanced Settings** from the **Edit Application Pool** area of the **Actions** pane. - - The **Advanced Settings** box appears. - -5. Make sure your **Identity** value is **ApplicationPoolIdentity**, click **OK**, and then close the box. - -6. Open File Explorer and go to your deployment directory, created in Step 1. For example, _D:\EMIEWebApp_. - -7. Right-click on the directory, click **Properties**, and then click the **Security** tab. - -8. Add your new application pool to the list (for example, _IIS AppPool\EMIEWebAppPool_) with **Full control access**, making sure the location searches the local computer. - -9. Add **Everyone** to the list with **Read & execute access**. - -**To create the website** -1. In IIS Manager, expand your local computer in the **Connections** pane, right-click **Sites**, then click **Add Website**. - - The **Add Website** box appears. - -2. In the **Add Website** box, type the name of your website into the **Site name** box. For example, _EMIEWebApp_, and then click **Select**. - - The **Select Application Pool** box appears. - -4. Pick the name of the application pool created earlier in this step, and then click **OK**. For example, _EMIEWebAppPool_. - -5. In the **Physical path** box, browse to your folder that contains your deployment directory. For example, _D:\EMIEWebApp_. - -6. Set up your **Binding**, including your **Binding Type**, **IP address**, and **Port**, as appropriate for your organization. - -7. Clear the **Start Website immediately** check box, and then click **OK**. - -8. In IIS Manager, expand your local computer, and then double-click your new website. For example, _EMIEWebApp_. - - The **<website_name> Home** pane appears. - -9. Double-click the **Authentication** icon, right-click on **Windows Authentication**, and then click **Enable**. - - > [!NOTE] - > You must also make sure that **Anonymous Authentication** is marked as **Enabled**. - -## Step 3 - Create and prep your database -Create a SQL Server database and run our custom query to create the Enterprise Mode Site List tables. - -**To create and prep your database** -1. Start SQL Server Management Studio. - -2. Open **Object Explorer** and then connect to an instance of the SQL Server Database Engine. - -3. Expand the instance, right-click on **Databases**, and then click **New Database**. - -4. Type a database name. For example, _EMIEDatabase_. - -5. Leave all default values for the database files, and then click **OK**. - -6. Open the **DatabaseScripts/Create DB Tables/1_CreateEMIETables.sql** query file, located in the deployment directory. - -7. Replace the database name placeholder with the database name you created earlier. For example, _EMIEDatabase_. - -8. Run the query. - -## Step 4 - Map your Application Pool to a SQL Server role -Map your ApplicationPoolIdentity to your database, adding the db_owner role. - -**To map your ApplicationPoolIdentity to a SQL Server role** -1. Start SQL Server Management Studio and connect to your database. - -2. Expand the database instance and then open the server-level **Security** folder. - - > [!IMPORTANT] - > Make sure you open the **Security** folder at the server level and not for the database. - -3. Right-click **Logins**, and then click **New Login**. - - The **Login-New** dialog box appears. - -4. Type the following into the **Login name** box, based on your server instance type: - - - **Local SQL Server instance.** If you have a local SQL Server instance, where IIS and SQL Server are on the same server, type the name of your Application Pool. For example, _IIS AppPool\EMIEWebAppPool_. - - - **Remote SQL Server instance.** If you have a remote SQL Server instance, where IIS and SQL Server are on different servers, type `Domain\ServerName$`. - - > [!IMPORTANT] - > Don't click **Search** in the **Login name** box. Login name searches will resolve to a ServerName\AppPool Name account and SQL Server Management Studio won't be able to resolve the account's virtual Security ID (SID). - -5. Click **User Mapping** from the **Select a page** pane, click the checkbox for your database (for example, _EMIEDatabase_) from the **Users mapped to this login** pane, and then click **db_owner** from the list of available roles in the **Database role membership** pane. - -6. Click **OK**. - -## Step 5 - Restart the Application Pool and website -Using the IIS Manager, you must restart both your Application Pool and your website. - -**To restart your Application Pool and website** -1. In IIS Manager, expand your local computer in the **Connections** pane, select your website, then click **Restart** from the **Manage Website** pane. - -2. In the **Connections** pane, select your Application Pool, and then click **Recycle** from the **Application Pool Tasks** pane. - -## Step 6 - Registering as an administrator -After you've created your database and website, you'll need to register yourself (or another employee) as an administrator for the Enterprise Mode Site List Portal. - -**To register as an administrator** -1. Open Microsoft Edge and type your website URL into the Address bar. For example, https://emieportal:8085. - -2. Click **Register now**. - -3. Type your name or alias into the **Email** box, making sure it matches the info in the drop-down box. - -4. Click **Administrator** from the **Role** box, and then click **Save**. - -5. Append your website URL with `/#/EMIEAdminConsole` in the Address bar to go to your administrator console. For example, https://emieportal:8085/#/EMIEAdminConsole. - - A dialog box appears, prompting you for the system user name and password. The default user name is EMIEAdmin and the default password is Admin123. We strongly recommend that you change the password by using the **Change password** link as soon as you're done with your first visit. - -6. Select your name from the available list, and then click **Activate**. - -7. Go to the Enterprise Mode Site List Portal Home page and sign in. - -## Step 7 - Configure the SMTP server and port for email notification -After you've set up the portal, you need to configure your SMTP server and port for email notifications from the system. - -**To set up your SMTP server and port for emails** -1. Open Visual Studio, and then open the web.config file from your deployment directory. - -2. Update the SMTP server and port info with your info, using this format: - - ``` - - - ``` -3. Open the **Settings** page in the Enterprise Mode Site List Portal, and then update the email account and password info. - -## Step 8 - Register the scheduler service -Register the EMIEScheduler tool and service for production site list changes. - -**To register the scheduler service** - -1. Open File Explorer and go to EMIEWebPortal.SchedulerService\EMIEWebPortal.SchedulerService in your deployment directory, and then copy the **App_Data**, **bin**, and **Logs** folders to a separate folder. For example, C:\EMIEService\. - - > [!IMPORTANT] - > If you can't find the **bin** and **Logs** folders, you probably haven't built the Visual Studio solution. Building the solution creates the folders and files. - -2. In Visual Studio start the Developer Command Prompt as an administrator, and then change the directory to the location of the InstallUtil.exe file. For example, _C:\Windows\Microsoft.NET\Framework\v4.0.30319_. - -3. Run the command, `InstallUtil ""`. For example, _InstallUtil "C:\EMIEService\bin\Debug\EMIEWebPortal.SchedulerService.exe"._ - - You'll be asked for your user name and password for the service. - -4. Open the **Run** command, type `Services.msc`, and then start the EMIEScheduler service. - -## Related topics -- [Enterprise Mode Site List Portal source code](https://github.com/MicrosoftEdge/enterprise-mode-site-list-portal) - -- [Enterprise Mode and the Enterprise Mode Site List](what-is-enterprise-mode.md) - -- [Use the Enterprise Mode Site List Manager tool or page](use-the-enterprise-mode-site-list-manager.md) diff --git a/browsers/internet-explorer/ie11-deploy-guide/setup-problems-with-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/setup-problems-with-ie11.md deleted file mode 100644 index 70d197c391..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/setup-problems-with-ie11.md +++ /dev/null @@ -1,70 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: support -ms.pagetype: appcompat -description: Reviewing log files to learn more about potential setup problems with Internet Explorer 11. -author: dansimp -ms.prod: ie11 -ms.assetid: 2cd79988-17d1-4317-bee9-b3ae2dd110a0 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Setup problems with Internet Explorer 11 (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Setup problems with Internet Explorer 11 - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -Installing Internet Explorer creates the following log files, which are stored in the Windows installation folder (typically, the C:\\Windows folder): - -- `IE11_main.log` - -- `IE11_NR_Setup.log` - -- `IE11_uninst.log` - -- `cbs*.log` - -- `WU_ IE11_LangPacks.log` - -These log files continuously record the entire process from the moment the IE setup program starts running until the last .cab file is downloaded, including error codes. The possible error codes are: - -|Error code |Description | -|-----------|-------------------------------------------| -|0 |Success | -|1460 |Timeout | -|3010 |Success, reboot required | -|40001 |USER_ERROR_CANNOT_OPEN_LOG_FILE | -|40003 |USER_ERROR_CANNOT_INITIALIZE_APPLICATION | -|40004 |USER_ERROR_OLD_OS_VERSION | -|40005 |USER_ERROR_WRONG_PLATFORM | -|40006 |USER_ERROR_BAD_SPVERSION | -|40007 |USER_ERROR_MISSING_REQUIRED_PREREQUISITE | -|40008 |USER_ERROR_IE_GREATERVERSION_INSTALLED | -|40010 |USER_ERROR_BAD_LANGUAGE | -|40012 |USER_ERROR_CRYPTO_VALIDATION_FAILED | -|40013 |USER_ERROR_ALREADY_INSTALLED | -|40015 |USER_ERROR_WRONG_OS | -|40016 |USER_ERROR_EXTRACTION_FAILED | -|40019 |USER_ERROR_WINDOWS_PRERELEASE_NOT_SUPPORTED | -|40021 |USER_ERROR_UNSUPPORTED_VIDEO_HARDWARE | -|40022 |USER_ERROR_UNSUPPORTED_VIDEO_DRIVER | -|40023 |USER_ERROR_PREREQUISITE_INSTALL_FAILED | -|40024 |USER_ERROR_NEUTRAL_CAB_DOWNLOAD_FAILED | -|40025 |USER_ERROR_NEUTRAL_CAB_INSTALL_FAILED | -|41001 |USER_ERROR_UNKNOWN | -|50005 |USER_SUCCESS_USER_CANCELLED | - -  - -  - -  - - - diff --git a/browsers/internet-explorer/ie11-deploy-guide/system-requirements-and-language-support-for-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/system-requirements-and-language-support-for-ie11.md deleted file mode 100644 index 818b3acf64..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/system-requirements-and-language-support-for-ie11.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: Lists the minimum system requirements and supported languages for Internet Explorer 11. -author: dansimp -ms.prod: ie11 -ms.assetid: 27185e3d-c486-4e4a-9c51-5cb317c0006d -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: System requirements and language support for Internet Explorer 11 (IE11) (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# System requirements and language support for Internet Explorer 11 (IE11) - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - - -**Applies to:** - -- Windows 10 -- Windows 8.1 Update -- Windows 7 with Service Pack 1 (SP1) -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -Internet Explorer 11 is available for a number of systems and languages. This topic provides info about the minimum system requirements and language support. - -## Minimum system requirements for IE11 -IE11 is pre-installed on Windows 8.1, Windows 10, and Windows Server 2012 R2 and is listed here for reference. For more info about IE11 on Windows 10, see [Browser: Microsoft Edge and Internet Explorer 11](/microsoft-edge/deploy/emie-to-improve-compatibility). - -**Important**
                -IE11 isn't supported on Windows 8 or Windows Server 2012. - -Some of the components in this table might also need additional system resources. Check the component's documentation for more information. - - -| Item | Minimum requirements | -|--------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Computer/processor | 1 gigahertz (GHz) 32-bit (x86) or 64-bit (x64) | -| Operating system |

              • Windows 10 (32-bit or 64-bit)
              • Windows 8.1 Update (32-bit or 64-bit)
              • Windows 7 with SP1 (32-bit or 64-bit)
              • Windows Server 2012 R2
              • Windows Server 2008 R2 with SP1 (64-bit only)
              | -| Memory |
              • Windows 10 (32-bit)-1 GB
              • Windows 10 (64-bit)-2 GB
              • Windows 8.1 Update (32-bit)-1 GB
              • Windows 8.1 Update (64-bit)-2 GB
              • Windows 7 with SP1 (32-bit or 64-bit)-512 MB
              • Windows Server 2012 R2-512 MB
              • Windows Server 2008 R2 with SP1 (64-bit only)-512 MB
              | -| Hard drive space |
              • Windows 10 (32-bit)-16 GB
              • Windows 10 (64-bit)-20 GB
              • Windows 8.1 Update (32-bit)-16 GB
              • Windows 8.1 Update (64-bit)-20 GB
              • Windows 7 with SP1 (32-bit)-70 MB
              • Windows 7 with SP1 (64-bit)-120 MB
              • Windows Server 2012 R2-32 GB
              • Windows Server 2008 R2 with SP1 (64-bit only)-200 MB
                • | -| Drive | CD-ROM drive (if installing from a CD-ROM) | -| Display | Super VGA (800 x 600) or higher-resolution monitor with 256 colors | -| Peripherals | Internet connection and a compatible pointing device | - -## Support for .NET Framework -You might experience start up issues where IE11 fails to launch an application that uses managed browser hosting controls with your legacy apps. This is because, starting with Internet Explorer 10, the browser started blocking legacy apps from using the .NET Framework 1.1 and 2.0. To fix this problem, see [.NET Framework problems with Internet Explorer 11](net-framework-problems-with-ie11.md). - -## Support for multiple languages -IE11 is available in 108 languages for Windows 8.1 and Windows 10 and in 97 languages for Windows 7 with SP1. For the list of languages and download links, see [Available language packs based on operating system](https://go.microsoft.com/fwlink/p/?LinkId=281818). - -Computers running localized versions of Windows should run the same version of IE11. For example, if your employees use the Spanish edition of Windows, you should deploy the Spanish version of IE11. On the other hand, if your employees use multiple localized versions of Windows, like Spanish, French, and Catalan, you should install IE11 in one of the languages, and then install language packs for the others. - - - diff --git a/browsers/internet-explorer/ie11-deploy-guide/tips-and-tricks-to-manage-ie-compatibility.md b/browsers/internet-explorer/ie11-deploy-guide/tips-and-tricks-to-manage-ie-compatibility.md deleted file mode 100644 index ec77071c73..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/tips-and-tricks-to-manage-ie-compatibility.md +++ /dev/null @@ -1,139 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Find out how to achieve better backward compatibility for your legacy web applications with the Enterprise Mode Site List. -author: dansimp -ms.author: dansimp -ms.prod: ie11 -ms.assetid: -ms.reviewer: -audience: itpro -manager: dansimp -title: Tips and tricks to manage Internet Explorer compatibility -ms.sitesec: library -ms.date: 05/10/2018 ---- - -# Tips and tricks to manage Internet Explorer compatibility - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - - -Find out how to achieve better backward compatibility for your legacy web applications with the Enterprise Mode Site List. - -Jump to: -- [Tips for IT professionals](#tips-for-it-professionals) -- [Tips for web developers](#tips-for-web-developers) - -[Enterprise Mode for Internet Explorer 11](enterprise-mode-overview-for-ie11.md) can be very effective in providing backward compatibility for older web apps. The Enterprise Mode Site List includes the ability to put any web app in any document mode, include IE8 and IE7 Enterprise Modes, without changing a single line of code on the website. - -![Internet Explorer Enterprise Modes and document modes.](images/img-enterprise-mode-site-list-xml.jpg) - -Sites in the \ section can be rendered in any document mode, as shown in blue above. Some sites designed for older versions of Internet Explorer may require better backward compatibility, and these can leverage the \ section of the Enterprise Mode Site List. IE8 Enterprise Mode provides higher-fidelity emulation for Internet Explorer 8 by using, among other improvements, the original Internet Explorer 8 user agent string. IE7 Enterprise Mode further improves emulation by adding Compatibility View. - -Compatibility View, first introduced with Internet Explorer 8, is basically a switch. If a webpage has no DOCTYPE, that page will be rendered in Internet Explorer 5 mode. If there is a DOCTYPE, the page will be rendered in Internet Explorer 7 mode. You can effectively get Compatibility View by specifying Internet Explorer 7 in the \ section, as this falls back to Internet Explorer 5 automatically if there's no DOCTYPE, or you can use IE7 Enterprise Mode for even better emulation. - -## Tips for IT professionals - -### Inventory your sites - -Upgrading to a new browser can be a time-consuming and potentially costly venture. To help reduce these costs, you can download the [Enterprise Site Discovery Toolkit](https://www.microsoft.com/download/details.aspx?id=44570), which can help you prioritize which sites you should be testing based on their usage in your enterprise. For example, if the data shows that no one is visiting a particular legacy web app, you may not need to test or fix it. The toolkit is supported on Internet Explorer 8, Internet Explorer 9, Internet Explorer 10, and Internet Explorer 11. The toolkit also gives you information about which document mode a page runs in your current browser so you can better understand how to fix that site if it breaks in a newer version of the browser. - -Once you know which sites to test and fix, the following remediation methods may help fix your compatibility issues in Internet Explorer 11 and Windows 10. - -### If you're on Internet Explorer 8 and upgrading to Internet Explorer 11: - -Use the Enterprise Mode Site List to add sites to the Internet Explorer 5, Internet Explorer 7, and Internet Explorer 8 documents modes, as well as IE8 Enterprise Mode and IE7 Enterprise Mode. - -- Sites with the *x-ua-compatible* meta tag or HTTP header set to "IE=edge" may break in Internet Explorer 11 and need to be set to Internet Explorer 8 mode. This is because "edge" in Internet Explorer 8 meant Internet Explorer 8 mode, but "edge" in Internet Explorer 11 means Internet Explorer 11 mode. - -- Sites without a DOCTYPE in zones other than Intranet will default to QME (or "interoperable quirks") rather than Internet Explorer 5 Quirks and may need to be set to Internet Explorer 5 mode. - -- Some sites may need to be added to both Enterprise Mode and Compatibility View to work. You can do this by adding the site to IE7 Enterprise Mode. - -### If you're on Internet Explorer 9 and upgrading to Internet Explorer 11: - -Use the Enterprise Mode Site List to add sites to the Internet Explorer 5, Internet Explorer 7, and Internet Explorer 9 document modes. - -- Sites with the *x-ua-compatible* meta tag or HTTP header set to "IE=edge" may break in Internet Explorer 11 and need to be set to Internet Explorer 9 mode. This is because "edge" in Internet Explorer 9 meant Internet Explorer 9 mode, but "edge" in Internet Explorer 11 means Internet Explorer 11 mode. - -- Sites without a DOCTYPE in zones other than Intranet will default to Interoperable Quirks rather than Internet Explorer 5 Quirks and may need to be set to Internet Explorer 5 mode. - -- If your sites worked in Internet Explorer 9, you won't need IE8 Enterprise Mode or IE7 Enterprise Mode. - -### If you're on Internet Explorer 10 and upgrading to Internet Explorer 11: - -Use the Enterprise Mode Site List to add sites to the Internet Explorer 5, Internet Explorer 7, and Internet Explorer 10 modes. - -- Sites with the *x-ua-compatible* meta tag or HTTP header set to "IE=edge" may break in Internet Explorer 11 and need to be set to Internet Explorer 10 mode. This is because "edge" in Internet Explorer 10 meant Internet Explorer 10 mode, but "edge" in Internet Explorer 11 means Internet Explorer 11 mode. - -- If your sites worked in Internet Explorer 10, you won't need IE8 Enterprise Mode or IE7 Enterprise Mode. - -### If you're on Internet Explorer 11 and upgrading to Windows 10: - -You're all set! You shouldn’t need to make any changes. - -## Tips for web developers - -If your website worked in an older version of Internet Explorer, but no longer works in Internet Explorer 11, you may need to update the site. Here are the set of steps you should take to find the appropriate remediation strategy. - -### Try document modes - -To see if the site works in the Internet Explorer 5, Internet Explorer 7, Internet Explorer 8, Internet Explorer 9, Internet Explorer 10, or Internet Explorer 11 document modes: - -- Open the site in Internet Explorer 11, load the F12 tools by pressing the **F12** key or by selecting **F12 Developer Tools** from the **Tools** menu, and select the **Emulation** tab. - - ![F12 Developer Tools Emulation tab.](images/img-f12-developer-tools-emulation.jpg) - -- Run the site in each document mode until you find the mode in which the site works. - - > [!NOTE] - > You will need to make sure the User agent string dropdown matches the same browser version as the Document mode dropdown. For example, if you were testing to see if the site works in Internet Explorer 10, you should update the Document mode dropdown to 10 and the User agent string dropdown to Internet Explorer 10. - -- If you find a mode in which your site works, you will need to add the site domain, sub-domain, or URL to the Enterprise Mode Site List for the document mode in which the site works, or ask the IT administrator to do so. You can add the *x-ua-compatible* meta tag or HTTP header as well. - -### Try IE8 Enterprise Mode - -If a document mode didn't fix your site, try IE8 Enterprise Mode, which benefits sites written for Internet Explorer 5, Internet Explorer 7, and Internet Explorer 8 document modes. - -- Enable the **Let users turn on and use Enterprise Mode from the Tools menu** policy locally on your machine. To do this: - - - Search for and run **gpedit.msc** - - - Navigate to **Computer Configuration** \> **Administrative Template** \> **Windows Components** \> **Internet Explorer**. - - - Enable the **Let users turn on and use Enterprise Mode from the Tools menu** Group Policy setting. - - After making this change, run **gpupdate.exe /force** to make sure the setting is applied locally. You should also make sure to disable this setting once you're done testing. Alternately, you can use a regkey; see [Turn on local control and logging for Enterprise Mode](turn-on-local-control-and-logging-for-enterprise-mode.md) for more information. - -- Restart Internet Explorer 11 and open the site you're testing, then go to **Emulation** tab in the **F12 Developer Tools** and select **Enterprise** from the **Browser profile** dropdown. If the site works, inform the IT administrator that the site needs to be added to the IE8 Enterprise Mode section. - -### Try IE7 Enterprise Mode - -If IE8 Enterprise Mode doesn't work, IE7 Enterprise Mode will give you the Compatibility View behavior that shipped with Internet Explorer 8 with Enterprise Mode. To try this approach: - -- Go to the **Tools** menu, select **Compatibility View Settings**, and add the site to the list. - -- Go to **Emulation** tab in the **F12 Developer Tools** and select **Enterprise** from the **Browser profile** dropdown. - -If the site works, inform the IT administrator that the site needs to be added to the IE7 Enterprise Mode section.\ - -> [!NOTE] -> Adding the same Web path to the Enterprise Mode and sections of the Enterprise Mode Site List will not work, but we will address this in a future update. - -### Update the site for modern web standards - -We recommend that enterprise customers focus their new development on established, modern web standards for better performance and interoperability across devices, and avoid developing sites in older Internet Explorer document modes. We often hear that, due to fact that the Intranet zone defaults to Compatibility View, web developers inadvertently create new sites in the Internet Explorer 7 or Internet Explorer 5 modes in the Intranet zone, depending on whether or not they used a DOCTYPE. As you move your web apps to modern standards, you can enable the **Turn on Internet Explorer Standards Mode for local intranet** Group Policy setting and add those sites that need Internet Explorer 5 or Internet Explorer 7 modes to the Site List. Of course, it is always a good idea to test the app to ensure that these settings work for your environment. - -## Related resources - -- [Document modes](https://msdn.microsoft.com/library/dn384051(v=vs.85).aspx) -- [What is Enterprise Mode?](what-is-enterprise-mode.md) -- [Turn on Enterprise Mode and use a site list](turn-on-enterprise-mode-and-use-a-site-list.md) -- [Enterprise Site Discovery Toolkit](https://www.microsoft.com/download/details.aspx?id=44570) -- [Collect data using Enterprise Site Discovery](collect-data-using-enterprise-site-discovery.md) -- [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) -- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) -- [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md) -- [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md) diff --git a/browsers/internet-explorer/ie11-deploy-guide/troubleshoot-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/troubleshoot-ie11.md deleted file mode 100644 index bf8ceeb867..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/troubleshoot-ie11.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: support -description: Use the topics in this section to learn how to troubleshoot several of the more common problems experienced with Internet Explorer. -author: dansimp -ms.prod: ie11 -ms.assetid: 0361c1a6-3faa-42b2-a588-92439eebeeab -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Troubleshoot Internet Explorer 11 (IE11) (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Troubleshoot Internet Explorer 11 (IE11) - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -Use the topics in this section to learn how to troubleshoot several of the more common problems experienced with Internet Explorer. - -## In this section - -|Topic |Description | -|-------|--------------| -|[Setup problems with Internet Explorer 11](setup-problems-with-ie11.md) |Guidance about how to find and understand the error log files created when setup runs. | -|[Install problems with Internet Explorer 11](install-problems-with-ie11.md) |Guidance about how to address potential problems when IE doesn’t finish installing. | -|[Problems after installing Internet Explorer 11](problems-after-installing-ie11.md) |Guidance about how to troubleshoot and help fix instability problems, where IE crashes or seems slow or where Digital Rights Management (DRM) playback doesn’t work. | -|[Auto configuration and auto proxy problems with Internet Explorer 11](auto-configuration-and-auto-proxy-problems-with-ie11.md) |Guidance about how to troubleshoot and help fix problems where branding changes aren’t distributed or where you’re experiencing proxy server setup problems. | -|[User interface problems with Internet Explorer 11](user-interface-problems-with-ie11.md) |Guidance about changes to the IE Customization Wizard, security zones, Favorites, Command, and Status bars, and the search box. | -|[Group Policy problems with Internet Explorer 11](group-policy-problems-ie11.md) |Guidance about how to find the Group Policy Object-related log files for troubleshooting. | -|[.NET Framework problems with Internet Explorer 11](net-framework-problems-with-ie11.md) |Guidance about how to turn managed browser hosting controls back on. | -|[Enhanced Protected Mode problems with Internet Explorer](enhanced-protected-mode-problems-with-ie11.md) |Guidance about how to turn off Enhanced Protected Mode to address compatibility issues. | -|[Fix font rendering problems by turning off natural metrics](turn-off-natural-metrics.md) |Guidance about how to turn off natural metrics to address font rendering problems. | -|[Intranet problems with Internet Explorer 11](intranet-problems-and-ie11.md) |Guidance about how to turn on single-word intranet searches in the address bar. | -|[Browser cache changes and roaming profiles](browser-cache-changes-and-roaming-profiles.md) |Guidance about changes we’ve made to the browser cache to improve the performance, flexibility, reliability, and scalability and how to get the best results while using a roaming profile. | - -  - -  - -  - - - diff --git a/browsers/internet-explorer/ie11-deploy-guide/turn-off-enterprise-mode.md b/browsers/internet-explorer/ie11-deploy-guide/turn-off-enterprise-mode.md deleted file mode 100644 index fdb532ae11..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/turn-off-enterprise-mode.md +++ /dev/null @@ -1,84 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: How to turn Enterprise Mode off temporarily while testing websites and how to turn it off completely if you no longer want to to use it. -author: dansimp -ms.prod: windows-client -ms.assetid: 5027c163-71e0-49b8-9dc0-f0a7310c7ae3 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Turn off Enterprise Mode (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Turn off Enterprise Mode - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -It’s important that you test the sites you’re adding, or considering removing, from your Enterprise Mode site list. To make this testing easier, you can turn off the site list or the entire Enterprise Mode functionality. For example, you might have an intranet site on your list that you’ve upgraded to be compatible with the new web standards . If you test the site while the site list is active, Internet Explorer 11 will automatically switch to Enterprise Mode. By turning off the site list, you can see what the page actually looks like and decide whether to remove it from your site list. - -In addition, if you no longer want your users to be able to turn Enterprise Mode on locally, you can remove Enterprise Mode from the local **Tools** menu. - -**Important**
                  -Turning off both of these features turns off Enterprise Mode for your company. Turning off Enterprise Mode also causes any websites included in your employee’s manual site lists to not appear in Enterprise Mode. - - **To turn off the site list using Group Policy** - -1. Open your Group Policy editor, like Group Policy Management Console (GPMC). - -2. Go to the **Use the Enterprise Mode IE website list** setting, and then click **Disabled**.

                  - Enterprise Mode will no longer look for the site list, effectively turning off Enterprise Mode. However, if you previously turned on local control for your employees, Enterprise Mode will still be available from the **Tools** menu. You need to turn that part of the functionality off separately. - - **To turn off local control using Group Policy** - -3. Open your Group Policy editor, like Group Policy Management Console (GPMC). - -4. Go to the **Let users turn on and use Enterprise Mode from the Tools menu** setting, and then click **Disable**. - -5. Enterprise Mode no longer shows up on the **Tools** menu for your employees. However, if you are still using an Enterprise Mode site list, all of the globally listed sites will still appear in Enterprise Mode. If you want to turn off all of Enterprise Mode, you will need to also turn off the site list functionality. - - **To turn off the site list using the registry** - -6. Open a registry editor, such as regedit.exe. - -7. Go to `HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\EnterpriseMode`, and then delete the **SiteList** value.

                  - You can also use HKEY_LOCAL_MACHINE, depending whether you want to turn off the Enterprise Mode site list for users or for computers. - -8. Close all and restart all instances of Internet Explorer.

                  - IE11 stops looking at the site list for rendering instructions. However, Enterprise Mode is still available to your users locally (if it was turned on). - - **To turn off local control using the registry** - -9. Open a registry editor, such as regedit.exe. - -10. Go `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Main\EnterpriseMode`, and then delete the **Enable** value.

                  - You can also use HKEY_CURRENT_USER, depending whether you want to turn off Enterprise Mode for users or for computers. - -11. Close and restart all instances of IE.

                  - Enterprise Mode is no longer a user option on the **Tools** menu in IE11. However, IE11 still looks at the site list (if it was turned on). - -## Related topics -- [What is Enterprise Mode?](what-is-enterprise-mode.md) -- [Turn on Enterprise Mode and use a site list](turn-on-enterprise-mode-and-use-a-site-list.md) -- [Turn on local control and logging for Enterprise Mode](turn-on-local-control-and-logging-for-enterprise-mode.md) -- [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) - - - - - - diff --git a/browsers/internet-explorer/ie11-deploy-guide/turn-off-natural-metrics.md b/browsers/internet-explorer/ie11-deploy-guide/turn-off-natural-metrics.md deleted file mode 100644 index 178085c2ad..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/turn-off-natural-metrics.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: support -description: Turn off natural metrics for Internet Explorer 11 -author: dansimp -ms.prod: ie11 -ms.assetid: e31a27d7-662e-4106-a3d2-c6b0531961d5 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Fix font rendering problems by turning off natural metrics (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Fix font rendering problems by turning off natural metrics - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -By default, Internet Explorer 11 uses “natural metrics”. Natural metrics use inter-pixel spacing that creates more accurately rendered and readable text, avoiding many common font rendering problems with Windows Internet Explorer 9 or older sites. - -However, you might find that many intranet sites need you to use Windows Graphics Device Interface (GDI) metrics. To avoid potential compatibility issues, you must turn off natural metrics for those sites. - - **To turn off natural metrics** - -- Add the following HTTP header to each site: `X-UA-TextLayoutMetrics: gdi` - -

                  -OR-

                  - -- Add the following <meta> tag to each site: `` - -Turning off natural metrics automatically turns on GDI metrics. - - - - - - - diff --git a/browsers/internet-explorer/ie11-deploy-guide/turn-on-enterprise-mode-and-use-a-site-list.md b/browsers/internet-explorer/ie11-deploy-guide/turn-on-enterprise-mode-and-use-a-site-list.md deleted file mode 100644 index 1b32fa64ad..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/turn-on-enterprise-mode-and-use-a-site-list.md +++ /dev/null @@ -1,69 +0,0 @@ ---- -title: Turn on Enterprise Mode and use a site list (Internet Explorer 11 for IT Pros) -description: How to turn on Enterprise Mode and specify a site list. -ms.assetid: 800e9c5a-57a6-4d61-a38a-4cb972d833e1 -ms.reviewer: -audience: itpro -manager: dansimp -ms.prod: ie11 -ms.mktglfcycl: deploy -ms.pagetype: appcompat -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.date: 08/14/2017 -ms.localizationpriority: medium ---- - - -# Turn on Enterprise Mode and use a site list - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -Before you can use a site list with Enterprise Mode, you need to turn the functionality on and set up the system for centralized control. By allowing centralized control, you can create one global list of websites that render using Enterprise Mode. Approximately 65 seconds after Internet Explorer 11 starts, it looks for a properly formatted site list. If a new site list if found, with a different version number than the active list, IE11 loads and uses the newer version. After the initial check, IE11 won’t look for an updated list again until you restart the browser. - -> [!NOTE] -> We recommend that you store and download your website list from a secure web server (https://), to help protect against data tampering. After the list is downloaded, it's stored locally on your employees' computers so if the centralized file location is unavailable, they can still use Enterprise Mode. - - **To turn on Enterprise Mode using Group Policy** - -1. Open your Group Policy editor and go to the `Administrative Templates\Windows Components\Internet Explorer\Use the Enterprise Mode IE website list` setting.

                  - Turning this setting on also requires you to create and store a site list. For more information about creating your site list, see the [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) topics. - - ![local group policy editor for using a site list.](images/ie-emie-grouppolicysitelist.png) - -2. Click **Enabled**, and then in the **Options** area, type the location to your site list. - - **To turn on Enterprise Mode using the registry** - -3. **For only the local user:** Open a registry editor, like regedit.exe and go to `HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Main\EnterpriseMode`. -

                  -OR-

                  - For all users on the device: Open a registry editor, like regedit.exe and go to HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Main\EnterpriseMode. - -4. Edit the `SiteList` registry key to point to where you want to keep your Enterprise Mode site list file. For example: - - ![enterprise mode with site list in the registry.](images/ie-emie-registrysitelist.png) - - - **HTTPS location**: `"SiteList"="https://localhost:8080/sites.xml"` - - - **Local network:** `"SiteList"="\\network\shares\sites.xml"` - - - **Local file:** `"SiteList"="file:///c:\\Users\\\\Documents\\testList.xml"` - - All of your managed devices must have access to this location if you want them to be able to access and use Enterprise Mode and your site list. For information about how to create and use an Enterprise Mode site list, see [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md). - -## Related topics -- [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) -- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) -- [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md) -- [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md) - diff --git a/browsers/internet-explorer/ie11-deploy-guide/turn-on-local-control-and-logging-for-enterprise-mode.md b/browsers/internet-explorer/ie11-deploy-guide/turn-on-local-control-and-logging-for-enterprise-mode.md deleted file mode 100644 index 6290d3a462..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/turn-on-local-control-and-logging-for-enterprise-mode.md +++ /dev/null @@ -1,65 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Turn on local user control and logging for Enterprise Mode. -author: dansimp -ms.prod: ie11 -ms.assetid: 6622ecce-24b1-497e-894a-e1fd5a8a66d1 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Turn on local control and logging for Enterprise Mode (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Turn on local control and logging for Enterprise Mode - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -You can turn on local control of Enterprise Mode so that your users can turn Enterprise Mode on from the **Tools** menu. Turning on this feature also adds the **Enterprise** browser profile to the **Emulation** tab of the F12 developer tools. - -Besides turning on this feature, you also have the option to provide a URL for Enterprise Mode logging. If you turn logging on, Internet Explorer initiates a simple POST back to the supplied address, including the URL and a specification that **EnterpriseMode** was turned on or off through the **Tools** menu. - - **To turn on local control of Enterprise Mode using Group Policy** - -1. Open your Group Policy editor and go to the **Administrative Templates\\Windows Components\\Internet Explorer\\Let users turn on and use Enterprise Mode from the Tools menu** setting. - - ![group policy editor with emie setting.](images/ie-emie-editpolicy.png) - -2. Click **Enabled**, and then in the **Options** area, type the location for where to receive reports about when your employees use this functionality to turn Enterprise Mode on or off from the **Tools** menu. - - **To turn on local control of Enterprise Mode using the registry** - -3. Open a registry editor, like regedit.exe and go to `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Main\EnterpriseMode`. - -4. In the right pane, right-click and click **New**, click **String Value**, and then name the new value **Enable**. - -5. Right-click the **Enable** key, click **Modify**, and then type a **Value data** to point to a server that you can listen to for updates. - - ![edit registry string for data collection location.](images/ie-emie-editregistrystring.png) - -Your **Value data** location can be any of the following types: - -- **URL location**, for example: `https://www.emieposturl.com/api/records` or `https://localhost:13000`. IE sends a POST message to the URL every time a change is made to Enterprise Mode from the **Tools** menu. - - > [!Important] - > The `https://www.emieposturl.com/api/records` example will only work if you've downloaded the sample discussed in the [Set up Enterprise Mode logging and data collection](set-up-enterprise-mode-logging-and-data-collection.md) article. If you don't have the sample, you won't have the web API. - -- **Local network location**, for example: `https://emieposturl/`. IE sends a POST message to your specified local network location every time a change is made to Enterprise Mode from the **Tools** menu. - -- **Empty string**. If you leave the **Value data** box blank; your employees will be able to turn Enterprise Mode on and off from the **Tools** menu, but you won't collect any logging data. - -For information about how to collect the data provided when your employees turn Enterprise Mode on or off from the **Tools** menu, see [Set up Enterprise Mode logging and data collection](set-up-enterprise-mode-logging-and-data-collection.md). diff --git a/browsers/internet-explorer/ie11-deploy-guide/updated-features-and-tools-with-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/updated-features-and-tools-with-ie11.md deleted file mode 100644 index 98739a8df1..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/updated-features-and-tools-with-ie11.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: High-level info about some of the new and updated features for Internet Explorer 11. -author: dansimp -ms.prod: windows-client -ms.assetid: f53c6f04-7c60-40e7-9fc5-312220f08156 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: List of updated features and tools - Internet Explorer 11 (IE11) (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# List of updated features and tools - Internet Explorer 11 (IE11) - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - - -**Applies to:** - -- Windows 10 -- Windows 8.1 Update -- Windows 7 with Service Pack 1 (SP1) -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -Internet Explorer 11 includes several new features and tools. This topic includes high-level info about the each of them. - -## Updated features and tools -- **Updated web standards.** WebGL, Canvas 2D L2 extensions, fullscreen API, encrypted media extensions, media source extensions, CSS flexible box layout module, mutation observers, like DOM4 and 5.3. - -- **Enhanced Protected Mode.** Extends Protected Mode to further restrict the ability of an attacker to access sensitive or personal information in personal and corporate environments. This feature is turned off by default. For more info, see [Enhanced Protected Mode problems with Internet Explorer](enhanced-protected-mode-problems-with-ie11.md). - -- **Enterprise Mode.** Enterprise Mode, a compatibility mode that runs on IE11 on Windows 8.1 Update and Windows 7 devices, lets websites render using a modified browser configuration that’s designed to emulate Windows Internet Explorer 8, avoiding the common compatibility problems associated with web apps written and tested on older versions of Internet Explorer. For more info, see [What is Enterprise Mode?](what-is-enterprise-mode.md) - -- **Out-of-date ActiveX control blocking**. Helps to keep your ActiveX controls up-to-date, because malicious software (or malware) can target security flaws in outdated controls, damaging your computer by collecting info from it, installing unwanted software, or by letting someone else control it remotely. For more info, see [Out-of-date ActiveX control blocking](out-of-date-activex-control-blocking.md). - -- **Do Not Track (DNT) exceptions.** IE11 lets websites ask whether to track users as they browse a website. If the user approves the request, IE records an exception to the "Do Not Track" rule and sends headers to the website that allow tracking. By respecting these headers and requesting exceptions to the default privacy settings, website owners can develop a trusted relationship with their users about privacy. For more info, see [Internet Explorer 11 - FAQ for IT Pros](../ie11-faq/faq-for-it-pros-ie11.yml). - -- **IE Administration Kit (IEAK).** Lets you create custom, branded versions of IE11. For more info and to download the tool, see [Internet Explorer Administration Kit 11 (IEAK 11) - Administration Guide for IT Pros](../ie11-ieak/index.md). - -- **Unattend Settings.** Lets you update the Unattend.xml file, to customize the home page, favorites, search providers, feeds, Accelerators, Web Slices, and settings for top result searches. For more info, see the [Unattend Settings: Microsoft-Windows-IE-InternetExplorer](/previous-versions/windows/it-pro/windows-8.1-and-8/ff715726(v=win.10)). - -  - -  \ No newline at end of file diff --git a/browsers/internet-explorer/ie11-deploy-guide/use-the-enterprise-mode-portal.md b/browsers/internet-explorer/ie11-deploy-guide/use-the-enterprise-mode-portal.md deleted file mode 100644 index fe55abfdc6..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/use-the-enterprise-mode-portal.md +++ /dev/null @@ -1,88 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Use the topics in this section to learn about how to use the Enterprise Mode Site List Portal. -ms.prod: ie11 -title: Use the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 -ms.reviewer: dansimp -audience: itpro -manager: dansimp -ms.author: dansimp -author: dansimp ---- - -# Use the Enterprise Mode Site List Portal - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -Enterprise Mode is a compatibility mode that runs on Internet Explorer 11, letting websites render using a modified browser configuration that’s designed to emulate either Windows Internet Explorer 8 or Windows Internet Explorer 7, avoiding the common compatibility problems associated with web apps written and tested on older versions of Internet Explorer. - -The Enterprise Mode Site List Portal is an open-source web tool on GitHub that allows you to manage your Enterprise Mode Site List, hosted by the app, with multiple users. The portal is designed to use IIS and a SQL Server backend, leveraging Active Directory (AD) for employee management. Updates to your site list are made by submitting new change requests, which are then approved by a designated group of people, put into a pre-production environment for testing, and then deployed immediately, or scheduled for deployment later. - -You can use IE11 and the Enterprise Mode Site List Portal to manage your Enterprise Mode Site List, hosted by the app, with multiple users. - -## Minimum system requirements for portal and test machines -Some of the components in this table might also need additional system resources. Check the component's documentation for more information. - -|Item |Description | -|-----|------------| -|Operating system |Windows 7 or later | -|Memory |16 GB RAM | -|Hard drive space |At least 8 GB of free space, formatted using the NTFS file system for better security | -|Active Directory (AD) |Devices must be domain-joined | -|SQL Server |Microsoft SQL Server Enterprise Edition 2012 or later | -|Visual Studio |Visual Studio 2015 or later | -|Node.js® package manager |npm Developer version or higher | -|Additional server infrastructure |Internet Information Service (IIS) 6.0 or later | - -## Role assignments and available actions -Admins can assign roles to employees for the Enterprise Mode Site List Portal, allowing the employees to perform specific actions, as described in this table. - -|Role assignment |Available actions | -|----------------|------------------| -|Requester |

                  • Create a change request


                  • Validate changes in the pre-production environment


                  • Rollback pre-production and production changes in case of failure


                  • Send approval requests


                  • View own requests


                  • Sign off and close own requests
                  | -|Approver

                  (includes the App Manager and Group Head roles) |
                  • All of the Requester actions, plus:


                  • Approve requests
                  | -|Administrator |
                  • All of the Requester and Approver actions, plus:


                  • Add employees to the portal


                  • Assign employee roles


                  • Approve registrations to the portal


                  • Configure portal settings (for example, determine the freeze schedule, determine the pre-production and production XML paths, and determine the attachment upload location)


                  • Use the standalone Enterprise Mode Site List Manager page


                  • View reports
                  | - -## Enterprise Mode Site List Portal workflow by employee role -The following workflow describes how to use the Enterprise Mode Site List Portal. - -1. [The Requester submits a change request for an app](create-change-request-enterprise-mode-portal.md) - -2. [The Requester tests the change request info, verifying its accuracy](verify-changes-preprod-enterprise-mode-portal.md) - -3. [The Approver(s) group accepts the change request](approve-change-request-enterprise-mode-portal.md) - -4. [The Requester schedules the change for the production environment](schedule-production-change-enterprise-mode-portal.md) - -5. [The change is verified against the production site list and signed off](verify-changes-production-enterprise-mode-portal.md) - - -## Related topics -- [Set up the Enterprise Mode Site List Portal](set-up-enterprise-mode-portal.md) - -- [Workflow-based processes for employees using the Enterprise Mode Site List Portal](workflow-processes-enterprise-mode-portal.md) - -- [How to use the Enterprise Mode Site List Manager tool or page](use-the-enterprise-mode-site-list-manager.md) - -- [Enterprise Mode Site List Portal source code](https://github.com/MicrosoftEdge/enterprise-mode-site-list-portal) - -- [Enterprise Mode and the Enterprise Mode Site List](what-is-enterprise-mode.md) -  - -  - - - diff --git a/browsers/internet-explorer/ie11-deploy-guide/use-the-enterprise-mode-site-list-manager.md b/browsers/internet-explorer/ie11-deploy-guide/use-the-enterprise-mode-site-list-manager.md deleted file mode 100644 index cbfcfecf93..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/use-the-enterprise-mode-site-list-manager.md +++ /dev/null @@ -1,76 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Use the topics in this section to learn about how to use the Enterprise Mode Site List Manager. -author: dansimp -ms.prod: ie11 -ms.assetid: f4dbed4c-08ff-40b1-ab3f-60d3b6e8ec9b -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Use the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 12/04/2017 ---- - - -# Use the Enterprise Mode Site List Manager - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -Enterprise Mode is a compatibility mode that runs on Internet Explorer 11, letting websites render using a modified browser configuration that's designed to emulate either Windows Internet Explorer 8 or Windows Internet Explorer 7, avoiding the common compatibility problems associated with web apps written and tested on older versions of Internet Explorer. - -You can use IE11 and the Enterprise Mode Site List Manager to add individual website domains and domain paths and to specify whether the site renders using Enterprise Mode or the default mode. - -## Enterprise Mode Site List Manager versions -There are currently two versions of the Enterprise Site List Manager, both based on your schema and operating system. Download the [Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) or the [Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) tool, based on your operating system. - -|Schema version |Operating system |Enterprise Site List Manager version | -|-----------------|---------------|------------------------------------| -|Enterprise Mode schema, version 2 (v.2) |Windows 10
                  -OR-
                  Windows 8.1
                  -OR-
                  Windows 7|Uses the Enterprise Mode Site List Manager (schema v.2) and the v.2 version of the schema. If you import a v.1 version schema into the Enterprise Mode Site List Manager (schema v.2), the XML is saved into the v.2 version of the schema.

                  For more info about the v.2 version of the schema, see [Enterprise Mode schema v.2 guidance](enterprise-mode-schema-version-2-guidance.md).| -|Enterprise Mode schema, version 1 (v.1) |Windows 10
                  -OR-
                  Windows 8.1
                  -OR-
                  Windows 7|Uses the Enterprise Mode Site List Manager (schema v.1) and the v.1 version of the schema.

                  For more info about the v.1 version of the schema, see [Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md)| - -## Using the Enterprise Mode Site List Manager -The following topics give you more information about the things that you can do with the Enterprise Mode Site List Manager. - -|Topic |Description | -|------|------------| -|[Add sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.2)](add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md) |How to add websites to your site list using the Enterprise Mode Site List Manager (schema v.2). | -|[Add sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.1)](add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md) |How to add websites to your site list using the Enterprise Mode Site List Manager (schema v.1). | -|[Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md) |How to add several websites to your site list at the same time, using a text or XML file and the Enterprise Mode Site List Manager (schema v.2). | -|[Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md) |How to add several websites to your site list at the same time, using a text or XML file and the WEnterprise Mode Site List Manager (schema v.1). | -|[Edit the Enterprise Mode site list using the Enterprise Mode Site List Manager](edit-the-enterprise-mode-site-list-using-the-enterprise-mode-site-list-manager.md) |How to edit the compatibility mode for specific websites.

                  This topic applies to both versions of the Enterprise Mode Site List Manager. | -|[Fix validation problems using the Enterprise Mode Site List Manager](fix-validation-problems-using-the-enterprise-mode-site-list-manager.md) |How to fix common site list validation errors.

                  This topic applies to both versions of the Enterprise Mode Site List Manager. | -|[Review neutral sites for Internet Explorer mode using the Enterprise Mode Site List Manager](review-neutral-sites-with-site-list-manager.md) |How to flag sites listed as neutral, to ensure that they are intentional and not a result of schema conversion. This topic applies to the Enterprise Mode Site List Manager version 11.0 or later. | -|[Search your Enterprise Mode site list in the Enterprise Mode Site List Manager](search-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md) |How to look to see if a site is already in your global Enterprise Mode site list.

                  This topic applies to both versions of the Enterprise Mode Site List Manager. | -|[Save your site list to XML in the Enterprise Mode Site List Manager](save-your-site-list-to-xml-in-the-enterprise-mode-site-list-manager.md) |How to save a site list as XML, so you can deploy and use it with your managed systems.

                  This topic applies to both versions of the Enterprise Mode Site List Manager. | -|[Export your Enterprise Mode site list from the Enterprise Mode Site List Manager](export-your-enterprise-mode-site-list-from-the-enterprise-mode-site-list-manager.md) |How to export your site list so you can transfer your data and contents to someone else.

                  This topic applies to both versions of the Enterprise Mode Site List Manager. | -|[Import your Enterprise Mode site list to the Enterprise Mode Site List Manager](import-into-the-enterprise-mode-site-list-manager.md) |How to import your site list to replace a corrupted or out-of-date list.

                  This topic applies to both versions of the Enterprise Mode Site List Manager. | -|[Delete sites from your Enterprise Mode site list in the Enterprise Mode Site List Manager](delete-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md) |How to delete a website from your site list.

                  This topic applies to both versions of the Enterprise Mode Site List Manager. | -|[Remove all sites from your Enterprise Mode site list in the Enterprise Mode Site List Manager](remove-all-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md) |How to delete all of the websites in a site list.

                  This topic applies to both versions of the Enterprise Mode Site List Manager. | -| [Review neutral sites for Internet Explorer mode using the Enterprise Mode Site List Manager](review-neutral-sites-with-site-list-manager.md)|How to flag sites listed as neutral, to ensure that they are intentional and not a result of schema conversion.

                  This topic applies to the latest version of the Enterprise Mode Site List Manager. - -## Related topics - - -- [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) -- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) -- [Enterprise Mode schema v.2 guidance](enterprise-mode-schema-version-2-guidance.md) -- [Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md) -  - -  - - - diff --git a/browsers/internet-explorer/ie11-deploy-guide/user-interface-problems-with-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/user-interface-problems-with-ie11.md deleted file mode 100644 index b7669cf1ca..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/user-interface-problems-with-ie11.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: support -description: Info about where features went in the IEAK11, where the Favorites, Command, and Status bars went, and where the search bar went. -author: dansimp -ms.prod: ie11 -ms.assetid: 7324faff-ccb6-4e14-ad91-af12dbca575e -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: User interface problems with Internet Explorer 11 (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# User interface problems with Internet Explorer 11 - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -Some of the features in both Internet Explorer 11 and IEAK 11 have moved around. Here are some of the more common changes. - -## Where did features go in the Internet Explorer Customization Wizard 11? -Various installation or set up choices can prevent you from seeing certain pages in the Internet Explorer Customization Wizard 11. If, after going through the entire Wizard you still haven't found the screen you were looking for, try: - -- Making sure you picked the right version of IEAK 11 during installation. Most administrators should pick the **Internal** version, which has more screens and options available. - -- Making sure you picked all of the features you wanted from the **Feature Selection** page of the IE Customization Wizard 11. If you don't pick a feature, the associated page won't appear. - -## Where are the security zone settings? -You can see your security zone settings by opening Internet Explorer for the desktop, clicking **Internet Options** from the **Tools** menu, and then clicking **Security**. - -## Where did the Favorites, Command, and Status bars go? -For IE11, the UI has been changed to provide just the controls needed to support essential functionality, hiding anything considered non-essential, such as the **Favorites Bar**, **Command Bar**, **Menu Bar**, and **Status Bar**. This is intended to help focus users on the content of the page, rather than the browser itself. However, if you want these bars to appear, you can turn them back on using Group Policy settings. - - **To turn the toolbars back on** - -- Right click in the IE toolbar heading and choose to turn on the **Command bar**, **Favorites bar**, and **Status bar** from the menu. -

                  -OR-

                  - In IE, press ALT+V to show the View menu, press T to enter the Toolbars menu, and then press: - - - **C** to turn on the **Command Bar** - - - **F** to turn on the **Favorites Bar** - - - **S** to turn on the **Status Bar** - -## Where did the search box go? -IE11 uses the **One Box** feature, which lets users type search terms directly into the **Address bar**. Any text entered into the **Address bar** that doesn't appear to be a URL is automatically sent to the currently selected search provider. - -> [!NOTE] -> Depending on how you've set up your intranet search, the text entry might resolve to an intranet site. For more information about this, see [Intranet problems with Internet Explorer 11](intranet-problems-and-ie11.md). - diff --git a/browsers/internet-explorer/ie11-deploy-guide/using-enterprise-mode.md b/browsers/internet-explorer/ie11-deploy-guide/using-enterprise-mode.md deleted file mode 100644 index 677f1c974a..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/using-enterprise-mode.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: security -description: Use this section to learn about how to turn on and use IE7 Enterprise Mode or IE8 Enterprise Mode. -author: dansimp -ms.prod: ie11 -ms.assetid: 238ead3d-8920-429a-ac23-02f089c4384a -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Using IE7 Enterprise Mode or IE8 Enterprise Mode (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Using IE7 Enterprise Mode or IE8 Enterprise Mode - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -Enterprise Mode gives you a way for your legacy websites and apps to run using emulated versions of Windows Internet Explorer 7 or Windows Internet Explorer 8, while your new sites and apps run using Internet Explorer 11, including modern standards and features. - -Although it’s called IE7 Enterprise Mode, it actually turns on Enterprise Mode along with Internet Explorer 7 or Microsoft Internet Explorer 5 Compatibility View. Compatibility View chooses which document mode to use based on whether there’s a `DOCTYPE` tag in your code: - -- **DOCTYPE tag found.** Webpages render using the Internet Explorer 7 document mode. -- **No DOCTYPE tag found.** Webpages render using the Internet Explorer 5 document mode. - -**Important**
                  -Because we’ve added the IE7 Enterprise Mode option, we’ve had to rename the original functionality of Enterprise Mode to be IE8 Enterprise Mode. We’ve also replaced Edge Mode with IE11 Document Mode, so you can explicitly use IE11 on Windows 10. - -## Turning on and using IE7 Enterprise Mode or IE8 Enterprise Mode -For instructions about how to add IE7 Enterprise Mode or IE8 Enterprise Mode to your webpages and apps, see: - -- [Add single sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.2)](add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md) - -- [Add single sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.1)](add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md) - -- [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md) - -- [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md) - -For instructions and more info about how to fix your compatibility issues using Enterprise Mode, see [Fix web compatibility issues using document modes and the Enterprise Mode site list](fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md). - -## Related topics -- [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) -- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) -- [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) -  - -  - - - diff --git a/browsers/internet-explorer/ie11-deploy-guide/using-ieak11-to-create-install-packages.md b/browsers/internet-explorer/ie11-deploy-guide/using-ieak11-to-create-install-packages.md deleted file mode 100644 index 2090ed72ef..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/using-ieak11-to-create-install-packages.md +++ /dev/null @@ -1,70 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to use IEAK 11 while planning, customizing, and building the custom installation package. -author: dansimp -ms.prod: ie11 -ms.assetid: af93742f-f955-44ab-bfa2-7bf0c99045d3 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Using Internet Explorer Administration Kit 11 (IEAK 11) to create packages (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Using Internet Explorer Administration Kit 11 (IEAK 11) to create packages - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -Internet Explorer Administration Kit 11 (IEAK 11) helps you set up, deploy, and maintain Internet Explorer 11. - -**Note**
                  IEAK 11 works in network environments, with or without Microsoft Active Directory. - -  - -## Plan, Customize, and Build with the IEAK 11 -Consider these activities while planning, customizing, and building the custom installation package. - -### Plan -Before you begin, you should: - -- **Check the operating system requirements.** Check that the requirements for the computer you're building your installation package from, and the computers you're installing IE11 to, all meet the system requirements for IEAK 11 and IE11. For Internet Explorer requirements, see [System requirements and language support for Internet Explorer 11 (IE11)](system-requirements-and-language-support-for-ie11.md). For IEAK 11 requirements, see [Internet Explorer Administration Kit 11 (IEAK 11) - Administration Guide for IT Pros](../ie11-ieak/index.md). - -- **Decide on your distribution method.** Decide how to distribute your custom installation package: Windows Update, Microsoft Configuration Manager, or your network. - -- **Gather URLs and branding and custom graphics.** Collect the URLs for your company's own **Home**, **Search**, and **Support** pages, plus any custom branding and graphic files for the browser toolbar button and the **Favorites** list icons. - -- **Identify trusted network servers.** Decide which servers your employees should use to install the custom IE package. These servers need to be listed as trusted sites. - -- **Set up automatic detection and configuration settings.** Decide whether to automatically customize IE11 the first time it's started. - -- **Identify custom components for uninstallation.** Decide whether to include any custom uninstallation programs. Uninstallation programs let your employees remove your custom components through **Uninstall or change a program** in the Control Panel. - -- **Identify ActiveX controls.** Decide if you'll use ActiveX controls in your company. If you already use ActiveX, you should get an inventory of your active controls. - -### Customize and build -After installing IE11 and the IEAK 11, you should: - -- **Prepare your build computer.** Create your build environment on the computer you're using to build the custom package. - -- **Create your branding and custom graphics.** If you don't have any, create custom branding and graphic files for the browser toolbar button and icons in your **Favorites** list. - -- **Specify your servers as trusted sites.** Identify your installation servers as trusted sites, in the **Trusted sites zone** of the **Internet Options** box. - -- **Turn on automatic detection and configuration settings (Optional).** Set up your network so that IE is automatically customized the first time it's started. - -- **Set up custom components for uninstallation.** Create the custom .inf file you'll use to register your custom uninstallation programs. - -- **Set up ActiveX controls.** Add any new ActiveX controls to the Axaa.adm file, using a text editor. - -- **Create a custom browser package.** Create your custom installation package, using IE Customization Wizard 11. For more information about using the wizard, see [Internet Explorer Administration Kit 11 (IEAK 11) Customization Wizard options](../ie11-ieak/ieak11-wizard-custom-options.md). - -  - -  - - - diff --git a/browsers/internet-explorer/ie11-deploy-guide/using-inf-files-to-create-install-packages.md b/browsers/internet-explorer/ie11-deploy-guide/using-inf-files-to-create-install-packages.md deleted file mode 100644 index 0f65a6f4ac..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/using-inf-files-to-create-install-packages.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to use Setup Information (.inf) files to create installation packages. -author: dansimp -ms.prod: ie11 -ms.assetid: 04fa2ba8-8d84-4af6-ab99-77e4f1961b0e -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Using Setup Information (.inf) files to create packages (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Using Setup Information (.inf) files to create install packages - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -IEAK 11 uses Setup information (.inf) files to provide uninstallation instructions. Uninstallation instructions let your employees remove components, like files, registry entries, or shortcuts, through the **Uninstall or change a program** box. For details about .inf files, see [INF File Sections and Directives](/windows-hardware/drivers/install/). - - **To add uninstallation instructions to the .inf files** - -- Open the Registry Editor (regedit.exe) and add these registry keys: - ``` - HKLM,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\app-name,"DisplayName",,"description" - HKLM,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\app-name,"UninstallString",,"command-line" - ``` - Where **"description"** is the name that shows up in the **Uninstall or change a program** box and **"command-line"** is the command that runs after the component is picked. -

                  Note
                  - Make sure your script removes the uninstallation registry key, too. Otherwise, the component name will continue to show up in the Uninstall or change a program. - -## Limitations -.Inf files have limitations: - -- You can't delete directories. - -- You can't use **RenFiles** to move a file to a different location, it only lets you rename a file in its existing location. For detailed information, see [INF RenFiles Directive](/windows-hardware/drivers/install/inf-renfiles-directive). - -- You can't use **CopyFiles** to copy a file to another place on your hard drive, it can only copy files from the source disk to the destination directory. For information, see [INF CopyFiles Directive](/windows-hardware/drivers/install/inf-copyfiles-directive). - - - diff --git a/browsers/internet-explorer/ie11-deploy-guide/verify-changes-preprod-enterprise-mode-portal.md b/browsers/internet-explorer/ie11-deploy-guide/verify-changes-preprod-enterprise-mode-portal.md deleted file mode 100644 index a31c831abd..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/verify-changes-preprod-enterprise-mode-portal.md +++ /dev/null @@ -1,74 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Details about how to make sure your change request info is accurate within the pre-production environment of the Enterprise Mode Site List Portal. -author: dansimp -ms.prod: ie11 -title: Verify your changes using the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp ---- - -# Verify your changes using the Enterprise Mode Site List Portal - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -> [!Important] -> This step requires that each Requester have access to a test machine with Administrator rights, letting him or her get to the pre-production environment to make sure that the requested change is correct. - -The Requester successfully submits a change request to the Enterprise Mode Site List Portal and then gets an email, including: - -- **EMIE_RegKey**. A batch file that when run, sets the registry key to point to the local pre-production Enterprise Mode Site List. - -- **Test steps**. The suggested steps about how to test the change request details to make sure they're accurate in the pre-production environment. - -- **EMIE_Reset**. A batch file that when run, reverts the changes made to the pre-production registry. - -## Verify and send the change request to Approvers -The Requester tests the changes and then goes back into the Enterprise Mode Site List Portal, **Pre-production verification** page to verify whether the testing was successful. - -**To verify changes and send to the Approver(s)** -1. On the **Pre-production verification** page, the Requester clicks **Successful** and optionally includes any attachments (only .jpeg, .png, .jpg and .txt files are allowed) to support the change request and testing results. - -2. The Requester reviews the pre-defined Approver(s), and then clicks **Send for approval**. - - The Requester, the Approver group, and the Administrator group all get an email, stating that the change request is waiting for approval. - - -**To rollback your pre-production changes** -1. On the **Pre-production verification** page, the Requester clicks **Failed** and optionally includes any attachments (only .jpeg, .png, .jpg and .txt files are allowed) to support the change request and testing results. - -2. Add a description about the issue into the **Issue description** box, and then click **Send failure details**. - - The change request and issue info are sent to the Administrators. - -3. The Requester clicks **Roll back** to roll back the changes in the pre-production environment. - - After the Requester rolls back the changes, the request can be updated and re-submitted. - - -## View rolled back change requests -The original Requester and the Administrator(s) group can view the rolled back change requests. - -**To view the rolled back change request** - -- In the Enterprise Mode Site List Portal, click **Rolled back** from the left pane. - - All rolled back change requests appear, with role assignment determining which ones are visible. - -## Next steps -If the change request is certified as successful, the Requester must next send it to the Approvers for approval. For the Approver-related steps, see the [Approve a change request using the Enterprise Mode Site List Portal](approve-change-request-enterprise-mode-portal.md) topic. diff --git a/browsers/internet-explorer/ie11-deploy-guide/verify-changes-production-enterprise-mode-portal.md b/browsers/internet-explorer/ie11-deploy-guide/verify-changes-production-enterprise-mode-portal.md deleted file mode 100644 index 1ccd3e4d0c..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/verify-changes-production-enterprise-mode-portal.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Details about how the Requester makes sure that the change request update is accurate within the production environment using the Enterprise Mode Site List Portal. -author: dansimp -ms.prod: ie11 -title: Verify the change request update in the production environment using the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp ---- - -# Verify the change request update in the production environment using the Enterprise Mode Site List Portal - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -## Verify and sign off on the update in the production environment -The Requester tests the changes in the production environment and then goes back into the Enterprise Mode Site List Portal, **Production verification** page to verify whether the testing was successful. - -**To verify the changes and sign off** -- On the **Production verification** page, the Requester clicks **Successful**, optionally includes any attachments (only .jpeg, .png, .jpg and .txt files are allowed) to support the testing results, optionally includes a description of the change, and then clicks **Sign off**. - - The Requester, Approver group, and Administrator group all get an email, stating that the change request has been signed off. - - -**To rollback production changes** -1. On the **Production verification** page, the Requester clicks **Failed** and optionally includes any attachments (only .jpeg, .png, .jpg and .txt files are allowed) to support the testing results. - -2. Add a description about the issue into the **Change description** box, and then click **Send failure details**. - - The info is sent to the Administrators. - -3. The Requester clicks **Roll back** to roll back the changes in the production environment. - - After the Requester rolls back the changes, the request is automatically handled in the production and pre-production environment site lists. - diff --git a/browsers/internet-explorer/ie11-deploy-guide/view-apps-enterprise-mode-site-list.md b/browsers/internet-explorer/ie11-deploy-guide/view-apps-enterprise-mode-site-list.md deleted file mode 100644 index 9aa736bacb..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/view-apps-enterprise-mode-site-list.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Details about how to view the active Enterprise Mode Site List from the Enterprise Mode Site List Portal. -author: dansimp -ms.prod: ie11 -title: View the apps included in the active Enterprise Mode Site List from the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp ---- - -# View the apps included in the active Enterprise Mode Site List from the Enterprise Mode Site List Portal - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -Any employee with access to the Enterprise Mode Site List Portal can view the apps included in the current Enterprise Mode Site List. - -**To view the active Enterprise Mode Site List** -1. Open the Enterprise Mode Site List Portal and click the **Production sites list** icon in the upper-right area of the page. - - The **Production sites list** page appears, with each app showing its URL, the compatibility mode to use, and the assigned browser to open the site. - -2. Click any URL to view the actual site, using the compatibility mode and opening in the correct browser. - - -**To export the active Enterprise Mode Site List** -1. On the **Production sites list** page, click **Export**. - -2. Save the ProductionSiteList.xlsx file. - - The Excel file includes all apps in the current Enterprise Mode Site List, including URL, compatibility mode, and assigned browser. diff --git a/browsers/internet-explorer/ie11-deploy-guide/view-enterprise-mode-reports-for-portal.md b/browsers/internet-explorer/ie11-deploy-guide/view-enterprise-mode-reports-for-portal.md deleted file mode 100644 index f2db72080d..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/view-enterprise-mode-reports-for-portal.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Details about how an Administrator can view the available Enterprise Mode reports from the Enterprise Mode Site List Portal. -author: dansimp -ms.prod: ie11 -title: View the available Enterprise Mode reports from the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp ---- - -# View the available Enterprise Mode reports from the Enterprise Mode Site List Portal - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -Administrators can view the Microsoft-provided Enterprise Mode reports from the Enterprise Mode Site List Portal. - -**To view the reports** -1. Open the Enterprise Mode Site List Portal and click the **Enterprise Mode reports** icon in the upper-right area of the page. - - The **Enterprise Mode reports** page appears, with each app showing its URL, the compatibility mode to use, and the assigned browser to open the site. - -2. Use the calendars to provide the **From date** and **To date**, determining the span of time the report covers. - -3. Click **Apply**. - - The reports all change to reflect the appropriate timeframe and group, including: - - - **Total number of websites in the site list.** A box at the top of the reports page that tells you the total number of websites included in the Enterprise Mode Sit List. - - - **All websites by docmode.** Shows how many change requests exist, based on the different doc modes included in the **App best viewed in** field. - - - **All websites by browser.** Shows how many apps require which browser, including **IE11**, **MSEdge**, or **None**. - - - **All requests by status.** Shows how many change requests exist, based on each status. - - - **All requests by change type.** Shows how many change requests exist, based on the **Requested change** field. - - - **Request status by group.** Shows how many change requests exist, based on both group and status. - - - **Reasons for request.** Shows how many change request reasons exist, based on the **Reason for request** field. - - - **Requested changes by app name.** Shows what specific apps were **Added to site list**, **Deleted from site list**, or **Updated from site list**. diff --git a/browsers/internet-explorer/ie11-deploy-guide/virtualization-and-compatibility-with-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/virtualization-and-compatibility-with-ie11.md deleted file mode 100644 index 613d58863c..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/virtualization-and-compatibility-with-ie11.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: virtualization -description: Virtualization and compatibility with Internet Explorer 11 -author: dansimp -ms.prod: ie11 -ms.assetid: b0388c04-2584-4b6d-a7a8-4e0476773a80 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Virtualization and compatibility with Internet Explorer 11 (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Virtualization and compatibility with Internet Explorer 11 - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -If your company is considering upgrading to the latest version of Internet Explorer, but is hesitant because of a large number of web apps that need to be tested and moved, we recommend that you consider virtualization. Virtualization lets you set up a virtual environment where you can run earlier versions of IE. - -**Important**
                  -We strongly suggest that while you're using virtualization, you also update your web apps so they run natively in the newer version of IE. For more information about how to update your code, see the [Internet Explorer 11 Compatibility Cookbook (Windows)](/previous-versions//dn384049(v=vs.85)) to learn about the developer features that have been changed or deprecated since Internet Explorer 10. - -The Microsoft-supported options for virtualizing web apps are: - -- **Microsoft Enterprise Desktop Virtualization (MED-V).** Uses Microsoft Virtual PC to provide an enterprise solution for desktop virtualization. With MED-V, you can easily create, deliver, and manage corporate Virtual PC images on any Windows®-based desktop. For more information, see [MED-V](/microsoft-desktop-optimization-pack/medv-v2/). - -- **Client Hyper-V.** Uses the same virtualization technology previously available in Windows Server, but now installed for Windows 8.1. For more information, see [Client Hyper-V](/previous-versions/windows/it-pro/windows-8.1-and-8/hh857623(v=ws.11)).

                  -For more information about virtualization options, see [Microsoft Desktop Virtualization](https://go.microsoft.com/fwlink/p/?LinkId=271662). - -  - -  \ No newline at end of file diff --git a/browsers/internet-explorer/ie11-deploy-guide/what-is-enterprise-mode.md b/browsers/internet-explorer/ie11-deploy-guide/what-is-enterprise-mode.md deleted file mode 100644 index fd8cca1014..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/what-is-enterprise-mode.md +++ /dev/null @@ -1,173 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Info about the features included in Enterprise Mode with Internet Explorer 11. -author: dansimp -ms.prod: ie11 -ms.assetid: 3c77e9f3-eb21-46d9-b5aa-f9b2341cfefa -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Enterprise Mode and the Enterprise Mode Site List (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 10/25/2018 ---- - - -# Enterprise Mode and the Enterprise Mode Site List - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -Internet Explorer and Microsoft Edge can work together to support your legacy web apps, while still defaulting to the higher bar for security and modern experiences enabled by Microsoft Edge. Working with multiple browsers can be difficult, particularly if you have a substantial number of internal sites. To help manage this dual-browser experience, we are introducing a new web tool specifically targeted towards larger organizations: the [Enterprise Mode Site List Portal](https://github.com/MicrosoftEdge/enterprise-mode-site-list-portal). - -## Available dual-browser experiences -If you have specific websites and apps that you know have compatibility problems with Microsoft Edge, you can use the Enterprise Mode site list so that the websites automatically open using Internet Explorer 11. Additionally, if you know that your intranet sites aren't going to work correctly with Microsoft Edge, you can set all intranet sites to open using IE11 automatically. - -Using Enterprise Mode means that you can continue to use Microsoft Edge as your default browser, while also ensuring that your apps continue working on IE11. - -> [!TIP] -> If you are running an earlier version of Internet Explorer, we recommend upgrading to IE11, so that any legacy apps continue to work correctly. - -For Windows 10, Microsoft Edge is the default browser experience. However, Microsoft Edge lets you continue to use IE11 for sites that are on your corporate intranet or included on your Enterprise Mode Site List. - - -## What is Enterprise Mode? -Enterprise Mode, a compatibility mode that runs on Internet Explorer 11 on Windows 10, Windows 8.1, and Windows 7 devices, lets websites render using a modified browser configuration that’s designed to emulate either Windows Internet Explorer 7 or Windows Internet Explorer 8. Running in this mode helps to avoid many of the common compatibility problems associated with web apps written and tested on older versions of Internet Explorer. - -Many customers identify web app compatibility as a significant cost to upgrading because web apps need to be tested and upgraded before adopting a new browser. The improved compatibility provided by Enterprise Mode can help give customers confidence to upgrade to IE11, letting customers benefit from modern web standards, increased performance, improved security, and better reliability. - -### Enterprise Mode features -Enterprise Mode includes the following features: - -- **Improved web app and website compatibility.** Through improved emulation, Enterprise Mode lets many legacy web apps run unmodified on IE11, supporting several site patterns that aren’t currently supported by existing document modes. - -- **Tool-based management for website lists.** Use the Enterprise Mode Site List Manager to add website domains and domain paths and to specify whether a site renders using Enterprise Mode. -Download the [Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) or the [Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378), based on your operating system and schema. - -- **Centralized control.** You can specify the websites or web apps to interpret using Enterprise Mode, through an XML file on a website or stored locally. Domains and paths within those domains can be treated differently, allowing granular control. Use Group Policy to let users turn Enterprise Mode on or off from the Tools menu and to decide whether the Enterprise browser profile appears on the Emulation tab of the F12 developer tools. - - > [!Important] - > All centrally-made decisions override any locally-made choices. - -- **Integrated browsing.** When Enterprise Mode is set up, users can browse the web normally, letting the browser change modes automatically to accommodate Enterprise Mode sites. - -- **Data gathering.** You can configure Enterprise Mode to collect local override data, posting back to a named server. This lets you "crowd source" compatibility testing from key users; gathering their findings to add to your central site list. - -## Enterprise Mode and the Enterprise Mode Site List - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - XML file -The Enterprise Mode Site List is an XML document that specifies a list of sites, their compatibility mode, and their intended browser. Using [Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853), you can automatically start a webpage using a specific browser. In IE11, the webpage can also be launched in a specific compatibility mode, so it always renders correctly. Your employees can easily view this site list by typing `about:compat` in either Microsoft Edge or IE11. - -Starting with Windows 10, version 1511 (also known as the Anniversary Update), you can also [restrict IE11 to only the legacy web apps that need it](https://blogs.windows.com/msedgedev/2016/05/19/edge14-ie11-better-together/), automatically sending sites not included in the Enterprise Mode Site List to Microsoft Edge. - -### Site list xml file -This is a view of the [raw EMIE v2 schema.xml file](https://gist.github.com/kypflug/9e9961de771d2fcbd86b#file-emie-v2-schema-xml). There are equivalent Enterprise Mode Site List policies for both [Microsoft Edge](/microsoft-edge/deploy/emie-to-improve-compatibility) and [Internet Explorer 11](turn-on-enterprise-mode-and-use-a-site-list.md). The Microsoft Edge list is used to determine which sites should open in IE11; while the IE11 list is used to determine the compatibility mode for a site, and which sites should open in Microsoft Edge. We recommend using one list for both browsers, where each policy points to the same XML file location. - -```xml - - - - EnterpriseSiteListManager - 10586 - 20150728.135021 - - - - IE8Enterprise - IE11 - - - Default - IE11 - - - IE7Enterprise - IE11 - - - - - IE8Enterprise" - IE11 - - - IE7 - IE11 - - - IE7 - IE11 - - - -``` - -## Enterprise Mode Site List Manager and the Enterprise Mode Site List Portal tools -You can build and manage your Enterprise Mode Site List is by using any generic text editor. However, we’ve also provided a couple tools that can make that process even easier. - -### Enterprise Mode Site List Manager -This tool helps you create error-free XML documents with simple n+1 versioning and URL verification. We recommend using this tool if your site list is relatively small. For more info about this tool, see the Use the [Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) topics. - -There are two versions of this tool, both supported on Windows 7, Windows 8.1, and Windows 10: - -- [Enterprise Mode Site List Manager (schema v.1)](https://www.microsoft.com/download/details.aspx?id=42501). This is an older version of the schema that you must use if you want to create and update your Enterprise Mode Site List for devices running the v.1 version of the schema. - - We strongly recommend moving to the new schema, v.2. For more info, see [Enterprise Mode schema v.2 guidance](enterprise-mode-schema-version-2-guidance.md). - -- [Enterprise Mode Site List Manager (schema v.2)](https://www.microsoft.com/download/details.aspx?id=49974). The updated version of the schema, including new functionality. You can use this version of the schema to create and update your Enterprise Mode Site List for devices running the v.2 version of the schema. - - If you open a v.1 version of your Enterprise Mode Site List using this version, it will update the schema to v.2, automatically. For more info, see [Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md). - -If your list is too large to add individual sites, or if you have more than one person managing the site list, we recommend using the Enterprise Site List Portal. - -### Enterprise Mode Site List Portal -The [Enterprise Mode Site List Portal](https://github.com/MicrosoftEdge/enterprise-mode-site-list-portal) is an open-source web tool on GitHub that allows you to manage your Enterprise Mode Site List, hosted by the app, with multiple users. The portal is designed to use IIS and a SQL Server backend, leveraging Active Directory (AD) for employee management. - -In addition to all the functionality of the Enterprise Mode Site List Manager tool, the Enterprise Mode Site List Portal helps you: - -- Manage site lists from any device supporting Windows 7 or greater. - -- Submit change requests. - -- Operate offline through an on-premise solution. - -- Provide role-based governance. - -- Test configuration settings before releasing to a live environment. - -Updates to your site list are made by submitting new change requests, which are then approved by a designated group of people, put into a pre-production environment for testing, and then deployed immediately, or scheduled for deployment later. - -Because the tool is open-source, the source code is readily available for examination and experimentation. We encourage you to [fork the code, submit pull requests, and send us your feedback](https://github.com/MicrosoftEdge/enterprise-mode-site-list-portal)! For more info about the Enterprise Mode Site List Portal, see the [Use the Enterprise Mode Site List Portal](use-the-enterprise-mode-portal.md) topics. - -## Related topics - -- [Enterprise Mode Site List Portal source code](https://github.com/MicrosoftEdge/enterprise-mode-site-list-portal) - -- [Technical guidance, tools, and resources on Enterprise browsing](https://technet.microsoft.com/ie) - -- [Enterprise Mode Site List Manager (schema v.1)](https://www.microsoft.com/download/details.aspx?id=42501) - -- [Enterprise Mode Site List Manager (schema v.2)](https://www.microsoft.com/download/details.aspx?id=49974) - -- [Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) - -- [Collect data using Enterprise Site Discovery](collect-data-using-enterprise-site-discovery.md) - -- [Web Application Compatibility Lab Kit](https://technet.microsoft.com/microsoft-edge/mt612809.aspx) - -- [Find a Microsoft partner on Pinpoint](https://partnercenter.microsoft.com/pcv/search) \ No newline at end of file diff --git a/browsers/internet-explorer/ie11-deploy-guide/what-is-the-internet-explorer-11-blocker-toolkit.md b/browsers/internet-explorer/ie11-deploy-guide/what-is-the-internet-explorer-11-blocker-toolkit.md deleted file mode 100644 index 13e84a6792..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/what-is-the-internet-explorer-11-blocker-toolkit.md +++ /dev/null @@ -1,156 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: support -ms.pagetype: security -description: How to download and use the Internet Explorer 11 Blocker Toolkit to turn off the automatic delivery of IE11 through the Automatic Updates feature of Windows Update. -author: dansimp -ms.author: dansimp -ms.manager: elizapo -ms.prod: ie11 -ms.assetid: fafeaaee-171c-4450-99f7-5cc7f8d7ba91 -ms.reviewer: -audience: itpro -manager: dansimp -title: What is the Internet Explorer 11 Blocker Toolkit? (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 05/10/2018 ---- - - -# What is the Internet Explorer 11 Blocker Toolkit? - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -The Internet Explorer 11 Blocker Toolkit lets you turn off the automatic delivery of IE11 through the **Automatic Updates** feature of Windows Update. - -> [!IMPORTANT] -> The IE11 Blocker Toolkit does not stop users from manually installing IE11 from the [Microsoft Download Center](https://go.microsoft.com/fwlink/p/?linkid=327753). Also, even if you have installed previous versions of the toolkit before, like for Internet Explorer 10, you still need to install this version to prevent the installation of IE11. - -## Install the toolkit - -1. Download the IE11 Blocker Toolkit from [Toolkit to Disable Automatic Delivery of Internet Explorer 11](https://go.microsoft.com/fwlink/p/?LinkId=327745). - -2. Accept the license agreement and store the included four files on your local computer. - -3. Start an elevated Command Prompt by going to **Start**>**All Programs**>**Accessories**> right-clicking on **Command Prompt**, and then choosing **Run as Administrator**. - -4. In the Command Prompt, change to the location where you put the 4 files. - -5. In the Command Prompt, type `ie11_blocker.cmd /B` and press Enter.

                  -Wait for the message, **Blocking deployment of IE11 on the local machine. The operation completed successfully.** - -6. Close the Command Prompt. - -For answers to frequently asked questions, see [Internet Explorer 11 Blocker Toolkit: Frequently Asked Questions](../ie11-faq/faq-ie11-blocker-toolkit.yml). - -## Automatic updates -Internet Explorer 11 makes browsing the web faster, easier, safer, and more reliable than ever. To help customers become more secure and up-to-date, Microsoft will distribute Internet Explorer 11 through Automatic Updates and the Windows Update and Microsoft Update sites. Internet Explorer 11 will be available for users of the 32-bit and 64-bit versions of Windows 7 Service Pack 1 (SP1), and 64-bit version of Windows Server 2008 R2 SP1. This article provides an overview of the delivery process and options available for IT administrators to control how and when Internet Explorer 11 is deployed to their organization through Automatic Updates. - -### Automatic delivery process -Internet Explorer 11 only downloads and installs if it’s available for delivery through Automatic Updates; and Automatic Updates only offer Internet Explorer 11 to users with local administrator accounts. User’s without local administrator accounts won’t be prompted to install the update and will continue using their current version of Internet Explorer. - -Internet Explorer 11 replaces Internet Explorer 8, Internet Explorer 9, or Internet Explorer 10. If you decide you don’t want Internet Explorer 11, and you’re running Windows 7 SP1 or Windows Server 2008 R2 with SP1, you can uninstall it from the **View installed updates** section of the **Uninstall an update** page of the Control Panel.  - -### Internet Explorer 11 automatic upgrades - -Internet Explorer 11 is offered through Automatic Updates and Windows Update as an Important update. Users running Windows 7 SP1, who have chosen to download and install updates automatically through Windows Update, are automatically upgraded to Internet Explorer 11. - -Users who were automatically upgraded to Internet Explorer 11 can decide to uninstall Internet Explorer 11. However, Internet Explorer 11 will still appear as an optional update through Windows Update. - -### Options for blocking automatic delivery - -If you use Automatic Updates in your company, but want to stop your users from automatically getting Internet Explorer 11, do one of the following: - -- **Download and use the Internet Explorer 11 Blocker Toolkit.** Includes a Group Policy template and a script that permanently blocks Internet Explorer 11 from being offered by Windows Update or Microsoft Update as a high-priority update. You can download this kit from the [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=40722). - - > [!NOTE] - >The toolkit won't stop users with local administrator accounts from manually installing Internet Explorer 11. Using this toolkit also prevents your users from receiving automatic upgrades from Internet Explorer 8, Internet Explorer 9, or Internet Explorer 10 to Internet Explorer 11. For more information, see the [Internet Explorer 11 Blocker Toolkit frequently asked questions](../ie11-faq/faq-for-it-pros-ie11.yml). - -- **Use an update management solution to control update deployment.** If you already use an update management solution, like [Windows Server Update Services (WSUS)](/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus) or the more advanced [Configuration Manager](/previous-versions/system-center/system-center-2012-R2/gg682129(v=technet.10)), you should use that instead of the Internet Explorer Blocker Toolkit. - -> [!NOTE] -> If you use WSUS to manage updates, and Update Rollups are configured for automatic installation, Internet Explorer will automatically install throughout your company. - - -### Prevent automatic installation of Internet Explorer 11 with WSUS - -Internet Explorer 11 will be released to WSUS as an Update Rollup package. Therefore, if you’ve configured WSUS to “auto-approve” Update Rollup packages, it’ll be automatically approved and installed. To stop Internet Explorer 11 from being automatically approved for installation, you need to: - -1. Click **Start**, click **Administrative Tools**, and then click **Microsoft Windows Server Update Services 3.0**. - -2. Expand *ComputerName*, and then click **Options**. - -3. Click **Automatic Approvals**. - -4. Click the rule that automatically approves an update that is classified as Update Rollup, and then click **Edit.** - - > [!NOTE] - > If you don’t see a rule like this, you most likely haven’t configured WSUS to automatically approve Update Rollups for installation. In this situation, you don’t have to do anything else. - -5. Click the **Update Rollups** property under the **Step 2: Edit the properties (click an underlined value)** section. - - > [!NOTE] - > The properties for this rule will resemble the following:

                  • When an update is in Update Rollups
                  • Approve the update for all computers
                  - -6. Clear the **Update Rollup** check box, and then click **OK**. - -7. Click **OK** to close the **Automatic Approvals** dialog box. - -After the new Internet Explorer 11 package is available for download, you should manually synchronize the new package to your WSUS server, so that when you re-enable auto-approval it won’t be automatically installed. - -1. Click **Start**, click **Administrative Tools**, and then click **Microsoft Windows Server Update Services 3.0**. - -2. Expand *ComputerName*, and then click **Synchronizations**. - -3. Click **Synchronize Now**. - -4. Expand *ComputerName*, expand **Updates**, and then click **All Updates**. - -5. Choose **Unapproved** in the **Approval**drop down box. - -6. Check to make sure that Microsoft Internet Explorer 11 is listed as an unapproved update. - -> [!NOTE] -> There may be multiple updates, depending on the imported language and operating system updates. - -### Optional - Reset update rollups packages to auto-approve - -1. Click **Start**, click **Administrative Tools**, and then click **Microsoft Windows Server Update Services 3.0**. - -2. Expand *ComputerName*, and then click **Options**. - -3. Click **Automatic Approvals**. - -4. Click the rule that automatically approves updates of different classifications, and then click **Edit**. - -5. Click the **Update Rollups** property under the **Step 2: Edit the properties (click an underlined value)** section. - -6. Check the **Update Rollups** check box, and then click **OK**. - -7. Click **OK** to close the **Automatic Approvals** dialog box. - -> [!NOTE] -> Because auto-approval rules are only evaluated when an update is first imported into WSUS, turning this rule back on after the Internet Explorer 11 update has been imported and synchronized to the server won’t cause this update to be auto-approved. - - - -## Additional resources - -- [Internet Explorer 11 Blocker Toolkit download](https://www.microsoft.com/download/details.aspx?id=40722) - -- [Internet Explorer 11 Blocker Toolkit - Frequently Asked Questions](../ie11-faq/faq-ie11-blocker-toolkit.yml) - -- [Internet Explorer 11 FAQ for IT pros](../ie11-faq/faq-for-it-pros-ie11.yml) - -- [Internet Explorer 11 delivery through automatic updates](ie11-delivery-through-automatic-updates.md) - -- [Internet Explorer 11 deployment guide](./index.md) \ No newline at end of file diff --git a/browsers/internet-explorer/ie11-deploy-guide/workflow-processes-enterprise-mode-portal.md b/browsers/internet-explorer/ie11-deploy-guide/workflow-processes-enterprise-mode-portal.md deleted file mode 100644 index dd8e3bcce6..0000000000 --- a/browsers/internet-explorer/ie11-deploy-guide/workflow-processes-enterprise-mode-portal.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Use the topics in this section to learn how to perform all of the workflow-related processes in the Enterprise Mode Site List Portal. -author: dansimp -ms.prod: ie11 -title: Workflow-based processes for employees using the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp ---- - - -# Workflow-based processes for employees using the Enterprise Mode Site List Portal - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -Use the topics in this section to learn how to perform the available Enterprise Mode Site List Portal processes, based on workflow. - -## In this section -|Topic |Description | -|---------------------------------------------------------------|-----------------------------------------------------------------------------------| -|[Create a change request using the Enterprise Mode Site List Portal](create-change-request-enterprise-mode-portal.md)|Details about how the Requester creates a change request in the Enterprise Mode Site List Portal.| -|[Verify your changes using the Enterprise Mode Site List Portal](verify-changes-preprod-enterprise-mode-portal.md)|Details about how the Requester tests a change request in the pre-production environment of the Enterprise Mode Site List Portal.| -|[Approve a change request using the Enterprise Mode Site List Portal](approve-change-request-enterprise-mode-portal.md)|Details about how the Approver(s) approve a change request in the Enterprise Mode Site List Portal.| -|[Schedule approved change requests for production using the Enterprise Mode Site List Portal](schedule-production-change-enterprise-mode-portal.md)|Details about how the Requester schedules the approved change request update in the Enterprise Mode Site List Portal.| -|[Verify the change request update in the production environment using the Enterprise Mode Site List Portal](verify-changes-production-enterprise-mode-portal.md)|Details about how the Requester tests an update in the production environment of the Enterprise Mode Site List Portal.| -|[View the apps currently on the Enterprise Mode Site List](view-apps-enterprise-mode-site-list.md)|Details about how anyone with access to the portal can review the apps already on the active Enterprise Mode Site List.| -|[View the available Enterprise Mode reports from the Enterprise Mode Site List Portal](view-enterprise-mode-reports-for-portal.md) |Details about how the Administrator can view the view the Microsoft-provided Enterprise Mode reports from the Enterprise Mode Site List Portal. | - - -## Related topics -- [Set up the Enterprise Mode Site List Portal](set-up-enterprise-mode-portal.md) - -- [Enterprise Mode Site List Portal source code](https://github.com/MicrosoftEdge/enterprise-mode-site-list-portal) - -- [Enterprise Mode and the Enterprise Mode Site List](what-is-enterprise-mode.md) diff --git a/browsers/internet-explorer/ie11-faq/faq-for-it-pros-ie11.yml b/browsers/internet-explorer/ie11-faq/faq-for-it-pros-ie11.yml deleted file mode 100644 index 96fce41e4b..0000000000 --- a/browsers/internet-explorer/ie11-faq/faq-for-it-pros-ie11.yml +++ /dev/null @@ -1,250 +0,0 @@ -### YamlMime:FAQ -metadata: - ms.localizationpriority: medium - ms.mktglfcycl: explore - description: Frequently asked questions about Internet Explorer 11 for IT Pros - author: dansimp - ms.prod: ie11 - ms.assetid: 140e7d33-584a-44da-8c68-6c1d568e1de3 - ms.reviewer: - audience: itpro - manager: dansimp - ms.author: dansimp - title: Internet Explorer 11 - FAQ for IT Pros (Internet Explorer 11 for IT Pros) - ms.sitesec: library - ms.date: 10/16/2017 - ms.topic: faq -title: Internet Explorer 11 - FAQ for IT Pros -summary: | - [!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - - Answering frequently asked questions about Internet Explorer 11 (IE11) features, operating system support, integration with the Windows operating system, Group Policy, and general configuration. - - -sections: - - name: Ignored - questions: - - question: | - What operating system does IE11 run on? - answer: | - - Windows 10 - - - Windows 8.1 - - - Windows Server 2012 R2 - - - Windows 7 with Service Pack 1 (SP1) - - - Windows Server 2008 R2 with Service Pack 1 (SP1) - - - - question: | - How do I install IE11 on Windows 10, Windows 8.1, or Windows Server 2012 R2? - answer: | - IE11 is preinstalled with Windows 8.1 and Windows Server 2012 R2. No additional action is required. - - - question: | - How do I install IE11 on Windows 7 with SP1 or Windows Server 2008 R2 with SP1? - answer: | - You can install IE11 on computers running either Windows 7 with SP1 or Windows Server 2008 R2 with SP1. To download IE11, see the IE11 [home page](https://go.microsoft.com/fwlink/p/?LinkId=290956). - - - question: | - How does IE11 integrate with Windows 8.1? - answer: | - IE11 is the default handler for the HTTP and HTTPS protocols and the default browser for Windows 8.1. There are two experiences in Windows 8.1: Internet Explorer and Internet Explorer for the desktop. IE is the default browser for touch-first, immersive experiences. Internet Explorer for the desktop provides a more traditional window and tab management experience. The underlying platform of IE11 is fully interoperable across both IE and the familiar Internet Explorer for the desktop, letting developers write the same markup for both experiences. - - - question: | - What are the new or improved security features? - answer: | - IE11 offers improvements to Enhanced Protected Mode, password manager, and other security features. IE11 also turns on Transport Layer Security (TLS) 1.2 by default. - - - question: | - How is Microsoft supporting modern web standards, such as WebGL? - answer: | - Microsoft is committed to providing an interoperable web by supporting modern web standards. Doing this lets developers use the same markup across web browsers, helping to reduce development and support costs.

                  - Supported web standards include: - - - Web Graphics Library (WebGL) - - - Canvas 2D L2 extensions, including image smoothing using the nearest neighbor, dashed lines, and fill rules - - - Fullscreen API - - - Encrypted media extensions - - - Media source extensions - - - CSS flexible box layout module - - - And mutation observers like DOM4 and 5.3 - - For more information about specific changes and additions, see the [IE11 guide for developers](/previous-versions/windows/internet-explorer/ie-developer/dev-guides/bg182636(v=vs.85)). - - - question: | - What test tools exist to test for potential application compatibility issues? - answer: | - The Compat Inspector tool supports Windows Internet Explorer 9 through IE11. For more information, see [Compat Inspector User Guide](https://testdrive-archive.azurewebsites.net/html5/compatinspector/help/post.htm). In addition, you can use the new [F12 Developer Tools](/previous-versions/windows/internet-explorer/ie-developer/dev-guides/bg182632(v=vs.85)) that are included with IE11, or the [modern.ie](https://go.microsoft.com/fwlink/p/?linkid=308902) website for Microsoft Edge. - - - question: | - Why am I having problems launching my legacy apps with Internet Explorer 11? - answer: | - It’s most likely because IE no longer starts apps that use managed browser hosting controls, like in the .NET Framework 1.1 and 2.0. You can get IE11 to use managed browser hosting controls again, by: - - - **For x86 systems or for 32-bit processes on x64 systems:** Go to the `HKLM\SOFTWARE\MICROSOFT\.NETFramework` registry key and change the **EnableIEHosting** value to **1**. - - - **For x64 systems or for 64-bit processes on x64 systems:** Go to the `HKLM\SOFTWARE\Wow6432Node\.NETFramework` registry key and change the **EnableIEHosting** value to **1**. - - For more information, see the [Web Applications](/dotnet/framework/migration-guide/application-compatibility) section of the Application Compatibility in the .NET Framework 4.5 page. - - - question: | - Is there a compatibility list for IE? - answer: | - Yes. You can review the XML-based [compatibility version list](https://go.microsoft.com/fwlink/p/?LinkId=403864). - - - question: | - What is Enterprise Mode? - answer: | - Enterprise Mode is a compatibility mode designed for Enterprises. This mode lets websites render using a modified browser configuration that’s designed to avoid the common compatibility problems associated with web apps written and tested on older versions of IE, like Windows Internet Explorer 7 or Windows Internet Explorer 8.

                  - For more information, see [Turn on Enterprise Mode and use a site list](../ie11-deploy-guide/turn-on-enterprise-mode-and-use-a-site-list.md). - - - question: | - What is the Enterprise Mode Site List Manager tool? - answer: | - Enterprise Mode Site List Manager tool gives you a way to add websites to your Enterprise Mode site list, without having to manually code XML.

                  - For more information, see all of the topics in [Use the Enterprise Mode Site List Manager](../ie11-deploy-guide/use-the-enterprise-mode-site-list-manager.md). - - - question: | - Are browser plug-ins supported in IE11? - answer: | - The immersive version of IE11 provides an add-on–free experience, so browser plugins won't load and dependent content won't be displayed. This doesn't apply to Internet Explorer for the desktop. For more information, see [Browsing Without Plug-ins](https://go.microsoft.com/fwlink/p/?LinkId=242587). However, Internet Explorer for the desktop and IE11 on Windows 7 with SP1 do support browser plugins, including ActiveX controls such as Adobe Flash and Microsoft Silverlight. - - - question: | - Is Adobe Flash supported on IE11? - answer: | - Adobe Flash is included as a platform feature and is available out of the box for Windows 8.1, running on both IE and Internet Explorer for the desktop. Users can turn this feature on or off using the **Manage Add-ons** dialog box, while administrators can turn this feature on or off using the Group Policy setting, **Turn off Adobe Flash in IE and prevent applications from using IE technology to instantiate Flash objects**.

                  - **Important**
                  - The preinstalled version of Adobe Flash isn't supported on IE11 running on either Windows 7 with SP1 or Windows Server 2008 R2 with SP1. However, you can still download and install the separate Adobe Flash plug-in. - - - question: | - Can I replace IE11 on Windows 8.1 with an earlier version? - answer: | - No. Windows 8.1 doesn't support any of the previous versions of IE. - - - question: | - Are there any new Group Policy settings in IE11? - answer: | - IE11 includes all of the previous Group Policy settings you've used to manage and control web browser configuration since Internet Explorer 9. It also includes the following new Group Policy settings, supporting new features: - - - Turn off Page Prediction - - - Turn on the swiping motion for Internet Explorer for the desktop - - - Allow Microsoft services to provide more relevant and personalized search results - - - Turn off phone number detection - - - Allow IE to use the SPDY/3 network protocol - - - Let users turn on and use Enterprise Mode from the **Tools** menu - - - Use the Enterprise Mode IE website list - - For more information, see [New group policy settings for IE11](../ie11-deploy-guide/new-group-policy-settings-for-ie11.md). - - - - question: | - Where can I get more information about IE11 for IT pros? - answer: | - Visit the [Springboard Series for Microsoft Browsers](https://go.microsoft.com/fwlink/p/?LinkId=313191) webpage on TechNet. - - - - - question: | - Can I customize settings for IE on Windows 8.1? - answer: | - Settings can be customized in the following ways: - - - IE11 **Settings** charm. - - - IE11-related Group Policy settings. - - - IEAK 11 for settings shared by both IE and Internet Explorer for the desktop. - - - question: | - Can I make Internet Explorer for the desktop my default browsing experience? - answer: | - Group Policy settings can be set to open either IE or Internet Explorer for the desktop as the default browser experience. Individual users can configure their own settings in the **Programs** tab of **Internet Options**. The following table shows the settings and results:

                  - - |Setting |Result | - |--------|-------| - |Let IE decide |Links open in the same type of experience from where they're launched. For example, clicking a link from a Microsoft Store app, opens IE. However, clicking a link from a desktop app, opens Internet Explorer for the desktop. | - |Always in IE11 |Links always open in IE. | - |Always in Internet Explorer for the desktop |Links always open in Internet Explorer for the desktop. | - - - - question: | - Can IEAK 11 build custom Internet Explorer 11 packages in languages other than the language of the in-use IEAK 11 version? - answer: | - Yes. You can use IEAK 11 to build custom Internet Explorer 11 packages in any of the supported 24 languages. You'll select the language for the custom package on the Language Selection page of the customization wizard. - - IEAK 11 is available in 24 languages but can build customized Internet Explorer 11 packages in all languages of the supported operating systems. Select a language below and download IEAK 11 from the download center: - - | | | | - |---------|---------|---------| - |[English](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/en-us/ieak.msi) |[French](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/fr-fr/ieak.msi) |[Norwegian (Bokmål)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/nb-no/ieak.msi) | - |[Arabic](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ar-sa/ieak.msi) |[Chinese (Simplified)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/zh-cn/ieak.msi) |[Chinese(Traditional)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/zh-tw/ieak.msi) | - |[Czech](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/cs-cz/ieak.msi) |[Danish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/da-dk/ieak.msi) |[Dutch](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/nl-nl/ieak.msi) | - |[Finnish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/fi-fi/ieak.msi) |[German](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/de-de/ieak.msi) |[Greek](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/el-gr/ieak.msi) | - |[Hebrew](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/he-il/ieak.msi) |[Hungarian](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/hu-hu/ieak.msi) |[Italian](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/it-it/ieak.msi) | - |[Japanese](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ja-jp/ieak.msi) |[Korean](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ko-kr/ieak.msi) |[Polish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/pl-pl/ieak.msi) | - |[Portuguese (Brazil)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/pt-br/ieak.msi) |[Portuguese (Portugal)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/pt-pt/ieak.msi) |[Russian](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ru-ru/ieak.msi) | - |[Spanish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/es-es/ieak.msi) |[Swedish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/sv-se/ieak.msi) |[Turkish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/tr-tr/ieak.msi) | - - - - - - question: | - What are the different modes available for the Internet Explorer Customization Wizard? - answer: | - The IEAK Customization Wizard displays pages based on your licensing mode selection, either **Internal** or **External**. For more information on IEAK Customization Wizard modes, see [Determine the licensing version and features to use in IEAK 11](../ie11-ieak/licensing-version-and-features-ieak11.md). - - The following table displays which pages are available in IEAK 11, based on the licensing mode: - - | **Wizard Pages** | **External** | **Internal** | - |-------------------------------------------|--------------|--------------| - | Welcome to the IEAK | Yes | Yes | - | File Locations | Yes | Yes | - | Platform Selection | Yes | Yes | - | Language Selection | Yes | Yes | - | Package Type Selection | Yes | Yes | - | Feature Selection | Yes | Yes | - | Automatic Version Synchronization | Yes | Yes | - | Custom Components | Yes | Yes | - | Corporate Install | No | Yes | - | User Experience | No | Yes | - | Browser User Interface | Yes | Yes | - | Search Providers | Yes | Yes | - | Important URLs - Home page and Support | Yes | Yes | - | Accelerators | Yes | Yes | - | Favorites, Favorites Bar, and Feeds | Yes | Yes | - | Browsing Options | No | Yes | - | First Run Wizard and Welcome Page Options | Yes | Yes | - | Compatibility View | Yes | Yes | - | Connection Manager | Yes | Yes | - | Connection Settings | Yes | Yes | - | Automatic Configuration | No | Yes | - | Proxy Settings | Yes | Yes | - | Security and Privacy Settings | No | Yes | - | Add a Root Certificate | Yes | No | - | Programs | Yes | Yes | - | Additional Settings | No | Yes | - | Wizard Complete | Yes | Yes | - - -additionalContent: | - - ## Related topics - - - [Microsoft Edge - Deployment Guide for IT Pros](/microsoft-edge/deploy/) - - [Internet Explorer 11 (IE11) - Deployment Guide for IT Pros](../ie11-deploy-guide/index.md) - - [Internet Explorer Administration Kit 11 (IEAK 11) - Administrator's Guide](../ie11-ieak/index.md) diff --git a/browsers/internet-explorer/ie11-faq/faq-ie11-blocker-toolkit.yml b/browsers/internet-explorer/ie11-faq/faq-ie11-blocker-toolkit.yml deleted file mode 100644 index 618ec339b5..0000000000 --- a/browsers/internet-explorer/ie11-faq/faq-ie11-blocker-toolkit.yml +++ /dev/null @@ -1,161 +0,0 @@ -### YamlMime:FAQ -metadata: - ms.localizationpriority: medium - ms.mktglfcycl: explore - description: Get answers to commonly asked questions about the Internet Explorer 11 Blocker Toolkit. - author: dansimp - ms.author: dansimp - ms.prod: ie11 - ms.assetid: - ms.reviewer: - audience: itpro - manager: dansimp - title: Internet Explorer 11 Blocker Toolkit - Frequently Asked Questions - ms.sitesec: library - ms.date: 05/10/2018 - ms.topic: faq -title: Internet Explorer 11 Blocker Toolkit - Frequently Asked Questions -summary: | - [!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - - - Get answers to commonly asked questions about the Internet Explorer 11 Blocker Toolkit. - - > [!Important] - > If you administer your company’s environment using an update management solution, such as Windows Server Update Services (WSUS) or Configuration Manager, you don’t need to use the Internet Explorer 11 Blocker Toolkit. Update management solutions let you completely manage your Windows Updates and Microsoft Updates, including your Internet Explorer 11 deployment. - - - [Automatic updates delivery process](/internet-explorer/ie11-faq/faq-ie11-blocker-toolkit#automatic-updates-delivery-process) - - - [How the Internet Explorer 11 Blocker Toolkit works](/internet-explorer/ie11-faq/faq-ie11-blocker-toolkit#how-the-internet-explorer-11-blocker-toolkit-works) - - - [Internet Explorer 11 Blocker Toolkit and other update services](/internet-explorer/ie11-faq/faq-ie11-blocker-toolkit#internet-explorer-11-blocker-toolkit-and-other-update-services) - - -sections: - - name: Automatic Updates delivery process - questions: - - question: | - Which users will receive Internet Explorer 11 important update? - answer: | - Users running either Windows 7 with Service Pack 1 (SP1) or the 64-bit version of Windows Server 2008 R2 with Service Pack 1 (SP1) will receive Internet Explorer 11 important update, if Automatic Updates are turned on. Windows Update is manually run. Automatic Updates will automatically downloand install the Internet Explorer 11 files if it’s turned on. For more information about how Internet Explorer works with Automatic Updates and information about other deployment blocking options, see [Internet Explorer 11 Delivery through automatic updates](../ie11-deploy-guide/ie11-delivery-through-automatic-updates.md). - - - question: | - When is the Blocker Toolkit available? - answer: | - The Blocker Toolkit is currently available from the [Microsoft DownloCenter](https://www.microsoft.com/download/details.aspx?id=40722). - - - question: | - Whtools cI use to manage Windows Updates and Microsoft Updates in my company? - answer: | - We encourage anyone who wants full control over their company’s deployment of Windows Updates and Microsoft Updates, to use [Windows Server Update Services (WSUS)](/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus), a free tool for users of Windows Server. You calso use the more advanced configuration management tool, [Configuration Manager](/previous-versions/system-center/system-center-2012-R2/gg682041(v=technet.10)). - - - question: | - How long does the blocker mechanism work? - answer: | - The Internet Explorer 11 Blocker Toolkit uses a registry key value to permanently turn off the automatic delivery of Internet Explorer 11. This behavior lasts long the registry key value isn’t removed or changed. - - - question: | - Why should I use the Internet Explorer 11 Blocker Toolkit to stop delivery of Internet Explorer 11? Why can’t I just disable all of Automatic Updates? - answer: | - Automatic Updates provide you with ongoing criticsecurity and reliability updates. Turning this feature off cleave your computers more vulnerable. Instead, we suggest thyou use update management solution, such WSUS, to fully control your environment while leaving this feature running, managing how and when the updates get to your user’s computers. - - The Internet Explorer 11 Blocker Toolkit safely allows Internet Explorer 11 to downloand install in companies thcan’t use WSUS, Configuration Manager, or - other update management solution. - - - question: | - Why don’t we just block URL access to Windows Update or Microsoft Update? - answer: | - Blocking the Windows Update or Microsoft Update URLs also stops delivery of criticsecurity and reliability updates for all of the supported versions of the Windows operating system; leaving your computers more vulnerable. - - - name: How the Internet Explorer 11 Blocker Toolkit works - questions: - - question: | - How should I test the Internet Explorer 11 Blocker Toolkit in my company? - answer: | - Because the toolkit only sets a registry key to turn on and off the delivery of Internet Explorer 11, there should be no additionimpact or side effects to your environment. No additiontesting should be necessary. - - - question: | - What’s the registry key used to block delivery of Internet Explorer 11? - answer: | - HKLM\\SOFTWARE\\Microsoft\\Internet Explorer\\Setup\\11.0 - - - question: | - What’s the registry key name and values? - answer: | - The registry key name is **DoNotAllowIE11**, where: - - - A value of **1** turns off the automatic delivery of Internet Explorer 11 using Automatic Updates and turns off the Express install option. - - - Not providing a registry key, or using a value of anything other th**1**, lets the user install Internet Explorer 11 through Automatic Updates or a - manuupdate. - - - question: | - Does the Internet Explorer 11 Blocker Toolkit stop users from manually installing Internet Explorer 11? - answer: | - No. The Internet Explorer 11 Blocker Toolkit only stops computers from automatically installing Internet Explorer 11 through Automatic Updates. Users cstill downloand install Internet Explorer 11 from the Microsoft DownloCenter or from externmedia. - - - question: | - Does the Internet Explorer 11 Blocker Toolkit stop users from automatically upgrading to Internet Explorer 11? - answer: | - Yes. The Internet Explorer 11 Blocker Toolkit also prevents Automatic Updates from automatically upgrading a computer from Internet Explorer 8, Internet Explorer 9, or Internet Explorer 10 to Internet Explorer 11. - - - question: | - How does the provided script work? - answer: | - The script accepts one of two command line options: - - - **Block:** Creates the registry key thstops Internet Explorer 11 from installing through Automatic Updates. - - - **Unblock:** Removes the registry key thstops Internet Explorer 11 from installing through Automatic Updates. - - - question: | - What’s the ADM template file used for? - answer: | - The Administrative Template (.adm file) lets you import the new Group Policy environment and use Group Policy Objects to centrally manage all of the computers in your company. - - - question: | - Is the tool localized? - answer: | - No. The tool isn’t localized, it’s only available in English (en-us). However, it does work, without any modifications, on any language edition of the supported operating systems. - - - name: Internet Explorer 11 Blocker Toolkit and other update services - questions: - - question: | - Is there a version of the Internet Explorer Blocker Toolkit thwill prevent automatic installation of IE11? - answer: | - Yes. The IE11 Blocker Toolkit is available for download. For more information, see [Toolkit to Disable Automatic Delivery of IE11](https://go.microsoft.com/fwlink/p/?LinkId=328195) on the Microsoft DownloCenter. - - - question: | - Does the Internet Explorer 11 blocking mechanism also block delivery of Internet Explorer 11 through update management solutions, like WSUS? - answer: | - No. You cstill deploy Internet Explorer 11 using one of the upgrade management solutions, even if the blocking mechanism is activated. The Internet Explorer 11 Blocker Toolkit is only intended for companies thdon’t use upgrade management solutions. - - - question: | - If WSUS is set to 'auto-approve' Update Rollup packages (this is not the default configuration), how do I stop Internet Explorer 11 from automatically installing throughout my company? - answer: | - You only need to change your settings if: - - - You use WSUS to manage updates and allow auto-approvals for Update Rollup installation. - - -and- - - - You have computers running either Windows 7 SP1 or Windows Server 2008 R2 (SP1) with Internet Explorer 8, Internet Explorer 9, or Internet Explorer 10 installed. - - -and- - - - You don’t want to upgrade your older versions of Internet Explorer to Internet Explorer 11 right now. - - If these scenarios apply to your company, see [Internet Explorer 11 delivery through automatic updates](../ie11-deploy-guide/ie11-delivery-through-automatic-updates.md) for more information on how to prevent automatic installation. - - -additionalContent: | - - ## Additionresources - - - [Internet Explorer 11 Blocker Toolkit download](https://www.microsoft.com/download/details.aspx?id=40722) - - - [Internet Explorer 11 Ffor IT pros](./faq-for-it-pros-ie11.yml) - - - [Internet Explorer 11 delivery through automatic updates](../ie11-deploy-guide/ie11-delivery-through-automatic-updates.md) - - - [Internet Explorer 11 deployment guide](../ie11-deploy-guide/index.md) diff --git a/browsers/internet-explorer/ie11-faq/faq-ieak11.yml b/browsers/internet-explorer/ie11-faq/faq-ieak11.yml deleted file mode 100644 index 20e3889f45..0000000000 --- a/browsers/internet-explorer/ie11-faq/faq-ieak11.yml +++ /dev/null @@ -1,140 +0,0 @@ -### YamlMime:FAQ -metadata: - ms.localizationpriority: medium - ms.mktglfcycl: support - ms.pagetype: security - description: Internet Explorer Administration Kit (IEAK) helps corporations, Internet service providers (ISPs), Internet content providers (ICPs), and independent software vendors (ISVs) to deploy and manage web-based solutions. - author: dansimp - ms.author: dansimp - ms.manager: elizapo - ms.prod: ie11 - ms.assetid: - ms.reviewer: - audience: itpro - manager: dansimp - title: IEAK 11 - Frequently Asked Questions - ms.sitesec: library - ms.date: 05/10/2018 - ms.topic: faq -title: IEAK 11 - Frequently Asked Questions -summary: | - [!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - - - Get answers to commonly asked questions about the Internet Explorer Administration Kit 11 (IEAK 11), and find links to additional material you might find helpful. - - -sections: - - name: Ignored - questions: - - question: | - What is IEAK 11? - answer: | - IEAK 11 enables you to customize, brand, and distribute customized Internet Explorer 11 browser packages across an organization. Download the kit from the [Internet Explorer Administration Kit (IEAK) information and downloads](../ie11-ieak/ieak-information-and-downloads.md). - - - question: | - What are the supported operating systems? - answer: | - You can customize and install IEAK 11 on the following supported operating systems: - - - Windows 8 - - - Windows Server 2012 - - - Windows 7 Service Pack 1 (SP1) - - - Windows Server 2008 R2 Service Pack 1 (SP1) - - > [!NOTE] - > IEAK 11 does not support building custom packages for Windows RT. - - - - question: | - What can I customize with IEAK 11? - answer: | - The IEAK 11 enables you to customize branding and settings for Internet Explorer 11. For PCs running Windows 7, the custom package also includes the Internet Explorer executable. - - > [!NOTE] - > Internet Explorer 11 is preinstalled on PCs running Windows 8. Therefore, the executable is not included in the customized package. - - - question: | - Can IEAK 11 build custom Internet Explorer 11 packages in languages other than the language of the in-use IEAK 11 version? - answer: | - Yes. You can use IEAK 11 to build custom Internet Explorer 11 packages in any of the supported 24 languages. You'll select the language for the custom package on the Language Selection page of the customization wizard. - - > [!NOTE] - > IEAK 11 is available in 24 languages but can build customized Internet Explorer 11 packages in all languages of the supported operating systems. To download IEAK 11, see [Internet Explorer Administration Kit (IEAK) information and downloads](../ie11-ieak/ieak-information-and-downloads.md). - - - question: | - Is there a version of the Internet Explorer Administration Kit (IEAK) supporting IE11? - answer: | - Yes. The Internet Explorer Administration Kit 11 (IEAK 11) is available for download. IEAK 11 lets you create custom versions of IE11 for use in your organization. For more information, see the following resources: - - - [Internet Explorer Administration Kit Information and Downloads](../ie11-ieak/ieak-information-and-downloads.md) on the Internet Explorer TechCenter. - - - [Internet Explorer Administration Kit 11 (IEAK 11) - Administrator's Guide](../ie11-ieak/index.md) - - - question: | - What are the different modes available for the Internet Explorer Customization Wizard? - answer: | - The IEAK Customization Wizard displays pages based on your licensing mode selection, either **Internal** or **External**. For more information on IEAK Customization Wizard modes, see [What IEAK can do for you](../ie11-ieak/what-ieak-can-do-for-you.md). - - The following table displays which pages are available in IEAK 11, based on the licensing mode: - - | **Wizard Pages** | **External** | **Internal** | - |-------------------------------------------|--------------|--------------| - | Welcome to the IEAK | Yes | Yes | - | File Locations | Yes | Yes | - | Platform Selection | Yes | Yes | - | Language Selection | Yes | Yes | - | Package Type Selection | Yes | Yes | - | Feature Selection | Yes | Yes | - | Automatic Version Synchronization | Yes | Yes | - | Custom Components | Yes | Yes | - | Corporate Install | No | Yes | - | User Experience | No | Yes | - | Browser User Interface | Yes | Yes | - | Search Providers | Yes | Yes | - | Important URLs - Home page and Support | Yes | Yes | - | Accelerators | Yes | Yes | - | Favorites, Favorites Bar, and Feeds | Yes | Yes | - | Browsing Options | No | Yes | - | First Run Wizard and Welcome Page Options | Yes | Yes | - | Compatibility View | Yes | Yes | - | Connection Manager | Yes | Yes | - | Connection Settings | Yes | Yes | - | Automatic Configuration | No | Yes | - | Proxy Settings | Yes | Yes | - | Security and Privacy Settings | No | Yes | - | Add a Root Certificate | Yes | No | - | Programs | Yes | Yes | - | Additional Settings | No | Yes | - | Wizard Complete | Yes | Yes | - - - - question: | - Can IEAK 11 build custom Internet Explorer 11 packages in languages other than the language of the in-use IEAK 11 version? - answer: | - Yes. You can use IEAK 11 to build custom Internet Explorer 11 packages in any of the supported 24 languages. You'll select the language for the custom package on the Language Selection page of the customization wizard. - - IEAK 11 is available in 24 languages but can build customized Internet Explorer 11 packages in all languages of the supported operating systems. Select a language below and download IEAK 11 from the download center: - - | | | | - |---------|---------|---------| - |[English](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/en-us/ieak.msi) |[French](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/fr-fr/ieak.msi) |[Norwegian (Bokmål)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/nb-no/ieak.msi) | - |[Arabic](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ar-sa/ieak.msi) |[Chinese (Simplified)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/zh-cn/ieak.msi) |[Chinese(Traditional)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/zh-tw/ieak.msi) | - |[Czech](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/cs-cz/ieak.msi) |[Danish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/da-dk/ieak.msi) |[Dutch](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/nl-nl/ieak.msi) | - |[Finnish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/fi-fi/ieak.msi) |[German](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/de-de/ieak.msi) |[Greek](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/el-gr/ieak.msi) | - |[Hebrew](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/he-il/ieak.msi) |[Hungarian](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/hu-hu/ieak.msi) |[Italian](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/it-it/ieak.msi) | - |[Japanese](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ja-jp/ieak.msi) |[Korean](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ko-kr/ieak.msi) |[Polish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/pl-pl/ieak.msi) | - |[Portuguese (Brazil)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/pt-br/ieak.msi) |[Portuguese (Portugal)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/pt-pt/ieak.msi) |[Russian](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ru-ru/ieak.msi) | - |[Spanish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/es-es/ieak.msi) |[Swedish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/sv-se/ieak.msi) |[Turkish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/tr-tr/ieak.msi) | - -additionalContent: | - - ## Additional resources - - -[Download IEAK 11](../ie11-ieak/ieak-information-and-downloads.md) - -[IEAK 11 overview](../ie11-ieak/index.md) - -[IEAK 11 product documentation](../ie11-ieak/index.md) - -[IEAK 11 licensing guidelines](../ie11-ieak/licensing-version-and-features-ieak11.md) diff --git a/browsers/internet-explorer/ie11-ieak/accelerators-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/accelerators-ieak11-wizard.md deleted file mode 100644 index 40a7886b0a..0000000000 --- a/browsers/internet-explorer/ie11-ieak/accelerators-ieak11-wizard.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to use the Accelerators page in the IEAK 11 Customization Wizard to add accelerators to employee devices. -author: dansimp -ms.prod: ie11 -ms.assetid: 208305ad-1bcd-42f3-aca3-0ad1dda7048b -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Use the Accelerators page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the Accelerators page in the IEAK 11 Wizard - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -The **Accelerators** page of the Internet Explorer Administration Kit (IEAK 11) Customization Wizard lets you add accelerators to your employee computers. Accelerators are contextual menu options that can quickly get to a web service from any webpage. For example, an accelerator can look up a highlighted word in the dictionary or a selected location on a map. - -**Note**
                  -The customizations you make on this page apply only to Internet Explorer for the desktop. - - **To use the Accelerators page** - -1. Click **Import** to automatically import your existing accelerators from your current version of IE into this list. - -2. Click **Add** to add more accelerators.

                  -The **Add Accelerator** box appears. - -3. Use the **Browse** button to go to your custom accelerator XML file. - -4. Check the **Set this Accelerator as the default for the category** box if you want this accelerator to be the default value that shows up for the category. - -5. Click **Edit** to change your accelerator information, click **Set Default** to make an accelerator the default value for a category, or **Remove** to delete an accelerator. - -6. Click **Next** to go to the [Favorites, Favorites Bar, and Feeds](favorites-favoritesbar-and-feeds-ieak11-wizard.md) page or **Back** to go to the [Important URLs - Home Page and Support](important-urls-home-page-and-support-ieak11-wizard.md) page. - -  - -  - - - - - diff --git a/browsers/internet-explorer/ie11-ieak/add-and-approve-activex-controls-ieak11.md b/browsers/internet-explorer/ie11-ieak/add-and-approve-activex-controls-ieak11.md deleted file mode 100644 index b4d0459c78..0000000000 --- a/browsers/internet-explorer/ie11-ieak/add-and-approve-activex-controls-ieak11.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to use IEAK 11 to add and approve ActiveX controls for your organization. -author: dansimp -ms.prod: ie11 -ms.assetid: 33040bd1-f0e4-4541-9fbb-16e0c76752ab -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Add and approve ActiveX controls using IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Add and approve ActiveX controls using IEAK 11 - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -There are two main approaches to how you can control the use of ActiveX controls in your company. For more info about ActiveX controls, including how to manage the controls using Group Policy, see [Group Policy and ActiveX installation](../ie11-deploy-guide/activex-installation-using-group-policy.md) in the [Internet Explorer 11 (IE11) - Deployment Guide for IT Pros](../ie11-deploy-guide/index.md). - -**Note**
                  -ActiveX controls are supported in Internet Explorer for the desktop for Windows 7 and Windows 8.1. They are not supported on the immersive version of Internet Explorer for Windows 8.1. - -## Scenario 1: Limited Internet-only use of ActiveX controls -While you might not care about your employees using ActiveX controls while on your intranet sites, you probably do want to limit ActiveX usage while your employee is on the Internet. By specifying and pre-approving a set of generic controls for use on the Internet, you’re able to let your employees use the Internet, but you can still limit your company’s exposure to potentially hazardous, non-approved ActiveX controls. - -For example, your employees need to access an important Internet site, such as for a business partner or service provider, but there are ActiveX controls on their page. To make sure the site is accessible and functions the way it should, you can visit the site to review the controls, adding them as new entries to your `\Windows\Downloaded Program Files` folder. Then, as part of your browser package, you can enable and approve these ActiveX controls to run on this specific site; while all additional controls are blocked. - -**To add and approve ActiveX controls** - -1. In IE, click **Tools**, and then **Internet Options**. - -2. On the **Security** tab, click the zone that needs to change, and click **Custom Level**. - -3. Go to **Run ActiveX controls and plug-ins**, and then click **Administrator approved**. - -4. Repeat the last two steps until you have configured all the zones you want. - -5. When you run the IEAK 11 Customization Wizard to create a custom package, you'll use the [Additional Settings](additional-settings-ieak11-wizard.md) page, clicking each folder to expand its contents. Then select the check boxes for the controls you want to approve. - -## Scenario 2: Restricted use of ActiveX controls -You can get a higher degree of management over ActiveX controls by listing each of them out and then allowing the browser to use only that set of controls. The biggest challenge to using this method is the extra effort you need to put into figuring out all of the controls, and then actually listing them out. Because of that, we only recommend this approach if your complete set of controls is relatively small. - -After you decide which controls you want to allow, you can specify them as approved by zone, using the process described in the first scenario. - -  - -  - - - - - diff --git a/browsers/internet-explorer/ie11-ieak/add-root-certificate-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/add-root-certificate-ieak11-wizard.md deleted file mode 100644 index c04501eea7..0000000000 --- a/browsers/internet-explorer/ie11-ieak/add-root-certificate-ieak11-wizard.md +++ /dev/null @@ -1,33 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: We’re sorry. While we continue to recommend that you digitally sign your package, we’ve removed all of the functionality that allowed you to add a root certificate using the Internet Explorer Customization Wizard 11. The wizard page itself will be removed in a future version of the IEAK. -author: dansimp -ms.prod: ie11 -ms.assetid: 7ae4e747-49d2-4551-8790-46a61b5fe838 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Use the Add a Root Certificate page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the Add a Root Certificate page in the IEAK 11 Wizard - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -We’re sorry. While we continue to recommend that you digitally sign your package, we’ve removed all of the functionality that allowed you to add a root certificate using the Internet Explorer Customization Wizard 11. The wizard page itself will be removed in a future version of the IEAK. - -Click **Next** to go to the [Programs](programs-ieak11-wizard.md) page or **Back** to go to the [Security and Privacy Settings](security-and-privacy-settings-ieak11-wizard.md) page. - -  - -  - - - - - diff --git a/browsers/internet-explorer/ie11-ieak/additional-settings-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/additional-settings-ieak11-wizard.md deleted file mode 100644 index ebff04a24a..0000000000 --- a/browsers/internet-explorer/ie11-ieak/additional-settings-ieak11-wizard.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to use the Additional Settings page in IEAK 11 Customization Wizard for additional settings that relate to your employee’s desktop, operating system, and security. -author: dansimp -ms.prod: ie11 -ms.assetid: c90054af-7b7f-4b00-b55b-5e5569f65f25 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Use the Additional Settings page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the Additional Settings page in the IEAK 11 Wizard - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -The **Additional Settings** page of the Internet Explorer Administration Kit (IEAK 11) Customization Wizard lets you pick additional custom, corporate, and Internet settings that relate to your employee’s desktop, operating system, and security. If you don’t change a setting, it’ll be ignored. - -The additional settings appear in administration (.adm) files that are stored in your `:\Program Files\Windows IEAK 11\policies` folder. You can also create your own .adm files with options that can be configured using the wizard. Any edits you make to your own .adm file are stored as .ins files, which are used to build the .inf files for your custom install package. - -You can store your user settings in a central location so your employees that log on from computer to computer can use them. For example if you have an employee that requires low security using a computer that’s typically operated by someone that needs more restrictive permissions. - -You’ll only see this page if you are running the **Internal** version of the IE Customization Wizard 11. - -**To use the Additional Settings page** - -1. Double-click **Custom Settings**, **Corporate Settings**, or **Internet Settings**, and review the included policy or restriction settings. - -2. Pick the setting you want to change, and then update its details. - -3. Click **Next** to go to the [Wizard Complete-Next Steps](wizard-complete-ieak11-wizard.md) page or **Back** to go to the [Programs](programs-ieak11-wizard.md) page. - -  - -  - - - - - diff --git a/browsers/internet-explorer/ie11-ieak/auto-config-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/auto-config-ieak11-wizard.md deleted file mode 100644 index 879c328e43..0000000000 --- a/browsers/internet-explorer/ie11-ieak/auto-config-ieak11-wizard.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to use the Automatic Configuration page in the IEAK 11 Customization Wizard to add URLs to auto-configure IE. -author: dansimp -ms.prod: ie11 -ms.assetid: de5b1dbf-6e4d-4f86-ae08-932f14e606b0 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Use the Automatic Configuration page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the Automatic Configuration page in the IEAK 11 Wizard - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -The **Automatic Configuration** page of the Internet Explorer Administration Kit (IEAK 11) Customization Wizard lets you provide URLs to the files that’ll automatically configure Internet Explorer 11 for a group of employees or devices. - -**Note**
                  -This page only appears if you’re using the **Internal** version of the wizard. - -You can set your proxy settings using Internet setting (.ins) files. You can also configure and maintain your advanced proxy settings using JScript (.js), JavaScript (.jvs), or proxy auto-configuration (.pac) script files. When you provide an auto-proxy script, IE dynamically determines whether to connect directly to a host or to use a proxy server. - -You can use the Domain Name System (DNS) and the Dynamic Host Configuration Protocol (DHCP) naming systems to detect and change a browser’s settings automatically when the employee first starts IE on the network. For more info, see [Set up auto detection for DHCP or DNS servers using IEAK 11](auto-detection-dhcp-or-dns-servers-ieak11.md), or refer to the product documentation for your DNS and DHCP software packages. - -**To check the existing settings on your employee’s devices** - -1. Open IE, click **Tools**, click **Internet Options**, and then click the **Connections** tab. - -2. Click **LAN Settings** and make sure that the **Use automatic configuration script** box is selected, confirming the path and name of the file in the **Address** box. - -**To use the Automatic Configuration page** - -1. Check the **Automatically detect configuration settings** box to automatically detect browser settings. - -2. Check the **Enable Automatic Configuration** box if you plan to automatically change your IE settings after deployment, using configuration files. You can then: - - - Type the length of time (in minutes) for how often settings are to be applied in your company. Putting zero (**0**), or nothing, in this box will cause automatic configuration to only happen when the computer’s restarted. - - - Type the location to your .ins file. You can edit this file directly to make any necessary changes. - - The updates will take effect the next time your employee starts IE, or during your next scheduled update. - - - Type the location to your automatic proxy script file. - - **Note**
                  - If you specify URLs for both auto-config and auto-proxy, the auto-proxy URL will be incorporated into the .ins file. The correct form for the URL is `https://share/test.ins`. - -3. Click **Next** to go to the [Proxy Settings](proxy-settings-ieak11-wizard.md) page or **Back** to go to the [Connection Settings](connection-settings-ieak11-wizard.md) page. - -  - -  - - - - - diff --git a/browsers/internet-explorer/ie11-ieak/auto-detection-dhcp-or-dns-servers-ieak11.md b/browsers/internet-explorer/ie11-ieak/auto-detection-dhcp-or-dns-servers-ieak11.md deleted file mode 100644 index fadc8246a0..0000000000 --- a/browsers/internet-explorer/ie11-ieak/auto-detection-dhcp-or-dns-servers-ieak11.md +++ /dev/null @@ -1,65 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to set up automatic detection for DHCP or DNS servers using IEAK 11 in your organization. -author: dansimp -ms.prod: ie11 -ms.assetid: c6bfe7c4-f452-406f-b47e-b7f0d8c44ae1 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Set up auto detection for DHCP or DNS servers using IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Set up auto detection for DHCP or DNS servers using IEAK 11 - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -Set up your network to automatically detect and customize Internet Explorer 11 when it’s first started. Automatic detection is supported on both Dynamic Host Configuration Protocol (DHCP) and Domain Name System (DNS), letting your servers detect and set up your employee’s browser settings from a central location, using a configuration URL (.ins file) or a JavaScript proxy configuration file (.js, .jvs, or .pac). - -Before you can set up your environment to use automatic detection, you need to turn the feature on. - -**To turn on the automatic detection feature** - -- Open Internet Explorer Administration Kit 11 (IEAK 11), run the IE Customization Wizard 11 and on the **Automatic Configuration** page, check **Automatically detect configuration settings**. For more information, see [Use the Automatic Configuration page in the IEAK 11 Wizard](auto-config-ieak11-wizard.md). - -## Automatic detection on DHCP and DNS servers -Automatic detection works even if the browser wasn't originally set up or installed by the administrator. - -- **Using DHCP servers:** For local area network (LAN)-based users. This server type lets you specify your global and subnet TCP/IP parameters centrally, defining your users' parameters by using reserved addresses. By doing it this way, a computer can move between subnets, automatically reconfiguring for TCP/IP when it starts. -

                  Note
                  - Your DHCP servers must support the DHCPINFORM message, to obtain the DHCP options. - -- **Using DNS servers:** For users on dial-up connections. This server type uses a set of protocols and services on a TCP/IP network, which lets users search for other computers by using hierarchical, user-friendly names (hosts), instead of numeric IP addresses. To use this, you have to set up either the host record or the CNAME alias record in the DNS database file. -

                  Note
                  - DHCP has a higher priority than DNS for automatic configuration. If DHCP provides the URL to a .pac, .jvs, .js, or .ins configuration file, the process stops and the DNS lookup doesn't happen. - -**To set up automatic detection for DHCP servers** - -- Open the [DHCP Administrative Tool](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd145324(v=ws.10)), create a new option type, using the code number 252, and then associate it with the URL to your configuration file. For detailed instructions about how to do this, see [Create an option 252 entry in DHCP](/previous-versions/tn-archive/bb794881(v=technet.10)). - - **Examples:**
                  - `https://www.microsoft.com/webproxy.pac`
                  - `https://marketing/config.ins`
                  - `https://123.4.567.8/account.pac`

                  - For more detailed info about how to set up your DHCP server, see your server documentation. - -**To set up automatic detection for DNS servers** - -1. In your DNS database file, the file that’s used to associate your host (computer) names to static IP addresses in a zone, you need to create a host record named, **WPAD**. This record contains entries for all of the hosts that require static mappings, such as workstations, name servers, and mail servers. It also has the IP address to the web server storing your automatic configuration (.js, .jvs, .pac, or .ins) file.

                  The syntax is:
                  - ` IN A `
                  - `corserv IN A 192.55.200.143`
                  - `nameserver2 IN A 192.55.200.2`
                  - `mailserver1 IN A 192.55.200.51` -

                  -OR-

                  - Create a canonical name (CNAME) alias record, named WPAD. This record lets you use more than one name to point to a single host, letting you host both an FTP server and a web server on the same computer. It also includes the resolved name (not the IP address) of the server storing your automatic configuration (.pac) file.

                  - Note
                  For more info about creating a WPAD entry, see Creating a WPAD entry in DNS. - -2. After the database file propagates to the server, the DNS name, `wpad..com` resolves to the server name that includes your automatic configuration file. - -**Note**
                  -IE11 creates a default URL template based on the host name,**wpad**. For example, `https://wpad..com/wpad.dat`. Because of this, you need to set up a file or redirection point in your web server **WPAD** record, named **wpad.dat**. The **wpad.dat** record delivers the contents of your automatic configuration file. \ No newline at end of file diff --git a/browsers/internet-explorer/ie11-ieak/auto-version-sync-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/auto-version-sync-ieak11-wizard.md deleted file mode 100644 index b4565ed485..0000000000 --- a/browsers/internet-explorer/ie11-ieak/auto-version-sync-ieak11-wizard.md +++ /dev/null @@ -1,52 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to use the Automatic Version Synchronization page in the IEAK 11 Customization Wizard to download the IE11 Setup file each time you run the Wizard. -author: dansimp -ms.prod: ie11 -ms.assetid: bfc7685f-843b-49c3-8b9b-07e69705840c -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Use the Automatic Version Synchronization page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the Automatic Version Synchronization page in the IEAK 11 Wizard - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -The **Automatic Version Synchronization** page of the Internet Explorer Customization Wizard 11 runs the synchronization process every time you run the wizard, downloading the Internet Explorer 11 Setup file to your computer. The Setup file includes the required full and express packages. - -**Important**
                  -You must run the **Automatic Version Synchronization** page once for each operating system and language combination of IE. - -The **Automatic Version Synchronization** page tells you: - -- **Version available on your machine**. The version of IE11 that’s running on the computer that’s also running the IE Customization Wizard 11. - -- **Latest version available on web**. The most recently released version of the IE Customization Wizard 11. To get this value, the wizard compares the version of IE on your computer to the latest version of IE on the **Downloads** site. If the versions are different, you’ll be asked to update your version of IE. - -- **Disk space required**. The amount of space on your hard drive needed to update the browser. - -- **Disk space available**. The amount of hard drive space available on the computer that’s running the IE Customization Wizard 11. - - -**To use the Automatic Version Synchronization page** - -1. Click **Synchronize**.

                  -You might receive a security warning before downloading your Setup file, asking if you want to continue. Click **Run** to continue. - -2. Click **Next** to go to the [Custom Components](custom-components-ieak11-wizard.md) page or **Back** to go to the [Feature Selection](feature-selection-ieak11-wizard.md) page. - -  - -  - - - - - diff --git a/browsers/internet-explorer/ie11-ieak/before-you-create-custom-pkgs-ieak11.md b/browsers/internet-explorer/ie11-ieak/before-you-create-custom-pkgs-ieak11.md deleted file mode 100644 index 7271837b2e..0000000000 --- a/browsers/internet-explorer/ie11-ieak/before-you-create-custom-pkgs-ieak11.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: plan -description: A list of steps to follow before you start to create your custom browser installation packages. -author: dansimp -ms.author: dansimp -ms.manager: elizapo -ms.prod: ie11 -ms.assetid: 6ed182b0-46cb-4865-9563-70825be9a5e4 -ms.reviewer: -audience: itpro -manager: dansimp -title: Before you start using IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 04/24/2018 ---- - - -# Before you start using IEAK 11 - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - - -Before you run IEAK 11 and the Customization Wizard, make sure you have met the following requirements: - -- Have you determined which licensing version of the Internet Explorer Administration Kit 11 to install? For info, see [Determine the licensing version and features to use in IEAK 11](licensing-version-and-features-ieak11.md). - -- Do you meet the necessary hardware and software requirements? See [Hardware and software requirements for IEAK 11](hardware-and-software-reqs-ieak11.md). - -- Have you gotten all of the URLs needed to customize your **Home**, **Search**, and **Support** pages? See [Use the Important URLs - Home Page and Support page in the IEAK 11 Wizard](important-urls-home-page-and-support-ieak11-wizard.md). - -- Have you reviewed the security features to determine how to set up and manage them? See [Security features and IEAK 11](security-and-ieak11.md). - -- Have you created a test lab, where you can run the test version of your browser package to make sure it runs properly? - -  - -  - - - - - diff --git a/browsers/internet-explorer/ie11-ieak/branding-ins-file-setting.md b/browsers/internet-explorer/ie11-ieak/branding-ins-file-setting.md deleted file mode 100644 index 351b1bbb76..0000000000 --- a/browsers/internet-explorer/ie11-ieak/branding-ins-file-setting.md +++ /dev/null @@ -1,58 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: Use the \[Branding\] .INS file setting to set up your custom branding and setup info in your browser install package. -author: dansimp -ms.prod: ie11 -ms.assetid: cde600c6-29cf-4bd3-afd1-21563d2642df -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Use the Branding .INS file to create custom branding and setup info (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the Branding .INS file to create custom branding and setup info - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -Info about the custom branding and setup information in your browser package. - -|Name |Value | Description | -|-----------|--------------------------------|--------------------------------------------------------------| -|Add on URL | `` |The add-on URL for the product updates command in the browser.| -|BrowserDefault|

                  • **0.** Locks down Internet Explorer as the default browser.
                  • **1.** Preserves the existing default browser.
                  • **2.** Lets the employee decide the default browser.
                  | Determines the default browser behavior. | -|CMBitmapName | `` | The file name for the Connection Manager custom bitmap. | -|CMBitmapPath | `` | The full file path to the Connection Manager custom bitmap file. | -|CMProfileName| `` | The name of the Connection Manager profile. | -|CMProfilePath| `` | The full file path to the Connection Manager profile. | -|CMUseCustom |
                  • **0.** Don’t use a custom Connection Manager profile.
                  • **1.** Use a custom Connection Manager profile.
                  | Determines whether to use a custom Connection Manager profile. | -|CompanyName |`` |The name of the company with a valid IEAK 11 license, building this .ins file. | -|EncodeFavs |
                  • **0.** Don’t encode the section.
                  • **1.** Encode the section.
                  |Determines whether to encode the **[Favorites]** section for versions of IE earlier than 5.0. | -|FavoritesDelete |*hexadecimal:* `0x89` |Lets you remove all existing Favorites and Quick Links. | -|FavoritesOnTop |
                  • **0.** Don’t put the new item at the top of the **Favorites** menu.
                  • **1.** Put the new item at the top of the **Favorites** menu.
                  |Determines whether to put new favorite items at the top of the menu. | -|IE4 Welcome Msg |
                  • **0.** Don’t go to a **Welcome** page the first time the browser is opened.
                  • **1.** Go to a **Welcome** page the first time the browser is opened.
                  |Determines whether a **Welcome** page appears. | -|Language ID |`` |Code value for the language used. | -|Language Locale |`` |The locale of the version of IE being customized, as denoted by a four-letter string — for example, EN-us for English. | -|NoIELite |
                  • **0.** Don’t optimize the Active Setup Wizard.
                  • **1.** Optimize the Active Setup Wizard for download, using existing files, as possible.
                  |Determines whether to optimize the Active Setup Wizard for download. | -|SilentInstall |
                  • **0.** Run Windows Update Setup interactively.
                  • **1.** Run Windows Update Setup non-interactively, but show progress and error messages to the employee.
                  |Determines whether Windows Update Setup runs interactively on the employee’s computer.

                  **Note**
                  This only appears for the **Internal** version of the IEAK 11. | -|StealthInstall |

                  • **0.** Run Windows Update Setup showing progress and error messages to the employee.
                  • **1.** Run Windows Update Setup without showing error messages to the employee.
                  |Determines whether Windows Update Setup shows error messages and dialog boxes.

                  **Note**
                  This only appears for the **Internal** version of the IEAK 11. | -|Toolbar Bitmap |`` |Full path to the icon bitmap that appears on the browser toolbar. | -|Type |

                  • **1.** Internal version. For use on a corporate intranet or network.
                  • **2.** External version. For use by ISPs, ICPs, or Developers.
                  |The version of IEAK 11 being used. | -|User Agent |`` |String to be appended to the default User Agent string. | -|Version |`` |Version number of the browser. For example, `6,0,0,1`. | -|WebIntegrated |
                  • **0.** Don’t include the 4.x integrated shell in your custom package.
                  • **1.** Include the 4.x integrated shell in your custom package.
                  |Determines whether the IE 4.x integrated shell is included in this package. | -|Win32DownloadSite |`` |URL from where your employees will download the IEsetup.exe file. | -|Window_Title |`` |Customized window title for IE. | -|Window_Title_CN |`` |Company name to be appended to the window title. | -|WizardVersion |`` |Version of the IEAK that created the .ins file. For example, `6.00.0707.2800`. | - -  - - - - - diff --git a/browsers/internet-explorer/ie11-ieak/browser-ui-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/browser-ui-ieak11-wizard.md deleted file mode 100644 index 0116384f6d..0000000000 --- a/browsers/internet-explorer/ie11-ieak/browser-ui-ieak11-wizard.md +++ /dev/null @@ -1,60 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to use the Browser User Interface page in the IEAK 11 Customization Wizard to change the toolbar buttons and the title bar. -author: dansimp -ms.prod: ie11 -ms.assetid: c4a18dcd-2e9c-4b5b-bcc5-9b9361a79f0d -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Use the Browser User Interface page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the Browser User Interface page in the IEAK 11 Wizard - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -The **Browser User Interface** page of the Internet Explorer Customization Wizard 11 lets you change the toolbar buttons and the title bar text in IE. - -**Note**
                  The customizations you make on this page apply only to Internet Explorer for the desktop. - - **To use the Browser User Interface page** - -1. Check the **Customize Title Bars** box so you can add your custom text to the **Title Bar Text** box.

                  -The text shows up in the title bar as **IE provided by** <*your_custom_text*>. - -2. Check the **Delete existing toolbar buttons, if present** box so you can delete all of the toolbar buttons in your employee’s browser, except for the standard buttons installed with IE (which can’t be removed). - -**Note**
                  Only Administrators can use this option. - -3. Click **Add** to add new toolbar buttons.

                  - The **Browser Toolbar Button Information** box appears. - -4. In the **Toolbar caption** box, type the text that shows up when an employee hovers over your custom button. We recommend no more than 10 characters. - -5. In the **Toolbar action** box, browse to your script or executable file that runs when an employee clicks your custom button. - -6. In the **Toolbar icon** box, browse to the icon file that represents your button while active. This icon must be 20x20 pixels. - -7. Check the **This button should be shown on the toolbar by default** box so your custom button shows by default.

                  - This box should be cleared if you want to offer a custom set of buttons, but want your employees to choose whether or not to use them. In this situation, your buttons will show up in the **Customize Toolbars** dialog box, under **Available toolbar buttons**. Your employees can get to this dialog box in IE by clicking **Tools** from the **Command Bar**, clicking **Toolbars**, and then clicking **Customize**. - -8. Click **OK.** - -9. Click **Edit** to change your custom toolbar button or **Remove** to delete the button. The removed button will disappear from your employee’s computer after you apply the updated customization. Only custom toolbar buttons can be removed. - -10. Click **Next** to go to the [Search Providers](search-providers-ieak11-wizard.md) page or **Back** to go to the [User Experience](user-experience-ieak11-wizard.md) page. - - - - - - - - - diff --git a/browsers/internet-explorer/ie11-ieak/browsertoolbars-ins-file-setting.md b/browsers/internet-explorer/ie11-ieak/browsertoolbars-ins-file-setting.md deleted file mode 100644 index 05fb2324f7..0000000000 --- a/browsers/internet-explorer/ie11-ieak/browsertoolbars-ins-file-setting.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: plan -description: Use the \[BrowserToolbars\] .INS file setting to customize your Internet Explorer toolbar and buttons. -author: dansimp -ms.prod: ie11 -ms.assetid: 83af0558-9df3-4c2e-9350-44f7788efa6d -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Use the BrowserToolbars .INS file to customize the Internet Explorer toolbar and buttons (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the BrowserToolbars .INS file to customize the Internet Explorer toolbar and buttons - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -Info about how to customize the Internet Explorer toolbar. - -|Name |Value |Description | -|-----------|---------------------------|-------------| -|Action0 |`` |Path and file name for the executable (.exe) file that's associated with your custom toolbar button. | -|Caption0 |`` |Text that appears as the caption for your custom toolbar button. | -|DeleteButtons |

                  • **0.** Don’t delete the existing custom toolbar buttons.
                  • **1.** Delete the existing custom toolbar buttons.
                  |Determines whether to delete the existing custom toolbar buttons. | -|HotIcon0 |`` |An icon (.ico) file that appears highlighted on the button when the pointer is moved over it. | -|Icon0 |`` |An icon (.ico) file that appears dimmed on the button when the pointer isn’t moved over it. | -|Show0 |
                  • **0.** Don’t show the button by default.
                  • **1.** Show the button by default.
                  |Determines whether to show the new button on the toolbar by default. | -|ToolTipText0 |`` |Tooltip text for the custom toolbar button. | - -  - -  - -  - - - - - diff --git a/browsers/internet-explorer/ie11-ieak/browsing-options-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/browsing-options-ieak11-wizard.md deleted file mode 100644 index 3214ea32c0..0000000000 --- a/browsers/internet-explorer/ie11-ieak/browsing-options-ieak11-wizard.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to use the Browsing Options page in the IEAK 11 Customization Wizard to manage items in the Favorites, Favorites Bar, and Feeds section. -author: dansimp -ms.prod: ie11 -ms.assetid: d6bd71ba-5df3-4b8c-8bb5-dcbc50fd974e -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Use the Browsing Options page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the Browsing Options page in the IEAK 11 Wizard - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -The **Browsing Options** page of the Internet Explorer Administration Kit (IEAK 11) Customization Wizard lets you decide how you want to manage items in the **Favorites, Favorites Bar, and Feeds** section, including the Microsoft-provided default items. - -The choices that you make on this page affect only the items shown on the **Favorites, Favorites Bar, and Feeds** page. - -**To use the Browsing Options page** - -1. Decide how you want to manage links that are already installed on your employee’s computer: - - - **Delete all existing items under Favorites, Favorites Bar and Feeds.** Removes all of the links, Web Slices, feeds, and Accelerators on the computer. This includes links and favorites added by you or the employee. Because this removes everything, we recommend that you use this option with caution. - - - **Only delete the items created by the administrator.** Removes only the items that you added for your employees on the **Favorites, Favorites Bar and Feeds** page. - - - **Don’t delete any items.** Doesn’t remove anything. Links Web Slices, feeds, and Accelerators are added to your employee computers at the top of the list, in the order you picked on the **Favorites, Favorites Bar and Feeds** page. - -2. Decide if you don’t want to add the Microsoft-default items: - - - **Favorites.** Checking this box won’t add the Microsoft-defined links. - - - **Web Slices and Links.** Checking this box won’t add the Microsoft-defined Web Slices or links. - - - **Feeds.** Checking this box won’t add the Microsoft-defined RSS feeds. - - - **Accelerators.** Checking this box won’t add the Microsoft-defined Accelerators. - -3. Click **Next** to go to the [First Run Wizard and Welcome Page Options](first-run-and-welcome-page-ieak11-wizard.md) page or **Back** to go to the [Favorites, Favorites Bar, and Feeds](favorites-favoritesbar-and-feeds-ieak11-wizard.md) page. - -  - -  - - - - - diff --git a/browsers/internet-explorer/ie11-ieak/cabsigning-ins-file-setting.md b/browsers/internet-explorer/ie11-ieak/cabsigning-ins-file-setting.md deleted file mode 100644 index 321f45caf5..0000000000 --- a/browsers/internet-explorer/ie11-ieak/cabsigning-ins-file-setting.md +++ /dev/null @@ -1,30 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: Use the \[CabSigning\] .INS file setting to customize the digital signature info for your apps. -author: dansimp -ms.prod: ie11 -ms.assetid: 098707e9-d712-4297-ac68-7d910ca8f43b -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Use the CabSigning .INS file to customize the digital signature info for your apps (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the CabSigning .INS file to customize the digital signature info for your apps - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -Info about how to customize the digital signature info for your apps. - -|Name |Value |Description | -|-----------|---------------------------|-------------| -|InfoURL |`` |URL that appears on the **Certificate** dialog box. | -|Name |`` |Company name associated with the certificate. | -|pvkFile |`` |File path to the privacy key file. | -|spcFile |`` |File path to the certificate file.| - diff --git a/browsers/internet-explorer/ie11-ieak/compat-view-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/compat-view-ieak11-wizard.md deleted file mode 100644 index b6138064be..0000000000 --- a/browsers/internet-explorer/ie11-ieak/compat-view-ieak11-wizard.md +++ /dev/null @@ -1,26 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: We’re sorry. We’ve removed all of the functionality included on the **Compatibility View** page of the Internet Explorer Customization Wizard 11. -author: dansimp -ms.prod: ie11 -ms.assetid: 51d8f80e-93a5-41e4-9478-b8321458bc30 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Use the Compatibility View page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the Compatibility View page in the IEAK 11 Wizard - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -We’re sorry. We’ve changed the way Compatibility View works in Internet Explorer 11 and have removed all of the functionality included on the **Compatibility View** page of the Internet Explorer Customization Wizard 11. For more info about the changes we’ve made to the Compatibility View functionality, see [Missing the Compatibility View Button](../ie11-deploy-guide/missing-the-compatibility-view-button.md). - -Click **Next** to go to the [Programs](programs-ieak11-wizard.md) page or **Back** to go to the [Security and Privacy Settings](security-and-privacy-settings-ieak11-wizard.md) page. - diff --git a/browsers/internet-explorer/ie11-ieak/connection-mgr-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/connection-mgr-ieak11-wizard.md deleted file mode 100644 index e9051c955b..0000000000 --- a/browsers/internet-explorer/ie11-ieak/connection-mgr-ieak11-wizard.md +++ /dev/null @@ -1,25 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: We’re sorry. We’ve removed all of the functionality included on the **Connection Manager** page of the Internet Explorer Customization Wizard 11. -author: dansimp -ms.prod: ie11 -ms.assetid: 1edaa7db-cf6b-4f94-b65f-0feff3d4081a -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Use the Connection Manager page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the Connection Manager page in the IEAK 11 Wizard - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -We're sorry. We've removed all of the functionality included on the Connection Manager page of the Internet Explorer Customization Wizard 11. - -Click **Next** to go to the [Connection Settings](connection-settings-ieak11-wizard.md) page or **Back** to go to the [Compatibility View](compat-view-ieak11-wizard.md) page. - diff --git a/browsers/internet-explorer/ie11-ieak/connection-settings-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/connection-settings-ieak11-wizard.md deleted file mode 100644 index bc00c58bec..0000000000 --- a/browsers/internet-explorer/ie11-ieak/connection-settings-ieak11-wizard.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to use the Connection Settings page in IEAK 11 Customization Wizard to import and preset connection settings on your employee’s computers. -author: dansimp -ms.prod: ie11 -ms.assetid: dc93ebf7-37dc-47c7-adc3-067d07de8b78 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Use the Connection Settings page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the Connection Settings page in the IEAK 11 Wizard - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -The **Connection Settings** page of the Internet Explorer Administration Kit (IEAK 11) Customization Wizard lets you import the connection settings from your computer, to preset the connection settings on your employee’s computers. - -**Note**
                  Using the options on the **Additional Settings** page of the wizard, you can let your employees change their connection settings. For more information see the [Additional Settings](additional-settings-ieak11-wizard.md) page. You can also customize additional connection settings using the **Automatic Configuration** page in the wizard. For more information see the [Automatic Configuration](auto-config-ieak11-wizard.md) page. - -**To view your current connection settings** - -1. Open IE, click the **Tools** menu, click **Internet Options**, and then click the **Connections** tab. - -2. Click **Settings** to view your dial-up settings and click **LAN Settings** to view your network settings. - -**To use the Connection Settings page** - -1. Decide if you want to customize your connection settings. You can pick: - - - **Do not customize Connection Settings.** Pick this option if you don’t want to preset your employee’s connection settings. - - - **Import the current Connection Settings from this machine.** Pick this option to import your connection settings from your computer and use them as the preset for your employee’s connection settings. - - **Note**
                  If you want to change any of your settings later, you can click **Modify Settings** to open the **Internet Properties** box, click the **Connection Settings** tab, and make your changes. - -2. Check the **Delete existing Dial-up Connection Settings** box to clear any existing settings on your employee’s computers. - -3. Click **Next** to go to the [Automatic Configuration](auto-config-ieak11-wizard.md) page or **Back** to go to the [Connection Manager](connection-mgr-ieak11-wizard.md) page. - diff --git a/browsers/internet-explorer/ie11-ieak/connectionsettings-ins-file-setting.md b/browsers/internet-explorer/ie11-ieak/connectionsettings-ins-file-setting.md deleted file mode 100644 index 0e7777a64e..0000000000 --- a/browsers/internet-explorer/ie11-ieak/connectionsettings-ins-file-setting.md +++ /dev/null @@ -1,30 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: plan -description: Use the \[ConnectionSettings\] .INS file setting to specify the network connection settings needed to install your custom package. -author: dansimp -ms.prod: ie11 -ms.assetid: 41410300-6ddd-43b2-b9e2-0108a2221355 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Use the ConnectionSettings .INS file to review the network connections for install (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the ConnectionSettings .INS file to review the network connections for install - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -Info about the network connection settings used to install your custom package. This section creates a common configuration on all of your employee’s computers. - -|Name |Value |Description | -|-----------|---------------------------|-------------| -|ConnectName0 |`` |Name for the connection. | -|ConnectName1 |`` |Secondary name for the connection. | -|DeleteConnectionSettings |
                  • **0.** Don’t remove the connection settings during installation.
                  • **1.** Remove the connection settings during installation.

                    **Note**
                    This only appears for the **Internal** version of the IEAK 11.

                  |Determines whether to remove the existing connection settings during installation of your custom package. | -|Option |
                  • **0.** Don’t let employees import connection settings.
                  • **1.** Let employees import connection settings.
                  |Determines whether an employee can import connection settings into the Internet Explorer Customization Wizard. | - diff --git a/browsers/internet-explorer/ie11-ieak/create-build-folder-structure-ieak11.md b/browsers/internet-explorer/ie11-ieak/create-build-folder-structure-ieak11.md deleted file mode 100644 index 0befbc922f..0000000000 --- a/browsers/internet-explorer/ie11-ieak/create-build-folder-structure-ieak11.md +++ /dev/null @@ -1,28 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: plan -description: How to create your folder structure on the computer that you’ll use to build your custom browser package. -author: dansimp -ms.prod: ie11 -ms.assetid: e0d05a4c-099f-4f79-a069-4aa1c28a1080 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Create the build computer folder structure using IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Create the build computer folder structure using IEAK 11 - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -Create your build environment on the computer that you’ll use to build your custom browser package. Your license agreement determines your folder structure and which version of Internet Explorer Administration Kit 11 (IEAK 11) you’ll use: **Internal** or **External**. - -|Name |Version |Description | -|-----------------|----------------------|---------------------------------------------------------| -|`\` |Internal and External |The main, placeholder folder used for all files built by IEAK or that you referenced in your custom package.| -|`\\Dist` |Internal only |Destination directory for your files. You’ll only need this folder if you’re creating your browser package on a network drive. | - diff --git a/browsers/internet-explorer/ie11-ieak/create-manage-deploy-custom-pkgs-ieak11.md b/browsers/internet-explorer/ie11-ieak/create-manage-deploy-custom-pkgs-ieak11.md deleted file mode 100644 index e2a0fb48a9..0000000000 --- a/browsers/internet-explorer/ie11-ieak/create-manage-deploy-custom-pkgs-ieak11.md +++ /dev/null @@ -1,31 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: plan -description: Review this list of tasks and references before you create and deploy your Internet Explorer 11 custom install packages. -author: dansimp -ms.prod: ie11 -ms.assetid: fe71c603-bf07-41e1-a477-ade5b28c9fb3 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Tasks and references to consider before creating and deploying custom packages using IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Tasks and references to consider before creating and deploying custom packages using IEAK 11 - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -Review this list of tasks and references to help you use the Internet Explorer Administration Kit 11 (IEAK 11) to set up, deploy, and manage Internet Explorer 11 in your company. - -|Task |References | -|----------------------------------------|--------------------------------------------------------------| -|Review concepts and requirements, including info about the version and features you'll use. |
                  • [Hardware and software requirements for IEAK 11](hardware-and-software-reqs-ieak11.md)
                  • [Determine the licensing version and features to use in IEAK 11](licensing-version-and-features-ieak11.md)
                  • [Before you start using IEAK 11](before-you-create-custom-pkgs-ieak11.md)
                  | -|Prep your environment and get all of the info you'll need for running IEAK 11 |
                  • [Create the build computer folder structure using IEAK 11](create-build-folder-structure-ieak11.md)
                  • [Customize the Toolbar button and Favorites List icons using IEAK 11](guidelines-toolbar-and-favorites-list-ieak11.md)
                  • [Before you install your package over your network using IEAK 11](prep-network-install-with-ieak11.md)
                  • [Set up auto detection for DHCP or DNS servers using IEAK 11](auto-detection-dhcp-or-dns-servers-ieak11.md)
                  • [Register an uninstall app for custom components using IEAK 11](register-uninstall-app-ieak11.md)
                  • [Add and approve ActiveX controls using the IEAK 11](add-and-approve-activex-controls-ieak11.md)
                  • [Internet Explorer Administration Kit 11 (IEAK 11) Customization Wizard options](ieak11-wizard-custom-options.md)
                  • [Security features and IEAK 11](security-and-ieak11.md)
                  | -|Run the Internet Explorer Administration Kit 11 (IEAK 11) Customization Wizard |
                  • [Use the File Locations page in the IEAK 11 Wizard](file-locations-ieak11-wizard.md)
                  • [Use the Platform Selection page in the IEAK 11 Wizard](platform-selection-ieak11-wizard.md)
                  • [Use the Language Selection page in the IEAK 11 Wizard](language-selection-ieak11-wizard.md)
                  • [Use the Package Type Selection page in the IEAK 11 Wizard](pkg-type-selection-ieak11-wizard.md)
                  • [Use the Feature Selection page in the IEAK 11 Wizard](feature-selection-ieak11-wizard.md)
                  • [Use the Automatic Version Synchronization page in the IEAK 11 Wizard](auto-version-sync-ieak11-wizard.md)
                  • [Use the Custom Components page in the IEAK 11 Wizard](custom-components-ieak11-wizard.md)
                  • [Use the Internal Install page in the IEAK 11 Wizard](internal-install-ieak11-wizard.md)
                  • [Use the User Experience page in the IEAK 11 Wizard](user-experience-ieak11-wizard.md)
                  • [Use the Browser User Interface page in the IEAK 11 Wizard](browser-ui-ieak11-wizard.md)
                  • [Use the Search Providers page in the IEAK 11 Wizard](search-providers-ieak11-wizard.md)
                  • [Use the Important URLs - Home Page and Support page in the IEAK 11 Wizard](important-urls-home-page-and-support-ieak11-wizard.md)
                  • [Use the Accelerators page in the IEAK 11 Wizard](accelerators-ieak11-wizard.md)
                  • [Use the Favorites, Favorites Bar, and Feeds page in the IEAK 11 Wizard](favorites-favoritesbar-and-feeds-ieak11-wizard.md)
                  • [Use the Browsing Options page in the IEAK 11 Wizard](browsing-options-ieak11-wizard.md)
                  • [Use the First Run Wizard and Welcome Page Options page in the IEAK 11 Wizard](first-run-and-welcome-page-ieak11-wizard.md)
                  • [Use the Compatibility View page in the IEAK 11 Wizard](compat-view-ieak11-wizard.md)
                  • [Use the Connection Manager page in the IEAK 11 Wizard](connection-mgr-ieak11-wizard.md)
                  • [Use the Connection Settings page in the IEAK 11 Wizard](connection-settings-ieak11-wizard.md)
                  • [Use the Automatic Configuration page in the IEAK 11 Wizard](auto-config-ieak11-wizard.md)
                  • [Use the Proxy Settings page in the IEAK 11 Wizard](proxy-settings-ieak11-wizard.md)
                  • [Use the Security and Privacy Settings page in the IEAK 11 Wizard](security-and-privacy-settings-ieak11-wizard.md)
                  • [Use the Add a Root Certificate page in the IEAK 11 Wizard](add-root-certificate-ieak11-wizard.md)
                  • [Use the Programs page in the IEAK 11 Wizard](programs-ieak11-wizard.md)
                  • [Use the Additional Settings page in the IEAK 11 Wizard](additional-settings-ieak11-wizard.md)
                  • [Use the Wizard Complete - Next Steps page in the IEAK 11 Wizard](wizard-complete-ieak11-wizard.md)
                  | -|Review your policy settings and create multiple versions of your install package. |
                  • [Create multiple versions of your custom package using IEAK 11](create-multiple-browser-packages-ieak11.md)
                  • [Use the RSoP snap-in to review policy settings](rsop-snapin-for-policy-settings-ieak11.md)

                    **Note**
                    For deployment instructions, additional troubleshooting, and post-installation management, see the [Internet Explorer 11 (IE11) - Deployment Guide for IT Pros](../ie11-deploy-guide/index.md)

                  | -|Review the general IEAK Customization Wizard 11 information, which applies throughout the process. |
                  • [Troubleshoot custom package and IEAK 11 problems](troubleshooting-custom-browser-pkg-ieak11.md)
                  • [File types used or created by IEAK 11](file-types-ieak11.md)
                  • [Customize Automatic Search using IEAK 11](customize-automatic-search-for-ie.md)
                  • [Use the uninstallation .INF files to uninstall custom components](create-uninstall-inf-files-for-custom-components.md)
                  • [Using Internet Settings (.INS) files with IEAK 11](using-internet-settings-ins-files.md)
                  • [Use proxy auto-configuration (.pac) files with IEAK 11](proxy-auto-config-examples.md)
                  • [IExpress Wizard for Windows Server 2008 R2 with SP1](iexpress-wizard-for-win-server.md)
                  | - diff --git a/browsers/internet-explorer/ie11-ieak/create-multiple-browser-packages-ieak11.md b/browsers/internet-explorer/ie11-ieak/create-multiple-browser-packages-ieak11.md deleted file mode 100644 index 5d88bfa81a..0000000000 --- a/browsers/internet-explorer/ie11-ieak/create-multiple-browser-packages-ieak11.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: Steps to create multiple versions of your custom browser if you support more than 1 version of Windows, more than 1 language, or have different features in each package. -author: dansimp -ms.prod: ie11 -ms.assetid: 4c5f3503-8c69-4691-ae97-1523091ab333 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Create multiple versions of your custom package using IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Create multiple versions of your custom package using IEAK 11 - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -You'll need to create multiple versions of your custom browser package if: - -- You support more than 1 version of the Windows operating system. - -- You support more than 1 language. - -- You have custom installation packages with only minor differences. For example, having a different phone number or a different set of URLs in the **Favorites** folder. - -The Internet Explorer Customization Wizard 11 stores your original settings in the Install.ins file and will show them each time you re-open the wizard. For more info about .ins files, see [Using Internet Settings (.INS) files with IEAK 11](using-internet-settings-ins-files.md). - -**To create multiple versions of your browser package** - -1. Use the Internet Explorer Customization Wizard 11 to create a custom browser package. For more info about how to run the wizard, start with the [Use the File Locations page in the IEAK 11 Wizard](file-locations-ieak11-wizard.md) topic. - -2. Go to the Cie\Custom folder and rename the Install.ins file to a name that reflects the version. Like, if you need a version for your employees in Texas, you could name the file Texas.ins. - -3. Run the wizard again, choosing the newly renamed folder as the destination directory for your output files.

                  -**Important**
                  Except for the **Title bar** text, **Favorites**, **Links bar**, **Home** page, and **Search bar**, we recommend that you keep all of your wizard settings the same for all of your build computers. - -4. Repeat this process until you’ve created a package for each version of your custom installation package. - diff --git a/browsers/internet-explorer/ie11-ieak/create-uninstall-inf-files-for-custom-components.md b/browsers/internet-explorer/ie11-ieak/create-uninstall-inf-files-for-custom-components.md deleted file mode 100644 index ba3904ae39..0000000000 --- a/browsers/internet-explorer/ie11-ieak/create-uninstall-inf-files-for-custom-components.md +++ /dev/null @@ -1,33 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: Use Setup information (.inf) files to uninstall custom components from your custom browser packages. -author: dansimp -ms.prod: ie11 -ms.assetid: 8257aa41-58de-4339-81dd-9f2ffcc10a08 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Use Setup information (.inf) files to uninstall custom components (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use uninstallation .INF files to uninstall custom components - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -The Internet Explorer Administration Kit 11 (IEAK 11) uses Setup information (.inf) files to provide installation instructions for your custom browser packages. You can also use this file to uninstall your custom components by removing the files, registry entries, and shortcuts, and adding your custom component to the list of programs that can be uninstalled from **Uninstall or change a program**. - -**To uninstall your custom components** - -1. Open the Registry Editor and add a new key and value to:
                  `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\app-name,"DisplayName",,"description"`

                  -Where *description* is the string that’s shown in the **Uninstall or change a program** box. - -2. Add another new key and value to:
                  `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\app-name,"UninstallString”",,"command-line"`

                  -Where *command-line* is the command that’s run when the component is picked from the **Uninstall or change a program** box. - -Your uninstall script must also remove your key from under the **Uninstall** registry key, so that your component no longer appears in the **Uninstall or change a program** after uninstallation. You can also run just a section of an .inf file by using the Setupx.dll InstallHinfSection entry point. To make this work, your installation script must copy the .inf file to the Windows\Inf folder for your custom component. - diff --git a/browsers/internet-explorer/ie11-ieak/custom-components-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/custom-components-ieak11-wizard.md deleted file mode 100644 index 1a981a5a16..0000000000 --- a/browsers/internet-explorer/ie11-ieak/custom-components-ieak11-wizard.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to use the Custom Components page in the IEAK 11 Customization Wizard to add additional components for your employees to install with IE. -author: dansimp -ms.prod: ie11 -ms.assetid: 38a2b90f-c324-4dc8-ad30-8cd3e3e901d7 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Use the Custom Components page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the Custom Components page in the IEAK 11 Wizard - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -The **Custom Components** page of the Internet Explorer Customization Wizard 11 lets you add up to 10 additional components that your employees can install at the same time they install IE. These components can be created by Microsoft or your organization as either compressed cabinet (.cab) or self-extracting executable (.exe) files. If you’re using Microsoft components, make sure you have the latest version and software patches from the [Microsoft Support](https://go.microsoft.com/fwlink/p/?LinkId=258658) site. To include Microsoft Update components, you must bundle the associated files into a custom component. - -**Important**
                  You should sign any custom code that’s being downloaded over the Internet. The default settings of Internet Explorer 11 will automatically reject any unsigned code. For more info about digitally signing custom components, see [Security features and IEAK 11](security-and-ieak11.md). - -**To use the Custom Component page** - -1. Click **Add**.

                  -The **Add a Custom Component** box appears. - -2. Type in the name of your component and then browse to the location of your file (either .cab or .exe). - -3. Pick when to install the component. This can be before IE, after IE, or after the computer restarts.

                  -**Important**
                  You should install your component before IE if you need to run a batch file to configure your employee settings. You should install your component after IE if you plan to install software updates.  - -4. Check the **Only install if IE is installed successfully** box if your component should only install if IE installs successfully. For example, if you’re installing a security update that requires IE. - -5. If your component is a .cab file, you must provide the extraction command into the **Command** box. - -6. If your component has its own globally unique identifier (GUID), replace the value in the **GUID** box. Otherwise, keep the automatically generated GUID. - -7. Describe your component using up to 511 characters in the **Description** box. - -8. Type any command-line options that need to run while installing your component into the **Parameters** box. For example, if you want your component to install silently, without prompts. For more info about using options, see [IExpress command-line options](iexpress-command-line-options.md). - -9. Type the value that Microsoft Update Setup uses to check that the component installed successfully into the **Uninstall Key** box. This check is done by comparing your value to the value in the `HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\ApplicationName` key. - -10. Type a numeric serial number for your component into the **Version** box, using this format: *xxxx*, *xxxxxx*, *xxxx*, *xxxx*. - -11. Click **Add**.

                  -The boxes clear and you can add another component. Click **Cancel** to go back to the **Custom Components** page. - -12. Click **Edit** to change your custom component information, **Verify** to make sure the component is digitally signed, or **Remove** to delete the component from your custom installation package. - -13. Click **Next** to go to the [Internal Install](internal-install-ieak11-wizard.md) page or **Back** to go to the [Automatic Version Synchronization](auto-version-sync-ieak11-wizard.md) page. - -  - -  - - - - - diff --git a/browsers/internet-explorer/ie11-ieak/custombranding-ins-file-setting.md b/browsers/internet-explorer/ie11-ieak/custombranding-ins-file-setting.md deleted file mode 100644 index 7a5556235d..0000000000 --- a/browsers/internet-explorer/ie11-ieak/custombranding-ins-file-setting.md +++ /dev/null @@ -1,28 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: plan -description: Use the \[CustomBranding\] .INS file setting to specify the location of your branding cabinet (.cab) file. -author: dansimp -ms.prod: ie11 -ms.assetid: 9c74e239-65c5-4aa5-812f-e0ed80c5c2b0 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Use the CustomBranding .INS file to create custom branding and setup info (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the CustomBranding .INS file to create custom branding and setup info - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -Provide the URL to your branding cabinet (.cab) file. - - -| Name | Value | Description | -|----------|------------------|------------------------------------------------------------------------------------------------------------------------| -| Branding | `` | The location of your branding cabinet (.cab) file. For example, https://www.<your_server>.net/cabs/branding.cab. | - diff --git a/browsers/internet-explorer/ie11-ieak/customize-automatic-search-for-ie.md b/browsers/internet-explorer/ie11-ieak/customize-automatic-search-for-ie.md deleted file mode 100644 index 634e13f2fb..0000000000 --- a/browsers/internet-explorer/ie11-ieak/customize-automatic-search-for-ie.md +++ /dev/null @@ -1,107 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: manage -description: Customize Automatic Search in Internet Explorer so that your employees can type a single word into the Address box to search for frequently used pages. -author: dansimp -ms.prod: ie11 -ms.assetid: 694e2f92-5e08-49dc-b83f-677d61fa918a -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Customize Automatic Search using IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Customize Automatic Search for Internet Explorer using IEAK 11 - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -Internet Explorer lets websites advertise any search provider that uses the open search standard described at the A9 website ([OpenSearch 1.1 Draft 5](https://opensearch.org/docs/latest/opensearch/index/)). When IE detects new search providers, the **Search** box becomes active and adds the new providers to the drop-down list of providers. - -Using the **Administrative Templates** section of Group Policy, you can prevent the search box from appearing, you can add a list of acceptable search providers, or you can restrict your employee’s ability to add or remove search providers. - -## Automatic Search Configuration -You can customize Automatic Search so that your employees can type a single word into the **Address** box to search for frequently used pages. For example, you can let a commonly used webpage about invoices appear if an employee types *invoice* into the **Address** box, even if the URL doesn’t include the term. If a website can’t be associated with the term, or if there are multiple matches, a webpage appears showing the top search results. - -**To set up Automatic Search** - -1. Create a script (.asp) file that conditionally looks for search terms, and post it to an intranet server here: https://ieautosearch/response.asp?MT=%1&srch=%2.

                  - For info about the acceptable values for the *%1* and *%2* parameters, see the [Automatic Search parameters](#automatic-search-parameters). For an example of the script file, see the [Sample Automatic Search script](#sample-automatic-search-script).

                  - **Important**
                  If you aren’t using IIS in your company, you’ll need to remap this URL to your script file’s location. - -2. On the **Additional Settings** page of the IEAK 11, click **Internet Settings**, and then click **Advanced Settings**. - -3. Go to the section labeled **Searching** and type *intranet* into the **Search Provider Keyword** box. - -**To redirect to a different site than the one provided by the search results** - -- In the **Advanced Settings** section, go to the section labeled **Searching** and change the **When searching from the address bar** setting to **Just go to the most likely site**. - -**To disable Automatic Search** - -- In the **Advanced Settings** section, go to the section labeled **Searching** and change the **When searching from the address bar** setting to **Do not search from the address bar**. - -### Automatic Search parameters -You must replace the Automatic Search script file parameters, *%1* and *%2* so they’re part of the actual URL. - -|Parameter |Value | -|----------|--------------------------------------------------------| -|1% |The text string typed by an employee into the **Address** bar. | -|2% |The type of search chosen by an employee. This can include:

                  • **3.** Display the results and go to the most likely site.
                  • **2.** Go to the most likely site.
                  • **1.** Display the results in the main window.
                  • **0.** Don't search from the **Address** box.
                  | - -### Sample Automatic Search script -This is a VBScript-based sample of an .asp Automatic Search script. - -``` -<%@ Language=VBScript %> -<% -' search holds the words typed in the Address bar -' by the user, without the "go" or -' "find" or any delimiters like -' "+" for spaces. -' If the user typed -' "Apple pie," search = "Apple pie." -' If the user typed -' "find Apple pie," search = "Apple pie." - -search = Request.QueryString("MT") -search = UCase(search) -searchOption = Request.QueryString("srch") - -' This is a simple if/then/else -' to redirect the browser to the site -' of your choice based on what the -' user typed. -' Example: expense report is an intranet page -' about filling out an expense report - -if (search = "NEW HIRE") then -Response.Redirect("https://admin/hr/newhireforms.htm") -elseif (search = "LIBRARY CATALOG") then -Response.Redirect("https://library/catalog") -elseif (search = "EXPENSE REPORT") then -Response.Redirect("https://expense") -elseif (search = "LUNCH MENU") then -Response.Redirect("https://cafe/menu/") -else - -' If there is not a match, use the -' default IE autosearch server -Response.Redirect("https://auto.search.msn.com/response.asp?MT=" -+ search + "&srch=" + searchOption + -"&prov=&utf8") -end if -%> -``` - - - - - - - - - diff --git a/browsers/internet-explorer/ie11-ieak/extreginf-ins-file-setting.md b/browsers/internet-explorer/ie11-ieak/extreginf-ins-file-setting.md deleted file mode 100644 index 7d0a2f9882..0000000000 --- a/browsers/internet-explorer/ie11-ieak/extreginf-ins-file-setting.md +++ /dev/null @@ -1,32 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: Use the \[ExtRegInf\] .INS file setting to specify your Setup information (.inf) files and the installation mode for your custom components. -author: dansimp -ms.prod: ie11 -ms.assetid: 53148422-d784-44dc-811d-ef814b86a4c6 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Use the ExtRegInf .INS file to specify your installation files and mode (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the ExtRegInf .INS file to specify installation files and mode - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -Info about how to specify your Setup information (.inf) files and the installation mode for your custom components. - -|Name |Value |Description | -|-----------|---------|------------------------------------------------------------------------------------------------------------------| -|Chat |*string* |The name of the .inf file and the install mode for components. For example, *,chat.inf,DefaultInstall. | -|Conf |*string* |The name of the .inf file and the install mode for components. For example, *,conf.inf,DefaultInstall. | -|Inetres |*string* |The name of the .inf file and the install mode for components. For example, *,inetres.inf,DefaultInstall. | -|Inetset |*string* |The name of the .inf file and the install mode for components. For example, *,inetset.inf,DefaultInstall. | -|Subs |*string* |The name of the .inf file and the install mode for components. For example, *,subs.inf,DefaultInstall. | -|ConnectionSettings |*string* |The name of the .inf file and the install mode for components. For example, *,connect.inf,DefaultInstall. | - diff --git a/browsers/internet-explorer/ie11-ieak/favorites-favoritesbar-and-feeds-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/favorites-favoritesbar-and-feeds-ieak11-wizard.md deleted file mode 100644 index 030dc054d2..0000000000 --- a/browsers/internet-explorer/ie11-ieak/favorites-favoritesbar-and-feeds-ieak11-wizard.md +++ /dev/null @@ -1,113 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to use the Favorites, Favorites Bar, and Feeds page in IEAK 11 Customization Wizard to add links, web slices, and feeds to your custom browser package. -author: dansimp -ms.prod: ie11 -ms.assetid: 84afa831-5642-4b8f-b7df-212a53ec8fc7 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Use the Favorites, Favorites Bar, and Feeds page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the Favorites, Favorites Bar, and Feeds page in the IEAK 11 Wizard - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -The **Favorites, Favorites Bar, and Feeds** page of the Internet Explorer Administration Kit (IEAK 11) Customization Wizard lets you add: - -- **Links.** Used so your employees can quickly connect with your important websites. These links can appear in the **Links** folder or on the **Favorites Bar**. - -- **Web Slices.** Used so your employees can subscribe to a section of a webpage, tracking information as it changes, such as for weather reports, stock prices, or the progress of an auction item. - -- **Feeds.** Used so your employees can quickly access your recommended RSS feeds. While you can’t import a folder of RSS feeds, you can add new links. - -Although we provide default items in the **Favorites, Favorites Bar, and Feeds** area, you can remove any of the items, add more items, or add new folders and links as part of your custom package. The customizations you make on this page only apply to Internet Explorer for the desktop. - -**To work with Favorites** - -1. To import your existing folder of links, pick **Favorites**, and then click **Import**. - -2. Go to your existing link folder, most likely in the `\Users\\Favorites` folder, and then click **OK**.

                  -The links are imported and added to the **Favorites, Favorites Bar, and Feeds** page, beneath the **Favorites** folder. - -3. To add a new favorite link, pick **Favorites**, and then click **Add URL**.

                  -The **Details** box appears. - -4. Type the new link name in the **Name** box. - -5. Type the new URL in the **URL** box. - -6. Optionally, you can add a 16x16 pixel icon to your link by adding the location in the **Icon** box. - -7. Click **OK**. - -8. To add a new **Favorites** folder, pick **Favorites**, and then click **Add Folder**.

                  -The **Details** box appears. - -9. Type the folder name into the **Name** box, and then click **OK**. - -10. Click **Edit** to change any of your new information, **Test URL** to test each of your links to make sure they go to the right place, or **Remove** to delete a **Favorites** item. - -11. If you have multiple **Favorites** links, you can update their order in the list. Check the **Add to the top of the list** box, click the link you want to move, and then click **Move Up** or **Move Down**. - -12. Check the **Disable IE Suggested Sites** box to disable the Suggested Sites feature. By turning this on, your employees won’t receive suggested sites based on the sites that they visit. - -13. Continue with the next procedures in this topic to add additional **Favorites Bar** or **RSS Feeds** links, or you can click **Next** to go to the [Browsing Options](browsing-options-ieak11-wizard.md) page or **Back** to go to the [Accelerators](accelerators-ieak11-wizard.md) page. - -**To work with the Favorites Bar** - -1. To import your existing folder of links, pick **Favorites Bar**, and then click **Import**. - -2. Go to your existing link folder, most likely in the `\Users\\Favorites\Favorites Bar` folder, and then click **OK**.

                  -The links are imported and added to the **Favorites, Favorites Bar, and Feeds** page, beneath the **Favorites Bar** folder. - -3. To add a new link to the **Favorites Bar**, pick **Favorites Bar**, and then click **Add URL**.

                  -The **Details** box appears. - -4. Type the new quick link name in the **Name** box. - -5. Type the new URL in the **URL** box. - -6. Optionally, you can add a 16x16 pixel icon to your link by adding the location in the **Icon** box. - -7. Pick whether your link is a simple **Link**, a **Feed**, or a **Web Slice**, and then click **OK**. - -8. Click **Edit** to change any of your new information, **Test URL** to test each of your links to make sure they go to the right place, or **Remove** to delete a **Favorites Bar** item. - -9. If you have multiple **Favorites Bar** links, you can update their order in the list. Check the **Add to the top of the list** box, click the link you want to move, and then click **Move Up** or **Move Down**. - -10. Check the **Disable IE Suggested Sites** box to disable the Suggested Sites feature. By turning this on, your employees won’t receive suggested sites based on the sites that they visit. - -11. Continue with the next procedures in this topic to add additional **Favorites** or **RSS Feeds** links, or you can click **Next** to go to the [Browsing Options](browsing-options-ieak11-wizard.md) page or **Back** to go to the [Accelerators](accelerators-ieak11-wizard.md) page. - -**To work with RSS Feeds** - -1. To add a new link to the **RSS Feeds**, pick **Favorites Bar**, and then click **Add URL**.

                  -The **Details** box appears. - -2. Type the new link name in the **Name** box. - -3. Type the new URL in the **URL** box, and then click **OK**. - -4. Click **Edit** to change any of your new information, **Test URL** to test each of your links to make sure they go to the right place, or **Remove** to delete a **RSS Feeds** item. - -5. If you have multiple **RSS Feeds** links, you can update their order in the list. Check the **Add to the top of the list** box, click the link you want to move, and then click **Move Up** or **Move Down**. - -6. Check the **Disable IE Suggested Sites** box to disable the Suggested Sites feature. By turning this on, your employees won’t receive suggested sites based on the sites that they visit. - -7. Continue with the next procedures in this topic to add additional **Favorites** or **Favorites Bar** links, or you can click **Next** to go to the [Browsing Options](browsing-options-ieak11-wizard.md) page or **Back** to go to the [Accelerators](accelerators-ieak11-wizard.md) page. - -  - -  - - - - - diff --git a/browsers/internet-explorer/ie11-ieak/favoritesex-ins-file-setting.md b/browsers/internet-explorer/ie11-ieak/favoritesex-ins-file-setting.md deleted file mode 100644 index ac736e20df..0000000000 --- a/browsers/internet-explorer/ie11-ieak/favoritesex-ins-file-setting.md +++ /dev/null @@ -1,30 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: Use the \[FavoritesEx\] .INS file setting to specify your Favorites icon file, whether Favorites is available offline, and your Favorites URLs. -author: dansimp -ms.prod: ie11 -ms.assetid: 55de376a-d442-478e-8978-3b064407b631 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Use the FavoritesEx .INS file for your Favorites icon and URLs (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the FavoritesEx .INS file for your Favorites icon and URLs - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -Info about where you store your **Favorites** icon file, whether your **Favorites** are available offline, and the URLs for each **Favorites** site. - -|Name |Value |Description | -|----------------|-----------------------|--------------------------------------------------------------------------| -|IconFile1 |`` |An icon (.ico file) that represents the **Favorites** item you’re adding. | -|Offline1 |

                  • **0.** Makes the **Favorites** item unavailable for offline browsing.
                  • **1.** Makes the **Favorites** item available for offline browsing.
                  |Determines if the **Favorites** item is available for offline browsing. | -|Title1 |`` |Title for the **Favorites** item. | -|Url1 |`` |URL to the **Favorites** item. | - diff --git a/browsers/internet-explorer/ie11-ieak/feature-selection-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/feature-selection-ieak11-wizard.md deleted file mode 100644 index 08899cb2db..0000000000 --- a/browsers/internet-explorer/ie11-ieak/feature-selection-ieak11-wizard.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to use the Feature Selection page in the IEAK 11 Customization Wizard to choose which parts of the setup processes and Internet Explorer 11 to change for your company. -author: dansimp -ms.prod: ie11 -ms.assetid: 9cb8324e-d73b-41ba-ade9-3acc796e21d8 -ms.reviewer: -ms.date: 03/15/2016 -audience: itpro -manager: dansimp -ms.author: dansimp -title: Use the Feature Selection page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library ---- - - -# Use the Feature Selection page in the IEAK 11 Wizard - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -The **Feature Selection** page of the Internet Explorer Customization Wizard 11 lets you choose which parts of the setup processes and Internet Explorer 11 to change for your company, including: - -- **Setup Customizations.** Lets you add custom components, decide which components to install, provide your download site information, and modify the Setup title bar and graphics. - -- **Internal Install.** Lets you decide to install the latest updates, run the malicious Software Removal Tool, and set IE11 as the default browser. - -- **Connection Manager.** Lets you import your Connection Manager Profiles, created by the Connection Manager Administration Kit (CMAK). - -- **Browser User Interface.** Lets you change the toolbar buttons, the title bar, and the general look of the browser. - -- **Search Providers.** Lets you add, remove, and pick a new default search provider for IE11. - -- **Important URLs – Home Page and Support.** Lets you choose multiple **Home** pages that open in different tabs in IE. You can also use this page to change the **Welcome** and **Online Support** pages. - -- **Accelerators.** Lets you import, add, edit, or remove Accelerators, the contextual services that give you quick access to external services from any webpage. - -- **Favorites, Favorites Bar, and Feeds.** Lets you pick which favorites, web slices, and feeds are installed with your custom installation package. - -- **Browsing Options.** Lets you pick how you delete items in the Favorites, Favorites Bar, and Feeds folders, and whether to add the Microsoft default items. - -- **Compatibility View.** Lets you decide whether IE renders content using compatibility mode or standards mode. - -- **Connections Customization.** Lets you set up and deploy custom connections. - -- **Security Zones and Content Ratings.** Lets you control what your employees can view and what’s downloaded to their computer. - -- **Programs.** Lets you pick the default program that’s used automatically by email, HTML, newsgroups, Internet calls, calendars, and contact lists. - -- **Additional Settings.** Lets you pre-set and lockdown specific functionality on your employee’s computer. - -**Note**
                  Your choices on this page determine what wizard pages appear. - -**To use the Feature Selection page** - -1. Check the box next to each feature you want to include in your custom installation package.

                  -You can also click **Select All** to add, or **Clear All** to remove, all of the features. - -2. Click **Next** to go to the [Automatic Version Synchronization](auto-version-sync-ieak11-wizard.md) page or **Back** to go to the [Package Type Selection](pkg-type-selection-ieak11-wizard.md) page. - -  - -  diff --git a/browsers/internet-explorer/ie11-ieak/file-locations-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/file-locations-ieak11-wizard.md deleted file mode 100644 index 0aee908cd4..0000000000 --- a/browsers/internet-explorer/ie11-ieak/file-locations-ieak11-wizard.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to use the File Locations page in the IEAK 11 Customization Wizard to change the location of your install package and IE11 folders. -author: dansimp -ms.prod: ie11 -ms.assetid: bd0620e1-0e07-4560-95ac-11888c2c389e -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Use the File Locations page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the File Locations page in the IEAK 11 Wizard - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -The **File Locations** page of the Internet Explorer Customization Wizard 11 lets you change the location of your folders, including: - -- Where you’ll create and store your custom installation package. - -- Where you’ll download and store Internet Explorer 11. - -**Important**
                  -You can create a custom installation package on your hard drive and move it to an Internet or intranet server, or you can create it directly on a server. If you create the package on a web server that’s running from your hard drive, use the path to the web server as the destination folder location. Whatever location you choose, it must be protected by appropriate access control lists (ACLs). If the location is not protected, the custom package may be tampered with. - -**To use the File Locations page** - -1. Browse to the location where you’ll store your finished custom IE installation package and the related subfolders.

                  -**Note**
                  Subfolders are created for each language version, based on operating system and media type. For example, if your destination folder is `C:\Inetpub\Wwwroot\Cie\Dist`, then the English-language version is created as `C:\Inetpub\Wwwroot\Cie\Dist\Flat\Win32\En` subfolders. - -2. Click **Advanced Options**.

                  -The **Advanced Options** box opens and lets you change how the wizard downloads and gets files, and how it imports settings from your .ins file. - -3. Check the box letting IE Customization Wizard 11 look for the latest components, using Automatic Version Synchronization.

                  -This option lets the wizard connect to the IE **Downloads** page to look for updated versions of IE since you last ran the wizard.

                  -**Important**
                  -You must run Automatic Version Synchronization at least once to check for updated components. - -4. Browse to your .ins file location, and then click **Open**.

                  -By importing settings from an .ins file, you can re-use existing configurations. This saves you time if your packages have the same or similar settings. - -5. Browse to your component download folder.

                  -Automatic Version Synchronization automatically checks the component download folder to see if you have the latest version of IE. To keep this folder up-to-date, you shouldn’t change its location. However, if you want to keep both a previous version of IE and the latest version, we recommend you download the components to a different location. - -6. Click **OK** to close the **Advanced Options** box, and then click **Next** to go to the [Platform Selection](platform-selection-ieak11-wizard.md) page. - -  - -  - - - - - diff --git a/browsers/internet-explorer/ie11-ieak/file-types-ieak11.md b/browsers/internet-explorer/ie11-ieak/file-types-ieak11.md deleted file mode 100644 index 616e3b9938..0000000000 --- a/browsers/internet-explorer/ie11-ieak/file-types-ieak11.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: plan -description: Review the file types that are created and used by tools in the Internet Explorer Administration Kit 11 (IEAK 11). -author: dansimp -ms.prod: ie11 -ms.assetid: e5735074-3e9b-4a00-b1a7-b8fd8baca327 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: File types used or created by IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# File types used or created by IEAK 11 - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -A list of the file types used or created by tools in IEAK 11: - -|File type |Description | -|----------|-------------------------| -|.adm | An admin file (located at `:\Program Files\Windows IEAK 11\policies`), used by Group Policy to define the system policies and restrictions for Windows. You can use the IEAK 11 to change these settings. | -|.bat |An ASCII text file that contains a sequence of operating system commands, including the parameters and operators supported by the batch command language. When you run the batch file from a command prompt, the computer processes each command sequentially. | -|.bmp, .gif, .jpeg, and .jpg |Image files you can use to customize your toolbar button and favorites list icons. For info, see the [Customize the Toolbar button and Favorites List icons using IEAK 11](guidelines-toolbar-and-favorites-list-ieak11.md) page. | -|.cab |A compressed cabinet (.cab) file, created by the Internet Explorer Customization Wizard 11 to store your custom component files. We highly recommend that your .cab files be signed for security purposes. For more info, see the [Security features and IEAK 11](security-and-ieak11.md) page. | -|.cif |A component info file (IESetup.cif), identifying the new or updated components you're going to install with Internet Explorer. Each component file has an associated *ComponentID* that's used by Windows Update Setup to determine whether a new component or an update exists. | -|.cmp |Connection profile files that are created by the Connection Manager Administration Kit (CMAK). | -|.cms |Service provider files, created by the CMAK tool to specify the configuration of the phone book and many of the other functions of your service profiles. | -|.exe |Executable files that control the setup process, by installing the .cab files that install the custom browser package on your employee's devices. | -|.inf |Setup information files that provide installation instructions for your custom browser packages. For more info, see the [Use the uninstallation .INF files to uninstall custom components](create-uninstall-inf-files-for-custom-components.md) page. | -|.ins |Internet Settings files that specify how to configure your custom browser and its components. You can create multiple versions of your custom package by customizing copies of this file. For more info, see the [Using Internet Settings (.INS) files with IEAK 11](using-internet-settings-ins-files.md) page. | -|.pac |Proxy auto-configuration script files that determine whether to connect directly to a host or to use a proxy server. For more info, see the [Use the Automatic Configuration page in the IEAK 11 Wizard](auto-config-ieak11-wizard.md) page. | -|.js and .jvs |JScript and JavaScript files that let you configure and maintain your advanced proxy settings. For more info, see the [Use the Automatic Configuration page in the IEAK 11 Wizard](auto-config-ieak11-wizard.md) page. | -|.pvk |A file format used by some certification authorities to store the private key of the digital certificate. The public part of the digital certificate is stored in an SPC file, while the private part is stored in the PVK file. For more info, see the **Understanding certificates** section of the [Security features and IEAK 11](security-and-ieak11.md) page. | -|.sed |Connection profile files, created by the CMAK tool, including the instructions for building the self-extracting executable (.exe) file for your service profiles.

                  **Important**
                  You must never edit a .sed file. | -|.spc |The software publishing certificate file, which includes:

                  • The name and other identifying information of the owner of the certificate.
                  • The public key associated with the certificate.
                  • The serial number.
                  • The length of time the certificate is valid.
                  • The digital signature of the certification authority that issued the certificate.
                  | - diff --git a/browsers/internet-explorer/ie11-ieak/first-run-and-welcome-page-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/first-run-and-welcome-page-ieak11-wizard.md deleted file mode 100644 index 9d6fe74f8a..0000000000 --- a/browsers/internet-explorer/ie11-ieak/first-run-and-welcome-page-ieak11-wizard.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to use the First Run Wizard and Welcome Page Options page in the IEAK 11 Customization Wizard to set what your employee’s see the first time they log on to IE, based on their operating system. -author: dansimp -ms.prod: ie11 -ms.assetid: 85f856a6-b707-48a9-ba99-3a6e898276a9 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Use the First Run Wizard and Welcome Page Options page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the First Run Wizard and Welcome Page Options page in the IEAK 11 Wizard - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -The **First Run Wizard and Welcome Page Options** page of the Internet Explorer Customization Wizard 11 lets you decide what your employee’s see the first time they log on to IE, based on their operating system. - -- **Windows 8.1 Update and newer.** No longer includes a **Welcome** page, so if you pick the **Use Internet Explorer 11 Welcome Page** or the **Use a custom Welcome page** option, IEAK creates an initial **Home** page that loads before all other **Home** pages, as the first tab. This only applies to the Internet Explorer for the desktop. - -- **Windows 7 SP1.** You can disable the first run page for Windows 7 SP1 and then pick a custom **Welcome** page to show instead. If you don’t customize the settings on this page, your employees will see the default IE **Welcome** page. - -**To use the First Run Wizard and Welcome Page Options page** - -1. Check the **Use IE11 First Run wizard (recommended)** box to use the default First Run wizard in IE.

                  -Clearing this box lets you use the IE11 **Welcome** page or your custom **Welcome** page. - -2. If you cleared the First Run wizard box, you can decide which **Welcome** page to use: - - - **Use IE11 Welcome Page.** Check this box if you want to use the default IE11 **Welcome** page. - - - **Use a custom Welcome Page.** Check this box if you want to use a custom **Welcome** page. If you choose this option, you need to add the URL to your custom page. - -3. Click **Next** to go to the [Compatibility View](compat-view-ieak11-wizard.md) page or **Back** to go to the [Browsing Options](browsing-options-ieak11-wizard.md) page. - -  - -  - - - - - diff --git a/browsers/internet-explorer/ie11-ieak/guidelines-toolbar-and-favorites-list-ieak11.md b/browsers/internet-explorer/ie11-ieak/guidelines-toolbar-and-favorites-list-ieak11.md deleted file mode 100644 index e3d95badec..0000000000 --- a/browsers/internet-explorer/ie11-ieak/guidelines-toolbar-and-favorites-list-ieak11.md +++ /dev/null @@ -1,32 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: plan -description: Customization guidelines for your Internet Explorer toolbar button and Favorites List icons. -author: dansimp -ms.prod: ie11 -ms.assetid: bddc8f23-9ac1-449d-ad71-f77f43ae3b5c -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Customize the toolbar button and Favorites List icons using IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Customize the Toolbar button and Favorites List icons using IEAK 11 - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -Use these customization guidelines to change the browser toolbar button and the **Favorites List** icons, using your own branding and graphics. - -**Important**
                  Check your license agreement to make sure this customization is available. - -|Graphic |Type and description | -|-----------------------|----------------------------------------------------------------------| -|Browser toolbar button |2 icon (.ico) files with color images for active and inactive states. | -|Favorites List icons |1 icon (.ico) file for each new URL. | - -Your icons must use the .ico file extension, no other image file extension works. - diff --git a/browsers/internet-explorer/ie11-ieak/hardware-and-software-reqs-ieak11.md b/browsers/internet-explorer/ie11-ieak/hardware-and-software-reqs-ieak11.md deleted file mode 100644 index 2da43b7f38..0000000000 --- a/browsers/internet-explorer/ie11-ieak/hardware-and-software-reqs-ieak11.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: plan -description: List of supported hardware and software requirements for Internet Explorer 11 and the Internet Explorer Administration Kit 11. -author: dansimp -ms.prod: ie11 -ms.assetid: c50b86dc-7184-43d1-8daf-e750eb88dabb -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Hardware and software requirements for Internet Explorer 11 and the IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Hardware and software requirements for Internet Explorer 11 and the IEAK 11 - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -Before you can use the Internet Explorer Administration Kit 11 and the Internet Explorer Customization Wizard 11, you must first install Internet Explorer 11. For more info about installing IE11, see the [Determine the licensing version and features to use in IEAK 11](licensing-version-and-features-ieak11.md) page. - -## Hardware requirements -Before you start the Internet Explorer Customization Wizard 11, you must check to see how much disk space you have on the drive you're going to use to build the IE11 install package. This drive can be on the same device as the one running the wizard; it just needs to have a secure destination folder. - -Before you start to create your install package, you must meet all of the [Internet Explorer 11 requirements](../ie11-deploy-guide/system-requirements-and-language-support-for-ie11.md), plus: - -- Up to 100 megabytes (MB) of disk space, depending on how many components you include in the installation package. - -- An additional 100 MB of disk space for each custom installation package built. Different media types are considered separate packages. - -## Software requirements -The device you're going to use to build your install packages must be running Internet Explorer 11, on one of these operating systems: - -- Windows 10

                  However, you must use the Windows 8.1 target platform and only the "Configuration-only package" is available. - -- Windows 8.1 - -- Windows Server 2012 R2 - -- Windows® 7 Service Pack 1 (SP1) - -- Windows Server 2008 R2 (SP1) - -**Important**
                  -The device you're going to use to run IEAK 11 must be running the same version of the operating system as the device where you'll build your install packages. - -  - -  - - - - - diff --git a/browsers/internet-explorer/ie11-ieak/hidecustom-ins-file-setting.md b/browsers/internet-explorer/ie11-ieak/hidecustom-ins-file-setting.md deleted file mode 100644 index 6c46e306f3..0000000000 --- a/browsers/internet-explorer/ie11-ieak/hidecustom-ins-file-setting.md +++ /dev/null @@ -1,36 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: Use the \[HideCustom\] .INS file setting to decide whether to hide the GUID for each custom component. -author: dansimp -ms.prod: ie11 -ms.assetid: e673f7b1-c3aa-4072-92b0-20c6dc3d9277 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Use the HideCustom .INS file to hide the GUID for each custom component (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the HideCustom .INS file to hide the GUID for each custom component - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -Info about whether to hide the globally unique identifier (GUID) for each of your custom components. - -|Name |Value |Description | -|------|-------------------------------------------------------------------------------------|-----------------------------------------------| -|GUID |

                  • **0.** Component isn't hidden.
                  • **1.** Component is hidden.
                  |Determines whether this is a hidden component. | - - - - - - - - - - diff --git a/browsers/internet-explorer/ie11-ieak/ie-setup-command-line-options-and-return-codes.md b/browsers/internet-explorer/ie11-ieak/ie-setup-command-line-options-and-return-codes.md deleted file mode 100644 index c9d24160a9..0000000000 --- a/browsers/internet-explorer/ie11-ieak/ie-setup-command-line-options-and-return-codes.md +++ /dev/null @@ -1,72 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: Reference about the command-line options and return codes for Internet Explorer Setup. -author: dansimp -ms.prod: ie11 -ms.assetid: 40c23024-cb5d-4902-ad1b-6e8a189a699f -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Internet Explorer Setup command-line options and return codes (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Internet Explorer Setup command-line options and return codes - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -You can use command-line options along with a tool like IExpress to package your custom version of Internet Explorer and to perform a batch installation across your organization. - -## IE Setup command-line options -These command-line options work with IE Setup: - -`[/help] [/passive | /quiet] [/update-no] [/no-default] [/nobackup] [/ieak-full: | /ieak-branding: ] [/norestart | /forcerestart] [/log: ` - -|Parameter (Setup modes) |Description | -|------------------------|-------------------------------------------------------------------------------------------------| -|`/passive` |Runs the install without requiring input from the employee, showing progress and error messages. | -|`/quiet` |Identical to `/passive`, but doesn't show any of the progress or error messages to the employee. | -

                  - -|Parameter (Setup options) |Description | -|--------------------------|-------------------------------------------------------------------------------------------------| -|`/update-no` |Doesn't look for Internet Explorer updates. | -|`/no-default` |Doesn't make Internet Explorer the default browser. | -|`/no-backup` |Doesn't back up the files necessary to uninstall IE. | -|`/ieak-full` |Reserved for use by the IEAK 11. | -|`/ieak-branding` |Reserved for use by the IEAK 11. | -

                  - -|Parameter (Restart options) |Description | -|----------------------------|--------------------------------------------| -|`/norestart` |Doesn't restart after installation. | -|`/forcerestart` |Restarts after installation. | -

                  - -|Parameter (miscellaneous options) |Description | -|----------------------------------|--------------------------------------------| -|`/help` |Provides help info. Can't be used with any other option. | -|`/log ` |Creates a log file about the installation process, at the specified location. | - - -## Windows Setup return and status codes -Windows Setup needs to tell you whether IE successfully installed. However, because IE11wzd.exe is packaged inside your IE11setup.exe file, the return codes can’t be sent directly back to you. Instead, Setup needs to return the information (both success and failure) to the `HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\InstallInfo` registry branch. - -|Subkey |Data type |Value | -|---------|----------|---------------------------------------| -|Complete |String |0 = Success | -|Complete |String |0x80100003 = Files are missing for the requested installation. | -|Complete |String |0x80100001 = Setup partially succeeded. One or more components weren’t downloaded or installed. Check the **FailedComponents** subkey for the list of components. | -|Complete |String |0x80100002 = Setup partially succeeded, but the employee cancelled Setup. One or more components weren’t downloaded or installed. Check the **FailedComponents** subkey for the list of components. | -|FailedComponents |MultiSZ |``Null``Component1 | -|InstallStatus |Binary |0 = Install completed successfully. | -|InstallStatus |Binary |1 = Suspend Setup.
                  The employee cancelled Setup and is then asked to confirm:

                  • 2 = No, don’t cancel. Resume Setup.
                  • 3 = Yes, cancel confirmed. Quit Setup as soon as possible.

                  **Important**
                  If the cancellation is confirmed, Setup will quit as soon as all of the in-progress tasks are done, like copying or extracting files. | - -## Related topics -- [IExpress Wizard for Windows Server 2008 R2 with SP1](iexpress-wizard-for-win-server.md) -- [Express Wizard command-line options](iexpress-command-line-options.md) - diff --git a/browsers/internet-explorer/ie11-ieak/ieak-information-and-downloads.md b/browsers/internet-explorer/ie11-ieak/ieak-information-and-downloads.md deleted file mode 100644 index 8a02248b90..0000000000 --- a/browsers/internet-explorer/ie11-ieak/ieak-information-and-downloads.md +++ /dev/null @@ -1,96 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: support -ms.pagetype: security -description: The Internet Explorer Administration Kit (IEAK) simplifies the creation, deployment, and management of customized Internet Explorer packages. Use the IEAK to configure the out-of-box Internet Explorer experience or to manage user settings after Internet Explorer deployment. -author: dansimp -ms.author: dansimp -ms.manager: dougkim -ms.prod: ie11 -ms.assetid: -ms.reviewer: -audience: itpro -manager: dansimp -title: Internet Explorer Administration Kit (IEAK) information and downloads -ms.sitesec: library -ms.date: 05/10/2018 ---- - -# Internet Explorer Administration Kit (IEAK) information and downloads - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - - ->Applies to: Windows 10 - -The Internet Explorer Administration Kit (IEAK) simplifies the creation, deployment, and management of customized Internet Explorer packages. You can use the IEAK to configure the out-of-box Internet Explorer experience or to manage user settings after Internet Explorer deployment. To find more information on the IEAK, see [What IEAK can do for you](what-ieak-can-do-for-you.md). - - -## Internet Explorer Administration Kit 11 (IEAK 11) - -[IEAK 11 documentation](index.md) - -[IEAK 11 licensing guidelines](licensing-version-and-features-ieak11.md) - -[IEAK 11 - Frequently Asked Questions](../ie11-faq/faq-ieak11.yml) - -[Internet Explorer Administration Kit 11 (IEAK 11) - Administrator's Guide](before-you-create-custom-pkgs-ieak11.md) - -## Download IEAK - -To download, choose to **Open** the download or **Save** it to your hard drive first. - -:::row::: - :::column span=""::: - [English](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/en-us/ieak.msi) - - [Arabic](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ar-sa/ieak.msi) - - [Chinese (Simplified)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/zh-cn/ieak.msi) - - [Chinese (Traditional)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/zh-tw/ieak.msi) - - [Czech](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/cs-cz/ieak.msi) - - [Danish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/da-dk/ieak.msi) - - [Dutch](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/nl-nl/ieak.msi) - - [Finnish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/fi-fi/ieak.msi) -:::column-end::: - :::column span=""::: - [French](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/fr-fr/ieak.msi) - - [German](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/de-de/ieak.msi) - - [Greek](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/el-gr/ieak.msi) - - [Hebrew](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/he-il/ieak.msi) - - [Hungarian](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/hu-hu/ieak.msi) - - [Italian](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/it-it/ieak.msi) - - [Japanese](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ja-jp/ieak.msi) - - [Korean](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ko-kr/ieak.msi) -:::column-end::: - :::column span=""::: - [Norwegian (Bokmål)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/nb-no/ieak.msi) - - [Polish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/pl-pl/ieak.msi) - - [Portuguese (Brazil)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/pt-br/ieak.msi) - - [Portuguese (Portugal)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/pt-pt/ieak.msi) - - [Russian](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ru-ru/ieak.msi) - - [Spanish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/es-es/ieak.msi) - - [Swedish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/sv-se/ieak.msi) - - [Turkish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/tr-tr/ieak.msi) -:::column-end::: -:::row-end::: - diff --git a/browsers/internet-explorer/ie11-ieak/ieak11-wizard-custom-options.md b/browsers/internet-explorer/ie11-ieak/ieak11-wizard-custom-options.md deleted file mode 100644 index 0aa9964807..0000000000 --- a/browsers/internet-explorer/ie11-ieak/ieak11-wizard-custom-options.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: plan -description: Review the options available to help you customize your browser install packages for deployment to your employee's devices. -author: dansimp -ms.prod: ie11 -ms.assetid: 4b804da3-c3ac-4b60-ab1c-99536ff6e31b -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Internet Explorer Administration Kit 11 (IEAK 11) Customization Wizard options (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Internet Explorer Administration Kit 11 (IEAK 11) Customization Wizard options - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -Use the Internet Explorer Administration Kit 11 (IEAK 11) and the Internet Explorer Customization Wizard 11 to customize your browser install packages for deployment to your employee's devices. - -## IE Customization Wizard 11 options -IEAK 11 lets you customize a lot of Internet Explorer 11, including the IE and Internet Explorer for the desktop experiences. For more info about the experiences, see [Internet Explorer 11 (IE11) - Deployment Guide for IT Pros](../ie11-deploy-guide/index.md). For info about which pages appear in the **Internal** or **External** version of IE Customization Wizard 11, see [Determine the licensing version and features to use in IEAK 11](licensing-version-and-features-ieak11.md). - -|Internet Explorer Customization Wizard 11 page |Browser experience |Description | -|-----------------------------------------------|------------------------------------|-----------------------------| -|[Custom Components](custom-components-ieak11-wizard.md) |Internet Explorer for the desktop |Add up to 10 additional components that your employees can install at the same time they install IE. | -|[Internal install](internal-install-ieak11-wizard.md) |Internet Explorer for the desktop |Choose to set IE11 as the default browser.

                  **Note**
                  This only applies to IE11 on Windows 7 SP1 | -|[User Experience](user-experience-ieak11-wizard.md) |Internet Explorer for the desktop |Control the installation and restart experience for your employees.

                  This only applies to IE11 on Windows 7 SP1 | -|[Browser user interface](browser-ui-ieak11-wizard.md) |Internet Explorer for the desktop |Customize your title bars and toolbar buttons. | -|[Search Providers](search-providers-ieak11-wizard.md) |Both |Import and add Search providers. | -|[Important URLs – Home page and Support](important-urls-home-page-and-support-ieak11-wizard.md) |The **Support** page is supported by both experiences. The **Home** page is only supported on Internet Explorer for the desktop. |Add URLs for your **Home** and **Support** pages. | -|[Accelerators](accelerators-ieak11-wizard.md) |Internet Explorer for the desktop |Import and add default accelerators. | -|[Favorites, Favorites Bar and Feeds](favorites-favoritesbar-and-feeds-ieak11-wizard.md) |Internet Explorer for the desktop |Import and add items to the **Favorites** folder, the **Favorites Bar**, and the **Feeds** folder.

                  **Note**
                  You can turn off the entire **Suggested Sites** feature from this page. | -|[Browsing Options](browsing-options-ieak11-wizard.md) |Doesn't apply. The choices that you make on this page affect only the items shown on the **Favorites, Favorites Bar, and Feeds** page. |Choose how to manage items in the **Favorites** folder, the **Favorites Bar**, and the **Feeds** folder. You can also turn off the Microsoft-default Favorites, Web slices, links, feeds, and accelerators. | -|[First Run Wizard and Welcome Page Options](first-run-and-welcome-page-ieak11-wizard.md) |Internet Explorer for the desktop |Decide if the First Run wizard appears the first time an employee starts IE. You can also use the IE11 **Welcome** page, or link to a custom **Welcome** page. | -|[Compatibility View](compat-view-ieak11-wizard.md) |No longer supported |This functionality has been removed for IE11. For more information, see [Missing the Compatibility View Button](../ie11-deploy-guide/missing-the-compatibility-view-button.md). | -|[Connection Manager](connection-mgr-ieak11-wizard.md) |No longer supported |This functionality has been removed for IE11. | -|[Connection Settings](connection-settings-ieak11-wizard.md) |Both |Choose whether to customize your connection settings. You can also choose to delete old dial-up connection settings. | -|[Automatic Configuration](auto-config-ieak11-wizard.md) |Both |Choose whether to automatically detect configuration settings and whether to turn on and customize automatic configuration. | -|[Proxy Settings](proxy-settings-ieak11-wizard.md) |Both |Turn on and set up your proxy servers.

                  **Note**
                  We don't support Gopher Server anymore. | -|[Add a Root Certification](add-root-certificate-ieak11-wizard.md) |No longer supported |This functionality has been removed for IE11. | -|[Security and Privacy Settings](security-and-privacy-settings-ieak11-wizard.md) |The **Security Zones and Privacy** settings are supported by both experiences. The **Content Ratings** are only supported on Internet Explorer for the desktop. |Decide if you want to:

                  • Customize your security zones and privacy settings
                  • -OR-

                  • Import your current security zones and privacy settings
                  • -AND-

                  • Customize your content ratings settings
                  • -OR-

                  • Import your current content ratings settings
                  | -|[Programs](programs-ieak11-wizard.md) |Internet Explorer for the desktop |Decide your default programs or import your current settings. | -|[Additional Settings](additional-settings-ieak11-wizard.md) |Both |Decide how to set up multiple IE settings that appear in the **Internet Options** box. | - diff --git a/browsers/internet-explorer/ie11-ieak/iexpress-command-line-options.md b/browsers/internet-explorer/ie11-ieak/iexpress-command-line-options.md deleted file mode 100644 index 391784b8a4..0000000000 --- a/browsers/internet-explorer/ie11-ieak/iexpress-command-line-options.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: Reference about the command-line options for the IExpress Wizard. -author: dansimp -ms.prod: ie11 -ms.assetid: aa16d738-1067-403c-88b3-bada12cf9752 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: IExpress Wizard command-line options (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - -# IExpress Wizard command-line options - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - - -**Applies to:** -- Windows Server 2008 R2 with SP1 - -Use command-line options with the IExpress Wizard (IExpress.exe) to control your Internet Explorer custom browser package extraction process. - -These command-line options work with IExpress:
                  -`Ie11setup /c:"ie11wzd "` - -|Parameter |Action | -|----------|--------------------------------------------------------------------------------------------| -|`/q` |Specifies quiet mode, hiding all of the prompts, while files are being extracted. This option won’t suppress prompts during Setup. | -|`/q:u` |Specifies user-quiet mode, letting some of the progress and error messages appear to the employee. | -|`/q:a` |Specifies administrator-quiet mode, hiding all of the progress and error messages from the employee. | -|`/t:` |Specifies where to store your extracted files. | -|`/c:` |Extracts all of the files without installing them. If `t:/` isn’t used, you’ll be prompted for a storage folder. | -|`/c:` |Specifies the UNC path and name of the Setup .inf or .exe file. | -|`/r:n` |Never restarts the computer after installation. | -|`/r:a` |Always restarts the computer after installation. | -|`/r:s` |Restarts the computer after installation without prompting the employee. | - -## Related topics -- [IExpress Wizard for Windows Server 2008 R2 with SP1](iexpress-wizard-for-win-server.md) -- [Internet Explorer Setup command-line options and return codes](ie-setup-command-line-options-and-return-codes.md) - diff --git a/browsers/internet-explorer/ie11-ieak/iexpress-wizard-for-win-server.md b/browsers/internet-explorer/ie11-ieak/iexpress-wizard-for-win-server.md deleted file mode 100644 index fe4bb3a985..0000000000 --- a/browsers/internet-explorer/ie11-ieak/iexpress-wizard-for-win-server.md +++ /dev/null @@ -1,76 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: Use the IExpress Wizard on Windows Server 2008 R2 with SP1 to create self-extracting files to run your custom Internet Explorer Setup program. -author: dansimp -ms.prod: ie11 -ms.assetid: 5100886d-ec88-4c1c-8cd7-be00da874c57 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: IExpress Wizard for Windows Server 2008 R2 with SP1 (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# IExpress Wizard for Windows Server 2008 R2 with SP1 - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -Use the IExpress Wizard and its associated command-line options to create self-extracting files that automatically run your custom Internet Explorer Setup (.inf or .exe file) program that’s contained inside. - -## IExpress Wizard location -The IExpress Wizard (Iexpress.exe) is included as part of Windows Server 2008 R2 with Service Pack 1 (SP1), in the `:\Windows\System32` folder. The wizard uses a self-extraction directive (.sed) file to store your package’s information. When you run the wizard, you have the option to start with an existing .sed file or to create a new one. - -## IExpress Wizard features -The IExpress Wizard: - -- Performs silent, unattended installations of your custom IE packages. - -- Supports upgrading IE without removing previous installations. - -- Supports repeated updating or performing clean installations of the same IE build. - -## IExpress Wizard settings -The IExpress Wizard lets you: - -- Decide whether the self-installing package is for administrators or for general employees. - -- Set multiple ways to run the installation command, such as in normal or silent mode. - -- Determine whether the IExpress dynamic-link libraries (.dll files) are updated on an employee’s computer. - -- Determine the compatibility of the installation package, based on the operating system version range, the browser version range, or any application version range. - -- Update and add files to the IExpress package, using the UPDFILE tool, without having to rebuild the package. - -- Replace Runonce with RunOnceEx (if the newer version of Iernonce.dll exists); giving you control over the job run order and status display. - -- Let corporate administrators set up support for roaming employees. - -- Let Internet Content Providers (ICPs) and Internet Service Providers (ISPs) generate packages for preconfigured desktops with custom, current content. - -- Save disk space by cleaning up the hard drive when running in Setup, uninstallation, and maintenance modes. - -- Provide support for multiple download sites. - -- Provide support for internal and external development, customization, expandability, and enhanced debugging. - -- Provide support for the extended character set, beyond single-byte characters (SBCS). - -- Provide support for using the .inf file format to download Internet components. For more information, see [Use the uninstallation .INF files to uninstall custom components](create-uninstall-inf-files-for-custom-components.md). - -## Related topics -- [IExpress command-line options](iexpress-command-line-options.md) -- [Internet Explorer Setup command-line options and return codes](ie-setup-command-line-options-and-return-codes.md) - -  - -  - - - - - diff --git a/browsers/internet-explorer/ie11-ieak/images/wedge.gif b/browsers/internet-explorer/ie11-ieak/images/wedge.gif deleted file mode 100644 index aa3490aee9..0000000000 Binary files a/browsers/internet-explorer/ie11-ieak/images/wedge.gif and /dev/null differ diff --git a/browsers/internet-explorer/ie11-ieak/important-urls-home-page-and-support-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/important-urls-home-page-and-support-ieak11-wizard.md deleted file mode 100644 index b32b5bacab..0000000000 --- a/browsers/internet-explorer/ie11-ieak/important-urls-home-page-and-support-ieak11-wizard.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to use the Important URLs - Home Page and Support page in the IEAK 11 Customization Wizard to choose one or more **Home** pages and an online support page for your customized version of IE. -author: dansimp -ms.prod: ie11 -ms.assetid: 19e34879-ba9d-41bf-806a-3b9b9b752fc1 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Use the Important URLs - Home Page and Support page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the Important URLs - Home Page and Support page in the IEAK 11 Wizard - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -The **Important URLS – Home Page and Support** page of the Internet Explorer Customization Wizard 11 lets you choose one or more **Home** pages and an online support page for your customized version of IE. - -**To use the Important URLS – Home Page and Support page** - -1. In the **Add a homepage URL** box, type the URL to the page your employees go to when they click the **Home** button, and then click **Add**.

                  -If you add multiple **Home** pages, each page appears on a separate tab in the browser. If you don’t add a custom **Home** page, IE uses https://www.msn.com by default. If you want to delete an existing page, click the URL and then click **Remove**. - -2. Check the **Retain previous Home Page (Upgrade)** box if you have employees with previous versions of IE, who need to keep their **Home** page settings when the browser is updated. - -3. Check the **Online support page URL** box to type in the URL to your own support page. Customizing the support page is only supported in Internet Explorer for the desktop. - -4. Click **Next** to go to the [Accelerators](accelerators-ieak11-wizard.md) page or **Back** to go to the [Search Providers](search-providers-ieak11-wizard.md) page. - - -  - -  - - - - - diff --git a/browsers/internet-explorer/ie11-ieak/index.md b/browsers/internet-explorer/ie11-ieak/index.md deleted file mode 100644 index d4dde73e8c..0000000000 --- a/browsers/internet-explorer/ie11-ieak/index.md +++ /dev/null @@ -1,53 +0,0 @@ ---- -ms.mktglfcycl: plan -description: IEAK 11 - Internet Explorer Administration Kit 11 Users Guide -author: dansimp -ms.author: dansimp -ms.prod: ie11 -ms.assetid: 847bd7b4-d5dd-4e10-87b5-4d7d3a99bbac -title: Internet Explorer Administration Kit 11 (IEAK 11) - Administrator's Guide (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.localizationpriority: medium -manager: dansimp -ms.date: 03/15/2016 ---- - - -# Internet Explorer Administration Kit 11 (IEAK 11) - Administrator's Guide - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - - -The Internet Explorer Administration Kit (IEAK) simplifies the creation, deployment, and management of customized Internet Explorer packages. You can use the IEAK to configure the out-of-box Internet Explorer experience or to manage user settings after Internet Explorer deployment. - -Use this guide to learn about the several options and processes you'll need to consider while you're using the Internet Explorer Administration Kit 11 (IEAK 11) to customize, deploy, and manage Internet Explorer 11 for your employee's devices. - -> [!IMPORTANT] -> Because this content isn't intended to be a step-by-step guide, not all of the steps are necessary. - - -## Included technology -IEAK 11 includes the following technology: -- **Internet Explorer Customization Wizard.** This wizard guides you through the process of creating custom browser packages. After these packages are installed on your user's desktop, the user receives customized versions of Internet Explorer 11, with the settings and options you selected through the wizard. -- **Windows Installer (MSI).** IEAK 11 supports creating an MSI wrapper for your custom Internet Explorer 11 packages, enabling you to use Active Directory to deploy the package to your user's PC. -- **IEAK Help.** IEAK 11 Help includes many conceptual and procedural topics, which you can view from the **Index**, **Contents**, or **Search** tabs. You also have the option to print any topic, or the entire Help library. - - -## Naming conventions -IE11 and IEAK 11 offers differing experiences between Windows 7 and Windows 8.1 Update and newer versions of the Windows operating system: - -|Name |Description | -|-----|-----------------------------------------------------------| -|IE |The immersive browser, or IE, without a specific version. | -|Internet Explorer for the desktop |The desktop browser. This is the only experience available when running IE11 on Windows 7 SP1. | -|IE11 |The whole browser, which includes both IE and Internet Explorer for the desktop. | -|Internet Explorer Customization Wizard 11 |Step-by-step wizard screens that help you create custom IE11 installation packages. | - -## Related topics -- [IEAK 11 - Frequently Asked Questions](../ie11-faq/faq-ieak11.yml) -- [Download IEAK 11](ieak-information-and-downloads.md) -- [IEAK 11 administrators guide]() -- [IEAK 11 licensing guidelines](licensing-version-and-features-ieak11.md) -- [Internet Explorer 11 - FAQ for IT Pros](../ie11-faq/faq-for-it-pros-ie11.yml) -- [Internet Explorer 11 (IE11) - Deployment Guide for IT Pros](../ie11-deploy-guide/index.md) -- [Microsoft Edge - Deployment Guide for IT Pros](/microsoft-edge/deploy/) diff --git a/browsers/internet-explorer/ie11-ieak/internal-install-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/internal-install-ieak11-wizard.md deleted file mode 100644 index 6936f198d0..0000000000 --- a/browsers/internet-explorer/ie11-ieak/internal-install-ieak11-wizard.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to use the Internal Install page in the IEAK 11 Customization Wizard to customize Setup for the default browser and the latest browser updates. -author: dansimp -ms.prod: ie11 -ms.assetid: 33d078e3-75b8-455b-9126-f0d272ed676f -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Use the Internal Install page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the Internal Install page in the IEAK 11 Wizard - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -The **Internal Install** page of the Internet Explorer Customization Wizard 11 lets you customize Setup for the default browser and the latest browser updates, based on your company’s guidelines. - -**Note**
                  The customizations made on this page only apply to Internet Explorer for the desktop on Windows 7. - -**To use the Internal Install page** - -1. Pick either: - - - **Allow user to choose.** Lets your employees pick their own default browser.

                  -OR-

                  - - - **Do not set IE as the default browser.** Won’t set IE as the default browser. However, your employees can still make IE the default. - -2. Click **Next** to go to the [User Experience](user-experience-ieak11-wizard.md) page or **Back** to go to the [Custom Components](custom-components-ieak11-wizard.md). - -  - -  - - - - - diff --git a/browsers/internet-explorer/ie11-ieak/isp-security-ins-file-setting.md b/browsers/internet-explorer/ie11-ieak/isp-security-ins-file-setting.md deleted file mode 100644 index 666c5f8b17..0000000000 --- a/browsers/internet-explorer/ie11-ieak/isp-security-ins-file-setting.md +++ /dev/null @@ -1,27 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: Use the \[ISP_Security\] .INS file setting to add the root certificate for your custom Internet Explorer package. -author: dansimp -ms.prod: ie11 -ms.assetid: 4eca2de5-7071-45a2-9c99-75115be00d06 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Use the ISP_Security .INS file to add your root certificate (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the ISP_Security .INS file to add your root certificate - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -Info about where you store the root certificate you’re adding to your custom package. - -|Name |Value |Description | -|---------------|-----------------------|------------------------------------------------------------------------------------------| -|RootCertPath |`` |Location and name of the root certificate you want to add to your custom install package. | - diff --git a/browsers/internet-explorer/ie11-ieak/language-selection-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/language-selection-ieak11-wizard.md deleted file mode 100644 index a343a30e51..0000000000 --- a/browsers/internet-explorer/ie11-ieak/language-selection-ieak11-wizard.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to use the Language Selection page in the IEAK 11 Customization Wizard to choose the language for your IEAK 11 custom package. -author: dansimp -ms.prod: ie11 -ms.assetid: f9d4ab57-9b1d-4cbc-9398-63f4938df1f6 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Use the Language Selection page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the Language Selection page in the IEAK 11 Wizard - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -The **Language Selection** page of the Internet Explorer Customization Wizard 11 lets you choose the language for your Internet Explorer Administration Kit 11 (IEAK 11) custom package. You can create custom Internet Explorer 11 packages in any of the languages your operating system version is available in. - -**Important**
                  Make sure that the language of your IEAK 11 installation matches the language of your custom IE11 package. If the languages don’t match, IEAK 11 won’t work properly. - -**To use the Language Selection page** - -1. Pick the language you want your custom IE11 installation package to use.

                  -You can support as many languages as you want, but each localized version must be in its own install package.

                  -**Note**
                  To keep your settings across multiple versions of the package, you can pick the same destination folder for all versions. The different language versions are then saved in separate subfolders within that destination folder. Like, for an English version, `C:\Cie\Build1\Flat\Win32_WIN8\en-US\` and for a German version, `C:\Cie\Build1\Flat\Win32_WIN8\de-DE\`. - -2. Click **Next** to go to the [Package Type Selection](pkg-type-selection-ieak11-wizard.md) page or **Back** to go to the [Platform Selection](platform-selection-ieak11-wizard.md) page. - -  - -  - - - - - diff --git a/browsers/internet-explorer/ie11-ieak/licensing-version-and-features-ieak11.md b/browsers/internet-explorer/ie11-ieak/licensing-version-and-features-ieak11.md deleted file mode 100644 index 9eba34b5e1..0000000000 --- a/browsers/internet-explorer/ie11-ieak/licensing-version-and-features-ieak11.md +++ /dev/null @@ -1,110 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: plan -description: Learn about the version of the IEAK 11 you should run, based on your license agreement. -author: dansimp -ms.author: dansimp -ms.prod: ie11 -ms.assetid: 69d25451-08af-4db0-9daa-44ab272acc15 -ms.reviewer: -audience: itpro -manager: dansimp -title: Determine the licensing version and features to use in IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 10/23/2018 ---- - - -# Determine the licensing version and features to use in IEAK 11 - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -In addition to the Software License Terms for the Internet Explorer Administration Kit 11 (IEAK 11, referred to as the "software"), these Guidelines further define how you may and may not use the software to create versions of Internet Explorer 11 with optional customizations (referred to as the "customized browser") for internal use and distribution in accordance with the IEAK 11 Software License Terms. IEAK 11 is for testing purposes only and is not intended to be used in a production environment. - -During installation, you must pick a version of IEAK 11, either **External** or **Internal**, based on your license agreement. Your version selection decides the options you can chose, the steps you follow to deploy your Internet Explorer 11 package, and how you manage the browser after deployment. - -- **External Distribution as an Internet Service Provider (ISP), Internet Content Provider (ICP), or Developer.** If you are an ISP or an ICP, your license agreement also states that you must show the Internet Explorer logo on your packaging and promotional goods, as well as on your website. - > [!IMPORTANT] - > Original Equipment Manufacturers (OEMs) that install IEAK 11 as part of a Windows product, under an OEM license agreement with Microsoft, must use their appropriate Windows OEM Preinstallation document (OPD) as the guide for allowable customizations. - -- **Internal Distribution via a Corporate Intranet.** This version is for network admins that plan to directly deploy IE11 into a corporate environment. - -## Available features by version - -| Feature | Internal | External | -|-------------------------------------------|:--------------------------------------------------------------------------------:|:------------------------------------------------------------------------------------:| -| Welcome screen | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| File locations | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| Platform selection | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| Language selection | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| Package type selection | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| Feature selection | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| Automatic Version Synchronization (AVS) | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| Custom components | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| Internal install | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Not available](/microsoft-edge/deploy/images/148766.png) | -| User experience | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Not available](/microsoft-edge/deploy/images/148766.png) | -| Browser user interface | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| Search providers | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| Important URLs – Home page and support | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| Accelerators | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| Favorites, Favorites bar, and feeds | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| Browsing options | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Not available](/microsoft-edge/deploy/images/148766.png) | -| First Run wizard and Welcome page options | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| Connection manager | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| Connection settings | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| Automatic configuration | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Not available](/microsoft-edge/deploy/images/148766.png) | -| Proxy settings | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| Security and privacy settings | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Not available](/microsoft-edge/deploy/images/148766.png) | -| Add a root certificate | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Not available](/microsoft-edge/deploy/images/148766.png) | -| Programs | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| Additional settings | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Not available](/microsoft-edge/deploy/images/148766.png) | -| Wizard complete | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | - ---- - - -## Customization guidelines - -Two installation modes are available to you, depending on how you are planning to use the customized browser created with the software. Each mode requires a separate installation of the software. - -- **External Distribution** - This mode is available to anyone who wants to create a customized browser for distribution outside their company (for example, websites, magazines, retailers, non-profit organizations, independent hardware vendors, independent software vendors, Internet service providers, Internet content providers, software developers, and marketers). - -- **Internal Distribution** - This mode is available to companies for the creation and distribution of a customized browser only to their employees over a corporate intranet. - -The table below identifies which customizations you may or may not perform based on the mode you selected. - -| **Feature Name** | **External Distribution** | **Internal Distribution** | -|---------------------------------|:--------------------:|:-------------------:| -| **Custom Components** | Yes | Yes | -| **Title Bar** | Yes | Yes | -| **Favorites** | One folder, containing any number of links. | Any number of folders/links. | -| **Search Provider URLs** | Yes | Yes | -| **Search Guide URL** | No | Yes | -| **Online Support URL** | Yes | Yes | -| **Web Slice** | Suggested maximum five Web Slices. | Any number of Web Slices. | -| **Accelerator** | Search provider Accelerator must be the same as the search provider set for the Search Toolbox. We recommend that Any number of Accelerators/Accelerator Categories. Feature Name External Internal Accelerator category not exceed seven total categories, and each Accelerator category must be unique. We recommend each Accelerator category not have more than two Accelerators. The Accelerator display name should follow the syntax of verb + noun, such as "Map with Bing." | Any number of Accelerators/Accelerator Categories. | -| **Homepage URLs** | Can add a maximum of three. | Unlimited. | -| **First Run Wizard and Welcome Page Options** | Cannot remove Internet Explorer 11 First Run wizard. Can customize **Welcome** page. | Customizable. | -| **RSS Feeds** | One folder, containing any number of links. | Any number of folders/links. | -| **Browsing Options** | No | Yes | -| **Security and Privacy Settings** | No | Can add any number of sites. | -| **Corporate Options** (Latest Updates, Default Browser, Uninstall Info, Additional Settings) | No | Yes | -| **User Experience** (Setup/Restart) | No | Yes | -| **User Agent String** | Yes | Yes | -| **Compatibility View** | Yes | Yes | -| **Connection Settings and Manage** | Yes | Yes | - - -Support for some of the Internet Explorer settings on the wizard pages varies depending on your target operating system. For more information, see [Internet Explorer Customization Wizard 11 options](./ieak11-wizard-custom-options.md). - -## Distribution guidelines - -Two installation modes are available to you, depending on how you are planning to use the customized browser created with the software. Each mode requires a separate installation of the software. - -- **External Distribution** - You shall use commercially reasonable efforts to maintain the quality of (i) any non-Microsoft software distributed with Internet Explorer 11, and (ii) any media used for distribution (for example, optical media, flash drives), at a level that meets or exceeds the highest industry standards. If you distribute add-ons with Internet Explorer 11, those add-ons must comply with the [Microsoft browser extension policy](/legal/microsoft-edge/microsoft-browser-extension-policy). - -- **Internal Distribution - corporate intranet** - The software is solely for use by your employees within your company's organization and affiliated companies through your corporate intranet. Neither you nor any of your employees may permit redistribution of the software to or for use by third parties other than for third parties such as consultants, contractors, and temporary staff accessing your corporate intranet. \ No newline at end of file diff --git a/browsers/internet-explorer/ie11-ieak/media-ins-file-setting.md b/browsers/internet-explorer/ie11-ieak/media-ins-file-setting.md deleted file mode 100644 index f628def610..0000000000 --- a/browsers/internet-explorer/ie11-ieak/media-ins-file-setting.md +++ /dev/null @@ -1,27 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: Use the \[Media\] .INS file setting to specify the types of media on which your custom install package is available. -author: dansimp -ms.prod: ie11 -ms.assetid: c57bae60-d520-49a9-a77d-da43f7ebe5b8 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Use the Media .INS file to specify your install media (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the Media .INS file to specify your install media - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -The types of media on which your custom install package is available. - -|Name |Value |Description | -|-----|------|-----------------| -|Build_LAN |

                  • **0.** Don’t create the LAN-based installation package.
                  • **1.** Create the LAN-based installation package.
                  |Determines whether you want to create a LAN-based installation package. | - diff --git a/browsers/internet-explorer/ie11-ieak/pkg-type-selection-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/pkg-type-selection-ieak11-wizard.md deleted file mode 100644 index ae7b3c6150..0000000000 --- a/browsers/internet-explorer/ie11-ieak/pkg-type-selection-ieak11-wizard.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to use the Package Type Selection page in the IEAK 11 Customization Wizard to pick the media type you’ll use to distribute your custom package. -author: dansimp -ms.prod: ie11 -ms.assetid: dd91f788-d05e-4f45-9fd5-d951abf04f2c -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Use the Package Type Selection page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the Package Type Selection page in the IEAK 11 Wizard - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -The **Package Type Selection** page of the Internet Explorer Customization Wizard 11 lets you pick which type of media you’ll use to distribute your custom installation package. You can pick more than one type, if you need it. - -**Important**
                  You can't create a full installation package for deployment to Windows 10 computers. That option only works for computers running Windows 7 or Windows 8.1. - -**To use the File Locations page** - -1. Check the **Full Installation Package** box if you’re going to build your package on, or move your package to, a local area network (LAN). This media package includes the Internet Explorer 11 installation files, and is named **IE11-Setup-Full.exe**, in the `\\FLAT\\` folder.

                  -OR-

                    - -2. Check the **Configuration-only package** box if you want to update an existing installation of IE11. This media package is named **IE11- Setup-Branding.exe**, in the `\\BrndOnly\\` folder.

                  -You can distribute this file on any media format or server. It customizes the IE11 features without re-installing IE.

                  -**Important**
                  You can’t include custom components in a configuration-only package. - -3. Click **Next** to go to the [Feature Selection](feature-selection-ieak11-wizard.md) page or **Back** to go to the [Language Selection](language-selection-ieak11-wizard.md) page. - -  - -  - - - - - diff --git a/browsers/internet-explorer/ie11-ieak/platform-selection-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/platform-selection-ieak11-wizard.md deleted file mode 100644 index 67d9caac65..0000000000 --- a/browsers/internet-explorer/ie11-ieak/platform-selection-ieak11-wizard.md +++ /dev/null @@ -1,38 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to use the Platform Selection page in the IEAK 11 Customization Wizard to pick the specs for your employee devices that will get the install package. -author: dansimp -ms.prod: ie11 -ms.assetid: 9cbf5abd-86f7-42b6-9810-0b606bbe8218 -ms.reviewer: -manager: dansimp -ms.author: dansimp -title: Use the Platform Selection page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the Platform Selection page in the IEAK 11 Wizard - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -The **Platform Selection** page of the Internet Explorer Customization Wizard 11 lets you pick the operating system and architecture (32-bit or 64-bit) for the devices on which you’re going to install the custom installation package. - -**To use the Platform Selection page** - -1. Pick the operating system and architecture for the devices on which you’re going to install the custom package.

                  -You must create individual packages for each supported operating system.

                  -**Note**
                  To keep your settings across several operating system packages, you can specify the same destination folder. Then, after running the wizard, you can reuse the resulting .ins file. Any additional changes to the .ins file are saved. For more info about using .ins files, see [Using Internet Settings (.INS) files with IEAK 11](using-internet-settings-ins-files.md). For more info about adding in your .ins file, see [Use the File Locations page in the IEAK 11 Wizard](file-locations-ieak11-wizard.md). - -2. Click **Next** to go to the [Language Selection](language-selection-ieak11-wizard.md) page or **Back** to go to the [File Locations](file-locations-ieak11-wizard.md) page. - -  - -  - - - - - diff --git a/browsers/internet-explorer/ie11-ieak/prep-network-install-with-ieak11.md b/browsers/internet-explorer/ie11-ieak/prep-network-install-with-ieak11.md deleted file mode 100644 index 4720c446af..0000000000 --- a/browsers/internet-explorer/ie11-ieak/prep-network-install-with-ieak11.md +++ /dev/null @@ -1,39 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: plan -description: Learn about what you need to do before you deploy your custom browser package using IEAK 11 over your network. -author: dansimp -ms.prod: ie11 -ms.assetid: 2c66d22a-4a94-47cc-82ab-7274abe1dfd6 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Before you install your package over your network using IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Before you install your package over your network using IEAK 11 - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -Employees can install the custom browser package using a network server. However, you must either lower the intranet security level or make the server a trusted site. - -**To lower your intranet security** - -1. In Internet Explorer 11, click **Tools**, **Internet Options**, and then the **Security** tab. - -2. Click **Local intranet**, and then **Sites**. - -3. Uncheck **Automatically detect intranet network**, uncheck **Include all network paths (UNC)**, and then click **OK**. - -**To make your server a trusted site** - -1. From the **Security** tab, click **Trusted sites**, and then **Sites**. - -2. Type the location of the server with the downloadable custom browser package, and then click **Add**. - -3. Repeat this step for every server that will include the custom browser package for download. - diff --git a/browsers/internet-explorer/ie11-ieak/programs-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/programs-ieak11-wizard.md deleted file mode 100644 index acfbbc74ae..0000000000 --- a/browsers/internet-explorer/ie11-ieak/programs-ieak11-wizard.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to use the Programs page in the IEAK 11 Customization Wizard to pick the default programs to use for Internet services. -author: dansimp -ms.prod: ie11 -ms.assetid: f715668f-a50d-4db0-b578-e6526fbfa1fc -ms.reviewer: -manager: dansimp -ms.author: dansimp -title: Use the Programs page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the Programs page in the IEAK 11 Wizard - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -The **Programs** page of the Internet Explorer Customization Wizard 11 lets you pick the default programs to use for Internet services, like email, contact lists, and newsgroups, by importing settings from your computer. - -**Important**
                  The customizations you make on this page only apply to Internet Explorer for the desktop. - -**To use the Programs page** - -1. Determine whether you want to customize your connection settings. You can pick: - - - **Do not customize Program Settings.** Pick this option if you don’t want to set program associations for your employee’s devices.

                  -OR-

                  - - - **Import the current Program Settings.** Pick this option to import the program associations from your device and use them as the preset for your employee’s program settings.

                  **Note**
                  If you want to change any of your settings, you can click **Modify Settings** to open the **Internet Properties** box, click **Set associations**, and make your changes. - -2. Click **Next** to go to the [Additional Settings](additional-settings-ieak11-wizard.md) page or **Back** to go to the [Add a Root Certificate](add-root-certificate-ieak11-wizard.md) page. - -  - -  - - - - - diff --git a/browsers/internet-explorer/ie11-ieak/proxy-auto-config-examples.md b/browsers/internet-explorer/ie11-ieak/proxy-auto-config-examples.md deleted file mode 100644 index 56a0823f9a..0000000000 --- a/browsers/internet-explorer/ie11-ieak/proxy-auto-config-examples.md +++ /dev/null @@ -1,185 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: Learn about how to use a proxy auto-configuration (.pac) file to specify an automatic proxy URL. -author: dansimp -ms.prod: ie11 -ms.assetid: 6c94708d-71bd-44bd-a445-7e6763b374ae -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Use proxy auto-configuration (.pac) files with IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use proxy auto-configuration (.pac) files with IEAK 11 - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -These are various ways you can use a proxy auto-configuration (.pac) file to specify an automatic proxy URL. We've included some examples here to help guide you, but you'll need to change the proxy names, port numbers, and IP addresses to match your organization's info. - -Included examples: -- [Example 1: Connect directly if the host is local](#example-1-connect-directly-if-the-host-is-local) -- [Example 2: Connect directly if the host is inside the firewall](#example-2-connect-directly-if-the-host-is-inside-the-firewall) -- [Example 3: Connect directly if the host name is resolvable](#example-3-connect-directly-if-the-host-name-is-resolvable) -- [Example 4: Connect directly if the host is in specified subnet](#example-4-connect-directly-if-the-host-is-in-specified-subnet) -- [Example 5: Determine the connection type based on the host domain](#example-5-determine-the-connection-type-based-on-the-host-domain) -- [Example 6: Determine the connection type based on the protocol](#example-6-determine-the-connection-type-based-on-the-protocol) -- [Example 7: Determine the proxy server based on the host name matching the IP address](#example-7-determine-the-proxy-server-based-on-the-host-name-matching-the-ip-address) -- [Example 8: Connect using a proxy server if the host IP address matches the specified IP address](#example-8-connect-using-a-proxy-server-if-the-host-ip-address-matches-the-specified-ip-address) -- [Example 9: Connect using a proxy server if there are periods in the host name](#example-9-connect-using-a-proxy-server-if-there-are-periods-in-the-host-name) -- [Example 10: Connect using a proxy server based on specific days of the week](#example-10-connect-using-a-proxy-server-based-on-specific-days-of-the-week) - - -## Example 1: Connect directly if the host is local -In this example, if the host is local, it can connect directly. However, if the server isn't local, it must connect through a proxy server. Specifically, the `isPlainHostName` function looks to see if there are any periods (.) in the host name. If the function finds periods, it means the host isn’t local and it returns false. Otherwise, the function returns true. - -``` javascript -function FindProxyForURL(url, host) - { - if (isPlainHostName(host)) - return "DIRECT"; - else - return "PROXY proxy:80"; - } -``` -## Example 2: Connect directly if the host is inside the firewall -In this example, if the host is inside the firewall, it can connect directly. However, if the server is outside the firewall, it must connect through a proxy server. Specifically, the `localHostOrDomainIs` function only runs for URLs in the local domain. If the host domain name matches the provided domain information, the `dnsDomainIs` function returns true. - -``` javascript -function FindProxyForURL(url, host) - { - if ((isPlainHostName(host) || - dnsDomainIs(host, ".company.com")) && - !localHostOrDomainIs(host, "www.company.com") && - !localHostOrDoaminIs(host, "home.company.com")) - return "DIRECT"; - else - return "PROXY proxy:80"; -} -``` -## Example 3: Connect directly if the host name is resolvable -In this example, if the host name can be resolved, it can connect directly. However, if the name can’t be resolved, the server must connect through a proxy server. Specifically, this function requests the DNS server to resolve the host name it's passed. If the name can be resolved, a direct connection is made. If it can't, the connection is made using a proxy. This is particularly useful when an internal DNS server is used to resolve all internal host names. - -**Important**
                  The `isResolvable` function queries a Domain Name System (DNS) server. References to Object Model objects, properties, or methods cause the proxy auto-configuration file to fail silently. For example, the references `window.open(...)`, `alert(...)`, and `password(...)` all cause the proxy auto-configuration file to fail. - -``` javascript -function FindProxyForURL(url, host) - { - if (isResolvable(host)) - return "DIRECT"; - else - return "PROXY proxy:80"; - } -``` - -## Example 4: Connect directly if the host is in specified subnet -In this example, if the host is in a specified subnet, it can connect directly. However, if the server is outside of the specified subnet, it must connect through a proxy server. Specifically, the `isInNet` (host, pattern, mask) function returns true if the host IP address matches the specified pattern. The mask indicates which part of the IP address to match (255=match, 0=ignore). - -**Important**
                  The `isInNet` function queries a DNS server. References to Object Model objects, properties, or methods cause the proxy auto-configuration file to fail silently. For example, the references `window.open(...)`, `alert(...)`, and `password(...)` all cause the proxy auto-configuration file to fail. - -``` javascript -function FindProxyForURL(url, host) - { - if (isInNet(host, "999.99.9.9", "255.0.255.0")) - return "DIRECT"; - else - return "PROXY proxy:80"; - } -``` -## Example 5: Determine the connection type based on the host domain -In this example, if the host is local, the server can connect directly. However, if the host isn’t local, this function determines which proxy to use based on the host domain. Specifically, the `shExpMatch(str, shexp)` function returns true if `str` matches the `shexp` using shell expression patterns. This is particularly useful when the host domain name is one of the criteria for proxy selection. - -``` javascript -function FindProxyForURL(url, host) - { - if (isPlainHostName(host)) - return "DIRECT"; - else if (shExpMatch(host, "*.com")) - return "PROXY comproxy:80"; - else if (shExpMatch(host, "*.edu")) - return "PROXY eduproxy:80"; - else - return "PROXY proxy"; - } -``` -## Example 6: Determine the connection type based on the protocol -In this example, the in-use protocol is extracted from the server and used to make a proxy selection. If no protocol match occurs, the server is directly connected. Specifically the `substring` function extracts the specified number of characters from a string. This is particularly useful when protocol is one of the criteria for proxy selection. - -``` javascript -function FindProxyForURL(url, host) - { - if (url.substring(0, 5) == "http:") { - return "PROXY proxy:80"; - } - else if (url.substring(0, 4) == "ftp:") { - return "PROXY fproxy:80"; - } - else if (url.substring(0, 6) == "https:") { - return "PROXY secproxy:8080"; - } - else { - return "DIRECT"; - } - } -``` -## Example 7: Determine the proxy server based on the host name matching the IP address -In this example, the proxy server is selected by translating the host name into an IP address and then comparing the address to a specified string. - -**Important** 
                  The `dnsResolve` function queries a DNS server. References to Object Model objects, properties, or methods cause the proxy auto-configuration file to fail silently. For example, the references `window.open(...)`, `alert(...)`, and `password(...)` all cause the proxy auto-configuration file to fail. - -``` javascript -function FindProxyForURL(url, host) - { - if (dnsResolve(host) == "999.99.99.999") { // = https://secproxy - return "PROXY secproxy:8080"; - } - else { - return "PROXY proxy:80"; - } - } -``` -## Example 8: Connect using a proxy server if the host IP address matches the specified IP address -In this example, the proxy server is selected by explicitly getting the IP address and then comparing it to a specified string. If no protocol match occurs, the server makes a direct connection. Specifically, the `myIpAddress` function returns the IP address (in integer-period format) for the host that the browser is running on. - -``` javascript -function FindProxyForURL(url, host) - { - if (myIpAddress() == "999.99.999.99") { - return "PROXY proxy:80"; - } - else { - return "DIRECT"; - } - } -``` -## Example 9: Connect using a proxy server if there are periods in the host name -In this example, the function looks to see if there are periods (.) in the host name. If there are any periods, the connection occurs using a proxy server. If there are no periods, a direct connection occurs. Specifically, the `dnsDomainLevels` function returns an integer equal to the number of periods in the host name. - -**Note**
                  This is another way to determine connection types based on host name characteristics. - -``` javascript -function FindProxyForURL(url, host) - { - if (dnsDomainLevels(host) > 0) { // if the number of periods in host > 0 - return "PROXY proxy:80"; - } - return "DIRECT"; - } -``` -## Example 10: Connect using a proxy server based on specific days of the week -In this example, the function decides whether to connect to a proxy server, based on the days of the week. Connecting on days that don’t fall between the specified date parameters let the server make a direct connection. Specifically the `weekdayRange(day1 [,day2] [,GMT] )` function returns whether the current system time falls within the range specified by the parameters `day1`, `day2`, and `GMT`. Only the first parameter is required. The GMT parameter presumes time values are in Greenwich Mean Time rather than the local time zone. This function is particularly useful for situations where you want to use a proxy server for heavy traffic times, but allow a direct connection when traffic is light. - -``` javascript -function FindProxyForURL(url, host) - { - if(weekdayRange("WED", "SAT", "GMT")) - return "PROXY proxy:80"; - else - return "DIRECT"; - } -``` - diff --git a/browsers/internet-explorer/ie11-ieak/proxy-ins-file-setting.md b/browsers/internet-explorer/ie11-ieak/proxy-ins-file-setting.md deleted file mode 100644 index 9def48f2d3..0000000000 --- a/browsers/internet-explorer/ie11-ieak/proxy-ins-file-setting.md +++ /dev/null @@ -1,34 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: Use the \[Proxy\] .INS file setting to define whether to use a proxy server. -author: dansimp -ms.prod: ie11 -ms.assetid: 30b03c2f-e3e5-48d2-9007-e3fd632f3c18 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Use the Proxy .INS file to specify a proxy server (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the Proxy .INS file to specify a proxy server - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -Info about whether to use a proxy server. If yes, this also includes the host names for the proxy server. - -|Name |Value |Description | -|-----|------|------------| -|FTP_Proxy_Server |`` |The host name for the FTP proxy server. | -|Gopher_Proxy_Server |`` |We no longer support Gopher Server. | -|HTTP_Proxy_Server |`` |The host name for the HTTP proxy server. | -|Proxy_Enable |

                  • **0.** Don’t use a proxy server.
                  • **1.** Use a proxy server.
                  |Determines whether to use a proxy server. | -|Proxy_Override |`` |The host name for the proxy server. For example, ``. | -|Secure_Proxy_Server |`` |The host name for the secure proxy server. | -|Socks_Proxy_Server |`` |The host name for the SOCKS proxy server. | -|Use_Same_Proxy |
                  • **0.** Don’t use the same proxy server for all services.
                  • **1.** Use the same proxy server for all services.
                  |Determines whether to use a single proxy server for all services. | - diff --git a/browsers/internet-explorer/ie11-ieak/proxy-settings-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/proxy-settings-ieak11-wizard.md deleted file mode 100644 index ba113af6cc..0000000000 --- a/browsers/internet-explorer/ie11-ieak/proxy-settings-ieak11-wizard.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to use the Proxy Settings page in the IEAK 11 Customization Wizard to pick the proxy servers used to connect to required services. -author: dansimp -ms.prod: ie11 -ms.assetid: 1fa1eee3-e97d-41fa-a48c-4a6e0dc8b544 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Use the Proxy Settings page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the Proxy Settings page in the IEAK 11 Wizard - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -The **Proxy Settings** page of the Internet Explorer Customization Wizard 11 lets you pick the proxy servers used by your employees to connect for services required by the custom install package. - -Using a proxy server lets you limit access to the Internet. You can also use the **Additional Settings** page of the wizard to further restrict your employees from changing the proxy settings. - -**To use the Proxy Settings page** - -1. Check the **Enable proxy settings** box if you want to use proxy servers for any of your services. - -2. Type the address of the proxy server you want to use for your services into the **Address of proxy** box. In most cases, a single proxy server is used for all of your services.

                  -Proxy locations that don’t begin with a protocol (like, https:// or ftp://) are assumed to be a CERN-type HTTP proxy. For example, the entry *proxy* is treated the same as the entry `https://proxy`. - -3. Type the port for each service. The default value is *80*. - -4. Check the **Use the same proxy server for all addresses** box to use the same proxy server settings for all of your services. - -5. Type any services that shouldn’t use a proxy server into the **Do not use proxy server for addresses beginning with** box.

                  -When filling out your exceptions, keep in mind: - - - Proxy bypass entries can begin with a protocol type, such as https://, https://, or ftp://. However, if a protocol type is used, the exception entry applies only to requests for that protocol. - - - Protocol values are not case sensitive and you can use a wildcard character (*) in place of zero or more characters. - - - You must use a semicolon between your entries. - - - This list is limited to **2064** characters. - -6. Check the **Do not use proxy server for local (intranet) addresses** to bypass your proxy servers for all addresses on your intranet. - -7. Click **Next** to go to the [Security and Privacy Settings](security-and-privacy-settings-ieak11-wizard.md) page or **Back** to go to the [Automatic Configuration](auto-config-ieak11-wizard.md) page. - -  - -  - - - - - diff --git a/browsers/internet-explorer/ie11-ieak/register-uninstall-app-ieak11.md b/browsers/internet-explorer/ie11-ieak/register-uninstall-app-ieak11.md deleted file mode 100644 index f3b4414183..0000000000 --- a/browsers/internet-explorer/ie11-ieak/register-uninstall-app-ieak11.md +++ /dev/null @@ -1,32 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: Learn how to register an uninstall app for your custom components, using IEAK 11. -author: dansimp -ms.prod: ie11 -ms.assetid: 4da1d408-af4a-4c89-a491-d6f005fd5005 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Register an uninstall app for custom components using IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros) -ms.date: 07/27/2017 ---- - - -# Register an uninstall app for custom components using IEAK 11 - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -Register the uninstall apps for any custom components you’ve included in your Internet Explorer 11 package. Registering these apps lets your employees remove the components later, using **Uninstall or change a program** in the Control Panel. - -## Register your uninstallation program -While you’re running your custom component setup process, your app can add information to the subkeys in the `HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\ApplicationName` registry key, registering your uninstallation program. - -**Note**
                  IE11 also uses this registry key to verify that the component installed successfully during setup. - -|Subkey |Data type |Value | -|-------|----------|-----------| -|DisplayName |*string* |Friendly name for your uninstall app. This name must match your **Uninstall Key** in the **Add a Custom Component** page of the Internet Explorer Customization Wizard 11. For more info, see the [Custom Components](custom-components-ieak11-wizard.md) page. | -|UninstallString |*string* |Full command-line text, including the path, to uninstall your component. You must not use a batch file or a sub-process. | - diff --git a/browsers/internet-explorer/ie11-ieak/rsop-snapin-for-policy-settings-ieak11.md b/browsers/internet-explorer/ie11-ieak/rsop-snapin-for-policy-settings-ieak11.md deleted file mode 100644 index 52e023abde..0000000000 --- a/browsers/internet-explorer/ie11-ieak/rsop-snapin-for-policy-settings-ieak11.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: manage -description: Learn how to use the Resultant Set of Policy (RSoP) snap-in to view your policy settings. -author: dansimp -ms.prod: ie11 -ms.assetid: 0f21b320-e879-4a06-8589-aae6fc264666 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Use the RSoP snap-in to review policy settings (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Using the Resultant Set of Policy (RSoP) snap-in to review policy settings - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -After you’ve deployed your custom Internet Explorer package to your employees, you can use the Resultant Set of Policy (RSoP) snap-in to view your created policy settings. The RSoP snap-in is a two-step process. First, you run the RSoP wizard to determine what information should be viewed. Second, you open the specific items in the console window to view the settings. For complete instructions about how to use RSoP, see [Resultant Set of Policy](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc772175(v=ws.11)). - -**To add the RSoP snap-in** - -1. On the **Start** screen, type *MMC*.

                  -The Microsoft Management Console opens. - -2. Click **File**, and then click **Add/Remove Snap-in**. - -3. In the **Available snap-ins** window, go down to the **Resultant Set of Policy** snap-in option, click **Add**, and then click **OK**.

                  -You’re now ready to use the RSoP snap-in from the console. - -**To use the RSoP snap-in** - -1. Right-click **Resultant Set of Policy** and then click **Generate RSoP Data**.

                  -You’ll only need to go through the resulting RSoP Wizard first time you run the snap-in. - -2. Click **Next** on the **Welcome** screen. - -3. Under **Computer Configuration**, click **Administrative Templates**, click **Windows Components**, click **IE**, and then click the feature you want to review the policy settings for. - -  - -  \ No newline at end of file diff --git a/browsers/internet-explorer/ie11-ieak/search-providers-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/search-providers-ieak11-wizard.md deleted file mode 100644 index c092a2101b..0000000000 --- a/browsers/internet-explorer/ie11-ieak/search-providers-ieak11-wizard.md +++ /dev/null @@ -1,60 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to use the Search Providers page in the IEAK 11 Customization Wizard to add additional providers and set the default. -author: dansimp -ms.prod: ie11 -ms.assetid: 48cfaba5-f4c0-493c-b656-445311b7bc52 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Use the Search Providers page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the Search Providers page in the IEAK 11 Wizard - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -The **Search Providers** page of the Internet Explorer Customization Wizard 11 lets you add a default search provider (typically, Bing®) and additional providers to your custom version of IE. - -**Note**
                  The Internet Explorer Customization Wizard 11 offers improved and extended search settings. However, you can still optionally include support for Search Suggestions and Favicons, as well as Accelerator previews by using an .ins file from a previous version of IEAK. - -**To use the Search Providers page** - -1. Click **Import** to automatically import your existing search providers from your current version of IE into this list. - -2. Click **Add** to add more providers.

                  -The **Search Provider** box appears. - -3. In the **Display Name** box, type the text that appears in the **Search Options** menu for the search provider. - -4. In the **URL** box, type the full URL to the search provider, including the https:// prefix. - -5. In the **Favicon URL** box, type the full URL to any icon to associate with your provider. - -6. In the **Suggestions URL (XML)** box, type the associated search suggestions in XML format. - -7. In the **Suggestions URL (JSON)** box, type the associated search suggestions in JavaScript Object Notation format. - -8. In the **Accelerator Preview URL** box, type the associated Accelerator preview URL for each provider, if it’s necessary. - -9. Check the **Display Search Suggestions for this provider** box to turn on search suggestions for the provider, and then click **OK**. - -10. Check the **Search Guide URL Customization** box if you’re going to add your search providers to a custom webpage for your employees. Then, type the URL to the custom webpage in the text box. - -11. Click **Edit** to change your search provider information, click **Set Default** to make a search provider the default for your employees, or **Remove** to delete a search provider. - -12. Click **Next** to go to the [Important URLs - Home Page and Support](important-urls-home-page-and-support-ieak11-wizard.md) page or **Back** to go to the [Browser User Interface](browser-ui-ieak11-wizard.md) page. - -  - -  - - - - - diff --git a/browsers/internet-explorer/ie11-ieak/security-and-ieak11.md b/browsers/internet-explorer/ie11-ieak/security-and-ieak11.md deleted file mode 100644 index 6c1c936553..0000000000 --- a/browsers/internet-explorer/ie11-ieak/security-and-ieak11.md +++ /dev/null @@ -1,68 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: plan -description: Learn about the security features available in Internet Explorer 11 and IEAK 11. -author: dansimp -ms.prod: ie11 -ms.assetid: 5b64c9cb-f8da-411a-88e4-fa69dea473e2 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Security features and IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Security features and IEAK 11 - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -Use Internet Explorer in conjunction with your new and existing security measures, to make sure the computers in your company aren’t compromised while on the Internet. - -## Enhanced Protection Mode -Extends Protected Mode to further restrict the ability of an attacker to access sensitive or personal information in personal and corporate environments, including: - -- Restricting access to higher-level processes in the AppContainer. - -- Improving security against memory safety exploits in 64-bit tab processes. - -This feature is turned off by default. For more info, see [Enhanced Protected Mode problems with Internet Explorer](../ie11-deploy-guide/enhanced-protected-mode-problems-with-ie11.md). - -## Certificates and Digital Signatures -Web browsers have security features that help protect users from downloading harmful programs. Depending on the security level and the platform that you are using, the user may be prevented from, or warned against, downloading programs that are not digitally signed. Digital signatures show users where programs come from, verify that the programs have not been altered, and ensure that users do not receive unnecessary warnings when installing the custom browser. - -Because of this, the custom .cab files created by the Internet Explorer Customization Wizard should be signed, unless you pre-configure the Local intranet zone with a Low security setting. Any custom components you distribute with your browser package for these platforms should also be signed. - -### Understanding digital certificates -To sign your package and custom programs digitally, you must first obtain a digital certificate. You can obtain a certificate from a certification authority or a privately-controlled certificate server. For more info about obtaining certificates or setting up a certificate server, see the following: - -- Microsoft-trusted certification authorities ([Windows root certificate program requirements](/previous-versions//cc751157(v=technet.10))). - -- Certificates overview documentation ([Certificates](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc732331(v=ws.11))). - -- Microsoft Active Directory Certificate Services ( [Active Directory Certificate Services](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc732625(v=ws.11))). - -- Enterprise public key infrastructure (PKI) snap-in documentation ([Enterprise PKI](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc771400(v=ws.11))). - -After you get a certificate, you should note the public and private keys, which are a matched set of keys that are created by the software publisher for encryption and decryption. They are generated on your device at the time the certificate is requested, and your private key is never sent to the certification authority or any other party. - -### Understanding code signing -Code signing varies, depening on how you plan to distribute your custom install package. - -- **If you plan to distribute custom packages over the Internet**, you must sign all custom components and the CMAK profile package (if used). Before you start the Internet Explorer Customization Wizard, make sure that both are signed. Typically, their respective manufacturers will have signed them. Otherwise, you can sign these using the Sign Tool (SignTool.exe) ( [SignTool.exe (Sign Tool)](/dotnet/framework/tools/signtool-exe)) or use the File Signing Tool (Signcode.exe) ([Signcode.exe (File Signing Tool)](/previous-versions/9sh96ycy(v=vs.100))). You should read the documentation included with these tools for more info about all of the signing options.

                  -In addition, after you run the Internet Explorer Customization Wizard, we highly recommend that you sign the IEAK package and the branding.cab file (if you are using it separately from the package). You can do this also using the tools mentioned above. For more information, download Code-Signing Best Practices ([Code-Signing Best Practices](/previous-versions/windows/hardware/design/dn653556(v=vs.85))). - -- **If you plan to distribute your custom packages over an intranet**, sign the custom files or preconfigure the Local intranet zone with a Low security setting, because the default security setting does not allow users to download unsigned programs or code. - -### Understanding your private key -Your device creates two keys during the enrollment process of your digital certificate. One is a public key, which is sent to anyone you want to communicate with, and one is a private key, which is stored on your local device and must be kept secret. You use the private key to encrypt your data and the corresponding public key to decrypt it. - -You must keep your private key, private. To do this, we recommend: - -- **Separate test and release signing.** Set up a parallel code signing infrastructure, using test certificates created by an internal test root certificate authority. This helps to ensure that your certificates aren’t stored on an insecure build system, reducing the likelihood that they will be compromised. - -- **Tamper-proof storage.** Save your private keys on secure, tamper-proof hardware devices. - -- **Security.** Protect your private keys using physical security measures, such as cameras and card readers. \ No newline at end of file diff --git a/browsers/internet-explorer/ie11-ieak/security-and-privacy-settings-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/security-and-privacy-settings-ieak11-wizard.md deleted file mode 100644 index c78a131719..0000000000 --- a/browsers/internet-explorer/ie11-ieak/security-and-privacy-settings-ieak11-wizard.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to use the Security and Privacy Settings page in the IEAK 11 Customization Wizard to manage your security zones, privacy settings, and content ratings. -author: dansimp -ms.prod: ie11 -ms.assetid: cb7cd1df-6a79-42f6-b3a1-8ae467053f82 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Use the Security and Privacy Settings page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the Security and Privacy Settings page in the IEAK 11 Wizard - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -The **Security and Privacy Settings** page of the Internet Explorer Customization Wizard 11 lets you manage your security zones, privacy settings, and content ratings. These settings help restrict the types of content your employees can access from the Internet, including any content that might be considered offensive or otherwise inappropriate in a corporate setting. - -**To use the Security and Privacy Settings page** - -1. Decide if you want to customize your security zones and privacy settings. You can pick: - - - **Do not customize security zones and privacy.** Pick this option if you don’t want to customize your security zones and privacy settings. - - - **Import the current security zones and privacy.** Pick this option to import your security zone and privacy settings from your computer and use them as the preset for your employee’s settings.

                  **Note**
                  To change your settings, click **Modify Settings** to open the **Internet Properties** box, and then click the **Security** and **Privacy** tabs to make your changes. - -2. Decide if you want to customize your content ratings. You can pick: - - - **Do not customize content ratings.** Pick this option if you don’t want to customize content ratings. - - - **Import the current content ratings settings.** Pick this option to import your content rating settings from your computer and use them as the preset for your employee’s settings.

                  **Note**
                  Not all Internet content is rated. If you choose to allow users to view unrated sites, some of those sites could contain inappropriate material. To change your settings, click **Modify Settings** to open the **Content Advisor** box, where you can make your changes. - -3. Click **Next** to go to the [Add a Root Certificate](add-root-certificate-ieak11-wizard.md) page or **Back** to go to the [Proxy Settings](proxy-settings-ieak11-wizard.md) page. - -  - -  - - - - - diff --git a/browsers/internet-explorer/ie11-ieak/security-imports-ins-file-setting.md b/browsers/internet-explorer/ie11-ieak/security-imports-ins-file-setting.md deleted file mode 100644 index b4fd0c45b2..0000000000 --- a/browsers/internet-explorer/ie11-ieak/security-imports-ins-file-setting.md +++ /dev/null @@ -1,31 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: Use the \[Security Imports\] .INS file setting to decide whether to import security info to your custom package. -author: dansimp -ms.prod: ie11 -ms.assetid: 19791c44-aaa7-4f37-9faa-85cbdf29f68e -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Use the Security Imports .INS file to import security info (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the Security Imports .INS file to import security info - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -Info about how to import security information from your local device to your custom package. - -|Name |Value |Description | -|-----|------|------------| -|ImportAuthCode |

                  • **0.** Don’t import the existing settings.
                  • **1.** Import the existing settings.
                  |Whether to import the existing Authenticode settings. | -|ImportRatings |
                  • **0.** Don’t import the existing settings.
                  • **1.** Import the existing settings.
                  |Whether to import the existing Content Ratings settings. | -|ImportSecZones |
                  • **0.** Don’t import the existing settings.
                  • **1.** Import the existing settings.
                  |Whether to import the existing Security Zone settings. | -|ImportSiteCert |
                  • **0.** Don’t import the existing authorities.
                  • **1.** Import the existing authorities.
                  |Whether to import the existing site certification authorities. | -|Win16SiteCerts |
                  • **0.** Don’t use the site certificates.
                  • **1.** Use the site certificates.
                  |Whether to use site certificates for computers running 16-bit versions of Windows. | - diff --git a/browsers/internet-explorer/ie11-ieak/troubleshooting-custom-browser-pkg-ieak11.md b/browsers/internet-explorer/ie11-ieak/troubleshooting-custom-browser-pkg-ieak11.md deleted file mode 100644 index e4fcd7c739..0000000000 --- a/browsers/internet-explorer/ie11-ieak/troubleshooting-custom-browser-pkg-ieak11.md +++ /dev/null @@ -1,127 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: support -description: Info about some of the known issues using the Internet Exporer Customization Wizard and a custom Internet Explorer install package. -author: dansimp -ms.author: dansimp -ms.prod: ie11 -ms.assetid: 9e22cc61-6c63-4cab-bfdf-6fe49db945e4 -ms.reviewer: -audience: itpro -manager: dansimp -title: Troubleshoot custom package and IEAK 11 problems (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Troubleshoot custom package and IEAK 11 problems - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -While the Internet Explorer Customization Wizard has been around for quite a while, there are still some known issues that you might encounter while deploying or managing your custom IE install package. - -## I am unable to locate some of the wizard pages -The most common reasons you will not see certain pages is because: - -- **Your licensing agreement with Microsoft.** Your licensing agreement determines whether you install the **Internal** or **External** version of the Internet Explorer Customization Wizard, and there are different features available for each version. For info about which features are available for each version, see [Determine the licensing version and features to use in IEAK 11](licensing-version-and-features-ieak11.md). - -- **Your choice of operating system.** Depending on the operating system you picked from the **Platform Selection** page of the wizard, you might not see all of the pages. Some features aren’t available for all operating systems. For more information, see [Use the Platform Selection page in the IEAK 11 Wizard](platform-selection-ieak11-wizard.md). - -- **Your choice of features.** Depending on what you selected from the **Feature Selection** page of the wizard, you might not see all of the pages. You need to make sure that the features you want to customize are all checked. For more information, see [Use the Feature Selection page in the IEAK 11 Wizard](feature-selection-ieak11-wizard.md). - -## Internet Explorer Setup fails on user's devices -Various issues can cause problems during Setup, including missing files, trust issues, or URL monikers. You can troubleshoot these issues by reviewing the Setup log file, located at `IE11\_main.log` from the **Windows** folder (typically, `C:\Windows`). The log file covers the entire Setup process from the moment IE11Setup.exe starts until the last .cab file finishes, providing error codes that you can use to help determine the cause of the failure. - -### Main.log file codes - -|Code |Description | -|-----|------------| -|0 |Initializing, making a temporary folder, and checking disk space. | -|1 |Checking for all dependencies. | -|2 |Downloading files from the server. | -|3 |Copying files from download location to the temporary installation folder. | -|4 |Restarting download and retrying Setup, because of a time-out error or other download error. | -|5 |Checking trust and checking permissions. | -|6 |Extracting files. | -|7 |Running Setup program (an .inf or .exe file). | -|8 |Installation is finished. | -|9 |Download finished, and all files are downloaded. | - -### Main.log error codes - -|Code |Description | -|-----|------------| -|80100003 |Files are missing from the download folder during installation. | -|800bxxxx |An error code starting with 800b is a trust failure. | -|800Cxxxx |An error code starting with 800C is a Urlmon.dll failure. | - - -## Internet Explorer Setup connection times out -Internet Explorer Setup can switch servers during the installation process to maintain maximum throughput or to recover from a non-responsive download site (you receive less than 1 byte in 2 minutes). If the connection times out, but Setup is able to connect to the next download site on the list, your download starts over. If however the connection times out and Setup can’t connect to a different server, it’ll ask if you want to stop the installation or try again. - -To address connection issues (for example, as a result of server problems) where Setup can’t locate another download site by default, we recommend you overwrite your first download server using this workaround: - -``` syntax -\ie11setup.exe /C:"ie11wzd.exe /S:""\ie11setup.exe"" /L:""https://your_Web_server/your_Web_site/ie11sites.dat""" -``` - -Where `` represents the folder location where you stored IE11setup.exe. - -## Users cannot uninstall IE -If you cannot uninstall IE using **Uninstall or change a program** in the Control Panel, it could be because the uninstall information is not on the computer. To fix this issue, you should: - -1. Review the uninstall log file, IE11Uninst.log, located in the `C:\Windows` folder. This log file covers the entire uninstallation process, including every file change, every registry change, and any dialog boxes that are shown. - -2. Try to manually uninstall IE. Go to the backup folder, `:\Windows\$ie11$`, and run the uninstall file, `Spunist.exe`. - -  -## The Internet Explorer Customization Wizard 11 does not work with user names that user double-byte character sets -The customization wizard does not work with user names that use double-byte character sets, such as Chinese or Japanese. To fix this, set the **TEMP** and **TMP** environmental variables to a path that does not use these characters (for example, C:\temp). - -1. Open **System Properties**, click the **Advanced** tab, and then click **Environmental Variables**. -2. Click Edit, and then modify the **TEMP** and **TMP** environmental variables to a non-user profile directory. - -  -## Unicode characters are not supported in IEAK 11 path names -While Unicode characters, such as Emoji, are supported for organization names and other branding items, you must not use Unicode characters in any paths associated with running the Internet Explorer Customization Wizard 11. This includes paths to your IEAK 11 installation and to the storage location for your custom packages after they're built. - -## Internet Explorer branding conflicts when using both Unattend and IEAK 11 to customize Internet Explorer settings -Using both Unattend settings and an IEAK custom package to modify a user's version of Internet Explorer 11 might cause a user to lose personalized settings during an upgrade. For example, many manufacturers configure Internet Explorer using Unattend settings. If a user purchases a laptop, and then signs up for Internet service, their Internet Service Provider (ISP) might provide a version of Internet Explorer that has been branded (for example, with a custom homepage for that ISP) using Internet Explorer Customization Wizard 11. If that user later upgrades to a new version of Internet Explorer, the Unattend settings from the laptop manufacturer will be reapplied, overwriting any settings that the user configured for themselves (such as their homepage). - - -## IEAK 11 does not correctly apply the Delete all existing items under Favorites, Favorites Bar and Feeds option -The Internet Explorer Customization Wizard 11 does not correctly apply the **Delete all existing items under Favorites**, **Favorites Bar and Feeds** option, available on the **Browsing Options** page. - -Selecting to include this feature in your customized Internet Explorer package enables the deletion of existing items in the **Favorites** and **Favorites Bar** areas, but it doesn't enable deletion in the **Feeds** area. In addition, this setting adds a new favorite, titled “Web Slice Gallery” to the **Favorites Bar**. - -## F1 does not activate Help on Automatic Version Synchronization page -Pressing the **F1** button on the **Automatic Version Synchronization** page of the Internet Explorer Customization Wizard 11 does not display the **Help** page. Clicking the **Help** button enables you to open the Help system and view information about this page. - -## Certificate installation does not work on IEAK 11 -IEAK 11 doesn't install certificates added using the Add a Root Certificate page of the Internet Explorer Customization Wizard 11. Administrators can manually install certificates using the Certificates Microsoft Management Console snap-in (Certmgr.msc) or using the command-line tool, Certificate Manager (Certmgr.exe). - -> [!NOTE] -> This applies only when using the External licensing mode of IEAK 11. - -## The Additional Settings page appears in the wrong language when using a localized version of IEAK 11 -When using IEAK 11 in other languages, the settings on the Additional Settings page appear in the language of the target platform, regardless of the IEAK 11 language. - -> [!NOTE] -> This applies only when using the Internal licensing mode of IEAK 11. - -To work around this issue, run the customization wizard following these steps: -1. On the **Language Selection** page, select the language that matches the language of your installed IEAK 11. -2. Click **Next**, and then click **Synchronize** on the Automatic Version Synchronization page. -3. After synchronization is complete, cancel the wizard. -4. Repeat these steps for each platform on the Platform Selection page. - -After performing these steps, you must still do the following each time you synchronize a new language and platform: -1. Open File Explorer to the Program Files\Windows IEAK 11 or Program Files (x86)\Windows IEAK 11 folder. -2. Open the **Policies** folder, and then open the appropriate platform folder. -3. Copy the contents of the matching-language folder into the new language folder. - -After completing these steps, the Additional Settings page matches your wizard’s language. - -## Unable to access feeds stored in a subfolder -Adding feeds using the **Favorites**, **Favorites Bar**, and **Feeds** page of the Internet Explorer 11 Customization Wizard requires that the feeds be stored in a single folder. Creating two levels of folders, and creating the feed in the subfolder, causes the feed to fail. diff --git a/browsers/internet-explorer/ie11-ieak/url-ins-file-setting.md b/browsers/internet-explorer/ie11-ieak/url-ins-file-setting.md deleted file mode 100644 index 06a1d3c029..0000000000 --- a/browsers/internet-explorer/ie11-ieak/url-ins-file-setting.md +++ /dev/null @@ -1,44 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: Use the \[URL\] .INS file setting to decide whether to use an auto-configured proxy server. -author: dansimp -ms.prod: ie11 -ms.assetid: 05b09dfa-cf11-408d-92c2-b4ae434a59a7 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Use the URL .INS file to use an auto-configured proxy server (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the URL .INS file to use an auto-configured proxy server - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -Info about whether to use an auto-configured proxy server. If yes, this also includes the URLs to the pages that appear when your employees first connect to that server. - -|Name |Value |Description | -|-----|------|------------| -|AutoConfig |
                  • **0.** Don’t automatically configure the browser.
                  • **1.** Automatically configure the browser.
                  |Determines whether to automatically configure the customized browser on your employee’s device. | -|AutoConfigJSURL |`` |The URL for the proxy auto-config file (.js or .jvs) | -|AutoConfigTime |*integer* |Automatically configures the browser on your employee’s device after its run for a specified length of time. | -|AutoConfigURL |`` |The URL for the proxy auto-config (.pac) file. | -|FirstHomePage |`` |The page (URL) that appears the first time the custom browser is opened on the employee’s device. | -|Help_Page |`` |The URL to your internal technical support site. | -|Home_Page |`` |The URL to your default **Home** page. | -|NoWelcome |
                  • **0.** Display the **Welcome** page.
                  • **1.** Don’t display the **Welcome** page.
                  |Determines whether to show the **Welcome** page the first time the browser’s used on an employee’s device. | -|Quick_Link_1 |`` |The URL to your first Quick Link. | -|Quick_Link_1_Name |`` |The name of the site associated with Quick_Link_1. | -|Quick_Link_2 |`` |The URL to your second Quick Link. | -|Quick_Link_2_Name |`` |The name of the site associated with Quick_Link_2. | -|Quick_Link_X |`` |The URL to another Quick Link. | -|Quick_Link_X_Icon |`` |A Quick Links icon (.ico) file. | -|Quick_Link_X_Name |`` |The name of the site associated with another Quick Link. | -|Quick_Link_X_Offline |
                  • **0.** Don’t make the Quick Links available offline.
                  • **1.** Make the Quick Links available offline.
                  |Determines whether to make the Quick Links available for offline browsing. | -|Search_Page |`` |The URL to the default search page. | -|UseLocalIns |
                  • **0.** Don’t use a local .ins file.
                  • **1.** Use a local .ins file.
                  |Determines whether to use a local Internet Settings (.ins) file | - diff --git a/browsers/internet-explorer/ie11-ieak/user-experience-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/user-experience-ieak11-wizard.md deleted file mode 100644 index 364daedbbc..0000000000 --- a/browsers/internet-explorer/ie11-ieak/user-experience-ieak11-wizard.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to use the User Experience page in the IEAK 11 Customization Wizard to decide user interaction with the Setup process. -author: dansimp -ms.prod: ie11 -ms.assetid: d3378058-e4f0-4a11-a888-b550af994bfa -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Use the User Experience page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the User Experience page in the IEAK 11 Wizard - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -The **User Experience** page of the Internet Explorer Customization Wizard 11 lets you decide how much you want your employees to interact with the custom package’s Setup process. - -**Note**
                  You’ll only see this page if you are running the **Internal** version of the Internet Explorer Customization Wizard 11.

                  The customizations you make on this page only apply to Internet Explorer for the desktop on Windows 7. - -**To use the User Experience page** - -1. Choose how your employee should interact with Setup, including: - - - **Interactive installation**. Lets your employees change installation options while installing your custom package. This experience shows all of the progress and error messages throughout the process. - - - **Hands-free installation**. Lets you make all of the decisions for your employees. However, they’ll still see all of the progress and error messages throughout the process. - - - **Completely silent installation**. Lets you make all of the decisions for your employees and hides all of the progress and error messages. Because this mode is completely silent, if the installation fails, your employees won’t know and they won’t be able to run the installation package again. -

                  Both the hands-free and completely silent installation options will: - - - Answer prompts so Setup can continue. - - - Accept the license agreement. - - - Determine that Internet Explorer 11 is installed and not just downloaded. - - - Perform your specific installation type. - - - Install IE in the default location, unless it is already installed. In that case, the new version of the browser is installed in the same location as the previous version. - -2. Choose if your employee’s device will restart at the end of Setup. - - - **Default**. Prompts your employees to restart after installing IE. - - - **No restart**. Doesn’t restart the computer after installing IE. The employee will have to manually restart later. - - - **Force restart**. Automatically restarts the computer after installing IE. - -3. Click **Next** to go to the [Browser User Interface](browser-ui-ieak11-wizard.md) page or **Back** to go to the [Internal Install](internal-install-ieak11-wizard.md) page. - - - - - - - - - diff --git a/browsers/internet-explorer/ie11-ieak/using-internet-settings-ins-files.md b/browsers/internet-explorer/ie11-ieak/using-internet-settings-ins-files.md deleted file mode 100644 index c9bb888bed..0000000000 --- a/browsers/internet-explorer/ie11-ieak/using-internet-settings-ins-files.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: Info about how to use Internet Settings (.ins) files and the IEAK 11 to configure your custom browser package. -author: dansimp -ms.prod: ie11 -ms.assetid: a24a7cdb-681e-4f34-a53c-6d8383c5f977 -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Using Internet Settings (.INS) files with IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Using Internet Settings (.INS) files with IEAK 11 - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -Use the Internet Settings (.ins) files and the Internet Explorer Administration Kit 11 (IEAK 11) to configure your custom browser and its components. You can create multiple versions of your custom package by customizing copies of this file. - -Here's a list of the available .INS file settings: - -|Setting |Description | -|-----------------------------------------|------------------------------------------------------------------------------| -|[Branding](branding-ins-file-setting.md) |Customize the branding and setup information in your browser package. | -|[BrowserToolbars](browsertoolbars-ins-file-setting.md) |Customize the appearance of the IE toolbar. | -|[CabSigning](cabsigning-ins-file-setting.md) |Digital signature information for your programs. | -|[ConnectionSettings](connectionsettings-ins-file-setting.md) |Info about the networking connection settings used to install your custom package. | -|[CustomBranding](custombranding-ins-file-setting.md) |URL location to your branding cabinet (.cab) file. | -|[ExtRegInf](extreginf-ins-file-setting.md) |Names of your Setup information (.inf) files and the installation mode for components. | -|[FavoritesEx](favoritesex-ins-file-setting.md) |Add a path to your icon file for **Favorites**, decide whether **Favorites** are available offline, and add URLs to each**Favorites** site. | -|[HideCustom](hidecustom-ins-file-setting.md) |Whether to hide the globally unique identifier (GUID) for each custom component. | -|[ISP_Security](isp-security-ins-file-setting.md) |The root certificate you’re adding to your custom package. | -|[Media](media-ins-file-setting.md) |Types of media in which your custom installation package is available. | -|[Proxy](proxy-ins-file-setting.md) |Whether to use a proxy server. | -|[Security Imports](security-imports-ins-file-setting.md) |Whether to import security information for your custom package. | -|[URL](url-ins-file-setting.md) |Whether to use an auto-configured proxy server. | - diff --git a/browsers/internet-explorer/ie11-ieak/what-ieak-can-do-for-you.md b/browsers/internet-explorer/ie11-ieak/what-ieak-can-do-for-you.md deleted file mode 100644 index b6c2cc7087..0000000000 --- a/browsers/internet-explorer/ie11-ieak/what-ieak-can-do-for-you.md +++ /dev/null @@ -1,72 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: support -ms.pagetype: security -description: Internet Explorer Administration Kit (IEAK) helps corporations, Internet service providers (ISPs), Internet content providers (ICPs), and independent software vendors (ISVs) to deploy and manage web-based solutions. -author: dansimp -ms.author: dansimp -ms.manager: elizapo -ms.prod: ie11 -ms.assetid: -ms.reviewer: -audience: itpro -manager: dansimp -title: What IEAK can do for you -ms.sitesec: library -ms.date: 05/10/2018 ---- - -# What IEAK can do for you - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - - -Internet Explorer Administration Kit (IEAK) helps corporations, Internet service providers (ISPs), Internet content providers (ICPs), and independent software vendors (ISVs) to deploy and manage web-based solutions. - -IEAK 10 and newer includes the ability to install using one of the following installation modes: - -- Internal - -- External - -## IEAK 11 users -Internet Explorer Administration Kit (IEAK) helps corporations, Internet service providers (ISPs), Internet content providers (ICPs), and independent software vendors (ISVs) to deploy and manage web-based solutions. - -IEAK 10 and newer includes the ability to install using one of the following installation modes: -- Internal -- External - -> [!NOTE] -> IEAK 11 works in network environments, with or without Microsoft Active Directory service. - - -### Corporations -IEAK helps corporate administrators establish version control, centrally distribute and manage browser installation, configure automatic connection profiles, and customize large portions of Internet Explorer, including features, security, communications settings, and other important functionality. - -Corporate administrators install IEAK using Internal mode (for Internet Explorer 10 or newer) or Corporate mode (for Internet Explorer 9 or older). - -### Internet service providers -IEAK helps ISPs customize, deploy and distribute, add third-party add-ons, search providers, and custom components, as well as include web slices and accelerators all as part of a custom Internet Explorer installation package. - -ISPs install IEAK using External mode (for Internet Explorer 10 or newer) or Internet Service Provider (ISP) mode (for Internet Explorer 9 or older). - -### Internet content providers -IEAK helps ICPs customize the appearance of Internet Explorer and its Setup program, including letting you add your company name or specific wording to the Title bar, set up a customer support webpage, set up the user home page and search providers, add links to the Favorites and the Explorer bars, add optional components, web slices and accelerators, and determine which compatibility mode Internet Explorer should use. - -ICPs install IEAK using External mode (for Internet Explorer 10 or newer) or Internet Content Provider (ICP) mode (for Internet Explorer 9 or older) - -### Independent software vendors -IEAK helps ISVs distribute (and redistribute) a custom version of Internet Explorer that can include custom components, programs, and controls (like the web browser control) that you create for your users. ISVs can also determine home pages, search providers, and add websites to the Favorites bar. - -ISVs install IEAK using External mode (for Internet Explorer 10 or newer) or Internet Content Provider (ICP) mode (for Internet Explorer 9 or older). - -## Additional resources - -- [IEAK 11 - Frequently Asked Questions](../ie11-faq/faq-ieak11.yml) -- [Download IEAK 11](ieak-information-and-downloads.md) -- [IEAK 11 overview](index.md) -- [IEAK 11 administrators guide](./index.md) -- [IEAK 11 licensing guidelines](licensing-version-and-features-ieak11.md) -- [Internet Explorer 11 - FAQ for IT Pros](../ie11-faq/faq-for-it-pros-ie11.yml) -- [Internet Explorer 11 (IE11) - Deployment Guide for IT Pros](../ie11-deploy-guide/index.md) -- [Microsoft Edge - Deployment Guide for IT Pros](/microsoft-edge/deploy/) \ No newline at end of file diff --git a/browsers/internet-explorer/ie11-ieak/wizard-complete-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/wizard-complete-ieak11-wizard.md deleted file mode 100644 index 03de7ed423..0000000000 --- a/browsers/internet-explorer/ie11-ieak/wizard-complete-ieak11-wizard.md +++ /dev/null @@ -1,35 +0,0 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to use the Wizard Complete - Next Steps page in the IEAK 11 Customization Wizard to build your custom Internet Explorer install package. -author: dansimp -ms.prod: ie11 -ms.assetid: aaaac88a-2022-4d0b-893c-b2404b45cabc -ms.reviewer: -audience: itpro -manager: dansimp -ms.author: dansimp -title: Use the Wizard Complete - Next Steps page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the Wizard Complete - Next Steps page in the IEAK 11 Wizard - -[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] - -The **Wizard Complete – Next Steps** page of the Internet Explorer Customization Wizard 11 lets you build your custom installation package, after you click **Finish**. - -In most cases, your next steps will be to prepare your files for installation from your network or from another distribution method. If you haven’t already done it, you’ll need to digitally sign any program or .cab files that are going to be distributed over the Internet or over an intranet that isn’t configured to allow downloads. - -After that, the steps you’ll use to distribute your customized browser will vary, depending on your version of IEAK (Internal or External) and the media you’re using to distribute the package. For more information, see the [Internet Explorer 11 (IE11) - Deployment Guide for IT Pros](../ie11-deploy-guide/index.md). - -  - -  - - - - - diff --git a/browsers/internet-explorer/images/deploy1.png b/browsers/internet-explorer/images/deploy1.png deleted file mode 100644 index 1e16c46e03..0000000000 Binary files a/browsers/internet-explorer/images/deploy1.png and /dev/null differ diff --git a/browsers/internet-explorer/images/deploy2.png b/browsers/internet-explorer/images/deploy2.png deleted file mode 100644 index 44b4aad41c..0000000000 Binary files a/browsers/internet-explorer/images/deploy2.png and /dev/null differ diff --git a/browsers/internet-explorer/images/explore1.png b/browsers/internet-explorer/images/explore1.png deleted file mode 100644 index 3a956dc394..0000000000 Binary files a/browsers/internet-explorer/images/explore1.png and /dev/null differ diff --git a/browsers/internet-explorer/images/explore2.png b/browsers/internet-explorer/images/explore2.png deleted file mode 100644 index c07bbd197b..0000000000 Binary files a/browsers/internet-explorer/images/explore2.png and /dev/null differ diff --git a/browsers/internet-explorer/images/explore3.png b/browsers/internet-explorer/images/explore3.png deleted file mode 100644 index 4ea3adee19..0000000000 Binary files a/browsers/internet-explorer/images/explore3.png and /dev/null differ diff --git a/browsers/internet-explorer/images/ie-deploy.png b/browsers/internet-explorer/images/ie-deploy.png deleted file mode 100644 index 622d9e250b..0000000000 Binary files a/browsers/internet-explorer/images/ie-deploy.png and /dev/null differ diff --git a/browsers/internet-explorer/images/ie-explore.png b/browsers/internet-explorer/images/ie-explore.png deleted file mode 100644 index 184cfdf381..0000000000 Binary files a/browsers/internet-explorer/images/ie-explore.png and /dev/null differ diff --git a/browsers/internet-explorer/images/ie-manage.png b/browsers/internet-explorer/images/ie-manage.png deleted file mode 100644 index 51c9cc4aa9..0000000000 Binary files a/browsers/internet-explorer/images/ie-manage.png and /dev/null differ diff --git a/browsers/internet-explorer/images/ie-plan.png b/browsers/internet-explorer/images/ie-plan.png deleted file mode 100644 index 9b158a815f..0000000000 Binary files a/browsers/internet-explorer/images/ie-plan.png and /dev/null differ diff --git a/browsers/internet-explorer/images/ie-support.png b/browsers/internet-explorer/images/ie-support.png deleted file mode 100644 index 4152163abc..0000000000 Binary files a/browsers/internet-explorer/images/ie-support.png and /dev/null differ diff --git a/browsers/internet-explorer/images/informed1.png b/browsers/internet-explorer/images/informed1.png deleted file mode 100644 index a1f1f0b0fe..0000000000 Binary files a/browsers/internet-explorer/images/informed1.png and /dev/null differ diff --git a/browsers/internet-explorer/images/informed2.png b/browsers/internet-explorer/images/informed2.png deleted file mode 100644 index 544ad83db6..0000000000 Binary files a/browsers/internet-explorer/images/informed2.png and /dev/null differ diff --git a/browsers/internet-explorer/images/manage1.png b/browsers/internet-explorer/images/manage1.png deleted file mode 100644 index df84f05983..0000000000 Binary files a/browsers/internet-explorer/images/manage1.png and /dev/null differ diff --git a/browsers/internet-explorer/images/manage2.png b/browsers/internet-explorer/images/manage2.png deleted file mode 100644 index 94d111e32c..0000000000 Binary files a/browsers/internet-explorer/images/manage2.png and /dev/null differ diff --git a/browsers/internet-explorer/images/manage3.png b/browsers/internet-explorer/images/manage3.png deleted file mode 100644 index c0043c5a8e..0000000000 Binary files a/browsers/internet-explorer/images/manage3.png and /dev/null differ diff --git a/browsers/internet-explorer/images/manage4.png b/browsers/internet-explorer/images/manage4.png deleted file mode 100644 index 20af91d5a5..0000000000 Binary files a/browsers/internet-explorer/images/manage4.png and /dev/null differ diff --git a/browsers/internet-explorer/images/plan1.png b/browsers/internet-explorer/images/plan1.png deleted file mode 100644 index 1bf8e4264e..0000000000 Binary files a/browsers/internet-explorer/images/plan1.png and /dev/null differ diff --git a/browsers/internet-explorer/images/plan2.png b/browsers/internet-explorer/images/plan2.png deleted file mode 100644 index 95103ecc5b..0000000000 Binary files a/browsers/internet-explorer/images/plan2.png and /dev/null differ diff --git a/browsers/internet-explorer/images/support1.png b/browsers/internet-explorer/images/support1.png deleted file mode 100644 index e771ed999a..0000000000 Binary files a/browsers/internet-explorer/images/support1.png and /dev/null differ diff --git a/browsers/internet-explorer/images/support2.png b/browsers/internet-explorer/images/support2.png deleted file mode 100644 index 9841cf1962..0000000000 Binary files a/browsers/internet-explorer/images/support2.png and /dev/null differ diff --git a/browsers/internet-explorer/images/support3.png b/browsers/internet-explorer/images/support3.png deleted file mode 100644 index a3a0425c73..0000000000 Binary files a/browsers/internet-explorer/images/support3.png and /dev/null differ diff --git a/browsers/internet-explorer/images/twitter.png b/browsers/internet-explorer/images/twitter.png deleted file mode 100644 index 3b30a9a1cc..0000000000 Binary files a/browsers/internet-explorer/images/twitter.png and /dev/null differ diff --git a/browsers/internet-explorer/includes/microsoft-365-ie-end-of-support.md b/browsers/internet-explorer/includes/microsoft-365-ie-end-of-support.md deleted file mode 100644 index 2ba0956295..0000000000 --- a/browsers/internet-explorer/includes/microsoft-365-ie-end-of-support.md +++ /dev/null @@ -1,12 +0,0 @@ ---- -author: aczechowski -ms.author: aaroncz -ms.date: 02/14/2023 -ms.reviewer: cathask -manager: aaroncz -ms.prod: ie11 -ms.topic: include ---- - -> [!CAUTION] -> **Update:** The retired, out-of-support Internet Explorer 11 desktop application has been permanently disabled through a Microsoft Edge update on certain versions of Windows 10. For more information, see [Internet Explorer 11 desktop app retirement FAQ](https://aka.ms/iemodefaq). diff --git a/browsers/internet-explorer/index.md b/browsers/internet-explorer/index.md deleted file mode 100644 index 7aeb739bc8..0000000000 --- a/browsers/internet-explorer/index.md +++ /dev/null @@ -1,24 +0,0 @@ ---- -ms.mktglfcycl: deploy -description: The landing page for IE11 that lets you access the documentation. -author: dansimp -ms.author: dansimp -manager: dansimp -ms.prod: ie11 -title: Internet Explorer 11 (IE11) (Internet Explorer 11 for IT Pros) -assetid: be3dc32e-80d9-4d9f-a802-c7db6c50dbe0 -ms.sitesec: library -ms.localizationpriority: medium -ms.date: 07/27/2017 ---- - - -# Internet Explorer 11 (IE11) -Find info about Internet Explorer 11 that's important to IT Pros. - -- [Internet Explorer 11 - FAQ for IT Pros](ie11-faq/faq-for-it-pros-ie11.yml) - -- [Internet Explorer 11 (IE11) - Deployment Guide for IT Pros](ie11-deploy-guide/index.md) - -- [Internet Explorer Administration Kit 11 (IEAK 11) - Administrator's Guide](ie11-ieak/index.md) - diff --git a/browsers/internet-explorer/internet-explorer.yml b/browsers/internet-explorer/internet-explorer.yml deleted file mode 100644 index 17eee2393b..0000000000 --- a/browsers/internet-explorer/internet-explorer.yml +++ /dev/null @@ -1,151 +0,0 @@ -### YamlMime:Landing - -title: Internet Explorer 11 documentation -summary: Consistent, reliable web browsing on Windows 7, Windows 8.1, and Windows 10, with the security, performance, backward compatibility, and modern standards support that large organizations need. -metadata: - title: Internet Explorer 11 documentation - description: Consistent, reliable web browsing on Windows 7, Windows 8.1, and Windows 10, with the security, performance, backward compatibility, and modern standards support that large organizations need. - ms.topic: landing-page - author: aczechowski - ms.author: aaroncz - ms.date: 07/29/2022 - ms.prod: ie11 - -# linkListType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | sample | tutorial | video | whats-new - -landingContent: -# Cards and links should be based on top customer tasks or top subjects -# Start card title with a verb - # Card - - title: Explore - linkLists: - - linkListType: get-started - links: - - text: IE11 features and tools - url: ./ie11-deploy-guide/updated-features-and-tools-with-ie11.md - - text: System requirements and language support - url: ./ie11-deploy-guide/system-requirements-and-language-support-for-ie11.md - - text: Frequently asked questions - url: ./ie11-faq/faq-for-it-pros-ie11.yml - - text: Internet Explorer 11 deployment guide - url: ./ie11-deploy-guide/index.md - - text: Use Enterprise Mode to improve compatibility - url: /microsoft-edge/deploy/emie-to-improve-compatibility - - text: Lifecycle FAQ - Internet Explorer - url: /lifecycle/faq/internet-explorer-microsoft-edge - - linkListType: download - links: - - text: Enterprise Mode Site List Manager (schema, v.2) - url: https://www.microsoft.com/download/details.aspx?id=49974 - - text: Cumulative security updates for Internet Explorer 11 - url: https://www.catalog.update.microsoft.com/Search.aspx?q=cumulative%20security%20update%20for%20internet%20explorer%2011 - - # Card - - title: Plan - linkLists: - - linkListType: get-started - links: - - text: What is Enterprise Mode? - url: ./ie11-deploy-guide/what-is-enterprise-mode.md - - text: Tips and tricks to manage Internet Explorer compatibility - url: ./ie11-deploy-guide/tips-and-tricks-to-manage-ie-compatibility.md - - text: Download the Enterprise Site Discovery Toolkit - url: https://www.microsoft.com/download/details.aspx?id=44570 - - text: Collect data using Enterprise Site Discovery - url: ./ie11-deploy-guide/collect-data-using-enterprise-site-discovery.md - - text: Manage Windows upgrades with Upgrade Readiness - url: /windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness - - linkListType: how-to-guide - links: - - text: Turn on Enterprise Mode and use a site list - url: ./ie11-deploy-guide/turn-on-enterprise-mode-and-use-a-site-list.md - - text: Add sites to the Enterprise Mode site list - url: ./ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md - - text: Edit the Enterprise Mode site list - url: ./ie11-deploy-guide/edit-the-enterprise-mode-site-list-using-the-enterprise-mode-site-list-manager.md - - text: Turn on local control and logging for Enterprise Mode - url: ./ie11-deploy-guide/turn-on-local-control-and-logging-for-enterprise-mode.md - - # Card - - title: Deploy - linkLists: - - linkListType: get-started - links: - - text: IEAK 11 user's guide - url: ./ie11-ieak/index.md - - text: Download IEAK 11 - url: ./ie11-ieak/ieak-information-and-downloads.md - - text: Frequently asked questions about IEAK 11 - url: ./ie11-faq/faq-ieak11.yml - - text: Customization and distribution guidelines - url: ./ie11-ieak/licensing-version-and-features-ieak11.md#customization-guidelines - - linkListType: deploy - links: - - text: Install Internet Explorer 11 through automatic updates (recommended) - url: ./ie11-deploy-guide/ie11-delivery-through-automatic-updates.md - - text: Install Internet Explorer 11 as part of an operating system deployment - url: ./ie11-deploy-guide/install-ie11-using-operating-system-deployment-systems.md - - text: Install Internet Explorer 11 over the network - url: ./ie11-deploy-guide/install-ie11-using-the-network.md - - text: Install Internet Explorer 11 with System Center 2012 R2 Configuration Manager - url: ./ie11-deploy-guide/install-ie11-using-system-center-configuration-manager.md - - text: Install Internet Explorer 11 with Windows Server Update Services (WSUS) - url: ./ie11-deploy-guide/install-ie11-using-windows-server-update-services-wsus.md - - text: Install Internet Explorer 11 with Microsoft Intune - url: ./ie11-deploy-guide/install-ie11-using-microsoft-intune.md - - text: Install Internet Explorer 11 with third-party tools - url: ./ie11-deploy-guide/install-ie11-using-third-party-tools.md - - # Card - - title: Manage - linkLists: - - linkListType: tutorial - links: - - text: Group Policy for beginners - url: /previous-versions/windows/it-pro/windows-7/hh147307(v=ws.10) - - text: New Group Policy settings for IE11 - url: ./ie11-deploy-guide/new-group-policy-settings-for-ie11.md - - text: Administrative templates for IE11 - url: https://www.microsoft.com/download/details.aspx?id=40905 - - text: Group Policy preferences for IE11 - url: ./ie11-deploy-guide/group-policy-preferences-and-ie11.md - - text: Configure Group Policy preferences - url: /troubleshoot/browsers/how-to-configure-group-policy-preference-settings - - text: Blocked out-of-date ActiveX controls - url: ./ie11-deploy-guide/blocked-out-of-date-activex-controls.md - - text: Out-of-date ActiveX control blocking - url: ./ie11-deploy-guide/out-of-date-activex-control-blocking.md - - text: Update to block out-of-date ActiveX controls in Internet Explorer - url: https://support.microsoft.com/topic/update-to-block-out-of-date-activex-controls-in-internet-explorer-39ced8f8-5d98-3c7b-4792-b62fad4e2277 - - # Card - - title: Support - linkLists: - - linkListType: get-started - links: - - text: Change or reset Internet Explorer settings - url: https://support.microsoft.com/windows/change-or-reset-internet-explorer-settings-2d4bac50-5762-91c5-a057-a922533f77d5 - - text: Troubleshoot problems with setup, installation, auto configuration, and more - url: ./ie11-deploy-guide/troubleshoot-ie11.md - - text: Disable VBScript execution in Internet Explorer for Internet Zone and Restricted Sites Zone - url: https://support.microsoft.com/topic/option-to-disable-vbscript-execution-in-internet-explorer-for-internet-zone-and-restricted-sites-zone-3a2104c0-5af0-9aae-6c57-8207d3cb3e65 - - text: Frequently asked questions about IEAK 11 - url: ./ie11-faq/faq-ieak11.yml - - text: Internet Explorer 8, 9, 10, 11 forum - url: https://social.technet.microsoft.com/forums/ie/home?forum=ieitprocurrentver - - text: Contact a Microsoft support professional - url: https://support.microsoft.com/contactus - - text: General support - url: https://support.microsoft.com/windows/internet-explorer-help-23360e49-9cd3-4dda-ba52-705336cc0de2 - - # Card - - title: Stay informed - linkLists: - - linkListType: get-started - links: - - text: Sign up for the Windows IT Pro Insider - url: https://aka.ms/windows-it-pro-insider - - text: Microsoft Edge Dev blog - url: https://blogs.windows.com/msedgedev - - text: Microsoft Edge Dev on Twitter - url: https://twitter.com/MSEdgeDev diff --git a/browsers/internet-explorer/kb-support/ie-edge-faqs.yml b/browsers/internet-explorer/kb-support/ie-edge-faqs.yml deleted file mode 100644 index 996e07597a..0000000000 --- a/browsers/internet-explorer/kb-support/ie-edge-faqs.yml +++ /dev/null @@ -1,241 +0,0 @@ -### YamlMime:FAQ -metadata: - title: IE and Microsoft Edge FAQ for IT Pros - description: Describes frequently asked questions about Internet Explorer and Microsoft Edge for IT professionals. - manager: msmets - author: ramakoni1 - ms.author: ramakoni - ms.reviewer: ramakoni, DEV_Triage - ms.prod: internet-explorer - ms.technology: - ms.topic: faq - ms.localizationpriority: medium - ms.date: 01/23/2020 -title: Internet Explorer and Microsoft Edge frequently asked questions (FAQ) for IT Pros -summary: | - -sections: - - name: Cookie-related questions - questions: - - question: | - What is a cookie? - answer: | - An HTTP cookie (the web cookie or browser cookie) is a small piece of data that a server sends to the user's web browser. The web browser may store the cookie and return it to the server together with the next request. For example, a cookie might be used to indicate whether two requests come from the same browser in order to allow the user to remain logged-in. The cookie records stateful information for the stateless HTTP protocol. - - - question: | - How does Internet Explorer handle cookies? - answer: | - For more information about how Internet Explorer handles cookies, see the following articles: - - - [Beware Cookie Sharing in Cross-Zone Scenarios](/archive/blogs/ieinternals/beware-cookie-sharing-in-cross-zone-scenarios) - - [A Quick Look at P3P](/archive/blogs/ieinternals/a-quick-look-at-p3p) - - [Internet Explorer Cookie Internals FAQ](/archive/blogs/ieinternals/internet-explorer-cookie-internals-faq) - - [Privacy Beyond Blocking Cookies](/archive/blogs/ie/privacy-beyond-blocking-cookies-bringing-awareness-to-third-party-content) - - [Description of Cookies](https://support.microsoft.com/help/260971/description-of-cookies) - - - question: | - Where does Internet Explorer store cookies? - answer: | - To see where Internet Explorer stores its cookies, follow these steps: - - 1. Start File Explorer. - 2. Select **Views** \> **Change folder and search options**. - 3. In the **Folder Options** dialog box, select **View**. - 4. In **Advanced settings**, select **Do not show hidden files, folders, or drivers**. - 5. Clear **Hide protected operation system files (Recommended)**. - 6. Select **Apply**. - 7. Select **OK**. - - The following are the folder locations where the cookies are stored: - - **In Windows 10** - C:\Users\username\AppData\Local\Microsoft\Windows\INetCache - - **In Windows 8 and Windows 8.1** - C:\Users\username\AppData\Local\Microsoft\Windows\INetCookies - - **In Windows 7** - C:\Users\username\AppData\Roaming\Microsoft\Windows\Cookies - C:\Users\username\AppData\Roaming\Microsoft\Windows\Cookies\Low - - - question: | - What is the per-domain cookie limit? - answer: | - Since the June 2018 cumulative updates for Internet Explorer and Microsoft Edge, the per-domain cookie limit is increased from 50 to 180 for both browsers. The cookies vary by path. So, if the same cookie is set for the same domain but for different paths, it's essentially a new cookie. - - There's still a 5 Kilobytes (KB) limit on the size of the cookie header that is sent out. This limit can cause some cookies to be lost after they exceed that value. - - The JavaScript limitation was updated to 10 KB from 4 KB. - - For more information, see [Internet Explorer Cookie Internals (FAQ)](/archive/blogs/ieinternals/internet-explorer-cookie-internals-faq). - - - name: Additional information about cookie limits - questions: - - question: | - What does the Cookie RFC allow? - answer: | - RFC 2109 defines how cookies should be implemented, and it defines minimum values that browsers support. According to the RFC, browsers would ideally have no limits on the size and number of cookies that a browser can handle. To meet the specifications, the user agent should support the following: - - - At least 300 cookies total - - At least 20 cookies per unique host or domain name - - For practicality, individual browser makers set a limit on the total number of cookies that any one domain or unique host can set. They also limit the total number of cookies that can be stored on a computer. - - - question: | - Cookie size limit per domain - answer: | - Some browsers also limit the amount of space that any one domain can use for cookies. This means that if your browser sets a limit of 4,096 bytes per domain for cookies, 4,096 bytes is the maximum available space in that domain even though you can set up to 180 cookies. - - - name: Proxy Auto Configuration (PAC)-related questions - questions: - - question: | - Is an example Proxy Auto Configuration (PAC) file available? - answer: | - Here's a simple PAC file: - - ```vb - function FindProxyForURL(url, host) - { - return "PROXY proxyserver:portnumber"; - } - ``` - - > [!NOTE] - > The previous PAC always returns the `proxyserver:portnumber` proxy. - - For more information about how to write a PAC file and about the different functions in a PAC file, see [the FindProxyForURL website](https://findproxyforurl.com/). - - **Third-party information disclaimer** - The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, about the performance or reliability of these products. - - - question: | - How to improve performance by using PAC scripts - answer: | - For more information, see [Optimizing performance with automatic Proxy configuration scripts (PAC)](/troubleshoot/developer/browsers/connectivity-navigation/optimize-pac-performance). - - - name: Other questions - questions: - - question: | - How to set home and start pages in Microsoft Edge and allow user editing - answer: | - For more information, see the following blog article: - - [How do I set the home page in Microsoft Edge?](https://support.microsoft.com/microsoft-edge/change-your-browser-home-page-a531e1b8-ed54-d057-0262-cc5983a065c6) - - - question: | - How to add sites to the Enterprise Mode (EMIE) site list - answer: | - For more information about how to add sites to an EMIE list, see [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2)](../ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md). - - - question: | - What is Content Security Policy (CSP)? - answer: | - By using [Content Security Policy](/microsoft-edge/dev-guide/security/content-security-policy), you create an allowlist of sources of trusted content in the HTTP headers. You also pre-approve certain servers for content that is loaded into a webpage, and instruct the browser to execute or render only resources from those sources. You can use this technique to prevent malicious content from being injected into sites. - - Content Security Policy is supported in all versions of Microsoft Edge. It lets web developers lock down the resources that can be used by their web application. This helps prevent [cross-site scripting](https://en.wikipedia.org/wiki/Cross-site_scripting) attacks that remain a common vulnerability on the web. However, the first version of Content Security Policy was difficult to implement on websites that used inline script elements that either pointed to script sources or contained script directly. - - CSP2 makes these scenarios easier to manage by adding support for nonces and hashes for script and style resources. A nonce is a cryptographically strong random value that is generated on each page load that appears in both the CSP policy and in the script tags on the page. Using nonces can help minimize the need to maintain a list of allowed source URL values while also allowing trusted scripts that are declared in script elements to run. - - For more information, see the following articles: - - - [Introducing support for Content Security Policy Level 2](https://blogs.windows.com/msedgedev/2017/01/10/edge-csp-2/) - - [Content Security Policy](https://en.wikipedia.org/wiki/Content_Security_Policy) - - - question: | - Where to find Internet Explorer security zones registry entries - answer: | - Most of the Internet Zone entries can be found in [Internet Explorer security zones registry entries for advanced users](/troubleshoot/browsers/ie-security-zones-registry-entries). - - This article was written for Internet Explorer 6 but is still applicable to Internet Explorer 11. - - The default Zone Keys are stored in the following locations: - - - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones - - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones - - - question: | - Why don't HTML5 videos play in Internet Explorer 11? - answer: | - To play HTML5 videos in the Internet Zone, use the default settings or make sure that the registry key value of **2701** under **Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3** is set to **0**. - - - 0 (the default value): Allow - - 3: Disallow - - This key is read by the **URLACTION\_ALLOW\_AUDIO\_VIDEO 0x00002701** URL action flag that determines whether media elements (audio and video) are allowed in pages in a URL security zone. - - For more information, see [Unable to play HTML5 Videos in IE](/archive/blogs/askie/unable-to-play-html5-videos-in-ie). - - For Windows 10 N and Windows KN editions, you must also download the feature pack that is discussed in [Media feature pack for Windows 10 N and Windows 10 KN editions](https://support.microsoft.com/help/3010081/media-feature-pack-for-windows-10-n-and-windows-10-kn-editions). - - For more information about how to check Windows versions, see [Which version of Windows operating system am I running?](https://support.microsoft.com/help/13443/windows-which-version-am-i-running) - - - question: | - What is the Enterprise Mode Site List Portal? - answer: | - This is a new feature to add sites to your enterprise mode site list XML. For more information, see [Enterprise Mode Site List Portal](https://github.com/MicrosoftEdge/enterprise-mode-site-list-portal). - - - question: | - What is Enterprise Mode Feature? - answer: | - For more information, see [Enterprise Mode and the Enterprise Mode Site List](../ie11-deploy-guide/what-is-enterprise-mode.md). - - - question: | - Where can I obtain a list of HTTP Status codes? - answer: | - For information about this list, see [HTTP Status Codes](/windows/win32/winhttp/http-status-codes). - - - question: | - What is end of support for Internet Explorer 11? - answer: | - Internet Explorer 11 is the last major version of Internet Explorer. Internet Explorer 11 will continue receiving security updates and technical support for the lifecycle of the version of Windows on which it's installed. - - For more information, see [Lifecycle FAQ - Internet Explorer and Microsoft Edge](/lifecycle/faq/internet-explorer-microsoft-edge). - - - question: | - How to configure TLS (SSL) for Internet Explorer - answer: | - For more information about how to configure TLS/SSL for Internet Explorer, see [Group Policy Setting to configure TLS/SSL](https://gpsearch.azurewebsites.net/#380). - - - question: | - What is Site to Zone? - answer: | - Site to Zone usually refers to one of the following: - - **Site to Zone Assignment List** - This is a Group Policy policy setting that can be used to add sites to the various security zones. - - The Site to Zone Assignment List policy setting associates sites to zones by using the following values for the Internet security zones: - - - Intranet zone - - Trusted Sites zone - - Internet zone - - Restricted Sites zone - - If you set this policy setting to **Enabled**, you can enter a list of sites and their related zone numbers. By associating a site to a zone, you can make sure that the security settings for the specified zone are applied to the site. - - **Site to Zone Mapping** - Site to Zone Mapping is stored as the name of the key. The protocol is a registry value that has a number that assigns it to the corresponding zone. Internet Explorer will read from the following registry subkeys for the sites that are deployed through the Site to Zone assignment list: - - - HKEY\_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap - - HKEY\_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMapKey - - **Site to Zone Assignment List policy** - This policy setting is available for both Computer Configuration and User Configuration: - - - Computer Configuration > Administrative Templates > Windows Components > Internet Explorer > Internet Control Panel > Security Page - - User Configuration > Administrative Templates > Windows Components > Internet Explorer > Internet Control Panel > Security Page - - **References** - [How to configure Internet Explorer security zone sites using group policies](/archive/blogs/askie/how-to-configure-internet-explorer-security-zone-sites-using-group-polices) - - - question: | - What are the limits for MaxConnectionsPerServer, MaxConnectionsPer1_0Server for the current versions of Internet Explorer? - answer: | - For more information about these settings and limits, see [Connectivity Enhancements in Windows Internet Explorer 8](/previous-versions/cc304129(v=vs.85)). - - - question: | - What is the MaxConnectionsPerProxy setting, and what are the maximum allowed values for this setting? - answer: | - The **MaxConnectionsPerProxy** setting controls the number of connections that a single-user client can maintain to a given host by using a proxy server. - - For more information, see [Understanding Connection Limits and New Proxy Connection Limits in WinInet and Internet Explorer](/archive/blogs/jpsanders/understanding-connection-limits-and-new-proxy-connection-limits-in-wininet-and-internet-explorer). diff --git a/education/docfx.json b/education/docfx.json index 894dbe7e86..cc2b912248 100644 --- a/education/docfx.json +++ b/education/docfx.json @@ -29,21 +29,19 @@ "globalMetadata": { "recommendations": true, "adobe-target": true, - "ms.topic": "article", "ms.collection": [ "education", "tier2" ], - "ms.prod": "windows-client", - "ms.technology": "itpro-edu", + "ms.subservice": "itpro-edu", + "ms.service": "windows-client", "author": "paolomatarazzo", "ms.author": "paoloma", "manager": "aaroncz", "ms.localizationpriority": "medium", "breadcrumb_path": "/education/breadcrumb/toc.json", "uhfHeaderId": "MSDocsHeader-Windows", - "feedback_system": "GitHub", - "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", + "feedback_system": "Standard", "feedback_product_url": "https://support.microsoft.com/windows/send-feedback-to-microsoft-with-the-feedback-hub-app-f59187f8-8739-22d6-ba93-f66612949332", "_op_documentIdPathDepotMapping": { "./": { @@ -52,30 +50,25 @@ } }, "titleSuffix": "Windows Education", - "contributors_to_exclude": [ - "rjagiewich", - "traya1", - "rmca14", - "claydetels19", - "Kellylorenebaker", + "contributors_to_exclude": [ + "dstrome2", + "rjagiewich", + "American-Dipper", + "claydetels19", "jborsecnik", - "tiburd", - "AngelaMotherofDragons", - "dstrome", - "v-dihans", - "garycentric", - "v-stsavell", - "beccarobins", + "v-stchambers", + "shdyas", "Stacyrch140", - "American-Dipper" + "garycentric", + "dstrome" ] }, "fileMetadata": { - "appliesto":{ + "appliesto": { "windows/**/*.md": [ - "✅ Windows 11", - "✅ Windows 11 SE", - "✅ Windows 10" + "✅ Windows 11", + "✅ Windows 11 SE", + "✅ Windows 10" ] } }, @@ -83,5 +76,5 @@ "template": "op.html", "dest": "education", "markdownEngineName": "markdig" -} -} + } +} \ No newline at end of file diff --git a/education/includes/education-content-updates.md b/education/includes/education-content-updates.md deleted file mode 100644 index dc91fc136e..0000000000 --- a/education/includes/education-content-updates.md +++ /dev/null @@ -1,14 +0,0 @@ - - - - -## Week of November 06, 2023 - - -| Published On |Topic title | Change | -|------|------------|--------| -| 11/7/2023 | [Reset devices with Autopilot Reset](/education/windows/autopilot-reset) | modified | -| 11/9/2023 | [Configure Stickers for Windows 11 SE](/education/windows/edu-stickers) | modified | -| 11/9/2023 | What's new in the Windows Set up School PCs app | removed | -| 11/9/2023 | [Management functionalities for Surface devices](/education/windows/tutorial-school-deployment/manage-surface-devices) | modified | -| 11/9/2023 | [Use Set up School PCs app](/education/windows/use-set-up-school-pcs-app) | modified | diff --git a/education/index.yml b/education/index.yml index a79c5f8617..adc8d30041 100644 --- a/education/index.yml +++ b/education/index.yml @@ -14,7 +14,7 @@ productDirectory: title: For IT admins summary: This guide is designed for IT admins looking for the simplest way to move their platform to the cloud. It does not capture all the necessary steps for large scale or complex deployments. items: - # Card + # Card - title: Phase 1 - Cloud deployment imageSrc: ./images/EDU-Deploy.svg summary: Create your Microsoft 365 tenant, secure and configure your environment, sync your Active Directory and SIS, and license users. @@ -24,12 +24,12 @@ productDirectory: imageSrc: ./images/EDU-Device-Mgmt.svg summary: Get started with Windows for Education, set up and enroll devices in Intune. url: /microsoft-365/education/deploy/set-up-windows-10-education-devices - # Card + # Card - title: Phase 3 - Apps management imageSrc: ./images/EDU-Apps-Mgmt.svg summary: Configure admin settings, set up Teams for Education, install apps and install Minecraft. url: /microsoft-365/education/deploy/configure-admin-settings - # Card + # Card - title: Phase 4 - Complete your deployment # imageSrc should be square in ratio with no whitespace imageSrc: ./images/EDU-Tasks.svg @@ -51,7 +51,7 @@ productDirectory: text: Microsoft Purview compliance - url: https://social.technet.microsoft.com/wiki/contents/articles/35748.office-365-what-is-customer-lockbox-and-how-to-enable-it.aspx text: Deploying Lockbox - # Card + # Card - title: Analytics & insights imageSrc: ./images/EDU-Education.svg links: @@ -59,7 +59,7 @@ productDirectory: text: Power BI for IT admins - url: /dynamics365/ text: Dynamics 365 - # Card + # Card - title: Find deployment help and other support resources imageSrc: ./images/EDU-Teachers.svg links: @@ -69,14 +69,6 @@ productDirectory: text: Education help center - url: /training/educator-center/ text: Teacher training packs - # Card - - title: Check out our education journey - imageSrc: ./images/EDU-ITJourney.svg - links: - - url: https://edujourney.microsoft.com/k-12/ - text: K-12 - - url: https://edujourney.microsoft.com/hed/ - text: Higher education additionalContent: sections: diff --git a/education/windows/autopilot-reset.md b/education/windows/autopilot-reset.md deleted file mode 100644 index bb0223c8fc..0000000000 --- a/education/windows/autopilot-reset.md +++ /dev/null @@ -1,101 +0,0 @@ ---- -title: Reset devices with Autopilot Reset -description: Learn about Autopilot Reset and how to enable and use it. -ms.date: 08/10/2022 -ms.topic: how-to -appliesto: - - ✅ Windows 10 ---- - -# Reset devices with Autopilot Reset - -IT admins or technical teachers can use Autopilot Reset to quickly remove personal files, apps, and settings, and reset Windows 10 devices from the lock screen anytime and apply original settings and management enrollment (Microsoft Entra ID and device management) so the devices are ready to use. With Autopilot Reset, devices are returned to a fully configured or known IT-approved state. - -To enable Autopilot Reset, you must: - -1. [Enable the policy for the feature](#enable-autopilot-reset) -2. [Trigger a reset for each device](#trigger-autopilot-reset) - -## Enable Autopilot Reset - -To use Autopilot Reset, Windows Recovery Environment (WinRE) must be enabled on the device. - -**DisableAutomaticReDeploymentCredentials** is a policy that enables or disables the visibility of the credentials for Autopilot Reset. It's a policy node in the [Policy CSP](/windows/client-management/mdm/policy-csp-credentialproviders), **CredentialProviders/DisableAutomaticReDeploymentCredentials**. By default, this policy is set to 1 (Disable). This setting ensures that Autopilot Reset isn't triggered by accident. - -You can set the policy using one of these methods: - -- MDM provider - - Check your MDM provider documentation on how to set this policy. If your MDM provider doesn't explicitly support this policy, you can manually set this policy if your MDM provider allows specific OMA-URIs to be manually set. - - For example, in Intune, create a new configuration policy and add an OMA-URI. - - OMA-URI: ./Vendor/MSFT/Policy/Config/CredentialProviders/DisableAutomaticReDeploymentCredentials - - Data type: Integer - - Value: 0 - -- Windows Configuration Designer - - You can [use Windows Configuration Designer](/windows/configuration/provisioning-packages/provisioning-create-package) to set the **Runtime settings > Policies > CredentialProviders > DisableAutomaticReDeploymentCredentials** setting and create a provisioning package. - -- Set up School PCs app - - Autopilot Reset in the Set up School PCs app is available in the latest release of the app. Make sure you're running Windows 10, version 1709 on the student PCs if you want to use Autopilot Reset through the Set up School PCs app. You can check the version several ways: - - - Reach out to your device manufacturer. - - - If you manage your PCs using Intune or Intune for Education, you can check the OS version by checking the **OS version** info for the device. If you're using another MDM provider, check the documentation for the MDM provider to confirm the OS version. - - - Log into the PCs, go to the **Settings > System > About** page, look in the **Windows specifications** section and confirm **Version** is set to 1709. - - To use the Autopilot Reset setting in the Set up School PCs app: - - - When using [Set up School PCs](use-set-up-school-pcs-app.md), in the **Configure student PC settings** screen, select **Enable Windows 10 Autopilot Reset** among the list of settings for the student PC as shown in the following example: - - ![Configure student PC settings in Set up School PCs.](images/suspcs/suspc_configure_pc2.jpg) - -## Trigger Autopilot Reset - -Autopilot Reset is a two-step process: trigger it and then authenticate. Once you've done these two steps, you can let the process execute and once it's done, the device is again ready for use. - -To trigger Autopilot Reset: - -1. From the Windows device lock screen, enter the keystroke: CTRL + WIN + R. - - ![Enter CTRL+Windows key+R on the Windows lockscreen.](images/autopilot-reset-lockscreen.png) - - This keystroke opens up a custom sign-in screen for Autopilot Reset. The screen serves two purposes: - - 1. Confirm/verify that the end user has the right to trigger Autopilot Reset - 1. Notify the user in case a provisioning package, created using Windows Configuration Designer or Set up School PCs, will be used as part of the process. - - ![Custom login screen for Autopilot Reset.](images/autopilot-reset-customlogin.png) - -1. Sign in with the admin account credentials. If you created a provisioning package, plug in the USB drive and trigger Autopilot Reset. - - > [!IMPORTANT] - > To reestablish Wi-Fi connectivity after reset, make sure the **Connect automatically** box is checked for the device's wireless network connection. - - Once Autopilot Reset is triggered, the reset process starts. - - After reset, the device: - - - Sets the region, language, and keyboard - - Connects to Wi-Fi - - If you provided a provisioning package when Autopilot Reset is triggered, the system applies this new provisioning package. Otherwise, the system reapplies the original provisioning package on the device - - Is returned to a known good managed state, connected to Microsoft Entra ID and MDM. - - ![Notification that provisioning is complete.](images/autopilot-reset-provisioningcomplete.png) - - Once provisioning is complete, the device is again ready for use. - -## Troubleshoot Autopilot Reset - -Autopilot Reset fails when the [Windows Recovery Environment (WinRE)](/windows-hardware/manufacture/desktop/windows-recovery-environment--windows-re--technical-reference) isn't enabled on the device. The error code is: `ERROR_NOT_SUPPORTED (0x80070032)`. - -To make sure WinRE is enabled, use the [REAgentC.exe tool](/windows-hardware/manufacture/desktop/reagentc-command-line-options) to run the following command: - -```cmd -reagentc.exe /enable -``` - -If Autopilot Reset fails after enabling WinRE, or if you're unable to enable WinRE, kindly contact [Microsoft Support](https://support.microsoft.com) for assistance. diff --git a/education/windows/change-home-to-edu.md b/education/windows/change-home-to-edu.md index caa984b456..072a760e05 100644 --- a/education/windows/change-home-to-edu.md +++ b/education/windows/change-home-to-edu.md @@ -1,7 +1,7 @@ --- title: Upgrade Windows Home to Windows Education on student-owned devices description: Learn how IT Pros can upgrade student-owned devices from Windows Home to Windows Education using Mobile Device Management or Kivuto OnTheHub with qualifying subscriptions. -ms.date: 08/07/2023 +ms.date: 04/10/2024 ms.topic: how-to author: scottbreenmsft ms.author: scbree @@ -16,43 +16,42 @@ ms.collection: ## Overview -Customers with qualifying subscriptions can upgrade student-owned and institution-owned devices from *Windows Home* to *Windows Education*, which is designed for both the classroom and remote learning. +Customers with qualifying subscriptions can upgrade student-owned and institution-owned devices from *Windows Home* to *Windows Education*, which is designed for both the classroom and remote learning. > [!NOTE] > To be qualified for this process, customers must have a Windows Education subscription that includes the student use benefit and must have access to the Volume Licensing Service Center (VLSC) or the Microsoft 365 Admin Center. -IT admins can upgrade student devices using a multiple activation key (MAK) manually or through Mobile Device Management (MDM). Alternatively, IT admins can set up a portal through [Kivuto OnTheHub](http://onthehub.com) where students can request a *Windows Pro Education* product key. The table below provides the recommended method depending on the scenario. +IT admins can upgrade student devices using a multiple activation key (MAK) manually or through Mobile Device Management (MDM). The following table provides the recommended method depending on the scenario. | Method | Product key source | Device ownership | Best for | |-|-|-|-| | MDM | VLSC | Personal (student-owned) | IT admin initiated via MDM | -| Kivuto | Kivuto | Personal (student-owned) | Initiated on device by student, parent or guardian | | Provisioning package | VLSC | Personal (student-owned) or Corporate (institution-owned) | IT admin initiated at first boot | These methods apply to devices with *Windows Home* installed; institution-owned devices can be upgraded from *Windows Professional* or *Windows Pro Edu* to *Windows Education* or *Windows Enterprise* using [Windows 10/11 Subscription Activation](/windows/deployment/windows-10-subscription-activation). ## User Notifications -Users aren't notified their device has been or will be upgraded to Windows Education when using MDM. It's the responsibility of the institution to notify their users. Institutions should notify their users that MDM will initiate an upgrade to Windows Education and this upgrade will give the institution extra capabilities, such as installing applications. +Users aren't notified when their device is upgraded to Windows Education when using MDM. It's the responsibility of the institution to notify their users. Institutions should notify their users that MDM initiates an upgrade to Windows Education, and that the upgrade gives the institution extra capabilities, such as installing applications. Device users can disconnect from MDM in the Settings app, to prevent further actions from being taken on their personal device. For instructions on disconnecting from MDM, see [Remove your Windows device from management](/mem/intune/user-help/unenroll-your-device-from-intune-windows). ## Why upgrade student-owned devices from Windows Home to Windows Education? -Some school institutions want to streamline student onboarding for student-owned devices using MDM. Typical MDM requirements include installing certificates, configuring WiFi profiles and installing applications. On Windows, MDM uses Configuration Service Providers (CSPs) to configure settings. Some CSPs aren't available on Windows Home, which can limit the capabilities. Some of the CSPs not available in Windows Home that can affect typical student onboarding are: +Some school institutions want to streamline student onboarding for student-owned devices using MDM. Typical MDM requirements include installing certificates, configuring WiFi profiles, and installing applications. On Windows, MDM uses Configuration Service Providers (CSPs) to configure settings. Some CSPs aren't available on Windows Home, which can limit the capabilities. Some of the CSPs not available in Windows Home that can affect typical student onboarding are: - [EnterpriseDesktopAppManagement](/windows/client-management/mdm/enterprisemodernappmanagement-csp) - which enables deployment of Windows installer or Win32 applications. - [DeliveryOptimization](/windows/client-management/mdm/policy-csp-deliveryoptimization) - which enables configuration of Delivery Optimization. -A full list of CSPs are available at [Configuration service provider reference](/windows/client-management/mdm/configuration-service-provider-reference). For more information about enrolling devices into Microsoft Intune, see [Deployment guide: Enroll Windows devices in Microsoft Intune](/mem/intune/fundamentals/deployment-guide-enrollment-windows). +A full list of CSPs is available at [Configuration service provider reference](/windows/client-management/mdm/configuration-service-provider-reference). For more information about enrolling devices into Microsoft Intune, see [Deployment guide: Enroll Windows devices in Microsoft Intune](/mem/intune/fundamentals/deployment-guide-enrollment-windows). ## Requirements for using a MAK to upgrade from Windows Home to Windows Education -- Access to Volume Licensing Service Center (VLSC) or the Microsoft 365 Admin Center. +- Access to Volume Licensing Service Center (VLSC) or the Microsoft 365 Admin Center - A qualifying Windows subscription such as: - - Windows A3, or; - - Windows A5. -- A pre-installed and activated instance of Windows 10 Home or Windows 11 Home. + - Windows A3, or + - Windows A5 +- A preinstalled and activated instance of Windows 10 Home or Windows 11 Home You can find more information in the [Microsoft Product Terms](https://www.microsoft.com/licensing/terms/productoffering). @@ -67,53 +66,44 @@ IT admins with access to the VLSC or the Microsoft 365 Admin Center, can find th It's critical that MAKs are protected whenever they're used. The following processes provide the best protection for a MAK being applied to a device: -- Provisioning package by institution approved staff; -- Manual entry by institution approved staff (don't distribute the key via email); -- Mobile Device Management (like Microsoft Intune) via [WindowsLicensing CSP](/windows/client-management/mdm/windowslicensing-csp); +- Provisioning package by institution approved staff +- Manual entry by institution approved staff (don't distribute the key via email) +- Mobile Device Management (like Microsoft Intune) via [WindowsLicensing CSP](/windows/client-management/mdm/windowslicensing-csp) > [!IMPORTANT] > If you are using a Mobile Device Management product other than Microsoft Intune, ensure the key isn't accessible by students. -- Operating System Deployment processes with tools such as Microsoft Deployment Toolkit or Microsoft Configuration Manager. +- Operating System Deployment processes with tools such as Microsoft Deployment Toolkit or Microsoft Configuration Manager For a full list of methods to perform a Windows edition upgrade and more details, see [Windows 10 edition upgrade](/windows/deployment/upgrade/windows-10-edition-upgrades). -## Downgrading, resetting, reinstalling and graduation rights +## Downgrading, resetting, reinstalling, and graduation rights After upgrading from *Windows Home* to *Windows Education* there are some considerations for what happens during downgrade, reset or reinstall of the operating system. -The table below highlights the differences by upgrade product key type: - -| Product Key Type | Downgrade (in-place) | Reset | Student reinstall | -|-|-|-|-| -| VLSC | No | Yes | No | -| Kivuto OnTheHub | No | Yes | Yes | - ### Downgrade It isn't possible to downgrade to *Windows Home* from *Windows Education* without reinstalling Windows. ### Reset -If the computer is reset, Windows Education will be retained. +If the computer is reset, Windows Education is retained. ### Reinstall -The Education upgrade doesn't apply to reinstalling Windows. Use the original Windows edition when reinstalling Windows. The original product key or [firmware-embedded product key](#what-is-a-firmware-embedded-activation-key) will be used to activate Windows. - -If students require a *Windows Pro Education* key that can work on a new install of Windows, they should use [Kivuto OnTheHub](http://onthehub.com) to request a key prior to graduation. +The Education upgrade doesn't apply to reinstalling Windows. Use the original Windows edition when reinstalling Windows. The original product key or [firmware-embedded product key](#what-is-a-firmware-embedded-activation-key) is used to activate Windows. For details on product keys and reinstalling Windows, see [Find your Windows product key](https://support.microsoft.com/windows/find-your-windows-product-key-aaa2bf69-7b2b-9f13-f581-a806abf0a886). ### Resale -The license will remain installed on the device if resold and the same conditions above apply for downgrade, reset or reinstall. +The license remains installed on the device if resold and the same conditions apply for downgrade, reset, or reinstall. ## Step by step process for customers to upgrade student-owned devices using Microsoft Intune -These steps provide instructions on how to use Microsoft Intune to upgrade devices from Home to Education. +These steps provide instructions on how to use Microsoft Intune to upgrade devices from Home to Education. ### Step 1: Create a Windows Home edition filter -These steps configure a filter that will only apply to devices running the *Windows Home edition*. This filter will ensure only devices running *Windows Home edition* are upgraded. For more information about filters, see [Create filters in Microsoft Intune](/mem/intune/fundamentals/filters). +These steps configure a filter that only applies to devices running the *Windows Home edition*, ensuring that only devices running *Windows Home edition* are upgraded. For more information about filters, see [Create filters in Microsoft Intune](/mem/intune/fundamentals/filters). - Start in the [**Microsoft Intune admin center**](https://go.microsoft.com/fwlink/?linkid=2109431) - Select **Tenant administration** > **Filters** @@ -130,7 +120,7 @@ These steps configure a filter that will only apply to devices running the *Wind > [!NOTE] > Ensure you've selected OR as the operator in the right And/Or column - + :::image type="content" source="images/change-home-to-edu-windows-home-edition-intune-filter.png" alt-text="Example of configuring the Windows Home filter"::: - Optionally select scope tags as required @@ -153,14 +143,14 @@ These steps create and assign a Windows edition upgrade policy. For more informa - Change **Edition to upgrade** to **Windows 10/11 Education** - In the **Product Key**, enter your *Windows 10/11 Education MAK* - Select **Next** - + :::image type="content" source="images/change-home-to-edu-windows-edition-upgrade-policy.png" alt-text="Example of configuring the Windows upgrade policy in Microsoft Intune"::: - Optionally select scope tags as required and select **Next** -- On the **assignments** screen; +- On the **assignments** screen: - Select **Add all devices** - Next to **All devices**, select **Edit filter** - + > [!NOTE] > You can also target other security groups that contain a smaller scope of users or devices and apply the filter rather than All devices. @@ -171,7 +161,7 @@ These steps create and assign a Windows edition upgrade policy. For more informa - Don't configure any applicability rules and select **next** - Review your settings and select **Create** -The edition upgrade policy will now apply to all existing and new Windows Home edition devices targeted. +The edition upgrade policy applies to all existing and new Windows Home edition devices targeted. ### Step 3: Report on device edition @@ -191,11 +181,11 @@ You can check the Windows versions of managed devices in the Microsoft Intune ad Increases to MAK Activation quantity can be requested by contacting [VLSC support](/licensing/contact-us) and may be granted by exception. A request can be made by accounts with the VLSC Administrator, Key Administrator, or Key Viewer permissions. The request should include the following information: -- Agreement/Enrollment Number or License ID and Authorization. -- Product Name (includes version and edition). -- Last five characters of the product key. -- The number of host activations required. -- Business Justification or Reason for Deployment. +- Agreement/Enrollment Number or License ID and Authorization +- Product Name (includes version and edition) +- Last five characters of the product key +- The number of host activations required +- Business Justification or Reason for Deployment ### What is a firmware-embedded activation key? @@ -205,7 +195,7 @@ A firmware-embedded activation key is a Windows product key that is installed in (Get-CimInstance -query 'select * from SoftwareLicensingService').OA3xOriginalProductKey ``` -If the device has a firmware-embedded activation key, it will be displayed in the output. Otherwise, the device doesn't have a firmware embedded activation key. Most OEM-provided devices designed to run Windows 8 or later will have a firmware-embedded key. +If the device has a firmware-embedded activation key, it's displayed in the output. Otherwise the device doesn't have a firmware embedded activation key. Most OEM-provided devices designed to run Windows 8 or later have a firmware-embedded key. A firmware embedded key is only required to upgrade using Subscription Activation, a MAK upgrade doesn't require the firmware embedded key. @@ -215,14 +205,6 @@ A multiple activation key activates either individual computers or a group of co | Scenario | Ownership | MAK | KMS | AD based activation | Subscription Activation | |-|-|:-:|:-:|:-:|:-:| -| **Workplace join (add work or school account)** | Personal (or student-owned) | X | | | | -| **Microsoft Entra join** | Organization | X | X | | X | -| **Microsoft Entra hybrid join** | Organization | X | X | X | X | - -## Related links - -- [Windows 10 edition upgrade (Windows 10)](/windows/deployment/upgrade/windows-10-edition-upgrades) -- [Windows 10/11 Subscription Activation](/windows/deployment/windows-10-subscription-activation) -- [Equip Your Students with Windows 11 Education - Kivuto](https://kivuto.com/windows-11-student-use-benefit/) -- [Upgrade Windows Home to Windows Pro (microsoft.com)](https://support.microsoft.com/windows/upgrade-windows-home-to-windows-pro-ef34d520-e73f-3198-c525-d1a218cc2818) -- [Partner Center: Upgrade Education customers from Windows 10 Home to Windows 10 Education](/partner-center/upgrade-windows-to-education) +| **Workplace join (add work or school account)** | Personal (or student-owned) | ✅ | | | | +| **Microsoft Entra join** | Organization | ✅ | ✅ | | ✅ | +| **Microsoft Entra hybrid join** | Organization | ✅ | ✅ | ✅ | ✅ | diff --git a/education/windows/chromebook-migration-guide.md b/education/windows/chromebook-migration-guide.md deleted file mode 100644 index 1453e64ad3..0000000000 --- a/education/windows/chromebook-migration-guide.md +++ /dev/null @@ -1,595 +0,0 @@ ---- -title: Chromebook migration guide -description: Learn how to migrate a Google Chromebook-based learning environment to a Windows 10-based learning environment. -ms.topic: how-to -ms.date: 08/10/2022 -appliesto: - - ✅ Windows 10 ---- - -# Chromebook migration guide - -In this guide, you'll learn how to migrate a Google Chromebook-based learning environment to a Windows 10-based learning environment. You'll learn how to perform the necessary planning steps, including Windows device deployment, migration of user and device settings, app migration or replacement, and cloud storage migration. You'll then learn the best method to perform the migration by using automated deployment and migration tools. - -## Plan Chromebook migration - - -Before you begin to migrate Chromebook devices, plan your migration. As with most projects, there can be an urge to immediately start doing before planning. When you plan your Chromebook migration before you perform the migration, you can save countless hours of frustration and mistakes during the migration process. - -In the planning portion of this guide, you'll identify all the decisions that you need to make and how to make each decision. At the end of the planning section, you'll have a list of information you need to collect and what you need to do with the information. You'll be ready to perform your Chromebook migration. - -## Plan for app migration or replacement - - -App migration or replacement is an essential part of your Chromebook migration. In this section, you'll plan how you'll migrate or replace Chromebook (Chrome OS) apps that are currently in use with the same or equivalent Windows apps. At the end of this section, you'll have a list of the active Chrome OS apps and the Windows app counterparts. - -**Identify the apps currently in use on Chromebook devices** - -Before you can do any analysis or make decisions about which apps to migrate or replace, you need to identify which apps are currently in use on the Chromebook devices. You'll create a list of apps that are currently in use (also called an app portfolio). - -> [!NOTE] -> The majority of Chromebook apps are web apps. For these apps you need to first perform Microsoft Edge compatibility testing and then publish the web app URL to the Windows users. For more information, see the [Perform app compatibility testing for web apps](#perform-testing-webapps) section. - - - -You can divide the apps into the following categories: - -- **Apps installed and managed by the institution.** These apps are typically managed in the Apps section in the Google Admin Console. You can record the list of these apps in your app portfolio. - -- **Apps installed by faculty or students.** Faculty or students might have installed these apps as a part of a classroom curriculum. Obtain the list of these apps from faculty or students. Ensure you only record apps that are legitimately used as a part of classroom curriculum (and not for personal entertainment or use). - -Record the following information about each app in your app portfolio: - -- App name - -- App type (such as offline app, online app, web app, and so on) - -- App publisher or developer - -- App version currently in use - -- App priority (how necessary is the app to the day-to-day process of the institution or a classroom? Rank as high, medium, or low) - -Throughout the entire app migration or replacement process, focus on the higher priority apps. Focus on lower priority apps only after you've determined what you'll do with the higher priority apps. - -### - -**Select Google Apps replacements** - -Table 1 lists the Windows device app replacements for the common Google Apps on Chromebook devices. If your users rely on any of these Google Apps, use the corresponding app on the Windows device. Use the information in Table 1 to select the Google App replacement on a Windows device. - -Table 1. Google App replacements - -| If you use this Google app on a Chromebook | Use this app on a Windows device | -|--------------------------------------------|--------------------------------------| -| Google Docs | Word 2016 or Word for the web | -| Google Sheets | Excel 2016 or Excel for the web | -| Google Slides | PowerPoint 2016 or PowerPoint for the web | -| Google Apps Gmail | Outlook 2016 or Outlook Web App | -| Google Hangouts | Microsoft Skype for Business | -| Chrome | Microsoft Edge | -| Google Drive | Microsoft OneDrive for Business | - - - -It may be that you'll decide to replace Google Apps after you deploy Windows devices. For more information on making this decision, see the [Select cloud services migration strategy](#select-cs-migrationstrat) section of this guide. - -**Find the same or similar apps in the Microsoft Store** - -In many instances, software vendors will create a version of their app for multiple platforms. You can search the Microsoft Store to find the same or similar apps to any apps not identified in the [Select Google Apps replacements](#select-googleapps) section. - -In other instances, the offline app doesn't have a version written for the Microsoft Store or isn't a web app. In these cases, look for an app that provides similar functions. For example, you might have a graphing calculator offline Android app published on the Chrome OS, but the software publisher doesn't have a version for Windows devices. Search the Microsoft Store for a graphing calculator app that provides similar features and functionality. Use that Microsoft Store app as a replacement for the graphing calculator offline Android app published on the Chrome OS. - -Record the Windows app that replaces the Chromebook app in your app portfolio. - -### - -**Perform app compatibility testing for web apps** - -Most of the Chromebook apps are web apps. Because you can't run native offline Chromebook apps on a Windows device, there's no reason to perform app compatibility testing for offline Chromebook apps. However, you may have many web apps that will run on both platforms. - -Ensure that you test these web apps in Microsoft Edge. Record the level of compatibility for each web app in Microsoft Edge in your app portfolio. - -## Plan for migration of user and device settings - - -Some institutions have configured the Chromebook devices to make the devices easier to use by using the Google Chrome Admin Console. You've also probably configured the Chromebook devices to help ensure the user data access and ensure that the devices themselves are secure by using the Google Chrome Admin Console. - -However, in addition to your centralized configuration in the Google Admin Console, Chromebook users have probably customized their device. In some instances, users may have changed the web content that is displayed when the Chrome browser starts. Or they may have bookmarked websites for future reference. Or users may have installed apps for use in the classroom. - -In this section, you'll identify the user and device configuration settings for your Chromebook users and devices. Then you'll prioritize these settings to focus on the configuration settings that are essential to your educational institution. - -At the end of this section, you should have a list of Chromebook user and device settings that you want to migrate to Windows, and a level of priority for each setting. You may discover at the end of this section that you've few or no higher priority settings to be migrated. If so, you can skip the [Perform migration of user and device settings](#migrate-user-device-settings) section of this guide. - -**Identify Google Admin Console settings to migrate** - -You use the Google Admin Console (as shown in Figure 1) to manage user and device settings. These settings are applied to all the Chromebook devices in your institution that are enrolled in the Google Admin Console. Review the user and device settings in the Google Admin Console and determine which settings are appropriate for your Windows devices. - -![figure 1.](images/chromebook-fig1-googleadmin.png) - -Figure 1. Google Admin Console - -Table 2 lists the settings in the Device Management node in the Google Admin Console. Review the settings and determine which settings you'll migrate to Windows. - -Table 2. Settings in the Device Management node in the Google Admin Console - -|Section |Settings | -|---------|---------| -|Network |

                  These settings configure the network connections for Chromebook devices and include the following settings categories:

                  • **Wi-Fi.** Configures the Wi-Fi connections that are available. The Windows devices will need these configuration settings to connect to the same Wi-Fi networks.

                  • **Ethernet.** Configures authentication for secured, wired Ethernet connections (802.1x). The Windows devices will need these configuration settings to connect to the network.

                  • **VPN.** Specifies the VPN network connections used by devices when not directly connected to your intranet. The Windows devices will need the same VPN network connections for users to remotely connect to your intranet.

                  • **Certificates.** Contains the certificates used for network authentication. The Windows devices will need these certificates to connect to the network.

                    | -|Mobile |These settings configure and manage companion devices (such as smartphones or tablets) that are used in conjunction with the Chromebook devices and include the following settings categories:
                    • **Device management settings.** Configures settings for mobile (companion) devices, such as device synchronization, password settings, auditing, enable remote wipe, and other settings. Record these settings so that you can ensure the same settings are applied when the devices are being managed by Microsoft Intune or another mobile device management (MDM) provider.
                    • **Device activation.** Contains a list of mobile (companion) devices that need to be approved for management by using the Google Admin Console. Approve or block any devices in this list so that the list of managed devices accurately reflects active managed devices.
                    • **Managed devices.** Performs management tasks on mobile (companion) devices that are managed by the Google Admin Console. Record the list of companion devices on this page so that you can ensure the same devices are managed by Intune or another MDM provider.
                    • **Set Up Apple Push Certificate.** Configures the certificate that is essentially the digital signature that lets the Google Admin Console manage iOS devices. You'll need this certificate if you plan to manage iOS devices by using Intune or another MDM provider.
                    • **Set Up Android for Work.** Authorizes the Google Admin Console to be the MDM provider for Android devices by providing an Enterprise Mobility Management (EMM) token. You'll need this token if you plan to manage Android devices by using another MDM provider. | -|Chrome management |These settings configure and manage companion devices (such as smartphones or tablets) that are used in conjunction with the Chromebook devices and include the following settings categories:
                      • **User settings.** Configures user-based settings for the Chrome browser and Chromebook devices. Most of these Chromebook user-based settings can be mapped to a corresponding setting in Windows. Record the settings and then map them to settings in Group Policy or Intune.
                      • **Public session settings.** Configures Public Sessions for Chrome devices that are used as kiosks, loaner devices, shared computers, or for any other work or school-related purpose for which users don't need to sign in with their credentials. You can configure Windows devices similarly by using Assigned Access. Record the settings and apps that are available in Public Sessions so that you can provide similar configuration in Assigned Access.
                      • **Device settings.** Configures device-based settings for the Chrome browser and Chromebook devices. You can map most of these Chromebook device-based settings to a corresponding setting in Windows. Record the settings and then map them to settings in Group Policy or Intune.
                      • **Devices.** Manages Chrome device management licenses. The number of licenses recorded here should correspond to the number of licenses you'll need for your new management system, such as Intune. Record the number of licenses and use those to determine how many licenses you'll need to manage your Windows devices
                      • **App Management.** Provides configuration settings for Chrome apps. Record the settings for any apps that you've identified that will run on Windows devices. | - -Table 3 lists the settings in the Security node in the Google Admin Console. Review the settings and determine which settings you'll migrate to Windows. - -Table 3. Settings in the Security node in the Google Admin Console - -|Section|Settings| -|--- |--- | -|Basic settings|These settings configure password management and whether or not two-factor authentication (2FA) is configured. You can set the minimum password length, the maximum password length, if non-admin users can recover their own passwords, and enable 2FA.
                        Record these settings and use them to help configure your on-premises Active Directory or Microsoft Entra ID to mirror the current behavior of your Chromebook environment.| -|Password monitoring|This section is used to monitor the strength of user passwords. You don’t need to migrate any settings in this section.| -|API reference|This section is used to enable access to various Google Apps Administrative APIs. You don’t need to migrate any settings in this section.| -|Set up single sign-on (SSO)|This section is used to configure SSO for Google web-based apps (such as Google Apps Gmail or Google Apps Calendar). While you don’t need to migrate any settings in this section, you probably will want to configure Microsoft Entra synchronization to replace Google-based SSO.| -|Advanced settings|This section is used to configure administrative access to user data and to configure the Google Secure Data Connector (which allows Google Apps to access data on your local network). You don’t need to migrate any settings in this section.| - -**Identify locally configured settings to migrate** - -In addition to the settings configured in the Google Admin Console, users may have locally configured their devices based on their own personal preferences (as shown in Figure 2). Table 4 lists the Chromebook user and device settings that you can locally configure. Review the settings and determine which settings you'll migrate to Windows. Some of the settings listed in Table 4 can only be seen when you click the **Show advanced settings** link (as shown in Figure 2). - -![figure 2.](images/fig2-locallyconfig.png) - -Figure 2. Locally configured settings on Chromebook - -Table 4. Locally configured settings - -| Section | Settings | -|------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Internet connections | These settings configure the Internet connection for the devices, such as Wi-Fi and VPN connections. Record the network connection currently in use and configure the Windows device to use the same network connection settings. | -| Appearances | These settings affect the appearance of the desktop. Record the wallpaper image file that is used. Migrate the image file to the Windows device and configure as the user’s wallpaper to maintain similar user experience. | -| Search | These settings configure which search engine is used to search for content. Record this setting so that you can use as the search engine on the Windows device. | -| Advanced sync settings | These settings configure which user settings are synchronized with the Google cloud, such as Apps, Extensions, History, Passwords, Settings, and so on. Record these settings and configure the Windows device with the same settings if you decide to continue to use Google Apps and other cloud services after you migrate to Windows devices. | -| Date and time | These settings configure the time zone and if 24-hour clock time should be used. Record these settings and configure the Windows device to use these settings. | -| Privacy | These settings configure Google Chrome web browser privacy settings (such as prediction service, phishing and malware protection, spelling errors, resource pre-fetch, and so on). Record these settings and configure Microsoft Edge, Internet Explorer, or the web browser of your choice with these settings. | -| Bluetooth | This setting configures whether or not Bluetooth is enabled on the device. Record this setting and configure the Windows device similarly. | -| Passwords and forms | These settings configure Google Chrome web browser to enable autofill of web forms and to save web passwords. Record these settings and configure Microsoft Edge, Internet Explorer, or the web browser of your choice with these settings. | -| Smart lock | These settings configure the Chromebook when the user’s Android phone is nearby and unlocked, which eliminates the need to type a password. You don’t need to migrate settings in this section. | -| Web content | These settings configure how the Chrome web browser displays content (such as font size and page zoom). Record these settings and configure Microsoft Edge, Internet Explorer, or the web browser of your choice with these settings. | -| Languages | These settings configure the language in use for the Chromebook. Record these settings and configure the Windows device to support the same language. | -| Downloads | These settings configure the default folder for file download, if the user should be prompted where to save files, and if the Google Drive account should be disconnected. Record these settings and configure the Windows device with similar settings. | -| HTTPS/SSL | These settings configure client-side certificates that are used to authenticate the device. Depending on the services or apps that use these certificates, you may need to export and then migrate these certificates to the Windows device. Contact the service or app provider to determine if you can use the existing certificate or if a new certificate needs to be issued. Record these settings and migrate the certificate to the Windows device or enroll for a new certificate as required by the service or app. | -| Google Cloud Print | These settings configure the printers that are available to the user. Record the list of printers available to the user and configure the Windows device to have the same printers available. Ensure that the user-friendly printer names in Windows are the same as for the Chromebook device. For example, if the Chromebook device has a printer named “Laser Printer in Registrar’s Office”, use that same name in Windows. | -| On startup | These settings configure which web pages are opened when the Chrome web browser starts. Record these settings and configure Microsoft Edge, Internet Explorer, or the web browser of your choice with these settings. | -| Accessibility | These settings configure the Chromebook ease of use (such as display of large mouse cursor, use of high contrast mode, enablement of the screen magnifier, and so on). Record these settings and configure the Windows device with similar settings. | -| Powerwash | This action removes all user accounts and resets the Chromebook device back to factory settings. You don’t have to migrate any settings in this section. | -| Reset settings | This action retains all user accounts, but restores all settings back to their default values. You don’t have to migrate any settings in this section. | - - - -Determine how many users have similar settings and then consider managing those settings centrally. For example, a large number of users may have many of the same Chrome web browser settings. You can centrally manage these settings in Windows after migration. - -Also, as a part of this planning process, consider settings that may not be currently managed centrally, but should be managed centrally. Record the settings that are currently being locally managed, but you want to manage centrally after the migration. - -**Prioritize settings to migrate** - -After you've collected all the Chromebook user, app, and device settings that you want to migrate, you need to prioritize each setting. Evaluate each setting and assign a priority to the setting based on the levels of high, medium, and low. - -Assign the setting-migration priority based on how critical the setting is to the faculty performing their day-to-day tasks and how the setting affects the curriculum in the classrooms. Focus on the migration of higher priority settings and put less effort into the migration of lower priority settings. There may be some settings that aren't necessary at all and can be dropped from your list of settings entirely. Record the setting priority in the list of settings you plan to migrate. - -## Plan for email migration - - -Many of your users may be using Google Apps Gmail to manage their email, calendars, and contacts. You need to create the list of users you'll migrate and the best time to perform the migration. - -Office 365 supports automated migration from Google Apps Gmail to Office 365. For more information, see [Migrate Google Apps mailboxes to Office 365](/Exchange/mailbox-migration/migrating-imap-mailboxes/migrate-g-suite-mailboxes). - -**Identify the list of user mailboxes to migrate** - -With regard to creating the list of users you'll migrate, it might seem that the answer “all the users” might be the best one. However, depending on the time you select for migration, only a subset of the users may need to be migrated. For example, you may not persist student email accounts between semesters or between academic years. In this case, you would only need to migrate faculty and staff. - -Also, when you perform a migration, it's a great time to verify that all user mailboxes are active. In many environments there are a significant number of mailboxes that were provisioned for users that are no longer a part of the institution (such as interns or student assistants). You can eliminate these users from your list of user mailboxes to migrate. - -Create your list of user mailboxes to migrate in Excel 2016 based on the format described in step 7 in [Create a list of Gmail mailboxes to migrate](/Exchange/mailbox-migration/migrating-imap-mailboxes/migrate-g-suite-mailboxes). If you follow this format, you can use the Microsoft Excel spreadsheet to perform the actual migration later in the process. - -**Identify companion devices that access Google Apps Gmail** - -In addition to Chromebook devices, users may have companion devices (smartphones, tablets, desktops, laptops, and so on) that also access the Google Apps Gmail mailbox. You'll need to identify those companion devices and identify the proper configuration for those devices to access Office 365 mailboxes. - -After you've identified each companion device, verify the settings for the device that are used to access Office 365. You only need to test one type of each companion device. For example, if users use Android phones to access Google Apps Gmail mailboxes, configure the device to access Office 365 and then record those settings. You can publish those settings on a website or to your helpdesk staff so that users will know how to access their Office 365 mailbox. - -In most instances, users will only need to provide in their Office 365 email account and password. However, you should verify these credentials on each type of companion device. For more information about how to configure a companion device to work with Office 365, see [Compare how different mobile devices work with Office 365](https://support.microsoft.com/office/compare-how-different-mobile-devices-work-with-office-365-bdd06229-776a-4824-947c-82425d72597b). - -**Identify the optimal timing for the migration** - -Typically, the best time to perform the migration is between academic years or during semester breaks. Select the time of least activity for your institution. And during that time, the optimal time to perform the migration might be during an evening or over a weekend. - -Ensure that you communicate the time the migration will occur to your users well in advance. Also, ensure that users know how to access their Office 365 email after the migration is complete. Finally, ensure that your users know how to perform the common tasks they performed in Google Apps Gmail in Office 365 and/or Outlook 2016. - -## Plan for cloud storage migration - - -Chromebook devices have limited local storage. So, most of your users will store data in cloud storage, such as Google Drive. You'll need to plan how to migrate your cloud storage as a part of the Chromebook migration process. - -In this section, you'll create a list of the existing cloud services, select the Microsoft cloud services that best meet your needs, and then optimize your cloud storage services migration plan. - -**Identify cloud storage services currently in use** - -Typically, most Chromebook users use Google Drive for cloud storage services because your educational institution purchased other Google cloud services and Google Drive is a part of those services. However, some users may use cloud storage services from other vendors. For each member of your faculty and staff and for each student, create a list of cloud storage services that includes the following details: - -- Name of the cloud storage service - -- Cloud storage service vendor - -- Associated licensing costs or fees - -- Approximate storage currently in use per user - -Use this information as the requirements for your cloud storage services after you migrate to Windows devices. If at the end of this discovery you determine there's no essential data being stored in cloud storage services that requires migration, then you can skip to the [Plan for cloud services migration](#plan-cloud-services) section. - -**Optimize cloud storage services migration plan** - -Now that you know the current cloud storage services configuration, you need to optimize your cloud storage services migration plan for Microsoft OneDrive for Business. Optimization helps ensure that your use only the cloud storage services resources that are necessary for your requirements. - -Consider the following to help optimize your cloud storage services migration plan: - -- **Eliminate inactive user storage.** Before you perform the cloud storage services migration, identify cloud storage that is currently allocated to inactive users. Remove this storage from your list of cloud storage to migrate. - -- **Eliminate or archive inactive files.** Review cloud storage to identify files that are inactive (haven't been accessed for some period of time). Eliminate or archive these files so that they don't consume cloud storage. - -- **Consolidate cloud storage services.** If multiple cloud storage services are in use, reduce the number of cloud storage services and standardize on one cloud storage service. This standardization will help reduce management complexity, support time, and typically will reduce cloud storage costs. - -Record your optimization changes in your cloud storage services migration plan. - -## Plan for cloud services migration - - -Many of your users may use cloud services on their Chromebook device, such as Google Apps, Google Drive, or Google Apps Gmail. You've planned for these individual cloud services in the [Plan for app migration or replacement](#plan-app-migrate-replace), [Plan for Google Apps Gmail to Office 365 migration](#plan-email-migrate), and [Plan for cloud storage migration](#plan-cloud-storage-migration) sections. - -In this section, you'll create a combined list of these cloud services and then select the appropriate strategy to migrate these cloud services. - -### - -**Identify cloud services currently in use** - -You've already identified the individual cloud services that are currently in use in your educational institution in the [Plan for app migration or replacement](#plan-app-migrate-replace), [Plan for Google Apps Gmail to Office 365 migration](#plan-email-migrate), and [Plan for cloud storage migration](#plan-cloud-storage-migration) sections. Create a unified list of these cloud services and record the following about each service: - -- Cloud service name - -- Cloud service provider - -- Number of users that use the cloud service - -**Select cloud services to migrate** - -One of the first questions you should ask after you identify the cloud services currently in use is, “Why do we need to migrate from these cloud services?” The answer to this question largely comes down to finances and features. - -Here's a list of reasons that describe why you might want to migrate from an existing cloud service to Microsoft cloud services: - -- **Better integration with Office 365.** If your long-term strategy is to migrate to Office 365 apps (such as Word 2016 or Excel 2016), then a migration to Microsoft cloud services will provide better integration with these apps. The use of existing cloud services may not be as intuitive for users. For example, Office 365 apps will integrate better with OneDrive for Business compared to Google Drive. - -- **Online apps offer better document compatibility.** Microsoft Office apps (such as Word and Excel for the web) provide the highest level of compatibility with Microsoft Office documents. The Office apps allow you to open and edit documents directly from SharePoint or OneDrive for Business. Users can access the Office app from any device with Internet connectivity. - -- **Reduce licensing costs.** If you pay for Office 365 licenses, then Office 365 apps and cloud storage are included in those licenses. Although you could keep existing cloud services, you probably would pay more to keep those services. - -- **Improve storage capacity and cross-platform features.** Microsoft cloud services provide competitive storage capacity and provide more Windows-centric features than other cloud services providers. While the Microsoft cloud services user experience is highly optimized for Windows devices, Microsoft cloud services are also highly optimized for companion devices (such as iOS or Android devices). - -Review the list of existing cloud services that you created in the [Identify cloud services currently in use](#identify-cloud-services-inuse) section and identify the cloud services that you want to migrate to Microsoft cloud services. If you determine at the end of this task that there are no cloud services to be migrated, then skip to the [Plan for Windows device deployment](#plan-windevice-deploy) section. Also, skip the [Perform cloud services migration](#perform-cloud-services-migration) section later in this guide. - -**Prioritize cloud services** - -After you've created your aggregated list of cloud services currently in use by Chromebook users, prioritize each cloud service. Evaluate each cloud service and assign a priority based on the levels of high, medium, and low. - -Assign the priority based on how critical the cloud service is to the faculty and staff performing their day-to-day tasks and how the cloud service affects the curriculum in the classrooms. Also, make cloud services that are causing pain for the users a higher priority. For example, if users experience outages with a specific cloud service, then make migration of that cloud service a higher priority. - -Focus on the migration of higher priority cloud services first and put less effort into the migration of lower priority cloud services. There may be some cloud services that are unnecessary and you can remove them from your list of cloud services to migrate entirely. Record the cloud service migration priority in the list of cloud services you plan to migrate. - -### - -**Select cloud services migration strategy** - -When you deploy the Windows devices, should you migrate the faculty, staff, and students to the new cloud services? Perhaps. But, in most instances you'll want to select a migration strategy that introduces many small changes over a period of time. - -Consider the following when you create your cloud services migration strategy: - -- **Introduce small changes.** The move from Chrome OS to Windows will be simple for most users as most will have exposure to Windows from home, friends, or family. However, users may not be as familiar with the apps or cloud services. Consider the move to Windows first, and then make other changes as time progresses. - -- **Start off by using existing apps and cloud services.** Immediately after the migration to Windows devices, you may want to consider running the existing apps and cloud services (such Google Apps, Google Apps Gmail, and Google Drive). This option gives users a familiar method to perform their day-to-day tasks. - -- **Resolve pain points.** If some existing apps or cloud services cause problems, you may want to migrate them sooner rather than later. In most instances, users will be happy to go through the learning curve of a new app or cloud service if it's more reliable or intuitive for them to use. - -- **Migrate classrooms or users with common curriculum.** Migrate to Windows devices for an entire classroom or for multiple classrooms that share common curriculum. You must ensure that the necessary apps and cloud services are available for the curriculum prior to the migration of one or more classrooms. - -- **Migrate when the fewest number of active users are affected.** Migrate your cloud services at the end of an academic year or end of a semester. This migration will ensure you've minimal impact on faculty, staff, and students. Also, a migration during this time will minimize the learning curve for users as they're probably dealing with new curriculum for the next semester. Also, you may not need to migrate student apps and data because many educational institutions don't preserve data between semesters or academic years. - -- **Overlap existing and new cloud services.** For faculty and staff, consider overlapping the existing and new cloud services (having both services available) for one business cycle (end of semester or academic year) after migration. This overlap operation allows you to easily recover any data that might not have migrated successfully from the existing cloud services. At a minimum, overlap the user of existing and new cloud services until the user can verify the migration. The tradeoff for using this strategy is the cost of the existing cloud services. However, depending on when license renewal occurs, the cost may be minimal. - -## Plan for Windows device deployment - - -You need to plan for Windows device deployment to help ensure that the devices are successfully installed and configured to replace the Chromebook devices. Even if the vendor that provides the devices pre-loads Windows 10 on them, you still will need to perform other tasks. - -In this section, you'll select a Windows device deployment strategy; plan for Active Directory Domain Services (AD DS) and Microsoft Entra services; plan for device, user, and app management; and plan for any necessary network infrastructure remediation. - -### - -**Select a Windows device deployment strategy** - -What decisions need to be made about Windows device deployment? You just put the device on a desk, hook up power, connect to Wi-Fi, and then let the users operate the device, right? That approach is correct, but depending on the extent of your deployment and other factors, you need to consider different deployment strategies. - -For each classroom that has Chromebook devices, select a combination of the following device deployment strategies: - -- **Deploy one classroom at a time.** In most cases, you'll want to perform your deployment in batches of devices and a classroom is an excellent way to batch devices. You can treat each classroom as a unit and check each classroom off your list after you've deployed the devices. - -- **Deploy based on curriculum.** Deploy the Windows devices after you've confirmed that the curriculum is ready for the Windows devices. If you deploy Windows devices without the curriculum installed and tested, you could significantly reduce the ability for students and teachers to perform effectively in the classroom. Also, deployment based on curriculum has the advantage of letting you move from classroom to classroom quickly if multiple classrooms use the same curriculum. - -- **Deploy side-by-side.** In some instances, you may need to have both the Chromebook and Windows devices in one or more classrooms. You can use this strategy if some of the curriculum only works on Chromebook and other parts of the curriculum works on Windows devices. This method helps prevent delays in Windows device deployment, while ensuring that students and teachers can make optimal use of technology in their curriculum. - -- **Deploy after apps and cloud services migration.** If you deploy a Windows device without the necessary apps and cloud services to support the curriculum, this arrangement provides only a portion of your complete solution. Ensure that the apps and cloud services are tested, provisioned, and ready for use prior to the deployment of Windows devices. - -- **Deploy after the migration of user and device settings.** Ensure that you've identified the user and device settings that you plan to migrate and that those settings are ready to be applied to the new Windows devices. For example, you would want to create Group Policy Objects (GPOs) to apply the user and device settings to Windows devices. - - If you ensure that Windows devices closely mirror the Chromebook device configuration, you'll ease user learning curve and create a sense of familiarity. Also, when you've the settings ready to be applied to the devices, it helps ensure you'll deploy your new Windows devices in a secure configuration. - -Record the combination of Windows device deployment strategies that you selected. - -### - -**Plan for AD DS and Microsoft Entra services** - -The next decision you'll need to make concerns AD DS and Microsoft Entra services. You can run AD DS on-premises, in the cloud by using Microsoft Entra ID, or a combination of both (hybrid). The decision about which of these options is best is closely tied to how you'll manage your users, apps, and devices and if you'll use Office 365 and other Azure-based cloud services. - -In the hybrid configuration, your on-premises AD DS user and group objects are synchronized with Microsoft Entra ID (including passwords). The synchronization happens both directions so that changes are made in both your on-premises AD DS and Microsoft Entra ID. - -Table 5 is a decision matrix that helps you decide if you can use only on-premises AD DS, only Microsoft Entra ID, or a combination of both (hybrid). If the requirements you select from the table require on-premises AD DS and Microsoft Entra ID, then you should select hybrid. For example, if you plan to use Office 365 and use Group Policy for management, then you would select hybrid. However, if you plan to use Office 365 and use Intune for management, then you would select only Microsoft Entra ID. - -Table 5. Select on-premises AD DS, Microsoft Entra ID, or hybrid - -|If you plan to...|On-premises AD DS|Microsoft Entra ID|Hybrid| -|--- |--- |--- |--- | -|Use Office 365||✔️|✔️| -|Use Intune for management||✔️|✔️| -|Use Microsoft Configuration Manager for management|✔️||✔️| -|Use Group Policy for management|✔️||✔️| -|Have devices that are domain-joined|✔️||✔️| -|Allow faculty and students to Bring Your Own Device (BYOD) which aren't domain-joined||✔️|✔️| - -### - -**Plan device, user, and app management** - -You may ask the question, “Why plan for device, user, and app management before you deploy the device?” The answer is that you'll only deploy the device once, but you'll manage the device throughout the remainder of the device's lifecycle. - -Also, planning management before deployment is essential to being ready to support the devices as you deploy them. You want to have your management processes and technology in place when the first teachers, facility, or students start using their new Windows device. - -Table 6 is a decision matrix that lists the device, user, and app management products and technologies and the features supported by each product or technology. The primary device, user, and app management products and technologies include Group Policy, Microsoft Configuration Manager, Intune, and the Microsoft Deployment Toolkit (MDT). Use this decision matrix to help you select the right combination of products and technologies for your plan. - -Table 6. Device, user, and app management products and technologies - -|Desired feature|Windows provisioning packages|Group Policy|Configuration Manager|Intune|MDT|Windows Software Update Services| -|--- |--- |--- |--- |--- |--- |--- | -|Deploy operating system images|✔️||✔️||✔️|| -|Deploy apps during operating system deployment|✔️||✔️||✔️|| -|Deploy apps after operating system deployment|✔️|✔️|✔️|||| -|Deploy software updates during operating system deployment|||✔️||✔️|| -|Deploy software updates after operating system deployment|✔️|✔️|✔️|✔️||✔️| -|Support devices that are domain-joined|✔️|✔️|✔️|✔️|✔️|| -|Support devices that aren't domain-joined|✔️|||✔️|✔️|| -|Use on-premises resources|✔️|✔️|✔️||✔️|| -|Use cloud-based services||||✔️||| - -You can use Configuration Manager and Intune with each other to provide features from both products and technologies. In some instances, you may need only one of these products or technologies. In other instances, you may need two or more to meet the device, user, and app management needs for your institution. - -Record the device, user, and app management products and technologies that you selected. - -### - -**Plan network infrastructure remediation** - -In addition to AD DS, Microsoft Entra ID, and management components, there are other network infrastructure services that Windows devices need. In most instances, Windows devices have the same network infrastructure requirements as the existing Chromebook devices. - -Examine each of the following network infrastructure technologies and services and determine if any remediation is necessary: - -- **Domain Name System (DNS)** provides translation between a device name and its associated IP address. For Chromebook devices, public facing, Internet DNS services are the most important. For Windows devices that only access the Internet, they have the same requirements. - - However, if you intend to communicate between Windows devices (peer-to-peer or client/server) then you'll need local DNS services. Windows devices will register their name and IP address with the local DNS services so that Windows devices can locate each other. - -- **Dynamic Host Configuration Protocol (DHCP)** provides automatic IP configuration for devices. Your existing Chromebook devices probably use DHCP for configuration. If you plan to immediately replace the Chromebook devices with Windows devices, then you only need to release all the DHCP reservations for the Chromebook devices prior to the deployment of Windows devices. - - If you plan to run Chromebook and Windows devices side-by-side, then you need to ensure that your DHCP service has adequate IP addresses available for both sets of devices. - -- **Wi-Fi.** Chromebook devices are designed to connect to Wi-Fi networks. Windows devices are the same. Your existing Wi-Fi network for the Chromebook devices should be adequate for the same number of Windows devices. - - If you plan to significantly increase the number of Windows devices or you plan to run Chromebook and Windows devices side-by-side, then you need to ensure that Wi-Fi network can support the number of devices. - -- **Internet bandwidth.** Chromebook devices consume more Internet bandwidth (up to 700 times more) than Windows devices. This consumption behavior means that if your existing Internet bandwidth is adequate for the Chromebook devices, then the bandwidth will be more than adequate for Windows devices. - - However, if you plan to significantly increase the number of Windows devices or you plan to run Chromebook and Windows devices side-by-side, then you need to ensure that your Internet connection can support the number of devices. - - For more information that compares Internet bandwidth consumption for Chromebook and Windows devices, see the following resources: - - - [Chromebook vs. Windows Notebook Network Traffic Analysis](https://www.principledtechnologies.com/Microsoft/Chromebook_PC_network_traffic_0613.pdf) - - - [Hidden Cost of Chromebook Deployments](https://www.principledtechnologies.com/Microsoft/Windows_Chromebook_bandwidth_0514.pdf) - - - [Microsoft Windows 8.1 Notebook vs. Chromebooks for Education](https://www.principledtechnologies.com/Microsoft/Windows_8.1_vs_Chromebooks_in_Education_0715.pdf) - -- **Power.** Although not specifically a network infrastructure, you need to ensure your classrooms have adequate power. Chromebook and Windows devices should consume similar amounts of power. This condition means that your existing power outlets should support the same number of Windows devices. - - If you plan to significantly increase the number of Windows devices or you plan to run Chromebook and Windows devices side-by-side, you need to ensure that the power outlets, power strips, and other power management components can support the number of devices. - -At the end of this process, you may determine that no network infrastructure remediation is necessary. If so, you can skip the [Perform network infrastructure remediation](#network-infra-remediation) section of this guide. - -## Perform Chromebook migration - - -Thus far, planning has been the primary focus. Believe it or not most of the work is now done. The rest of the Chromebook migration is just the implementation of the plan you've created. - -In this section, you'll perform the necessary steps for the Chromebook device migration. You'll perform the migration based on the planning decision that you made in the [Plan Chromebook migration](#plan-migration) section earlier in this guide. - -You must perform some of the steps in this section in a specific sequence. Each section has guidance about when to perform a step. You can perform other steps before, during, or after the migration. Again, each section will tell you if the sequence is important. - -## Perform network infrastructure remediation - - -The first migration task is to perform any network infrastructure remediation. In the [Plan network infrastructure remediation](#plan-network-infra-remediation) section, you determined the network infrastructure remediation (if any) that you needed to perform. - -It's important that you perform any network infrastructure remediation first because the remaining migration steps are dependent on the network infrastructure. Use the following Microsoft network infrastructure products and technologies: - -- [Core network guidance for Windows Server](/windows-server/networking/core-network-guide/core-network-guide-windows-server) -- [DHCP overview](/windows-server/networking/technologies/dhcp/dhcp-top) -- [DNS overview](/windows-server/networking/dns/dns-top) - -If you use network infrastructure products and technologies from other vendors, refer to the vendor documentation on how to perform the necessary remediation. If you determined that no remediation is necessary, you can skip this section. - - - -## Perform AD DS and Microsoft Entra services deployment or remediation - - -It's important that you perform AD DS and Microsoft Entra services deployment or remediation right after you finish network infrastructure remediation. Many of the remaining migration steps are dependent on you having your identity system (AD DS or Microsoft Entra ID) in place and up to necessary expectations. - -In the [Plan for Active Directory services](#plan-adservices) section, you determined the AD DS and/or Microsoft Entra deployment or remediation (if any) that needed to be performed. Use the following resources to deploy or remediate on-premises AD DS, Microsoft Entra ID, or both: - -- [Core network guidance for Windows Server](/windows-server/networking/core-network-guide/core-network-guide-windows-server) -- [AD DS overview](/windows-server/identity/ad-ds/active-directory-domain-services) -- [Microsoft Entra documentation](/azure/active-directory/) -- [Microsoft Entra ID P1 or P2](https://azure.microsoft.com/pricing/details/active-directory/) -- [Safely virtualizing Active Directory Domain Services (AD DS)](/windows-server/identity/ad-ds/introduction-to-active-directory-domain-services-ad-ds-virtualization-level-100)| - -If you decided not to migrate to AD DS or Microsoft Entra ID as a part of the migration, or if you determined that no remediation is necessary, you can skip this section. If you use identity products and technologies from another vendor, refer to the vendor documentation on how to perform the necessary steps. - -## Prepare device, user, and app management systems - -In the [Plan device, user, and app management](#plan-userdevapp-manage) section of this guide, you selected the products and technologies that you'll use to manage devices, users, and apps on Windows devices. You need to prepare your management systems prior to Windows 10 device deployment. You'll use these management systems to manage the user and device settings that you selected to migrate in the [Plan for migration of user and device settings](#plan-migrate-user-device-settings) section. You need to prepare these systems prior to the migration of user and device settings. - -Use the following Microsoft management systems and the deployment resources to prepare (deploy or remediate) these management systems. - -- [Microsoft Intune](/mem/intune/fundamentals/setup-steps) - -- [Windows Autopilot](/mem/autopilot/windows-autopilot) - -- Microsoft Configuration Manager [core infrastructure documentation](/mem/configmgr/core/) - -- Provisioning packages: - - - [Build and apply a provisioning package](/windows/configuration/provisioning-packages/provisioning-create-package) - - [Windows Imaging and Configuration Designer](/windows/configuration/provisioning-packages/provisioning-install-icd) - - [Step-By-Step: Building Windows 10 Provisioning Packages](/archive/blogs/canitpro/step-by-step-building-windows-10-provisioning-packages) - -- Group policy - - - [Core Network Companion Guide: Group Policy Deployment](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/jj899807(v=ws.11)) - - [Deploying Group Policy](/previous-versions/windows/it-pro/windows-server-2003/cc737330(v=ws.10)) - -If you determined that no new management system or no remediation of existing systems is necessary, you can skip this section. If you use a management system from another vendor, refer to the vendor documentation on how to perform the necessary steps. - -## Perform app migration or replacement - - -In the [Plan for app migration or replacement](#plan-app-migrate-replace) section, you identified the apps currently in use on Chromebook devices and selected the Windows apps that will replace the Chromebook apps. You also performed app compatibility testing for web apps to ensure that web apps on the Chromebook devices would run on Microsoft Edge and Internet Explorer. - -In this step, you need to configure your management system to deploy the apps to the appropriate Windows users and devices. Use the following Microsoft management systems and the app deployment resources to configure these management systems to deploy the apps that you selected in the [Plan for app migration or replacement](#plan-app-migrate-replace) section of this guide. - -- [Manage apps in Microsoft Intune](/mem/intune/apps/) -- [App management in Configuration Manager](/mem/configmgr/apps/) -- Group policy - - [Edit an AppLocker policy](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ee791894(v=ws.10)) - - [Group policy software deployment background](/previous-versions/windows/it-pro/windows-server-2003/cc739305(v=ws.10)) - - [Assigning and publishing software](/previous-versions/windows/it-pro/windows-server-2003/cc783635(v=ws.10)) - -If you determined that no deployment of apps is necessary, you can skip this section. If you use a management system from another vendor, refer to the vendor documentation on how to perform the necessary steps. - -## Perform migration of user and device settings - -In the [Plan for migration of user and device settings](#plan-migrate-user-device-settings) section, you determined the user and device settings that you want to migrate. You selected settings that are configured in the Google Admin Console and locally on the Chromebook device. - -Perform the user and device setting migration by using the following steps: - -1. From the list of institution-wide settings that you created in the [Plan for migration of user and device settings](#plan-migrate-user-device-settings) section, configure as many as possible in your management system (such as Group Policy, Configuration Manager, or Intune). - -2. From the list of device-specific settings that you created in the [Plan for migration of user and device settings](#plan-migrate-user-device-settings) section, configure device-specific setting for higher priority settings. - -3. From the list of user-specific settings that you created in the [Plan for migration of user and device settings](#plan-migrate-user-device-settings) section, configure user-specific setting for higher priority settings. - -4. Verify that all higher-priority user and device settings have been configured in your management system. - -If you do no want to migrate any user or device settings from the Chromebook devices to the Windows devices, you can skip this section. - -## Perform email migration - - -In the [Plan for email migration](#plan-email-migrate) section, you identified the user mailboxes to migrate, identified the companion devices that access Google Apps Gmail, and identified the optimal timing for migration. You can perform this migration before or after you deploy the Windows devices. - -Office 365 supports automated migration from Google Apps Gmail to Office 365. For more information on how to automate the migration from Google Apps Gmail to Office 365, see [Migrate Google Apps mailboxes to Office 365](/Exchange/mailbox-migration/migrating-imap-mailboxes/migrate-g-suite-mailboxes). - -Alternatively, if you want to migrate to Office 365 from: - -- **On-premises Microsoft Exchange Server.** Use the following resources to migrate to Office 365 from an on-premises Microsoft Exchange Server: - - - [What you need to know about a cutover email migration in Exchange Online](/exchange/mailbox-migration/what-to-know-about-a-cutover-migration) - - - [Step-By-Step: Migration of Exchange 2003 Server to Office 365](/archive/blogs/canitpro/step-by-step-migration-of-exchange-2003-server-to-office-365) - - - [Step-By-Step: Migrating from Exchange 2007 to Office 365](/archive/blogs/canitpro/step-by-step-migrating-from-exchange-2007-to-office-365) - -- **Another on-premises or cloud-based email service.** Follow the guidance from that vendor. - -## Perform cloud storage migration - -In the [Plan for cloud storage migration](#plan-cloud-storage-migration) section, you identified the cloud storage services currently in use, selected the Microsoft cloud storage services that you'll use, and optimized your cloud storage services migration plan. You can perform the cloud storage migration before or after you deploy the Windows devices. - -Manually migrate the cloud storage migration by using the following steps: - -1. Install both Google Drive app and OneDrive for Business or OneDrive app on a device. - -2. Sign in as the user in the Google Drive app. - -3. Sign in as the user in the OneDrive for Business or OneDrive app. - -4. Copy the data from the Google Drive storage to the OneDrive for Business or OneDrive storage. - -5. Optionally uninstall the Google Drive app. - -There are also many software vendors who provide software that helps automate the migration from Google Drive to OneDrive for Business, Office 365 SharePoint, or OneDrive. For more information about these automated migration tools, contact the vendors. - -## Perform cloud services migration - - -In the [Plan for cloud services migration](#plan-cloud-services)section, you identified the cloud services currently in use, selected the cloud services that you want to migrate, prioritized the cloud services to migrate, and then selected the cloud services migration strategy. You can perform the cloud services migration before or after you deploy the Windows devices. - -Migrate the cloud services that you currently use to the Microsoft cloud services that you selected. For example, you could migrate from a collaboration website to Office 365 SharePoint. Perform the cloud services migration based on the existing cloud services and the Microsoft cloud services that you selected. - -There are also many software vendors who provide software that helps automate the migration from other cloud services to Microsoft cloud services. For more information about these automated migration tools, contact the vendors. - -## Perform Windows device deployment - - -In the [Select a Windows device deployment strategy](#select-windows-device-deploy) section, you selected how you wanted to deploy Windows 10 devices. The other migration task that you designed in the [Plan for Windows device deployment](#plan-windevice-deploy) section have already been performed. Now it's time to deploy the actual devices. - -For example, if you selected to deploy Windows devices by each classroom, start with the first classroom and then proceed through all of the classrooms until you’ve deployed all Windows devices. - -In some instances, you may receive the devices with Windows 10 already deployed, and want to use provisioning packages. In other cases, you may have a custom Windows 10 image that you want to deploy to the devices by using Configuration Manager or MDT. For more information on how to deploy Windows 10 images to the devices, see the following resources: - -- [OS deployment in Configuration Manager](/mem/configmgr/osd/) - -- [Windows Imaging and Configuration Designer](/windows/configuration/provisioning-packages/provisioning-install-icd) - -- [Build and apply a provisioning package](/windows/configuration/provisioning-packages/provisioning-create-package) - -- [Step-By-Step: Installing Windows 8.1 From A USB Key](/archive/blogs/canitpro/step-by-step-installing-windows-8-1-from-a-usb-key) - -In addition to the Windows 10 image deployment, you may need to perform the following tasks as a part of device deployment: - -- Enroll the device with your management system. - -- Ensure that Windows Defender is enabled and configured to receive updates. - -- Ensure that Windows Update is enabled and configured to receive updates. - -- Deploy any apps that you want the user to immediately be able to access when they start the device (such as Word 2016 or Excel 2016). - -After you complete these steps, your management system should take over the day-to-day maintenance tasks for the Windows 10 devices. Verify that the user and device settings migrated correctly as you deploy each batch of Windows 10 devices. Continue this process until you deploy all Windows 10 devices. - -## Related topics - -[Try it out: Windows 10 deployment (for education)](../index.yml) - -[Try it out: Windows 10 in the classroom](../index.yml) diff --git a/education/windows/configure-aad-google-trust.md b/education/windows/configure-aad-google-trust.md index 8f3304ae76..54bf350d77 100644 --- a/education/windows/configure-aad-google-trust.md +++ b/education/windows/configure-aad-google-trust.md @@ -1,15 +1,15 @@ --- title: Configure federation between Google Workspace and Microsoft Entra ID description: Configuration of a federated trust between Google Workspace and Microsoft Entra ID, with Google Workspace acting as an identity provider (IdP) for Microsoft Entra ID. -ms.date: 09/11/2023 +ms.date: 04/10/2024 ms.topic: how-to appliesto: --- # Configure federation between Google Workspace and Microsoft Entra ID -This article describes the steps required to configure Google Workspace as an identity provider (IdP) for Azure AD.\ -Once configured, users will be able to sign in to Microsoft Entra ID with their Google Workspace credentials. +This article describes the steps required to configure Google Workspace as an identity provider (IdP) for Microsoft Entra ID.\ +Once configured, users can sign in to Microsoft Entra ID with their Google Workspace credentials. ## Prerequisites @@ -18,7 +18,7 @@ To configure Google Workspace as an IdP for Microsoft Entra ID, the following pr 1. A Microsoft Entra tenant, with one or multiple custom DNS domains (that is, domains that aren't in the format \**.onmicrosoft.com*) - If the federated domain hasn't yet been added to Microsoft Entra ID, you must have access to the DNS domain to create a DNS record. This is required to verify the ownership of the DNS namespace - Learn how to [Add your custom domain name using the Microsoft Entra admin center](/azure/active-directory/fundamentals/add-custom-domain) -1. Access to Microsoft Entra ID with an account with the *Global Administrator* role +1. Access to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [External Identity Provider Administrator](/entra/identity/role-based-access-control/permissions-reference#external-identity-provider-administrator) 1. Access to Google Workspace with an account with *super admin* privileges To test federation, the following prerequisites must be met: @@ -26,12 +26,12 @@ To test federation, the following prerequisites must be met: 1. A Google Workspace environment, with users already created > [!IMPORTANT] > Users require an email address defined in Google Workspace, which is used to match the users in Microsoft Entra ID. - > For more information about identity matching, see [Identity matching in Microsoft Entra ID](federated-sign-in.md#identity-matching-in-azure-ad). -1. Individual Microsoft Entra accounts already created: each Google Workspace user will require a matching account defined in Microsoft Entra ID. These accounts are commonly created through automated solutions, for example: + > For more information about identity matching, see [Identity matching in Microsoft Entra ID](federated-sign-in.md#identity-matching-in-microsoft-entra-id). +1. Individual Microsoft Entra accounts already created: each Google Workspace user requires a matching account defined in Microsoft Entra ID. These accounts are commonly created through automated solutions, for example: - School Data Sync (SDS) - Microsoft Entra Connect Sync for environment with on-premises AD DS - PowerShell scripts that call the Microsoft Graph API - - Provisioning tools offered by the IdP - this capability is offered by Google Workspace through [auto-provisioning](https://support.google.com/a/answer/7365072) + - Provisioning tools offered by the IdP - Google Workspace offers [autoprovisioning](https://support.google.com/a/answer/7365072) @@ -42,12 +42,12 @@ To test federation, the following prerequisites must be met: 1. Select **Add app > Search for apps** and search for *microsoft* 1. In the search results page, hover over the *Microsoft Office 365 - Web (SAML)* app and select **Select** :::image type="content" source="images/google/google-admin-search-app.png" alt-text="Screenshot showing Google Workspace and the search button for Microsoft Office 365 SAML app."::: -1. On the **Google Identity Provider details** page, select **Download Metadata** and take note of the location where the **IdP metadata** - *GoogleIDPMetadata.xml* - file is saved, as it will be used to setup Microsoft Entra ID later +1. On the **Google Identity Provider details** page, select **Download Metadata** and take note of the location where the **IdP metadata** - *GoogleIDPMetadata.xml* - file is saved, as it's used to set up Microsoft Entra ID later 1. On the **Service provider detail's** page - Select the option **Signed response** - Verify that the Name ID format is set to **PERSISTENT** - - Depending on how the Microsoft Entra users have been provisioned in Microsoft Entra ID, you may need to adjust the **Name ID** mapping.\ - If using Google auto-provisioning, select **Basic Information > Primary email** + - Depending on how the Microsoft Entra users have been provisioned in Microsoft Entra ID, you might need to adjust the **Name ID** mapping.\ + If using Google autoprovisioning, select **Basic Information > Primary email** - Select **Continue** 1. On the **Attribute mapping** page, map the Google attributes to the Microsoft Entra attributes @@ -56,7 +56,7 @@ To test federation, the following prerequisites must be met: |Basic Information: Primary Email|App attributes: IDPEmail| > [!IMPORTANT] - > You must ensure that your the Microsoft Entra user accounts email match those in your Google Workspace. + > You must ensure that your Microsoft Entra user account's email matches that in your Google Workspace. 1. Select **Finish** @@ -73,7 +73,7 @@ Now that the app is configured, you must enable it for the users in Google Works ## Configure Microsoft Entra ID as a Service Provider (SP) for Google Workspace The configuration of Microsoft Entra ID consists of changing the authentication method for the custom DNS domains. This configuration can be done using PowerShell.\ -Using the **IdP metadata** XML file downloaded from Google Workspace, modify the *$DomainName* variable of the following script to match your environment, and then run it in a PowerShell session. When prompted to authenticate to Microsoft Entra ID, use the credentials of an account with the *Global Administrator* role. +Using the **IdP metadata** XML file downloaded from Google Workspace, modify the *$DomainName* variable of the following script to match your environment, and then run it in a PowerShell session. When prompted to authenticate to Microsoft Entra ID, sign in as at least a [External Identity Provider Administrator](/entra/identity/role-based-access-control/permissions-reference#external-identity-provider-administrator) ```powershell Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser -Force @@ -136,7 +136,7 @@ AdditionalProperties : {} From a private browser session, navigate to https://portal.azure.com and sign in with a Google Workspace account: 1. As username, use the email as defined in Google Workspace -1. The user will be redirected to Google Workspace to sign in -1. After Google Workspace authentication, the user will be redirected back to Microsoft Entra ID and signed in +1. The user is redirected to Google Workspace to sign in +1. After Google Workspace authentication, the user is redirected back to Microsoft Entra ID and signed in :::image type="content" source="images/google/google-sso.gif" alt-text="A GIF that shows the user authenticating the Azure portal using a Google Workspace federated identity."::: diff --git a/education/windows/configure-windows-for-education.md b/education/windows/configure-windows-for-education.md deleted file mode 100644 index d9b96510a0..0000000000 --- a/education/windows/configure-windows-for-education.md +++ /dev/null @@ -1,159 +0,0 @@ ---- -title: Windows 10 configuration recommendations for education customers -description: Learn how to configure the OS diagnostic data, consumer experiences, Cortana, search, and some of the preinstalled apps, so that Windows is ready for your school. -ms.topic: how-to -ms.date: 08/10/2022 -appliesto: - - ✅ Windows 10 ---- -# Windows 10 configuration recommendations for education customers - -Privacy is important to us, we want to provide you with ways to customize the OS diagnostic data, consumer experiences, Cortana, search, and some of the preinstalled apps, for usage with [education editions of Windows 10](windows-editions-for-education-customers.md) in education environments. These features work on all Windows 10 editions, but education editions of Windows 10 have the settings preconfigured. We recommend that all Windows 10 devices in an education setting be configured with **[SetEduPolicies](#setedupolicies)** enabled. For more information, see the following table. To learn more about Microsoft's commitment to privacy, see [Windows 10 and privacy](https://go.microsoft.com/fwlink/?LinkId=809305). - -We want all students to have the chance to use the apps they need for success in the classroom and all school personnel to have apps they need for their job. Students and school personnel who use assistive technology apps not available in the Microsoft Store, and use devices running Windows 10 S, will be able to configure the device at no extra charge to Windows 10 Pro Education. To learn more about the steps to configure this device, see [Switch to Windows 10 Pro Education from Windows 10 Pro or Windows 10 S](change-to-pro-education.md). - -In Windows 10, version 1703 (Creators Update), it's straightforward to configure Windows to be education ready. - -| Area | How to configure | What this area does | Windows 10 Education | Windows 10 Pro Education | Windows 10 S | -| --- | --- | --- | --- | --- | --- | -| **Diagnostic Data** | **AllowTelemetry** | Sets Diagnostic Data to [Basic](/windows/configuration/configure-windows-telemetry-in-your-organization) | This feature is already set | This feature is already set | The policy must be set | -| **Microsoft consumer experiences** | **SetEduPolicies** | Disables suggested content from Windows such as app recommendations | This feature is already set | This feature is already set | The policy must be set | -| **Cortana** | **AllowCortana** | Disables Cortana

                        * Cortana is enabled by default on all editions in Windows 10, version 1703 | If using Windows 10 Education, upgrading from Windows 10, version 1607 to Windows 10, version 1703 will enable Cortana.

                        See the [Recommended configuration](#recommended-configuration) section below for recommended Cortana settings. | If using Windows 10 Pro Education, upgrading from Windows 10, version 1607 to Windows 10, version 1703 will enable Cortana.

                        See the [Recommended configuration](#recommended-configuration) section below for recommended Cortana settings. | See the [Recommended configuration](#recommended-configuration) section below for recommended Cortana settings. | -| **Safe search** | **SetEduPolicies** | Locks Bing safe search to Strict in Microsoft Edge | This feature is already set | This feature is already set | The policy must be set | -| **Bing search advertising** | Ad free search with Bing | Disables ads when searching the internet with Bing in Microsoft Edge. See [Ad-free search with Bing](#ad-free-search-with-bing | View configuration instructions as detailed in [Ad-free search with Bing](#ad-free-search-with-bing) | View configuration instructions as detailed in [Ad-free search with Bing](#ad-free-search-with-bing) | View configuration instructions as detailed in [Ad-free search with Bing](#ad-free-search-with-bing) | -| **Apps** | **SetEduPolicies** | Preinstalled apps like Microsoft Edge, Movies & TV, Groove, and Skype become education ready

                        * Any app can detect Windows is running in an education ready configuration through [IsEducationEnvironment](/uwp/api/windows.system.profile.educationsettings) | This feature is already set | This feature is already set | The policy must be set | - - -## Recommended configuration -It's easy to be education ready when using Microsoft products. We recommend the following configuration: - -1. Use an Office 365 Education tenant. - - With Office 365, you also have Microsoft Entra ID. To learn more about Office 365 Education features and pricing, see [Office 365 Education plans and pricing](https://products.office.com/en-us/academic/compare-office-365-education-plans). - -2. Activate Intune for Education in your tenant. - - You can [sign up to learn more about Intune for Education](https://info.microsoft.com/US-WNDWS-CNTNT-FY17-01Jan-17-IntuneforEducationlandingpageandnurture292531_01Registration-ForminBody.html). - -3. On PCs running Windows 10, version 1703: - 1. Provision the PC using one of these methods: - * [Provision PCs with the Set up School PCs app](use-set-up-school-pcs-app.md) - The usage of this method will automatically set both **SetEduPolicies** to True and **AllowCortana** to False. - * [Provision PCs with a custom package created with Windows Configuration Designer](/windows/configuration/provisioning-packages/provisioning-create-package) - Make sure to set both **SetEduPolicies** to True and **AllowCortana** to False. - 2. Join the PC to Microsoft Entra ID. - * Use Set up School PCs or Windows Configuration Designer to bulk enroll to Microsoft Entra ID. - * Manually Microsoft Entra join the PC during the Windows device setup experience. - 3. Enroll the PCs in MDM. - * If you've activated Intune for Education in your Microsoft Entra tenant, enrollment will happen automatically when the PC is joined to Microsoft Entra ID. Intune for Education will automatically set **SetEduPolicies** to True and **AllowCortana** to False. - 4. Ensure that needed assistive technology apps can be used. - * If you've students or school personnel who rely on assistive technology apps that aren't available in the Microsoft Store, and who are using a Windows 10 S device, configure their device to Windows 10 Pro Education to allow the download and use of non-Microsoft Store assistive technology apps. See [Switch to Windows 10 Pro Education from Windows 10 Pro or Windows 10 S](change-to-pro-education.md) for more info. - -4. Distribute the PCs to students. - - Students sign in with their Azure AD/Office 365 identity, which enables single sign-on to Bing in Microsoft Edge, enabling an ad-free search experience with Bing in Microsoft Edge. - -5. Ongoing management through Intune for Education. - - You can set many policies through Intune for Education, including **SetEduPolicies** and **AllowCortana**, for ongoing management of the PCs. - -## Configuring Windows -You can configure Windows through provisioning or management tools including industry standard MDM. -- Provisioning - A one-time setup process. -- Management - A one-time and/or ongoing management of a PC by setting policies. - -You can set all the education compliance areas through both provisioning and management tools. Additionally, these Microsoft education tools will ensure PCs that you set up are education ready: -- [Set up School PCs](use-set-up-school-pcs-app.md) -- [Intune for Education](/intune-education/available-settings) - -## AllowCortana -**AllowCortana** is a policy that enables or disables Cortana. It's a policy node in the Policy configuration service provider, [AllowCortana](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowcortana). - -> [!NOTE] -> See the [Recommended configuration](#recommended-configuration) section for recommended Cortana settings. - -Use one of these methods to set this policy. - -### MDM -- Intune for Education automatically sets this policy in the **All devices** group policy configuration. -- If you're using an MDM provider other than Intune for Education, check your MDM provider documentation on how to set this policy. - - If your MDM provider doesn't explicitly support this policy, you can manually set this policy if your MDM provider allows specific OMA-URIs to be manually set. - - For example, in Intune, create a new configuration policy and add an OMA-URI. - - OMA-URI: ./Vendor/MSFT/Policy/Config/Experience/AllowCortana - - Data type: Integer - - Value: 0 - -### Group Policy -Set **Computer Configuration > Administrative Templates > Windows Components > Search > AllowCortana** to **Disabled**. - -### Provisioning tools -- [Set up School PCs](use-set-up-school-pcs-app.md) always sets this policy in provisioning packages it creates. -- [Windows Configuration Designer](/windows/configuration/provisioning-packages/provisioning-create-package) - - Under **Runtime settings**, click the **Policies** settings group, set **Experience > Cortana** to **No**. - -## SetEduPolicies -**SetEduPolicies** is a policy that applies a set of configuration behaviors to Windows. It's a policy node in the [SharedPC configuration service provider](/windows/client-management/mdm/sharedpc-csp). - -Use one of these methods to set this policy. - -### MDM -- Intune for Education automatically sets this policy in the **All devices** group policy configuration. -- If you're using an MDM provider other than Intune for Education, check your MDM provider documentation on how to set this policy. - - If your MDM provider doesn't explicitly support this policy, you can manually set this policy if your MDM provider allows specific OMA-URIs to be manually set. - - For example, in Intune, create a new configuration policy and add an OMA-URI. - - OMA-URI: ./Vendor/MSFT/SharedPC/SetEduPolicies - - Data type: Boolean - - Value: true - - ![Create an OMA URI for SetEduPolices.](images/setedupolicies_omauri.png) - -### Group Policy -**SetEduPolicies** isn't natively supported in Group Policy. Instead, use the [MDM Bridge WMI Provider](/windows/win32/dmwmibridgeprov/mdm-bridge-wmi-provider-portal) to set the policy in [MDM SharedPC](/windows/win32/dmwmibridgeprov/mdm-sharedpc). - -For example: - -- Open PowerShell as an administrator and enter the following: - - ``` - $sharedPC = Get-CimInstance -Namespace "root\cimv2\mdm\dmmap" -ClassName "MDM_SharedPC" - - $sharedPC.SetEduPolicies = $True - - Set-CimInstance -CimInstance $sharedPC - - Get-CimInstance -Namespace $namespaceName -ClassName $MDM_SharedPCClass - ``` - -### Provisioning tools -- [Set up School PCs](use-set-up-school-pcs-app.md) always sets this policy in provisioning packages it creates. -- [Windows Configuration Designer](/windows/configuration/provisioning-packages/provisioning-create-package) - - Under **Runtime settings**, click the **SharedPC** settings group, set **PolicyCustomization > SetEduPolicies** to **True**. - - ![Set SetEduPolicies to True in Windows Configuration Designer.](images/wcd/setedupolicies.png) - -## Ad-free search with Bing -Provide an ad-free experience that is a safer, more private search option for K–12 education institutions in the United States. - -### Configurations - - - -#### Microsoft Entra ID and Office 365 Education tenant -To suppress ads when searching with Bing on Microsoft Edge on any network, follow these steps: - -1. Ensure your Office 365 tenant is registered as an education tenant. For more information, see [Verify your Office 365 domain to prove education status](https://support.office.com/article/Verify-your-Office-365-domain-to-prove-ownership-nonprofit-or-education-status-or-to-activate-viva-engage-87d1844e-aa47-4dc0-a61b-1b773fd4e590). -2. Domain join the Windows 10 PCs to your Microsoft Entra tenant (this tenant is the same as your Office 365 tenant). -3. Configure **SetEduPolicies** according to one of the methods described in the previous sections in this topic. -4. Have students sign in with their Microsoft Entra identity, which is the same as your Office 365 identity, to use the PC. -> [!NOTE] -> If you are verifying your Office 365 domain to prove education status (step 1 above), you may need to wait up to 7 days for the ad-free experience to take effect. Microsoft recommends not to roll out the browser to your students until that time. - -#### Office 365 sign-in to Bing -To suppress ads only when the student signs into Bing with their Office 365 account in Microsoft Edge, follow these steps: - -1. Configure **SetEduPolicies** according to one of the methods described in the previous sections in this topic. -2. Have students sign into Bing with their Office 365 account. - - -## Related topics -[Deployment recommendations for school IT administrators](edu-deployment-recommendations.md) diff --git a/education/windows/deploy-windows-10-in-a-school-district.md b/education/windows/deploy-windows-10-in-a-school-district.md deleted file mode 100644 index 43162f541c..0000000000 --- a/education/windows/deploy-windows-10-in-a-school-district.md +++ /dev/null @@ -1,1292 +0,0 @@ ---- -title: Deploy Windows 10 in a school district -description: Learn how to deploy Windows 10 in a school district. Integrate the school environment with Office 365, Active Directory Domain Services (AD DS), and Microsoft Entra ID, use Microsoft Configuration Manager, Intune, and Group Policy to manage devices. -ms.topic: how-to -ms.date: 08/10/2022 -appliesto: - - ✅ Windows 10 ---- - -# Deploy Windows 10 in a school district - -This guide shows you how to deploy the Windows 10 operating system in a school district. You learn how to deploy Windows 10 in classrooms; integrate the school environment with Microsoft Office 365, Active Directory Domain Services (AD DS), and Microsoft Entra ID; and deploy Windows 10 and your apps to new devices or upgrade existing devices to Windows 10. This guide also describes how to use Microsoft Configuration Manager, Microsoft Intune, and Group Policy to manage devices. Finally, the guide discusses common, ongoing maintenance tasks that you'll perform after initial deployment and the automated tools and built-in features of the operating system. - -## Prepare for district deployment - -Proper preparation is essential for a successful district deployment. To avoid common mistakes, your first step is to plan a typical district configuration. As with building a house, you need a blueprint for what your district and individual schools should look like when it’s finished. The second step in preparation is to learn how you'll manage the users, apps, and devices in your district. Just as a builder needs to have the right tools to build a house, you need the right set of tools to deploy your district. - -> [!NOTE] -> This guide focuses on Windows 10 deployment and management in a district. For management of other devices and operating systems in education environments, see [Manage BYOD and corporate-owned devices with MDM solutions](https://www.microsoft.com/cloud-platform/mobile-device-management). - -### Plan a typical district configuration - -As part of preparing for your district deployment, you need to plan your district configuration — the focus of this guide. Figure 1 illustrates a typical finished district configuration that you can use as a model (the blueprint in our builder analogy) for the finished state. - -> [!div class="mx-imgBorder"] -> ![Typical district configuration for this guide.](images/edu-districtdeploy-fig1.png "Typical district configuration for this guide") - -*Figure 1. Typical district configuration for this guide* - -A *district* consists of multiple schools, typically at different physical locations. Figure 2 illustrates a typical school configuration within the district that this guide uses. - -> [!div class="mx-imgBorder"] -> ![Typical school configuration for this guide.](images/edu-districtdeploy-fig2.png "Typical school configuration for this guide") - -*Figure 2. Typical school configuration for this guide* - -Finally, each school consists of multiple classrooms. Figure 3 shows the classroom configuration this guide uses. - -> [!div class="mx-imgBorder"] -> ![Typical classroom configuration in a school.](images/edu-districtdeploy-fig3.png "Typical classroom configuration in a school") - -*Figure 3. Typical classroom configuration in a school* - -This district configuration has the following characteristics: - -* It contains one or more admin devices. - -* It contains two or more schools. - -* Each school contains two or more classrooms. - -* Each classroom contains one teacher device. - -* The classrooms connect to each other through multiple subnets. - -* All devices in each classroom connect to a single subnet. - -* All devices have high-speed, persistent connections to each other and to the Internet. - -* All teachers and students have access to Microsoft Store or Microsoft Store for Business. - -* You install a 64-bit version of Windows 10 on the admin device. - -* You install the Windows Assessment and Deployment Kit (Windows ADK) on the admin device. - -* You install the 64-bit version of the Microsoft Deployment Toolkit (MDT) 2013 Update 2 on the admin device. - - > [!NOTE] - > In this guide, all references to MDT refer to the 64-bit version of MDT 2013 Update 2. - -* The devices use Microsoft Entra ID in Office 365 Education for identity management. - -* If you've on-premises AD DS, you can [integrate Microsoft Entra ID with on-premises AD DS](/azure/active-directory/hybrid/whatis-hybrid-identity). - -* Use [Intune](/intune/), [Mobile Device Management for Office 365](/microsoft-365/admin/basic-mobility-security/set-up), or [Group Policy in AD DS](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc725828(v=ws.10)) to manage devices. - -* Each device supports a one-student-per-device or multiple-students-per-device scenario. - -* The devices can be a mixture of different make, model, and processor architecture (32-bit or 64-bit) or be identical. - -* To initiate Windows 10 deployment, use a USB flash drive, DVD-ROM or CD-ROM, or Pre-Boot Execution Environment (PXE) boot. - -* The devices can be a mixture of different Windows 10 editions, such as Windows 10 Pro, Windows 10 Enterprise, or Windows 10 Education. - -Use these characteristics at a minimum as you deploy your schools. If your district deployment is less complex, you may want to review the guidance in [Deploy Windows 10 in a school](./deploy-windows-10-in-a-school.md). - -> [!NOTE] -> This guide focuses on Intune as the mobile device management (MDM) solution. If you want to use an MDM solution other than Intune, ignore the Intune-specific content in this guide. For each section, contact your MDM provider to determine the features and management capabilities for your institution. - -Office 365 Education allows: - -* Students and faculty to use Microsoft Office to create and edit Microsoft Word, OneNote, PowerPoint, and Excel documents in a browser. - -* Teachers to use the [OneNote Class Notebook app](https://www.onenote.com/classnotebook) to share content and collaborate with students. - -* Faculty to use the [OneNote Staff Notebooks app](https://www.onenote.com/staffnotebookedu) to collaborate with other teachers, the administration, and faculty. - -* Teachers to employ Sway to create interactive educational digital storytelling. - -* Students and faculty to use email and calendars, with mailboxes up to 50 GB per user. - -* Faculty to use advanced email features like email archiving and legal hold capabilities. - -* Faculty to help prevent unauthorized users from accessing documents and email by using Microsoft Azure Rights Management. - -* Faculty to use advanced compliance tools on the unified eDiscovery pages in the Microsoft Purview compliance portal. - -* Faculty to host online classes, parent–teacher conferences, and other collaboration in Skype for Business. - -* Students and faculty to access up to 1 TB of personal cloud storage that users inside and outside the educational institution can share through OneDrive for Business. - -* Teachers to provide collaboration in the classroom through Microsoft SharePoint Online team sites. - -* Students and faculty to use Office 365 Video to manage videos. - -* Students and faculty to use Viva Engage to collaborate through private social networking. - -* Students and faculty to access classroom resources from anywhere on any device (including iOS and Android devices). - -For more information about Office 365 Education features and an FAQ, go to [Office 365 Education plans and pricing](https://www.microsoft.com/microsoft-365/academic/compare-office-365-education-plans). - -### How to configure a district - -Now that you've the plan (blueprint) for your district and individual schools and classrooms, you’re ready to learn about the tools you'll use to deploy it. There are many tools you could use to accomplish the task, but this guide focuses on using those tools that require the least infrastructure and technical knowledge. - -The primary tool you'll use to deploy Windows 10 in your school is MDT, which uses Windows ADK components to make deployment easier. You could just use the Windows ADK to perform your deployment, but MDT simplifies the process by providing an intuitive, wizard-driven user interface (UI). - -You can use MDT as a stand-alone tool or integrate it with Microsoft Configuration Manager. As a stand-alone tool, MDT performs Lite Touch Installation (LTI) deployments—deployments that require minimal infrastructure and allow you to control the level of automation. When integrated with Configuration Manager, MDT performs Zero Touch Installation (ZTI) deployments, which require more infrastructure (such as Configuration Manager) but result in fully automated deployments. - -This guide focuses on LTI deployments to deploy the reference device. You can use ZTI deployments with Configuration Manager or LTI deployments to deploy the reference images to your faculty and student devices. If you want to only use MDT, see [Deploy Windows 10 in a school](./deploy-windows-10-in-a-school.md). - -MDT includes the Deployment Workbench, a console from which you can manage the deployment of Windows 10 and your apps. You configure the deployment process in the Deployment Workbench, including the management of operating systems, device drivers, apps, and migration of user settings on existing devices. - -LTI performs deployment from a *deployment share* — a network-shared folder on the device on which you installed MDT. You can perform over-the-network deployments from the deployment share or perform deployments from a local copy of the deployment share on a USB drive or DVD. You'll learn more about MDT in [Prepare the admin device](#prepare-the-admin-device), earlier in this article. - -The focus of MDT is deployment, so you also need tools that help you manage your Windows 10 devices and apps. You can manage Windows 10 devices and apps with Intune, the Compliance Management feature in Office 365, or Group Policy in AD DS. You can use any combination of these tools based on your school requirements. - -ZTI performs fully automated deployments using Configuration Manager and MDT. Although you could use Configuration Manager by itself, using Configuration Manager with MDT provides an easier process for deploying operating systems. MDT works with the operating system deployment feature in Configuration Manager. - -The configuration process requires the following devices: - -* **Admin device.** This device is the one you use for your day-to-day job functions. It’s also the one you use to create and manage the Windows 10 and app deployment process. You install the Windows ADK, MDT, and the Configuration Manager Console on this device. - -* **Reference devices.** These devices are the ones that you'll use as a template for the faculty and student devices. You install Windows 10 and Windows desktop apps on these devices, and then capture an image (.wim file) of the devices. - - You'll have a reference device for each type of device in your district. For example, if your district has Surface, HP Stream, Dell Inspiron, and Lenovo Yoga devices, then you would have a reference device for each model. For more information about approved Windows 10 devices, see [Explore devices](https://www.microsoft.com/windows/view-all). - -* **Faculty and staff devices.** These devices are the ones that the teachers, faculty, and staff use for their day-to-day job functions. You use the admin device to deploy (or upgrade) Windows 10 and apps to these devices. - -* **Student devices.** The students will use these devices. You'll use the admin device deploy (or upgrade) Windows 10 and apps to them. - -The high-level process for deploying and configuring devices within individual classrooms, individual schools, and the district as a whole is as follows and illustrated in Figure 4: - -1. Prepare the admin device for use, which includes installing the Windows ADK, MDT, and the Configuration Manager console. - -2. On the admin device, create and configure the Office 365 Education subscription that you'll use for the district’s classrooms. - -3. On the admin device, configure integration between on-premises AD DS and Microsoft Entra ID (if you've an on premises AD DS configuration). - -4. On the admin device, create and configure a Microsoft Store for Business portal. - -5. On the admin device, prepare for management of the Windows 10 devices after deployment. - -6. On the reference devices, deploy Windows 10 and the Windows desktop apps on the device, and then capture the reference image from the devices. - -7. Import the captured reference images into MDT or Microsoft Configuration Manager. - -8. On the student and faculty devices, deploy Windows 10 to new or existing devices, or upgrade eligible devices to Windows 10. - -9. On the admin device, manage the Windows 10 devices and apps, the Office 365 subscription, and the AD DS–Microsoft Entra integration. - -> [!div class="mx-imgBorder"] -> ![How district configuration works.](images/edu-districtdeploy-fig4.png "How district configuration works") - -*Figure 4. How district configuration works* - -Each step illustrated in Figure 4 directly corresponds to the remaining high-level sections in this guide. - -#### Summary - -In this district, you looked at the final configuration of your individual classrooms, individual schools, and the district as a whole upon completion of this guide. You also learned the high-level steps for deploying the faculty and student devices in your district. - -## Select deployment and management methods - -Now that you know what a typical district looks like and how to configure the devices in your district, you need to make a few decisions. You must select the methods you’ll use to deploy Windows 10 to the faculty and student devices in your district. Next, you must select the method you’ll use to manage configuration settings for your users and devices. Finally, you must select the method you’ll use to manage Windows desktop apps, Microsoft Store apps, and software updates. - -### Typical deployment and management scenarios - -Before you select the deployment and management methods, you need to review the typical deployment and management scenarios (the cloud-centric scenario and the on-premises and cloud scenario). Table 1 lists the scenario feature and the corresponding products and technologies for that feature in each scenario. - -|Scenario feature |Cloud-centric|On-premises and cloud| -|---|---|---| -|Identity management | Microsoft Entra ID (stand-alone or integrated with on-premises AD DS) | AD DS integrated with Microsoft Entra ID | -|Windows 10 deployment | MDT only | Microsoft Configuration Manager with MDT | -|Configuration setting management | Intune | Group Policy

                        Intune| -|App and update management | Intune |Microsoft Configuration Manager

                        Intune| - -*Table 1. Deployment and management scenarios* - -These scenarios assume the need to support: - -* Institution-owned and personal devices. -* AD DS domain-joined and nondomain-joined devices. - -Some constraints exist in these scenarios. As you select the deployment and management methods for your device, keep the following constraints in mind: - -* You can use Group Policy or Intune to manage configuration settings on a device but not both. -* You can use Configuration Manager or Intune to manage apps and updates on a device but not both. -* You can't manage multiple users on a device with Intune if the device is AD DS domain joined. - -Use the cloud-centric scenario and on-premises and cloud scenario as a guide for your district. You may need to customize these scenarios, however, based on your district. As you go through the [Select the deployment methods](#select-the-deployment-methods), [Select the configuration setting management methods](#select-the-configuration-setting-management-methods), and the [Select the app and update management products](#select-the-app-and-update-management-products) sections, remember these scenarios and use them as the basis for your district. - -### Select the deployment methods - -To deploy Windows 10 and your apps, you can use MDT by itself or Microsoft Configuration Manager and MDT together. For a district, there are a few ways to deploy Windows 10 to devices. Table 2 lists the methods that this guide describes and recommends. Use this information to determine which combination of deployment methods is right for your institution. - -|Method|Description| -|--- |--- | -|MDT|MDT is an on-premises solution that supports initial operating system deployment and upgrade. You can use MDT to deploy and upgrade Windows 10. In addition, you can initially deploy Windows desktop and Microsoft Store apps and software updates.
                        Select this method when you:
                      • Want to deploy Windows 10 to institution-owned and personal devices. (Devices need not be domain joined.)
                      • Don’t have an existing AD DS infrastructure.
                      • Need to manage devices regardless of where they are (on or off premises).
                        The advantages of this method are that:
                      • You can deploy Windows 10 operating systems
                      • You can manage device drivers during initial deployment.
                      • You can deploy Windows desktop apps (during initial deployment)
                      • It doesn’t require an AD DS infrastructure.
                      • It doesn’t have extra infrastructure requirements.
                      • MDT doesn’t incur extra cost: it’s a free tool.
                      • You can deploy Windows 10 operating systems to institution-owned and personal devices.
                        The disadvantages of this method are that it:
                      • Can’t manage applications throughout entire application life cycle (by itself).
                      • Can’t manage software updates for Windows 10 and apps (by itself).
                      • Doesn’t provide antivirus and malware protection (by itself).
                      • Has limited scaling to large numbers of users and devices.| -|Microsoft Configuration Manager|
                      • Configuration Manager is an on-premises solution that supports operating system management throughout the entire operating system life cycle
                      • You can use Configuration Manager to deploy and upgrade Windows 10. In addition, you can manage Windows desktop and Microsoft Store apps and software updates as well as provide antivirus and antimalware protection.
                        Select this method when you:
                      • Want to deploy Windows 10 to institution-owned devices that are domain joined (personal devices are typically not domain joined).
                      • Have an existing AD DS infrastructure (or plan to deploy an AD DS infrastructure).
                      • Typically deploy Windows 10 to on-premises devices.
                        The advantages of this method are that:
                      • You can deploy Windows 10 operating systems.
                      • You can manage (deploy) Windows desktop and Microsoft Store apps throughout entire application life cycle.
                      • You can manage software updates for Windows 10 and apps.
                      • You can manage antivirus and malware protection.
                      • It scales to large number of users and devices.
                        The disadvantages of this method are that it:
                      • Carries an extra cost for Microsoft Configuration Manager server licenses (if the institution doesn't have Configuration Manager already).
                      • Can deploy Windows 10 only to domain-joined (institution-owned devices).
                      • Requires an AD DS infrastructure (if the institution doesn't have AD DS already).| - -*Table 2. Deployment methods* - -Record the deployment methods you selected in Table 3. - -|Selection | Deployment method| -|--------- | -----------------| -| |MDT by itself | -| |Microsoft Configuration Manager and MDT| - -*Table 3. Deployment methods selected* - -### Select the configuration setting management methods - -If you've only one device to configure, manually configuring that one device is tedious but possible. When you've multiple classrooms of devices to configure, however, manually configuring each device becomes overwhelming. In addition, maintaining an identical configuration on every device will become impossible as the number of devices in the district increases. - -For a district, there are many ways to manage the configuration setting for users and devices. Table 4 lists the methods that this guide describes and recommends. Use this information to determine which combination of configuration setting management methods is right for your institution. - -|Method|Description| -|--- |--- | -|Group Policy|Group Policy is an integral part of AD DS and allows you to specify configuration settings for Windows 10 and previous versions of Windows.
                        Select this method when you
                      • Want to manage institution-owned devices that are domain joined (personal devices are typically not domain joined).
                      • Want more granular control of device and user settings.
                      • Have an existing AD DS infrastructure.
                      • Typically manage on-premises devices.
                      • Can manage a required setting only by using Group Policy.
                        The advantages of this method include:
                      • No cost beyond the AD DS infrastructure.
                      • A larger number of settings (compared to Intune).
                        The disadvantages of this method are that it:
                      • Can only manage domain-joined (institution-owned devices).
                      • Requires an AD DS infrastructure (if the institution doesn't have AD DS already).
                      • Typically manages on-premises devices (unless devices use a virtual private network [VPN] or Microsoft DirectAccess to connect).
                      • Has rudimentary app management capabilities.
                      • can't deploy Windows 10 operating systems.| -|Intune|Intune is a cloud-based management system that allows you to specify configuration settings for Windows 10, previous versions of Windows, and other operating systems (such as iOS or Android). Intune is a subscription-based cloud service that integrates with Office 365 and Microsoft Entra ID.
                        Intune is the cloud-based management system described in this guide, but you can use other MDM providers. If you use an MDM provider other than Intune, integration with Configuration Manager is unavailable.
                        Select this method when you:
                      • Want to manage institution-owned and personal devices (doesn't require that the device be domain joined).
                      • Don’t need granular control over device and user settings (compared to Group Policy).
                      • Don’t have an existing AD DS infrastructure.
                      • Need to manage devices regardless of where they are (on or off premises).
                      • Want to provide application management for the entire application life cycle.
                      • Can manage a required setting only by using Intune.
                        The advantages of this method are that:
                      • You can manage institution-owned and personal devices.
                      • It doesn’t require that devices be domain joined.
                      • It doesn’t require any on-premises infrastructure.
                      • It can manage devices regardless of their location (on or off premises).
                        The disadvantages of this method are that it:
                      • Carries an extra cost for Intune subscription licenses.
                      • Doesn’t offer granular control over device and user settings (compared to Group Policy).
                      • can't deploy Windows 10 operating systems.| - -*Table 4. Configuration setting management methods* - -Record the configuration setting management methods you selected in Table 5. Although you can use both Group Policy and Intune to manage devices, to manage a device, you must choose either Group Policy or Intune (but not both). - -|Selection |Configuration setting management method | -|----------|--------------| -| |Group Policy | -| |Intune | - -*Table 5. Configuration setting management methods selected* - -#### Select the app and update management products - -For a district, there are many ways to manage apps and software updates. Table 6 lists the products that this guide describes and recommends. Although you could manage updates by using [Windows Updates or Windows Server Update Services (WSUS)](/windows/deployment/deploy-whats-new), you still need to Configuration Manager or Intune to manage apps. Therefore, it only makes sense to use one or both of these tools for update management. - -Use the information in Table 6 to determine which combination of app and update management products is right for your district. - -|Selection|Management method| -|--- |--- | -|Microsoft Configuration Manager|Configuration Manager is an on-premises solution that allows you to specify configuration settings for Windows 10; previous versions of Windows; and other operating systems, such as iOS or Android, through integration with Intune.Configuration Manager supports application management throughout the entire application life cycle. You can deploy, upgrade, manage multiple versions, and retire applications by using Configuration Manager. You can also manage Windows desktop and Microsoft Store applications. Select this method when you:
                      • Selected Configuration Manager to deploy Windows 10.
                      • Want to manage institution-owned devices that are domain joined (personally owned devices are typically not domain joined).
                      • Want to manage AD DS domain-joined devices.
                      • Have an existing AD DS infrastructure.
                      • Typically manage on-premises devices.
                      • Want to deploy operating systems.
                      • Want to provide application management for the entire application life cycle.
                        The advantages of this method are that:
                      • You can deploy Windows 10 operating systems.
                      • You can manage applications throughout the entire application life cycle.
                      • You can manage software updates for Windows 10 and apps.
                      • You can manage antivirus and malware protection.
                      • It scales to large numbers of users and devices.
                        The disadvantages of this method are that it:
                      • Carries an extra cost for Configuration Manager server licenses (if the institution doesn't have Configuration Manager already).
                      • Carries an extra cost for Windows Server licenses and the corresponding server hardware.
                      • Can only manage domain-joined (institution-owned devices).
                      • Requires an AD DS infrastructure (if the institution doesn't have AD DS already).
                      • Typically manages on-premises devices (unless devices through VPN or DirectAccess).| -|Intune|Intune is a cloud-based solution that allows you to manage apps and software updates for Windows 10, previous versions of Windows, and other operating systems (such as iOS or Android). Intune is a subscription-based cloud service that integrates with Office 365 and Microsoft Entra ID.
                        Select this method when you:
                      • Selected MDT only to deploy Windows 10.
                      • Want to manage institution-owned and personal devices that aren't domain joined.
                      • Want to manage Microsoft Entra domain-joined devices.
                      • Need to manage devices regardless of where they are (on or off premises).
                      • Want to provide application management for the entire application life cycle.
                        The advantages of this method are that:
                      • You can manage institution-owned and personal devices.
                      • It doesn’t require that devices be domain joined.
                      • It doesn’t require on-premises infrastructure.vIt can manage devices regardless of their location (on or off premises).
                      • You can deploy keys to perform in-place Windows 10 upgrades (such as upgrading from Windows 10 Pro to Windows 10 Education edition).
                        The disadvantages of this method are that it:
                      • Carries an extra cost for Intune subscription licenses.
                      • can't deploy Windows 10 operating systems.| -|Microsoft Configuration Manager and Intune (hybrid)|Configuration Manager and Intune together extend Configuration Manager from an on-premises management system for domain-joined devices to a solution that can manage devices regardless of their location and connectivity options. This hybrid option provides the benefits of both Configuration Manager and Intune.

                        Configuration Manager and Intune in the hybrid configuration allows you to support application management throughout the entire application life cycle. You can deploy, upgrade, manage multiple versions, and retire applications by using Configuration Manager, and you can manage Windows desktop and Microsoft Store applications for both institution-owned and personal devices.

                        Select this method when you:
                      • Selected Microsoft Configuration Manager to deploy Windows 10.
                      • Want to manage institution-owned and personal devices (doesn't require that the device be domain joined).
                      • Want to manage domain-joined devices.
                      • Want to manage Microsoft Entra domain-joined devices.
                      • Have an existing AD DS infrastructure.
                      • Want to manage devices regardless of their connectivity.vWant to deploy operating systems.
                      • Want to provide application management for the entire application life cycle.

                        The advantages of this method are that:
                      • You can deploy operating systems.
                      • You can manage applications throughout the entire application life cycle.
                      • You can scale to large numbers of users and devices.
                      • You can support institution-owned and personal devices.
                      • It doesn’t require that devices be domain joined.
                      • It can manage devices regardless of their location (on or off premises).

                        The disadvantages of this method are that it:
                      • Carries an extra cost for Configuration Manager server licenses (if the institution doesn't have Configuration Manager already).
                      • Carries an extra cost for Windows Server licenses and the corresponding server hardware.
                      • Carries an extra cost for Intune subscription licenses.
                      • Requires an AD DS infrastructure (if the institution doesn't have AD DS already).| - -*Table 6. App and update management products* - -Record the app and update management methods that you selected in Table 7. - -|Selection | Management method| -|----------|------------------| -| |Microsoft Configuration Manager by itself| -| |Intune by itself| -| |Microsoft Configuration Manager and Intune (hybrid mode)| - -*Table 7. App and update management methods selected* - -#### Summary -In this section, you selected the methods that you'll use to deploy Windows 10 to the faculty and student devices in your district. You selected the methods that you'll use to manage configuration settings. Finally, you selected the methods that you'll use to manage Windows desktop apps, Microsoft Store apps, and software updates. - -## Prepare the admin device - -Now, you’re ready to prepare the admin device for use in the district. This process includes installing the Windows ADK, installing MDT, creating the MDT deployment share, installing the Configuration Manager console, and configuring Configuration Manager console integration. - -### Install the Windows ADK - -The first step in preparing the admin device is to install the Windows ADK. The Windows ADK contains the deployment tools that MDT uses, including the Windows Preinstallation Environment (Windows PE), the Windows User State Migration Tool (USMT), and Deployment Image Servicing and Management. - -When you install the Windows ADK on the admin device, select the following features: -* Deployment Tools -* Windows PE -* USMT - -For more information about installing the Windows ADK, see [Step 2-2: Install Windows ADK](/mem/configmgr/mdt/lite-touch-installation-guide#InstallWindowsADK). - -### Install MDT - -Next, install MDT. MDT uses the Windows ADK to help you manage and perform Windows 10 and app deployment. It's a free tool available directly from Microsoft. -You can use MDT to deploy 32-bit or 64-bit versions of Windows 10. Install the 64-bit version of MDT to support deployment of 32-bit and 64-bit operating systems. - -> [!NOTE] -> If you install the 32-bit version of MDT, you can install only 32-bit versions of Windows 10. Ensure that you download and install the 64-bit version of MDT so that you can install 64-bit and 32-bit versions of the operating system. - -For more information about installing MDT on the admin device, see [Installing a New Instance of MDT](/mem/configmgr/mdt/use-the-mdt#InstallingaNewInstanceofMDT). - -Now, you’re ready to create the MDT deployment share and populate it with the operating system, apps, and device drivers you want to deploy to your devices. - -### Create a deployment share - -MDT includes the Deployment Workbench, a graphical UI that you can use to manage MDT deployment shares. A *deployment share* is a shared folder that contains all the MDT deployment content. The LTI Deployment Wizard accesses the deployment content over the network or from a local copy of the deployment share (known as MDT *deployment media*). - -For more information about how to create a deployment share, see [Step 3-1: Create an MDT Deployment Share](/mem/configmgr/mdt/lite-touch-installation-guide#CreateMDTDeployShare). - -### Install the Configuration Manager console - -> [!NOTE] -> If you selected Microsoft Configuration Manager to deploy Windows 10 or manage your devices (in the [Select the deployment methods](#select-the-deployment-methods) and [Select the configuration setting management methods](#select-the-configuration-setting-management-methods) sections, respectively), perform the steps in this section. Otherwise, skip this section and continue to the next. - -You can use Configuration Manager to manage Windows 10 deployments, Windows desktop apps, Microsoft Store apps, and software updates. To manage Configuration Manager, you use the Configuration Manager console. You must install the Configuration Manager console on every device you use to manage Configuration Manager (specifically, the admin device). The Configuration Manager console is automatically installed when you install Configuration Manager primary site servers. - -For more information about how to install the Configuration Manager console, see [Install Microsoft Configuration Manager consoles](/mem/configmgr/core/servers/deploy/install/installing-sites#bkmk_InstallConsole). - -### Configure MDT integration with the Configuration Manager console - -> [!NOTE] -> If you selected MDT only to deploy Windows 10 and your apps (and not Microsoft Configuration Manager) in [Select the deployment methods](#select-the-deployment-methods), earlier in this article, then skip this section and continue to the next. - -You can use MDT with Configuration Manager to make ZTI operating system deployment easier. To configure MDT integration with Configuration Manager, run the Configure ConfigMgr Integration Wizard. This wizard is installed when you install MDT. - -In addition to the admin device, run the Configure ConfigMgr Integration Wizard on each device that runs the Configuration Manager console to ensure that all Configuration Manager console installation can use the power of MDT–Configuration Manager integration. - -For more information, see [Enable Configuration Manager Console Integration for Configuration Manager](/mem/configmgr/mdt/use-the-mdt#EnableConfigurationManagerConsoleIntegrationforConfigurationManager). - -#### Summary - -In this section, you installed the Windows ADK and MDT on the admin device. You also created the MDT deployment share that you'll configure and use later to capture a reference image. You can also use the MDT deployment share to deploy Windows 10 and your apps to faculty and students (if that’s the method you selected in [Select the deployment methods](#select-the-deployment-methods), earlier in this article). Finally, you installed the Configuration Manager console and configured MDT integration with the Configuration Manager console. - -## Create and configure Office 365 - -Office 365 is one of the core components of your classroom environment. You create and manage student identities in Office 365, and students and teachers use the suite as their email, contacts, and calendar system. They also use Office 365 collaboration features such as SharePoint, OneNote, and OneDrive for Business. - -As a first step in deploying your classroom, create an Office 365 Education subscription, and then configure Office 365 for the classroom. For more information about Office 365 Education deployment, see [School deployment of Office 365 Education](https://www.microsoft.com/education/products/office-365-deployment-resources/default.aspx). - -### Select the appropriate Office 365 Education license plan - -Complete the following steps to select the appropriate Office 365 Education license plan for your school: - -1. Determine the number of faculty members and students who will use the classroom. Office 365 Education licensing plans are available specifically for faculty and students. You must assign faculty and students the correct licensing plan.
                      • - -2. Determine the faculty members and students who need to install Microsoft Office applications on devices (if any). Faculty and students can use Office applications online (standard plans) or run them locally (Microsoft 365 Apps for enterprise plans). Table 8 lists the advantages and disadvantages of standard and Microsoft 365 Apps for enterprise plans. - - |Plan |Advantages |Disadvantages | - |----- |----------- |------------- | - |Office 365 Education |
                        • Less expensive than Microsoft 365 Apps for enterprise
                        • Can be run from any device
                        • No installation necessary
                        |
                        • Must have an Internet connection to use it
                        • Doesn't support all the features found in Microsoft 365 Apps for enterprise
                        | - |Microsoft 365 Apps for enterprise |
                        • Only requires an Internet connection every 30 days (for activation)
                        • Supports the full set of Office features
                        • Can be installed on five devices per user (there's no limit to the number of devices on which you can run Office apps online)
                        |
                        • Requires installation
                        • More expensive than Office 365 Education
                        | - - *Table 8. Comparison of standard and Microsoft 365 Apps for enterprise plans* - - The best user experience is to run Microsoft 365 Apps for enterprise or use native Office apps on mobile devices. If neither of these options is available, use Office applications online. In addition, all Office 365 plans provide a better user experience by storing documents in OneDrive for Business, which is included in all Office 365 plans. OneDrive for Business keeps content in sync among devices and helps ensure that users always have access to their documents on any device. - -3. Determine whether students or faculty need Azure Rights Management. - - You can use Azure Rights Management to protect classroom information against unauthorized access. Azure Rights Management protects your information inside or outside the classroom through encryption, identity, and authorization policies, securing your files and email. You can retain control of the information, even when it’s shared with people outside the classroom or your educational institution. Azure Rights Management is free to use with all Office 365 Education license plans. For more information, see [Azure Rights Management Documentation](/rights-management/). - -4. Record the Office 365 Education license plans needed for the classroom in Table 9. - - |Quantity |Plan | - |---------|-----| - | |Office 365 Education for students| - | |Office 365 Education for faculty| - | |Azure Rights Management for students| - | |Azure Rights Management for faculty| - - *Table 9. Office 365 Education license plans needed for the classroom* - -You'll use the Office 365 Education license plan information you record in Table 9 in [Create user accounts in Office 365](#create-user-accounts-in-office-365) later in this guide. - -### Create a new Office 365 Education subscription - -To create a new Office 365 Education subscription for use in the classroom, use your educational institution’s email account. There are no costs to you or to students for signing up for Office 365 Education subscriptions. - -> [!NOTE] -> If you already have an Office 365 Education subscription, you can use that subscription and continue to the next section, [Create user accounts in Office 365](#create-user-accounts-in-office-365). - -#### To create a new Office 365 subscription - -1. In Microsoft Edge or Internet Explorer, type `https://portal.office.com/start?sku=faculty` in the address bar. - - > [!NOTE] - > If you've already used your current sign-in account to create a new Office 365 subscription, you'll be prompted to sign in. If you want to create a new Office 365 subscription, start an In-Private Window by using one of the following methods: - > - > - In Microsoft Edge, open the Microsoft Edge app (press Ctrl+Shift+P, or click or tap More actions), and then click or tap New InPrivate window. - > - > - In Internet Explorer 11, open Internet Explorer 11 (press Ctrl+Shift+P, or click or tap Settings), click or tap Safety, and then click or tap InPrivate Browsing. - - -2. On the **Get started** page, in **Enter your school email address**, type your school email address, and then click **Sign up**. - - You'll receive an email in your school email account. -3. Click the hyperlink in the email in your school email account. - -4. On the **One last thing** page, complete your user information, and then click **Start**. - - -The wizard creates your new Office 365 Education subscription, and you’re automatically signed in as the administrative user you specified when you created the subscription. - -### Add domains and subdomains - -Now that you've created your new Office 365 Education subscription, add the domains and subdomains that your institution uses. For example, if your institution has contoso.edu as the primary domain name but you've subdomains for students or faculty (such as students.contoso.edu and faculty.contoso.edu), then you need to add the subdomains. - -#### To add more domains and subdomains - -1. In the admin center, in the list view, click **DOMAINS**. - -2. In the details pane, above the list of domains, on the menu bar, click **Add domain**. - -3. In the Add a New Domain in Office 365 Wizard, on the **Verify domain** wizard page, click **Let’s get started**. - -4. On the **Verify domain** wizard page, in **Enter a domain you already own**, type your domain name, and then click **Next**. - -5. Sign in to your domain name management provider (for example, Network Solutions or GoDaddy), and then complete the steps for your provider. - -6. Repeat these steps for each domain and subdomain you want faculty and students to use for your institution. - -### Configure automatic tenant join - -To make it easier for faculty and students to join your Office 365 Education subscription (or *tenant*), allow them to automatically sign up to your tenant (*automatic tenant join*). In automatic tenant join, when a faculty member or student signs up for Office 365, Office 365 automatically adds (joins) the user to your Office 365 tenant. - -> [!NOTE] -> By default, automatic tenant join is enabled in Office 365 Education, with the exception of certain areas in Europe, the Middle East, and Africa. These countries/regions require opt-in steps to add new users to existing Office 365 tenants. Check your country/region requirements to determine the automatic tenant join default configuration. Also, if you use Microsoft Entra Connect, then automatic tenant join is disabled. For more information, see [Office 365 Education Self-Sign up FAQ](/microsoft-365/education/deploy/office-365-education-self-sign-up). - -Office 365 uses the domain portion of the user’s email address to know which Office 365 tenant to join. For example, if a faculty member or student provides an email address of user@contoso.edu, then Office 365 automatically performs one of the following tasks: - -* If an Office 365 tenant with that domain name (contoso.edu) exists, Office 365 automatically adds the user to that tenant. -* If an Office 365 tenant with that domain name (contoso.edu) doesn't exist, Office 365 automatically creates a new Office 365 tenant with that domain name and adds the user to it. - -You'll always want faculty and students to join the Office 365 tenant that you created. Ensure that you perform the steps in the [Create a new Office 365 Education subscription](#create-a-new-office-365-education-subscription) and [Add domains and subdomains](#add-domains-and-subdomains) sections before you allow other faculty and students to join Office 365. - -> [!NOTE] -> You can't merge multiple tenants, so any faculty or students who create their own tenant will need to abandon their existing tenant and join yours. - -By default, all new Office 365 Education subscriptions have automatic tenant join enabled, but you can enable or disable automatic tenant join by using the Windows PowerShell commands in Table 10. For more information about how to run these commands, see [How can I prevent students from joining my existing Office 365 tenant](/microsoft-365/education/deploy/office-365-education-self-sign-up). - -|Action |Windows PowerShell command| -|-------|--------------------------| -|Enable |`Set-MsolCompanySettings -AllowEmailVerifiedUsers $true` | -|Disable |`Set-MsolCompanySettings -AllowEmailVerifiedUsers $false` | - -*Table 10. Windows PowerShell commands to enable or disable automatic tenant join* - -> [!NOTE] -> If your institution has AD DS, then disable automatic tenant join. Instead, use Microsoft Entra integration with AD DS to add users to your Office 365 tenant. - -### Disable automatic licensing - -To reduce your administrative effort, automatically assign Office 365 Education or Office 365 Education Plus licenses to faculty and students when they sign up (automatic licensing). Automatic licensing also enables Office 365 Education or Office 365 Education Plus features that don't require administrative approval. - -> [!NOTE] -> By default, automatic licensing is enabled in Office 365 Education. If you want to use automatic licensing, then skip this section and go to the next section. - -Although all new Office 365 Education subscriptions have automatic licensing enabled by default, you can enable or disable it for your Office 365 tenant by using the Windows PowerShell commands in Table 11. For more information about how to run these commands, see [How can I prevent students from joining my existing Office 365 tenant](/microsoft-365/education/deploy/office-365-education-self-sign-up). - -|Action |Windows PowerShell command| -|-------|--------------------------| -|Enable |`Set-MsolCompanySettings -AllowAdHocSubscriptions $true` | -|Disable|`Set-MsolCompanySettings -AllowAdHocSubscriptions $false`| - -*Table 11. Windows PowerShell commands to enable or disable automatic licensing* - - - -### Enable Microsoft Entra ID P1 or P2 - -When you create your Office 365 subscription, you create an Office 365 tenant that includes a Microsoft Entra directory, the centralized repository for all your student and faculty accounts in Office 365, Intune, and other Microsoft Entra integrated apps. Microsoft Entra ID is available in Free, Basic, and Premium editions. Microsoft Entra ID Free, which is included in Office 365 Education, has fewer features than Microsoft Entra Basic, which in turn has fewer features than Microsoft Entra ID P1 or P2. - -Educational institutions can obtain Microsoft Entra Basic edition licenses at no cost if they have a volume license agreement. After your institution obtains its licenses, activate your Microsoft Entra ID access by completing the steps in [Step 3: Activate your Microsoft Entra ID access](/azure/active-directory/fundamentals/active-directory-get-started-premium#step-3-activate-your-azure-active-directory-access). - -The following Microsoft Entra ID P1 or P2 features aren't in Microsoft Entra Basic: - -* Allow designated users to manage group membership -* Dynamic group membership based on user metadata -* Microsoft Entra multifactor authentication (MFA; see [What is Microsoft Entra multifactor authentication](/azure/active-directory/authentication/concept-mfa-howitworks)) -* Identify cloud apps that your users run -* Self-service recovery of BitLocker -* Add local administrator accounts to Windows 10 devices -* Microsoft Entra Connect Health monitoring -* Extended reporting capabilities - -You can assign Microsoft Entra ID P1 or P2 licenses to the users who need these features. For example, you may want the users who have access to confidential student information to use MFA. In this example, you could assign Microsoft Entra ID P1 or P2 to only those users. - -You can sign up for Microsoft Entra ID P1 or P2, and then assign licenses to users. In this section, you sign up for Microsoft Entra ID P1 or P2. You'll assign Microsoft Entra ID P1 or P2 licenses to users later in the deployment process. - -For more information about: - -* Microsoft Entra editions and the features in each, see [Microsoft Entra editions](/azure/active-directory/fundamentals/active-directory-whatis). -* How to enable Microsoft Entra ID P1 or P2, see [Associate a Microsoft Entra directory with a new Azure subscription](/previous-versions/azure/azure-services/jj573650(v=azure.100)#create_tenant3). - -#### Summary - -You provision and initially configure Office 365 Education as part of initial configuration. With the subscription in place, automatic tenant join configured, automatic licensing established, and Microsoft Entra ID P1 or P2 enabled (if necessary), you’re ready to select the method you'll use to create user accounts in Office 365. - -## Select an Office 365 user account–creation method - -Now that you've an Office 365 subscription, you must determine how you’ll create your Office 365 user accounts. Use one of the following methods to make your decision: - -* Method 1: Automatically synchronize your on-premises AD DS domain with Microsoft Entra ID. Select this method if you've an on-premises AD DS domain. -* Method 2: Bulk-import the user accounts from a .csv file (based on information from other sources) into Microsoft Entra ID. Select this method if you don’t have an on-premises AD DS domain. - - - -### Method 1: Automatic synchronization between AD DS and Microsoft Entra ID - -In this method, you've an on-premises AD DS domain. As shown in Figure 5, the Microsoft Entra Connector tool automatically synchronizes AD DS with Microsoft Entra ID. When you add or change any user accounts in AD DS, the Microsoft Entra Connector tool automatically updates Microsoft Entra ID. - -> [!NOTE] -> Microsoft Entra Connect also supports synchronization from any Lightweight Directory Access Protocol version 3 (LDAPv3)–compliant directory by using the information provided in [Generic LDAP Connector for FIM 2010 R2 Technical Reference](/previous-versions/mim/dn510997(v=ws.10)). - -> [!div class="mx-imgBorder"] -> ![Automatic synchronization between AD DS and Azure AD.](images/edu-districtdeploy-fig5.png "Automatic synchronization between AD DS and Microsoft Entra ID") - -*Figure 5. Automatic synchronization between AD DS and Microsoft Entra ID* - -For more information about how to perform this step, see the [Integrate on-premises AD DS with Microsoft Entra ID](#integrate-on-premises-ad-ds-with-azure-ad) section later in this guide. - - - -### Method 2: Bulk import into Microsoft Entra ID from a .csv file - -In this method, you've no on-premises AD DS domain. As shown in Figure 6, you manually prepare a .csv file with the student information from your source, and then manually import the information directly into Microsoft Entra ID. The .csv file must be in the format that Office 365 specifies. - -> [!div class="mx-imgBorder"] -> ![Bulk import into Microsoft Entra ID from other sources.](images/edu-districtdeploy-fig6.png "Bulk import into Microsoft Entra ID from other sources") - -*Figure 6. Bulk import into Microsoft Entra ID from other sources* - -To implement this method, perform the following steps: - -1. Export the student information from the source. - - Put the student information in the format the bulk-import feature requires. -2. Bulk-import the student information into Microsoft Entra ID. - - For more information about how to perform this step, see the [Bulk-import user and group accounts into Office 365](#bulk-import-user-and-group-accounts-into-office-365) section. - -#### Summary - -In this section, you selected the method for creating user accounts in your Office 365 subscription. Ultimately, these user accounts are in Microsoft Entra ID (which is the identity management system for Office 365). Now, you’re ready to create your Office 365 accounts. - - - -## Integrate on-premises AD DS with Microsoft Entra ID - -You can integrate your on-premises AD DS domain with Microsoft Entra ID to provide identity management for your Office 365 tenant. With this integration, you can synchronize the users, security groups, and distribution lists in your AD DS domain with Microsoft Entra ID with the Microsoft Entra Connect tool. Users will be able to sign in to Office 365 automatically by using their email account and the same password they use to sign in to AD DS. - -> [!NOTE] -> If your institution doesn't have an on-premises AD DS domain, you can skip this section. - -### Select a synchronization model - -Before you deploy AD DS and Microsoft Entra synchronization, determine where you want to deploy the server that runs Microsoft Entra Connect. - -You can deploy the Microsoft Entra Connect tool: - -- **On premises.** As shown in Figure 7, Microsoft Entra Connect runs on premises which has the advantage of not requiring a VPN connection to Azure. It does, however, require a virtual machine (VM) or physical server. - - > [!div class="mx-imgBorder"] - > ![Microsoft Entra Connect on premises.](images/edu-districtdeploy-fig7.png "Microsoft Entra Connect on premises") - - *Figure 7. Microsoft Entra Connect on premises* - -- **In Azure.** As shown in Figure 8, Microsoft Entra Connect runs on a VM in Microsoft Entra ID, which has the advantages of being faster to provision (than a physical, on-premises server), offers better site availability, and helps reduce the number of on-premises servers. The disadvantage is that you need to deploy a VPN gateway on premises. - - > [!div class="mx-imgBorder"] - > ![Microsoft Entra Connect in Azure.](images/edu-districtdeploy-fig8.png "Microsoft Entra Connect in Azure") - - *Figure 8. Microsoft Entra Connect in Azure* - -This guide describes how to run Microsoft Entra Connect on premises. For information about running Microsoft Entra Connect in Azure, see [Deploy Office 365 Directory Synchronization (DirSync) in Microsoft Azure](/microsoft-365/enterprise/deploy-microsoft-365-directory-synchronization-dirsync-in-microsoft-azure). - - - -### Deploy Microsoft Entra Connect on premises - -In this synchronization model (illustrated in Figure 7), you run Microsoft Entra Connect on premises on a physical device or in a VM. Microsoft Entra Connect synchronizes AD DS user and group accounts with Microsoft Entra ID and includes a wizard that helps you configure Microsoft Entra Connect for your AD DS domain and Office 365 subscription. First, you install Microsoft Entra Connect; then, you run the wizard to configure it for your institution. - - - -#### To deploy AD DS and Microsoft Entra synchronization - -1. Configure your environment to meet the prerequisites for installing Microsoft Entra Connect by performing the steps in [Prerequisites for Microsoft Entra Connect](/azure/active-directory/cloud-sync/how-to-prerequisites). - -2. In the VM or on the physical device that will run Microsoft Entra Connect, sign in with a domain administrator account. - -3. Install Microsoft Entra Connect by performing the steps in [Install Microsoft Entra Connect](/azure/active-directory/hybrid/whatis-hybrid-identity#install-azure-ad-connect). - -4. Configure Microsoft Entra Connect features based on your institution’s requirements by performing the steps in [Configure sync features](/azure/active-directory/hybrid/whatis-hybrid-identity#configure-sync-features). - -Now that you've used on premises Microsoft Entra Connect to deploy AD DS and Microsoft Entra synchronization, you’re ready to verify that Microsoft Entra Connect is synchronizing AD DS user and group accounts with Microsoft Entra ID. - -### Verify synchronization - -Microsoft Entra Connect should start synchronization immediately. Depending on the number of users in your AD DS domain, the synchronization process can take some time. To monitor the process, view the number of AD DS users and groups the tool has synchronized with Microsoft Entra ID in the Office 365 admin console. - - - -#### To verify AD DS and Microsoft Entra synchronization - -1. Open https://portal.office.com in your web browser. - -2. Using the administrative account that you created in the [Create a new Office 365 Education subscription](#create-a-new-office-365-education-subscription) section, sign in to Office 365. - -3. In the list view, expand USERS, and then click **Active Users**. - -4. In the details pane, view the list of users. - - The list of users should mirror the users in AD DS. -5. In the list view, click **GROUPS**. - -6. In the details pane, view the list of security groups. - - The list of users should mirror the security groups in AD DS. -7. In the details pane, double-click one of the security groups. - - The list of security group members should mirror the group membership for the corresponding security group in AD DS. -8. Close the browser. - -Now that you've verified Microsoft Entra Connect synchronization, you’re ready to assign user licenses for Microsoft Entra ID P1 or P2. - -#### Summary - -In this section, you selected your synchronization model, deployed Microsoft Entra Connect, and verified that Microsoft Entra ID is synchronizing properly. - -## Bulk-import user and group accounts into AD DS - -You can bulk-import user and group accounts into your on-premises AD DS domain. Bulk-importing accounts helps reduce the time and effort needed to create users compared to creating the accounts manually in the Office 365 Admin portal. First, you select the appropriate method for bulk-importing user accounts into AD DS. Next, you create the .csv file that contains the user accounts. Finally, you use the selected method to import the .csv file into AD DS. - -> [!NOTE] -> If your institution doesn’t have an on-premises AD DS domain, you can skip this section. - -### Select the bulk import method - -Several methods are available to bulk-import user accounts into AD DS domains. Table 12 lists the methods that the Windows Server operating system supports natively. In addition, you can use partner solutions to bulk-import user and group accounts into AD DS. - -|Method |Description and reason to select this method | -|-------|---------------------------------------------| -|Ldifde.exe|This command-line tool allows you to import and export objects (such as user accounts) from AD DS. Select this method if you aren't comfortable with Microsoft Visual Basic Scripting Edition (VBScript), Windows PowerShell, or other scripting languages. For more information about using Ldifde.exe, see [Step-by-Step Guide to Bulk Import and Export to Active Directory](/previous-versions/windows/it-pro/windows-2000-server/bb727091(v=technet.10)), [LDIFDE—Export/Import data from Active Directory—LDIFDE commands](https://support.microsoft.com/kb/555636), [Import or Export Directory Objects Using Ldifde](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc816781(v=ws.10)), and [LDIFDE](/previous-versions/orphan-topics/ws.10/cc755456(v=ws.10)).| -|VBScript|This scripting language uses the Active Directory Services Interfaces (ADSI) Component Object Model interface to manage AD DS objects, including user and group objects. Select this method if you’re comfortable with VBScript. For more information about using VBScript, see [Step-by-Step Guide to Bulk Import and Export to Active Directory](/previous-versions/windows/it-pro/windows-2000-server/bb727091(v=technet.10)).| -|Windows PowerShell|This scripting language natively supports cmdlets to manage AD DS objects, including user and group objects. Select this method if you’re comfortable with Windows PowerShell scripting. For more information about using Windows PowerShell, see [Import Bulk Users to Active Directory](/archive/blogs/technet/bettertogether/import-bulk-users-to-active-directory) and [PowerShell: Bulk create AD Users from CSV file](https://social.technet.microsoft.com/wiki/contents/articles/24541.powershell-bulk-create-ad-users-from-csv-file.aspx).| - -*Table 12. AD DS bulk-import account methods* - -### Create a source file that contains the user and group accounts - -After you've selected your user and group account bulk import method, you’re ready to create the source file that contains the user and group account. You’ll use the source file as the input to the import process. The source file format depends on the method you selected. Table 13 lists the source file format for the bulk import methods. - -|Method |Source file format | -|-------|-------------------| -|Ldifde.exe |Ldifde.exe requires a specific format for the source file. Use Ldifde.exe to export existing user and group accounts so that you can see the format. For examples of the format that Ldifde.exe requires, see [Step-by-Step Guide to Bulk Import and Export to Active Directory](/previous-versions/windows/it-pro/windows-2000-server/bb727091(v=technet.10)), [LDIFDE—Export/Import data from Active Directory—LDIFDE commands](https://support.microsoft.com/kb/555636), [Import or Export Directory Objects Using Ldifde](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc816781(v=ws.10)), and [LDIFDE](/previous-versions/orphan-topics/ws.10/cc755456(v=ws.10)).| -|VBScript |VBScript can use any .csv file format to create a source file for the bulk-import process. To create the .csv file, use software such as Excel. For examples of how to format your source file in comma-separated values (CSV) format, see [Step-by-Step Guide to Bulk Import and Export to Active Directory](/previous-versions/windows/it-pro/windows-2000-server/bb727091(v=technet.10)).| -|Windows PowerShell |Windows PowerShell can use any .csv file format you want to create as a source file for the bulk-import process. To create the .csv file, use software such as Excel. For examples of how to format your source file in CSV format, see [Import Bulk Users to Active Directory](/archive/blogs/technet/bettertogether/import-bulk-users-to-active-directory) and [PowerShell: Bulk create AD Users from CSV file](https://social.technet.microsoft.com/wiki/contents/articles/24541.powershell-bulk-create-ad-users-from-csv-file.aspx). | - -*Table 13. Source file format for each bulk import method* - -### Import the user accounts into AD DS - -With the bulk-import source file finished, you’re ready to import the user and group accounts into AD DS. The steps for importing the file are slightly different for each method. - -> [!NOTE] -> Bulk-import your group accounts first, and then import your user accounts. Importing in this order allows you to specify group membership when you import your user accounts. - -For more information about how to import user accounts into AD DS by using: - -* Ldifde.exe, see [Step-by-Step Guide to Bulk Import and Export to Active Directory](/previous-versions/windows/it-pro/windows-2000-server/bb727091(v=technet.10)), [LDIFDE—Export/Import data from Active Directory—LDIFDE commands](https://support.microsoft.com/kb/555636), [Import or Export Directory Objects Using Ldifde](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc816781(v=ws.10)), and [LDIFDE](/previous-versions/orphan-topics/ws.10/cc755456(v=ws.10)). -* VBScript, see [Step-by-Step Guide to Bulk Import and Export to Active Directory](/previous-versions/windows/it-pro/windows-2000-server/bb727091(v=technet.10)). -* Windows PowerShell, see [Import Bulk Users to Active Directory](/archive/blogs/technet/bettertogether/import-bulk-users-to-active-directory) and [PowerShell: Bulk create AD Users from CSV file](https://social.technet.microsoft.com/wiki/contents/articles/24541.powershell-bulk-create-ad-users-from-csv-file.aspx). - -#### Summary - -In this section, you selected the bulk-import method, created the source file that contains the user and group accounts, and imported the user and group accounts into AD DS. If you've Microsoft Entra Connect, it automatically synchronizes the new AD DS user and group accounts to Microsoft Entra ID. Now, you’re ready to assign user licenses for Microsoft Entra ID P1 or P2 in the [Assign user licenses for Microsoft Entra ID P1 or P2](#assign-user-licenses-for-azure-ad-premium) section later in this guide. - -## Bulk-import user and group accounts into Office 365 - -You can bulk-import user and group accounts directly into Office 365, reducing the time and effort required to create users. First, you bulk-import the user accounts into Office 365. Then, you create the security groups for your institution. Finally, you create the email distribution groups your institution requires. - -### Create user accounts in Office 365 - -Now that you've created your new Office 365 Education subscription, you need to create user accounts. You can add user accounts for the teachers, other faculty, and students who will use the classroom. - -> [!NOTE] -> If your institution has AD DS, don’t create security accounts in Office 365. Instead, create the security groups in AD DS, and then use Microsoft Entra integration to synchronize the security groups with your Office 365 tenant. - -You can use the Microsoft 365 admin center to add individual Office 365 accounts manually—a reasonable process when you’re adding only a few users. If you've many users, however, you can automate the process by creating a list of those users, and then use that list to create user accounts (that is, bulk-add users). - -The bulk-add process assigns the same Office 365 Education license plan to all users on the list. Therefore, you must create a separate list for each license plan you recorded in Table 9. Depending on the number of faculty members who need to use the classroom, you may want to add the faculty Office 365 accounts manually; however, use the bulk-add process to add student accounts. - -For more information about how to bulk-add users to Office 365, see [Add several users at the same time to Microsoft 365](/microsoft-365/enterprise/add-several-users-at-the-same-time). - -> [!NOTE] -> If you encountered errors during bulk add, resolve them before you continue the bulk-add process. You can view the log file to see which users caused the errors, and then modify the .csv file to correct the problems. Click **Back** to retry the verification process. - -The email accounts are assigned temporary passwords on creation. You must communicate these temporary passwords to your users before they can sign in to Office 365. - -### Create Office 365 security groups - -Assign SharePoint Online resource permissions to Office 365 security groups, not individual user accounts. For example, create one security group for faculty members and another for students. Then, you can assign unique SharePoint Online resource permissions to faculty members and a different set of permissions to students. Add or remove users from the security groups to grant or revoke access to SharePoint Online resources. - -> [!NOTE] -> If your institution has AD DS, don’t create security accounts in Office 365. Instead, create the security groups in AD DS, and then use Microsoft Entra integration to synchronize the security groups with your Office 365 tenant. - -For information about creating security groups, see [Create an Office 365 Group in the admin center](/microsoft-365/admin/create-groups/create-groups). - -You can add and remove users from security groups at any time. - -> [!NOTE] -> Office 365 evaluates group membership when users sign in. If you change group membership for a user, that user may have to sign out, and then sign in again for the change to take effect. - -### Create email distribution groups - -Microsoft Exchange Online uses an email distribution group as a single email recipient for multiple users. For example, you could create an email distribution group that contains all students. Then, you could send a message to the email distribution group instead of individually addressing the message to each student. - -You can create email distribution groups based on job role (such as teacher, administration, or student) or specific interests (such as robotics, drama club, or soccer team). You can create any number of distribution groups, and users can be members of more than one group. - -> [!NOTE] -> Office 365 can take some time to complete the Exchange Online creation process. You'll have to wait until the creation process ends before you can perform the following steps. - - -For information about creating email distribution groups, see [Create a Microsoft 365 group in the admin center](/microsoft-365/admin/create-groups/create-groups). - -#### Summary - -You've bulk-imported the user accounts into Office 365. First, you selected the bulk-import method. Next, you created the Office 365 security groups in Office 365. Finally, you created the Office 365 email distribution groups. Now, you’re ready to assign user licenses for Microsoft Entra ID P1 or P2. - - - -## Assign user licenses for Microsoft Entra ID P1 or P2 - -If you enabled Microsoft Entra ID P1 or P2 in the [Enable Microsoft Entra ID P1 or P2](#enable-azure-ad-premium) section, you must now assign Microsoft Entra ID P1 or P2 licenses to the users who need the features this edition offers. For example, you may want the users who have access to confidential student information to use MFA. In this example, you could assign Microsoft Entra ID P1 or P2 only to those users. - -For more information about assigning user licenses for Microsoft Entra ID P1 or P2, see [How to assign EMS/Azure AD Premium licenses to user accounts](https://channel9.msdn.com/Series/Azure-Active-Directory-Videos-Demos/How-to-assign-Azure-AD-Premium-Licenses-to-user-accounts). - -## Create and configure a Microsoft Store for Business portal - -Microsoft Store for Business allows you to create your own private portal to manage Microsoft Store apps in your institution. With Microsoft Store for Business, you can: - -* Find and acquire Microsoft Store apps. -* Manage apps, app licenses, and updates. -* Distribute apps to your users. - - -For more information about Microsoft Store for Business, see [Microsoft Store for Business overview](/microsoft-store/microsoft-store-for-business-overview). - -This section shows you how to create a Microsoft Store for Business portal and configure it for your school. - -### Create and configure your Microsoft Store for Business portal - -To create and configure your Microsoft Store for Business portal, use the administrative account for your Office 365 subscription to sign in to Microsoft Store for Business. Microsoft Store for Business automatically creates a portal for your institution and uses your account as its administrator. - -#### To create and configure a Microsoft Store for Business portal - -1. In Microsoft Edge or Internet Explorer, type `https://microsoft.com/business-store` in the address bar. - -2. On the **Microsoft Store for Business** page, click **Sign in with an organizational account**. - -3. On the Microsoft Store for Business sign-in page, use the administrative account for the Office 365 subscription you created in the [Create a new Office 365 Education subscription](#create-a-new-office-365-education-subscription) section to sign in. - -4. On the **Microsoft Store for Business Services Agreement** page, review the agreement, select the **I accept this agreement and certify that I have the authority to bind my organization to its terms** check box, and then click **Accept**. - -5. In the **Welcome to the Microsoft Store for Business** dialog box, click **OK**. - -After you create the Microsoft Store for Business portal, configure it by using the commands in the **Settings** menu listed in Table 14. Depending on your institution, you may (or may not) need to change these settings to further customize your portal. - -|Menu selection|What can you do in this menu| -|--------------|----------------------------| -|Account information |Displays information about your Microsoft Store for Business account (no settings can be changed). You make changes to this information in Office 365 or the Azure Management Portal. For more information, see [Update Microsoft Store for Business account settings](/microsoft-store/update-microsoft-store-for-business-account-settings).| -|Device Guard signing |Allows you to upload and sign Device Guard catalog and policy files. For more information about Device Guard, see [Device Guard deployment guide](/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide).| -|LOB publishers |Allows you to add line-of-business (LOB) publishers that can then publish apps to your private store. LOB publishers are internal developers or software vendors that are working with your institution. For more information, see [Working with line-of-business apps](/microsoft-store/working-with-line-of-business-apps).| -|Management tools |Allows you to add tools that you can use to distribute (deploy) apps in your private store. For more information, see [Distribute apps with a management tool](/microsoft-store/distribute-apps-with-management-tool).| -|Offline licensing|Allows you to show (or not show) offline licensed apps to people shopping in your private store. For more information, see the “Licensing model: online and offline licenses” section in [Apps in Microsoft Store for Business](/microsoft-store/apps-in-microsoft-store-for-business#licensing-model).| -|Permissions |Allows you to grant other users in your organization the ability to buy, manage, and administer your Microsoft Store for Business portal. You can also remove permissions you've previously granted. For more information, see [Roles and permissions in Microsoft Store for Business](/microsoft-store/roles-and-permissions-microsoft-store-for-business).| -|Private store |Allows you to change the organization name used in your Microsoft Store for Business portal. When you create your portal, the private store uses the organization name that you used to create your Office 365 subscription. For more information, see [Distribute apps using your private store](/microsoft-store/distribute-apps-from-your-private-store).| - -*Table 14. Menu selections to configure Microsoft Store for Business settings* - -### Find, acquire, and distribute apps in the portal - -Now that you've created your Microsoft Store for Business portal, you’re ready to find, acquire, and distribute apps that you'll add to your portal. You do this task from the **Inventory** page in Microsoft Store for Business. - -> [!NOTE] -> Your educational institution can now use a credit card or purchase order to pay for apps in Microsoft Store for Business. - -You can deploy apps to individual users or make apps available to users through your private store. Deploying apps to individual users restricts the app to those specified users. Making apps available through your private store allows all your users to install the apps. - -For more information about how to find, acquire, and distribute apps in the portal, see [App inventory management for Microsoft Store for Business](/microsoft-store/app-inventory-management-microsoft-store-for-business). - -#### Summary - -At the end of this section, you should have a properly configured Microsoft Store for Business portal. You've also found and acquired your apps from Microsoft Store. Finally, you should have deployed all your Microsoft Store apps to your users. Now, you’re ready to deploy Microsoft Store apps to your users. - -## Plan for deployment - -You'll use the LTI deployment process in MDT to deploy Windows 10 to devices or to upgrade devices to Windows 10. Prior to preparing for deployment, you must make some deployment planning decisions, including selecting the operating systems you'll use, the approach you'll use to create your Windows 10 images, and the method you'll use to initiate the LTI deployment process. - -### Select the operating systems - -Later in the process, you'll import the versions of Windows 10 you want to deploy. You can deploy the operating system to new devices, refresh existing devices, or upgrade existing devices. In the case of: - -* New devices or refreshing existing devices, you'll completely replace the existing operating system on a device with Windows 10. -* Upgrading existing devices, you'll upgrade the existing operating system (the Windows 8.1 or Windows 7 operating system) to Windows 10. - - -Depending on your school’s requirements, you may need any combination of the following Windows 10 editions: - -- **Windows 10 Pro.** Use this operating system to: - * Upgrade existing eligible institution-owned and personal devices running Windows 8.1 Pro or Windows 7 Professional to Windows 10 Pro. - * Deploy new instances of Windows 10 Pro to devices so that new devices have a known configuration. - -- **Windows 10 Education.** Use this operating system to: - * Upgrade institution-owned devices to Windows 10 Education. - * Deploy new instances of Windows 10 Education so that new devices have a known configuration. - -> [!NOTE] -> Although you can use Windows 10 Home on institution-owned devices, Microsoft recommends that you use Windows 10 Pro or Windows 10 Education, instead. Windows 10 Pro and Windows 10 Education provide support for MDM, policy-based management, and Microsoft Store for Business—features not available in Windows 10 Home. For more information about how to upgrade Windows 10 Home to Windows 10 Pro or Windows 10 Education, see [Windows 10 edition upgrade](/windows/deployment/upgrade/windows-10-edition-upgrades). - -For more information about the Windows 10 editions, see [Compare Windows 10 Editions](https://www.microsoft.com/WindowsForBusiness/Compare). - -One other consideration is the mix of processor architectures you'll support. If you can, support only 64-bit versions of Windows 10. If you've devices that can run only 32-bit versions of Windows 10, you'll need to import both 64-bit and 32-bit versions of the Windows 10 editions listed above. - -> [!NOTE] -> On devices that have minimal system resources (such as devices with only 2 GB of memory or 32 GB of storage), use 32-bit versions of Windows 10 because 64-bit versions of Windows 10 place more stress on device system resources. - -Finally, as a best practice, minimize the number of operating systems that you deploy and manage. If possible, standardize institution-owned devices on one Windows 10 edition (such as a 64-bit version of Windows 10 Education or Windows 10 Pro). Of course, you can't standardize personal devices on a specific operating system version or processor architecture. - -### Select an image approach - -A key operating system image decision is whether to use a thin or thick image. *Thin images* contain only the operating system, and MDT installs the necessary device drivers and apps after the operating system has been installed. *Thick images* contain the operating system, “core” apps (such as Office), and device drivers. With thick images, MDT installs any device drivers and apps not included in the thick image after the operating system has been installed. - -The advantage to a thin image is that the final deployment configuration is dynamic: you can easily change the configuration without having to capture another image. The disadvantage of a thin image is that it takes longer to complete the deployment. - -The advantage of a thick image is that the deployment takes less time than it would for a thin image. The disadvantage of a thick image is that you need to capture a new image each time you want to make a change to the operating system, apps, or other software in the image. - -This guide discusses thick image deployment. For information about thin image deployments, see [Deploy Windows 10 in a school](./deploy-windows-10-in-a-school.md). - -### Select a method to initiate deployment -The LTI deployment process is highly automated: it requires minimal information to deploy or upgrade Windows 10. The ZTI deployment process is fully automated, but you must manually initiate it. To do so, use the method listed in Table 15 that best meets the needs of your institution. - -|Method|Description and reason to select this method| -|--- |--- | -|Windows Deployment Services|This method:
                      • Uses diskless booting to initiate LTI and ZTI deployments.
                      • Works only with devices that support PXE boot.
                      • Deploys Windows 10 over the network, which consumes more network bandwidth than deployment from local media.
                      • Deploys images more slowly than when you use local media.
                      • Requires that you deploy a Windows Deployment Services server.

                        Select this method when you want to deploy Windows over-the-network and perform diskless booting. The advantage of this method is that the diskless media are generic and typically don’t require updates after you create them (LTI and ZTI access the centrally located deployment content over the network). The disadvantage of this method is that over-the-network deployments are slower than deployments from local media, and you must deploy a Windows Deployment Services server.| -|Bootable media|This method:
                      • Initiates LTI or ZTI deployment by booting from local media, including from USB drives, DVD, or CD.
                      • Deploys Windows 10 over the network, which consumes more network bandwidth than deployment from local media.
                      • Deploys images more slowly than when using local media.
                      • Requires no extra infrastructure.

                        Select this method when you want to deploy Windows over the network and are willing to boot the target device from local media. The advantage of this method is that the media are generic and typically don’t require updates after you create them (LTI and ZTI access the centrally located deployment content over the network). The disadvantage of this method is that over-the-network deployments are slower than deployment from local media.| -|Deployment media|This method:
                      • Initiates LTI or ZTI deployment by booting from a local USB hard disk.
                      • Deploys Windows 10 from local media, which consumes less network bandwidth than over-the-network methods.
                      • Deploys images more quickly than network-based methods do.
                      • Requires a USB hard disk because of the deployment share’s storage requirements (up to 100 GB).

                        Select this method when you want to perform local deployments and are willing to boot the target device from a local USB hard disk. The advantage of this method is that local deployments are faster than over-the-network deployments. The disadvantage of this method is that each time you change the deployment share or distribution point content, you must regenerate the deployment media and update the USB hard disk. - -*Table 15. Methods to initiate LTI and ZTI deployments* - -#### Summary -At the end of this section, you should know the Windows 10 editions and processor architecture that you want to deploy (and will import later in the process). You also determined whether you want to use thin or thick images. Finally, you selected the method for initiating your LTI or ZTI deployment. Now, you can prepare for Windows 10 deployment. - -## Prepare for deployment - -Before you can deploy Windows 10 and your apps to devices, you need to prepare your MDT environment, Windows Deployment Services, and Microsoft Configuration Manager (if you selected it to do operating system deployment in the [Select the deployment methods](#select-the-deployment-methods) section). In this section, you ensure that the deployment methods you selected in the [Select the deployment methods](#select-the-deployment-methods) section have the necessary Windows 10 editions and versions, Windows desktop apps, Microsoft Store apps, and device drivers. - -### Configure the MDT deployment share - -The first step in preparing for Windows 10 deployment is to configure—that is, *populate*—the MDT deployment share. Table 16 lists the MDT deployment share configuration tasks that you must perform. Perform the tasks in the order represented in Table 16. - -|Task|Description| -|--- |--- | -|1. Import operating systems|Import the operating systems that you selected in the [Select the operating systems](#select-the-operating-systems) section into the deployment share. For more information about how to import operating systems, see [Import Device Drivers into the Deployment Workbench](/mem/configmgr/mdt/use-the-mdt#ImportDeviceDriversintotheDeploymentWorkbench)| -|2. Import device drivers|Device drivers allow Windows 10 to know a device’s hardware resources and connected hardware accessories. Without the proper device drivers, certain features may be unavailable. For example, without the proper audio driver, a device can't play sounds; without the proper camera driver, the device can't take photos or use video chat.
                        Import device drivers for each device in your institution. For more information about how to import device drivers, see [Import Device Drivers into the Deployment Workbench](/mem/configmgr/mdt/use-the-mdt#ImportDeviceDriversintotheDeploymentWorkbench)| -|3. Create MDT applications for Microsoft Store apps|Create an MDT application for each Microsoft Store app you want to deploy. You can deploy Microsoft Store apps by using sideloading, which allows you to use the **Add-AppxPackage** Windows PowerShell cmdlet to deploy the .appx files associated with the app (called provisioned apps). Use this method to deploy up to 24 apps to Windows 10.
                        Prior to sideloading the .appx files, obtain the Microsoft Store .appx files that you'll use to deploy (sideload) the apps in your provisioning package. For apps in Microsoft Store, you'll need to obtain the .appx files by performing one of the following tasks:
                      • For offline-licensed apps, download the .appx files from the Microsoft Store for Business.
                      • For apps that aren't offline licensed, obtain the .appx files from the app software vendor directly.

                        If you are unable to obtain the .appx files from the app software vendor, then you or the students will need to install the apps on the student devices directly from Microsoft Store or Microsoft Store for Business.
                        If you've Intune or Microsoft Configuration Manager, you can deploy Microsoft Store apps after you deploy Windows 10, as described in the [Deploy and manage apps by using Intune](#deploy-and-manage-apps-by-using-intune) and [Deploy and manage apps by using Microsoft Configuration Manager](#deploy-and-manage-apps-by-using-microsoft-configuration-manager). This method provides granular deployment of Microsoft Store apps, and you can use it for ongoing management of Microsoft Store apps. This is the preferred method of deploying and managing Microsoft Store apps.
                        In addition, you must prepare your environment for sideloading Microsoft Store apps. For more information about how to:
                      • Prepare your environment for sideloading, see [Try it out: sideload Microsoft Store apps](/previous-versions/windows/).
                      • Create an MDT application, see [Create a New Application in the Deployment Workbench](/mem/configmgr/mdt/use-the-mdt#CreateaNewApplicationintheDeploymentWorkbench).| -|4. Create MDT applications for Windows desktop apps|You need to create an MDT application for each Windows desktop app you want to deploy. You can obtain the Windows desktop apps from any source, but ensure that you've sufficient licenses for them.
                        To help reduce the effort needed to deploy Microsoft Office 2016 desktop apps, use the Office Deployment Tool, as described in[Deploy Click-to-Run for Office 365 products by using the Office Deployment Tool](/deployoffice/deploy-microsoft-365-apps-local-source).
                        If you've Intune, you can [Deploy and manage apps by using Intune](#deploy-and-manage-apps-by-using-intune), as described in the Deploy and manage apps by using Intune section. This method provides granular deployment of Windows desktop apps, and you can use it for ongoing management of the apps.
                        This is the preferred method for deploying and managing Windows desktop apps.
                        **Note:**  You can also deploy Windows desktop apps after you deploy Windows 10, as described in the [Deploy and manage apps by using Intune](#deploy-and-manage-apps-by-using-intune)
                        For more information about how to create an MDT application for Windows desktop apps, see [Create a New Application in the Deployment Workbench](/mem/configmgr/mdt/use-the-mdt).| -|5. Create task sequences|You must create separate task sequences for each Windows 10 edition, processor architecture, operating system upgrade process, and new operating system deployment process. Minimally, create a task sequence for each Windows 10 operating system you imported in step 1—for example, (1) if you want to deploy Windows 10 Education to new devices or refresh existing devices with a new deployment of Windows 10 Education, (2) if you want to upgrade existing devices running Windows 8.1 or Windows 7 to Windows 10 Education, or (3) if you want to run deployments and upgrades for both 32-bit and 64-bit versions of Windows 10. To do so, you must create task sequences that will:
                      • Deploy 64-bit Windows 10 Education to devices.
                      • Deploy 32-bit Windows 10 Education to devices.
                      • Upgrade existing devices to 64-bit Windows 10 Education.
                      • Upgrade existing devices to 32-bit Windows 10 Education.

                        Again, you'll create the task sequences based on the operating systems that you imported in step 1. For more information about how to create a task sequence, see [Create a New Task Sequence in the Deployment Workbench](/mem/configmgr/mdt/use-the-mdt#CreateaNewTaskSequenceintheDeploymentWorkbench).| -|6. Update the deployment share|Updating a deployment share generates the MDT boot images you use to initiate the Windows 10 deployment process. You can configure the process to create 32-bit and 64-bit versions of the .iso and .wim files you can use to create bootable media or in Windows Deployment Services.
                        For more information about how to update a deployment share, see [Update a Deployment Share in the Deployment Workbench](/mem/configmgr/mdt/use-the-mdt#UpdateaDeploymentShareintheDeploymentWorkbench).| - -*Table 16. Tasks to configure the MDT deployment share* - -### Configure Microsoft Configuration Manager - -> [!NOTE] -> If you've already configured your Microsoft Configuration Manager infrastructure to support the operating system deployment feature or if you selected to deploy Windows 10 by using MDT only, then skip this section and continue to the next section. - -Before you can use Configuration Manager to deploy Windows 10 and manage your apps and devices, you must configure Configuration Manager to support the operating system deployment feature. If you don’t have an existing Configuration Manager infrastructure, you'll need to deploy a new infrastructure. - -Deploying a new Configuration Manager infrastructure is beyond the scope of this guide, but the following resources can help you deploy a new Configuration Manager infrastructure: - -* [Get ready for Configuration Manager](/mem/configmgr/core/plan-design/get-ready) -* [Start using Configuration Manager](/mem/configmgr/core/servers/deploy/start-using) - - -#### To configure an existing Microsoft Configuration Manager infrastructure for operating system deployment - -1. Perform any necessary infrastructure remediation. - - Ensure that your existing infrastructure can support the operating system deployment feature. For more information, see [Infrastructure requirements for operating system deployment in Microsoft Configuration Manager](/mem/configmgr/osd/plan-design/infrastructure-requirements-for-operating-system-deployment). -2. Add the Windows PE boot images, Windows 10 operating systems, and other content. - - You need to add the Windows PE boot images, Windows 10 operating system images, and other deployment content that you'll use to deploy Windows 10 with ZTI. To add this content, use the Create MDT Task Sequence Wizard. - - You can add this content by using Microsoft Configuration Manager only (without MDT), but the Create MDT Task Sequence Wizard is the preferred method because the wizard prompts you for all the deployment content you need for a task sequence and provides a much more intuitive user experience. For more information, see [Create ZTI Task Sequences Using the Create MDT Task Sequence Wizard in Configuration Manager](/mem/configmgr/mdt/use-the-mdt#CreateZTITaskSequencesUsingtheCreateMDTTaskSequenceWizardinConfigurationManager). -3. Add device drivers. - - You must add device drivers for the different device types in your district. For example, if you've a mixture of Surface, HP Stream, Dell Inspiron, and Lenovo Yoga devices, then you must have the device drivers for each device. - - Create a Microsoft Configuration Manager driver package for each device type in your district. For more information, see [Manage drivers in Configuration Manager](/mem/configmgr/osd/get-started/manage-drivers). -4. Add Windows apps. - - Install the Windows apps (Windows desktop and Microsoft Store apps) that you want to deploy after the task sequence deploys your customized image (a thick, reference image that includes Windows 10 and your core Windows desktop apps). These apps are in addition to the apps included in your reference image. You can only deploy Microsoft Store apps after you deploy Windows 10 because you can't capture Microsoft Store apps in a reference image. Microsoft Store apps target users, not devices. - - Create a Configuration Manager application for each Windows desktop or Microsoft Store app that you want to deploy after you apply the reference image to a device. For more information, see [Deploy and manage applications with Configuration Manager](/mem/configmgr/apps/deploy-use/deploy-applications). - -### Configure Windows Deployment Services for MDT - -You can use Windows Deployment Services in conjunction with MDT to automatically initiate boot images on target devices. These boot images can be Windows PE images (which you generated in step 6 in Table 16) or custom images that can deploy operating systems directly to the target devices. - -#### To configure Windows Deployment Services for MDT - -1. Set up and configure Windows Deployment Services. - - Windows Deployment Services is a server role available in all Windows Server editions. You can enable the Windows Deployment Services server role on a new server or on any server running Windows Server in your institution. - - For more information about how to perform this step, see the following resources: - - * [Windows Deployment Services Overview](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh831764(v=ws.11)) - * The Windows Deployment Services Help file, included in Windows Deployment Services - * [Windows Deployment Services Getting Started Guide for Windows Server 2012](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/jj648426(v=ws.11)) - -2. Add LTI boot images (Windows PE images) to Windows Deployment Services. - - The LTI boot images (.wim files) that you'll add to Windows Deployment Services are in the MDT deployment share. Locate the .wim files in the deployment share’s Boot subfolder. - - For more information about how to perform this step, see [Add LTI Boot Images to Windows Deployment Services](/mem/configmgr/mdt/use-the-mdt#AddLTIBootImagestoWindowsDeploymentServices). - -### Configure Windows Deployment Services for Microsoft Configuration Manager - -> [!NOTE] -> If you've already configured your Microsoft Configuration Manager infrastructure to support PXE boot or selected to deploy Windows 10 by using MDT only, then skip this section and continue to the next. - -You can use Windows Deployment Services in conjunction with Configuration Manager to automatically initiate boot images on target devices. These boot images are Windows PE images that you use to boot the target devices, and then initiate Windows 10, app, and device driver deployment. - -#### To configure Windows Deployment Services for Microsoft Configuration Manager - -1. Set up and configure Windows Deployment Services. - - Windows Deployment Services is a server role available in all Windows Server editions. You can enable the Windows Deployment Services server role on a new server or on any server running Windows Server in your institution. - - For more information about how to perform this step, see the following resources: - * [Windows Deployment Services Overview](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh831764(v=ws.11)) - * The Windows Deployment Services Help file, included in Windows Deployment Services - * [Windows Deployment Services Getting Started Guide for Windows Server 2012](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/jj648426(v=ws.11)) - -2. Configure a distribution point to accept PXE requests in Configuration Manager. - - To support PXE boot requests, you install the PXE service point site system role. Then, you must configure one or more distribution points to respond to PXE boot request. - For more information about how to perform this step, see [Install site system roles for Configuration Manager](/mem/configmgr/core/servers/deploy/configure/install-site-system-roles), [Use PXE to deploy Windows over the network with Configuration Manager](/mem/configmgr/osd/deploy-use/use-pxe-to-deploy-windows-over-the-network), and [Configuring distribution points to accept PXE requests](/mem/configmgr/osd/get-started/prepare-site-system-roles-for-operating-system-deployments#BKMK_PXEDistributionPoint). -3. Configure the appropriate boot images (Windows PE images) to deploy from the PXE-enabled distribution point. - - Before a device can start a boot image from a PXE-enabled distribution point, you must change the properties of the boot image to enable PXE booting. Typically, you create this boot image when you created your MDT task sequence in the Configuration Manager console. - - For more information about how to perform this step, see [Configure a boot image to deploy from a PXE-enabled distribution point](/mem/configmgr/osd/get-started/manage-boot-images#BKMK_BootImagePXE) and [Manage boot images with Configuration Manager](/mem/configmgr/osd/get-started/manage-boot-images). - -#### Summary - -Your MDT deployment share and Microsoft Configuration Manager are now ready for deployment. Windows Deployment Services is ready to initiate the LTI or ZTI deployment process. You've set up and configured Windows Deployment Services for MDT and for Configuration Manager. You've also ensured that your boot images are available to Windows Deployment Services (for LTI) or the distribution points (for ZTI and Configuration Manager). Now, you’re ready to capture the reference images for the different devices you've in your district. - -## Capture the reference image - -The reference device is a device that you use as the template for all the other devices in your district. On this device, you install any Windows desktop apps the classroom needs. For example, install the Windows desktop apps for Microsoft 365 Apps for enterprise if you selected that student license plan. - -After you deploy Windows 10 and the desktop apps to the reference device, you capture an image of the device (the reference image). You import the reference image to an MDT deployment share or into Configuration Manager. Finally, you create a task sequence to deploy the reference image to faculty and student devices. - -You'll capture multiple reference images, one for each type of device that you've in your organization. You perform the steps in this section for each image (device) that you've in your district. Use LTI in MDT to automate the deployment and capture of the reference image. - -> [!NOTE] -> You can use LTI in MDT or Configuration Manager to automate the deployment and capture of the reference image, but this guide only discusses how to use LTI in MDT to capture the reference image. - -### Customize the MDT deployment share - -You initially configured the MDT deployment share in the [Configure the MDT deployment share](#configure-the-mdt-deployment-share) section earlier in this guide. In that section, you configured the deployment share for generic use. Now, you need to customize the deployment share to deploy the appropriate Windows 10 edition, desktop apps, and device drivers to each reference device. - -#### To customize the MDT deployment share - -1. Create a task sequence to deploy the appropriate Windows 10 edition. - - A task sequence can deploy only one Windows 10 edition or version, which means that you must create a task sequence for each Windows 10 edition and version you selected in the [Select the operating systems](#select-the-operating-systems) section earlier in this guide. To create task sequences, use the New Task Sequence Wizard. - - For more information, see [Create a New Task Sequence in the Deployment Workbench](/mem/configmgr/mdt/use-the-mdt#CreateaNewTaskSequenceintheDeploymentWorkbench). -2. Create an MDT application for each desktop app you want to include in your reference image. - - You create MDT applications by using the New Application Wizard in the Deployment Workbench. As part of creating the MDT application, specify the command-line parameters used to install the app without user intervention (unattended installation). For more information, see [Create a New Application in the Deployment Workbench](/mem/configmgr/mdt/use-the-mdt#CreateaNewApplicationintheDeploymentWorkbench). -3. Customize the task sequence to install the MDT applications that you created in step 2. - - You can add an **Install Application** task sequence step to your task sequence. Then, you can customize the **Install Application** task sequence step to install a specific app, which automatically installs the app with no user interaction required when your run the task sequence. - - You need to add an **Install Application** task sequence step for each app you want to include in your reference image. For more information, see [Customize Application Installation in Task Sequences](/mem/configmgr/mdt/use-the-mdt#CustomizeApplicationInstallationinTaskSequences). -4. Create a selection profile that contains the drivers for the device. - - A *selection profile* lets you select specific device drivers. For example, if you want to deploy the device drivers for a Surface Pro 4 device, you can create a selection profile that contains only the Surface Pro 4 device drivers. - - First, in the Out-of-Box Drivers node in the Deployment Workbench, create a folder that will contain your device drivers. Next, import the device drivers into the folder you created. Finally, create the selection profile and specify the folder that contains the device drivers. For more information, see the following resources: - - * [Create Folders to Organize Device Drivers for LTI Deployments](/mem/configmgr/mdt/use-the-mdt#CreateFolderstoOrganizeDeviceDriversforLTIDeployments) - * [Create Selection Profiles to Select the Device Drivers for LTI Deployments](/mem/configmgr/mdt/use-the-mdt#CreateSelectionProfilestoSelecttheDeviceDriversforLTIDeployments) - -5. Customize the task sequence to use the selection profile that you created in step 4. - - You can customize the **Inject Driver** task sequence step in the **Preinstall** task sequence group in your task sequence to deploy only the device drivers in the selection profile. For more information, see [Configure Task Sequences to Deploy Device Drivers in Selection Profiles for LTI Deployments](/mem/configmgr/mdt/use-the-mdt#ConfigureTaskSequencestoDeployDeviceDriversinSelectionProfilesforLTIDeployments). - -### Capture reference image - -To capture the reference image, run the LTI task sequence that you created in the previous section. The LTI task sequence will allow you to specify a storage location and file name for the .wim file, which contains the captured image. - -Use the Deployment Wizard to deploy Windows 10, your apps, and device drivers to the device, and then capture the .wim file. The LTI deployment process is almost fully automated: you provide only minimal information to the Deployment Wizard at the beginning of the process. After the wizard collects the necessary information, the remainder of the process is fully automated. - -> [!NOTE] -> To fully automate the LTI deployment process, complete the steps in the “Fully Automated LTI Deployment Scenario” section of [Microsoft Deployment Toolkit Samples Guide](/mem/configmgr/mdt/samples-guide#Anchor_6). - -In most instances, deployments occur without incident. Only in rare occasions do deployments experience problems. - -#### To deploy Windows 10 - -1. **Initiate the LTI deployment process.** Initiate the LTI deployment process booting over the network (PXE boot) or from local media. You selected the method for initiating the LTI deployment process in the [Select method to initiate deployment](#select-a-method-to-initiate-deployment) section earlier in this guide. - -2. **Complete the Deployment Wizard.** For more information about how to complete the Deployment Wizard, see the “Running the Deployment Wizard” section in [Using the Microsoft Deployment Toolkit](/mem/configmgr/mdt/use-the-mdt#Anchor_5). - -### Import reference image - -After you've captured the reference image (.wim file), import the image into the MDT deployment share or into Configuration Manager (depending on which method you selected to perform Windows 10 deployments). You'll deploy the reference image to the student and faculty devices in your district. - -Both the Deployment Workbench and the Configuration Manager console have wizards that help you import the reference image. After you import the reference image, you need to create a task sequence that will deploy the reference image. - -For more information about how to import the reference image into: - -* An MDT deployment share, see [Import a Previously Captured Image of a Reference Computer](/mem/configmgr/mdt/use-the-mdt#ImportaPreviouslyCapturedImageofaReferenceComputer). -* Microsoft Configuration Manager, see [Manage operating system images with Microsoft Configuration Manager](/mem/configmgr/osd/get-started/manage-operating-system-images) and [Customize operating system images with Microsoft Configuration Manager](/mem/configmgr/osd/get-started/customize-operating-system-images). - -### Create a task sequence to deploy the reference image - -You created an LTI task sequence in the Deployment Workbench earlier in this process to deploy Windows 10 and your desktop apps to the reference device. Now that you've captured and imported your reference image, you need to create a tasks sequence to deploy it. - -As you might expect, both the Deployment Workbench and the Configuration Manager console have wizards that help you create a starting task sequence. After you create your task sequence, in most instances you'll need to customize it to deploy more apps, device drivers, and other software. - -For more information about how to create a task sequence in the: - -* Deployment Workbench for a deployment share, see [Create a New Task Sequence in the Deployment Workbench](/mem/configmgr/mdt/use-the-mdt#CreateaNewTaskSequenceintheDeploymentWorkbench). -* Configuration Manager console, see [Create a task sequence to install an operating system in Microsoft Configuration Manager](/mem/configmgr/osd/deploy-use/create-a-task-sequence-to-install-an-operating-system). - -#### Summary -In this section, you customized the MDT deployment share to deploy Windows 10 and desktop apps to one or more reference devices by creating and customizing MDT applications, device drivers, and applications. Next, you ran the task sequence, which deploys Windows 10, deploys your apps, deploys the appropriate device drivers, and captures an image of the reference device. Then, you imported the captured reference image into a deployment share or Microsoft Configuration Manager. Finally, you created a task sequence to deploy your captured reference image to faculty and student devices. At this point in the process, you’re ready to deploy Windows 10 and your apps to your devices. - -## Prepare for device management - -Before you deploy Windows 10 in your district, you must prepare for device management. You'll deploy Windows 10 in a configuration that complies with your requirements, but you want to help ensure that your deployments remain compliant. - -You also want to deploy apps and software updates after you deploy Windows 10. You need to manage apps and updates by using Configuration Manager, Intune, or a combination of both (hybrid model). - -### Select Microsoft-recommended settings - -Microsoft has several recommended settings for educational institutions. Table 17 lists them, provides a brief description of why you need to configure them, and recommends methods for configuring the settings. Review the settings in Table 17 and evaluate their relevancy to your institution. - -> [!NOTE] -> The settings for Intune in Table 17 also apply to the Configuration Manager and Intune management (hybrid) method. - -Use the information in Table 17 to help you determine whether you need to configure the setting and which method you'll use to do so. At the end, you'll have a list of settings that you want to apply to the Windows 10 devices and know which management method you'll use to configure the settings. - -|Recommendation|Description| -|--- |--- | -|Use of Microsoft accounts|You want faculty and students to use only Microsoft Entra accounts for institution-owned devices. For these devices, don't use Microsoft accounts or associate a Microsoft account with the Microsoft Entra accounts.
                        **Note**  Personal devices typically use Microsoft accounts. Faculty and students can associate their Microsoft account with their Microsoft Entra account on these devices.
                        **Group Policy.** Configure the [Accounts: Block Microsoft accounts](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/jj966262(v=ws.11)) Group Policy setting to use the **Users can’t add Microsoft accounts** setting option.
                        ****Intune**.** To enable or disable the use of Microsoft accounts, use the **Allow Microsoft account**, **Allow adding non-Microsoft accounts manually**, and **Allow settings synchronization for Microsoft accounts** policy settings under the **Accounts and Synchronization** section of a **Windows 10 General Configuration** policy.| -|Restrict the local administrator accounts on the devices|Ensure that only authorized users are local administrators on institution-owned devices. Typically, you don’t want students to be administrators on instruction-owned devices. Explicitly specify the users who will be local administrators on a group of devices.
                        **Group Policy**. Create a Local Group Policy preference to limit the local administrators group membership. Select the Delete all member users and Delete all member groups check boxes to remove any existing members. For more information about how to configure Local Group preferences, see Configure a Local Group Item.
                        **Intune**. Not available.| -|Manage the built-in administrator account created during device deployment|When you use MDT to deploy Windows 10, the MDT deployment process automatically creates a local Administrator account with the password you specified. As a security best practice, rename the built-in Administrator account and (optionally) disable it.
                        **Group Policy**. To rename the built-in Administrator account, use the Accounts: Rename administrator account Group policy setting. For more information about how to rename the built-in Administrator account, see [To rename the Administrator account using the Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-essentials-sbs/cc747484(v=ws.10)). You specify the new name for the Administrator account. To disable the built-in Administrator account, use the Accounts: Administrator account status Group policy setting. For more information about how to disable the built-in Administrator account, see [Accounts: Administrator account status](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/jj852165(v=ws.11)).
                        **Intune**. Not available.| -|Control Microsoft Store access|You can control access to Microsoft Store and whether existing Microsoft Store apps receive updates. You can only disable the Microsoft Store app in Windows 10 Education and Windows 10 Enterprise.
                        **Group policy**. To disable the Microsoft Store app, use the Turn off the Store Application group policy setting. To prevent Microsoft Store apps from receiving updates, use the Turn off Automatic Download and Install of updates Group Policy setting. For more information about configuring these settings, see Can I use Group Policy to control the Microsoft Store in my enterprise environment?
                        **Intune**. To enable or disable Microsoft Store access, use the Allow application store policy setting in the Apps section of a Windows 10 General Configuration policy.| -|Use of Remote Desktop connections to devices|Remote Desktop connections could allow unauthorized access to the device. Depending on your institution’s policies, you may want to disable Remote Desktop connections on your devices.
                        **Group policy**. To enable or disable Remote Desktop connections to devices, use the Allow Users to connect remotely using Remote Desktop setting in Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Connections.
                        **Intune**. Not available.| -|Use of camera|A device’s camera can be a source of disclosure or privacy issues in an education environment. Depending on your institution’s policies, you may want to disable the camera on your devices.
                        **Group policy**. Not available.
                        **Intune**. To enable or disable the camera, use the Allow camera policy setting in the Hardware section of a Windows 10 General Configuration policy.| -|Use of audio recording|Audio recording (by using the Sound Recorder app) can be a source of disclosure or privacy issues in an education environment. Depending on your institution’s policies, you may want to disable the Sound Recorder app on your devices.
                        **Group policy**. To disable the Sound Recorder app, use the don't allow Sound Recorder to run Group Policy setting. You can disable other audio recording apps by using AppLocker policies. To create AppLocker policies, use the information in [Editing an AppLocker Policy](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ee791894(v=ws.10)) and [Create Your AppLocker Policies](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/ee791899(v=ws.11)).
                        **Intune**. To enable or disable audio recording, use the Allow voice recording policy setting in the Features section of a Windows 10 General Configuration policy.| -|Use of screen capture|Screen captures can be a source of disclosure or privacy issues in an education environment. Depending on your institution’s policies, you may want to disable the ability to perform screen captures on your devices.
                        **Group policy**. Not available.
                        **Intune**. To enable or disable screen capture, use the Allow screen capture policy setting in the System section of a Windows 10 General Configuration policy.| -|Use of location services|Providing a device’s location can be a source of disclosure or privacy issues in an education environment. Depending on your institution’s policies, you may want to disable the location service on your devices.
                        **Group policy**. To enable or disable location services, use the Turn off location group policy setting in User Configuration\Windows Components\Location and Sensors.
                        **Intune**. To enable or disable location services, use the Allow geolocation policy setting in the Hardware section of a Windows 10 General Configuration policy.| -|Changing wallpaper|Custom wallpapers can be a source of disclosure or privacy issues in an education environment (if the wallpaper displays information about the user or device). Depending on your institution’s policies, you may want to prevent users from changing the wallpaper on institution-owned devices.
                        **Group policy**. To configure the wallpaper, use the Desktop WallPaper setting in User Configuration\Administrative Templates\Desktop\Desktop.
                        **Intune**. Not available.| - - -
                        -Table 17. Recommended settings for educational institutions - -### Configure settings by using Group Policy - -Now, you’re ready to use Group Policy to configure settings. The steps in this section assume that you've an AD DS infrastructure. Here, you configure the Group Policy settings you selected in the [Select Microsoft-recommended settings](#select-microsoft-recommended-settings) section. - -For more information about Group Policy, see [Group Policy Planning and Deployment Guide](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc754948(v=ws.10)). - -#### To configure Group Policy settings - -1. Create a Group Policy object (GPO) to contain your Group Policy settings by completing the steps in [Create a new Group Policy object](/previous-versions/windows/it-pro/windows-server-2003/cc738830(v=ws.10)). - -2. Configure the settings in the GPO by completing the steps in [Edit a Group Policy object](/previous-versions/windows/it-pro/windows-server-2003/cc739902(v=ws.10)). - -3. Link the GPO to the appropriate AD DS site, domain, or organizational unit by completing the steps in [Link a Group Policy object to a site, domain, or organizational unit](/previous-versions/windows/it-pro/windows-server-2003/cc738954(v=ws.10)). - -### Configure settings by using Intune - -Now, you’re ready to use Intune to configure settings. The steps in this section assume that you've an Office 365 subscription. Here, you configure the Intune settings that you selected in the [Select Microsoft-recommended settings](#select-microsoft-recommended-settings) section. - -For more information about Intune, see [Microsoft Intune Documentation](/intune/). - -#### To configure Intune settings - -1. Add Intune to your Office 365 subscription by completing the steps in [Manage Intune licenses](/mem/intune/fundamentals/licenses-assign). - -2. Enroll devices with Intune by completing the steps in [Get ready to enroll devices in Microsoft Intune](/mem/intune/enrollment/quickstart-enroll-windows-device). - -3. Configure the settings in Intune Windows 10 policies by completing the steps in [Manage settings and features on your devices with Microsoft Intune policies](/mem/intune/configuration/device-profiles). - -4. Manage Windows 10 devices by completing the steps in [Manage Windows PCs with Microsoft Intune](/mem/intune/remote-actions/device-management). - -### Deploy and manage apps by using Intune - -If you selected to deploy and manage apps by using Microsoft Configuration Manager and Intune in a hybrid configuration, then skip this section and continue to the [Deploy and manage apps by using Microsoft Configuration Manager](#deploy-and-manage-apps-by-using-microsoft-configuration-manager) section. - -You can use Intune to deploy Microsoft Store and Windows desktop apps. Intune provides improved control over which users receive specific apps. In addition, Intune allows you to deploy apps to companion devices (such as iOS or Android devices). Finally, Intune helps you manage app security and features, such as mobile application management policies that let you manage apps on devices that aren't enrolled in Intune or that another solution manages. - -For more information about how to configure Intune to manage your apps, see the following resources: - -- [Add apps with Microsoft Intune](/mem/intune/apps/apps-add) -- [Deploy apps with Microsoft Intune](/mem/intune/apps/apps-windows-10-app-deploy) -- [Protect apps and data with Microsoft Intune](/mem/intune/apps/app-protection-policy) -- [Help protect your data with full or selective wipe using Microsoft Intune](/mem/intune/remote-actions/devices-wipe) - -### Deploy and manage apps by using Microsoft Configuration Manager - -You can use Microsoft Configuration Manager to deploy Microsoft Store and Windows desktop apps. Configuration Manager allows you to create a Configuration Manager application that you can use to deploy apps to different devices (such as Windows 10 desktop, iOS, or Android devices) by using *deployment types*. You can think of a Configuration Manager application as a box. You can think of deployment types as one or more sets of installation files and installation instructions within that box. - -For example, you could create a Skype application that contains a deployment type for Windows 10 desktop, iOS, and Android. You can deploy the one application to multiple device types. - -> [!NOTE] -> When you configure Configuration Manager and Intune in a hybrid model, you deploy apps by using Configuration Manager as described in this section. - -Configuration Manager helps you manage apps by monitoring app installation. You can determine how many of your devices have a specific app installed. Finally, you can allow users to install apps at their discretion or make apps mandatory. - -For more information about how to configure Configuration Manager to deploy and manage your apps, see [Deploy and manage applications with Configuration Manager](/mem/configmgr/apps/deploy-use/deploy-applications). - -### Manage updates by using Intune - -If you selected to manage updates by using Configuration Manager and Intune in a hybrid configuration, then skip this section and continue to the [Manage updates by using Microsoft Configuration Manager](#manage-updates-by-using-microsoft-configuration-manager) section. - -To help ensure that your users have the most current features and security protection, keep Windows 10 and your apps current with updates. To configure Windows 10 and app updates, use the **Updates** workspace in Intune. - -> [!NOTE] -> You can only manage updates (including antivirus and antimalware updates) for Windows 10 desktop operating systems (not iOS or Android). - -For more information about how to configure Intune to manage updates and malware protection, see the following resources: - -- [Keep Windows PCs up to date with software updates in Microsoft Intune](/mem/intune/protect/windows-update-for-business-configure) -- [Help secure Windows PCs with Endpoint Protection for Microsoft Intune](/mem/intune/protect/endpoint-protection-configure) - -### Manage updates by using Microsoft Configuration Manager - -To ensure that your users have the most current features and security protection, use the software updates feature in Configuration Manager to manage updates. The software updates feature works in conjunction with WSUS to manage updates for Windows 10 devices. - -You configure the software updates feature to manage updates for specific versions of Windows and apps. Then, the software updates feature obtains the updates from Windows Updates by using the WSUS server in your environment. This integration provides greater granularity of control over updates and more specific targeting of updates to users and devices (compared to WSUS alone or Intune alone), which allows you to ensure that the right user or device gets the right updates. - -> [!NOTE] -> When you configure Configuration Manager and Intune in a hybrid model, you use Configuration manager to manage updates as described in this section. - -For more information about how to configure Configuration Manager to manage Windows 10 and app updates, see [Deploy and manage software updates in Configuration Manager](/mem/configmgr/sum/understand/software-updates-introduction). - -#### Summary - -In this section, you prepared your institution for device management. You identified the configuration settings that you want to use to manage your users and devices. You configured Group Policy or Intune to manage these configuration settings. You configured Intune or Microsoft Configuration Manager to manage your apps. Finally, you configured Intune or Microsoft Configuration Manager to manage software updates for Windows 10 and your apps. - -## Deploy Windows 10 to devices - -You’re ready to deploy Windows 10 to faculty and student devices. You must complete the steps in this section for each student device in the classrooms and for any new student devices you add in the future. You can also perform these actions for any device that’s eligible for a Windows 10 upgrade. This section discusses deploying Windows 10 to new devices, refreshing Windows 10 on existing devices, and upgrading existing devices that are running eligible versions of Windows 8.1 or Windows 7 to Windows 10. - -### Prepare for deployment - -Prior to deployment of Windows 10, complete the tasks in Table 18. Most of these tasks are already complete, but use this step to make sure. - -| | Task | -|:---|:---| -|**1.** |Ensure that the target devices have sufficient system resources to run Windows 10.| -|**2.** |Identify the necessary devices drivers, and then import them into the MDT deployment share or Microsoft Configuration Manager.| -|**3.** |For each Microsoft Store and Windows desktop app, create an MDT application or Configuration Manager application.| -|**4.** |Notify the students and faculty about the deployment.| - -*Table 18. Deployment preparation checklist* - -### Perform the deployment - -Use the Deployment Wizard to deploy Windows 10. With the LTI deployment process, you provide only minimal information to the Deployment Wizard at the beginning of the process. After the wizard collects the necessary information, the remainder of the process is fully automated. - -> [!NOTE] -> To fully automate the LTI deployment process, complete the steps in the “Fully Automated LTI Deployment Scenario” section in the [Microsoft Deployment Toolkit Samples Guide](/mem/configmgr/mdt/samples-guide#Anchor_6). - - -In most instances, deployments occur without incident. Only in rare occasions do deployments experience problems. - -#### To use LTI to deploy Windows 10 - -1. **Initiate the LTI deployment process.** Initiate the LTI deployment process by booting over the network (PXE boot) or from local media. You selected the method for initiating the LTI deployment process in the [Select a method to initiate deployment](#select-a-method-to-initiate-deployment) section earlier in this guide. - -2. **Complete the Deployment Wizard.** For more information about how to complete the Deployment Wizard, see the “Running the Deployment Wizard” section of [Using the Microsoft Deployment Toolkit](/mem/configmgr/mdt/use-the-mdt#Anchor_5). - -#### To use ZTI to deploy Windows 10 - -1. **Initiate the ZTI deployment process.** Initiate the ZTI deployment process by booting over the network (PXE boot) or from local media. You selected the method for initiating the ZTI deployment process in the [Select a method to initiate deployment](#select-a-method-to-initiate-deployment) section earlier in this guide. - -### Set up printers - -After you've deployed Windows 10, the devices are almost ready for use. First, you must set up the printers that each classroom will use. Typically, you connect the printers to the same network as the devices in the same classroom. If you don’t have printers in your classrooms, skip this section and proceed to [Verify deployment](#verify-deployment). - -> [!NOTE] -> If you’re performing an upgrade instead of a new deployment, the printers remain configured as they were in the previous version of Windows. As a result, you can skip this section and proceed to [Verify deployment](#verify-deployment). - -#### To set up printers - -1. Review the printer manufacturer’s instructions for installing the printer drivers. - -2. On the admin device, download the printer drivers. - -3. Copy the printer drivers to a USB drive. - -4. On a device, use the same account you used to set up Windows 10 in the [Prepare for deployment](#prepare-for-deployment) section to sign in to the device. - -5. Plug the USB drive into the device. - -6. Follow the printer manufacturer’s instructions to install the printer drivers from the USB drive. - -7. Verify that the printer drivers were installed correctly by printing a test page. - -8. Complete steps 1–8 for each printer. - -### Verify deployment - -As a final quality control step, verify the device configuration to ensure that all apps run. Microsoft recommends that you perform all the tasks that the user would perform. Specifically, verify that: - -* The device can connect to the Internet and view the appropriate web content in Microsoft Edge. -* Windows Update is active and current with software updates. -* Windows Defender is active and current with malware Security intelligence. -* Windows Defender SmartScreen is active. -* All Microsoft Store apps are properly installed and updated. -* All Windows desktop apps are properly installed and updated. -* Printers are properly configured. - -When you've verified that the first device is properly configured, you can move to the next device and perform the same steps. - -#### Summary - -You prepared the devices for deployment by verifying that they have adequate system resources and that the resources in the devices have corresponding Windows 10 device drivers. You performed device deployment over the network or by using local MDT media. Next, you configured the appropriate printers on the devices. Finally, you verified that the devices are properly configured and ready for use. - -## Maintain Windows devices and Office 365 - -After the initial deployment, you need to perform certain tasks to maintain the Windows 10 devices and your Office 365 Education subscription. You should perform these tasks on the following schedule: - -- **Monthly.** These tasks help ensure that the devices are current with software updates and properly protected against viruses and malware. -- **New semester or academic year.** Perform these tasks prior to the start of a new curriculum—for example, at the start of a new academic year or semester. These tasks help ensure that the classroom environments are ready for the next group of students. -- **As required (ad hoc).** Perform these tasks as necessary in a classroom. For example, a new version of an app may be available, or a student may inadvertently corrupt a device so that you must restore it to the default configuration. - -Table 19 lists the school and individual classroom maintenance tasks, the resources for performing the tasks, and the schedule (or frequency) on which you should perform the tasks. - -|Task and resources|Monthly|New semester or academic year|As required| -|--- |--- |--- |--- | -|Verify that Windows Update is active and current with operating system and software updates.
                        For more information about completing this task when you have:
                      • Intune, see [Keep Windows PCs up to date with software updates in Microsoft Intune](/mem/intune/protect/windows-update-for-business-configure)
                      • Group Policy, see [Windows Update for Business](/windows/deployment/update/waas-manage-updates-wufb).
                      • WSUS, see [Windows Server Update Services](/windows/deployment/deploy-whats-new).
                        Neither Intune, Group Policy, nor WSUS, see "Install, upgrade, & activate" in Windows 10 help.|✔️|✔️|✔️| -|Verify that Windows Defender is active and current with malware Security intelligence.
                        For more information about completing this task, see [Turn Windows Defender on or off](/mem/intune/user-help/turn-on-defender-windows) and [Updating Windows Defender](/mem/intune/user-help/turn-on-defender-windows).|✔️|✔️|✔️| -|Verify that Windows Defender has run a scan in the past week and that no viruses or malware were found.
                        For more information about completing this task, see the “How do I find and remove a virus?” topic in [Protect my PC from viruses](https://support.microsoft.com/help/17228/windows-protect-my-pc-from-viruses).|✔️|✔️|✔️| -|Download and approve updates for Windows 10, apps, device driver, and other software.
                        For more information, see:
                      • [Manage updates by using Intune](#manage-updates-by-using-intune)
                      • [Manage updates by using Microsoft Configuration Manager](#manage-updates-by-using-microsoft-configuration-manager)|✔️|✔️|✔️| -|Verify that you’re using the appropriate Windows 10 servicing options for updates and upgrades (such as selecting whether you want to use Current Branch or Current Branch for Business).
                        For more information about Windows 10 servicing options for updates and upgrades, see [Windows 10 servicing options](/windows/deployment/update/).||✔️|✔️| -|Refresh the operating system and apps on devices.
                        For more information about completing this task, see the following resources:
                      • [Prepare for deployment](#prepare-for-deployment)
                      • [Capture the reference image](#capture-the-reference-image)
                      • [Deploy Windows 10 to devices](#deploy-windows-10-to-devices)||✔️|✔️| -|Install any new Windows desktop apps, or update any Windows desktop apps used in the curriculum.
                        For more information, see:
                      • [Deploy and manage apps by using Intune](#deploy-and-manage-apps-by-using-intune)
                      • [Deploy and manage apps by using Microsoft Configuration Manager](#deploy-and-manage-apps-by-using-microsoft-configuration-manager)||✔️|✔️| -|Install new or update existing Microsoft Store apps used in the curriculum.
                        Microsoft Store apps are automatically updated from Microsoft Store. The menu bar in the Microsoft Store app shows whether any Microsoft Store app updates are available for download.
                        You can also deploy Microsoft Store apps directly to devices by using Intune, Microsoft Configuration Manager, or both in a hybrid configuration.
                        For more information, see:
                      • [Deploy and manage apps by using Intune](#deploy-and-manage-apps-by-using-intune)
                      • [Deploy and manage apps by using Microsoft Configuration Manager](#deploy-and-manage-apps-by-using-microsoft-configuration-manager)||✔️|✔️| -|Remove unnecessary user accounts (and corresponding licenses) from AD DS and Office 365 (if you've an on-premises AD DS infrastructure).
                        For more information about how to:
                      • Remove unnecessary user accounts, see [Active Directory Administrative Center](/windows-server/identity/ad-ds/get-started/adac/active-directory-administrative-center)
                      • Remove licenses, see [Add users and assign licenses](/microsoft-365/admin/add-users/add-users)||✔️|✔️| -|Add new accounts (and corresponding licenses) to AD DS (if you've an on-premises AD DS infrastructure).
                        For more information about how to:
                      • Add user accounts, see [Bulk-import user and group accounts into AD DS](#bulk-import-user-and-group-accounts-into-ad-ds)
                      • Assign licenses, see [Add users and assign licenses](/microsoft-365/admin/add-users/add-users)||✔️|✔️| -|Remove unnecessary user accounts (and corresponding licenses) from Office 365 (if you don't have an on-premises AD DS infrastructure).
                        For more information about how to:
                      • Remove unnecessary user accounts, see [Delete or restore users](/microsoft-365/admin/add-users/delete-a-user)
                      • Remove licenses, [Assign or remove licenses for Microsoft 365](/microsoft-365/admin/add-users/add-users).||✔️|✔️| -|Add new accounts (and corresponding licenses) to Office 365 (if you don’t have an on-premises AD DS infrastructure).
                        For more information about how to:
                      • Add user accounts, see [Add users to Microsoft 365](/microsoft-365/admin/add-users/add-users) and [Add users individually or in bulk to Office 365](https://www.youtube.com/watch?v=zDs3VltTJps).
                      • Assign licenses, see [Add users to Microsoft 365](/microsoft-365/admin/add-users/add-users).||✔️|✔️| -|Create or modify security groups, and manage group membership in Office 365.
                        For more information about how to:
                      • Create or modify security groups, see [Create a Microsoft 365 group](/microsoft-365/admin/create-groups/create-groups)
                      • Manage group membership, see [Manage Group membership](/microsoft-365/admin/create-groups/add-or-remove-members-from-groups).||✔️|✔️| -|Create or modify Exchange Online or Microsoft Exchange Server distribution lists in Office 365.
                        For more information about how to create or modify Exchange Online or Exchange Server distribution lists in Office 365, see [Create and manage distribution groups](/exchange/recipients-in-exchange-online/manage-distribution-groups/manage-distribution-groups) and [Create, edit, or delete a security group](/microsoft-365/admin/email/create-edit-or-delete-a-security-group).||✔️|✔️| -|Install new student devices.
                        Follow the same steps you followed in the[Deploy Windows 10 to devices](#deploy-windows-10-to-devices) section.|||✔️| - -*Table 19. School and individual classroom maintenance tasks, with resources and the schedule for performing them* - -#### Summary - -You've now identified the tasks you need to perform monthly, at the end of an academic year or semester, and as required. Your district and individual school configuration should match the typical school configuration you saw in the [Plan a typical district configuration](#plan-a-typical-district-configuration) section. By performing these maintenance tasks, you help ensure that your district as a whole stays secure and is configured as you specified. - -## Related topics - -* [Try it out: Windows 10 deployment (for educational institutions)](../index.yml) -* [Try it out: Windows 10 in the classroom](../index.yml) -* [Chromebook migration guide](./chromebook-migration-guide.md) -* [Deploy Windows 10 in a school](./deploy-windows-10-in-a-school.md) -* [Automate common Windows 10 deployment and configuration tasks for a school environment (video)](./index.yml) -* [Deploy a custom Windows 10 Start menu layout for a school (video)](./index.yml) -* [Manage Windows 10 updates and upgrades in a school environment (video)](./index.yml) -* [Reprovision devices at the end of the school year (video)](./index.yml) -* [Use MDT to deploy Windows 10 in a school (video)](./index.yml) -* [Use Microsoft Store for Business in a school environment (video)](./index.yml) diff --git a/education/windows/deploy-windows-10-in-a-school.md b/education/windows/deploy-windows-10-in-a-school.md deleted file mode 100644 index d1c9aea19e..0000000000 --- a/education/windows/deploy-windows-10-in-a-school.md +++ /dev/null @@ -1,894 +0,0 @@ ---- -title: Deploy Windows 10 in a school -description: Learn how to integrate your school environment with Microsoft Office 365, Active Directory Domain Services (AD DS), and Microsoft Entra ID. Deploy Windows 10 and apps to new devices or upgrade existing devices to Windows 10. Manage faculty, students, and devices by using Microsoft Intune and Group Policy. -ms.topic: how-to -ms.date: 08/10/2022 -appliesto: - - ✅ Windows 10 ---- - -# Deploy Windows 10 in a school - -This guide shows you how to deploy the Windows 10 operating system in a school environment. You learn how to deploy Windows 10 in classrooms; integrate the school environment with Microsoft Office 365, Active Directory Domain Services (AD DS), and Microsoft Entra ID; and deploy Windows 10 and your apps to new devices or upgrade existing devices to Windows 10. This guide also describes how to use Microsoft Intune and Group Policy to manage devices. Finally, the guide discusses common, ongoing maintenance tasks that you'll perform after initial deployment and the automated tools and built-in features of the operating system. - -## Prepare for school deployment - -Proper preparation is essential for a successful school deployment. To avoid common mistakes, your first step is to plan a typical school configuration. As with building a house, you need a blueprint for what your school should look like when it’s finished. The second step in preparation is to learn how you'll configure your school. Just as a builder needs to have the right tools to build a house, you need the right set of tools to deploy your school. - -### Plan a typical school configuration - -As part of preparing for your school deployment, you need to plan your configuration—the focus of this guide. Figure 1 illustrates a typical finished school configuration that you can use as a model (the blueprint in our builder analogy) for the finished state. - -:::image type="content" source="images/deploy-win-10-school-figure1.png" alt-text="A finished school configuration for a Windows client deployment."::: - -*Figure 1. Typical school configuration for this guide* - -Figure 2 shows the classroom configuration this guide uses. - -:::image type="content" source="images/deploy-win-10-school-figure2.png" alt-text="See the classroom configuration used in this Windows client deployment guide."::: - -*Figure 2. Typical classroom configuration in a school* - -This school configuration has the following characteristics: -- It contains one or more admin devices. -- It contains two or more classrooms. -- Each classroom contains one teacher device. -- The classrooms connect to each other through multiple subnets. -- All devices in each classroom connect to a single subnet. -- All devices have high-speed, persistent connections to each other and to the Internet. -- All teachers and students have access to Microsoft Store or Microsoft Store for Business. -- All devices receive software updates from Intune (or another device management system). -- You install a 64-bit version of Windows 10 on the admin device. -- You install the Windows Assessment and Deployment Kit (Windows ADK) on the admin device. -- You install the Windows Assessment and Deployment Kit (Windows ADK) on the admin device. -- You install the 64-bit version of the Microsoft Deployment Toolkit (MDT) 2013 Update 2 on the admin device. - - > [!NOTE] - > In this guide, all references to MDT refer to the 64-bit version of MDT 2013 Update 2. - -- The devices use Microsoft Entra ID in Office 365 Education for identity management. -- If you've on-premises AD DS, you can [integrate Microsoft Entra ID with on-premises AD DS](/azure/active-directory/hybrid/whatis-hybrid-identity). -- Use [Intune](/mem/intune/), [Set up Basic Mobility and Security](/microsoft-365/admin/basic-mobility-security/set-up), or Group Policy in AD DS to manage devices. -- Each device supports a one-student-per-device or multiple-students-per-device scenario. -- The devices can be a mixture of different make, model, and processor architecture (32 bit or 64 bit) or be identical. -- To start a Windows 10 deployment, use a USB flash drive, DVD-ROM or CD-ROM, or Pre-Boot Execution Environment Boot (PXE Boot). -- The devices can be a mixture of different Windows 10 editions, such as Windows 10 Home, Windows 10 Pro, and Windows 10 Education. - -Office 365 Education allows: - -- Students and faculty to use Microsoft Office to create and edit Microsoft Word, OneNote, PowerPoint, and Excel documents in a browser. -- Teachers to use the [OneNote Class Notebook app](https://www.onenote.com/classnotebook) to share content and collaborate with students. -- Faculty to use the [OneNote Staff Notebooks app](https://www.onenote.com/staffnotebookedu) to collaborate with other teachers, administration, and faculty. -- Teachers to employ Sway to create interactive educational digital storytelling. -- Students and faculty to use email and calendars, with mailboxes up to 50 GB per user. -- Faculty to use advanced email features like email archiving and legal hold capabilities. -- Faculty to help prevent unauthorized users from accessing documents and email by using Azure Rights Management. -- Faculty to use advanced compliance tools on the unified eDiscovery pages in the Microsoft Purview compliance portal. -- Faculty to host online classes, parent–teacher conferences, and other collaboration in Skype for Business or Skype. -- Students and faculty to access up to 1 TB of personal cloud storage that users inside and outside the educational institution can share through OneDrive for Business. -- Teachers to provide collaboration in the classroom through Microsoft SharePoint Online team sites. -- Students and faculty to use Office 365 Video to manage videos. -- Students and faculty to use Viva Engage to collaborate through private social networking. -- Students and faculty to access classroom resources from anywhere on any device (including iOS and Android devices). - -For more information about Office 365 Education features and a FAQ, go to [Office 365 Education](https://www.microsoft.com/microsoft-365/academic/compare-office-365-education-plans). - -## How to configure a school - -Now that you've the plan (blueprint) for your classroom, you’re ready to learn about the tools you'll use to deploy it. There are many tools you could use to accomplish the task, but this guide focuses on using those tools that require the least infrastructure and technical knowledge. - -The primary tool you'll use to deploy Windows 10 in your school is MDT, which uses Windows ADK components to make deployment easier. You could just use the Windows ADK to perform your deployment, but MDT simplifies the process by providing an intuitive, wizard-driven user interface (UI). - -You can use MDT as a stand-alone tool or integrate it with Microsoft Configuration Manager. As a stand-alone tool, MDT performs Lite Touch Installation (LTI) deployments—deployments that require minimal infrastructure and allow you to control the level of automation. When integrated with Configuration Manager, MDT performs Zero Touch Installation (ZTI) deployments, which require more infrastructure (such as Configuration Manager) but result in fully automated deployments. - -MDT includes the Deployment Workbench—a console from which you can manage the deployment of Windows 10 and your apps. You configure the deployment process in the Deployment Workbench, including the management of operating systems, device drivers, apps, and migration of user settings on existing devices. - -LTI performs deployment from a *deployment share*—a network-shared folder on the device where you installed MDT. You can perform over-the-network deployments from the deployment share or perform deployments from a local copy of the deployment share on a USB drive or DVD. You'll learn more about MDT in the [Prepare the admin device](#prepare-the-admin-device) section. - -The focus of MDT is deployment, so you also need tools that help you manage your Windows 10 devices and apps. You can manage Windows 10 devices and apps with [Microsoft Intune](/mem/intune/fundamentals/what-is-intune), [Configuration Manager](/mem/configmgr/core/understand/introduction), the Compliance Management feature in Office 365, or Group Policy in AD DS. You can use any combination of these tools based on your school requirements. - -The configuration process requires the following devices: - -- **Admin device.** This is the device you use for your day-to-day job functions. It’s also the one you use to create and manage the Windows 10 and app deployment process. You install the Windows ADK and MDT on this device. -- **Faculty devices.** These are the devices that the teachers and other faculty use for their day-to-day job functions. You use the admin device to deploy (or upgrade) Windows 10 and apps to these devices. -- **Student devices.** The students will use these devices. You'll use the admin device deploy (or upgrade) Windows 10 and apps to them. - -The high-level process for deploying and configuring devices within individual classrooms and the school as a whole is as follows and illustrated in Figure 3: - -1. Prepare the admin device for use, which includes installing the Windows ADK and MDT. -2. On the admin device, create and configure the Office 365 Education subscription that you'll use for each classroom in the school. -3. On the admin device, configure integration between on-premises AD DS and Microsoft Entra ID (if you've an on premises AD DS configuration). -4. On the admin device, create and configure a Microsoft Store for Business portal. -5. On the admin device, prepare for management of the Windows 10 devices after deployment. -6. On the student and faculty devices, deploy Windows 10 to new or existing devices, or upgrade eligible devices to Windows 10. -7. On the admin device, manage the Windows 10 devices and apps, the Office 365 subscription, and the AD DS and Microsoft Entra integration. - -:::image type="content" source="images/deploy-win-10-school-figure3.png" alt-text="See the high level process of configuring Windows client devices in a classroom and the school"::: - -*Figure 3. How school configuration works* - -Each of the steps illustrated in Figure 3 directly correspond to the remaining high-level sections in this guide. - -### Summary - -In this section, you looked at the final configuration of your individual classrooms and the school as a whole upon completion of this guide. You also learned the high-level steps you need to perform to deploy the faculty and student devices in your school. - -## Prepare the admin device - -Now, you’re ready to prepare the admin device for use in the school. This process includes installing the Windows ADK, installing the MDT, and creating the MDT deployment share. - -### Install the Windows ADK - -The first step in preparing the admin device is to install the Windows ADK. The Windows ADK contains the deployment tools that MDT uses, including the Windows Preinstallation Environment (Windows PE), the Windows User State Migration Tool (USMT), and Deployment Image Servicing and Management. - -When you install the Windows ADK on the admin device, select the following features: - -- Deployment tools -- Windows Preinstallation Environment (Windows PE) -- User State Migration Tool (USMT) - -For more information about installing the Windows ADK, see [Step 2-2: Install the Windows ADK](/mem/configmgr/mdt/lite-touch-installation-guide#InstallWindowsADK). - -### Install MDT - -Next, install MDT. MDT uses the Windows ADK to help you manage and perform Windows 10 and app deployment and is a free tool available directly from Microsoft. - -You can use MDT to deploy 32-bit or 64-bit versions of Windows 10. Install the 64-bit version of MDT to support deployment of 32-bit and 64-bit operating systems. - -> [!NOTE] -> If you install the 32-bit version of MDT, you can install only 32-bit versions of Windows 10. Ensure that you download and install the 64-bit version of MDT so that you can install 64-bit and 32-bit versions of the operating system. - -For more information about installing MDT on the admin device, see [Installing a New Instance of MDT](/mem/configmgr/mdt/use-the-mdt#InstallingaNewInstanceofMDT). - -Now, you’re ready to create the MDT deployment share and populate it with the operating system, apps, and device drivers you want to deploy to your devices. - -### Create a deployment share - -MDT includes the Deployment Workbench, a graphical user interface that you can use to manage MDT deployment shares. A deployment share is a shared folder that contains all the MDT deployment content. The LTI Deployment Wizard accesses the deployment content over the network or from a local copy of the deployment share (known as MDT deployment media). - -For more information about how to create a deployment share, see [Step 3-1: Create an MDT Deployment Share](/mem/configmgr/mdt/lite-touch-installation-guide#step-3-configure-mdt-to-create-the-reference-computer). - -### Summary - -In this section, you installed the Windows ADK and MDT on the admin device. You also created the MDT deployment share that you'll configure and use later in the LTI deployment process. - -## Create and configure Office 365 - -Office 365 is one of the core components of your classroom environment. You create and manage student identities in Office 365, and students and teachers use the suite as their email, contacts, and calendar system. Teachers and students use Office 365 collaboration features such as SharePoint, OneNote, and OneDrive for Business. - -As a first step in deploying your classroom, create an Office 365 Education subscription, and then configure Office 365 for the classroom. For more information about Office 365 Education deployment, see [School deployment of Office 365 Education](https://www.microsoft.com/education/products/office). - -### Select the appropriate Office 365 Education license plan - -Complete the following steps to select the appropriate Office 365 Education license plan for your school: - -- Determine the number of faculty members and students who will use the classroom. Office 365 Education licensing plans are available specifically for faculty and students. You must assign faculty and students the correct licensing plan. - -- Determine the faculty members and students who need to install Office applications on devices (if any). Faculty and students can use Office applications online (standard plans) or run them locally (Microsoft 365 Apps for enterprise plans). Table 1 lists the advantages and disadvantages of standard and Microsoft 365 Apps for enterprise plans. - -*Table 1. Comparison of standard and Microsoft 365 Apps for enterprise plans* - ---- -| Plan | Advantages | Disadvantages | -| --- | --- | --- | -| Standard | - Less expensive than Microsoft 365 Apps for enterprise
                        - Can be run from any device
                        - No installation necessary | - Must have an Internet connection to use it
                        - Doesn't support all the features found in Microsoft 365 Apps for enterprise | -| Office ProPlus | - Only requires an Internet connection every 30 days (for activation)
                        - Supports full set of Office features | - Requires installation
                        - Can be installed on only five devices per user (there's no limit to the number of devices on which you can run Office apps online) | - ---- - -The best user experience is to run Microsoft 365 Apps for enterprise or use native Office apps on mobile devices. If neither of these options is available, use Office applications online. In addition, all Office 365 plans provide a better user experience by storing documents in OneDrive for Business, which is included in all Office 365 plans. OneDrive for Business keeps content in sync among devices and helps ensure that users always have access to their documents on any device. - -- Determine whether students or faculty need Azure Rights Management. - - You can use Azure Rights Management to protect classroom information against unauthorized access. Azure Rights Management protects your information inside or outside the classroom through encryption, identity, and authorization policies, securing your files and email. You can retain control of the information, even when it’s shared with people outside the classroom or your educational institution. Azure Rights Management is free to use with all Office 365 Education license plans. For more information, see [Azure Rights Management](/information-protection/). - -- Record the Office 365 Education license plans needed for the classroom in Table 2. - -*Table 2. Office 365 Education license plans needed for the classroom* - ---- -| Quantity | Plan | -| --- | --- | -| | Office 365 Education for students | -| | Office 365 Education for faculty | -| | Azure Rights Management for students | -| | Azure Rights Management for faculty | - ---- - -You'll use the Office 365 Education license plan information you record in Table 2 in the [Create user accounts in Office 365](#create-user-accounts-in-office-365) section of this guide. - -### Create a new Office 365 Education subscription - -To create a new Office 365 Education subscription for use in the classroom, use your educational institution’s email account. There are no costs to you or to students for signing up for Office 365 Education subscriptions. - -> [!NOTE] -> If you already have an Office 365 Education subscription, you can use that subscription and continue to the next section, [Add domains and subdomains](#add-domains-and-subdomains). - -#### To create a new Office 365 subscription - -1. In Microsoft Edge or Internet Explorer, type `https://portal.office.com/start?sku=faculty` in the address bar. - - If you've already used your current sign-in account to create a new Office 365 subscription, you'll be prompted to sign in. If you want to create a new Office 365 subscription, start an In-Private Window. Your options: - - - In Microsoft Edge, select Ctrl+Shift+N. Or, select **More actions** > **New InPrivate window**. - - In Internet Explorer, select Ctrl+Shift+P. Or, select **Settings** > **Safety** > **InPrivate Browsing**. - -2. On the **Get started** page, type your school email address in the **Enter your school email address** box, and then click **Sign up**. You'll receive an email in your school email account. -3. Click the hyperlink in the email in your school email account. -4. On the **One last thing** page, complete your user information, and then click **Start**. The wizard creates your new Office 365 Education subscription, and you're automatically signed in as the administrative user you specified when you created the subscription. - -### Add domains and subdomains - -Now that you've created your new Office 365 Education subscription, add the domains and subdomains that your institution uses. For example, if your institution has `contoso.edu` as the primary domain name but you've subdomains for students or faculty (such as students.contoso.edu and faculty.contoso.edu), then you need to add the subdomains. - -#### To add more domains and subdomains - -1. In the admin center, in the list view, click **DOMAINS**. -2. In the details pane, above the list of domains, on the menu bar, click **Add domain**. -3. In the Add a New Domain in Office 365 Wizard, on the **Verify domain wizard** page, click **Let’s get started**. -4. On the **Verify domain** wizard page, in the **Enter a domain you already own** box, type your domain name, and then click **Next**. -5. Sign in to your domain name management provider (for example, Network Solutions or GoDaddy), and then complete the steps for your provider. -6. Repeat these steps for each domain and subdomain you want faculty and students to use for your institution. - -### Configure automatic tenant join - -To make it easier for faculty and students to join your Office 365 Education subscription (or *tenant*), allow them to automatically sign up to your tenant (*automatic tenant join*). In automatic tenant join, when a faculty member or student signs up for Office 365, Office 365 automatically adds (joins) the user to your Office 365 tenant. - -> [!NOTE] -> By default, automatic tenant join is enabled in Office 365 Education, except for certain areas in Europe, the Middle East, and Africa. These countries/regions require opt-in steps to add new users to existing Office 365 tenants. Check your country/region requirements to determine the automatic tenant join default configuration. Also, if you use Microsoft Entra Connect, then automatic tenant join is disabled. - -Office 365 uses the domain portion of the user’s email address to know which Office 365 tenant to join. For example, if a faculty member or student provides an email address of user@contoso.edu, then Office 365 automatically performs one of the following tasks: - -- If an Office 365 tenant with that domain name (contoso.edu) exists, Office 365 automatically adds the user to that tenant. -- If an Office 365 tenant with that domain name (contoso.edu) doesn't exists, Office 365 automatically creates a new Office 365 tenant with that domain name and adds the user to it. - -You'll always want faculty and students to join the Office 365 tenant that you created. Ensure that you perform the steps in the [Create a new Office 365 Education subscription](#create-a-new-office-365-education-subscription) and [Add domains and subdomains](#add-domains-and-subdomains) sections before allowing other faculty and students to join Office 365. - -> [!NOTE] -> You can't merge multiple tenants, so any faculty or students who create their own tenant will need to abandon their existing tenant and join yours. - -All new Office 365 Education subscriptions have automatic tenant join enabled by default, but you can enable or disable automatic tenant join by using the Windows PowerShell commands in Table 3. For more information about how to run these commands, see [How can I prevent students from joining my existing Office 365 tenant](/microsoft-365/education/deploy/office-365-education-self-sign-up#how-can-i-prevent-students-from-joining-my-existing-office-365-tenant). - -*Table 3. Windows PowerShell commands to enable or disable Automatic Tenant Join* - ---- -| Action | Windows PowerShell command | -|---------|-----------------------------------------------------------| -| Enable | `Set-MsolCompanySettings -AllowEmailVerifiedUsers $true` | -| Disable | `Set-MsolCompanySettings -AllowEmailVerifiedUsers $false` | - ---- - -> [!NOTE] -> If your institution has AD DS, then disable automatic tenant join. Instead, use Microsoft Entra integration with AD DS to add users to your Office 365 tenant. - -### Disable automatic licensing - -To reduce your administrative effort, automatically assign Office 365 Education or Office 365 Education Plus licenses to faculty and students when they sign up (automatic licensing). Automatic licensing also enables Office 365 Education or Office 365 Education Plus features that don't require administrative approval. - -> [!NOTE] -> By default, automatic licensing is enabled in Office 365 Education. If you want to use automatic licensing, then skip this section and go to the next section. - -Although all new Office 365 Education subscriptions have automatic licensing enabled by default, you can enable or disable it for your Office 365 tenant by using the Windows PowerShell commands in Table 4. For more information about how to run these commands, see [How can I prevent students from joining my existing Office 365 tenant](/microsoft-365/education/deploy/office-365-education-self-sign-up#how-can-i-prevent-students-from-joining-my-existing-office-365-tenant). - -*Table 4. Windows PowerShell commands to enable or disable automatic licensing* - ---- -| Action | Windows PowerShell command | -|---------|-----------------------------------------------------------| -| Enable | `Set-MsolCompanySettings -AllowAdHocSubscriptions $true` | -| Disable | `Set-MsolCompanySettings -AllowAdHocSubscriptions $false` | - ---- - - - -### Enable Microsoft Entra ID P1 or P2 - -When you create your Office 365 subscription, you create an Office 365 tenant that includes a Microsoft Entra directory. Microsoft Entra ID is the centralized repository for all your student and faculty accounts in Office 365, Intune, and other Microsoft Entra ID–integrated apps. Microsoft Entra ID has different editions, which may include Office 365 Education. For more information, see [Introduction to Microsoft Entra tenants](/microsoft-365/education/deploy/intro-azure-active-directory). - -Educational institutions can obtain Microsoft Entra Basic edition licenses at no cost. After you obtain your licenses, activate your Microsoft Entra ID access by completing the steps in [Step 3: Activate your Microsoft Entra ID access](/azure/active-directory/fundamentals/active-directory-get-started-premium#step-3-activate-your-azure-active-directory-access). - -The Microsoft Entra ID P1 or P2 features that aren't in Microsoft Entra Basic include: - -- Allow designated users to manage group membership -- Dynamic group membership based on user metadata -- Multifactor authentication (MFA) -- Identify cloud apps that your users run -- Automatic enrollment in a mobile device management (MDM) system (such as Intune) -- Self-service recovery of BitLocker -- Add local administrator accounts to Windows 10 devices -- Microsoft Entra Connect Health monitoring -- Extended reporting capabilities - -You can assign Microsoft Entra ID P1 or P2 licenses to the users who need these features. For example, you may want the users who have access to confidential student information to use MFA. In this example, you could assign Microsoft Entra ID P1 or P2 to only those users. - -You can sign up for Microsoft Entra ID P1 or P2, and then assign licenses to users. In this section, you sign up for Microsoft Entra ID P1 or P2. You'll assign Microsoft Entra ID P1 or P2 licenses to users later in the deployment process. - -For more information, see: - -- [Microsoft Entra ID licenses](/azure/active-directory/fundamentals/active-directory-whatis) -- [Sign up for Microsoft Entra ID P1 or P2](/azure/active-directory/fundamentals/active-directory-get-started-premium) - -### Summary -You provision and initially configure Office 365 Education as part of the initial configuration. With the subscription in place, automatic tenant join configured, automatic licensing established, and Microsoft Entra ID P1 or P2 enabled (if necessary), you’re ready to select the method you'll use to create user accounts in Office 365. - -## Select an Office 365 user account–creation method - - -Now that you've an Office 365 subscription, you need to determine how you'll create your Office 365 user accounts. Use the following methods to create Office 365 user accounts: - -- **Method 1:** Automatically synchronize your on-premises AD DS domain with Microsoft Entra ID. Select this method if you've an on-premises AD DS domain. -- **Method 2:** Bulk-import the user accounts from a .csv file (based on information from other sources) into Microsoft Entra ID. Select this method if you don’t have an on-premises AD DS domain. - - - -### Method 1: Automatic synchronization between AD DS and Microsoft Entra ID - -In this method, you've an on-premises AD DS domain. As shown in Figure 4, the Microsoft Entra Connector tool automatically synchronizes AD DS with Microsoft Entra ID. When you add or change any user accounts in AD DS, the Microsoft Entra Connector tool automatically updates Microsoft Entra ID. - -> [!NOTE] -> Microsoft Entra Connect also supports synchronization from any Lightweight Directory Access Protocol version 3 (LDAPv3)–compliant directory by using the information provided in [LDAP synchronization with Microsoft Entra ID](/azure/active-directory/fundamentals/sync-ldap). - -:::image type="content" source="images/deploy-win-10-school-figure4.png" alt-text="See the automatic synchronization between Active Directory Directory Services and Azure AD."::: - -*Figure 4. Automatic synchronization between AD DS and Microsoft Entra ID* - -For more information about how to perform this step, see the [Integrate on-premises AD DS with Microsoft Entra ID](#integrate-on-premises-ad-ds-with-azure-ad) section in this guide. - - - -### Method 2: Bulk import into Microsoft Entra ID from a .csv file - -In this method, you've no on-premises AD DS domain. As shown in Figure 5, you manually prepare a `.csv` file with the student information from your source, and then manually import the information directly into Microsoft Entra ID. The `.csv` file must be in the format that Office 365 specifies. - -:::image type="content" source="images/deploy-win-10-school-figure5.png" alt-text="Create a csv file with student information, and import the csv file into Azure AD."::: - -*Figure 5. Bulk import into Microsoft Entra ID from other sources* - -To implement this method, perform the following steps: - -1. Export the student information from the source. Ultimately, you want to format the student information in the format the bulk-import feature requires. -2. Bulk-import the student information into Microsoft Entra ID. For more information about how to perform this step, see the [Bulk-import user accounts into Office 365](#bulk-import-user-accounts-into-office-365) section. - -### Summary - -In this section, you selected the method for creating user accounts in your Office 365 subscription. Ultimately, these user accounts are in Microsoft Entra ID (which is the identity management system for Office 365). Now, you’re ready to create your Office 365 accounts. - - - -## Integrate on-premises AD DS with Microsoft Entra ID - -You can integrate your on-premises AD DS domain with Microsoft Entra ID to provide identity management for your Office 365 tenant. With this integration, you can synchronize the users, security groups, and distribution lists in your AD DS domain with Microsoft Entra ID with the Microsoft Entra Connect tool. Users will be able to sign in to Office 365 automatically by using their email account and the same password they use to sign in to AD DS. - -> [!NOTE] -> If your institution doesn't have an on-premises AD DS domain, you can skip this section. - -### Select synchronization model - -Before you deploy AD DS and Microsoft Entra synchronization, you need to determine where you want to deploy the server that runs Microsoft Entra Connect. - -You can deploy the Microsoft Entra Connect tool by using one of the following methods: - -- **On premises**: As shown in Figure 6, Microsoft Entra Connect runs on premises, which have the advantage of not requiring a virtual private network (VPN) connection to Azure. It does, however, require a virtual machine (VM) or physical server. - - :::image type="content" source="images/deploy-win-10-school-figure6.png" alt-text="Microsoft Entra Connect runs on-premises and uses a virtual machine."::: - - *Figure 6. Microsoft Entra Connect on premises* - -- **In Azure**: As shown in Figure 7, Microsoft Entra Connect runs on a VM in Microsoft Entra which has the advantages of being faster to provision (than a physical, on-premises server), offers better site availability, and helps reduce the number of on-premises servers. The disadvantage is that you need to deploy a VPN gateway on premises. - - :::image type="content" source="images/deploy-win-10-school-figure7.png" alt-text="Microsoft Entra Connect runs on a VM in Microsoft Entra ID, and uses a VPN gateway on-premises."::: - - *Figure 7. Microsoft Entra Connect in Azure* - -This guide describes how to run Microsoft Entra Connect on premises. For information about running Microsoft Entra Connect in Azure, see [Deploy Office 365 Directory Synchronization (DirSync) in Microsoft Azure](/microsoft-365/enterprise/deploy-microsoft-365-directory-synchronization-dirsync-in-microsoft-azure). - - - -### Deploy Microsoft Entra Connect on premises - -In this synchronization model (illustrated in Figure 6), you run Microsoft Entra Connect on premises on a physical device or VM. Microsoft Entra Connect synchronizes AD DS user and group accounts with Microsoft Entra ID. Microsoft Entra Connect includes a wizard that helps you configure Microsoft Entra Connect for your AD DS domain and Office 365 subscription. First, you install Microsoft Entra Connect; then, you run the wizard to configure it for your institution. - - - -#### To deploy AD DS and Microsoft Entra synchronization - -1. Configure your environment to meet the prerequisites for installing Microsoft Entra Connect by performing the steps in [Prerequisites for Microsoft Entra Connect](/azure/active-directory/hybrid/how-to-connect-install-prerequisites). -2. On the VM or physical device that will run Microsoft Entra Connect, sign in with a domain administrator account. -3. Install Microsoft Entra Connect by performing the steps in [Install Microsoft Entra Connect](/azure/active-directory/hybrid/how-to-connect-install-select-installation). -4. Configure Microsoft Entra Connect features based on your institution’s requirements. For more information, see [Microsoft Entra Connect Sync: Understand and customize synchronization](/azure/active-directory/hybrid/how-to-connect-sync-whatis). - -Now that you've used on premises Microsoft Entra Connect to deploy AD DS and Microsoft Entra synchronization, you’re ready to verify that Microsoft Entra Connect is synchronizing AD DS user and group accounts with Microsoft Entra ID. - -### Verify synchronization - -Microsoft Entra Connect should start synchronization immediately. Depending on the number of users in your AD DS domain, the synchronization process can take some time. To monitor the process, view the number of AD DS users and groups the tool has synchronized with Microsoft Entra ID in the Office 365 admin console. - - - -#### To verify AD DS and Microsoft Entra synchronization - -1. In your web browser, go to [https://portal.office.com](https://portal.office.com). -2. Using the administrative account that you created in the [Create a new Office 365 Education subscription](#create-a-new-office-365-education-subscription) section, sign in to Office 365. -3. In the list view, expand **USERS**, and then click **Active Users**. -4. In the details pane, view the list of users. The list of users should mirror the users in AD DS. -5. In the list view, click **GROUPS**. -6. In the details pane, view the list of security groups. The list of users should mirror the security groups in AD DS. -7. In the details pane, double-click one of the security groups. -8. The list of security group members should mirror the group membership for the corresponding security group in AD DS. -9. Close the browser. - -Now that you've verified Microsoft Entra Connect synchronization, you’re ready to assign user licenses for Microsoft Entra ID P1 or P2. - -### Summary - -In this section, you selected your synchronization model, deployed Microsoft Entra Connect, and verified that Microsoft Entra ID is synchronizing properly. - -## Bulk-import user and group accounts into AD DS - -You can bulk-import user and group accounts into your on-premises AD DS domain. Bulk-importing accounts helps reduce the time and effort needed to create users compared to creating the accounts manually in the Office 365 Admin portal. First, you select the appropriate method for bulk-importing user accounts into AD DS. Next, you create the .csv file that contains the user accounts. Finally, you use the selected method to import the .csv file into AD DS. - -> [!NOTE] -> If your institution doesn’t have an on-premises AD DS domain, you can skip this section. - -### Select the bulk import method - -Several methods are available to bulk-import user accounts into AD DS domains. Table 5 lists the methods that the Windows Server operating system supports natively. In addition, you can use partner solutions to bulk-import user and group accounts into AD DS. - -*Table 5. AD DS bulk-import account methods* - ---- -| Method | Description and reason to select this method | -|---|---| -| **Ldifde.exe** | This command-line tool allows you to import and export objects (such as user accounts) from AD DS. Select this method if you aren’t comfortable with Microsoft Visual Basic Scripting Edition (VBScript), Windows PowerShell, or other scripting languages. For more information about using Ldifde.exe, see [Step-by-Step Guide to Bulk Import and Export to Active Directory](https://social.technet.microsoft.com/wiki/contents/articles/116.active-directory-step-by-step-guide-bulk-import-and-export.aspx), [LDIFDE—Export/Import data from Active Directory—LDIFDE commands](https://support.microsoft.com/kb/555636), [Import or Export Directory Objects Using Ldifde](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc816781(v=ws.10)), and [LDIFDE](/previous-versions/orphan-topics/ws.10/cc755456(v=ws.10)). | -| **VBScript** | This scripting language uses the Active Directory Services Interfaces (ADSI) Component Object Model interface to manage AD DS objects, including user and group objects. Select this method if you’re comfortable with VBScript. For more information about using VBScript and ADSI, see [Step-by-Step Guide to Bulk Import and Export to Active Directory](https://social.technet.microsoft.com/wiki/contents/articles/116.active-directory-step-by-step-guide-bulk-import-and-export.aspx). | -| **Windows PowerShell** | This scripting language natively supports cmdlets to manage AD DS objects, including user and group objects. Select this method if you’re comfortable with Windows PowerShell scripting. For more information about using Windows PowerShell, see [Import Bulk Users to Active Directory](/archive/blogs/technet/bettertogether/import-bulk-users-to-active-directory) and [PowerShell: Bulk create AD Users from CSV file](https://social.technet.microsoft.com/wiki/contents/articles/24541.powershell-bulk-create-ad-users-from-csv-file.aspx). | - ---- - -### Create a source file that contains the user and group accounts - -After you've selected your user and group account bulk import method, you’re ready to create the source file that contains the user and group account. You’ll use the source file as the input to the import process. The source file format depends on the method you selected. Table 6 lists the source file format for the bulk import methods. - -*Table 6. Source file format for each bulk import method* - ---- -| Method | Source file format | -|---|---| -| **Ldifde.exe** | Ldifde.exe requires a specific format for the source file. Use Ldifde.exe to export existing user and group accounts so that you can see the format. For examples of the format that Ldifde.exe requires, see [Step-by-Step Guide to Bulk Import and Export to Active Directory](https://social.technet.microsoft.com/wiki/contents/articles/116.active-directory-step-by-step-guide-bulk-import-and-export.aspx), [LDIFDE—Export/Import data from Active Directory—LDIFDE commands](https://support.microsoft.com/kb/555636), [Import or Export Directory Objects Using Ldifde](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc816781(v=ws.10)), and [LDIFDE](/previous-versions/orphan-topics/ws.10/cc755456(v=ws.10)). | -| **VBScript** | VBScript can use any .csv file format to create a source file for the bulk-import process. To create the .csv file, use software such as Excel. For examples of how to format your source file in comma-separated values (CSV) format, see [Step-by-Step Guide to Bulk Import and Export to Active Directory](https://social.technet.microsoft.com/wiki/contents/articles/116.active-directory-step-by-step-guide-bulk-import-and-export.aspx) | -| **Windows PowerShell** | Windows PowerShell can use any .csv file format you want to create as a source file for the bulk-import process. To create the .csv file, use software such as Excel. For examples of how to format your source file in CSV format, see [Import Bulk Users to Active Directory](/archive/blogs/technet/bettertogether/import-bulk-users-to-active-directory) and [PowerShell: Bulk create AD Users from CSV file](https://social.technet.microsoft.com/wiki/contents/articles/24541.powershell-bulk-create-ad-users-from-csv-file.aspx). | - ---- - -### Import the user accounts into AD DS - -With the bulk-import source file finished, you’re ready to import the user and group accounts into AD DS. The steps for importing the file are slightly different for each method. - -> [!NOTE] -> Bulk-import your group accounts first, and then import your user accounts. Importing in this order allows you to specify group membership when you import your user accounts. - -For more information about how to import user accounts into AD DS by using: - -- Ldifde.exe: See [Step-by-Step Guide to Bulk Import and Export to Active Directory](https://social.technet.microsoft.com/wiki/contents/articles/116.active-directory-step-by-step-guide-bulk-import-and-export.aspx), [LDIFDE—Export/Import data from Active Directory—LDIFDE commands](https://support.microsoft.com/kb/555636), [Import or Export Directory Objects Using Ldifde](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc816781(v=ws.10)), and [LDIFDE](/previous-versions/orphan-topics/ws.10/cc755456(v=ws.10)). -- VBScript: See [Step-by-Step Guide to Bulk Import and Export to Active Directory](https://social.technet.microsoft.com/wiki/contents/articles/116.active-directory-step-by-step-guide-bulk-import-and-export.aspx). -- Windows PowerShell: See [Import Bulk Users to Active Directory](/archive/blogs/technet/bettertogether/import-bulk-users-to-active-directory) and [PowerShell: Bulk create AD Users from CSV file](https://social.technet.microsoft.com/wiki/contents/articles/24541.powershell-bulk-create-ad-users-from-csv-file.aspx). - -### Summary - -In this section, you selected the bulk-import method, created the source file that contains the user and group accounts, and imported the user and group accounts in to AD DS. If you've Microsoft Entra Connect, it automatically synchronizes the new AD DS user and group accounts to Microsoft Entra ID. Now, you’re ready to assign user licenses for Microsoft Entra ID P1 or P2 in the [Assign user licenses for Microsoft Entra ID P1 or P2](#assign-user-licenses-for-azure-ad-premium) section later in this guide. - -## Bulk-import user accounts into Office 365 - -You can bulk-import user and group accounts directly into Office 365, reducing the time and effort required to create users. First, you bulk-import the user accounts into Office 365. Then, you create the security groups for your institution. Finally, you create the email distribution groups your institution requires. - -### Create user accounts in Office 365 - -Now that you've created your new Office 365 Education subscription, you need to create user accounts. You can add user accounts for the teachers, other faculty, and students who will use the classroom. - -You can use the Microsoft 365 admin center to add individual Office 365 accounts manually—a reasonable process when you’re adding only a few users. If you've many users, however, you can automate the process by creating a list of those users, and then use that list to create user accounts (that is, bulk-add users). - -The bulk-add process assigns the same Office 365 Education license plan to all users on the list. Therefore, you must create a separate list for each license plan you recorded in Table 2. Depending on the number of faculty members who need to use the classroom, you may want to add the faculty Office 365 accounts manually; however, use the bulk-add process to add student accounts. - -For more information about how to bulk-add users to Office 365, see [Add several users at the same time to Office 365](/microsoft-365/enterprise/add-several-users-at-the-same-time). - -> [!NOTE] -> If you encountered errors during bulk add, resolve them before you continue the bulk-add process. You can view the log file to see which users caused the errors, and then modify the .csv file to correct the problems. Click **Back** to retry the verification process. - -The email accounts are assigned temporary passwords upon creation. Communicate these temporary passwords to your users before they can sign in to Office 365. - -### Create Office 365 security groups - -Assign SharePoint Online resource permissions to Office 365 security groups, not individual user accounts. For example, create one security group for faculty members and another for students. Then, you can assign unique SharePoint Online resource permissions to faculty members and a different set of permissions to students. Add or remove users from the security groups to grant or revoke access to SharePoint Online resources. - -> [!NOTE] -> If your institution has AD DS, don’t create security accounts in Office 365. Instead, create the security groups in AD DS, and then use Microsoft Entra integration to synchronize the security groups with your Office 365 tenant. - -For information about creating security groups, see [Create a group in the Microsoft 365 admin center](/microsoft-365/admin/create-groups/create-groups). - -You can add and remove users from security groups at any time. - -> [!NOTE] -> Office 365 evaluates group membership when users sign in. If you change group membership for a user, that user may need to sign out, and then sign in again for the change to take effect. - -### Create email distribution groups - -Microsoft Exchange Online uses an email distribution group as a single email recipient for multiple users. For example, you could create an email distribution group that contains all students. Then, you could send a message to the email distribution group instead of individually addressing the message to each student. - -You can create email distribution groups based on job role (such as teachers, administration, or students) or specific interests (such as robotics, drama club, or soccer team). You can create any number of distribution groups, and users can be members of more than one group. - -> [!NOTE] -> Office 365 can take some time to complete the Exchange Online creation process. You'll have to wait until Office 365 completes the Exchange Online creation process before you can perform the following steps. - -For information about how to create security groups, see [Create a group in the Microsoft 365 admin center](/microsoft-365/admin/create-groups/create-groups). - -### Summary - -Now, you've bulk-imported the user accounts into Office 365. First, you selected the bulk-import method. Next, you created the Office 365 security groups in Office 365. Finally, you created the Office 365 email distribution groups. Now, you’re ready to assign user licenses for Microsoft Entra ID P1 or P2. - - - -## Assign user licenses for Microsoft Entra ID P1 or P2 - -Microsoft Entra ID is available in Free, Basic, and Premium editions. Microsoft Entra ID Free, which is included in Office 365 Education, has fewer features than Microsoft Entra Basic, which in turn has fewer features than Microsoft Entra ID P1 or P2. Educational institutions can obtain Microsoft Entra Basic licenses at no cost and Microsoft Entra ID P1 or P2 licenses at a reduced cost. - -You can assign Microsoft Entra ID P1 or P2 licenses to the users who need the features this edition offers. For example, you may want the users who have access to confidential student information to use MFA. In this example, you could assign Microsoft Entra ID P1 or P2 only to those users. - -For more information about: - -- Microsoft Entra editions, see [Microsoft Entra editions](/azure/active-directory/fundamentals/active-directory-whatis). -- How to assign user licenses for Microsoft Entra ID P1 or P2, see [How to assign EMS/Azure AD Premium licenses to user accounts](https://channel9.msdn.com/Series/Azure-Active-Directory-Videos-Demos/How-to-assign-Azure-AD-Premium-Licenses-to-user-accounts). - -## Create and configure a Microsoft Store for Business portal - -Microsoft Store for Business allows you to create your own private portal to manage Microsoft Store apps in your institution. With Microsoft Store for Business, you can do the following: - -- Find and acquire Microsoft Store apps. -- Manage apps, app licenses, and updates. -- Distribute apps to your users. - -For more information, see [Microsoft Store for Business overview](/microsoft-store/microsoft-store-for-business-overview). - -The following section shows you how to create a Microsoft Store for Business portal and configure it for your school. - -### Create and configure your Microsoft Store for Business portal - -To create and configure your Microsoft Store for Business portal, use the administrative account for your Office 365 subscription to sign in to Microsoft Store for Business. Microsoft Store for Business automatically creates a portal for your institution and uses your account as its administrator. - -#### To create and configure a Microsoft Store for Business portal - -1. In Microsoft Edge or Internet Explorer, go to [https://microsoft.com/business-store](https://microsoft.com/business-store). -2. On the **Microsoft Store for Business** page, click **Sign in with an organizational account**. - - If your institution has AD DS, then don’t create security accounts in Office 365. Instead, create the security groups in AD DS, and then use Microsoft Entra integration to synchronize the security groups with your Office 365 tenant. - -1. On the Microsoft Store for Business sign-in page, use the administrative account for the Office 365 subscription you created in the [Create a new Office 365 Education subscription](#create-a-new-office-365-education-subscription) section to sign in. -2. On the **Microsoft Store for Business Services Agreement** page, review the agreement, select the **I accept this agreement and certify that I have the authority to bind my organization to its terms** check box, and then click **Accept** -3. In the **Welcome to the Microsoft Store for Business** dialog box, click **OK**. - -After you create the Microsoft Store for Business portal, configure it by using the commands in the settings menu listed in Table 7. Depending on your institution, you may (or may not) need to change these settings to further customize your portal. - -*Table 7. Menu selections to configure Microsoft Store for Business settings* - ---- -| Menu selection | What you can do in this menu | -|---|---| -| Account information | Displays information about your Microsoft Store for Business account (no settings can be changed). You make changes to this information in Office 365 or the Azure portal. For more information, see [Update Microsoft Store for Business account settings](/microsoft-store/update-microsoft-store-for-business-account-settings).| -| Device Guard signing | Allows you to upload and sign Device Guard catalog and policy files. For more information about Device Guard, see [Device Guard deployment guide](/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide). | -| LOB publishers | Allows you to add line-of-business (LOB) publishers that can then publish apps to your private store. LOB publishers are internal developers or software vendors that are working with your institution. For more information, see [Working with line-of-business apps](/microsoft-store/working-with-line-of-business-apps). | -| Management tools | Allows you to add tools that you can use to distribute (deploy) apps in your private store. For more information, see [Distribute apps with a management tool](/microsoft-store/distribute-apps-with-management-tool). | -| Offline licensing | Allows you to show (or not show) offline licensed apps to people shopping in your private store. For more information, see [Licensing model: online and offline licenses](/microsoft-store/apps-in-microsoft-store-for-business#licensing-model). | -| Permissions | Allows you to grant other users in your organization the ability to buy, manage, and administer your Microsoft Store for Business portal. You can also remove permissions you've previously granted. For more information, see [Roles and permissions in Microsoft Store for Business](/microsoft-store/roles-and-permissions-microsoft-store-for-business). | -| Private store | Allows you to change the organization name used in your Microsoft Store for Business portal. When you create your portal, the private store uses the organization name that you used to create your Office 365 subscription. For more information, see [Distribute apps using your private store](/microsoft-store/distribute-apps-from-your-private-store). | - ---- - -### Find, acquire, and distribute apps in the portal - -Now that you've created your Microsoft Store for Business portal, you’re ready to find, acquire, and distribute apps that you'll add to your portal. You do this task by using the Inventory page in Microsoft Store for Business. - -> [!NOTE] -> Your educational institution can now use a credit card to pay for apps in Microsoft Store for Business. - -You can deploy apps to individual users or make apps available to users through your private store. Deploying apps to individual users restricts the app to those specified users. Making apps available through your private store allows all your users. - -For more information about how to find, acquire, and distribute apps in the portal, see [App inventory management for Microsoft Store for Business](/microsoft-store/app-inventory-management-microsoft-store-for-business). - -### Summary - -At the end of this section, you should have a properly configured Microsoft Store for Business portal. You've also found and acquired your apps from Microsoft Store. Finally, you should have deployed all your Microsoft Store apps to your users. Now, you’re ready to deploy Microsoft Store apps to your users. - -## Plan for deployment - -You'll use the LTI deployment process in MDT to deploy Windows 10 to devices or to upgrade devices to Windows 10. Prior to preparing for deployment, you must make some deployment planning decisions, including selecting the operating systems you'll use, the approach you'll use to create your Windows 10 images, and the method you'll use to initiate the LTI deployment process. - -### Select the operating systems - -Later in the process, you'll import the versions of Windows 10 you want to deploy. You can deploy the operating system to new devices, refresh existing devices, or upgrade existing devices. If: - -- New devices or refreshing existing devices, you'll complete replace the existing operating system on a device with Windows 10. -- Upgrading existing devices, you'll upgrade the existing operating system (the Windows 8.1 or Windows 7 operating system) to Windows 10. - -Depending on your school’s requirements, you may need any combination of the following Windows 10 editions: - -- **Windows 10 Home**. Use this operating system to upgrade existing eligible institution-owned and personal devices that are running Windows 8.1 Home or Windows 7 Home to Windows 10 Home. -- **Windows 10 Pro**. Use this operating system to: - - Upgrade existing eligible institution-owned and personal devices running Windows 8.1 Pro or Windows 7 Professional to Windows 10 Pro. - - Deploy new instances of Windows 10 Pro to devices so that new devices have a known configuration. -- **Windows 10 Education**. Use this operating system to: - - Upgrade institution-owned devices to Windows 10 Education. - - Deploy new instances of Windows 10 Education so that new devices have a known configuration. -- **Windows 10 Pro Education**. Use this operating system to upgrade existing eligible institution-owned devices running Windows 10 Pro Education, version 1903 or later, to Windows 10 Education using [subscription activation](/windows/deployment/windows-10-subscription-activation). - -> [!NOTE] -> Although you can use Windows 10 Home on institution-owned devices, Microsoft recommends that you use Windows 10 Pro or Windows 10 Education, instead. Windows 10 Pro and Windows 10 Education provide support for MDM, policy-based management, and Microsoft Store for Business. These features aren't available in Windows 10 Home. - -One other consideration is the mix of processor architectures you'll support. If you can, support only 64-bit versions of Windows 10. If you've devices that can run only 32-bit versions of Windows 10, you'll need to import both 64-bit and 32-bit versions of the Windows 10 editions listed above. - -> [!NOTE] -> On devices that have minimal system resources (such as devices with only 2 GB of memory or 32 GB of storage), use 32-bit versions of Windows 10 because 64-bit versions of Windows 10 place more stress on device system resources. - -Finally, as a best practice, minimize the number of operating systems that you deploy and manage. If possible, standardize institution-owned devices on one Windows 10 edition (such as a 64-bit version of Windows 10 Education or Windows 10 Pro). You can't standardize personal devices on a specific operating system version or processor architecture. - -### Select an image approach - -A key operating system image decision is whether to use a “thin” or “thick” image. *Thin images* contain only the operating system, and MDT installs the necessary device drivers and apps after the operating system has been installed. *Thick images* contain the operating system, “core” apps (such as Office), and device drivers. With thick images, MDT installs any device drivers and apps not included in the thick image after the operating system has been installed. - -The advantage to a thin image is that the final deployment configuration is dynamic, and you can easily change the configuration without having to capture another image. The disadvantage of a thin image is that it takes longer to complete the deployment. - -The advantage of a thick image is that the deployment takes less time than it would for a thin image. The disadvantage of a thick image is that you need to capture a new image each time you want to make a change to the operating system, apps, or other software in the image. - -### Select a method to initiate deployment - -The MDT deployment process is highly automated, requiring minimal information to deploy or upgrade Windows 10, but you must manually initiate the MDT deployment process. To do so, use the method listed in Table 8 that best meets the needs of your institution. - -*Table 8. Methods to initiate MDT deployment* - ---- -| Method | Description and reason to select this method | -| --- | --- | -| **Windows Deployment Services** | This method:

                        - Uses diskless booting to initiate MDT deployment
                        - Works only with devices that support PXE boot.
                        - Deploys Windows 10 over the network, which consumes more network bandwidth than deployment from local media.
                        -Deploys images more slowly than when using local media.
                        - Requires that you deploy a Windows Deployment Services server.

                        Select this method when you want to deploy Windows over-the-network and perform diskless booting. The advantage of this method is that the diskless media are generic and typically don’t require updates after you create them (the Deployment Wizard accesses the centrally located deployment share over the network). The disadvantage of this method is that over-the-network deployments are slower than deployments from local media, and you must deploy a Windows Deployment Services server. | -| **Bootable media** | This method:

                        - Initiates MDT deployment by booting from local media, including from USB drives, DVD-ROM, or CD-ROM.
                        - Deploys Windows 10 over the network, which consumes more network bandwidth than deployment from local media.
                        - Deploys images more slowly than when using local media.
                        - Requires no extra infrastructure.

                        Select this method when you want to deploy Windows over-the-network and are willing to boot the target device from local media. The advantage of this method is that the media are generic and typically don’t require updates after you create them (the Deployment Wizard accesses the centrally located deployment share over the network). The disadvantage of this method is that over-the-network deployments are slower than deployment from local media. | -| **MDT deployment media** | This method:

                        - Initiates MDT deployment by booting from a local USB hard disk.
                        - Deploys Windows 10 from local media, which consumes less network bandwidth than over-the-network methods.
                        - Deploys images more quickly than network-based methods do.
                        - Requires a USB hard disk because of the deployment share’s storage requirements (up to 100 GB).

                        Select this method when you want to perform local deployments and are willing to boot the target device from a local USB hard disk. The advantage of this method is that local deployments are faster than over-the-network deployments. The disadvantage of this method is that each time you change the deployment share, you must regenerate the MDT deployment media and update the USB hard disk. | - ---- - -### Summary - -At the end of this section, you should know the Windows 10 editions and processor architecture that you want to deploy (and will import later in the process). You also determined whether you want to use thin or thick images. Finally, you selected the method for initiating your LTI deployment. Now, you can prepare for Windows 10 deployment. - -## Prepare for deployment - -To deploy Windows 10 to devices, using the LTI deployment method in MDT. In this section, you prepare your MDT environment and Windows Deployment Services for Windows 10 deployment. - -### Configure the MDT deployment share - -The first step in preparation for Windows 10 deployment is to configure—that is, *populate*—the MDT deployment share. Table 9 lists the MDT deployment share configuration tasks that you must perform. Perform the tasks in the order represented in Table 9. - -*Table 9. Tasks to configure the MDT deployment share* - ---- -| Task | Description | -| --- | --- | -| **1. Import operating systems** | Import the operating systems that you selected in the [Select operating systems](#select-the-operating-systems) section into the deployment share. For more information about how to import operating systems, see [Import an Operating System into the Deployment Workbench](/mem/configmgr/mdt/use-the-mdt#ImportanOperatingSystemintotheDeploymentWorkbench). | -| **2. Import device drives** | Device drivers allow Windows 10 to know a device’s hardware resources and connected hardware accessories. Without the proper device drivers, certain features may be unavailable. For example, without the proper audio driver, a device can't play sounds; without the proper camera driver, the device can't take photos or use video chat.

                        Import device drivers for each device in your institution. For more information about how to import device drivers, see [Import Device Drivers into the Deployment Workbench](/mem/configmgr/mdt/use-the-mdt#ImportDeviceDriversintotheDeploymentWorkbench). | -| **3. Create MDT applications for Microsoft Store apps** | Create an MDT application for each Microsoft Store app you want to deploy. You can deploy Microsoft Store apps by using sideloading, which allows you to use the Add-AppxPackage Windows PowerShell cmdlet to deploy the .appx files associated with the app (called provisioned apps). Use this method to deploy up to 24 apps to Windows 10.

                        Prior to sideloading the .appx files, obtain the Microsoft Store .appx files that you'll use to deploy (sideload) the apps in your provisioning package. For apps in Microsoft Store, you'll need to obtain the .appx files from the app software vendor directly. If you're unable to obtain the .appx files from the app software vendor, then you or the students will need to install the apps on the student devices directly from Microsoft Store or Microsoft Store for Business.

                        If you've Intune, you can deploy Microsoft Store apps after you deploy Windows 10, as described in the [Deploy apps by using Intune](#deploy-apps-by-using-intune) section. This method provides granular deployment of Microsoft Store apps, and you can use it for ongoing management of Microsoft Store apps. This method is the preferred one for deploying and managing Microsoft Store apps.

                        In addition, you must prepare your environment for sideloading (deploying) Microsoft Store apps. For more information about how to:

                        - Prepare your environment for sideloading, see [Sideload LOB apps in Windows 10](/windows/application-management/sideload-apps-in-windows-10).
                        - Create an MDT application, see [Create a New Application in the Deployment Workbench](/mem/configmgr/mdt/use-the-mdt#CreateaNewApplicationintheDeploymentWorkbench). | -| **4. Create MDT applications for Windows desktop apps** | You need to create an MDT application for each Windows desktop app you want to deploy. You can obtain the Windows desktop apps from any source, but ensure that you've sufficient licenses for them.

                        To help reduce the effort needed to deploy Microsoft Office 2016 desktop apps, use the Office Deployment Tool, as described in [Deploy Click-to-Run for Office 365 products by using the Office Deployment Tool](/deployoffice/deploy-microsoft-365-apps-local-source?f=255&MSPPError=-2147217396).

                        If you've Intune, you can deploy Windows desktop apps after you deploy Windows 10, as described in the [Deploy apps by using Intune](#deploy-apps-by-using-intune) section. This method provides granular deployment of Windows desktop apps, and you can use it for ongoing management of the apps. This method is the preferred one for deploying and managing Windows desktop apps.

                        You can also deploy Windows desktop apps after you deploy Windows 10, as described in the [Deploy apps by using Intune](#deploy-apps-by-using-intune) section.

                        For more information about how to create an MDT application for Windows desktop apps, see [Create a New Application in the Deployment Workbench](/mem/configmgr/mdt/use-the-mdt#CreateaNewApplicationintheDeploymentWorkbench). | -| **5. Create task sequences.** | You must create a separate task sequence for each Windows 10 edition, processor architecture, operating system upgrade process, and new operating system deployment process. Minimally, create a task sequence for each Windows 10 operating system you imported in Step 1—for example, (1) if you want to deploy Windows 10 Education to new devices or refresh existing devices with a new deployment of Windows 10 Education; (2) if you want to upgrade existing devices running Windows 8.1 or Windows 7 to Windows 10 Education; or (3) if you want to run deployments and upgrades for both 32 bit and 64-bit versions of Windows 10. To do so, you must create task sequences that will:

                        - Deploy Windows 10 Education 64-bit to devices.
                        - Deploy Windows 10 Education 32-bit to devices.
                        - Upgrade existing devices to Windows 10 Education 64-bit.
                        - Upgrade existing devices to Windows 10 Education 32-bit.

                        Again, you'll create the task sequences based on the operating systems that you imported in Step 1. For more information about how to create a task sequence, see [Create a New Task Sequence in the Deployment Workbench](/mem/configmgr/mdt/use-the-mdt#CreateaNewTaskSequenceintheDeploymentWorkbench). | -| **6. Update the deployment share.** | Updating a deployment share generates the MDT boot images you use to initiate the Windows 10 deployment process. You can configure the process to create 32 bit and 64-bit versions of the .iso and .wim files you can use to create bootable media or in Windows Deployment Services.

                        For more information about how to update a deployment share, see [Update a Deployment Share in the Deployment Workbench](/mem/configmgr/mdt/use-the-mdt#UpdateaDeploymentShareintheDeploymentWorkbench).| - ---- - -### Configure Windows Deployment Services for MDT - -You can use Windows Deployment Services with MDT to automatically initiate boot images on target computers. These boot images can be Windows PE images (which you generated in Step 6 in Table 9) or custom images that can deploy operating systems directly to the target computers. - -#### To configure Windows Deployment Services for MDT - -1. Set up and configure Windows Deployment Services. - - Windows Deployment Services is a server role available in all Windows Server editions. You can enable the Windows Deployment Services server role on a new server or on any server running Windows Server in your institution. For more information about how to perform this step, see the following resources: - - - [Windows Deployment Services overview](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh831764(v=ws.11)) - - The Windows Deployment Services Help file, included in Windows Deployment Services - - [Windows Deployment Services Getting Started Guide for Windows Server 2012](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/jj648426(v=ws.11)) - -2. Add LTI boot images (Windows PE images) to Windows Deployment Services. - - The LTI boot images (.wim files) that you'll add to Windows Deployment Services are in the MDT deployment share. Locate the .wim files in the Boot subfolder in the deployment share. For more information about how to perform this step, see [Add LTI Boot Images to Windows Deployment Services](/mem/configmgr/mdt/use-the-mdt#AddLTIBootImagestoWindowsDeploymentServices). - -### Summary - -Now, Windows Deployment Services is ready to initiate the LTI deployment process in MDT. You've set up and configured Windows Deployment Services and added the LTI boot images, which you generated in the previous section, to Windows Deployment Services. Now, you’re ready to prepare to manage the devices in your institution. - -## Prepare for device management - -Before you deploy Windows 10 in your institution, you must prepare for device management. You'll deploy Windows 10 in a configuration that complies with your requirements, but you want to help ensure that your deployments remain compliant. - -### Select the management method - -If you've only one device to configure, manually configuring that one device is tedious but possible. When you've multiple classrooms of devices to configure, however, manually configuring each device becomes overwhelming. In addition, manually keeping an identical configuration on each device is difficult as the number of devices in the school increases. - -For a school, there are many ways to manage devices. Table 10 lists the methods that this guide describes and recommends. Use the information in Table 10 to determine which combination of management methods is right for your institution. - -*Table 10. School management methods* - ---- -| Method | Description | -| --- | --- | -| **Group Policy** | Group Policy is an integral part of AD DS and allows you to specify configuration settings for Windows 10 and previous versions of Windows. Select this method when you:

                        - Want to manage institution-owned devices that are domain joined (personally owned devices are typically not domain joined).
                        - Want more granular control of device and user settings.
                        - Have an existing AD DS infrastructure.
                        - Typically manage on-premises devices.
                        - Can manage a required setting only by using Group Policy.

                        The advantages of this method include:

                        - No cost beyond the AD DS infrastructure.
                        - A larger number of settings.

                        The disadvantages of this method are:

                        - Can only manage domain-joined (institution-owned devices).
                        - Requires an AD DS infrastructure (if the institution doesn't have AD DS already).
                        - Typically manages on-premises devices (unless devices connect by using a VPN or DirectAccess). | -| **Intune** | Intune is a cloud-based management system that allows you to specify configuration settings for Windows 10 and other operating systems, such as iOS/iPadOS, macOS, and Android. Intune is a subscription-based cloud service that integrates with Microsoft 365 and Azure AD.

                        Select this method when you:

                        - Want to manage institution-owned and personal devices (doesn't require that the device be domain joined).
                        - Don’t require the level of granular control over device and user settings (compared to Group Policy).
                        - Don’t have an existing AD DS infrastructure.
                        - Need to manage devices regardless of where they are (on or off premises).
                        - Can manage a required setting only by using Intune.

                        The advantages of this method are:

                        - You can manage institution-owned and personal devices.
                        - It doesn’t require that devices be domain joined.
                        - It doesn’t require any on-premises infrastructure.
                        - It can manage devices regardless of their location (on or off premises).

                        The disadvantages of this method are:

                        - Carries an extra cost for subscription.
                        - Doesn’t have a granular level control over device and user settings (compared to Group Policy). | - ---- - -### Select Microsoft-recommended settings - -Microsoft has several recommended settings for educational institutions. Table 11 lists them, provides a brief description of why you need to configure them, and recommends methods for configuring the settings. Review the settings in Table 11 and evaluate their relevancy to your institution. Use the information to help you determine whether you need to configure the setting and which method you'll use to do so. At the end, you'll have a list of settings that you want to apply to the Windows 10 devices and know which management method you'll use to configure the settings. - -*Table 11. Recommended settings for educational institutions* - ---- -| Recommendation | Description | -| --- | --- | -| **Use of Microsoft accounts** | You want faculty and students to use only Microsoft Entra accounts for institution-owned devices. For these devices, don't use Microsoft accounts or associate a Microsoft account with the Microsoft Entra accounts.

                        Personal devices typically use Microsoft accounts. Faculty and students can associate their Microsoft account with their Microsoft Entra account on these devices.

                        **Group Policy**: Configure the [Accounts: Block Microsoft accounts](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/jj966262(v=ws.11)?amp;MSPPError=-2147217396&f=255) Group Policy setting to use the Users can’t add Microsoft accounts setting option.

                        **Intune**: Enable or disable Microsoft accounts by using the **Allow Microsoft account**, **Allow adding non-Microsoft accounts manually**, and **Allow settings synchronization for Microsoft accounts** policy settings under the **Accounts and Synchronization** section of a **Windows 10 General Configuration** policy. | -| **Restrict local administrator accounts on the devices** | Ensure that only authorized users are local administrators on institution-owned devices. Typically, you don’t want students to be administrators on instruction-owned devices. Explicitly specify the users who will be local administrators on a group of devices.

                        **Group Policy**: Create a **Local Group** Group Policy preference to limit the local administrators group membership. Select the **Delete all member users** and **Delete all member groups** check boxes to remove any existing members. For more information about how to configure Local Group preferences, see [Configure a Local Group Item](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc732525(v=ws.11)).

                        **Intune**: Not available | -| **Manage the built-in administrator account created during device deployment** | When you use MDT to deploy Windows 10, the MDT deployment process automatically creates a local Administrator account with the password you specified. As a security best practice, rename the built-in Administrator account and optionally disable it.

                        **Group Policy**: Rename the built-in Administrator account by using the **Accounts: Rename administrator account** Group Policy setting. For more information about how to rename the built-in Administrator account, see [To rename the Administrator account using the Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-essentials-sbs/cc747484(v=ws.10)). You'll specify the new name for the Administrator account. You can disable the built-in Administrator account by using the **Accounts: Administrator account status** Group Policy setting. For more information about how to disable the built-in Administrator account, see [Accounts: Administrator account status](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/jj852165(v=ws.11)).

                        **Intune**: Not available. | -| **Control Microsoft Store access** | You can control access to Microsoft Store and whether existing Microsoft Store apps receive updates. You can only disable the Microsoft Store app in Windows 10 Education and Windows 10 Enterprise.

                        **Group Policy**: You can disable the Microsoft Store app by using the **Turn off the Store Application** Group Policy setting. You can prevent Microsoft Store apps from receiving updates by using the **Turn off Automatic Download and Install of updates** Group Policy setting. For more information about configuring these settings, see [Can I use Group Policy to control the Microsoft Store in my enterprise environment?](/previous-versions/windows/it-pro/windows-8.1-and-8/hh832040(v=ws.11)#BKMK_UseGP).

                        **Intune**: You can enable or disable the camera by using the **Allow application store** policy setting in the **Apps** section of a **Windows 10 General Configuration** policy. | -| **Use of Remote Desktop connections to devices** | Remote Desktop connections could allow unauthorized access to the device. Depending on your institution’s policies, you may want to disable Remote Desktop connections on your devices.

                        **Group Policy**: You can enable or disable Remote Desktop connections to devices by using the **Allow Users to connect remotely using Remote Desktop setting** in Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Connections.

                        **Intune**: Not available. | -| **Use of camera** | A device’s camera can be a source of disclosure or privacy issues in an education environment. Depending on your institution’s policies, you may want to disable the camera on your devices.

                        **Group Policy**: Not available.

                        **Intune**: You can enable or disable the camera by using the **Allow camera** policy setting in the **Hardware** section of a **Windows 10 General Configuration** policy. | -| **Use of audio recording** | Audio recording (by using the Sound Recorder app) can be a source of disclosure or privacy issues in an education environment. Depending on your institution’s policies, you may want to disable the Sound Recorder app on your devices.

                        **Group Policy**: You can disable the Sound Recorder app by using the **Do not allow Sound Recorder to run** Group Policy setting. You can disable other audio recording apps by using AppLocker policies. Create AppLocker policies by using the information in [Editing an AppLocker Policy](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ee791894(v=ws.10)) and [Create Your AppLocker Policies](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/ee791899(v=ws.11))

                        **Intune**: You can enable or disable the camera by using the **Allow voice recording** policy setting in the **Features** section of a **Windows 10 General Configuration** policy. | -| **Use of screen capture** | Screen captures can be a source of disclosure or privacy issues in an education environment. Depending on your institution’s policies, you may want to disable the ability to perform screen captures on your devices.

                        **Group Policy**: Not available.

                        **Intune**: You can enable or disable the camera by using the **Allow screen capture** policy setting in the **System** section of a **Windows 10 General Configuration** policy. | -| **Use of location services** | Providing a device’s location can be a source of disclosure or privacy issues in an education environment. Depending on your institution’s policies, you may want to disable the location service on your devices.

                        **Group Policy**: You can enable or disable location services by using the **Turn off location** Group Policy setting in User Configuration\Windows Components\Location and Sensors.

                        **Intune**: You can enable or disable the camera by using the **Allow geolocation** policy setting in the **Hardware** section of a **Windows 10 General Configuration** policy. | -| **Changing wallpaper** | Displaying a custom wallpaper can be a source of disclosure or privacy issues in an education environment (if the wallpaper displays information about the user or the device). Depending on your institution’s policies, you may want to prevent users from changing the wallpaper on your devices.

                        **Group Policy**: You can configure the wallpaper by using the **Desktop WallPaper** setting in User Configuration\Administrative Templates\Desktop\Desktop.

                        **Intune**: Not available. | - ---- - -### Configure settings by using Group Policy - -Now, you’re ready to configure settings by using Group Policy. The steps in this section assume that you've an AD DS infrastructure. You'll configure the Group Policy settings you select in the [Select Microsoft-recommended settings](#select-microsoft-recommended-settings) section. - -For more information about Group Policy, see [Group Policy Planning and Deployment Guide](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc754948(v=ws.10)). - -#### To configure Group Policy settings - -1. Create a Group Policy object (GPO) that will contain the Group Policy settings by completing the steps in [Create a new Group Policy object](/previous-versions/windows/it-pro/windows-server-2003/cc738830(v=ws.10)). -2. Configure the settings in the GPO by completing the steps in [Edit a Group Policy object](/previous-versions/windows/it-pro/windows-server-2003/cc739902(v=ws.10)). -3. Link the GPO to the appropriate AD DS site, domain, or organizational unit by completing the steps in [Link a Group Policy object to a site, domain, or organizational unit](/previous-versions/windows/it-pro/windows-server-2003/cc738954(v=ws.10)). - -### Configure settings by using Intune - -Now, you’re ready to configure settings using Intune. The steps in this section assume that you've an Office 365 subscription. You'll configure the Intune settings that you selected in the [Select Microsoft-recommended settings](#select-microsoft-recommended-settings) section. - -For more information about Intune, see [Documentation for Microsoft Intune](/mem/intune/). - -#### To configure Intune settings - -1. Check your Intune licensing. If you've a Microsoft 365 subscription, you may already have Intune. For more information, see [Microsoft Intune licensing](/mem/intune/fundamentals/licenses). -2. Enroll devices in Microsoft Intune. For more information on your enrollment options, see [Intune enrollment methods for Windows devices](/mem/intune/enrollment/windows-enrollment-methods). -3. Configure the [compliance settings](/mem/intune/protect/device-compliance-get-started) and [configuration settings](/mem/intune/configuration/device-profiles) that meet your school system's needs. -4. Use the reporting features in Intune to monitor devices. For more information, see [Intune reports](/mem/intune/fundamentals/reports). - -### Deploy apps by using Intune - -You can use Intune to deploy apps to Android, iOS/iPadOS, macOS, and Windows devices. You can manage app security and features on organization-owned devices and personal devices. - -For more information about how to configure Intune to manage your apps, see: - -- [What is Microsoft Intune app management?](/mem/intune/apps/app-management) -- [App protection policies overview](/mem/intune/apps/app-protection-policy) - -### Summary - -In this section, you prepared your institution for device management. You determined whether you want to use Group Policy or Intune to manage your devices. You identified the configuration settings that you want to use to manage your users and devices. Finally, you configured the Group Policy and Intune settings in Group Policy and Intune, respectively. - -## Deploy Windows 10 to devices - -You’re ready to deploy Windows 10 to faculty and student devices. You must complete the steps in this section for each student device in the classrooms and for any new student devices you add in the future. You can also perform these actions for any device that’s eligible for a Windows 10 upgrade. This section discusses deploying Windows 10 to new devices, refreshing Windows 10 on existing devices, and upgrading existing devices that are running eligible versions of Windows 8.1 or Windows to Windows 10. - -### Prepare for deployment - -Prior to deployment of Windows 10, ensure that you complete the tasks listed in Table 12. Most of these tasks are already complete, but use this step to make sure. - -*Table 12. Deployment preparation checklist* - ---- -| Tasks | -|-------| -| The target devices have sufficient system resources to run Windows 10. | -| Identify the necessary devices drivers, and import them to the MDT deployment share. | -| Create an MDT application for each Microsoft Store and Windows desktop app. | -| Notify the students and faculty about the deployment. | - ---- - -### Perform the deployment - -Use the Deployment Wizard to deploy Windows 10. The LTI deployment process is almost fully automated: You provide only minimal information to the Deployment Wizard at the beginning of the process. After the wizard collects the necessary information, the remainder of the process is fully automated. - -> [!NOTE] -> To fully automate the LTI deployment process, complete the steps in the “Fully Automated LTI Deployment Scenario” section in the [Microsoft Deployment Toolkit Samples Guide](/mem/configmgr/mdt/samples-guide). - -In most instances, deployments occur without incident. Only in rare occasions do deployments experience problems. - -#### To deploy Windows 10 - -1. **Initiate the LTI deployment process**. Initiate the LTI deployment process booting over the network (PXE boot) or from local media. You selected the method for initiating the LTI deployment process in the [Select a method to initiate deployment](#select-a-method-to-initiate-deployment) section earlier in this guide. -2. **Complete the Deployment Wizard**. For more information about how to complete the Deployment Wizard, see the “Running the Deployment Wizard” topic in [Using the Microsoft Deployment Toolkit](/mem/configmgr/mdt/use-the-mdt#Running%20the%20Deployment%20Wizard). - -### Set up printers - -After you've deployed Windows 10, the devices are almost ready for use. First, you must set up the printers that each classroom will use. Typically, you connect the printers to the same network as the devices in the same classroom. If you don’t have printers in your classrooms, skip this section and proceed to the [Verify deployment](#verify-deployment) section. - -> [!NOTE] -> If you’re performing an upgrade instead of a new deployment, the printers remain configured as they were in the previous version of Windows. As a result, you can skip this section and proceed to the [Verify deployment](#verify-deployment) section. - -#### To set up printers - -1. Review the printer manufacturer’s instructions for installing the printer drivers. -2. On the admin device, download the printer drivers. -3. Copy the printer drivers to a USB drive. -4. On a device, use the same account you used to set up Windows 10 in the [Perform the deployment](#perform-the-deployment) section to sign in to the device. -5. Insert the USB drive in the device. -6. Follow the printer manufacturer’s instructions to install the printer drivers from the USB drive. -7. Verify that the printer drivers were installed correctly by printing a test page. -8. Complete steps 1–8 for each printer. - -### Verify deployment - -As a final quality control step, verify the device configuration to ensure that all apps run. Microsoft recommends that you perform all the tasks that the user would perform. Specifically, verify the following requirements: - -- The device can connect to the Internet and view the appropriate web content in Microsoft Edge. -- Windows Update is active and current with software updates. -- Windows Defender is active and current with malware Security intelligence. -- Windows Defender SmartScreen is active. -- All Microsoft Store apps are properly installed and updated. -- All Windows desktop apps are properly installed and updated. -- Printers are properly configured. - -When you've verified that the first device is properly configured, you can move to the next device and perform the same steps. - -### Summary - -You prepared the devices for deployment by verifying that they have adequate system resources and that the resources in the devices have corresponding Windows 10 device drivers. You performed device deployment over the network or by using local MDT media. Next, you configured the appropriate printers on the devices. Finally, you verified that the devices are properly configured and ready for use. - -## Maintain Windows devices and Office 365 - -After the initial deployment, you'll need to perform certain tasks to maintain the Windows 10 devices and your Office 365 Education subscription. You should perform these tasks on the following schedule: - -- **Monthly.** These tasks help ensure that the devices are current with software updates and properly protected against viruses and malware. -- **New semester or academic year.** Perform these tasks prior to the start of a new curriculum—for example, at the start of a new academic year or semester. These tasks help ensure that the classroom environments are ready for the next group of students. -- **As required (ad hoc).** Perform these tasks as necessary in a classroom. For example, a new version of an app may be available, or a student may inadvertently corrupt a device so that you must restore it to the default configuration. - -Table 13 lists the school and individual classroom maintenance tasks, the resources for performing the tasks, and the schedule (or frequency) on which you should perform the tasks. - -*Table 13. School and individual classroom maintenance tasks, with resources and the schedule for performing them* - ---- -| Task and resources | Monthly | New semester or academic year | As required | -| --- | --- | --- | --- | -| Verify that Windows Update is active and current with operating system and software updates.

                        For more information about completing this task, see:

                        - Intune: See [Keep Windows PCs up to date with software updates in Microsoft Intune](https://www.microsoft.com/en-us/insidetrack/keeping-windows-10-devices-up-to-date-with-microsoft-intune-and-windows-update-for-business)
                        - Group Policy: See [Windows Update for Business](/windows/deployment/update/waas-manage-updates-wufb)
                        - Windows Server Update Services (WSUS): See [Deploy Windows Server Update Services](/windows-server/administration/windows-server-update-services/deploy/deploy-windows-server-update-services)
                        - Neither Intune, Group Policy, or WSUS: See [Update Windows](https://support.microsoft.com/windows/update-windows-3c5ae7fc-9fb6-9af1-1984-b5e0412c556a). | ✔️ | ✔️ | ✔️ | -| Verify that Windows Defender is active and current with malware Security intelligence.

                        For more information, see [Enforce compliance for Microsoft Defender for Endpoint with Conditional Access in Intune](/mem/intune/protect/advanced-threat-protection) and [Enable and configure Microsoft Defender Antivirus always-on protection in Group Policy](/microsoft-365/security/defender-endpoint/configure-real-time-protection-microsoft-defender-antivirus)). | ✔️ | ✔️ | ✔️ | -| Verify that Windows Defender has run a scan in the past week and that no viruses or malware were found.

                        For more information about completing this task, see [Protect my PC from viruses](https://support.microsoft.com/windows/protect-my-pc-from-viruses-b2025ed1-02d5-1e87-ba5f-71999008e026). | ✔️ | ✔️ | ✔️ | -| Verify that you're using the appropriate Windows 10 servicing options for updates and upgrades (such as selecting whether you want to use Current Branch or Current Branch for Business).

                        For more information about Windows 10 servicing options for updates and upgrades, see [Windows 10 servicing options for updates and upgrades](/windows/deployment/update/). | | ✔️ | ✔️ | -| Refresh the operating system and apps on devices.

                        For more information about completing this task, see the [Deploy Windows 10 to devices](#deploy-windows-10-to-devices) section. | | ✔️ | ✔️ | -| Install any new Windows desktop apps or update any Windows desktop apps that are used in the curriculum.

                        For more information, see the [Deploy apps by using Intune](#deploy-apps-by-using-intune) section. | | ✔️ | ✔️ | -| Install new or update existing Microsoft Store apps that are used in the curriculum.

                        Microsoft Store apps are automatically updated from Microsoft Store. The menu bar in the Microsoft Store app shows whether any Microsoft Store app updates are available for download.

                        You can also deploy Microsoft Store apps directly to devices by using Intune. For more information, see the [Deploy apps by using Intune](#deploy-apps-by-using-intune) section. | | ✔️ | ✔️ | -| Remove unnecessary user accounts (and corresponding licenses) from Office 365.

                        For more information, see:

                        - Remove unnecessary user accounts, see [Delete a user from your organization](/microsoft-365/admin/add-users/delete-a-user).
                        - Unassign licenses, see [Add users and assign licenses at the same time](/microsoft-365/admin/add-users/add-users). | | ✔️ | ✔️ | -| Add new accounts (and corresponding licenses) to Office 365.

                        For more information, see [Add users and assign licenses at the same time](/microsoft-365/admin/add-users/add-users) and [Assign licenses to users](/microsoft-365/admin/manage/assign-licenses-to-users). | | ✔️ | ✔️ | -| Create or modify security groups and manage group membership in Office 365.

                        For more information, see:

                        - [Create a group in the Microsoft 365 admin center](/microsoft-365/admin/create-groups/create-groups)
                        - [Add or remove members from Microsoft 365 groups using the admin center](/microsoft-365/admin/create-groups/add-or-remove-members-from-groups) | | ✔️ | ✔️ | -| Create or modify Exchange Online or Microsoft Exchange Server distribution lists in Office 365.

                        For more information, see [Create and manage distribution list groups in Exchange Online](/exchange/recipients-in-exchange-online/manage-distribution-groups/manage-distribution-groups) and [Create, edit, or delete a security group in the Microsoft 365 admin center](/microsoft-365/admin/email/create-edit-or-delete-a-security-group) | | ✔️ | ✔️ | -| Install new student devices

                        Follow the same steps in the [Deploy Windows 10 to devices](#deploy-windows-10-to-devices) section. | | | ✔️ | - ---- - -### Summary - -Now, you've identified the tasks you need to perform monthly, at the end of an academic year or semester, and as required. Your school configuration should match the typical school configuration that you saw in the [Plan a typical school configuration](#plan-a-typical-school-configuration) section. By running these maintenance tasks, you help ensure that your school stays secure and is configured as you specified. - -## Related resources - -- [Try it out: Windows 10 deployment (for educational institutions)](../index.yml) -- [Try it out: Windows 10 in the classroom](../index.yml) -- [Chromebook migration guide](/education/windows/chromebook-migration-guide) diff --git a/education/windows/deploy-windows-10-overview.md b/education/windows/deploy-windows-10-overview.md deleted file mode 100644 index bbe2d5fc6c..0000000000 --- a/education/windows/deploy-windows-10-overview.md +++ /dev/null @@ -1,92 +0,0 @@ ---- -title: Windows 10 for Education -description: Learn how to use Windows 10 in schools. -ms.topic: how-to -ms.date: 08/10/2022 -appliesto: - - ✅ Windows 10 ---- - -# Windows 10 for Education - -## Learn - -**[Windows 10 editions for education customers](windows-editions-for-education-customers.md)** - -Windows 10, version 1607 introduces two editions designed for the unique needs of K-12 institutions: Windows 10 Pro Education and Windows 10 Education. These editions provide education-specific default settings for the evolving landscape in K-12 education IT environments. - -**[Compare each Windows edition](https://www.microsoft.com/WindowsForBusiness/Compare)** - -Find out more about the features and functionality we support in each edition of Windows. - -**[Get Windows 10 Education or Windows 10 Pro Education](https://www.microsoft.com/education/buy-license/overview-of-how-to-buy/default.aspx?tabshow=schools)** - -When you've made your decision, find out how to buy Windows for your school. - -## Plan - -**[Windows 10 configuration recommendations for education customers](configure-windows-for-education.md)** - -Provides guidance on ways to customize the OS diagnostic data, consumer experiences, Cortana, search, and some of the preinstalled apps, so that Windows is ready for your school. - -**[Deployment recommendations for school IT administrators](edu-deployment-recommendations.md)** - -Learn how to customize the OS privacy settings, Skype, and Xbox for Windows-based devices used in schools so that you can choose what information is shared with Microsoft. - -**[Get Minecraft Education Edition](get-minecraft-for-education.md)** - -Minecraft Education Edition is built for learning. Learn how to get early access and add it to your Microsoft Store for Business for distribution. - -**[Take tests in Windows](take-tests-in-windows.md)** - -Take a Test is a new app that lets you create the right environment for taking tests. Learn how to use and get it set up. - -**[Chromebook migration guide](chromebook-migration-guide.md)** - -Find out how you can migrate a Chromebook-based learning environment to a Windows 10-based learning environment. - -## Deploy - -**[Set up Windows devices for education](set-up-windows-10.md)** - -Depending on your school's device management needs, you can use the Set up School PCs app or the Windows Configuration Designer tool to quickly set up student PCs. - -**[Deploy Windows 10 in a school](deploy-windows-10-in-a-school.md)** - -Get step-by-step guidance to help you deploy Windows 10 in a school environment. - -**[Deploy Windows 10 in a school district](deploy-windows-10-in-a-school-district.md)** - -Get step-by-step guidance on how to deploy Windows 10 to PCs and devices across a school district. - -**[Test Windows 10 S on existing Windows 10 education devices](test-windows10s-for-edu.md)** - -Test Windows 10 S on various Windows 10 devices (except Windows 10 Home) in your school and share your feedback with us. - -## Switch - -**[Switch to Windows 10 Pro Education from Windows 10 Pro or Windows 10 S](change-to-pro-education.md)** - -If you have an education tenant and use Windows 10 Pro or Windows 10 S in your schools, find out how you can opt-in to a free switch to Windows 10 Pro Education. - -## Windows 8.1 - -Follow these links to find step-by-step guidance on how to deploy Windows 8.1 in an academic environment. - -

                        Windows 8.1 deployment planning
                        Explore key considerations and questions that should be answered when planning for Windows 8.1 deployment.

                        -

                        Windows 8.1 deployment to PCs
                        Get an overview of Windows 8.1 deployment to PCs in an educational environment.

                        -

                        BYOD
                        Explore Bring Your Own Device (BYOD) considerations, including device types, infrastructure, and deployment models.

                        -

                        Deploying Windows RT 8.1
                        Get step-by-step instructions on how to configure and deploy Windows RT devices (like Surface and other tablets) in educational environments.

                        -

                        Virtual Desktop Infrastructure
                        Learn how to address challenges related to BYOD scenarios using Virtual Desktop Infrastructure (VDI).

                        -

                        Microsoft Store apps
                        Explore Microsoft Store app deployment strategies and considerations for educational institutions running Windows 8.1.

                        -

                        Windows To Go
                        Learn about the benefits, limitations, and processes involved in deploying Windows To Go.

                        - -## Related articles - -- [Microsoft Education documentation and resources](/education) -- [Windows for business](https://www.microsoft.com/windows/business) -- [Microsoft 365 for business](https://www.microsoft.com/microsoft-365/business) - - \ No newline at end of file diff --git a/education/windows/edu-deployment-recommendations.md b/education/windows/edu-deployment-recommendations.md deleted file mode 100644 index d343391f22..0000000000 --- a/education/windows/edu-deployment-recommendations.md +++ /dev/null @@ -1,129 +0,0 @@ ---- -title: Deployment recommendations for school IT administrators -description: Provides guidance on ways to customize the OS privacy settings, and some of the apps, for Windows-based devices used in schools so that you can choose what information is shared with Microsoft. -ms.topic: best-practice -ms.date: 08/10/2022 -appliesto: - - ✅ Windows 10 ---- - -# Deployment recommendations for school IT administrators - -Your privacy is important to us, so we want to provide you with ways to customize the OS privacy settings, and some of the apps, so that you can choose what information is shared with Microsoft. To learn more about Microsoft's commitment to privacy, see [Windows 10 and privacy](https://go.microsoft.com/fwlink/?LinkId=809305). The following sections provide some best practices and specific privacy settings we'd like you to be aware of. For more information about ways to customize the OS diagnostic data, consumer experiences, Cortana, and search, see [Windows 10 configuration recommendations for education customers](configure-windows-for-education.md). - -We want all students to have the chance to use the apps they need for success in the classroom and all school personnel to have apps they need for their job. Students and school personnel who use assistive technology apps not available in the Microsoft Store, and use devices running Windows 10 S, will be able to configure the device at no extra charge to Windows 10 Pro Education. To learn more about the steps to configure this device, see [Switch to Windows 10 Pro Education from Windows 10 Pro or Windows 10 S](change-to-pro-education.md). - -## Deployment best practices - -Keep these best practices in mind when deploying any edition of Windows 10 in schools or districts: - -* A Microsoft account is only intended for consumer services. Enterprises and educational institutions should use enterprise versions where possible, such as Skype for Business, OneDrive for Business, and so on. For schools, consider using mobile device management (MDM) or Group Policy to block students from adding a Microsoft account as a secondary account -* If schools allow the use of personal accounts by their students to access personal services, schools should be aware that these accounts belong to individuals, not the school -* IT administrators, school officials, and teachers should also consider ratings when picking apps from the Microsoft Store -* If you've students or school personnel who rely on assistive technology apps that aren't available in the Microsoft Store, and who are using a Windows 10 S device, configure their device to Windows 10 Pro Education to allow the download and use of non-Microsoft Store assistive technology apps. See [Switch to Windows 10 Pro Education from Windows 10 Pro or Windows 10 S](change-to-pro-education.md) for more info - -## Windows 10 Contacts privacy settings - -If you're an IT administrator who deploys Windows 10 in a school or district, we recommend that you review these deployment resources to make informed decisions about how you can configure telemetry for your school or district: - -* [Configure Windows telemetry in your organization](/windows/privacy/configure-windows-diagnostic-data-in-your-organization) - Describes the types of telemetry we gather and the ways you can manage this data -* [Manage connections from Windows operating system components to Microsoft services](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services) - Learn about network connections that Windows components make to Microsoft and also the privacy settings (such as location, camera, messaging, and more) that affect data that is shared with either Microsoft or apps and how you can manage this data - -In particular, the **Contacts** area in the **Settings** > **Privacy** section lets you choose which apps can access a student's contacts list. By default, this setting is turned on. - -To change the setting, you can: -* [Turn off access to contacts for all apps](#turn-off-access-to-contacts-for-all-apps) -* [Choose the apps that you want to allow access to contacts](#choose-the-apps-that-you-want-to-allow-access-to-contacts) - -### Turn off access to contacts for all apps - -To turn off access to contacts for all apps on individual Windows devices: - -1. On the computer, go to **Settings** and select **Privacy**. -1. Under the list of **Privacy** areas, select **Contacts**. -1. Turn off **Let apps access my contacts**. - -For IT-managed Windows devices, you can use a Group Policy to turn off the setting. To turn off the setting: - -1. Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access contacts**. -1. Set the **Select a setting** box to **Force Deny**. - -### Choose the apps that you want to allow access to contacts - -If you want to allow only certain apps to have access to contacts, you can use the switch for each app to specify which ones you want on or off. - -The list of apps on the Windows-based device may vary from the above example. The list depends on what apps you've installed and which of these apps access contacts. - -To allow only certain apps to have access to contacts, you can: - -- Configure each app individually using the **Settings** > **Contacts** option in the Windows UI -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access contacts** and then specify the default for each app by adding the app's Package Family Name under the default behavior you want to enforce - -## Skype and Xbox settings - -Skype (a Universal Windows Platform [UWP]) and Xbox are preinstalled as part of Windows 10. - -The Skype app replaces the integration of Skype features into Skype video and Messaging apps on Windows PCs and large tablets. The Skype app provides all these features in one place and lets users have a single place to manage both their chat and voice conversations so they can take better advantage of their screen. For information about the new Skype UWP app preview, see [Skype for Windows 10 Insiders – your most asked questions](https://go.microsoft.com/fwlink/?LinkId=821441). - -With the Xbox app, students can use their Xbox profiles to play and make progress on their games using their Windows-based device. They can also unlock achievements and show off to their friends with game clips and screenshots. The Xbox app requires a Microsoft account, which is a personal account. - -Both Skype and Xbox include searchable directories that let students find other people to connect to. The online privacy and security settings for Skype and Xbox aren't manageable through Group Policy so we recommend that school IT administrators and school officials let parents and students know about these searchable directories. - -If the school allows the use of personal or Microsoft account in addition to organization accounts, we also recommend that IT administrators inform parents and students that they can optionally remove any identifying information from the directories by: - -* [Managing the user profile](#managing-the-user-profile) -* [Deleting the account if the user name is part of the identifying information](#delete-an-account-if-username-is-identifying) - -### Managing the user profile - -#### Skype - -Skype uses the user's contact details to deliver important information about the account and it also lets friends find each other on Skype. - -To manage and edit your profile in the Skype UWP app, follow these steps: - -1. In the Skype UWP app, select the user profile icon to go to the user's profile page. -2. In the account page, select **Manage account** for the Skype account that you want to change. This will take you to the online Skype portal. -3. In the online Skype portal, scroll down to the **Account details** section. In **Settings and preferences**, click **Edit profile**. - - The profile page includes these sections: - - * Personal information - * Contact details - * Profile settings - -4. Review the information in each section and click **Edit profile** in either or both the **Personal information** and **Contact details** sections to change the information being shared. You can also remove the checks in the **Profile settings** section to change settings on discoverability, notifications, and staying in touch. -5. If you don't wish the name to be included, edit the fields and replace the fields with **XXX**. -6. To change the profile picture, go to the Skype app and click on the current profile picture or avatar. The **Manage Profile Picture** window pops up. - - * To take a new picture, click the camera icon in the pop-up window. To upload a new picture, click the three dots (**...**) - * You can also change the visibility of the profile picture between public (everyone) or for contacts only. To change the profile picture visibility, select the dropdown under **Profile picture** and choose between **Show to everyone** or **Show to contacts only** - -#### Xbox - -A user's Xbox friends and their friends' friends can see their real name and profile. By default, the Xbox privacy settings enforce that no personal identifying information of a minor is shared on the Xbox Live network, although adults in the child's family can change these default settings to allow it to be more permissive. - -To learn more about how families can manage security and privacy settings on Xbox, see this [Xbox article on security](https://go.microsoft.com/fwlink/?LinkId=821445). - - -### Delete an account if username is identifying - -If you want to delete either (or both) the Skype and the Xbox accounts, here's how to do it. - -#### Skype - -To delete a Skype account, you can follow the instructions here: [How do I close my Skype account?](https://go.microsoft.com/fwlink/?LinkId=816515) - -If you need help with deleting the account, you can contact Skype customer service by going to the [Skype support request page](https://go.microsoft.com/fwlink/?LinkId=816519). You may need to sign in and specify a Skype account. Once you've signed in, you can: - -1. Select a help topic (**Account and Password**) -1. Select a related problem (**Deleting an account**) -1. Click **Next**. -1. Select a contact method to get answers to your questions. - -#### Xbox - -To delete an Xbox account, you can follow the instructions here: [How to delete your Microsoft account and personal information associated with it](https://go.microsoft.com/fwlink/?LinkId=816521). - -## Related topics -[Deploy Windows 10 in a school](deploy-windows-10-in-a-school.md) diff --git a/education/windows/edu-stickers.md b/education/windows/edu-stickers.md index 3ac82d2b7c..889b10b393 100644 --- a/education/windows/edu-stickers.md +++ b/education/windows/edu-stickers.md @@ -1,7 +1,7 @@ --- title: Configure Stickers for Windows 11 SE description: Learn about the Stickers feature and how to configure it via Intune and provisioning package. -ms.date: 11/09/2023 +ms.date: 04/10/2024 ms.topic: how-to appliesto: - ✅ Windows 11 SE @@ -25,7 +25,7 @@ With Stickers, students feel more attached to the device as they feel as if it's ## Enable Stickers -Stickers aren't enabled by default. Follow the instructions below to configure your devices using either Microsoft Intune or a provisioning package (PPKG). +Stickers aren't enabled by default. The following instructions describe how to configure your devices using either Microsoft Intune or a provisioning package (PPKG). #### [:::image type="icon" source="images/icons/intune.svg"::: **Intune**](#tab/intune) @@ -36,7 +36,6 @@ Stickers aren't enabled by default. Follow the instructions below to configure y |
                      • OMA-URI: **`./Vendor/MSFT/Policy/Config/Stickers/EnableStickers`**
                      • Data type: **Integer**
                      • Value: **1**
                      • | [!INCLUDE [intune-custom-settings-2](../../includes/configure/intune-custom-settings-2.md)] -[!INCLUDE [intune-custom-settings-info](../../includes/configure/intune-custom-settings-info.md)] > [!TIP] > Use the following Graph call to automatically create the custom policy in your tenant without assignments nor scope tags. [1](#footnote1) @@ -52,32 +51,26 @@ Content-Type: application/json #### [:::image type="icon" source="images/icons/provisioning-package.svg"::: **PPKG**](#tab/ppkg) -To configure devices using a provisioning package, [create a provisioning package][WIN-1] using Windows Configuration Designer (WCD) with the following settings: +[!INCLUDE [provisioning-package-1](../../includes/configure/provisioning-package-1.md)] | Setting | |--------| |
                      • Path: **`Education/AllowStickers`**
                      • Value: **True**
                      • | -Follow the steps in [Apply a provisioning package][WIN-2] to apply the package that you created. - +[!INCLUDE [provisioning-package-2](../../includes/configure/provisioning-package-2.md)] --- ## How to use Stickers -Once the Stickers feature is enabled, the sticker editor can be opened by either: +Once the Stickers feature is enabled, open sticker editor by either: - using the contextual menu on the desktop and selecting the option **Add or edit stickers** - opening the Settings app > **Personalization** > **Background** > **Add stickers** :::image type="content" source="./images/win-11-se-stickers-menu.png" alt-text="Windows 11 SE desktop contextual menu to open the sticker editor" border="true"::: -Multiple stickers can be added from the picker by selecting them. The stickers can be resized, positioned or deleted from the desktop by using the mouse, keyboard, or touch. +Multiple stickers can be added from the picker by selecting them. The stickers can be resized, positioned, or deleted from the desktop by using the mouse, keyboard, or touch. :::image type="content" source="./images/win-11-se-stickers-animation.gif" alt-text="animation showing Windows 11 SE desktop with 4 pirate stickers being resized and moved" border="true"::: Select the *X button* at the top of the screen to save your progress and close the sticker editor. - -[MEM-1]: /mem/intune/configuration/custom-settings-windows-10 - -[WIN-1]: /windows/configuration/provisioning-packages/provisioning-create-package -[WIN-2]: /windows/configuration/provisioning-packages/provisioning-apply-package \ No newline at end of file diff --git a/education/windows/edu-take-a-test-kiosk-mode.md b/education/windows/edu-take-a-test-kiosk-mode.md index 79b60c3c9e..21664c95bd 100644 --- a/education/windows/edu-take-a-test-kiosk-mode.md +++ b/education/windows/edu-take-a-test-kiosk-mode.md @@ -26,7 +26,7 @@ The other options allow you to configure Take a Test in kiosk mode using a local Follow the instructions below to configure your devices, selecting the option that best suits your needs. -#### [:::image type="icon" source="images/icons/intune.svg"::: **Intune**](#tab/intune) +# [:::image type="icon" source="images/icons/intune.svg"::: **Intune**](#tab/intune) You can use Intune for Education or a custom profile in Microsoft Intune: @@ -68,9 +68,8 @@ To configure devices using Intune for Education, follow these steps: :::image type="content" source="./images/takeatest/intune-take-a-test-custom-profile.png" alt-text="Intune portal - creation of a custom policy to configure Take a Test." lightbox="./images/takeatest/intune-take-a-test-custom-profile.png" border="true"::: [!INCLUDE [intune-custom-settings-2](../../includes/configure/intune-custom-settings-2.md)] -[!INCLUDE [intune-custom-settings-info](../../includes/configure/intune-custom-settings-info.md)] -#### [:::image type="icon" source="images/icons/provisioning-package.svg"::: **PPKG**](#tab/ppkg) +# [:::image type="icon" source="images/icons/provisioning-package.svg"::: **PPKG**](#tab/ppkg) To create a provisioning package, you can either use Set up School PCs or Windows Configuration Designer: @@ -85,7 +84,7 @@ Create a provisioning package using the Set up School PCs app, configuring the s ### Create a provisioning package using Windows Configuration Designer -[Create a provisioning package][WIN-1] using Windows Configuration Designer with the following settings: +[!INCLUDE [provisioning-package-1](../../includes/configure/provisioning-package-1.md)] | Setting | |--------| @@ -99,22 +98,11 @@ Create a provisioning package using the Set up School PCs app, configuring the s :::image type="content" source="./images/takeatest/wcd-take-a-test.png" alt-text="Windows Configuration Designer - configuration of policies to enable Take a Test to run in kiosk mode" lightbox="./images/takeatest/wcd-take-a-test.png" border="true"::: -Follow the steps in [Apply a provisioning package][WIN-2] to apply the package that you created. +[!INCLUDE [provisioning-package-2](../../includes/configure/provisioning-package-2.md)] -#### [:::image type="icon" source="images/icons/powershell.svg"::: **PowerShell**](#tab/powershell) +# [:::image type="icon" source="images/icons/powershell.svg"::: **PowerShell**](#tab/powershell) -Configure your devices using PowerShell scripts via the [MDM Bridge WMI Provider](/windows/win32/dmwmibridgeprov/mdm-bridge-wmi-provider-portal). For more information, see [Using PowerShell scripting with the WMI Bridge Provider](/windows/client-management/mdm/using-powershell-scripting-with-the-wmi-bridge-provider). - -> [!TIP] -> PowerShell scripts can be executed as scheduled tasks via Group Policy. - -> [!IMPORTANT] -> For all device settings, the WMI Bridge client must be executed as SYSTEM (LocalSystem) account. -> -> To test a PowerShell script, you can: -> 1. [Download the psexec tool](/sysinternals/downloads/psexec) -> 1. Open an elevated command prompt and run: `psexec.exe -i -s powershell.exe` -> 1. Run the script in the PowerShell session +[!INCLUDE [powershell-wmi-bridge-1](../../includes/configure/powershell-wmi-bridge-1.md)] Edit the following sample PowerShell script to: @@ -171,7 +159,9 @@ $cimObject.HideFastUserSwitching = 1 Set-CimInstance -CimInstance $cimObject ``` -#### [:::image type="icon" source="images/icons/windows-os.svg"::: **Settings app**](#tab/win) +[!INCLUDE [powershell-wmi-bridge-2](../../includes/configure/powershell-wmi-bridge-2.md)] + +# [:::image type="icon" source="images/icons/settings.svg"::: **Settings app**](#tab/settings) To create a local account, and configure Take a Test in kiosk mode using the Settings app: @@ -189,7 +179,7 @@ To create a local account, and configure Take a Test in kiosk mode using the Set 1. Under **Test taking settings** select the options you want to enable during the test - To enable printing, select **Require printing** - > [!NOTE] + > [!NOTE] > Make sure a printer is pre-configured on the Take a Test account if you're enabling this option. - To enable teachers to monitor screens, select **Allow screen monitoring** @@ -198,7 +188,7 @@ To create a local account, and configure Take a Test in kiosk mode using the Set 1. To take the test, a student must sign in using the test-taking account selected in step 4 :::image type="content" source="./images/takeatest/login-screen-take-a-test-single-pc.png" alt-text="Windows 11 SE login screen with the take a test account." border="true"::: - > [!NOTE] + > [!NOTE] > To sign-in with a local account on a device that is joined to Microsoft Entra ID or Active Directory, you must prefix the username with either `\` or `.\`. --- diff --git a/education/windows/edu-themes.md b/education/windows/edu-themes.md index c30c7fd79a..b0d6efa639 100644 --- a/education/windows/edu-themes.md +++ b/education/windows/edu-themes.md @@ -1,7 +1,7 @@ --- title: Configure education themes for Windows 11 description: Learn about education themes for Windows 11 and how to configure them via Intune and provisioning package. -ms.date: 09/11/2023 +ms.date: 04/10/2024 ms.topic: how-to appliesto: - ✅ Windows 11 diff --git a/education/windows/federated-sign-in.md b/education/windows/federated-sign-in.md index a1273e7bd7..aca908bb45 100644 --- a/education/windows/federated-sign-in.md +++ b/education/windows/federated-sign-in.md @@ -1,7 +1,7 @@ --- title: Configure federated sign-in for Windows devices description: Learn how federated sign-in in Windows works and how to configure it. -ms.date: 09/11/2023 +ms.date: 06/03/2024 ms.topic: how-to appliesto: - ✅ Windows 11 @@ -46,7 +46,7 @@ To enable a federated sign-in experience, the following prerequisites must be me - PowerShell scripts that call the [Microsoft Graph API][GRAPH-1] - provisioning tools offered by the IdP - For more information about identity matching, see [Identity matching in Microsoft Entra ID](#identity-matching-in-azure-ad). + For more information about identity matching, see [Identity matching in Microsoft Entra ID](#identity-matching-in-microsoft-entra-id). 1. Licenses assigned to the Microsoft Entra user accounts. It's recommended to assign licenses to a dynamic group: when new users are provisioned in Microsoft Entra ID, the licenses are automatically assigned. For more information, see [Assign licenses to users by group membership in Microsoft Entra ID][AZ-2] 1. Enable Federated sign-in or Web sign-in on the Windows devices, depending if the devices are shared or assigned to a single student @@ -87,7 +87,7 @@ Review the following instructions to configure your devices using either Microso |--|--|--| | Education | Is Education Environment | Enabled | | Federated Authentication | Enable Web Sign In For Primary User | Enabled | -| Authentication | Configure Web Sign In Allowed Urls | Semicolon separated list of domains, for example: `samlidp.clever.com;clever.com;mobile-redirector.clever.com` | +| Authentication | Configure Web Sign In Allowed Urls | Enter the list of domains, with each URL in a separate row. For example:
                        - `samlidp.clever.com`
                        - `clever.com`
                        - `mobile-redirector.clever.com` | | Authentication | Configure Webcam Access Domain Names | This setting is optional, and it should be configured if you need to use the webcam during the sign-in process. Specify the list of domains that are allowed to use the webcam during the sign-in process, separated by a semicolon. For example: `clever.com` | [!INCLUDE [intune-settings-catalog-2](../../includes/configure/intune-settings-catalog-2.md)] @@ -134,7 +134,7 @@ Review the following instructions to configure your shared devices using either | Education | Is Education Environment | Enabled | | SharedPC | Enable Shared PC Mode With OneDrive Sync | True | | Authentication | Enable Web Sign In | Enabled | -| Authentication | Configure Web Sign In Allowed Urls | Semicolon separated list of domains, for example: `samlidp.clever.com;clever.com;mobile-redirector.clever.com` | +| Authentication | Configure Web Sign In Allowed Urls | Enter the list of domains, with each URL in a separate row. For example:
                        - `samlidp.clever.com`
                        - `clever.com`
                        - `mobile-redirector.clever.com` | | Authentication | Configure Webcam Access Domain Names | This setting is optional, and it should be configured if you need to use the webcam during the sign-in process. Specify the list of domains that are allowed to use the webcam during the sign-in process, separated by a semicolon. For example: `clever.com` | [!INCLUDE [intune-settings-catalog-2](../../includes/configure/intune-settings-catalog-2.md)] @@ -201,8 +201,6 @@ The following issues are known to affect student shared devices: For student shared devices, it's recommended to configure the account management policies to automatically delete the user profiles after a certain period of inactivity or disk levels. For more information, see [Set up a shared or guest Windows device][WIN-3]. - - ### Preferred Microsoft Entra tenant name To improve the user experience, you can configure the *preferred Microsoft Entra tenant name* feature.\ @@ -210,8 +208,6 @@ When using preferred Microsoft Entra tenant name, the users bypass the disambigu For more information about preferred tenant name, see [Authentication CSP - PreferredAadTenantDomainName][WIN-4]. - - ### Identity matching in Microsoft Entra ID When a Microsoft Entra user is federated, the user's identity from the IdP must match an existing user object in Microsoft Entra ID. diff --git a/education/windows/get-minecraft-for-education.md b/education/windows/get-minecraft-for-education.md index 4e8222d98d..d5a0cb61fa 100644 --- a/education/windows/get-minecraft-for-education.md +++ b/education/windows/get-minecraft-for-education.md @@ -2,7 +2,7 @@ title: Get and deploy Minecraft Education description: Learn how to obtain and distribute Minecraft Education to Windows devices. ms.topic: how-to -ms.date: 09/11/2023 +ms.date: 04/10/2024 ms.collection: - education - tier2 @@ -16,15 +16,15 @@ Minecraft Education is a game-based platform that inspires creative and inclusiv **Prepare students for the future**: learners develop key skills like problem solving, collaboration, digital citizenship, and critical thinking to help them thrive now and in the future workplace. Spark a passion for STEM. -**Game based learning**: unlock creativity and deep learning with immersive content created with partners including BBC Earth, NASA, and the Nobel Peace Center. Inspire students to engage in real-world topics, with culturally relevant lessons and build challenges.  +**Game based learning**: unlock creativity and deep learning with immersive content created with partners including BBC Earth, NASA, and the Nobel Peace Center. Inspire students to engage in real-world topics, with culturally relevant lessons and build challenges.  ## Minecraft Education key features -- Multiplayer mode enables collaboration in-game across platforms, devices, and hybrid environments  -- Code Builder supports block-based coding, JavaScript, and Python with intuitive interface and in-game execution  -- Immersive Reader helps players read and translate text  -- Camera and Book & Quill items allow documentation and export of in-game creations  -- Integration with Microsoft Teams and Flipgrid supports assessment and teacher controls  +- Multiplayer mode enables collaboration in-game across platforms, devices, and hybrid environments  +- Code Builder supports block-based coding, JavaScript, and Python with intuitive interface and in-game execution  +- Immersive Reader helps players read and translate text  +- Camera and Book & Quill items allow documentation and export of in-game creations  +- Integration with Microsoft Teams and Flipgrid supports assessment and teacher controls  ## Try or purchase Minecraft Education @@ -34,7 +34,7 @@ Organizations can [purchase subscriptions][EDU-2] directly in the *Microsoft 3 When you sign up for a Minecraft Education trial, or purchase a subscription, Minecraft Education licenses are linked to your Microsoft Entra tenant. If you don't have a Microsoft Entra tenant: -- Microsoft-verified academic organizations can set up a free [Office 365 Education subscription][EDU-3], which includes a Microsoft Entra tenant +- Microsoft-verified academic organizations can set up a free [Office 365 Education subscription][EDU-3], which includes a Microsoft Entra tenant - Non-Microsoft-verified academic organizations can set up a free Microsoft Entra tenant when they [purchase Minecraft Education commercial licenses][EDU-4] ### Direct purchase @@ -78,7 +78,7 @@ To pay with an invoice: 1. During the purchase, select **Add a new payment method.** 2. Select the **Invoice** option, and provide the information needed for an invoice. The **PO number** item allows you to add a tracking number or info that is meaningful to your organization. -For more information about invoices and how to pay by invoice, see [Payment options for your Microsoft subscription][M365-1]. +For more information about invoices and how to pay by invoice, see [Payment options for your Microsoft subscription][M365-1]. ## Assign Minecraft Education licenses diff --git a/education/windows/images/autopilot-reset-customlogin.png b/education/windows/images/autopilot-reset-customlogin.png deleted file mode 100644 index d86cb57895..0000000000 Binary files a/education/windows/images/autopilot-reset-customlogin.png and /dev/null differ diff --git a/education/windows/images/autopilot-reset-lockscreen.png b/education/windows/images/autopilot-reset-lockscreen.png deleted file mode 100644 index f6fa6d3467..0000000000 Binary files a/education/windows/images/autopilot-reset-lockscreen.png and /dev/null differ diff --git a/education/windows/images/autopilot-reset-provisioningcomplete.png b/education/windows/images/autopilot-reset-provisioningcomplete.png deleted file mode 100644 index dd62db8c72..0000000000 Binary files a/education/windows/images/autopilot-reset-provisioningcomplete.png and /dev/null differ diff --git a/education/windows/images/chromebook-fig1-googleadmin.png b/education/windows/images/chromebook-fig1-googleadmin.png deleted file mode 100644 index b3d42e5ff2..0000000000 Binary files a/education/windows/images/chromebook-fig1-googleadmin.png and /dev/null differ diff --git a/education/windows/images/deploy-win-10-school-figure1.png b/education/windows/images/deploy-win-10-school-figure1.png deleted file mode 100644 index 66113dcce1..0000000000 Binary files a/education/windows/images/deploy-win-10-school-figure1.png and /dev/null differ diff --git a/education/windows/images/deploy-win-10-school-figure2.png b/education/windows/images/deploy-win-10-school-figure2.png deleted file mode 100644 index 0227f8dbaa..0000000000 Binary files a/education/windows/images/deploy-win-10-school-figure2.png and /dev/null differ diff --git a/education/windows/images/deploy-win-10-school-figure3.png b/education/windows/images/deploy-win-10-school-figure3.png deleted file mode 100644 index 1b39b5cc14..0000000000 Binary files a/education/windows/images/deploy-win-10-school-figure3.png and /dev/null differ diff --git a/education/windows/images/deploy-win-10-school-figure4.png b/education/windows/images/deploy-win-10-school-figure4.png deleted file mode 100644 index 09552a448a..0000000000 Binary files a/education/windows/images/deploy-win-10-school-figure4.png and /dev/null differ diff --git a/education/windows/images/deploy-win-10-school-figure5.png b/education/windows/images/deploy-win-10-school-figure5.png deleted file mode 100644 index 550386f1ce..0000000000 Binary files a/education/windows/images/deploy-win-10-school-figure5.png and /dev/null differ diff --git a/education/windows/images/deploy-win-10-school-figure6.png b/education/windows/images/deploy-win-10-school-figure6.png deleted file mode 100644 index 09552a448a..0000000000 Binary files a/education/windows/images/deploy-win-10-school-figure6.png and /dev/null differ diff --git a/education/windows/images/deploy-win-10-school-figure7.png b/education/windows/images/deploy-win-10-school-figure7.png deleted file mode 100644 index 8e7581007a..0000000000 Binary files a/education/windows/images/deploy-win-10-school-figure7.png and /dev/null differ diff --git a/education/windows/images/edu-districtdeploy-fig1.png b/education/windows/images/edu-districtdeploy-fig1.png deleted file mode 100644 index 9e9cd6c238..0000000000 Binary files a/education/windows/images/edu-districtdeploy-fig1.png and /dev/null differ diff --git a/education/windows/images/edu-districtdeploy-fig2.png b/education/windows/images/edu-districtdeploy-fig2.png deleted file mode 100644 index dfa00a0132..0000000000 Binary files a/education/windows/images/edu-districtdeploy-fig2.png and /dev/null differ diff --git a/education/windows/images/edu-districtdeploy-fig3.png b/education/windows/images/edu-districtdeploy-fig3.png deleted file mode 100644 index 0227f8dbaa..0000000000 Binary files a/education/windows/images/edu-districtdeploy-fig3.png and /dev/null differ diff --git a/education/windows/images/edu-districtdeploy-fig4.png b/education/windows/images/edu-districtdeploy-fig4.png deleted file mode 100644 index ca07e5a968..0000000000 Binary files a/education/windows/images/edu-districtdeploy-fig4.png and /dev/null differ diff --git a/education/windows/images/edu-districtdeploy-fig5.png b/education/windows/images/edu-districtdeploy-fig5.png deleted file mode 100644 index 09552a448a..0000000000 Binary files a/education/windows/images/edu-districtdeploy-fig5.png and /dev/null differ diff --git a/education/windows/images/edu-districtdeploy-fig6.png b/education/windows/images/edu-districtdeploy-fig6.png deleted file mode 100644 index 550386f1ce..0000000000 Binary files a/education/windows/images/edu-districtdeploy-fig6.png and /dev/null differ diff --git a/education/windows/images/edu-districtdeploy-fig7.png b/education/windows/images/edu-districtdeploy-fig7.png deleted file mode 100644 index 09552a448a..0000000000 Binary files a/education/windows/images/edu-districtdeploy-fig7.png and /dev/null differ diff --git a/education/windows/images/edu-districtdeploy-fig8.png b/education/windows/images/edu-districtdeploy-fig8.png deleted file mode 100644 index 8e7581007a..0000000000 Binary files a/education/windows/images/edu-districtdeploy-fig8.png and /dev/null differ diff --git a/education/windows/images/fig2-locallyconfig.png b/education/windows/images/fig2-locallyconfig.png deleted file mode 100644 index d2fe9820da..0000000000 Binary files a/education/windows/images/fig2-locallyconfig.png and /dev/null differ diff --git a/education/windows/images/i4e_editionupgrade.png b/education/windows/images/i4e_editionupgrade.png deleted file mode 100644 index ed5b281086..0000000000 Binary files a/education/windows/images/i4e_editionupgrade.png and /dev/null differ diff --git a/education/windows/images/icons/powershell.svg b/education/windows/images/icons/powershell.svg index ab2d5152ca..b23a99c61d 100644 --- a/education/windows/images/icons/powershell.svg +++ b/education/windows/images/icons/powershell.svg @@ -1,20 +1,9 @@ - - - - - - - - - - MsPortalFx.base.images-10 - - - - - - - - - - \ No newline at end of file + + + + + + + + + diff --git a/education/windows/images/icons/settings.svg b/education/windows/images/icons/settings.svg new file mode 100644 index 0000000000..9ec19d16aa --- /dev/null +++ b/education/windows/images/icons/settings.svg @@ -0,0 +1,19 @@ + + + + + + + + + + + + + + + + + + + diff --git a/education/windows/images/msfe_manage_benefits_checktoconfirm.png b/education/windows/images/msfe_manage_benefits_checktoconfirm.png deleted file mode 100644 index 90df941e00..0000000000 Binary files a/education/windows/images/msfe_manage_benefits_checktoconfirm.png and /dev/null differ diff --git a/education/windows/images/msfe_manage_reverttowin10pro.png b/education/windows/images/msfe_manage_reverttowin10pro.png deleted file mode 100644 index 30d0313f9b..0000000000 Binary files a/education/windows/images/msfe_manage_reverttowin10pro.png and /dev/null differ diff --git a/education/windows/images/setedupolicies_omauri.PNG b/education/windows/images/setedupolicies_omauri.PNG deleted file mode 100644 index eb3d9e216c..0000000000 Binary files a/education/windows/images/setedupolicies_omauri.PNG and /dev/null differ diff --git a/education/windows/images/settings_connectedtoazuread_3.png b/education/windows/images/settings_connectedtoazuread_3.png deleted file mode 100644 index 7311392405..0000000000 Binary files a/education/windows/images/settings_connectedtoazuread_3.png and /dev/null differ diff --git a/education/windows/images/settings_setupworkorschoolaccount_2.png b/education/windows/images/settings_setupworkorschoolaccount_2.png deleted file mode 100644 index 78237cfa31..0000000000 Binary files a/education/windows/images/settings_setupworkorschoolaccount_2.png and /dev/null differ diff --git a/education/windows/images/settings_workorschool_1.png b/education/windows/images/settings_workorschool_1.png deleted file mode 100644 index 4c53e6b3e2..0000000000 Binary files a/education/windows/images/settings_workorschool_1.png and /dev/null differ diff --git a/education/windows/images/suspcs/1812_Add_Apps_SUSPC.png b/education/windows/images/suspcs/1812_Add_Apps_SUSPC.png deleted file mode 100644 index b494aea2dd..0000000000 Binary files a/education/windows/images/suspcs/1812_Add_Apps_SUSPC.png and /dev/null differ diff --git a/education/windows/images/suspcs/2023-02-16_13-02-37.png b/education/windows/images/suspcs/2023-02-16_13-02-37.png deleted file mode 100644 index dc396099bf..0000000000 Binary files a/education/windows/images/suspcs/2023-02-16_13-02-37.png and /dev/null differ diff --git a/education/windows/images/suspcs/suspc_configure_pc2.jpg b/education/windows/images/suspcs/suspc_configure_pc2.jpg deleted file mode 100644 index 68c0080b22..0000000000 Binary files a/education/windows/images/suspcs/suspc_configure_pc2.jpg and /dev/null differ diff --git a/education/windows/images/suspcs/suspc_getstarted_050817.PNG b/education/windows/images/suspcs/suspc_getstarted_050817.png similarity index 100% rename from education/windows/images/suspcs/suspc_getstarted_050817.PNG rename to education/windows/images/suspcs/suspc_getstarted_050817.png diff --git a/education/windows/images/suspcs/suspc_runpackage_getpcsready.PNG b/education/windows/images/suspcs/suspc_runpackage_getpcsready.png similarity index 100% rename from education/windows/images/suspcs/suspc_runpackage_getpcsready.PNG rename to education/windows/images/suspcs/suspc_runpackage_getpcsready.png diff --git a/education/windows/images/wcd/setedupolicies.PNG b/education/windows/images/wcd/setedupolicies.PNG deleted file mode 100644 index e240063f68..0000000000 Binary files a/education/windows/images/wcd/setedupolicies.PNG and /dev/null differ diff --git a/education/windows/images/wcd/wcd_productkey.png b/education/windows/images/wcd/wcd_productkey.png deleted file mode 100644 index fbbfda7eb9..0000000000 Binary files a/education/windows/images/wcd/wcd_productkey.png and /dev/null differ diff --git a/education/windows/images/wcd/wcd_settings_assignedaccess.PNG b/education/windows/images/wcd/wcd_settings_assignedaccess.PNG deleted file mode 100644 index 443a5d0688..0000000000 Binary files a/education/windows/images/wcd/wcd_settings_assignedaccess.PNG and /dev/null differ diff --git a/education/windows/images/win-10-pro-edu-activated-subscription-active.png b/education/windows/images/win-10-pro-edu-activated-subscription-active.png deleted file mode 100644 index d29fa0e0e5..0000000000 Binary files a/education/windows/images/win-10-pro-edu-activated-subscription-active.png and /dev/null differ diff --git a/education/windows/images/win-10-pro-edu-not-activated-subscription-active.PNG b/education/windows/images/win-10-pro-edu-not-activated-subscription-active.PNG deleted file mode 100644 index 8e9242c0ba..0000000000 Binary files a/education/windows/images/win-10-pro-edu-not-activated-subscription-active.PNG and /dev/null differ diff --git a/education/windows/index.yml b/education/windows/index.yml index 3c3dfae79b..0cd20e659d 100644 --- a/education/windows/index.yml +++ b/education/windows/index.yml @@ -6,8 +6,6 @@ brand: windows metadata: ms.topic: hub-page - ms.prod: windows-client - ms.technology: itpro-edu ms.collection: - education - tier1 @@ -64,10 +62,8 @@ productDirectory: - title: Learn how to manage Windows devices imageSrc: /media/common/i_management.svg links: - - url: tutorial-school-deployment/manage-overview.md + - url: /mem/intune/industry/education/tutorial-school-deployment/manage-overview text: Manage devices with Microsoft Intune - - url: tutorial-school-deployment/manage-surface-devices.md - text: Management functionalities for Surface devices - url: /education/windows/get-minecraft-for-education text: Get and deploy Minecraft Education - url: /windows/client-management @@ -140,4 +136,4 @@ additionalContent: - text: Microsoft Intune community url: https://techcommunity.microsoft.com/t5/microsoft-intune/bd-p/Microsoft-Intune - text: Microsoft Support community - url: https://answers.microsoft.com/windows/forum \ No newline at end of file + url: https://answers.microsoft.com/ \ No newline at end of file diff --git a/education/windows/set-up-school-pcs-azure-ad-join.md b/education/windows/set-up-school-pcs-azure-ad-join.md deleted file mode 100644 index 27bffd9a4e..0000000000 --- a/education/windows/set-up-school-pcs-azure-ad-join.md +++ /dev/null @@ -1,86 +0,0 @@ ---- -title: Microsoft Entra join with Set up School PCs app -description: Learn how Microsoft Entra join is configured in the Set up School PCs app. -ms.topic: reference -ms.date: 08/10/2022 -appliesto: - - ✅ Windows 10 ---- - -# Microsoft Entra join for school PCs - -> [!NOTE] -> Set up School PCs app uses Microsoft Entra join to configure PCs. The app is helpful if you use the cloud based directory, Microsoft Entra ID. If your organization uses Active Directory or requires no account to connect, install and use [Windows Configuration -> Designer](set-up-students-pcs-to-join-domain.md) to -> join your PCs to your school's domain. - -Set up School PCs lets you create a provisioning package that automates Microsoft Entra ID -Join on your devices. This feature eliminates the need to manually: - -- Connect to your school's network. -- Join your organization's domain. - -## Automated connection to school domain - -During initial device setup, Microsoft Entra join automatically connects your PCs to your school's Microsoft Entra domain. You can skip all of the Windows setup experience that is typically a part of the out-of-the-box-experience (OOBE). Devices that are managed by a mobile device manager, such as Intune, are automatically enrolled with the provider upon initial device startup. - -Students who sign in to their PCs with their Microsoft Entra credentials get access to on-premises apps and the following cloud apps: -* Office 365 -* OneDrive -* OneNote - - - -## Enable Microsoft Entra join - -Learn how to enable Microsoft Entra join for your school. After you configure this setting, you'll be able to request an automated Microsoft Entra bulk token, which you need to create a provisioning package. - -1. Sign in to the Azure portal with your organization's credentials. -2. Go to **Azure -Active Directory** \> **Devices** \> **Device settings**. -3. Enable the setting -for Microsoft Entra ID by selecting **All** or **Selected**. If you choose the latter -option, select the teachers and IT staff to allow them to connect to Microsoft Entra ID. - -![Select the users you want to let join devices to Azure AD.](images/suspcs/suspc-enable-shared-pc-1807.png) - -You can also create an account that holds the exclusive rights to join devices. When a student PC has to be set up, provide the account credentials to the appropriate teachers or staff. - -## All Device Settings - -The following table describes each setting within **Device Settings**. - -| Setting | Description | -|------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Users may join devices to Microsoft Entra ID | Choose the scope of people in your organization that are allowed to join devices to Microsoft Entra ID. **All** allows all users and groups within your tenant to join devices. **Selected** prompts you to choose specific users or groups to allow. **None** allows no one in your tenant to join devices to Microsoft Entra ID. | -| More local administrators on Microsoft Entra joined devices | Only applicable to Microsoft Entra ID P1 or P2 tenants. Grant extra local administrator rights on devices, to selected users. Global administrators and the device owner are granted local administrator rights by default. | -| Users may register their devices with Microsoft Entra ID | Allow all or none of your users to register their devices with Microsoft Entra ID (Workplace Join). If you're enrolled in Microsoft Intune or Mobile Device Management for Office 365, your devices are required to be registered. In this case, **All** is automatically selected for you. | -| Require Multi-Factor Authentication to join devices | Recommended when adding devices to Microsoft Entra ID. When set to **Yes**, users that are setting up devices must enter a second method of authentication. | -| Maximum number of devices per user | Set the maximum number of devices a user is allowed to have in Microsoft Entra ID. If the maximum is exceeded, the user must remove one or more existing devices before more devices are added. | -| Users may sync settings and enterprise app data | Allow all or none of your users to sync settings and app data across multiple devices. Tenants with Microsoft Entra ID P1 or P2 are permitted to select specific users to allow. | - - - -## Clear Microsoft Entra tokens - -Your Intune tenant can only have 500 active Microsoft Entra tokens, or packages, at a time. You'll receive a notification in the Intune portal when you reach 500 active tokens. - -To reduce your inventory, clear out all unnecessary and inactive tokens. -1. Go to **Microsoft Entra ID** > **Users** > **All users** -2. In the **User Name** column, select and delete all accounts with a **package\ _** -prefix. These accounts are created at a 1:1 ratio for every token and are safe -to delete. -3. Select and delete inactive and expired user accounts. - -### How do I know if my package expired? -Automated Microsoft Entra tokens expire after 180 days. The expiration date for each token is appended to the end of the saved provisioning package, on the USB drive. After this date, you must create a new package. Be careful that you don't delete active accounts. - -![Screenshot of the Azure portal, Microsoft Entra ID, All Users page. Highlights all accounts that start with the prefix package_ and can be deleted.](images/suspcs/suspc-admin-token-delete-1807.png) - -## Next steps -Learn more about setting up devices with the Set up School PCs app. -* [What's in my provisioning package?](set-up-school-pcs-provisioning-package.md) -* [Set up School PCs technical reference](set-up-school-pcs-technical.md) -* [Set up Windows 10 devices for education](set-up-windows-10.md) - -When you're ready to create and apply your provisioning package, see [Use Set up School PCs app](use-set-up-school-pcs-app.md). diff --git a/education/windows/set-up-school-pcs-provisioning-package.md b/education/windows/set-up-school-pcs-provisioning-package.md index 0396303749..8b49992af0 100644 --- a/education/windows/set-up-school-pcs-provisioning-package.md +++ b/education/windows/set-up-school-pcs-provisioning-package.md @@ -1,11 +1,11 @@ --- title: What's in Set up School PCs provisioning package description: Learn about the settings that are configured in the provisioning package created with the Set up School PCs app. -ms.date: 06/02/2023 +ms.date: 04/10/2024 ms.topic: reference appliesto: - ✅ Windows 10 ---- +--- # What's in my provisioning package? @@ -34,21 +34,21 @@ For a more detailed look at the policies, see the Windows article [Set up shared | Disk level caching | 50% | Sets 50% of total disk space to be used as the disk space threshold for account caching. | | Disk level deletion | For shared device setup, 25%; for single device-student setup, 0%. | When devices are optimized for shared use, the policy sets 25% of total disk space as the disk space threshold for account caching. When devices are optimized for use by a single student, the policy sets the value to 0% and doesn't delete accounts. | | Enable account manager | True | Enables automatic account management. | -| Inactive threshold | For shared device setup, 30 days; for single device-student setup, 180 days. | After 30 or 180 days, respectively, if an account hasn't signed in, it will be deleted. | +| Inactive threshold | For shared device setup, 30 days; for single device-student setup, 180 days. | After the threshold, if an account hasn't signed in, its user profile is deleted. | | Kiosk Mode AMUID | `Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy!App` | Configures the kiosk account on student devices to only run the Take a Test secure assessment browser. | | Kiosk Mode User Tile Display Text | Take a Test | Displays "Take a Test" as the name of the kiosk account on student devices. | | Restrict local storage | For shared device setup, True; for single device-student setup, False. | When devices are optimized for shared use across multiple PCs, this policy forces students to save to the cloud to prevent data loss. When your devices are optimized for use by a single student, this policy doesn't prevent students from saving on the PCs local hard drive. | | Maintenance start time | 0 - midnight | The maintenance start time when automatic maintenance tasks, such as Windows Update, run on student devices. | -| Max page file size in MB | 1024 | Sets the maximum size of the paging file to 1024 MB. Applies only to systems with less than 32-GB storage and at least 3 GB of RAM. | +| Max page file size in MB | 1024 | Sets the maximum size of the paging file to 1,024 MB. Applies only to systems with less than 32-GB storage and at least 3 GB of RAM. | | Set power policies | True | Prevents users from changing power settings and turns off hibernate. Also overrides all power state transitions to sleep, such as lid close. | | Sign in on resume | True | Requires the device user to sign in with a password when the PC wakes from sleep. | -| Sleep timeout | 3600 seconds | Specifies the maximum idle time before the PC should sleep. If you don't set sleep timeout, the default time, 3600 seconds (1 hour), is applied. | +| Sleep timeout | 3,600 seconds | Specifies the maximum idle time before the PC should sleep. If you don't set sleep timeout, the default time, 3,600 seconds (1 hour), is applied. | ## MDM and local group policies This section lists only the MDM and local group policies that are configured uniquely for the Set up School PCs app. -For a more detailed look of each policy listed, see [Policy CSP](/windows/client-management/mdm/policy-configuration-service-provider) in the Windows IT Pro Center documentation. +For a more detailed look of each policy listed, see [Policy CSP](/windows/client-management/mdm/policy-configuration-service-provider) in the Windows IT Pro Center documentation. | Policy name | Default value | Description | |--|--|--| @@ -58,7 +58,7 @@ For a more detailed look of each policy listed, see [Policy CSP](/windows/client | Hide OOBE for desktop | True | Hides the interactive OOBE flow for Windows 10. | | Download Mode | 1 - HTTP blended with peering behind the same NAT | Specifies the download method that Delivery Optimization can use in downloads of Windows Updates, Apps, and App updates | | Select when Preview Builds and Feature Updates are received | 32 - Semi-annual Channel. Device gets feature updates from Semi-annual Channel | Specifies how frequently devices receive preview builds and feature updates. | -| Allow auto update | 4 - Auto-installs and restarts without device-user control | When an auto update is available, it auto-installs and restarts the device without any input or action from the device user. | +| Allow auto update | 4 - Autoinstalls and restarts without device-user control | When an auto update is available, it autoinstalls and restarts the device without any input or action from the device user. | | Configure automatic updates | 3 - Set to install at 3am | Scheduled time to install updates. | | Update power policy for cart restarts | 1 - Configured | Skips all restart checks to ensure that the reboot will happen at the scheduled install time. | | Select when Preview Builds and Feature Updates are received | 365 days | Defers Feature Updates for the specified number of days. When not specified, defaults to 365 days. | @@ -70,7 +70,7 @@ For a more detailed look of each policy listed, see [Policy CSP](/windows/client | Allow add provisioning package | Disabled | Students can't add and upload new provisioning packages to their device. | | Allow remove provisioning package | Disabled | Students can't remove packages that you've uploaded to their device, including the Set up School PCs app | | Start Layout | Enabled | Lets you specify the Start layout for users and prevents them from changing the configuration. | -| Import Edge Assets | Enabled | Import Microsoft Edge assets, such as PNG and JPG files, for secondary tiles on the Start layout. Tiles will appear as weblinks and will be tied to the relevant image asset files. | +| Import Microsoft Edge Assets | Enabled | Import Microsoft Edge assets, such as PNG and JPG files, for secondary tiles on the Start layout. Tiles will appear as weblinks and will be tied to the relevant image asset files. | | Allow pinned folder downloads | 1 - The shortcut is visible and disables the setting in the Settings app | Makes the Downloads shortcut on the Start menu visible to students. | | Allow pinned folder File Explorer | 1 - The shortcut is visible and disables the setting in the Settings app | Makes the File Explorer shortcut on the Start menu visible to students. | | Personalization | Deploy lock screen image | Set to the image you picked when you customized the lock screen during device setup. If you didn't customize the image, the computer will show the default. | @@ -81,10 +81,10 @@ For a more detailed look of each policy listed, see [Policy CSP](/windows/client ## Apps uninstalled from Windows devices -Set up School PCs app uses the Universal app uninstall policy. The policy identifies default apps that aren't relevant to the classroom experience, and uninstalls them from each device. The apps uninstalled from Windows devices are: +Set up School PCs app uses the Universal app uninstall policy. The policy identifies default apps that aren't relevant to the classroom experience, and uninstalls them from each device. The apps uninstalled from Windows devices are: - Mixed Reality Viewer -- Weather +- Weather - Desktop App Installer - Tips - Messaging @@ -106,13 +106,13 @@ Set up School PCs uses the Universal app install policy to install school-releva ## Provisioning time estimates -The time it takes to install a package on a device depends on the: +The time it takes to install a package on a device depends on the: - Strength of network connection - Number of policies and apps within the package -- Other configurations made to the device +- Other configurations made to the device -Review the table below to estimate your expected provisioning time. A package that only applies Set Up School PC's default configurations will provision the fastest. A package that removes preinstalled apps, through CleanPC, will take much longer to provision. +Review the table below to estimate your expected provisioning time. A package that only applies Set Up School PC's default configurations provisions the fastest. A package that removes preinstalled apps, through CleanPC, will take longer to provision. | Configurations | Connection type | Estimated provisioning time | |--|--|--| diff --git a/education/windows/set-up-school-pcs-technical.md b/education/windows/set-up-school-pcs-technical.md index 8dd635d04e..213c75c26f 100644 --- a/education/windows/set-up-school-pcs-technical.md +++ b/education/windows/set-up-school-pcs-technical.md @@ -2,7 +2,7 @@ title: Set up School PCs app technical reference overview description: Describes the purpose of the Set up School PCs app for Windows 10 devices. ms.topic: overview -ms.date: 08/10/2022 +ms.date: 01/16/2024 appliesto: - ✅ Windows 10 --- @@ -14,47 +14,36 @@ The **Set up School PCs** app helps you configure new Windows 10 PCs for school If your school uses Microsoft Entra ID or Office 365, the Set up School PCs app will create a setup file. This file joins the PC to your Microsoft Entra tenant. The app also helps set up PCs for use with or without Internet connectivity. - +## Join devices to Microsoft Entra ID -## Join PC to Microsoft Entra ID -If your school uses Microsoft Entra ID or Office 365, the Set up -School PCs app creates a setup file that joins your PC to your Azure Active -Directory tenant. +If your school uses Microsoft Entra ID or Office 365, the Set up School PCs app creates a setup file that joins your PC to your Microsoft Entra ID tenant. The app also helps set up PCs for use with or without Internet connectivity. ## List of Set up School PCs features + The following table describes the Set up School PCs app features and lists each type of Intune subscription. An X indicates that the feature is available with the specific subscription. -| Feature | No Internet | Microsoft Entra ID | Office 365 | Microsoft Entra ID P1 or P2 | -|--------------------------------------------------------------------------------------------------------|-------------|----------|------------|------------------| -| **Fast sign-in** | X | X | X | X | -| Students sign in and start using the computer in under a minute, even on initial sign-in. | | | | | -| **Custom Start experience** | X | X | X | X | -| Necessary classroom apps are pinned to Start and unnecessary apps are removed. | | | | | -| **Guest account, no sign-in required** | X | X | X | X | -| Set up computers for use by anyone with or without an account. | | | | | -| **School policies** | X | X | X | X | -| Settings create a relevant, useful learning environment and optimal computer performance. | | | | | -| **Microsoft Entra join** | | X | X | X | -| Computers join with your existing Microsoft Entra ID or Office 365 subscription for centralized management. | | | | | -| **Single sign-on to Office 365** | | | X | X | -| Students sign in with their IDs to access all Office 365 web apps or installed Office apps. | | | | | -| **Take a Test app** | | | | X | -| Administer quizzes and assessments through test providers such as Smarter Balanced. | | | | | -| [Settings roaming](/azure/active-directory/devices/enterprise-state-roaming-overview) **via Microsoft Entra ID** | | | | X | -| Synchronize student and application data across devices for a personalized experience. | | | | | +| Feature | No Internet | Microsoft Entra ID | Office 365 | Microsoft Entra ID P1 or P2 | +|--|--|--|--|--| +| **Fast sign-in** | X | X | X | X | +| Students sign in and start using the computer in under a minute, even on initial sign-in. | | | | | +| **Custom Start experience** | X | X | X | X | +| Necessary classroom apps are pinned to Start and unnecessary apps are removed. | | | | | +| **Guest account, no sign-in required** | X | X | X | X | +| Set up computers for use by anyone with or without an account. | | | | | +| **School policies** | X | X | X | X | +| Settings create a relevant, useful learning environment and optimal computer performance. | | | | | +| **Microsoft Entra join** | | X | X | X | +| Computers join with your existing Microsoft Entra ID or Office 365 subscription for centralized management. | | | | | +| **Single sign-on to Office 365** | | | X | X | +| Students sign in with their IDs to access all Office 365 web apps or installed Office apps. | | | | | +| **Take a Test app** | | | | X | +| Administer quizzes and assessments through test providers such as Smarter Balanced. | | | | | +| [Settings roaming](/azure/active-directory/devices/enterprise-state-roaming-overview) **via Microsoft Entra ID** | | | | X | +| Synchronize student and application data across devices for a personalized experience. | | | | | -> [!NOTE] -> If your school uses Active Directory, use [Windows Configuration -> Designer](set-up-students-pcs-to-join-domain.md) -> to configure your PCs to join the domain. You can only use the Set up School -> PCs app to set up PCs that are connected to Microsoft Entra ID. - -## Next steps -Learn more about setting up devices with the Set up School PCs app. -* [Microsoft Entra join with Set up School PCs](set-up-school-pcs-azure-ad-join.md) -* [What's in my provisioning package](set-up-school-pcs-provisioning-package.md) -* [Set up Windows 10 devices for education](set-up-windows-10.md) +>[!NOTE] +>You can only use the Set up School PCs app to set up PCs that are connected to Microsoft Entra ID. When you're ready to create and apply your provisioning package, see [Use Set up School PCs app](use-set-up-school-pcs-app.md). diff --git a/education/windows/set-up-students-pcs-to-join-domain.md b/education/windows/set-up-students-pcs-to-join-domain.md deleted file mode 100644 index 91f2ad28d1..0000000000 --- a/education/windows/set-up-students-pcs-to-join-domain.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: Set up student PCs to join domain -description: Learn how to use Windows Configuration Designer to provision student devices to join Active Directory. -ms.topic: how-to -ms.date: 08/10/2022 -appliesto: - - ✅ Windows 10 ---- - -# Set up student PCs to join domain - -If your school uses Active Directory, use the Windows Configuration Designer tool to create a provisioning package that will configure a PC for student use that is joined to the Active Directory domain. - -## Install Windows Configuration Designer -Follow the instructions in [Install Windows Configuration Designer](/windows/configuration/provisioning-packages/provisioning-install-icd). - -## Create the provisioning package -Follow the steps in [Provision PCs with common settings for initial deployment (desktop wizard)](/windows/configuration/provisioning-packages/provision-pcs-for-initial-deployment). However, make a note of these steps to further customize the provisioning package for use in a school that will join a student PC to a domain: - -1. In the **Account Management** step: - - > [!WARNING] - > If you don't create a local administrator account and the device fails to enroll in Active Directory for any reason, you'll have to reimage the device and start over. As a best practice, we recommend: - > - Use a least-privileged domain account to join the device to the domain. - > - Create a temporary administrator account to use for debugging or reprovisioning if the device fails to enroll successfully. - > - [Use Group Policy to delete the temporary administrator account](/archive/blogs/canitpro/group-policy-creating-a-standard-local-admin-account) after the device is enrolled in Active Directory. - -2. After you're done with the wizard, don't click **Create**. Instead, click the **Switch to advanced editor** to switch the project to the advanced editor to see all the available **Runtime settings**. -3. Find the **SharedPC** settings group. - - Set **EnableSharedPCMode** to **TRUE** to configure the PC for shared use. -4. (Optional) To configure the PC for secure testing, follow these steps. - 1. Under **Runtime settings**, go to **AssignedAccess > AssignedAccessSettings**. - 2. Enter **{"Account":"*redmond\\kioskuser*","AUMID":” Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy!App "}**, using the account that you want to set up. - - **Figure 7** - Add the account to use for test-taking - - ![Add the account to use for test-taking.](images/wcd/wcd_settings_assignedaccess.png) - - The account can be in one of the following formats: - - username - - domain\username - - computer name\\username - - username@tenant.com - - 3. Under **Runtime settings**, go to **TakeATest** and configure the following settings: - 1. In **LaunchURI**, enter the assessment URL. - 2. In **TesterAccount**, enter the test account you entered in the previous step. - -5. To configure other settings to make Windows education ready, see [Windows 10 configuration recommendations for education customers](configure-windows-for-education.md) and follow the guidance on what settings you can set using Windows Configuration Designer. - -6. Follow the steps to [build a package](/windows/configuration/provisioning-packages/provisioning-create-package#build-package). - - You'll see the file path for your provisioning package. By default, this path is set to %windir%\Users\*your_username\Windows Imaging and Configuration Designer (WICD)\*Project name). - - Copy the provisioning package to a USB drive. - - > [!IMPORTANT] - > When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed. - -## Apply package -Follow the steps in [Apply a provisioning package](/windows/configuration/provisioning-packages/provisioning-apply-package) to apply the package that you created. \ No newline at end of file diff --git a/education/windows/set-up-students-pcs-with-apps.md b/education/windows/set-up-students-pcs-with-apps.md deleted file mode 100644 index 669dc2484c..0000000000 --- a/education/windows/set-up-students-pcs-with-apps.md +++ /dev/null @@ -1,25 +0,0 @@ ---- -title: Provision student PCs with apps -description: Learn how to use Windows Configuration Designer to easily provision student devices to join Active Directory. -ms.topic: how-to -ms.date: 08/10/2022 -appliesto: - - ✅ Windows 10 ---- -# Provision student PCs with apps - -To create and apply a provisioning package that contains apps to a device running all desktop editions of Windows 10 except Windows 10 Home, follow the steps in [Provision PCs with apps](/windows/configuration/provisioning-packages/provision-pcs-with-apps). - -Provisioning packages can include management instructions and policies, installation of specific apps, customization of network connections and policies, and more. - -You can apply a provisioning package on a USB drive to off-the-shelf devices during setup, making it fast and easy to configure new devices. - -- If you want to [provision a school PC to join a domain](set-up-students-pcs-to-join-domain.md) and add apps in the same provisioning package, follow the steps in [Provision PCs with apps](/windows/configuration/provisioning-packages/provision-pcs-with-apps). - -- If you want to provision a school PC to join Microsoft Entra ID, set up the PC using the steps in [Use Set up School PCs App](use-set-up-school-pcs-app.md). Set up School PCs now lets you add recommended apps from the Store so you can add these apps while you're creating your package through Set up School PCs. You can also follow the steps in [Provision PCs with apps](/windows/configuration/provisioning-packages/provision-pcs-with-apps) if you want to add apps to student PCs after initial setup with the Set up School PCs package. - -## Learn more - --[Develop Universal Windows Education apps](/windows/uwp/apps-for-education/) - -- [Build and apply a provisioning package](/windows/configuration/provisioning-packages/provisioning-create-package) diff --git a/education/windows/set-up-windows-10.md b/education/windows/set-up-windows-10.md deleted file mode 100644 index 784d5978ac..0000000000 --- a/education/windows/set-up-windows-10.md +++ /dev/null @@ -1,33 +0,0 @@ ---- -title: Set up Windows devices for education -description: Decide which option for setting up Windows 10 is right for you. -ms.topic: overview -ms.date: 08/10/2022 -appliesto: - - ✅ Windows 10 ---- - -# Set up Windows devices for education - -You have two tools to choose from to set up PCs for your classroom: - -- Set up School PCs -- Windows Configuration Designer - -Choose the tool that is appropriate for how your students will sign in (Active Directory, Microsoft Entra ID, or no account). - -You can use the following diagram to compare the tools. - -![Which tool to use to set up Windows 10.](images/suspcs/suspc_wcd_featureslist.png) - -## In this section - -- [Use the Set up School PCs app](use-set-up-school-pcs-app.md) -- [Technical reference for the Set up School PCs app](set-up-school-pcs-technical.md) -- [Set up student PCs to join domain](set-up-students-pcs-to-join-domain.md) -- [Provision student PCs with apps](set-up-students-pcs-with-apps.md) - -## Related topics - -[Take tests in Windows](take-tests-in-windows.md) -[Deploy Windows 10 in a school](deploy-windows-10-in-a-school.md)S diff --git a/education/windows/take-tests-in-windows.md b/education/windows/take-tests-in-windows.md index d9663d6d32..8c46ac4b93 100644 --- a/education/windows/take-tests-in-windows.md +++ b/education/windows/take-tests-in-windows.md @@ -1,7 +1,7 @@ --- title: Take tests and assessments in Windows description: Learn about the built-in Take a Test app for Windows and how to use it. -ms.date: 03/31/2023 +ms.date: 02/29/2024 ms.topic: how-to --- @@ -48,7 +48,7 @@ This is an ideal option for teachers who want to create a link to a specific ass For this option, you embed a URL with a specific prefix and specify parameters depending on what you want to allow during the test. The URL must be in the following format: -``` +```text ms-edu-secureassessment:#enforceLockdown ``` diff --git a/education/windows/toc.yml b/education/windows/toc.yml index 708fd96a30..62e4c0d85c 100644 --- a/education/windows/toc.yml +++ b/education/windows/toc.yml @@ -4,12 +4,10 @@ items: - name: Tutorials expanded: true items: - - name: Deploy and manage Windows devices in a school - href: tutorial-school-deployment/toc.yml - name: Deploy applications to Windows 11 SE href: tutorial-deploy-apps-winse/toc.yml - name: Concepts - items: + items: - name: Windows 11 SE items: - name: Overview @@ -26,8 +24,6 @@ items: href: /windows/deployment/windows-10-pro-in-s-mode?context=/education/context/context - name: Deploy Win32 apps to S Mode devices href: /windows/security/threat-protection/windows-defender-application-control/lob-win32-apps-on-s?context=/education/context/context - - name: Windows 10 editions for education customers - href: windows-editions-for-education-customers.md - name: Considerations for shared and guest devices href: /windows/configuration/shared-devices-concepts?context=/education/context/context - name: Windows 10 configuration recommendations for education customers @@ -49,39 +45,13 @@ items: - name: Configure federation between Google Workspace and Microsoft Entra ID href: configure-aad-google-trust.md - name: Configure Shared PC - href: /windows/configuration/set-up-shared-or-guest-pc?context=/education/context/context + href: /windows/configuration/shared-pc/set-up-shared-or-guest-pc?context=/education/context/context - name: Get and deploy Minecraft Education href: get-minecraft-for-education.md - name: Use the Set up School PCs app href: use-set-up-school-pcs-app.md - name: Upgrade Windows Home to Windows Education on student-owned devices href: change-home-to-edu.md - - name: Migrate from Chromebook to Windows - items: - - name: Chromebook migration guide - href: chromebook-migration-guide.md - - name: Deploy Windows 10 devices in a school - items: - - name: Overview - href: deploy-windows-10-overview.md - - name: Deploy Windows 10 in a school - href: deploy-windows-10-in-a-school.md - - name: Deploy Windows 10 in a school district - href: deploy-windows-10-in-a-school-district.md - - name: Deployment recommendations for school IT administrators - href: edu-deployment-recommendations.md - - name: Set up Windows devices for education - items: - - name: Overview - href: set-up-windows-10.md - - name: Microsoft Entra join for school PCs - href: set-up-school-pcs-azure-ad-join.md - - name: Active Directory join for school PCs - href: set-up-students-pcs-to-join-domain.md - - name: Provision student PCs with apps - href: set-up-students-pcs-with-apps.md - - name: Reset devices with Autopilot Reset - href: autopilot-reset.md - name: Reference items: - name: Set up School PCs @@ -90,11 +60,9 @@ items: href: set-up-school-pcs-technical.md - name: Provisioning package settings href: set-up-school-pcs-provisioning-package.md - - name: What's new in Set up School PCs - href: set-up-school-pcs-whats-new.md - name: Take a Test technical reference href: take-a-test-app-technical.md - name: Shared PC technical reference - href: /windows/configuration/shared-pc-technical?context=/education/context/context + href: /windows/configuration/shared-pc/shared-pc-technical?context=/education/context/context + - diff --git a/education/windows/tutorial-deploy-apps-winse/considerations.md b/education/windows/tutorial-deploy-apps-winse/considerations.md index 73d202a202..7f2a9f9207 100644 --- a/education/windows/tutorial-deploy-apps-winse/considerations.md +++ b/education/windows/tutorial-deploy-apps-winse/considerations.md @@ -1,7 +1,7 @@ --- title: Important considerations before deploying apps with managed installer description: Learn about important aspects to consider before deploying apps with managed installer. -ms.date: 06/19/2023 +ms.date: 04/10/2024 ms.topic: tutorial appliesto: - ✅ Windows 11 SE, version 22H2 and later diff --git a/education/windows/tutorial-deploy-apps-winse/create-policies.md b/education/windows/tutorial-deploy-apps-winse/create-policies.md index 8841f736bd..26e022bbbf 100644 --- a/education/windows/tutorial-deploy-apps-winse/create-policies.md +++ b/education/windows/tutorial-deploy-apps-winse/create-policies.md @@ -1,7 +1,7 @@ --- title: Create policies to enable applications description: Learn how to create policies to enable the installation and execution of apps on Windows SE. -ms.date: 06/19/2023 +ms.date: 04/10/2024 ms.topic: tutorial appliesto: - ✅ Windows 11 SE, version 22H2 and later diff --git a/education/windows/tutorial-deploy-apps-winse/deploy-apps.md b/education/windows/tutorial-deploy-apps-winse/deploy-apps.md index bc3bd28004..62442e2058 100644 --- a/education/windows/tutorial-deploy-apps-winse/deploy-apps.md +++ b/education/windows/tutorial-deploy-apps-winse/deploy-apps.md @@ -1,7 +1,7 @@ --- title: Applications deployment considerations description: Learn how to deploy different types of applications to Windows 11 SE and some considerations before deploying them. -ms.date: 05/23/2023 +ms.date: 04/10/2024 ms.topic: tutorial appliesto: - ✅ Windows 11 SE, version 22H2 and later diff --git a/education/windows/tutorial-deploy-apps-winse/deploy-policies.md b/education/windows/tutorial-deploy-apps-winse/deploy-policies.md index 330d85b61e..63f6143853 100644 --- a/education/windows/tutorial-deploy-apps-winse/deploy-policies.md +++ b/education/windows/tutorial-deploy-apps-winse/deploy-policies.md @@ -1,7 +1,7 @@ --- title: Deploy policies to enable applications description: Learn how to deploy AppLocker policies to enable apps execution on Windows SE devices. -ms.date: 05/23/2023 +ms.date: 04/10/2024 ms.topic: tutorial appliesto: - ✅ Windows 11 SE, version 22H2 and later diff --git a/education/windows/tutorial-deploy-apps-winse/index.md b/education/windows/tutorial-deploy-apps-winse/index.md index ff7cce6a5f..1c09685eed 100644 --- a/education/windows/tutorial-deploy-apps-winse/index.md +++ b/education/windows/tutorial-deploy-apps-winse/index.md @@ -1,7 +1,7 @@ --- title: Deploy applications to Windows 11 SE with Intune description: Learn how to deploy applications to Windows 11 SE with Intune and how to validate the apps. -ms.date: 06/07/2023 +ms.date: 04/10/2024 ms.topic: tutorial appliesto: - ✅ Windows 11 SE, version 22H2 and later diff --git a/education/windows/tutorial-deploy-apps-winse/troubleshoot.md b/education/windows/tutorial-deploy-apps-winse/troubleshoot.md index 631b12b06e..38a3ee9d4c 100644 --- a/education/windows/tutorial-deploy-apps-winse/troubleshoot.md +++ b/education/windows/tutorial-deploy-apps-winse/troubleshoot.md @@ -1,7 +1,7 @@ --- title: Troubleshoot app deployment issues in Windows SE description: Troubleshoot common issues when deploying apps to Windows SE devices. -ms.date: 06/19/2023 +ms.date: 04/10/2024 ms.topic: tutorial appliesto: - ✅ Windows 11 SE, version 22H2 and later @@ -45,10 +45,10 @@ Use the Event Viewer to see if a supplemental policy is deployed correctly. Thes ``` citool.exe -lp ``` - + - For the policy that allows managed installers to run, a policyID `C0DB889B-59C5-453C-B297-399C851934E4` and Friendly Name *[Win-EDU] Microsoft Apps Supplemental Policy - Prod* should be present, and have **Is Currently Enforced** showing as **true** - For any additional policies that you deploy, check that a policy with a matching ID and Friendly Name is shown in the list and the **Is Currently Enforced** and **Is Authorized** properties are both showing as **true** - + :::image type="content" source="images/troubleshoot-citool.png" alt-text="Screenshot of the output of citool.exe with the Win-EDU supplemental policy."::: 1. Check for **error events** with code **3077**: and reference [Understanding Application Control event IDs][WIN-1] diff --git a/education/windows/tutorial-deploy-apps-winse/validate-apps.md b/education/windows/tutorial-deploy-apps-winse/validate-apps.md index a3e128a92e..211638de72 100644 --- a/education/windows/tutorial-deploy-apps-winse/validate-apps.md +++ b/education/windows/tutorial-deploy-apps-winse/validate-apps.md @@ -1,7 +1,7 @@ --- title: Validate the applications deployed to Windows SE devices description: Learn how to validate the applications deployed to Windows SE devices via Intune. -ms.date: 06/19/2023 +ms.date: 04/10/2024 ms.topic: tutorial appliesto: - ✅ Windows 11 SE, version 22H2 and later @@ -65,11 +65,11 @@ To check the installation status of an app from the Intune portal: 1. Select **App > All apps** 1. Select the application you want to check 1. From the **Overview** page, you can verify the overall installation status - + :::image type="content" source="./images/intune-app-install-overview.png" alt-text="Screenshot of the Microsoft Intune admin center - App installation details." lightbox="./images/intune-app-install-overview.png"::: 1. From the **Device install status** page, you can verify the installation status for each device, and the status code that indicates the cause of the failure - + :::image type="content" source="./images/intune-app-install-status.png" alt-text="Screenshot of the Microsoft Intune admin center - App installation status for each device." lightbox="./images/intune-app-install-status.png"::: > [!NOTE] diff --git a/education/windows/tutorial-school-deployment/configure-device-apps.md b/education/windows/tutorial-school-deployment/configure-device-apps.md deleted file mode 100644 index ef1e695396..0000000000 --- a/education/windows/tutorial-school-deployment/configure-device-apps.md +++ /dev/null @@ -1,76 +0,0 @@ ---- -title: Configure applications with Microsoft Intune -description: Learn how to configure applications with Microsoft Intune in preparation for device deployment. -ms.date: 03/08/2023 -ms.topic: tutorial ---- - -# Configure applications with Microsoft Intune - -With Intune for Education, school IT administrators have access to diverse applications to help students unlock their learning potential. This section discusses tools and resources for adding apps to Intune for Education. - -Applications can be assigned to groups: - -- If you target apps to a **group of users**, the apps will be installed on any managed devices that the users sign into -- If you target apps to a **group of devices**, the apps will be installed on those devices and available to any user who signs in - -In this section you will: -> [!div class="checklist"] -> * Add apps to Intune for Education -> * Assign apps to groups -> * Review some considerations for Windows 11 SE devices - -## Add apps to Intune for Education - -Intune for Education supports the deployment of two types of Windows applications: **web apps** and **desktop apps**. - -:::image type="content" source="./images/intune-education-apps.png" alt-text="Intune for Education - Apps" lightbox="./images/intune-education-apps.png" border="true"::: - -### Desktop apps - -The addition of desktop applications to Intune should be carried out by repackaging the apps, and defining the commands to silently install them. The process is described in the article [Add, assign, and monitor a Win32 app in Microsoft Intune][MEM-1]. - -### Web apps - -To create web applications in Intune for Education: - -1. Sign in to the Intune for Education portal -1. Select **Apps** -1. Select **New app** > **New web app** -1. Provide a URL for the web app, a name and, optionally, an icon and description -1. Select **Save** - -For more information, see [Add web apps][INT-2]. - -## Assign apps to groups - -To assign applications to a group of users or devices: - -1. Sign in to the Intune for Education portal -1. Select **Groups** > Pick a group to manage -1. Select **Apps** -1. Select either **Web apps** or **Windows apps** -1. Select the apps you want to assign to the group > Save - -## Considerations for Windows 11 SE - -Windows 11 SE prevents the installation and execution of third party applications with a technology called **Windows Defender Application Control** (WDAC). -WDAC applies an *allowlist* policy, which ensures that unwanted apps don't run or get installed. However, it also prevents IT admins from deploying apps to Windows 11 SE devices, unless they're included in the E Mode policy. - -To learn more about which apps are supported in Windows 11 SE, and how to deploy them, see the tutorial [Deploy applications to Windows 11 SE with Intune][EDU-1]. - -## Next steps - -With the applications configured, you can now deploy students' and teachers' devices. - -> [!div class="nextstepaction"] -> [Next: Deploy devices >](enroll-overview.md) - - - -[EDU-1]: ../tutorial-deploy-apps-winse/index.md - -[MEM-1]: /mem/intune/apps/apps-win32-add - -[INT-1]: /intune-education/express-configuration-intune-edu -[INT-2]: /intune-education/add-web-apps-edu \ No newline at end of file diff --git a/education/windows/tutorial-school-deployment/configure-device-settings.md b/education/windows/tutorial-school-deployment/configure-device-settings.md deleted file mode 100644 index fc71325532..0000000000 --- a/education/windows/tutorial-school-deployment/configure-device-settings.md +++ /dev/null @@ -1,130 +0,0 @@ ---- -title: Configure and secure devices with Microsoft Intune -description: Learn how to configure policies with Microsoft Intune in preparation for device deployment. -ms.date: 11/09/2023 -ms.topic: tutorial ---- - -# Configure and secure devices with Microsoft Intune - -With Intune for Education, you can configure settings for devices in the school, to ensure that they comply with specific policies. -For example, you may need to secure your devices, ensuring that they are kept up to date. Or you may need to configure all the devices with the same look and feel. - -Settings can be assigned to groups: - -- If you target settings to a **group of users**, those settings will apply, regardless of what managed devices the targeted users sign in to -- If you target settings to a **group of devices**, those settings will apply regardless of who is using the devices - -There are two ways to manage settings in Intune for Education: - -- **Express Configuration.** This option is used to configure a selection of settings that are commonly used in school environments -- **Group settings.** This option is used to configure all settings that are offered by Intune for Education - -> [!NOTE] -> Express Configuration is ideal when you are getting started. Settings are pre-configured to Microsoft-recommended values, but can be changed to fit your school's needs. It is recommended to use Express Configuration to initially set up your Windows devices. - -In this section you will: -> [!div class="checklist"] -> * Configure settings with Express Configuration -> * Configure group settings -> * Create Windows Update policies -> * Configure security policies - -## Configure settings with Express Configuration - -With Express Configuration, you can get Intune for Education up and running in just a few steps. You can select a group of devices or users, select applications to distribute, and choose settings from the most commonly used in schools. - -> [!TIP] -> To learn more, and practice step-by-step Express Configuration in Intune for Education, try this interactive demo. - -## Configure group settings - -Groups are used to manage users and devices with similar management needs, allowing you to apply changes to many devices or users at once. To review the available group settings: - -1. Sign in to the Intune for Education portal -1. Select **Groups** > Pick a group to manage -1. Select **Windows device settings** -1. Expand the different categories and review information about individual settings - -Settings that are commonly configured for student devices include: - -- Wallpaper and lock screen background. See: [Lock screen and desktop][INT-7] -- Wi-Fi connections. See: [Add Wi-Fi profiles][INT-8] -- Enablement of the integrated testing and assessment solution *Take a Test*. See: [Add Take a Test profile][INT-9] - -For more information, see [Windows device settings in Intune for Education][INT-3]. - -## Create Windows Update policies - -It is important to keep Windows devices up to date with the latest security updates. You can create Windows Update policies using Intune for Education. - -To create a Windows Update policy: - -1. Select **Groups** > Pick a group to manage -1. Select **Windows device settings** -1. Expand the category **Update and upgrade** -1. Configure the required settings as needed - -For more information, see [Updates and upgrade][INT-6]. - -> [!NOTE] -> If you require a more complex Windows Update policy, you can create it in Microsoft Intune. For more information: -> - [What is Windows Update for Business?][WIN-1] -> - [Manage Windows software updates in Intune][MEM-1] - -## Configure security policies - -It is critical to ensure that the devices you manage are secured using the different security technologies available in Windows. -Intune for Education provides different settings to secure devices. - -To create a security policy: - -1. Select **Groups** > Pick a group to manage -1. Select **Windows device settings** -1. Expand the category **Security** -1. Configure the required settings as needed, including - - Windows Defender - - Windows Encryption - - Windows SmartScreen - -For more information, see [Security][INT-4]. - -> [!NOTE] -> If you require more sophisticated security policies, you can create them in Microsoft Intune. For more information: -> - [Antivirus][MEM-2] -> - [Disk encryption][MEM-3] -> - [Firewall][MEM-4] -> - [Endpoint detection and response][MEM-5] -> - [Attack surface reduction][MEM-6] -> - [Account protection][MEM-7] - ---- - -## Next steps - -With the Intune service configured, you can configure policies and applications to deploy to your students' and teachers' devices. - -> [!div class="nextstepaction"] -> [Next: Configure applications >](configure-device-apps.md) - - - -[EDU-1]: /education/windows/windows-11-se-overview - -[INT-2]: /intune-education/express-configuration-intune-edu -[INT-3]: /intune-education/all-edu-settings-windows -[INT-4]: /intune-education/all-edu-settings-windows#security -[INT-6]: /intune-education/all-edu-settings-windows#updates-and-upgrade -[INT-7]: /intune-education/all-edu-settings-windows#lock-screen-and-desktop -[INT-8]: /intune-education/add-wi-fi-profile -[INT-9]: /intune-education/take-a-test-profiles - -[WIN-1]: /windows/deployment/update/waas-manage-updates-wufb - -[MEM-1]: /mem/intune/protect/windows-update-for-business-configure -[MEM-2]: /mem/intune/protect/endpoint-security-antivirus-policy -[MEM-3]: /mem/intune/protect/encrypt-devices -[MEM-4]: /mem/intune/protect/endpoint-security-firewall-policy -[MEM-5]: /mem/intune/protect/endpoint-security-edr-policy -[MEM-6]: /mem/intune/protect/endpoint-security-asr-policy -[MEM-7]: /mem/intune/protect/endpoint-security-account-protection-policy \ No newline at end of file diff --git a/education/windows/tutorial-school-deployment/configure-devices-overview.md b/education/windows/tutorial-school-deployment/configure-devices-overview.md deleted file mode 100644 index fa6e5c218a..0000000000 --- a/education/windows/tutorial-school-deployment/configure-devices-overview.md +++ /dev/null @@ -1,58 +0,0 @@ ---- -title: Configure devices with Microsoft Intune -description: Learn how to configure policies and applications in preparation for device deployment. -ms.date: 11/09/2023 -ms.topic: tutorial ---- - -# Configure settings and applications with Microsoft Intune - -Before distributing devices to your users, you must ensure that the devices will be configured with the required policies, settings, and applications as they get enrolled in Intune. -Microsoft Intune uses Microsoft Entra groups to assign policies and applications to devices. -With Microsoft Intune for Education, you can conveniently create groups and assign policies and applications to them. - -In this section you will: -> [!div class="checklist"] -> * Create groups -> * Create and assign policies to groups -> * Create and assign applications to groups - -## Create groups - -By organizing devices, students, classrooms, or learning curricula into groups, you can provide students with the resources and configurations they need. - -By default, Intune for Education creates two default groups: *All devices* and *All users*. -Two additional groups are pre-created if you use **Microsoft School Data Sync (SDS)**: *All teachers* and *All students*. SDS can also be configured to automatically create and maintain groups of students and teachers for each school. - -:::image type="content" source="./images/intune-education-groups.png" alt-text="Intune for Education - Groups blade" border="true"::: - -Beyond the defaults, groups can be customized to suit various needs. For example, if you have both *Windows 10* and *Windows 11 SE* devices in your school, you can create groups, such as *Windows 10 devices* and *Windows 11 SE devices*, to assign different policies and applications to. - -Two group types can be created: - -- **Assigned groups** are used when you want to manually add users or devices to a group -- **Dynamic groups** reference rules that you create to assign students or devices to groups, which automate the membership's maintenance of those groups - -> [!TIP] -> If you target applications and policies to a *device dynamic group*, they will be applied to the devices as soon as they are enrolled in Intune, before users signs in. This can be useful in bulk enrollment scenarios, where devices are enrolled without requiring users to sign in. Devices can be configured and prepared in advance, before distribution. - -For more information, see: - -- [Create groups in Intune for Education][EDU-1] -- [Manually add or remove users and devices to an existing assigned group][EDU-2] -- [Edit dynamic group rules to accommodate for new devices, locations, or school years][EDU-3] - -________________________________________________________ - -## Next steps - -With the groups created, you can configure policies and applications to deploy to your groups. - -> [!div class="nextstepaction"] -> [Next: Configure policies >](configure-device-settings.md) - - - -[EDU-1]: /intune-education/create-groups -[EDU-2]: /intune-education/edit-groups-intune-for-edu -[EDU-3]: /intune-education/edit-groups-intune-for-edu#edit-dynamic-group-rules diff --git a/education/windows/tutorial-school-deployment/enroll-autopilot.md b/education/windows/tutorial-school-deployment/enroll-autopilot.md deleted file mode 100644 index 26300b5115..0000000000 --- a/education/windows/tutorial-school-deployment/enroll-autopilot.md +++ /dev/null @@ -1,149 +0,0 @@ ---- -title: Enrollment in Intune with Windows Autopilot -description: Learn how to join Microsoft Entra ID and enroll in Intune using Windows Autopilot. -ms.date: 03/08/2023 -ms.topic: tutorial ---- - -# Windows Autopilot - -Windows Autopilot is designed to simplify all parts of Windows devices lifecycle, from initial deployment through end of life. Using cloud-based services, Windows Autopilot can reduce the overall costs for deploying, managing, and retiring devices. - -Traditionally, IT pros spend a significant amount of time building and customizing images that will later be deployed to devices. Windows Autopilot introduces a new, simplified approach. Devices don't need to be reimaged, rather they can be deployed with the OEM image, and customized using cloud-based services. - -From the user's perspective, it only takes a few simple operations to make their device ready to use. The only interaction required from the end user is to set their language and regional settings, connect to a network, and verify their credentials. Everything beyond that is automated. - -## Prerequisites - -Before setting up Windows Autopilot, consider these prerequisites: - -- **Software requirements.** Ensure your school and devices meet the [software, networking, licensing, and configuration requirements][WIN-1] for Windows Autopilot -- **Devices ordered and registered.** Ensure your school IT administrator or Microsoft partner has ordered the devices from an original equipment manufacturer (OEM) and registered them for the Autopilot deployment service. To connect with a partner, you can use the [Microsoft Partner Center][MSFT-1] and work with them to register your devices -- **Networking requirements.** Ensure students know to connect to the school network during OOBE setup. For more information on managing devices behind firewalls and proxy servers, see [Network endpoints for Microsoft Intune][MEM-1] - -> [!NOTE] -> Where not explicitly specified, both HTTPS (443) and HTTP (80) must be accessible. If you are auto-enrolling your devices into Microsoft Intune or deploying Microsoft Office, follow the networking guidelines for [Microsoft Intune][INT-1] and [Microsoft 365][M365-1]. - -## Register devices to Windows Autopilot - -Before deployment, devices must be registered in the Windows Autopilot service. Each device's unique hardware identity (known as a *hardware hash*) must be uploaded to the Autopilot service. In this way, the Autopilot service can recognize which tenant devices belong to, and which OOBE experience it should present. There are three main ways to register devices to Autopilot: - -- **OEM registration process.** When you purchase devices from an OEM or Reseller, that company can automatically register devices to Windows Autopilot and associate them to your tenant. Before this registration can happen, a *Global Administrator* must grant the OEM/Reseller permissions to register devices. For more information, see [OEM registration][MEM-2] - > [!NOTE] - > For **Microsoft Surface registration**, collect the details shown in this [documentation table][SURF-1] and follow the instruction to submit the request form to Microsoft Support. -- **Cloud Solution Provider (CSP) registration process.** As with OEMs, CSP partners must be granted permission to register devices for a school. For more information, see [Partner registration][MEM-5] - > [!TIP] - > Try the Microsoft Partner Center clickable demo, which provides detailed steps to establish a partner relationship and register devices. -- **Manual registration.** To manually register a device, you must first capture its hardware hash. Once this process has been completed, the hardware hash can be uploaded to the Windows Autopilot service using [Microsoft Intune][MEM-6] - > [!IMPORTANT] - > **Windows 11 SE** devices do not support the use of Windows PowerShell or Microsoft Configuration Manager to capture hardware hashes. Hardware hashes can only be captured manually. We recommend working with an OEM, partner, or device reseller to register devices. - -## Create groups for Autopilot devices - -**Windows Autopilot deployment profiles** determine the Autopilot *deployment mode* and define the out-of-box experience of your devices. A device group is required to assign a Windows Autopilot deployment profile to the devices. -For this task, it's recommended to create dynamic device groups using Autopilot attributes. - -Here are the steps for creating a dynamic group for the devices that have an assigned Autopilot group tag: - -1. Sign in to the Intune for Education portal -1. Select **Groups** > **Create group** -1. Specify a **Group name** and select **Dynamic** -1. Under **Rules**, select **I want to manage: Devices** and use the clause **Where: Device group tag starts with**, specifying the required tag value -1. Select **Create group** - :::image type="content" source="./images/intune-education-autopilot-group.png" alt-text="Intune for Education - creation of a dynamic group for Autopilot devices" border="true"::: - -More advanced dynamic membership rules can be created from Microsoft Intune admin center. For more information, see [Create an Autopilot device group using Intune][MEM-3]. - -> [!TIP] -> You can use these dynamic groups not only to assign Autopilot profiles, but also to target applications and settings. - -## Create Autopilot deployment profiles - -For Autopilot devices to offer a customized OOBE experience, you must create **Windows Autopilot deployment profiles** and assign them to a group containing the devices. -A deployment profile is a collection of settings that determine the behavior of the device during OOBE. Among other settings, a deployment profile specifies a **deployment mode**, which can either be: -1. **User-driven:** devices with this profile are associated with the user enrolling the device. User credentials are required to complete the Microsoft Entra join process during OOBE -1. **Self-deploying:** devices with this profile aren't associated with the user enrolling the device. User credentials aren't required to complete the Microsoft Entra join process. Rather, the device is joined automatically and, for this reason, specific hardware requirements must be met to use this mode. - -To create an Autopilot deployment profile: - -1. Sign in to the Intune for Education portal -1. Select **Groups** > Select a group from the list -1. Select **Windows device settings** -1. Expand the **Enrolment** category -1. From **Configure Autopilot deployment profile for device** select **User-driven** -1. Ensure that **User account type** is configured as **Standard** -1. Select **Save** - -While Intune for Education offers simple options for Autopilot configurations, more advanced deployment profiles can be created from Microsoft Intune admin center. For more information, see [Windows Autopilot deployment profiles][MEM-4]. - -### Configure an Enrollment Status Page - -An Enrollment Status Page (ESP) is a greeting page displayed to users while enrolling or signing in for the first time to Windows devices. The ESP displays provisioning progress, showing applications and profiles installation status. - -:::image type="content" source="./images/win11-oobe-esp.gif" alt-text="Windows OOBE - enrollment status page animation." border="false"::: - -> [!NOTE] -> Some Windows Autopilot deployment profiles **require** the ESP to be configured. - -To deploy the ESP to devices, you need to create an ESP profile in Microsoft Intune. - -> [!TIP] -> While testing the deployment process, you can configure the ESP to: -> - allow the reset of the devices in case the installation fails -> - allow the use of the device if installation error occurs -> -> This enables you to troubleshoot the installation process in case any issues arise and to easily reset the OS. You can turn these settings off once you are done testing. - -For more information, see [Set up the Enrollment Status Page][MEM-3]. - -> [!CAUTION] -> The Enrollment Status Page (ESP) is compatible with Windows 11 SE. However, due to the E Mode policy, devices may not complete the enrollment. For more information, see [Enrollment Status Page][EDU-3]. - -### Autopilot end-user experience - -Once configuration is complete and devices are distributed, students and teachers are able to complete the out-of-box experience with Autopilot. They can set up their devices at home, at school, or wherever there's a reliable Internet connection. -When a Windows device is turned on for the first time, the end-user experience with Windows Autopilot is as follows: - -1. Identify the language and region -1. Select the keyboard layout and decide on the option for a second keyboard layout -1. Connect to the internet: if connecting through Wi-Fi, the user will be prompted to connect to a wireless network. If the device is connected through an ethernet cable, Windows will skip this step -1. Apply updates: the device will look for and apply required updates -1. Windows will detect if the device has an Autopilot profile assigned to it. If so, it will proceed with the customized OOBE experience. If the Autopilot profile specifies a naming convention for the device, the device will be renamed, and a reboot will occur -1. The user authenticates to Microsoft Entra ID, using the school account -1. The device joins Microsoft Entra ID, enrolls in Intune and all the settings and applications are configured - -> [!NOTE] -> Some of these steps may be skipped, depending on the Autopilot profile configuration and if the device is using a wired connection. - -:::image type="content" source="./images/win11-login-screen.png" alt-text="Windows 11 login screen" border="false"::: - -________________________________________________________ -## Next steps - -With the devices joined to Microsoft Entra tenant and managed by Intune, you can use Intune to maintain them and report on their status. - -> [!div class="nextstepaction"] -> [Next: Manage devices >](manage-overview.md) - - - -[MEM-1]: /mem/intune/fundamentals/intune-endpoints -[MEM-2]: /mem/autopilot/oem-registration -[MEM-3]: /mem/autopilot/enrollment-autopilot#create-an-autopilot-device-group-using-intune -[MEM-4]: /mem/autopilot/profiles -[MEM-5]: /mem/autopilot/partner-registration -[MEM-6]: /mem/autopilot/add-devices - -[WIN-1]: /windows/deployment/windows-autopilot/windows-autopilot-requirements - -[MSFT-1]: https://partner.microsoft.com/ - -[INT-1]: /intune/network-bandwidth-use - -[M365-1]: https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2 - -[EDU-1]: /education/windows/windows-11-se-overview -[EDU-2]: /intune-education/windows-11-se-overview#windows-autopilot -[EDU-3]: ../tutorial-deploy-apps-winse/considerations.md#enrollment-status-page - -[SURF-1]: /surface/surface-autopilot-registration-support diff --git a/education/windows/tutorial-school-deployment/enroll-entra-join.md b/education/windows/tutorial-school-deployment/enroll-entra-join.md deleted file mode 100644 index e599fca7ac..0000000000 --- a/education/windows/tutorial-school-deployment/enroll-entra-join.md +++ /dev/null @@ -1,32 +0,0 @@ ---- -title: Enrollment in Intune with standard out-of-box experience (OOBE) -description: Learn how to join devices to Microsoft Entra ID from OOBE and automatically get them enrolled in Intune. -ms.date: 11/09/2023 -ms.topic: tutorial ---- - -# Automatic Intune enrollment via Microsoft Entra join - -If you're setting up a Windows device individually, you can use the out-of-box experience to join it to your school's Microsoft Entra tenant, and automatically enroll it in Intune. -With this process, no advance preparation is needed: - -1. Follow the on-screen prompts for region selection, keyboard selection, and network connection -1. Wait for updates. If any updates are available, they'll be installed at this time - :::image type="content" source="./images/win11-oobe-updates.png" alt-text="Windows 11 OOBE - updates page" border="true"::: -1. When prompted, select **Set up for work or school** and authenticate using your school's Microsoft Entra account - :::image type="content" source="./images/win11-oobe-auth.png" alt-text="Windows 11 OOBE - authentication page" border="true"::: -1. The device will join Microsoft Entra ID and automatically enroll in Intune. All settings defined in Intune will be applied to the device - -> [!IMPORTANT] -> If you configured enrollment restrictions in Intune blocking personal Windows devices, this process will not complete. You will need to use a different enrollment method, or ensure that the devices are registered in Autopilot. - -:::image type="content" source="./images/win11-login-screen.png" alt-text="Windows 11 login screen" border="false"::: - ---- - -## Next steps - -With the devices joined to Microsoft Entra tenant and managed by Intune, you can use Intune to maintain them and report on their status. - -> [!div class="nextstepaction"] -> [Next: Manage devices >](manage-overview.md) diff --git a/education/windows/tutorial-school-deployment/enroll-overview.md b/education/windows/tutorial-school-deployment/enroll-overview.md deleted file mode 100644 index 8410be0db9..0000000000 --- a/education/windows/tutorial-school-deployment/enroll-overview.md +++ /dev/null @@ -1,31 +0,0 @@ ---- -title: Device enrollment overview -description: Learn about the different options to enroll Windows devices in Microsoft Intune -ms.date: 11/09/2023 -ms.topic: overview ---- - -# Device enrollment overview - -There are three main methods for joining Windows devices to Microsoft Entra ID and getting them enrolled and managed by Intune: - -- **Automatic Intune enrollment via Microsoft Entra join** happens when a user first turns on a device that is in out-of-box experience (OOBE), and selects the option to join Microsoft Entra ID. In this scenario, the user can customize certain Windows functionalities before reaching the desktop, and becomes a local administrator of the device. This option isn't an ideal enrollment method for education devices -- **Bulk enrollment with provisioning packages.** Provisioning packages are files that can be used to set up Windows devices, and can include information to connect to Wi-Fi networks and to join a Microsoft Entra tenant. Provisioning packages can be created using either **Set Up School PCs** or **Windows Configuration Designer** applications. These files can be applied during or after the out-of-box experience -- **Enrollment via Windows Autopilot.** Windows Autopilot is a collection of cloud services to configure the out-of-box experience, enabling light-touch or zero-touch deployment scenarios. Windows Autopilot simplifies the Windows device lifecycle, from initial deployment to end of life, for OEMs, resellers, IT administrators and end users - -## Choose the enrollment method - -**Windows Autopilot** and the **Set up School PCs** app are usually the most efficient options for school environments. -This [table][INT-1] describes the ideal scenarios for using either option. It's recommended to review the table when planning your enrollment and deployment strategies. - -:::image type="content" source="./images/enroll.png" alt-text="The device lifecycle for Intune-managed devices - enrollment" border="false"::: - -Select one of the following options to learn the next steps about the enrollment method you chose: -> [!div class="op_single_selector"] -> - [Automatic Intune enrollment via Microsoft Entra join](enroll-entra-join.md) -> - [Bulk enrollment with provisioning packages](enroll-package.md) -> - [Enroll devices with Windows Autopilot](enroll-autopilot.md) - - - -[INT-1]: /intune-education/add-devices-windows#when-to-use-set-up-school-pcs-vs-windows-autopilot diff --git a/education/windows/tutorial-school-deployment/enroll-package.md b/education/windows/tutorial-school-deployment/enroll-package.md deleted file mode 100644 index 22f7c70443..0000000000 --- a/education/windows/tutorial-school-deployment/enroll-package.md +++ /dev/null @@ -1,65 +0,0 @@ ---- -title: Enrollment of Windows devices with provisioning packages -description: Learn about how to enroll Windows devices with provisioning packages using SUSPCs and Windows Configuration Designer. -ms.date: 11/09/2023 -ms.topic: tutorial ---- - -# Enrollment with provisioning packages - -Enrolling devices with provisioning packages is an efficient way to deploy a large number of Windows devices. Some of the benefits of provisioning packages are: - -- There are no particular hardware dependencies on the devices to complete the enrollment process -- Devices don't need to be registered in advance -- Enrollment is a simple task: just open a provisioning package and the process is automated - -You can create provisioning packages using either **Set Up School PCs** or **Windows Configuration Designer** applications, which are described in the following sections. - -## Set up School PCs - -With Set up School PCs, you can create a package containing the most common device configurations that students need, and enroll devices in Intune. The package is saved on a USB stick, which can then be plugged into devices during OOBE. Applications and settings will be automatically applied to the devices, including the Microsoft Entra join and Intune enrollment process. - -### Create a provisioning package - -The Set Up School PCs app guides you through configuration choices for school-owned devices. - -:::image type="content" source="./images/supcs-win11se.png" alt-text="Configure device settings in Set Up School PCs app" border="false"::: - -> [!CAUTION] -> If you are creating a provisioning package for **Windows 11 SE** devices, ensure to select the correct *OS version* in the *Configure device settings* page. - -Set Up School PCs will configure many settings, allowing you to optimize devices for shared use and other scenarios. - -For more information on prerequisites, configuration, and recommendations, see [Use the Set Up School PCs app][EDU-1]. - -> [!TIP] -> To learn more and practice with Set up School PCs, try the Set Up School PCs demo, which provides detailed steps to create a provisioning package and deploy a device. -## Windows Configuration Designer - -Windows Configuration Designer is especially useful in scenarios where a school needs to provision packages for both bring-you-own devices and school-owned devices. Differently from Set Up School PCs, Windows Configuration Designer doesn't offer a guided experience, and allows granular customizations, including the possibility to embed scripts in the package. - -:::image type="content" source="./images/wcd.png" alt-text="Set up device page in Windows Configuration Designer" border="false"::: - -For more information, see [Install Windows Configuration Designer][WIN-1], which provides details about the app, its provisioning process, and considerations for its use. - -## Enroll devices with the provisioning package - -To provision Windows devices with provisioning packages, insert the USB stick containing the package during the out-of-box experience. The devices will read the content of the package, join Microsoft Entra ID and automatically enroll in Intune. -All settings defined in the package and in Intune will be applied to the device, and the device will be ready to use. - -:::image type="content" source="./images/win11-oobe-ppkg.gif" alt-text="Windows 11 OOBE - enrollment with provisioning package animation." border="false"::: - ---- - -## Next steps - -With the devices joined to Microsoft Entra tenant and managed by Intune, you can use Intune to maintain them and report on their status. - -> [!div class="nextstepaction"] -> [Next: Manage devices >](manage-overview.md) - - - -[EDU-1]: /education/windows/use-set-up-school-pcs-app - -[WIN-1]: /windows/configuration/provisioning-packages/provisioning-install-icd diff --git a/education/windows/tutorial-school-deployment/images/advanced-support.png b/education/windows/tutorial-school-deployment/images/advanced-support.png deleted file mode 100644 index d7655d1616..0000000000 Binary files a/education/windows/tutorial-school-deployment/images/advanced-support.png and /dev/null differ diff --git a/education/windows/tutorial-school-deployment/images/device-lifecycle.png b/education/windows/tutorial-school-deployment/images/device-lifecycle.png deleted file mode 100644 index ab14cdb9f0..0000000000 Binary files a/education/windows/tutorial-school-deployment/images/device-lifecycle.png and /dev/null differ diff --git a/education/windows/tutorial-school-deployment/images/dfci-profile-expanded.png b/education/windows/tutorial-school-deployment/images/dfci-profile-expanded.png deleted file mode 100644 index 3386f7673a..0000000000 Binary files a/education/windows/tutorial-school-deployment/images/dfci-profile-expanded.png and /dev/null differ diff --git a/education/windows/tutorial-school-deployment/images/dfci-profile.png b/education/windows/tutorial-school-deployment/images/dfci-profile.png deleted file mode 100644 index d77dc06f3d..0000000000 Binary files a/education/windows/tutorial-school-deployment/images/dfci-profile.png and /dev/null differ diff --git a/education/windows/tutorial-school-deployment/images/enroll.png b/education/windows/tutorial-school-deployment/images/enroll.png deleted file mode 100644 index 352cda9509..0000000000 Binary files a/education/windows/tutorial-school-deployment/images/enroll.png and /dev/null differ diff --git a/education/windows/tutorial-school-deployment/images/enrollment-restrictions.png b/education/windows/tutorial-school-deployment/images/enrollment-restrictions.png deleted file mode 100644 index 69b22745a6..0000000000 Binary files a/education/windows/tutorial-school-deployment/images/enrollment-restrictions.png and /dev/null differ diff --git a/education/windows/tutorial-school-deployment/images/entra-assign-licenses.png b/education/windows/tutorial-school-deployment/images/entra-assign-licenses.png deleted file mode 100644 index 3f031053d5..0000000000 Binary files a/education/windows/tutorial-school-deployment/images/entra-assign-licenses.png and /dev/null differ diff --git a/education/windows/tutorial-school-deployment/images/entra-branding.png b/education/windows/tutorial-school-deployment/images/entra-branding.png deleted file mode 100644 index 7201c7386d..0000000000 Binary files a/education/windows/tutorial-school-deployment/images/entra-branding.png and /dev/null differ diff --git a/education/windows/tutorial-school-deployment/images/entra-device-settings.png b/education/windows/tutorial-school-deployment/images/entra-device-settings.png deleted file mode 100644 index ef18b7391f..0000000000 Binary files a/education/windows/tutorial-school-deployment/images/entra-device-settings.png and /dev/null differ diff --git a/education/windows/tutorial-school-deployment/images/entra-tenant-name.png b/education/windows/tutorial-school-deployment/images/entra-tenant-name.png deleted file mode 100644 index 4cf21148d1..0000000000 Binary files a/education/windows/tutorial-school-deployment/images/entra-tenant-name.png and /dev/null differ diff --git a/education/windows/tutorial-school-deployment/images/intune-diagnostics.png b/education/windows/tutorial-school-deployment/images/intune-diagnostics.png deleted file mode 100644 index 20b05ad9d7..0000000000 Binary files a/education/windows/tutorial-school-deployment/images/intune-diagnostics.png and /dev/null differ diff --git a/education/windows/tutorial-school-deployment/images/intune-education-apps.png b/education/windows/tutorial-school-deployment/images/intune-education-apps.png deleted file mode 100644 index ca344cf5cf..0000000000 Binary files a/education/windows/tutorial-school-deployment/images/intune-education-apps.png and /dev/null differ diff --git a/education/windows/tutorial-school-deployment/images/intune-education-autopilot-group.png b/education/windows/tutorial-school-deployment/images/intune-education-autopilot-group.png deleted file mode 100644 index 75543684ca..0000000000 Binary files a/education/windows/tutorial-school-deployment/images/intune-education-autopilot-group.png and /dev/null differ diff --git a/education/windows/tutorial-school-deployment/images/intune-education-groups.png b/education/windows/tutorial-school-deployment/images/intune-education-groups.png deleted file mode 100644 index 87f4546e88..0000000000 Binary files a/education/windows/tutorial-school-deployment/images/intune-education-groups.png and /dev/null differ diff --git a/education/windows/tutorial-school-deployment/images/intune-education-portal.png b/education/windows/tutorial-school-deployment/images/intune-education-portal.png deleted file mode 100644 index 6bcc9f9375..0000000000 Binary files a/education/windows/tutorial-school-deployment/images/intune-education-portal.png and /dev/null differ diff --git a/education/windows/tutorial-school-deployment/images/inventory-reporting.png b/education/windows/tutorial-school-deployment/images/inventory-reporting.png deleted file mode 100644 index 39c904e205..0000000000 Binary files a/education/windows/tutorial-school-deployment/images/inventory-reporting.png and /dev/null differ diff --git a/education/windows/tutorial-school-deployment/images/m365-admin-center.png b/education/windows/tutorial-school-deployment/images/m365-admin-center.png deleted file mode 100644 index d471b441dd..0000000000 Binary files a/education/windows/tutorial-school-deployment/images/m365-admin-center.png and /dev/null differ diff --git a/education/windows/tutorial-school-deployment/images/protect-manage.png b/education/windows/tutorial-school-deployment/images/protect-manage.png deleted file mode 100644 index 7ee7040a46..0000000000 Binary files a/education/windows/tutorial-school-deployment/images/protect-manage.png and /dev/null differ diff --git a/education/windows/tutorial-school-deployment/images/remote-actions.png b/education/windows/tutorial-school-deployment/images/remote-actions.png deleted file mode 100644 index cfbd12f2da..0000000000 Binary files a/education/windows/tutorial-school-deployment/images/remote-actions.png and /dev/null differ diff --git a/education/windows/tutorial-school-deployment/images/retire.png b/education/windows/tutorial-school-deployment/images/retire.png deleted file mode 100644 index c079cfeaac..0000000000 Binary files a/education/windows/tutorial-school-deployment/images/retire.png and /dev/null differ diff --git a/education/windows/tutorial-school-deployment/images/supcs-win11se.png b/education/windows/tutorial-school-deployment/images/supcs-win11se.png deleted file mode 100644 index 700ff6d87f..0000000000 Binary files a/education/windows/tutorial-school-deployment/images/supcs-win11se.png and /dev/null differ diff --git a/education/windows/tutorial-school-deployment/images/surface-management-portal-expanded.png b/education/windows/tutorial-school-deployment/images/surface-management-portal-expanded.png deleted file mode 100644 index 339bd90904..0000000000 Binary files a/education/windows/tutorial-school-deployment/images/surface-management-portal-expanded.png and /dev/null differ diff --git a/education/windows/tutorial-school-deployment/images/surface-management-portal.png b/education/windows/tutorial-school-deployment/images/surface-management-portal.png deleted file mode 100644 index a1b7dd37ab..0000000000 Binary files a/education/windows/tutorial-school-deployment/images/surface-management-portal.png and /dev/null differ diff --git a/education/windows/tutorial-school-deployment/images/wcd.png b/education/windows/tutorial-school-deployment/images/wcd.png deleted file mode 100644 index fba5be741f..0000000000 Binary files a/education/windows/tutorial-school-deployment/images/wcd.png and /dev/null differ diff --git a/education/windows/tutorial-school-deployment/images/whfb-disable.png b/education/windows/tutorial-school-deployment/images/whfb-disable.png deleted file mode 100644 index 97177965e3..0000000000 Binary files a/education/windows/tutorial-school-deployment/images/whfb-disable.png and /dev/null differ diff --git a/education/windows/tutorial-school-deployment/images/win11-autopilot-reset.png b/education/windows/tutorial-school-deployment/images/win11-autopilot-reset.png deleted file mode 100644 index 0ec380619e..0000000000 Binary files a/education/windows/tutorial-school-deployment/images/win11-autopilot-reset.png and /dev/null differ diff --git a/education/windows/tutorial-school-deployment/images/win11-login-screen.png b/education/windows/tutorial-school-deployment/images/win11-login-screen.png deleted file mode 100644 index 438dda11bc..0000000000 Binary files a/education/windows/tutorial-school-deployment/images/win11-login-screen.png and /dev/null differ diff --git a/education/windows/tutorial-school-deployment/images/win11-oobe-auth.png b/education/windows/tutorial-school-deployment/images/win11-oobe-auth.png deleted file mode 100644 index 5ebb6a9f14..0000000000 Binary files a/education/windows/tutorial-school-deployment/images/win11-oobe-auth.png and /dev/null differ diff --git a/education/windows/tutorial-school-deployment/images/win11-oobe-esp.gif b/education/windows/tutorial-school-deployment/images/win11-oobe-esp.gif deleted file mode 100644 index fa2e4c3aeb..0000000000 Binary files a/education/windows/tutorial-school-deployment/images/win11-oobe-esp.gif and /dev/null differ diff --git a/education/windows/tutorial-school-deployment/images/win11-oobe-ppkg.gif b/education/windows/tutorial-school-deployment/images/win11-oobe-ppkg.gif deleted file mode 100644 index 2defd5c1ce..0000000000 Binary files a/education/windows/tutorial-school-deployment/images/win11-oobe-ppkg.gif and /dev/null differ diff --git a/education/windows/tutorial-school-deployment/images/win11-oobe-updates.png b/education/windows/tutorial-school-deployment/images/win11-oobe-updates.png deleted file mode 100644 index 51bbc39c9f..0000000000 Binary files a/education/windows/tutorial-school-deployment/images/win11-oobe-updates.png and /dev/null differ diff --git a/education/windows/tutorial-school-deployment/images/win11-wipe.png b/education/windows/tutorial-school-deployment/images/win11-wipe.png deleted file mode 100644 index 027afae172..0000000000 Binary files a/education/windows/tutorial-school-deployment/images/win11-wipe.png and /dev/null differ diff --git a/education/windows/tutorial-school-deployment/index.md b/education/windows/tutorial-school-deployment/index.md deleted file mode 100644 index 6ddb3c8c54..0000000000 --- a/education/windows/tutorial-school-deployment/index.md +++ /dev/null @@ -1,80 +0,0 @@ ---- -title: Introduction to the tutorial deploy and manage Windows devices in a school -description: Introduction to deployment and management of Windows devices in education environments. -ms.date: 11/09/2023 -ms.topic: tutorial ---- - -# Tutorial: deploy and manage Windows devices in a school - -This guide introduces the tools and services available from Microsoft to deploy, configure and manage Windows devices in an education environment. - -## Audience and user requirements - -This tutorial is intended for education professionals responsible for deploying and managing Windows devices, including: - -- School leaders -- IT administrators -- Teachers -- Microsoft partners - -This content provides a comprehensive path for schools to deploy and manage new Windows devices with Microsoft Intune. It includes step-by-step information how to manage devices throughout their lifecycle, and specific guidance for **Windows 11 SE** and **Surface devices**. - -> [!NOTE] -> Depending on your school setup scenario, you may not need to implement all steps. - -## Device lifecycle management - -Historically, school IT administrators and educators have struggled to find an easy-to-use, flexible, and secure way to manage the lifecycle of the devices in their schools. In response, Microsoft has developed integrated suites of products for streamlined, cost-effective device lifecycle management. - -Microsoft 365 Education provides tools and services that enable simplified management of all devices through Microsoft Intune services. With Microsoft's solutions, IT administrators have the flexibility to support diverse scenarios, including school-owned devices and bring-your-own devices. -Microsoft Intune services include: - -- [Microsoft Intune][MEM-1] -- [Microsoft Intune for Education][INT-1] -- [Configuration Manager][MEM-2] -- [Desktop Analytics][MEM-3] -- [Windows Autopilot][MEM-4] -- [Surface Management Portal][MEM-5] - -These services are part of the Microsoft 365 stack to help secure access, protect data, and manage risk. - -## Why Intune for Education? - -Windows devices can be managed with Intune for Education, enabling simplified management of multiple devices from a single point. -From enrollment, through configuration and protection, to resetting, Intune for Education helps school IT administrators manage and optimize the devices throughout their lifecycle: - -:::image type="content" source="./images/device-lifecycle.png" alt-text="The device lifecycle for Intune-managed devices" border="false"::: - -- **Enroll:** to enable remote device management, devices must be enrolled in Intune with an account in your Microsoft Entra tenant. Some enrollment methods require an IT administrator to initiate enrollment, while others require students to complete the initial device setup process. This document discusses the facets of various device enrollment methodologies -- **Configure:** once the devices are enrolled in Intune, applications and settings will be applied, as defined by the IT administrator -- **Protect and manage:** in addition to its configuration capabilities, Intune for Education helps protect devices from unauthorized access or malicious attacks. For example, adding an extra layer of authentication with Windows Hello can make devices more secure. Policies are available that let you control settings for Windows Firewall, Endpoint Protection, and software updates -- **Retire:** when it's time to repurpose a device, Intune for Education offers several options, including resetting the device, removing it from management, or wiping school data. In this document, we cover different device return and exchange scenarios - -## Four pillars of modern device management - -In the remainder of this document, we'll discuss the key concepts and benefits of modern device management with Microsoft 365 solutions for education. The guidance is organized around the four main pillars of modern device management: - -- **Identity management:** setting up and configuring the identity system, with Microsoft 365 Education and Microsoft Entra ID, as the foundation for user identity and authentication -- **Initial setup:** setting up the Intune for Education environment for managing devices, including configuring settings, deploying applications, and defining updates cadence -- **Device enrollment:** Setting up Windows devices for deployment and enrolling them in Intune for Education -- **Device reset:** Resetting managed devices with Intune for Education - ---- - -## Next steps - -Let's begin with the creation and configuration of your Microsoft Entra tenant and Intune environment. - -> [!div class="nextstepaction"] -> [Next: Set up Microsoft Entra ID >](set-up-microsoft-entra-id.md) - - - -[MEM-1]: /mem/intune/fundamentals/what-is-intune -[MEM-2]: /mem/configmgr/core/understand/introduction -[MEM-3]: /mem/configmgr/desktop-analytics/overview -[MEM-4]: /mem/autopilot/windows-autopilot -[MEM-5]: /mem/autopilot/dfci-management - -[INT-1]: /intune-education/what-is-intune-for-education diff --git a/education/windows/tutorial-school-deployment/manage-overview.md b/education/windows/tutorial-school-deployment/manage-overview.md deleted file mode 100644 index 0a51b174b9..0000000000 --- a/education/windows/tutorial-school-deployment/manage-overview.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: Manage devices with Microsoft Intune -description: Overview of device management capabilities in Intune for Education, including remote actions, remote assistance and inventory/reporting. -ms.date: 11/09/2023 -ms.topic: tutorial ---- - -# Manage devices with Microsoft Intune - -Microsoft Intune offers a streamlined remote device management experience throughout the school year. IT administrators can optimize device settings, deploy new applications, updates, ensuring that security and privacy are maintained. - -:::image type="content" source="./images/protect-manage.png" alt-text="The device lifecycle for Intune-managed devices - protect and manage devices" border="false"::: - -## Remote device management - -With Intune for Education, there are several ways to manage students' devices. Groups can be created to organize devices and students, to facilitate remote management. You can determine which applications students have access to, and fine tune device settings and restrictions. You can also monitor which devices students sign in to, and troubleshoot devices remotely. - -### Remote actions - -Intune fo Education allows you to perform actions on devices without having to sign in to the devices. For example, you can send a command to a device to restart or to turn off, or you can locate a device. - -:::image type="content" source="./images/remote-actions.png" alt-text="Remote actions available in Intune for Education when selecting a Windows device" lightbox="./images/remote-actions.png" border="true"::: - -With bulk actions, remote actions can be performed on multiple devices at once. - -To learn more about remote actions in Intune for Education, see [Remote actions][EDU-1]. - -## Remote assistance - -With devices managed by Intune for Education, you can remotely assist students and teachers that are having issues with their devices. - -For more information, see [Remote assistance for managed devices - Intune for Education][EDU-2]. - -## Device inventory and reporting - -With Intune for Education, it's possible view and report on current devices, applications, settings, and overall health. You can also download reports to review or share offline. - -Here are the steps for generating reports in Intune for Education: - -1. Sign in to the Intune for Education portal -1. Select **Reports** -1. Select between one of the report types: - - Device inventory - - Device actions - - Application inventory - - Settings errors - - Windows Defender - - Autopilot deployment -1. If needed, use the search box to find specific devices, applications, and settings -1. To download a report, select **Download**. The report will download as a comma-separated value (CSV) file, which you can view and modify in a spreadsheet app like Microsoft Excel. - :::image type="content" source="./images/inventory-reporting.png" alt-text="Reporting options available in Intune for Education when selecting the reports blade" border="true"::: - -To learn more about reports in Intune for Education, see [Reports in Intune for Education][EDU-3]. - - - -[EDU-1]: /intune-education/edu-device-remote-actions -[EDU-2]: /intune-education/remote-assist-mobile-devices -[EDU-3]: /intune-education/what-are-reports diff --git a/education/windows/tutorial-school-deployment/manage-surface-devices.md b/education/windows/tutorial-school-deployment/manage-surface-devices.md deleted file mode 100644 index 028dc739c7..0000000000 --- a/education/windows/tutorial-school-deployment/manage-surface-devices.md +++ /dev/null @@ -1,44 +0,0 @@ ---- -title: Management functionalities for Surface devices -description: Learn about the management capabilities offered to Surface devices, including firmware management and the Surface Management Portal. -ms.date: 11/09/2023 -ms.topic: tutorial -appliesto: - - ✅ Surface devices ---- - -# Management functionalities for Surface devices - -Microsoft Surface devices offer advanced management functionalities, including the possibility to manage firmware settings and a web portal designed for them. - -## Manage device firmware for Surface devices - -Surface devices use a Unified Extensible Firmware Interface (UEFI) setting that allows you to enable or disable built-in hardware components, protect UEFI settings from being changed, and adjust device boot configuration. With [Device Firmware Configuration Interface profiles built into Intune][INT-1], Surface UEFI management extends the modern management capabilities to the hardware level. Windows can pass management commands from Intune to UEFI for Autopilot-deployed devices. - -DFCI supports zero-touch provisioning, eliminates BIOS passwords, and provides control of security settings for boot options, cameras and microphones, built-in peripherals, and more. For more information, see [Manage DFCI on Surface devices][SURF-1] and [Manage DFCI with Windows Autopilot][MEM-1], which includes a list of requirements to use DFCI. - -:::image type="content" source="./images/dfci-profile.png" alt-text="Creation of a DFCI profile from Microsoft Intune" lightbox="./images/dfci-profile-expanded.png" border="true"::: - -## Microsoft Surface Management Portal - -Located in the Microsoft Intune admin center, the Microsoft Surface Management Portal enables you to self-serve, manage, and monitor your school's Intune-managed Surface devices at scale. Get insights into device compliance, support activity, warranty coverage, and more. - -When Surface devices are enrolled in cloud management and users sign in for the first time, information automatically flows into the Surface Management Portal, giving you a single pane of glass for Surface-specific administration activities. - -To access and use the Surface Management Portal: - -1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) -1. Select **All services** > **Surface Management Portal** - :::image type="content" source="./images/surface-management-portal.png" alt-text="Surface Management Portal within Microsoft Intune" lightbox="./images/surface-management-portal-expanded.png" border="true"::: -1. To obtain insights for all your Surface devices, select **Monitor** - - Devices that are out of compliance or not registered, have critically low storage, require updates, or are currently inactive, are listed here -1. To obtain details on each insights category, select **View report** - - This dashboard displays diagnostic information that you can customize and export -1. To obtain the device's warranty information, select **Device warranty and coverage** -1. To review a list of support requests and their status, select **Support requests** - - - -[INT-1]: /intune/configuration/device-firmware-configuration-interface-windows -[MEM-1]: /mem/autopilot/dfci-management -[SURF-1]: /surface/surface-manage-dfci-guide diff --git a/education/windows/tutorial-school-deployment/reset-wipe.md b/education/windows/tutorial-school-deployment/reset-wipe.md deleted file mode 100644 index 9646537bac..0000000000 --- a/education/windows/tutorial-school-deployment/reset-wipe.md +++ /dev/null @@ -1,111 +0,0 @@ ---- -title: Reset and wipe Windows devices -description: Learn about the reset and wipe options for Windows devices using Intune for Education, including scenarios when to delete devices. -ms.date: 11/09/2023 -ms.topic: tutorial ---- - -# Device reset options - -There are different scenarios that require a device to be reset, for example: - -- The device isn't responding to commands -- The device is lost or stolen -- It's the end of the life of the device -- It's the end of the school year and you want to prepare the device for a new school year -- The device has hardware problems and you want to send it to the service center - -:::image type="content" source="./images/retire.png" alt-text="The device lifecycle for Intune-managed devices - retirement" border="false"::: - -Intune for Education provides two device reset functionalities that enable IT administrators to remotely execute them: - -- **Factory reset** (also known as **wipe**) is used to wipe all data and settings from the device, returning it to the default factory settings -- **Autopilot reset** is used to return the device to a fully configured or known IT-approved state - -## Factory reset (wipe) - -A factory reset, or a wipe, reverts a device to the original settings when it was purchased. All settings, applications and data installed on the device after purchase are removed. The device is also removed from Intune management. - -Once the wipe is completed, the device will be in out-of-box experience. - -Here are the steps to perform a factory reset from Intune for Education: - -1. Sign in to the Intune for Education portal -1. Select **Devices** -1. Select the device you want to reset > **Factory reset** -1. Select **Factory reset** to confirm the action - -:::image type="content" source="./images/win11-wipe.png" alt-text="Three screenshots showing the device being wiped, ending up in OOBE" lightbox="./images/win11-wipe.png" border="false"::: - -Consider using factory reset in the following example scenarios: - -- The device isn't working properly, and you want to reset it without reimaging it -- It's the end of school year and you want to prepare the device for a new school year -- You need to reassign the device to a different student, and you want to reset the device to its original settings -- You're returning a device to the service center, and you want to remove all data and settings from the device - -> [!TIP] -> Consider that once the device is wiped, the new user will go through OOBE. This option may be ideal if the device is also registered in Autopilot to make the OOBE experience seamless, or if you plan to use a provisioning package to re-enroll the device. - -## Autopilot Reset - -Autopilot Reset is ideal when all data on a device needs to be wiped, but the device remains enrolled in your tenant. - -Once the Autopilot reset action is completed, the device will ask to chose region and keyboard layout, then it will display the sign-in screen. - -Here are the steps to perform an Autopilot reset from Intune for Education: - -1. Sign in to the Intune for Education portal -1. Select **Devices** -1. Select the device you want to reset > **Autopilot reset** -1. Select **Autopilot reset** to confirm the action - -:::image type="content" source="./images/win11-autopilot-reset.png" alt-text="Three screenshots showing the device being wiped, ending up in the login screen" border="false"::: - -Consider using Autopilot reset in the following example scenarios: - -- The device isn't working properly, and you want to reset it without reimaging it -- It's the end of school year and you want to prepare the device for a new school year -- You need to reassign the device to a different student, and you want to reset the device to without requiring the student to go through OOBE - -> [!TIP] -> Consider that the end user will **not** go through OOBE, and the association of the user to the device in Intune doesn't change. For this reason, this option may be ideal for devices that have been enrolled in Intune as *shared devices* (for example, a device that was enrolled with a provisioning package or using Autopilot self-deploying mode). - -## Wiping and deleting a device - -There are scenarios that require a device to be deleted from your tenant, for example: - -- The device is lost or stolen -- It's the end of the life of the device -- The device has been replaced with a new device or has its motherboard replaced - -> [!IMPORTANT] -> The following actions should only be performed for devices that are no longer going to be used in your tenant. - - To completely remove a device, you need to perform the following actions: - -1. If possible, perform a **factory reset (wipe)** of the device. If the device can't be wiped, delete the device from Intune using [these steps][MEM-1] -1. If the device is registered in Autopilot, delete the Autopilot object using [these steps][MEM-2] -1. Delete the device from Microsoft Entra ID using [these steps][MEM-3] - -## Autopilot considerations for a motherboard replacement scenario - -Repairing Autopilot-enrolled devices can be complex, as OEM requirements must be balanced with Autopilot requirements. If a motherboard replacement is needed on an Autopilot device, it's suggested the following process: - -1. Deregister the device from Autopilot -1. Replace the motherboard -1. Capture a new device ID (4K HH) -1. Re-register the device with Autopilot - > [!IMPORTANT] - > For DFCI management, the device must be re-registered by a partner or OEM. Self-registration of devices is not supported with DFCI management. -1. Reset the device -1. Return the device - -For more information, see [Autopilot motherboard replacement scenario guidance][MEM-4]. - - - -[MEM-1]: /mem/intune/remote-actions/devices-wipe#delete-devices-from-the-intune-portal -[MEM-2]: /mem/intune/remote-actions/devices-wipe#delete-devices-from-the-intune-portal -[MEM-3]: /mem/intune/remote-actions/devices-wipe#delete-devices-from-the-azure-active-directory-portal -[MEM-4]: /mem/autopilot/autopilot-mbr diff --git a/education/windows/tutorial-school-deployment/set-up-microsoft-entra-id.md b/education/windows/tutorial-school-deployment/set-up-microsoft-entra-id.md deleted file mode 100644 index b1ab1cfc12..0000000000 --- a/education/windows/tutorial-school-deployment/set-up-microsoft-entra-id.md +++ /dev/null @@ -1,172 +0,0 @@ ---- -title: Set up Microsoft Entra ID -description: Learn how to create and prepare your Microsoft Entra tenant for an education environment. -ms.date: 11/09/2023 -ms.topic: tutorial -appliesto: ---- - -# Set up Microsoft Entra ID - -The Microsoft platform for education simplifies the management of Windows devices with Intune for Education and Microsoft 365 Education. The first, fundamental step, is to configure the identity infrastructure to manage user access and permissions for your school. - -Microsoft Entra ID, which is included with the Microsoft 365 Education subscription, provides authentication and authorization to any Microsoft cloud services. Identity objects are defined in Microsoft Entra ID for human identities, like students and teachers, as well as non-human identities, like devices, services, and applications. Once users get Microsoft 365 licenses assigned, they'll be able to consume services and access resources within the tenant. With Microsoft 365 Education, you can manage identities for your teachers and students, assign licenses to devices and users, and create groups for the classrooms. - -In this section you will: -> [!div class="checklist"] -> * Set up a Microsoft 365 Education tenant -> * Add users, create groups, and assign licenses -> * Configure school branding -> * Enable bulk enrollment - -## Create a Microsoft 365 tenant - -If you don't already have a Microsoft 365 tenant, you'll need to create one. - -For more information, see [Create your Office 365 tenant account][M365-1] - -> [!TIP] -> To learn more, and practice how to configure the Microsoft 365 tenant for your school, try this interactive demo. -### Explore the Microsoft 365 admin center - -The **Microsoft 365 admin center** is the hub for all administrative consoles for the Microsoft 365 cloud. To access the Microsoft Entra admin center, sign in with the same global administrator account when you [created the Microsoft 365 tenant](#create-a-microsoft-365-tenant). - -From the Microsoft 365 admin center, you can access different administrative dashboards: Microsoft Entra ID, Microsoft Intune, Intune for Education, and others: - -:::image type="content" source="./images/m365-admin-center.png" alt-text="*All admin centers* page in *Microsoft 365 admin center*" lightbox="./images/m365-admin-center.png" border="true"::: - -For more information, see [Overview of the Microsoft 365 admin center][M365-2]. - -> [!NOTE] -> Setting up your school's basic cloud infrastructure does not require you to complete the rest of the Microsoft 365 setup. For this reason, we will skip directly to adding students and teachers as users in the Microsoft 365 tenant. - -## Add users, create groups, and assign licenses - -With the Microsoft 365 tenant in place, it's time to add users, create groups, and assign licenses. All students and teachers need a user account before they can sign in and access the different Microsoft 365 services. There are multiple ways to do this, including using School Data Sync (SDS), synchronizing an on-premises Active Directory, manually, or a combination of the above. - -> [!NOTE] -> Synchronizing your Student Information System (SIS) with School Data Sync is the preferred way to create students and teachers as users in a Microsoft 365 Education tenant. However, if you want to integrate an on-premises directory and synchronize accounts to the cloud, skip to [Azure Active Directory Sync](#azure-active-directory-sync) below. - -### School Data Sync - -School Data Sync (SDS) imports and synchronizes SIS data to create classes in Microsoft 365, such as Microsoft 365 groups and class teams in Microsoft Teams. SDS can be used to create new, cloud-only, identities or to evolve existing identities. Users evolve into *students* or *teachers* and are associated with a *grade*, *school*, and other education-specific attributes. - -For more information, see [Overview of School Data Sync][SDS-1]. - -> [!TIP] -> To learn more and practice with School Data Sync, follow the Microsoft School Data Sync demo, which provides detailed steps to access, configure, and deploy School Data Sync in your Microsoft 365 Education tenant. - -> [!NOTE] -> You can perform a test deployment by cloning or downloading sample SDS CSV school data from the [O365-EDU-Tools GitHub site](https://github.com/OfficeDev/O365-EDU-Tools). -> -> Remember that you should typically deploy test SDS data (users, groups, and so on) in a separate test tenant, not your school production environment. - -### Azure Active Directory Sync - -To integrate an on-premises directory with Microsoft Entra ID, you can use **Microsoft Entra Connect** to synchronize users, groups, and other objects. Microsoft Entra Connect lets you configure the authentication method appropriate for your school, including: - -- [Password hash synchronization][AAD-1] -- [Pass-through authentication][AAD-2] -- [Federated authentication][AAD-3] - -For more information, see [Set up directory synchronization for Microsoft 365][O365-1]. - -### Create users manually - -In addition to the above methods, you can manually add users and groups, and assign licenses through the Microsoft 365 admin center. - -There are two options for adding users manually, either individually or in bulk: - -1. To add students and teachers as users in Microsoft 365 Education *individually*: - - Sign in to the Microsoft Entra admin center - - Select **Microsoft Entra ID** > **Users** > **All users** > **New user** > **Create new user** - For more information, see [Add users and assign licenses at the same time][M365-3]. -1. To add *multiple* users to Microsoft 365 Education: - - Sign in to the Microsoft Entra admin center - - Select **Microsoft Entra ID** > **Users** > **All users** > **Bulk operations** > **Bulk create** - -For more information, see [Add multiple users in the Microsoft 365 admin center][M365-4]. - -### Create groups - -Creating groups is important to simplify multiple tasks, like assigning licenses, delegating administration, deploy settings, applications or to distribute assignments to students. To create groups: - -1. Sign in to the Microsoft Entra admin center -1. Select **Microsoft Entra ID** > **Groups** > **All groups** > **New group** -1. On the **New group** page, select **Group type** > **Security** -1. Provide a group name and add members, as needed -1. Select **Next** - -For more information, see [Create a group in the Microsoft 365 admin center][M365-5]. - -### Assign licenses - -The recommended way to assign licenses is through group-based licensing. With this method, Microsoft Entra ID ensures that licenses are assigned to all members of the group. Any new members who join the group are assigned the appropriate licenses, and when members leave, their licenses are removed. - -To assign a license to a group: - -1. Sign in to the Microsoft Entra admin center -1. Select **Microsoft Entra ID** > **Show More** > **Billing** > **Licenses** -1. Select the required products that you want to assign licenses for > **Assign** -1. Add the groups to which the licenses should be assigned - - :::image type="content" source="images/entra-assign-licenses.png" alt-text="Assign licenses from Microsoft Entra admin center." lightbox="images/entra-assign-licenses.png"::: - -For more information, see [Group-based licensing using Microsoft Entra admin center][AAD-4]. - -## Configure school branding - -Configuring your school branding enables a more familiar Autopilot experience to students and teachers. With a custom school branding, you can define a custom logo and a welcome message, which will appear during the Windows out-of-box experience. - -To configure your school's branding: - -1. Sign in to the Microsoft Entra admin center -1. Select **Microsoft Entra ID** > **Show More** > **User experiences** > **Company branding** -1. You can specify brand settings like background image, logo, username hint and a sign-in page text - :::image type="content" source="images/entra-branding.png" alt-text="Configure Microsoft Entra ID branding from Microsoft Entra admin center." lightbox="images/entra-branding.png"::: -1. To adjust the school tenant's name displayed during OOBE, select **Microsoft Entra ID** > **Overview** > **Properties** -1. In the **Name** field, enter the school district or organization's name > **Save** - :::image type="content" alt-text="Configure Microsoft Entra tenant name from Microsoft Entra admin center." source="images/entra-tenant-name.png" lightbox="images/entra-tenant-name.png"::: - -For more information, see [Add branding to your directory][AAD-5]. - -## Enable bulk enrollment - -If you decide to enroll Windows devices using provisioning packages instead of Windows Autopilot, you must ensure that the provisioning packages can join Windows devices to the Microsoft Entra tenant. - -To allow provisioning packages to complete the Microsoft Entra join process: - -1. Sign in to the Microsoft Entra admin center -1. Select **Microsoft Entra ID** > **Devices** > **Device Settings** -1. Under **Users may join devices to Microsoft Entra ID**, select **All** - > [!NOTE] - > If it is required that only specific users can join devices to Microsoft Entra ID, select **Selected**. Ensure that the user account that will create provisioning packages is included in the list of users. -1. Select Save - :::image type="content" source="images/entra-device-settings.png" alt-text="Configure device settings from Microsoft Entra admin center." lightbox="images/entra-device-settings.png"::: - ---- - -## Next steps - -With users and groups created, and licensed for Microsoft 365 Education, you can now configure Microsoft Intune. - -> [!div class="nextstepaction"] -> [Next: Set up Microsoft Intune >](set-up-microsoft-intune.md) - - - -[AAD-1]: /azure/active-directory/hybrid/whatis-phs -[AAD-2]: /azure/active-directory/hybrid/how-to-connect-pta -[AAD-3]: /azure/active-directory/hybrid/how-to-connect-fed-whatis -[AAD-4]: /azure/active-directory/enterprise-users/licensing-groups-assign -[AAD-5]: /azure/active-directory/fundamentals/customize-branding - -[M365-1]: /microsoft-365/education/deploy/create-your-office-365-tenant -[M365-2]: /microsoft-365/admin/admin-overview/admin-center-overview -[M365-3]: /microsoft-365/admin/add-users/add-users -[M365-4]: /microsoft-365/enterprise/add-several-users-at-the-same-time -[M365-5]: /microsoft-365/admin/create-groups/create-groups - -[O365-1]: /office365/enterprise/set-up-directory-synchronization - -[SDS-1]: /schooldatasync/overview-of-school-data-sync diff --git a/education/windows/tutorial-school-deployment/set-up-microsoft-intune.md b/education/windows/tutorial-school-deployment/set-up-microsoft-intune.md deleted file mode 100644 index 38dc58b276..0000000000 --- a/education/windows/tutorial-school-deployment/set-up-microsoft-intune.md +++ /dev/null @@ -1,96 +0,0 @@ ---- -title: Set up device management -description: Learn how to configure the Intune service and set up the environment for education. -ms.date: 11/09/2023 -ms.topic: tutorial -appliesto: ---- - -# Set up Microsoft Intune - -Without the proper tools and resources, managing hundreds or thousands of devices in a school environment can be a complex and time-consuming task. Microsoft Intune is a collection of services that simplifies the management of devices at scale. - -The Microsoft Intune service can be managed in different ways, and one of them is **Intune for Education**, a web portal designed for education environments. - -:::image type="content" source="./images/intune-education-portal.png" alt-text="Intune for Education dashboard" lightbox="./images/intune-education-portal.png" border="true"::: - -**Intune for Education** supports the entire device lifecycle, from the enrollment phase through retirement. IT administrators can start managing classroom devices with bulk enrollment options and a streamlined deployment. At the end of the school year, IT admins can reset devices, ensuring they're ready for the next year. - -For more information, see [Intune for Education documentation][INT-1]. - -In this section you will: -> [!div class="checklist"] -> * Review Intune's licensing prerequisites -> * Configure the Intune service for education devices - -## Prerequisites - -Before configuring settings with Intune for Education, consider the following prerequisites: - -- **Intune subscription.** Microsoft Intune is licensed in three ways: - - As a standalone service - - As part of [Enterprise Mobility + Security][MSFT-1] - - As part of a [Microsoft 365 Education subscription][MSFT-2] -- **Device platform.** Intune for Education can manage devices running a supported version of Windows 10, Windows 11, Windows 11 SE, iOS, and iPad OS - -For more information, see [Intune licensing][MEM-1] and [this comparison sheet][MSFT-3], which includes a table detailing the *Microsoft Modern Work Plan for Education*. - -## Configure the Intune service for education devices - -The Intune service can be configured in different ways, depending on the needs of your school. In this section, you'll configure the Intune service using settings commonly implemented by K-12 school districts. - -### Configure enrollment restrictions - -With enrollment restrictions, you can prevent certain types of devices from being enrolled and therefore managed by Intune. For example, you can prevent the enrollment of devices that are not owned by the school. - -To block personally owned Windows devices from enrolling: - -1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). -1. Select **Devices** > **Enroll devices** > **Enrollment device platform restrictions** -1. Select the **Windows restrictions** tab -1. Select **Create restriction** -1. On the **Basics** page, provide a name for the restriction and, optionally, a description > **Next** -1. On the **Platform settings** page, in the **Personally owned devices** field, select **Block** > **Next** - :::image type="content" source="./images/enrollment-restrictions.png" alt-text="This screenshot is of the device enrollment restriction page in Microsoft Intune admin center." lightbox="./images/enrollment-restrictions.png"::: -1. Optionally, on the **Scope tags** page, add scope tags > **Next** -1. On the **Assignments** page, select **Add groups**, and then use the search box to find and choose groups to which you want to apply the restriction > **Next** -1. On the **Review + create** page, select **Create** to save the restriction - -For more information, see [Create a device platform restriction][MEM-2]. - -### Disable Windows Hello for Business - -Windows Hello for Business is a biometric authentication feature that allows users to sign in to their devices using a PIN, password, or fingerprint. Windows Hello for Business is enabled by default on Windows devices, and to set it up, users must perform for multi-factor authentication (MFA). As a result, this feature may not be ideal for students, who may not have MFA enabled. -It's suggested to disable Windows Hello for Business on Windows devices at the tenant level, and enabling it only for devices that need it, for example for teachers and staff devices. -To disable Windows Hello for Business at the tenant level: - -1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). -1. Select **Devices** > **Windows** > **Windows Enrollment** -1. Select **Windows Hello for Business** -1. Ensure that **Configure Windows Hello for Business** is set to **disabled** -1. Select **Save** - -:::image type="content" source="./images/whfb-disable.png" alt-text="Disablement of Windows Hello for Business from Microsoft Intune admin center." lightbox="./images/whfb-disable.png"::: - -For more information how to enable Windows Hello for Business on specific devices, see [Create a Windows Hello for Business policy][MEM-4]. - ---- - -## Next steps - -With the Intune service configured, you can configure policies and applications in preparation to the deployment of students' and teachers' devices. - -> [!div class="nextstepaction"] -> [Next: Configure devices >](configure-devices-overview.md) - - - -[MEM-1]: /mem/intune/fundamentals/licenses -[MEM-2]: /mem/intune/enrollment/enrollment-restrictions-set -[MEM-4]: /mem/intune/protect/windows-hello#create-a-windows-hello-for-business-policy - -[INT-1]: /intune-education/what-is-intune-for-education - -[MSFT-1]: https://www.microsoft.com/microsoft-365/enterprise-mobility-security -[MSFT-2]: https://www.microsoft.com/licensing/product-licensing/microsoft-365-education -[MSFT-3]: https://edudownloads.azureedge.net/msdownloads/Microsoft-Modern-Work-Plan-Comparison-Education_11-2021.pdf \ No newline at end of file diff --git a/education/windows/tutorial-school-deployment/toc.yml b/education/windows/tutorial-school-deployment/toc.yml deleted file mode 100644 index 8abc013f68..0000000000 --- a/education/windows/tutorial-school-deployment/toc.yml +++ /dev/null @@ -1,38 +0,0 @@ -items: - - name: Introduction - href: index.md - - name: 1. Prepare your tenant - items: - - name: Set up Microsoft Entra ID - href: set-up-microsoft-entra-id.md - - name: Set up Microsoft Intune - href: set-up-microsoft-intune.md - - name: 2. Configure settings and applications - items: - - name: Overview - href: configure-devices-overview.md - - name: Configure policies - href: configure-device-settings.md - - name: Configure applications - href: configure-device-apps.md - - name: 3. Deploy devices - items: - - name: Overview - href: enroll-overview.md - - name: Enroll devices via Microsoft Entra join - href: enroll-entra-join.md - - name: Enroll devices with provisioning packages - href: enroll-package.md - - name: Enroll devices with Windows Autopilot - href: enroll-autopilot.md - - name: 4. Manage devices - items: - - name: Overview - href: manage-overview.md - - name: Management functionalities for Surface devices - href: manage-surface-devices.md - - name: Reset and wipe devices - href: reset-wipe.md - - name: 5. Troubleshoot and get help - href: troubleshoot-overview.md - diff --git a/education/windows/tutorial-school-deployment/troubleshoot-overview.md b/education/windows/tutorial-school-deployment/troubleshoot-overview.md deleted file mode 100644 index 0d59f1af56..0000000000 --- a/education/windows/tutorial-school-deployment/troubleshoot-overview.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: Troubleshoot Windows devices -description: Learn how to troubleshoot Windows devices from Intune and contact Microsoft Support for issues related to Intune and other services. -ms.date: 11/09/2023 -ms.topic: tutorial ---- - -# Troubleshoot Windows devices - -Microsoft Intune provides many tools that can help you troubleshoot Windows devices. -Here's a collection of resources to help you troubleshoot Windows devices managed by Intune: - -- [Troubleshooting device enrollment in Intune][MEM-2] -- [Troubleshooting Windows Autopilot][MEM-9] -- [Troubleshoot Windows Wi-Fi profiles][MEM-6] -- [Troubleshooting policies and profiles in Microsoft Intune][MEM-5] -- [Troubleshooting BitLocker with the Intune encryption report][MEM-4] -- [Troubleshooting CSP custom settings][MEM-8] -- [Troubleshooting Win32 app installations with Intune][MEM-7] -- [Troubleshooting device actions in Intune][MEM-3] -- [**Collect diagnostics**][MEM-10] is a remote action that lets you collect and download Windows device logs without interrupting the user - :::image type="content" source="./images/intune-diagnostics.png" alt-text="Intune for Education dashboard" lightbox="./images/intune-diagnostics.png" border="true"::: - -## How to contact Microsoft Support - -Microsoft provides global technical, pre-sales, billing, and subscription support for cloud-based device management services. This support includes Microsoft Intune, Configuration Manager, Windows 365, and Microsoft Managed Desktop. - -Follow these steps to obtain support in Microsoft Intune provides many tools that can help you troubleshoot Windows devices: - -- Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) -- Select **Troubleshooting + support** > **Help and support** - :::image type="content" source="images/advanced-support.png" alt-text="Screenshot that shows how to obtain support from Microsoft Intune." lightbox="images/advanced-support.png"::: -- Select the required support scenario: Configuration Manager, Intune, Co-management, or Windows 365 -- Above **How can we help?**, select one of three icons to open different panes: *Find solutions*, *Contact support*, or *Service requests* -- In the **Find solutions** pane, use the text box to specify a few details about your issue. The console may offer suggestions based on what you've entered. Depending on the presence of specific keywords, the console provides help like: - - Run diagnostics: start automated tests and investigations of your tenant from the console to reveal known issues. When you run a diagnostic, you may receive mitigation steps to help with resolution - - View insights: find links to documentation that provides context and background specific to the product area or actions you've described - - Recommended articles: browse suggested troubleshooting topics and other content related to your issue -- If needed, use the *Contact support* pane to file an online support ticket - > [!IMPORTANT] - > When opening a case, be sure to include as many details as possible in the *Description* field. Such information includes: timestamp and date, device ID, device model, serial number, OS version, and any other details relevant to the issue. -- To review your case history, select the **Service requests** pane. Active cases are at the top of the list, with closed issues also available for review - -For more information, see [Microsoft Intune support page][MEM-1] - - -[MEM-1]: /mem/get-support -[MEM-2]: /troubleshoot/mem/intune/troubleshoot-device-enrollment-in-intune -[MEM-3]: /troubleshoot/mem/intune/troubleshoot-device-actions -[MEM-4]: /troubleshoot/mem/intune/troubleshoot-bitlocker-admin-center -[MEM-5]: /troubleshoot/mem/intune/troubleshoot-policies-in-microsoft-intune -[MEM-6]: /troubleshoot/mem/intune/troubleshoot-wi-fi-profiles#troubleshoot-windows-wi-fi-profiles -[MEM-7]: /troubleshoot/mem/intune/troubleshoot-win32-app-install -[MEM-8]: /troubleshoot/mem/intune/troubleshoot-csp-custom-settings -[MEM-9]: /mem/autopilot/troubleshooting -[MEM-10]: /mem/intune/remote-actions/collect-diagnostics diff --git a/education/windows/use-set-up-school-pcs-app.md b/education/windows/use-set-up-school-pcs-app.md index d6b1fa3e62..b7d2153dce 100644 --- a/education/windows/use-set-up-school-pcs-app.md +++ b/education/windows/use-set-up-school-pcs-app.md @@ -7,7 +7,7 @@ appliesto: - ✅ Windows 10 --- -# Use the Set up School PCs app +# Use the Set up School PCs app IT administrators and technical teachers can use the **Set up School PCs** app to quickly set up Windows devices for students. The app configures devices with the apps and features students need, and it removes the ones they don't need. During setup, if licensed in your tenant, the app enrolls each student device in Microsoft Intune. You can then manage all the settings the app configures through Intune. @@ -16,20 +16,20 @@ With Set up School PCs you can: - Joins student devices to your organization's Microsoft Entra tenant - Enable the optional Autopilot Reset feature, to return devices to a fully configured or known IT-approved state - Use Windows Update and maintenance hours to keep student devices up-to-date, without interfering with class time -- Lock down student devices to prevent activity that aren't beneficial to their education +- Lock down student devices to prevent activity that aren't beneficial to their education -This article describes how to use the Set up School PCs app. To learn more about the app's functionality, review the [Technical reference for the Set up School PCs app](set-up-school-pcs-technical.md). +This article describes how to use the Set up School PCs app. To learn more about the app's functionality, review the [Technical reference for the Set up School PCs app](set-up-school-pcs-technical.md). ## Requirements Before you begin, make sure that your devices and your school's network are configured with the following requirements: - Microsoft Entra ID and Microsoft 365 licenses -- [Latest Set up School PCs app](https://apps.microsoft.com/detail/9NBLGGH4LS40) +- [Latest Set up School PCs app](https://apps.microsoft.com/detail/9NBLGGH4LS40) - A NTFS-formatted USB drive that is at least 1 GB - Student devices must either: - Be within range of the Wi-Fi network that you configured in the app - - Have a wired Ethernet connection when you set them up + - Have a wired Ethernet connection when you set them up ### Prepare existing PC account for new setup @@ -46,7 +46,7 @@ Alternatively, you can also select **Start** > **Power** icon. Hold down Sh 1. Select **Troubleshoot** > **Reset this PC** 1. Select **Remove everything** -1. If the option appears, select **Only the drive where Windows is installed** +1. If the option appears, select **Only the drive where Windows is installed** 1. Select **Just remove my files** 1. Select **Reset** @@ -58,20 +58,20 @@ This section offers recommendations to prepare you for the best possible setup e We recommend you run the IT administrator or technical teacher's device on the same Windows build as the student devices. -### Student devices must meet OS requirements for the app +### Student devices must meet OS requirements for the app -Check the OS requirements in the Set up School PCs app. We recommend using the latest Set up School PCs app along with the latest Windows images on the student devices. +Check the OS requirements in the Set up School PCs app. We recommend using the latest Set up School PCs app along with the latest Windows images on the student devices. To check the app's OS requirements, go to the Microsoft Store and locate the Set up School PCs app. In the app's description, go to **System Requirements** > **OS**. -### Use app on a PC that is connected to your school's network +### Use app on a PC that is connected to your school's network We recommend that you run the Set up School PCs app on a computer that's connected to your school's network. That way the app can gather accurate information about your school's wireless networks and cloud subscriptions. If it's not connected, you need to enter the information manually. ->[!NOTE] +>[!NOTE] >Don't use the **Set up Schools PCs** app for devices that must connect to enterprise or open Wi-Fi networds that require the user to accept Terms of Use. -### Run app on an open network or network that requires a basic password +### Run app on an open network or network that requires a basic password Don't use Set up School PCs over a certificate-based network, or one where you have to enter credentials in a browser. If you need to set up many devices over Wi-Fi, make sure that your network configuration can support it. @@ -87,57 +87,57 @@ We recommend that you: To set up more than one PC at the same time, save the provisioning package to additional USB drives. Then plug the USBs in at the same time during setup. -### Limit changes to school-optimized settings +### Limit changes to school-optimized settings -We strongly recommend that you avoid changing preset policies. Changes can slow down setup, performance, and the time it takes to sign in. +We strongly recommend that you avoid changing preset policies. Changes can slow down setup, performance, and the time it takes to sign in. -## Create the provisioning package +## Create the provisioning package The **Set up School PCs** app guides you through the configuration choices for the student PCs. To begin, open the app on your device and select **Get started**. -![Launch the Set up School PCs app.](images/suspcs/suspc_getstarted_050817.png) +![Launch the Set up School PCs app.](images/suspcs/suspc_getstarted_050817.png) ### Package name -Type a unique name to help distinguish your school's provisioning packages. The name appears: +Type a unique name to help distinguish your school's provisioning packages. The name appears: - On the local package folder - In your tenant's Microsoft Entra account in the Azure portal -A package expiration date is also attached to the end of each package. For example, *Set_Up_School_PCs (Expires 1-1-2024)*. The expiration date is 180 days after you create your package. +A package expiration date is also attached to the end of each package. For example, *Set_Up_School_PCs (Expires 1-1-2024)*. The expiration date is 180 days after you create your package. - ![Example screenshot of the Set up School PCs app, Name your package screen.](images/suspcs/1810_Name_Your_Package_SUSPC.png) + ![Example screenshot of the Set up School PCs app, Name your package screen.](images/suspcs/1810_Name_Your_Package_SUSPC.png) -After you select **Next**, you can no longer change the name in the app. To create a package with a different name, reopen the Set up School PCs app. +After you select **Next**, you can no longer change the name in the app. To create a package with a different name, reopen the Set up School PCs app. -To change an existing package's name, right-click the package folder on your device and select **Rename**. This action doesn't change the name in Microsoft Entra ID. If you have Global Admin permissions, you can go to Microsoft Entra ID in the Azure portal, and rename the package there. +To change an existing package's name, right-click the package folder on your device and select **Rename**. This action doesn't change the name in Microsoft Entra ID. You can access to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [User Administrator](/entra/identity/role-based-access-control/permissions-reference#user-administrator), and rename the package there. -### Sign in +### Sign in 1. Select how you want to sign in - 1. (Recommended) To enable student device to automatically connect and authenticate to Microsoft Entra ID, and management services like Microsoft Intune, select **Sign-in**. Then go to step 3 + 1. (Recommended) To enable student device to automatically connect and authenticate to Microsoft Entra ID, and management services like Microsoft Intune, select **Sign-in**. Then go to step 3 1. To complete setup without signing in, select **Continue without account**. Student devices won't connect to your school's cloud services and their management will be more difficult later. Continue to [Wireless network](#wireless-network) -1. In the new window, select the account you want to use throughout setup. +1. In the new window, select the account you want to use throughout setup. - ![Sign-in screen showing the option to "Use this account" or use a different "Work or school account."](images/suspcs/1810_choose_account_suspc.png) + ![Sign-in screen showing the option to "Use this account" or use a different "Work or school account."](images/suspcs/1810_choose_account_suspc.png) - To add an account not listed: - 1. Select **Work or school account** > **Continue**. - 1. Type in the account username and select **Next**. - 1. Verify the user account and password, if prompted. + To add an account not listed: + 1. Select **Work or school account** > **Continue**. + 1. Type in the account username and select **Next**. + 1. Verify the user account and password, if prompted. 1. Select **Accept** to allow Set up School PCs to access your account throughout setup 1. When your account name appears on the page, select **Next** - ![Example screenshot of the Set up School PC app, Sign in screen, showing that the user's account name appears at the bottom of the page.](images/suspcs/1810_Sign_In_SUSPC.png) + ![Example screenshot of the Set up School PC app, Sign in screen, showing that the user's account name appears at the bottom of the page.](images/suspcs/1810_Sign_In_SUSPC.png) ### Wireless network -Add and save the wireless network profile that you want student devices to connect to. Only skip Wi-Fi setup if you have an Ethernet connection. +Add and save the wireless network profile that you want student devices to connect to. Only skip Wi-Fi setup if you have an Ethernet connection. -Select your organization's Wi-Fi network from the list of available wireless networks, or select **Add a wireless network** to manually configure it. Then select **Next** +Select your organization's Wi-Fi network from the list of available wireless networks, or select **Add a wireless network** to manually configure it. Then select **Next** - ![Example screenshot of the Set up School PC app, Wireless network page with two Wi-Fi networks listed, one of which is selected.](images/suspcs/1810_SUSPC_select_Wifi.png) + ![Example screenshot of the Set up School PC app, Wireless network page with two Wi-Fi networks listed, one of which is selected.](images/suspcs/1810_SUSPC_select_Wifi.png) ### Device names @@ -147,17 +147,17 @@ To make sure all device names are unique, Set up School PCs automatically append To keep the default name for your devices, select **Continue with existing names**. - !["Name these devices" screen with the device field filled in with example device name, "Grd8."](images/suspcs/1810_name-devices_SUSPC.png) + !["Name these devices" screen with the device field filled in with example device name, "Grd8."](images/suspcs/1810_name-devices_SUSPC.png) ### Settings Select more settings to include in the provisioning package. To begin, select the operating system on your student PCs. -![Screenshot of the Current OS version page with the Select OS version menu selected, showing 7 Windows 10 options. All other settings on page are unavailable to select.](images/suspcs/1810_suspc_settings.png) +![Screenshot of the Current OS version page with the Select OS version menu selected, showing 7 Windows 10 options. All other settings on page are unavailable to select.](images/suspcs/1810_suspc_settings.png) Setting selections vary based on the OS version you select. -![Example screenshot of the Current OS version page, with Windows 10 version 1803 selected. 4 available settings and 1 unavailable setting are shown, and none are selected.](images/suspcs/1810_SUSPC_available_settings.png) +![Example screenshot of the Current OS version page, with Windows 10 version 1803 selected. 4 available settings and 1 unavailable setting are shown, and none are selected.](images/suspcs/1810_SUSPC_available_settings.png) The following table describes each setting and lists the applicable Windows 10 versions. To find out if a setting is available in your version of Windows 10, look for an *X* in the setting row and in the version column. @@ -172,20 +172,20 @@ The following table describes each setting and lists the applicable Windows 10 v After you've made your selections, select **Next**. -### Time zone +### Time zone > [!WARNING] > If you are using the Autounattend.xml file to reimage your school PCs, do not specify a time zone in the file. If you set the time zone in the file *and* in this app, you will encounter an error. -Choose the time zone where your school's devices are used. This setting ensures that all PCs are provisioned in the same time zone. When you're done, select **Next**. +Choose the time zone where your school's devices are used. This setting ensures that all PCs are provisioned in the same time zone. When you're done, select **Next**. -![Choose PC time zone page with the time zone menu expanded to show all time zone selections.](images/suspcs/1810_suspc_timezone.png) +![Choose PC time zone page with the time zone menu expanded to show all time zone selections.](images/suspcs/1810_suspc_timezone.png) ### Product key Optionally, type in a 25-digit product key to upgrade or change the edition of Windows on your student devices. If you don't have a product key, select **Continue without change**. -![Example screenshot of the Set up School PC app, Product key screen, showing a value field, Next button, and Continue without change option.](images/suspcs/1810_suspc_product_key.png) +![Example screenshot of the Set up School PC app, Product key screen, showing a value field, Next button, and Continue without change option.](images/suspcs/1810_suspc_product_key.png) ### Take a Test @@ -195,7 +195,7 @@ Set up the Take a Test app to give online quizzes and high-stakes assessments. D ![Set up Take a Test app page with "Yes" selected to create an app button. Page also has two checkboxes for additional settings and one text field for the assessment URL.](images/suspcs/1810_SUSPC_Take_Test.png) -1. Select from the advanced settings. Available settings include: +1. Select from the advanced settings. Available settings include: - Allow keyboard auto-suggestions: Allows app to suggest words as the student types on the device's keyboard - Allow teachers to monitor online tests: Enables screen capture in the Take a Test app 1. Enter the URL where the test is hosted. When students log in to the Take a Test account, they'll be able to select or enter the link to view the assessment @@ -203,11 +203,11 @@ Set up the Take a Test app to give online quizzes and high-stakes assessments. D ### Personalization -Upload custom images to replace the student devices' default desktop and lock screen backgrounds. Select **Browse** to search for an image file on your computer. Accepted image formats are jpg, jpeg, and png. +Upload custom images to replace the student devices' default desktop and lock screen backgrounds. Select **Browse** to search for an image file on your computer. Accepted image formats are jpg, jpeg, and png. -If you don't want to upload custom images or use the images that appear in the app, select **Continue without personalization**. This option doesn't apply any customizations, and instead uses the devices' default or preset images. +If you don't want to upload custom images or use the images that appear in the app, select **Continue without personalization**. This option doesn't apply any customizations, and instead uses the devices' default or preset images. -![Example image of the Set up School PCs app, Personalization screen, showing the default desktop and lock screen background photos, a Browse button under each photo, a blue Next button, and a Continue without personalization button.](images/suspcs/1810_SUSPC_personalization.png) +![Example image of the Set up School PCs app, Personalization screen, showing the default desktop and lock screen background photos, a Browse button under each photo, a blue Next button, and a Continue without personalization button.](images/suspcs/1810_SUSPC_personalization.png) ### Summary @@ -216,7 +216,7 @@ Review all of the settings for accuracy and completeness 1. To make changes now, select any page along the left side of the window 2. When finished, select **Accept** -![Example image of the Summary screen, showing the user's configurations for Sign-in, Wireless network, Device names, Settings, Time zone, Take a Test. Accept button is available and the page contains three links on the right-hand side to help and support.](images/suspcs/1810_SUSPC_summary.png) +![Example image of the Summary screen, showing the user's configurations for Sign-in, Wireless network, Device names, Settings, Time zone, Take a Test. Accept button is available and the page contains three links on the right-hand side to help and support.](images/suspcs/1810_SUSPC_summary.png) > [!NOTE] > To make changes to a saved package, you have to start over. @@ -230,34 +230,34 @@ Review all of the settings for accuracy and completeness 1. When the package is ready, you see the filename and package expiration date. You can also select **Add a USB** to save the same provisioning package to another USB drive. When you're done, remove the USB drive and select **Next** -![Your provisioning package is ready screen with package filename and expiration date. Shows an active blue, Next button, and a gray Add a USB button.](images/suspcs/1810_SUSPC_Package_ready.png) +![Your provisioning package is ready screen with package filename and expiration date. Shows an active blue, Next button, and a gray Add a USB button.](images/suspcs/1810_SUSPC_Package_ready.png) ## Run package - Get PCs ready Complete each step on the **Get PCs ready** page to prepare student devices for set-up. Then select **Next**. -![Your provisioning package is ready! screen with 3 steps to get student devices ready for setup. Save button is active.](images/suspcs/suspc_runpackage_getpcsready.png) +![Your provisioning package is ready! screen with 3 steps to get student devices ready for setup. Save button is active.](images/suspcs/suspc_runpackage_getpcsready.png) ## Run package - Install package on PC The provisioning package on your USB drive is named SetupSchoolPCs_<*devicename*>(Expires <*expiration date*>.ppkg. A provisioning package applies settings to Windows without reimaging the device. -When used in context of the Set up School PCs app, the word *package* refers to your provisioning package. The word *provisioning* refers to the act of installing the package on the student device. This section describes how to apply the settings to a device in your school. +When used in context of the Set up School PCs app, the word *package* refers to your provisioning package. The word *provisioning* refers to the act of installing the package on the student device. This section describes how to apply the settings to a device in your school. > [!IMPORTANT] -> The devices must have a new or reset Windows image and must not already have been through first-run setup experience (which is referred to as *OOBE*). For instructions about how to reset a devices's image, see [Prepare existing PC account for new setup](use-set-up-school-pcs-app.md#prepare-existing-pc-account-for-new-setup). +> The devices must have a new or reset Windows image and must not already have been through first-run setup experience (which is referred to as *OOBE*). For instructions about how to reset a devices's image, see [Prepare existing PC account for new setup](use-set-up-school-pcs-app.md#prepare-existing-pc-account-for-new-setup). 1. Start with the student device turned off or with the device on the first-run setup screen. If the device is past the account setup screen, reset the device to start over. To reset the it, go to **Settings** > **Update & security** > **Recovery** > **Reset this PC** ![Example screenshot of the first screen the Windows 10 PC setup for OOBE. United States is selected as the region and the Yes button is active.](images/suspcs/win10_1703_oobe_firstscreen.png) - + 1. Insert the USB drive. Windows automatically recognizes and installs the package ![Screen showing that the installation is automatically beginning, with a loading bar showing the status on the installation.](images/suspcs/suspc_studentpcsetup_installingsetupfile.png) 1. When you receive the message that it's okay to remove the USB drive, remove it from the device. If there are more devices to set up, insert the USB drive into the next one - ![Screen with message telling user to remove the USB drive.](images/suspcs/suspc_setup_removemediamessage.png) + ![Screen with message telling user to remove the USB drive.](images/suspcs/suspc_setup_removemediamessage.png) 1. If you didn't set up the package with Microsoft Entra join, continue the Windows device setup experience. If you did configure the package with Microsoft Entra join, the device is ready for use and no further configurations are required diff --git a/education/windows/windows-11-se-faq.yml b/education/windows/windows-11-se-faq.yml index 52fa4c5d69..4a9b022c07 100644 --- a/education/windows/windows-11-se-faq.yml +++ b/education/windows/windows-11-se-faq.yml @@ -3,7 +3,7 @@ metadata: title: Windows 11 SE Frequently Asked Questions (FAQ) description: Use these frequently asked questions (FAQ) to learn important details about Windows 11 SE. ms.topic: faq - ms.date: 03/09/2023 + ms.date: 01/16/2024 appliesto: - ✅ Windows 11 SE diff --git a/education/windows/windows-11-se-overview.md b/education/windows/windows-11-se-overview.md index e82eb8a227..e5fd11df2b 100644 --- a/education/windows/windows-11-se-overview.md +++ b/education/windows/windows-11-se-overview.md @@ -2,7 +2,7 @@ title: Windows 11 SE Overview description: Learn about Windows 11 SE, and the apps that are included with the operating system. ms.topic: overview -ms.date: 11/02/2023 +ms.date: 01/09/2024 appliesto: - ✅ Windows 11 SE ms.collection: @@ -88,6 +88,7 @@ The following applications can also run on Windows 11 SE, and can be deployed us | `AristotleK12 Borderless Classroom ` | 3.0.11. | `Win32` | `Sergeant Laboratories` | | `AristotleK12 Analytics ` | 10.0.6 | `Win32` | `Sergeant Laboratories` | | `AristotleK12 Network filter` | 3.1.10 | `Win32` | `Sergeant Laboratories` | +| `Bluebook` | 0.9.203 | `Win32` | `Collegeboard` | | `Brave Browser` | 106.0.5249.119 | `Win32` | `Brave` | | `Bulb Digital Portfolio` | 0.0.7.0 | `Store` | `Bulb` | | `CA Secure Browser` | 15.0.0 | `Win32` | `Cambium Development` | @@ -101,9 +102,10 @@ The following applications can also run on Windows 11 SE, and can be deployed us | `ContentKeeper Cloud` | 9.01.45 | `Win32` | `ContentKeeper Technologies` | | `DigiExam` | 14.1.0 | `Win32` | `Digiexam` | | `Digital Secure testing browser` | 15.0.0 | `Win32` | `Digiexam` | -| `Dragon Professional Individual` | 15.00.100 | `Win32` | `Nuance Communications` | -| `DRC INSIGHT Online Assessments` | 13.0.0.0 | `Store` | `Data recognition Corporation` | -| `Duo from Cisco` | 3.0.0 | `Win32` | `Cisco` | +| `Dolphin Guide Connect` | 1.27 | `Win32` | `Dolphin Guide Connect` | +| `Dragon Professional Individual` | 16.00.200.121 | `Win32` | `Nuance Communications` | +| `DRC INSIGHT Online Assessments` | 14.0.0.0 | `Store` | `Data recognition Corporation` | +| `Duo from Cisco` | 6.3.0 | `Win32` | `Cisco` | | `Dyknow` | 7.9.13.7 | `Win32` | `Dyknow` | | `e-Speaking Voice and Speech recognition` | 4.4.0.11 | `Win32` | `e-speaking` | | `EasyReader` | 10.0.4.498 | `Win32` | `Dolphin Computer Access` | @@ -112,7 +114,7 @@ The following applications can also run on Windows 11 SE, and can be deployed us | `ESET Endpoint Security` | 10.1.2046.0 | `Win32` | `ESET` | | `ESET Remote Administrator Agent` | 10.0.1126.0 | `Win32` | `ESET` | | `eTests` | 4.0.25 | `Win32` | `CASAS` | -| `Exam Writepad` | 23.2.4.2338 | `Win32` | `Sheldnet` | +| `Exam Writepad` | 24.4.1.1200 | `Win32` | `Sheldnet` | | `FirstVoices Keyboard` | 15.0.270 | `Win32` | `SIL International` | | `FortiClient` | 7.2.0.4034+ | `Win32` | `Fortinet` | | `Free NaturalReader` | 16.1.2 | `Win32` | `Natural Soft` | @@ -124,10 +126,12 @@ The following applications can also run on Windows 11 SE, and can be deployed us | `Immunet` | 7.5.8.21178 | `Win32` | `Immunet` | | `Impero Backdrop Client` | 5.0.151 | `Win32` | `Impero Software` | | `IMT Lazarus` | 2.86.0 | `Win32` | `IMTLazarus` | +| `Inprint` | 3.7.6 | `Win32` | `Inprint` | | `Inspiration 10` | 10.11 | `Win32` | `TechEdology Ltd` | -| `JAWS for Windows` | 2022.2112.24 | `Win32` | `Freedom Scientific` | +| `Instashare 2` | 1.3.13.0 | `Win32` | `BenQ` | +| `JAWS for Windows` | 2024.2312.53 | `Win32` | `Freedom Scientific` | | `Kite Student Portal` | 9.0.0.0 | `Win32` | `Dynamic Learning Maps` | -| `Keyman` | 16.0.141 | `Win32` | `SIL International` | +| `Keyman` | 16.0.142 | `Win32` | `SIL International` | | `Kortext` | 2.3.433.0 | `Store` | `Kortext` | | `Kurzweil 3000 Assistive Learning` | 20.13.0000 | `Win32` | `Kurzweil Educational Systems` | | `LanSchool Classic` | 9.1.0.46 | `Win32` | `Stoneware, Inc.` | @@ -135,10 +139,13 @@ The following applications can also run on Windows 11 SE, and can be deployed us | `Lexibar` | 3.07.02 | `Win32` | `Lexibar` | | `LGfL HomeProtect` | 8.3.44.11 | `Win32` | `LGFL` | | `Lightspeed Smart Agent` | 1.9.1 | `Win32` | `Lightspeed Systems` | -| `Lightspeed Filter Agent` | 2.3.4 | `Win32` | `Lightspeed Systems` | +| `Lightspeed Classroom` | 3.4.5.0 | `Win32` | `Lightspeed Systems` | +| `Lightspeed Filter Agent` | 2.5.2 | `Win32` | `Lightspeed Systems` | | `Lightspeed Digital` | 3.12.3.11 | `Win32` | `Lightspeed Systems` | +| `Linewize Authentication agent ` |1.4.1 | `Win32` | `Linewize` | | `MetaMoJi ClassRoom` | 3.12.4.0 | `Store` | `MetaMoJi Corporation` | | `Microsoft Connect` | 10.0.22000.1 | `Store` | `Microsoft` | +| `Mind+ Desktop` | 1.8.0 | `Win32` | `Mind+Desktop` | | `Mozilla Firefox` | 116.0.2 | `Win32` | `Mozilla` | | `Mobile Plans` | 5.1911.3171.0 | `Store` | `Microsoft Corporation` | | `Musescore` | 4.1.1.232071203 | `Win32` | `Musescore` | @@ -150,28 +157,30 @@ The following applications can also run on Windows 11 SE, and can be deployed us | `NetSupport School` | 14.00.0012 | `Win32` | `NetSupport` | | `NextUp Talker` | 1.0.49 | `Win32` | `NextUp Technologies` | | `Netsweeper Workstation Agent` | 4.50.54.54 | `Win32` | `Netsweeper` | -| `NonVisual Desktop Access` | 2023.1. | `Win32` | `NV Access` | +| `NonVisual Desktop Access` | 2023.3 | `Win32` | `NV Access` | | `NWEA Secure Testing Browser` | 5.4.387.0 | `Win32` | `NWEA` | | `PC Talker Neo` | 2209 | `Win32` | `Kochi System Development` | | `PC Talker Neo Plus` | 2209 | `Win32` | `Kochi System Development` | | `PaperCut` | 22.0.6 | `Win32` | `PaperCut Software International Pty Ltd` | | `Pearson TestNav` | 1.11.3 | `Store` | `Pearson` | | `Project Monarch Outlook` | 1.2023.831.400 | `Store` | `Microsoft` | -| `Questar Secure Browser` | 5.0.1.456 | `Win32` | `Questar, Inc` | +| `Questar Secure Browser` | 5.0.5.536 | `Win32` | `Questar, Inc` | | `ReadAndWriteForWindows` | 12.0.78 | `Win32` | `Texthelp Ltd.` | | `Remote Desktop client (MSRDC)` | 1.2.4487.0 | `Win32` | `Microsoft` | -| `Remote Help` | 4.0.1.13 | `Win32` | `Microsoft` | -| `Respondus Lockdown Browser` | 2.0.9.03 | `Win32` | `Respondus` | +| `Remote Help` | 5.0.1311.0 | `Win32` | `Microsoft` | +| `Respondus Lockdown Browser` | 2.1.1.05 | `Win32` | `Respondus` | | `Safe Exam Browser` | 3.5.0.544 | `Win32` | `Safe Exam Browser` | -|`SchoolYear` | 3.5.4 | `Win32` |`SchoolYear` | -|`School Manager` | 3.6.8.1109 | `Win32` |`School Manager` | +|`SchoolYear` | 3.7.10 | `Win32` |`SchoolYear` | +|`School Manager` | 3.6.10-1149 | `Win32` |`Linewize` | +|`Schoolnet Secure Tester` | 2.1.0 | `Win32` |`School Net` | |`Scratch` | 3.0 | `Win32` |`MIT` | -| `Senso.Cloud` | 2021.11.15.0 | `Win32` | `Senso.Cloud` | +| `Senso.Cloud` |2021.11.15.0 | `Win32` | `Senso.Cloud` | | `Skoolnext` | 2.19 | `Win32` | `Skool.net` | | `Smoothwall Monitor` | 2.9.2 | `Win32` | `Smoothwall Ltd` | -| `SuperNova Magnifier & Screen Reader` | 22.02 | `Win32` | `Dolphin Computer Access` | +| `SuperNova Magnifier & Screen Reader` | 22.04 | `Win32` | `Dolphin Computer Access` | | `SuperNova Magnifier & Speech` | 21.03 | `Win32` | `Dolphin Computer Access` | -|`TX Secure Browser` | 15.0.0 | `Win32` | `Cambium Development` | +| `Snapplify` | 6.9.7 | `Win32` | `Snapplify` | +|`TX Secure Browser` | 16.0.0 | `Win32` | `Cambium Development` | | `VitalSourceBookShelf` | 10.2.26.0 | `Win32` | `VitalSource Technologies Inc` | |`WA Secure Browser` | 16.0.0 | `Win32` | `Cambium Development` | | `Winbird` | 19 | `Win32` | `Winbird Co., Ltd.` | @@ -179,8 +188,8 @@ The following applications can also run on Windows 11 SE, and can be deployed us | `Windows SEB` | 3.4.0 | `Win32` | `Illinois Stateboard of Education` | | `Windows Notepad` | 12.0.78 | `Store` | `Microsoft Corporation` | | `Zoom` | 5.12.8 (10232) | `Win32` | `Zoom` | -| `ZoomText Fusion` | 2023.2307.7.400 | `Win32` | `Freedom Scientific` | -| `ZoomText Magnifier/Reader` | 2023.2307.29.400 | `Win32` | `Freedom Scientific` | +| `ZoomText Fusion` | 2024.2403.1.400 | `Win32` | `Freedom Scientific` | +| `ZoomText Magnifier/Reader` | 2024.2402.66.400 | `Win32` | `Freedom Scientific` | ## Add your own applications diff --git a/education/windows/windows-11-se-settings-list.md b/education/windows/windows-11-se-settings-list.md index bea07c4d0b..1c973e2035 100644 --- a/education/windows/windows-11-se-settings-list.md +++ b/education/windows/windows-11-se-settings-list.md @@ -2,7 +2,7 @@ title: Windows 11 SE settings list description: Windows 11 SE automatically configures settings in the operating system. Learn more about the settings you can control and manage, and the settings you can't change. ms.topic: reference -ms.date: 08/18/2023 +ms.date: 05/06/2024 appliesto: - ✅ Windows 11 SE ms.collection: diff --git a/education/windows/windows-editions-for-education-customers.md b/education/windows/windows-editions-for-education-customers.md deleted file mode 100644 index 7c6ecca23b..0000000000 --- a/education/windows/windows-editions-for-education-customers.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: Windows 10 editions for education customers -description: Learn about the two Windows 10 editions that are designed for the needs of education institutions. -ms.topic: overview -ms.date: 07/25/2023 -appliesto: - - ✅ Windows 10 ---- - -# Windows 10 editions for education customers - -Windows 10 offers various new features and functionalities, such as simplified provisioning with the [Set up School PCs app](./use-set-up-school-pcs-app.md) or [Windows Configuration Designer](./set-up-students-pcs-to-join-domain.md), easier delivery of digital assessments with [Take a Test](./take-tests-in-windows.md), and faster sign-in performance for shared devices than ever before. These features work with all Windows for desktop editions, excluding Windows 10 Home. You can find more information on [windows.com](https://www.windows.com/). - -Windows 10 introduces two editions designed for the unique needs of K-12 institutions: [Windows 10 Pro Education](#windows-10-pro-education) and [Windows 10 Education](#windows-10-education). These editions provide education-specific default settings for the evolving landscape in K-12 education IT environments. - -## Windows 10 Pro Education - -Windows 10 Pro Education builds on the commercial version of Windows 10 Pro and provides important management controls needed in schools. Windows 10 Pro Education is a variant of Windows 10 Pro that provides education-specific default settings. These default settings disable tips, tricks and suggestions & Microsoft Store suggestions. More detailed information on these default settings is available in [Manage Windows 10 and Microsoft Store tips, tricks, and suggestions](/windows/configuration/manage-tips-and-suggestions). - -Windows 10 Pro Education is available on new devices pre-installed with Windows 10, version 1607 or newer versions that are purchased with discounted K-12 academic licenses through OEM partners (these discounted licenses are sometimes referred to as National Academic or Shape the Future). - -Existing devices running Windows 10 Pro, currently activated with the original OEM digital product key and purchased with discounted K-12 academic licenses through OEM partners (these discounted licenses are sometimes referred to as National Academic or Shape the Future), will upgrade automatically to Windows 10 Pro Education as part of the Windows 10, version 1607 installation. - -Customers with Academic Volume Licensing agreements with rights for Windows can get Windows 10 Pro Education through the [Volume Licensing Service Center](https://www.microsoft.com/Licensing/servicecenter/default.aspx). - -Customers who deploy Windows 10 Pro are able to configure the product to have similar feature settings to Windows 10 Pro Education using policies. More detailed information on these policies and the configuration steps required is available in [Manage Windows 10 and Microsoft Store tips, tricks, and suggestions](/windows/configuration/manage-tips-and-suggestions). We recommend that K-12 customers using commercial Windows 10 Pro read the [document](/windows/configuration/manage-tips-and-suggestions) and apply desired settings for your environment. - -## Windows 10 Education - -Windows 10 Education builds on Windows 10 Enterprise and provides the enterprise-grade manageability and security desired by many schools. Windows 10 Education is effectively a variant of Windows 10 Enterprise that provides education-specific default settings. These default settings disable tips, tricks and suggestions & Microsoft Store suggestions. More detailed information on these default settings is available in [Manage Windows 10 and Microsoft Store tips, tricks, and suggestions](/windows/configuration/manage-tips-and-suggestions). - -Windows 10 Education is available through Microsoft Volume Licensing. Customers who are already running Windows 10 Education can upgrade to Windows 10, version 1607 or newer versions through Windows Update or from the [Volume Licensing Service Center](https://www.microsoft.com/Licensing/servicecenter/default.aspx). We recommend Windows 10 Education to all K-12 customers as it provides the most complete and secure edition for education environments. If you don't have access to Windows 10 Education, contact your Microsoft representative or see more information [here](https://go.microsoft.com/fwlink/?LinkId=822628). - -Customers who deploy Windows 10 Enterprise are able to configure the product to have similar feature settings to Windows 10 Education using policies. More detailed information on these policies and the configuration steps required is available in [Manage Windows 10 and Microsoft Store tips, tricks, and suggestions](/windows/configuration/manage-tips-and-suggestions). We recommend that K-12 customers using commercial Windows 10 Enterprise read the [document](/windows/configuration/manage-tips-and-suggestions) and apply desired settings for your environment. - -For any other questions, contact [Microsoft Customer Service and Support](https://support.microsoft.com/en-us). - -## Related topics - -- [Switch to Windows 10 Pro Education from Windows 10 Pro or Windows 10 S](change-to-pro-education.md) -- [Windows deployment for education](./index.yml) -- [Windows 10 upgrade paths](/windows/deployment/upgrade/windows-10-upgrade-paths) -- [Volume Activation for Windows 10](/windows/deployment/volume-activation/volume-activation-windows-10) -- [Plan for volume activation](/windows/deployment/volume-activation/plan-for-volume-activation-client) -- [Windows 10 subscription activation](/windows/deployment/windows-10-subscription-activation) -- \ No newline at end of file diff --git a/images/group-policy.svg b/images/group-policy.svg deleted file mode 100644 index ace95add6b..0000000000 --- a/images/group-policy.svg +++ /dev/null @@ -1,3 +0,0 @@ - - - \ No newline at end of file diff --git a/images/windows-os.svg b/images/windows-os.svg deleted file mode 100644 index da64baf975..0000000000 --- a/images/windows-os.svg +++ /dev/null @@ -1,3 +0,0 @@ - - - \ No newline at end of file diff --git a/includes/ai-disclaimer-generic.md b/includes/ai-disclaimer-generic.md deleted file mode 100644 index 0e190e0e38..0000000000 --- a/includes/ai-disclaimer-generic.md +++ /dev/null @@ -1,10 +0,0 @@ ---- -author: aczechowski -ms.author: aaroncz -ms.date: 03/31/2023 -ms.topic: include -ms.prod: windows-client ---- - -> [!NOTE] -> This article was partially created with the help of artificial intelligence. Before publishing, an author reviewed and revised the content as needed. For more information, see [Our principles for using AI-generated content in Microsoft Learn](/azure/principles-for-ai-generated-content). diff --git a/includes/configure/gpo-settings-1.md b/includes/configure/gpo-settings-1.md index 4a7b56a8be..296a1025d2 100644 --- a/includes/configure/gpo-settings-1.md +++ b/includes/configure/gpo-settings-1.md @@ -3,7 +3,7 @@ author: paolomatarazzo ms.author: paoloma ms.date: 08/15/2023 ms.topic: include -ms.prod: windows-client +ms.service: windows-client --- To configure a device with group policy, use the [Local Group Policy Editor](/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc731745(v=ws.10)). To configure multiple devices joined to Active Directory, [create or edit](/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc754740(v=ws.11)) a group policy object (GPO) and use the following settings: diff --git a/includes/configure/gpo-settings-2.md b/includes/configure/gpo-settings-2.md index 88fd46ec27..fa200244ae 100644 --- a/includes/configure/gpo-settings-2.md +++ b/includes/configure/gpo-settings-2.md @@ -3,7 +3,7 @@ author: paolomatarazzo ms.author: paoloma ms.date: 08/15/2023 ms.topic: include -ms.prod: windows-client +ms.service: windows-client --- Group policies can be [linked](/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc732979(v=ws.10)) to domains or organizational units, [filtered using security groups](/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc752992(v=ws.10)), or [filtered using WMI filters](/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717288(v=ws.11)). diff --git a/includes/configure/intune-custom-settings-1.md b/includes/configure/intune-custom-settings-1.md index 60125a46d1..d804757446 100644 --- a/includes/configure/intune-custom-settings-1.md +++ b/includes/configure/intune-custom-settings-1.md @@ -3,14 +3,7 @@ author: paolomatarazzo ms.author: paoloma ms.date: 08/15/2023 ms.topic: include -ms.prod: windows-client +ms.service: windows-client --- -To configure devices with Microsoft Intune, use a custom policy: - -1. Go to the Microsoft Intune admin center -2. Select **Devices > Configuration profiles > Create profile** -3. Select **Platform > Windows 10 and later** and **Profile type > Templates > Custom** -4. Select **Create** -5. Specify a **Name** and, optionally, a **Description > Next** -6. Add the following settings: \ No newline at end of file +To configure devices with Microsoft Intune, [create a custom policy](/mem/intune/configuration/custom-settings-windows-10) and use the following settings: \ No newline at end of file diff --git a/includes/configure/intune-custom-settings-2.md b/includes/configure/intune-custom-settings-2.md index 03977b7a0d..66b5ceae1d 100644 --- a/includes/configure/intune-custom-settings-2.md +++ b/includes/configure/intune-custom-settings-2.md @@ -3,10 +3,7 @@ author: paolomatarazzo ms.author: paoloma ms.date: 08/15/2023 ms.topic: include -ms.prod: windows-client +ms.service: windows-client --- -7. Select **Next** -8. Assign the policy to a security group that contains as members the devices or users that you want to configure > **Next** -9. Under **Applicability Rules**, select **Next** -10. Review the policy configuration and select **Create** \ No newline at end of file +Assign the policy to a group that contains as members the devices or users that you want to configure. \ No newline at end of file diff --git a/includes/configure/intune-custom-settings-info.md b/includes/configure/intune-custom-settings-info.md deleted file mode 100644 index 8f406cf058..0000000000 --- a/includes/configure/intune-custom-settings-info.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -author: paolomatarazzo -ms.author: paoloma -ms.date: 08/15/2023 -ms.topic: include -ms.prod: windows-client ---- - -For more information about how to create custom settings using Intune, see [Use custom settings for Windows devices in Intune](/mem/intune/configuration/custom-settings-windows-10). \ No newline at end of file diff --git a/includes/configure/intune-settings-catalog-1.md b/includes/configure/intune-settings-catalog-1.md index b27582fd32..6afcc21dab 100644 --- a/includes/configure/intune-settings-catalog-1.md +++ b/includes/configure/intune-settings-catalog-1.md @@ -3,7 +3,7 @@ author: paolomatarazzo ms.author: paoloma ms.date: 08/15/2023 ms.topic: include -ms.prod: windows-client +ms.service: windows-client --- To configure devices with Microsoft Intune, [create a Settings catalog policy](/mem/intune/configuration/settings-catalog) and use the following settings: \ No newline at end of file diff --git a/includes/configure/intune-settings-catalog-2.md b/includes/configure/intune-settings-catalog-2.md index 287d5ebbf1..66b5ceae1d 100644 --- a/includes/configure/intune-settings-catalog-2.md +++ b/includes/configure/intune-settings-catalog-2.md @@ -3,7 +3,7 @@ author: paolomatarazzo ms.author: paoloma ms.date: 08/15/2023 ms.topic: include -ms.prod: windows-client +ms.service: windows-client --- Assign the policy to a group that contains as members the devices or users that you want to configure. \ No newline at end of file diff --git a/includes/configure/powershell-wmi-bridge-1.md b/includes/configure/powershell-wmi-bridge-1.md new file mode 100644 index 0000000000..84c8a0bb24 --- /dev/null +++ b/includes/configure/powershell-wmi-bridge-1.md @@ -0,0 +1,18 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 09/12/2023 +ms.topic: include +ms.prod: windows-client +--- + +Configure your devices using PowerShell scripts via the [MDM Bridge WMI Provider](/windows/win32/dmwmibridgeprov/mdm-bridge-wmi-provider-portal). + +> [!IMPORTANT] +> For all device settings, the WMI Bridge client must be executed as SYSTEM (LocalSystem) account. + +To test the PowerShell script, you can: + +1. [Download the psexec tool](/sysinternals/downloads/psexec) +1. Open an elevated command prompt and run: `psexec.exe -i -s powershell.exe` +1. Run the script in the PowerShell session diff --git a/includes/configure/powershell-wmi-bridge-2.md b/includes/configure/powershell-wmi-bridge-2.md new file mode 100644 index 0000000000..55db82674d --- /dev/null +++ b/includes/configure/powershell-wmi-bridge-2.md @@ -0,0 +1,9 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 09/12/2023 +ms.topic: include +ms.prod: windows-client +--- + +For more information, see [Use PowerShell scripting with the WMI Bridge Provider](/windows/client-management/mdm/using-powershell-scripting-with-the-wmi-bridge-provider). diff --git a/includes/configure/provisioning-package-1.md b/includes/configure/provisioning-package-1.md index 951ca428e3..62543ac656 100644 --- a/includes/configure/provisioning-package-1.md +++ b/includes/configure/provisioning-package-1.md @@ -3,7 +3,7 @@ author: paolomatarazzo ms.author: paoloma ms.date: 09/12/2023 ms.topic: include -ms.prod: windows-client +ms.service: windows-client --- Use the following settings to [create a provisioning package](/windows/configuration/provisioning-packages/provisioning-create-package): diff --git a/includes/configure/provisioning-package-2.md b/includes/configure/provisioning-package-2.md index b600e58e47..8915e7aebd 100644 --- a/includes/configure/provisioning-package-2.md +++ b/includes/configure/provisioning-package-2.md @@ -3,7 +3,7 @@ author: paolomatarazzo ms.author: paoloma ms.date: 09/12/2023 ms.topic: include -ms.prod: windows-client +ms.service: windows-client --- [Apply the provisioning package](/windows/configuration/provisioning-packages/provisioning-apply-package) to the devices that you want to configure. diff --git a/includes/configure/registry.md b/includes/configure/registry.md index 2c620f057a..6c76a6b9b1 100644 --- a/includes/configure/registry.md +++ b/includes/configure/registry.md @@ -3,7 +3,7 @@ author: paolomatarazzo ms.author: paoloma ms.date: 08/15/2023 ms.topic: include -ms.prod: windows-client +ms.service: windows-client --- To configure devices with the [Registry Editor](/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc755256(v=ws.11)), use the following settings: \ No newline at end of file diff --git a/includes/configure/tab-intro.md b/includes/configure/tab-intro.md index a818e4df8b..c9c293a8c5 100644 --- a/includes/configure/tab-intro.md +++ b/includes/configure/tab-intro.md @@ -3,7 +3,7 @@ author: paolomatarazzo ms.author: paoloma ms.date: 08/15/2023 ms.topic: include -ms.prod: windows-client +ms.service: windows-client --- The following instructions provide details how to configure your devices. Select the option that best suits your needs. \ No newline at end of file diff --git a/includes/insider/insider-note.md b/includes/insider/insider-note.md new file mode 100644 index 0000000000..f0018a1d2b --- /dev/null +++ b/includes/insider/insider-note.md @@ -0,0 +1,16 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.topic: include +ms.date: 01/11/2024 +--- + +:::row::: +:::column span="1"::: +:::image type="content" source="insider.png" alt-text="Logo of Windows Insider." border="false"::: +:::column-end::: +:::column span="3"::: +> [!IMPORTANT] +>This article describes features or settings that are under development and only applicable to [Windows Insider Preview builds](/windows-insider/). The content is subject to change and may have dependencies on other features or services in preview. +:::column-end::: +:::row-end::: diff --git a/includes/insider/insider.png b/includes/insider/insider.png new file mode 100644 index 0000000000..dbe00408cb Binary files /dev/null and b/includes/insider/insider.png differ diff --git a/includes/licensing/assigned-access-kiosk-mode.md b/includes/licensing/assigned-access.md similarity index 55% rename from includes/licensing/assigned-access-kiosk-mode.md rename to includes/licensing/assigned-access.md index f14704f482..3a980896b0 100644 --- a/includes/licensing/assigned-access-kiosk-mode.md +++ b/includes/licensing/assigned-access.md @@ -5,18 +5,28 @@ ms.date: 09/18/2023 ms.topic: include --- -## Windows edition and licensing requirements + -The following table lists the Windows editions that support Assigned Access (kiosk mode): +## Windows edition requirements -|Windows Pro|Windows Enterprise|Windows Pro Education/SE|Windows Education| -|:---:|:---:|:---:|:---:| -|Yes|Yes|Yes|Yes| +The following table lists the Windows editions that support Assigned Access: -Assigned Access (kiosk mode) license entitlements are granted by the following licenses: +|Edition|Assigned Access support| +|:---|:---:| +|Education|✅| +|Enterprise |✅| +|Enterprise LTSC|✅| +|IoT Enterprise | ✅| +|IoT Enterprise LTSC|✅| +|Pro Education|✅| +|Pro|✅| + + \ No newline at end of file diff --git a/includes/licensing/shell-launcher.md b/includes/licensing/shell-launcher.md new file mode 100644 index 0000000000..b44ad3f92b --- /dev/null +++ b/includes/licensing/shell-launcher.md @@ -0,0 +1,33 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 09/18/2023 +ms.topic: include +--- + + + +## Windows edition requirements + +The following table lists the Windows editions that support Shell Launcher: + +|Edition|Shell Launcher support| +|:---|:---:| +|Education|✅| +|Enterprise |✅| +|Enterprise LTSC|✅| +|IoT Enterprise | ✅| +|IoT Enterprise LTSC|✅| +|Pro Education|❌| +|Pro|❌| + + \ No newline at end of file diff --git a/includes/licensing/account-lockout-policy.md b/includes/licensing/system-guard.md similarity index 76% rename from includes/licensing/account-lockout-policy.md rename to includes/licensing/system-guard.md index 3ca26ae6ea..0c165234b4 100644 --- a/includes/licensing/account-lockout-policy.md +++ b/includes/licensing/system-guard.md @@ -7,13 +7,13 @@ ms.topic: include ## Windows edition and licensing requirements -The following table lists the Windows editions that support Account Lockout Policy: +The following table lists the Windows editions that support System Guard: |Windows Pro|Windows Enterprise|Windows Pro Education/SE|Windows Education| |:---:|:---:|:---:|:---:| |Yes|Yes|Yes|Yes| -Account Lockout Policy license entitlements are granted by the following licenses: +System Guard license entitlements are granted by the following licenses: |Windows Pro/Pro Education/SE|Windows Enterprise E3|Windows Enterprise E5|Windows Education A3|Windows Education A5| |:---:|:---:|:---:|:---:|:---:| diff --git a/includes/licensing/windows-defender-system-guard.md b/includes/licensing/windows-defender-system-guard.md deleted file mode 100644 index cecce5edd5..0000000000 --- a/includes/licensing/windows-defender-system-guard.md +++ /dev/null @@ -1,22 +0,0 @@ ---- -author: paolomatarazzo -ms.author: paoloma -ms.date: 09/18/2023 -ms.topic: include ---- - -## Windows edition and licensing requirements - -The following table lists the Windows editions that support Windows Defender System Guard: - -|Windows Pro|Windows Enterprise|Windows Pro Education/SE|Windows Education| -|:---:|:---:|:---:|:---:| -|Yes|Yes|Yes|Yes| - -Windows Defender System Guard license entitlements are granted by the following licenses: - -|Windows Pro/Pro Education/SE|Windows Enterprise E3|Windows Enterprise E5|Windows Education A3|Windows Education A5| -|:---:|:---:|:---:|:---:|:---:| -|Yes|Yes|Yes|Yes|Yes| - -For more information about Windows licensing, see [Windows licensing overview](/windows/whats-new/windows-licensing). diff --git a/includes/licensing/windows-security-policy-settings-and-auditing.md b/includes/licensing/windows-security-policy-settings-and-auditing.md deleted file mode 100644 index 07f612b6ae..0000000000 --- a/includes/licensing/windows-security-policy-settings-and-auditing.md +++ /dev/null @@ -1,22 +0,0 @@ ---- -author: paolomatarazzo -ms.author: paoloma -ms.date: 09/18/2023 -ms.topic: include ---- - -## Windows edition and licensing requirements - -The following table lists the Windows editions that support Windows security policy settings and auditing: - -|Windows Pro|Windows Enterprise|Windows Pro Education/SE|Windows Education| -|:---:|:---:|:---:|:---:| -|Yes|Yes|Yes|Yes| - -Windows security policy settings and auditing license entitlements are granted by the following licenses: - -|Windows Pro/Pro Education/SE|Windows Enterprise E3|Windows Enterprise E5|Windows Education A3|Windows Education A5| -|:---:|:---:|:---:|:---:|:---:| -|Yes|Yes|Yes|Yes|Yes| - -For more information about Windows licensing, see [Windows licensing overview](/windows/whats-new/windows-licensing). diff --git a/store-for-business/docfx.json b/store-for-business/docfx.json index 8fd22d16a4..4d87a128eb 100644 --- a/store-for-business/docfx.json +++ b/store-for-business/docfx.json @@ -54,27 +54,23 @@ "folder_relative_path_in_docset": "./" } }, - "contributors_to_exclude": [ - "rjagiewich", - "traya1", - "rmca14", + "contributors_to_exclude": [ + "dstrome2", + "rjagiewich", + "American-Dipper", "claydetels19", - "Kellylorenebaker", "jborsecnik", - "tiburd", - "AngelaMotherofDragons", - "dstrome", - "v-dihans", - "garycentric", - "v-stsavell", - "beccarobins", + "v-stchambers", + "shdyas", "Stacyrch140", - "American-Dipper" + "garycentric", + "dstrome", + "alekyaj" ] }, "fileMetadata": {}, "template": [], "dest": "store-for-business", "markdownEngineName": "markdig" - } + } } diff --git a/store-for-business/images/msfb-add-collection.PNG b/store-for-business/images/msfb-add-collection.png similarity index 100% rename from store-for-business/images/msfb-add-collection.PNG rename to store-for-business/images/msfb-add-collection.png diff --git a/store-for-business/images/wsfb-private-store-gpo.PNG b/store-for-business/images/wsfb-private-store-gpo.png similarity index 100% rename from store-for-business/images/wsfb-private-store-gpo.PNG rename to store-for-business/images/wsfb-private-store-gpo.png diff --git a/store-for-business/includes/store-for-business-content-updates.md b/store-for-business/includes/store-for-business-content-updates.md deleted file mode 100644 index 000c3669c0..0000000000 --- a/store-for-business/includes/store-for-business-content-updates.md +++ /dev/null @@ -1,21 +0,0 @@ - - - - -## Week of July 10, 2023 - - -| Published On |Topic title | Change | -|------|------------|--------| -| 7/14/2023 | [Microsoft Store for Business and Education release history](/microsoft-store/release-history-microsoft-store-business-education) | modified | -| 7/14/2023 | [Whats new in Microsoft Store for Business and Education](/microsoft-store/whats-new-microsoft-store-business-education) | modified | -| 7/14/2023 | [Prerequisites for Microsoft Store for Business and Education (Windows 10)](/microsoft-store/prerequisites-microsoft-store-for-business) | modified | - - -## Week of June 26, 2023 - - -| Published On |Topic title | Change | -|------|------------|--------| -| 6/29/2023 | [Microsoft Store for Business and Education release history](/microsoft-store/release-history-microsoft-store-business-education) | modified | -| 6/29/2023 | [Whats new in Microsoft Store for Business and Education](/microsoft-store/whats-new-microsoft-store-business-education) | modified | diff --git a/store-for-business/prerequisites-microsoft-store-for-business.md b/store-for-business/prerequisites-microsoft-store-for-business.md index 1d519c7d26..ac4b271b5d 100644 --- a/store-for-business/prerequisites-microsoft-store-for-business.md +++ b/store-for-business/prerequisites-microsoft-store-for-business.md @@ -65,11 +65,10 @@ If your organization restricts computers on your network from connecting to the - `account.live.com` - `clientconfig.passport.net` - `windowsphone.com` -- `\*.wns.windows.com` -- `\*.microsoft.com` -- `\*.s-microsoft.com` +- `*.wns.windows.com` +- `*.microsoft.com` +- `*.s-microsoft.com` - `www.msftncsi.com` (prior to Windows 10, version 1607) -- `www.msftconnecttest.com/connecttest.txt` (replaces `www.msftncsi.com` - starting with Windows 10, version 1607) +- `www.msftconnecttest.com/connecttest.txt` (replaces `www.msftncsi.com` starting with Windows 10, version 1607) Store for Business requires Microsoft Windows HTTP Services (WinHTTP) to install, or update apps. diff --git a/store-for-business/release-history-microsoft-store-business-education.md b/store-for-business/release-history-microsoft-store-business-education.md index 15adb1f6c8..368df86b94 100644 --- a/store-for-business/release-history-microsoft-store-business-education.md +++ b/store-for-business/release-history-microsoft-store-business-education.md @@ -8,7 +8,7 @@ ms.author: cmcatee author: cmcatee-MSFT manager: scotv ms.topic: conceptual -ms.date: 06/29/2023 +ms.date: 01/11/2024 ms.reviewer: --- @@ -22,9 +22,17 @@ Because Microsoft Store for Business and Education will be retired, we no longer Looking for info on the latest release? Check out [What's new in Microsoft Store for Business and Education](whats-new-microsoft-store-business-education.md) +## January 2024 + +**Removal of private store capability from Microsoft Store for Business and Education** + +The private store tab and associated functionality was removed from the Microsoft Store for Business and Education portal. This includes the ability to add apps to private groups and to download and install apps from the private store. + +We recommend customers use the [Private app repository, Windows Package Manager, and Company Portal app](/windows/application-management/private-app-repository-mdm-company-portal-windows-11) to provide a private app repository within their organization. + ## May 2023 -### Removal of Microsoft Store for Business tab from Microsoft Store app on Windows 10 PCs +**Removal of Microsoft Store for Business tab from Microsoft Store app on Windows 10 PCs** The Microsoft Store for Business tab was removed from the Microsoft Store app on Windows 10. The Microsoft Store for Business tab is still available on HoloLens devices. @@ -45,33 +53,41 @@ We recommend that you add your apps through the new Microsoft Store app experien Follow the [Intune Customer Success blog](https://aka.ms/IntuneCustomerSuccess) where we will publish more information about this change. ## April 2023 + - **Tab removed from Microsoft Store apps on Windows 11 PCs** – The Microsoft Store for Business tab was removed from Microsoft Store apps on Windows 11 PCs. An interaction with existing MDM and GPO policies may lead to customers seeing errors when accessing the Microsoft Store app. [Get more info](manage-access-to-private-store.md#microsoft-store-for-business-tab-removed) ## October 2018 + - **Use security groups with Private store apps** - On the details page for apps in your private store, you can set Private store availability. This allows you to choose which security groups can see an app in the private store. [Get more info](app-inventory-management-microsoft-store-for-business.md) ## September 2018 + - **Performance improvements** - With updates and improvements in the private store, most changes, like adding an app, will take fifteen minutes or less. [Get more info](/microsoft-store/manage-private-store-settings#private-store-performance) ## August 2018 - **App requests** - People in your organization can make requests for apps that they need. hey can also request them on behalf of other people. Admins review requests and can decide on purchases. [Get more info](./acquire-apps-microsoft-store-for-business.md#allow-app-requests) ## July 2018 + - Bug fixes and performance improvements. ## June 2018 -- **Change order within private store collection** - Continuing our focus on improvements for private store, now you can customize the order of products in each private store collection. + +- **Change order within private store collection** - Continuing our focus on improvements for private store, now you can customize the order of products in each private store collection. - **Performance improvements in private store** - We continue to work on performance improvements in the private store. Now, most products new to your inventory are available in your private store within 15 minutes of adding them. [Get more info](./manage-private-store-settings.md#private-store-performance) ## May 2018 + - **Immersive Reader app available in Microsoft Store for Education** - This app is a free tool that uses proven techniques to improve reading and writing for people regardless of their age or ability. You can add the app to your private store, so students can easily install and use it. ## April 2018 + - **Assign apps to larger groups** - We're making it easier for admins to assign apps to groups of people. Admins can assign licenses to groups of any size, and include subgroups within those groups. We'll figure out who's in those groups, and assign licenses to people in the groups (skipping people who already have licenses). Along the way, we'll let you know how many licenses are needed, and provide an estimate on the time required to assign licenses. - **Change collection order in private store** - Private store collections make it easy for groups of people to find the apps that they need. Now, you can customize the order of your private store collections. - **Office 365 subscription management** - We know that sometimes customers need to cancel a subscription. While we don't want to lose a customer, we want the process for managing subscriptions to be easy. Now, you can delete your Office 365 subscription without calling Support. From Microsoft Store for Business and Education, you can request to delete an Office 365 subscription. We'll wait three days before permanently deleting the subscription. In case of a mistake, customers are welcome to reactivate subscriptions during the three-day period. ## March 2018 + - **Performance improvements in private store** - We've made it significantly faster for you to update the private store. Many changes to the private store are available immediately after you make them. [Get more info](./manage-private-store-settings.md#private-store-performance) - **Private store collection updates** - We've made it easier to find apps when creating private store collections – now you can search and filter results. [Get more info](./manage-private-store-settings.md#private-store-collections) @@ -79,19 +95,23 @@ Follow the [Intune Customer Success blog](https://aka.ms/IntuneCustomerSuccess) - **Upgrade Microsoft 365 trial subscription** - Customers with Office 365 can upgrade their subscription and automatically re-assign their user licenses over to a new target subscription. For example, you could upgrade your Office 365 for business subscription to a Microsoft 365 for business subscription. ## January and February 2018 + - **One place for apps, software, and subscriptions** - The new **Products & services** page in Microsoft Store for Business and Education gives customers a single place to manage all products and services. - **Create collections of apps in your private store** - Use **collections** to customize your private store. Collections allow you to create groups of apps that are commonly used in your organization or school -- you might create a collection for a Finance department, or a 6th-grade class. [Get more info](./manage-private-store-settings.md#private-store-collections) - **Upgrade Office 365 trial subscription** - Customers with Office 365 trials can now transition their trial to a paid subscription in Microsoft Store for Business. This works for trials you acquired from Microsoft Store for Business, or Office Admin Portal. - **Supporting Microsoft Product and Services Agreement customers** - If you are purchasing under the Microsoft Products and Services Agreement (MPSA), you can use Microsoft Store for Business. Here you will find access to Products & Services purchased, Downloads & Keys, Software Assurance benefits, Order history, and Agreement details. -- **Microsoft Product and Services Agreement customers can invite people to take roles** - MPSA admins can invite people to take Microsoft Store for Business roles even if the person is not in their tenant. You provide an email address when you assign the role, and we'll add the account to your tenant and assign the role. +- **Microsoft Product and Services Agreement customers can invite people to take roles** - MPSA admins can invite people to take Microsoft Store for Business roles even if the person is not in their tenant. You provide an email address when you assign the role, and we'll add the account to your tenant and assign the role. ## December 2017 + - Bug fixes and performance improvements. ## November 2017 + - **Export list of Minecraft: Education Edition users** - Admins and teachers can now export a list of users who have Minecraft: Education Edition licenses assigned to them. Click **Export users**, and Store for Education creates an Excel spreadsheet for you, and saves it as a .csv file. ## October 2017 + - Bug fixes and performance improvements. ## September 2017 @@ -102,4 +122,4 @@ Follow the [Intune Customer Success blog](https://aka.ms/IntuneCustomerSuccess) - **Manage prepaid Office 365 subscriptions** - Office 365 prepaid subscriptions can be redeemed using a prepaid token. Tokens are available through 3rd-party businesses, outside of Microsoft Store for Business or the Office 365 Admin portal. After redeeming prepaid subscriptions, Admins can add more licenses or extend the subscription's expiration date. - **Manage Office 365 subscriptions acquired by partners** - Office 365 subscriptions purchased for your organization by a partner or reseller can be managed in Microsoft Store for Business. Admins can assign and manage licenses for these subscriptions. - **Edge extensions in Microsoft Store** - Edge Extensions are now available from Microsoft Store! You can acquire and distribute them from Microsoft Store for Business just like any other app. -- **Search results in Microsoft Store for Business** - Search results now have sub categories to help you refine search results. \ No newline at end of file +- **Search results in Microsoft Store for Business** - Search results now have sub categories to help you refine search results. diff --git a/store-for-business/whats-new-microsoft-store-business-education.md b/store-for-business/whats-new-microsoft-store-business-education.md index 8ab993b759..4af32aae83 100644 --- a/store-for-business/whats-new-microsoft-store-business-education.md +++ b/store-for-business/whats-new-microsoft-store-business-education.md @@ -8,52 +8,31 @@ ms.author: cmcatee author: cmcatee-MSFT manager: scotv ms.topic: conceptual -ms.date: 06/29/2023 +ms.date: 06/21/2024 ms.reviewer: --- # What's new in Microsoft Store for Business and Education -> [!IMPORTANT] -> -> - The retirement of Microsoft Store for Business and Microsoft Store for Education has been postponed. We will update this notice when a new retirement date is announced. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). - ## Latest updates for Store for Business and Education -**May 2023** +**June 2024** -**Removal of Microsoft Store for Business tab from Microsoft Store app on Windows 10 PCs** - -The Microsoft Store for Business tab was removed from the Microsoft Store app on Windows 10. The Microsoft Store for Business tab is still available on HoloLens devices. - -Users on Windows 10 PCs can no longer do the following tasks: - -- see Line of Business (LOB) products listed in the Microsoft Store for Business tab -- acquire or install [online apps](/mem/configmgr/apps/deploy-use/manage-apps-from-the-windows-store-for-business#online-and-offline-apps) -- assign licenses for existing [online apps](/mem/configmgr/apps/deploy-use/manage-apps-from-the-windows-store-for-business#online-and-offline-apps) using the Store for Business portal or Store for Business app - -[Offline app](/mem/configmgr/apps/deploy-use/manage-apps-from-the-windows-store-for-business#online-and-offline-apps) distribution and licensing scenarios aren't impacted by this change. - -We recommend that you add your apps through the new Microsoft Store app experience in Intune. If an app isn’t available in the Microsoft Store, you must retrieve an app package from the vendor and install it as an LOB app or Win32 app. For instructions, read the following articles: - -- [Add Microsoft Store apps to Microsoft Intune](/mem/intune/apps/store-apps-microsoft) -- [Add a Windows line-of-business app to Microsoft Intune](/mem/intune/apps/lob-apps-windows) -- [Add, assign, and monitor a Win32 app in Microsoft Intune](/mem/intune/apps/apps-win32-add) - -Follow the [Intune Customer Success blog](https://aka.ms/IntuneCustomerSuccess) where we will publish more information about this change. - - +The Microsoft Store for Business and Microsoft Store for Education portals will retire on August 15, 2024. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-intune-integration-with-the-microsoft-store-on-windows/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). If you are using offline licensing, you can use the [WinGet Download command](/windows/package-manager/winget/download) to continue to access offline apps and license files. ## Previous releases and updates +**January 2024** + +**Removal of private store capability from Microsoft Store for Business and Education** + +The private store tab and associated functionality was removed from the Microsoft Store for Business and Education portal. This includes the ability to add apps to private groups and to download and install apps from the private store. + +We recommend customers use the [Private app repository, Windows Package Manager, and Company Portal app](/windows/application-management/private-app-repository-mdm-company-portal-windows-11) to provide a private app repository within their organization. + +[May 2023](release-history-microsoft-store-business-education.md#may-2023) +- Tab removed from Microsoft Store apps on Windows 10 PCs. + [April 2023](release-history-microsoft-store-business-education.md#april-2023) - Tab removed from Microsoft Store apps on Windows 11 PCs. diff --git a/template.md b/template.md index c9529e25a3..c114acd13f 100644 --- a/template.md +++ b/template.md @@ -2,8 +2,8 @@ title: # ARTICLE TITLE in 55 chars or less, most important for SEO. Best to match H1 and TOC, but doesn't have to. description: # A summary of the content. 75-300 characters. Used in site search. Sometimes used on a search engine results page for improved SEO. Always end with period. ms.date: mm/dd/yyyy -ms.prod: windows-client -ms.technology: itpro-fundamentals # itpro-deploy itpro-updates itpro-apps itpro-manage itpro-configure itpro-security itpro-privacy itpro-edu +ms.service: windows-client +ms.subservice: itpro-fundamentals # itpro-deploy itpro-updates itpro-apps itpro-manage itpro-configure itpro-security itpro-privacy itpro-edu ms.topic: conceptual #reference troubleshooting how-to end-user-help overview (more in contrib guide) ms.localizationpriority: medium #high null author: # GitHub username (aczechowski) @@ -13,6 +13,7 @@ manager: # MS alias of manager (dougeby/aaroncz) ms.collection: # optional - # highpri - high priority, strategic, important, current, etc. articles (confirm with manager prior to use) - # education - part of M365 for Education vertical +- # tier1 tier2 tier3 --- # Metadata and Markdown Template diff --git a/windows/application-management/add-apps-and-features.md b/windows/application-management/add-apps-and-features.md deleted file mode 100644 index db4571a9c6..0000000000 --- a/windows/application-management/add-apps-and-features.md +++ /dev/null @@ -1,98 +0,0 @@ ---- -title: Add or hide Windows features -description: Learn how to add Windows optional features using the Apps & features page in the Settings app. Also see the group policy objects (GPO) and MDM policies that show or hide Apps and Windows Features in the Settings app. Use Windows PowerShell to show or hide specific features in Windows Features. -author: aczechowski -ms.author: aaroncz -manager: aaroncz -ms.date: 08/18/2023 -ms.topic: how-to -ms.prod: windows-client -ms.technology: itpro-apps -ms.localizationpriority: medium -ms.collection: tier2 -appliesto: - - ✅ Windows 11 - - ✅ Windows 10 ---- - -# Add or hide Windows features - -Windows includes optional features that aren't installed by default, but you can add later. These features are called [Features on Demand](/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities), and can be installed at any time. Some of these features are language resources like language packs or handwriting support. On organization-owned devices, you can control access to these other features. You can use group policy or mobile device management (MDM) policies to hide the UI from users, or use Windows PowerShell to enable or disable specific features. - -## Use the Windows Settings app to add or uninstall features - -### Windows 11 - -1. Open the Start menu and search for **Settings**. - -1. In the Settings app, search for "optional" and select **Optional features**. - - > [!TIP] - > You can also use the following shortcut to open it directly: [`ms-settings:optionalfeatures`](ms-settings:optionalfeatures). - -1. To add a feature: - - 1. Select **View features** next to "Add an optional feature." - - 1. Find the feature you want to add, like **XPS Viewer**. Select the box to add it. You can select multiple features. - - 1. Select **Next**. Review the list of features you selected, and then select **Install** to add the selected features. - -1. To uninstall a feature: - - 1. Search for it in the list of **Installed features**. - - 1. Expand the section, and select **Uninstall**. - -### Windows 10 - -1. In the Search bar, search for "apps" and select **Apps and features**. - -1. Select **Optional features** > **Add a feature**. - -1. Select the feature you want to add, like **XPS Viewer**, and then select **Install.** - -When the installation completes, the feature is listed in **Apps & features**. In **Apps & features** > **Optional features** > **More Windows features**, there are more features that you and your users can install. - -To uninstall a feature, open the **Settings** app. Select the feature, and then select **Uninstall**. - -## Use group policy or MDM policies to hide Windows features - -By default, the OS might show Windows features and allow users to install and uninstall these optional apps and features. To hide Windows features on your user devices, you can use group policy or an MDM provider like Microsoft Intune. - -### Group policy - -If you use group policy, use the `User Configuration\Administrative Template\Control Panel\Programs\Hide "Windows Features"` policy. By default, this policy may be set to **Not configured**, which means users can add or remove features. When this setting is **Enabled**, the settings page to add optional features is hidden on the device. - -You can't use group policy to disable specific Windows features, such as XPS Viewer. If you want to disable specific features, use [Windows PowerShell](#use-windows-powershell-to-disable-specific-features). - -If you want to hide the entire **Apps** feature in the Settings app, use the `User Configuration\Administrative Template\Control Panel\Programs\Hide "Programs and Features" page` policy. - -### MDM - -Using Microsoft Intune, you can use [administrative templates](/mem/intune/configuration/administrative-templates-windows) or the [settings catalog](/mem/intune/configuration/settings-catalog) to hide Windows features. - -If you want to hide the entire **Apps** feature in the Settings app, you can use a configuration policy on Intune enrolled devices. For more information on the settings you can configure, see [Control Panel and Settings device restrictions in Microsoft Intune](/mem/intune/configuration/device-restrictions-windows-10#control-panel-and-settings). - -## Use Windows PowerShell to disable specific features - -To disable specific features, use the Windows PowerShell [Disable-WindowsOptionalFeature](/powershell/module/dism/disable-windowsoptionalfeature) cmdlet. - -> [!NOTE] -> There isn't a group policy that disables specific Windows features. - -To automate disabling specific features, create a scheduled task to run a PowerShell script. For more information about Windows task scheduler, see [Task Scheduler for developers](/windows/win32/taskschd/task-scheduler-start-page). - -Microsoft Intune can also run PowerShell scripts. For more information, see [Use PowerShell scripts on Windows client devices in Intune](/mem/intune/apps/intune-management-extension). - -To enable specific features, use the [Enable-WindowsOptionalFeature](/powershell/module/dism/enable-windowsoptionalfeature) cmdlet. - -Another useful PowerShell cmdlet is [Get-WindowsOptionalFeature](/powershell/module/dism/get-windowsoptionalfeature). Use this cmdlet to view information about optional features in the current OS or a mounted image. This cmdlet returns the current state of features, and whether a restart may be required when the state changes. - -## Related articles - -- [Features on Demand overview](/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities) - -- [Available Features on Demand](/windows-hardware/manufacture/desktop/features-on-demand-non-language-fod) - -- [Language and region Features on Demand (FOD)](/windows-hardware/manufacture/desktop/features-on-demand-language-fod) diff --git a/windows/application-management/app-v/appv-about-appv.md b/windows/application-management/app-v/appv-about-appv.md deleted file mode 100644 index 4fc8997a6e..0000000000 --- a/windows/application-management/app-v/appv-about-appv.md +++ /dev/null @@ -1,68 +0,0 @@ ---- -title: What's new in App-V for Windows 10, version 1703 and earlier (Windows 10) -description: Information about what's new in App-V for Windows 10, version 1703 and earlier. -author: aczechowski -ms.prod: windows-client -ms.date: 06/08/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.technology: itpro-apps ---- -# What's new in App-V for Windows 10, version 1703 and earlier - ->Applies to: Windows 10, version 1703 and earlier - -Microsoft Application Virtualization (App-V) for Windows 10 delivers Win32 applications to users as virtual applications. Virtual applications are installed on centrally managed servers and delivered to users as a service in real time and on an as-needed basis. Users launch virtual applications from familiar access points and interact with them as if they were installed locally. - -## What's new in App-V Windows 10, version 1703 - -### Auto-sequence and update your App-V packages singly or as a batch - -Previous versions of the App-V Sequencer required manual sequencing and updating of app packages. This was time-consuming and required extensive interaction, causing many companies to deploy brand-new packages rather than update an existing one. Windows 10, version 1703 introduces the App-V Auto-Sequencer, which automatically sequences your app packages, improving your overall experience by streamlining prerequisite environment provisioning, automating app installation, and expediting package updating setup. - -Using the automatic sequencer to package your apps gives you the following benefits: - -* **Automatic virtual machine (VM) sequencing environment provisioning**. To learn more, see [Automatically provision your sequencing environment using Microsoft Application Virtualization Sequencer (App-V Sequencer)](appv-auto-provision-a-vm.md). -* **Package batch-sequencing**. This benefit denotes that multiple apps can be sequenced at the same time, in a single group. To learn more, see [Automatically sequence multiple apps at the same time using Microsoft Application Virtualization Sequencer (App-V Sequencer)](appv-auto-batch-sequencing.md). -* **Package batch-updating**. This benefit denotes that multiple apps can be updated at the same time, in a single group. To learn more, see [Automatically update multiple apps at the same time using Microsoft Application Virtualization Sequencer (App-V Sequencer)](appv-auto-batch-updating.md). - -### Updates to the App-V project template - -Starting with Windows 10, version 1703, you can now save an App-V project template (.appvt) file as part of a sequenced App-V package. This file will automatically load every time you open the package for edits or updates. Your template can include general option settings, file exclusion list settings, and target operating system settings. To learn more, see [Create and apply an App-V project template to a sequenced App-V package](../app-v/appv-create-and-use-a-project-template.md). - -### Automatically clean up unpublished App-V packages from the App-V client - -Previous versions of App-V have required you to manually remove your unpublished packages from your client devices, to free up more storage space. Windows 10, version 1703 introduces the ability to use PowerShell or Group Policy settings to automatically clean up your unpublished packages after a device restart. To learn more, see [Automatically clean up unpublished packages on the App-V client](../app-v/appv-auto-clean-unpublished-packages.md). - -## What's new in App-V in Windows 10, version 1607 - -### App-V is now a feature in Windows 10 - -With Windows 10, version 1607 and later releases, App-V is now included with [Windows 10 for Enterprise and Windows 10 for Education](https://www.microsoft.com/WindowsForBusiness/windows-product-home) and is no longer part of the Microsoft Desktop Optimization Pack. - -To learn more about earlier versions of App-V, see [MDOP Information Experience](/microsoft-desktop-optimization-pack/index). - -The changes in App-V for Windows 10, version 1607 impact existing implementations of App-V in the following ways: - -* The App-V client is installed on user devices automatically with Windows 10, version 1607, and no longer has to be deployed separately. Performing an in-place upgrade to Windows 10, version 1607, on user devices automatically installs the App-V client. -* In previous releases of App-V, the application sequencer was included in the Microsoft Desktop Optimization Pack. Although you’ll need to use the new application sequencer to create new virtualized applications, existing virtualized applications will continue to work. The App-V application sequencer is available from the [Windows 10 Assessment and Deployment Kit (ADK)](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit). - - > [!NOTE] - >If you're already using App-V 5.x, you don't need to redeploy the App-V server components, as they haven't changed since App-V 5.0's release. - -For more information about how to configure an existing App-V installation after upgrading user devices to Windows 10, see [Upgrading to App-V for Windows 10 from an existing installation](../app-v/appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation.md) and [Migrating to App-V for Windows 10 from a previous version](../app-v/appv-migrating-to-appv-from-a-previous-version.md). - ->[!IMPORTANT] ->You can only upgrade your existing App-V installation to Windows 10, version 1607 if it's version 5.0 SP2 or higher. If you're using an older version of App-V, you’ll need to upgrade from that version to App-V 5.0 SP2 before you can upgrade to Windows 10, version 1607. - -## Support for System Center - -App-V supports System Center 2016 and Configuration Manager SP1. See [Planning for App-V Integration with Configuration Manager](/previous-versions/system-center/system-center-2012-R2/jj822982(v=technet.10)) to learn more about how to integrate your App-V environment with Configuration Manager. - -## Related articles - -* [Release Notes for App-V for Windows 10, version 1607](../app-v/appv-release-notes-for-appv-for-windows.md) -* [Release Notes for App-V for Windows 10, version 1703](../app-v/appv-release-notes-for-appv-for-windows-1703.md) diff --git a/windows/application-management/app-v/appv-add-or-remove-an-administrator-with-the-management-console.md b/windows/application-management/app-v/appv-add-or-remove-an-administrator-with-the-management-console.md deleted file mode 100644 index 040eda052e..0000000000 --- a/windows/application-management/app-v/appv-add-or-remove-an-administrator-with-the-management-console.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -title: How to Add or Remove an Administrator by Using the Management Console (Windows 10/11) -description: Add or remove an administrator on the Microsoft Application Virtualization (App-V) server by using the Management Console. -author: aczechowski -ms.prod: windows-client -ms.date: 06/08/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.technology: itpro-apps ---- -# How to add or remove an administrator by using the Management Console - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -Use the following procedures to add or remove an administrator on the Microsoft Application Virtualization (App-V) server. - -## Add an administrator using the Management Console - -1. Open the Microsoft Application Virtualization (App-V) Management Console and select **Administrators** in the navigation pane. The navigation pane will display a list of Access Directory (AD) users and groups that currently have administrative access to the Microsoft Application Virtualization (App-V) server. -2. To add a new administrator, select **Add Administrator**. Enter the name of the administrator that you want to add in the **Active Directory Name** field. Make sure to also provide the associated user account domain name. For example, **Domain** \\ **UserName**. -3. Select the account you want to add and select **Add**. The new account should now appear in the list of server administrators. - -## Remove an administrator using the Management Console - -1. Open the Microsoft Application Virtualization (App-V) Management Console and select **Administrators** in the navigation pane. The navigation pane displays a list of AD users and groups that currently have administrative access to the Microsoft Application Virtualization (App-V) server. -2. Right-click the account to be removed from the list of administrators and select **Remove**. - - - - - -## Related articles - -* [Operations for App-V](appv-operations.md) diff --git a/windows/application-management/app-v/appv-add-or-upgrade-packages-with-the-management-console.md b/windows/application-management/app-v/appv-add-or-upgrade-packages-with-the-management-console.md deleted file mode 100644 index b11acc20a7..0000000000 --- a/windows/application-management/app-v/appv-add-or-upgrade-packages-with-the-management-console.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: How to Add or Upgrade Packages by Using the Management Console (Windows 10/11) -description: Add or upgrade packages on the Microsoft Application Virtualization (App-V) server by using the Management Console. -author: aczechowski -ms.prod: windows-client -ms.date: 06/08/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.technology: itpro-apps ---- -# How to add or upgrade packages by using the Management Console - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -You can use the following procedure to add or upgrade a package to the App-V Management Console. To upgrade a package that already exists in the Management Console, use the following steps and import the upgraded package using the same package **Name**. - -## Add a package to the Management Console - -1. Select the **Packages** tab in the navigation pane of the Management Console display. - - The console displays the list of packages that have been added to the server along with status information about each package. When a package is selected, detailed information about the package is displayed in the **PACKAGES** pane. - - Select the **Ungrouped** drop-down list box and specify how the packages are to be displayed in the console. You can also click the associated column header to sort the packages. - -2. Select **Add or Upgrade Packages** to specify which package you want to add. - -3. Enter the full path to the package that you want to add. Use the UNC or HTTP path format, for example **\\\\servername\\sharename\\foldername\\packagename.appv** or **http://server.1234/file.appv**, and then select **Add**. - - >[!IMPORTANT] - >You must select a package with the **.appv** file name extension. - -4. The page displays the status message **Adding <Packagename>**. Select **IMPORT STATUS** to check the status of a package that you have imported. - - Select **OK** to add the package and close the **Add Package** page. If there was an error during the import, select **Detail** on the **Package Import** page for more information. The newly added package is now available in the **PACKAGES** pane. - -5. Select **Close** to close the **Add or Upgrade Packages** page. - - - - - -## Related articles - -* [Operations for App-V](appv-operations.md) diff --git a/windows/application-management/app-v/appv-administering-appv-with-powershell.md b/windows/application-management/app-v/appv-administering-appv-with-powershell.md deleted file mode 100644 index ec381c1293..0000000000 --- a/windows/application-management/app-v/appv-administering-appv-with-powershell.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: Administering App-V by using Windows PowerShell (Windows 10/11) -description: Administer App-V by using Windows PowerShell and learn where to find more information about PowerShell for App-V. -author: aczechowski -ms.prod: windows-client -ms.date: 06/08/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.technology: itpro-apps ---- -# Administering App-V by using Windows PowerShell - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -Microsoft Application Virtualization (App-V) supports Windows PowerShell cmdlets that give administrators a quick and easy way to manage App-V. The following sections will tell you more about how to use Windows PowerShell with App-V. - -## How to administer App-V with Windows PowerShell - -The following table lists articles that will tell you more about how to use PowerShell for App-V. - -|Name|Description| -|---|---| -|[How to load the Windows PowerShell cmdlets for App-V and get cmdlet help](appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md)|Describes how to install the Windows PowerShell cmdlets and find cmdlet help and examples.| -|[How to manage App-V packages running on a stand-alone computer by using Windows PowerShell](appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md)|Describes how to manage the client package lifecycle on a stand-alone computer with Windows PowerShell.| -|[How to manage connection groups on a stand-alone computer by using Windows PowerShell](appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell.md)|Describes how to manage connection groups with Windows PowerShell.| -|[How to modify client configuration by using Windows PowerShell](appv-modify-client-configuration-with-powershell.md)|Describes how to modify the client with Windows PowerShell.| -|[How to apply the user configuration file by using Windows PowerShell](appv-apply-the-user-configuration-file-with-powershell.md)|Describes how to apply a user configuration file with Windows PowerShell.| -|[How to apply the deployment configuration file by using Windows PowerShell](appv-apply-the-deployment-configuration-file-with-powershell.md)|Describes how to apply a deployment configuration file with Windows PowerShell.| -|[How to sequence a package by using Windows PowerShell](appv-sequence-a-package-with-powershell.md)|Describes how to create a new package with Windows PowerShell.| -|[How to create a package accelerator by using Windows PowerShell](appv-create-a-package-accelerator-with-powershell.md)|Describes how to create a package accelerator with Windows PowerShell. You can use package accelerators to automatically sequence large, complex applications.| -|[How to enable reporting on the App-V client by using Windows PowerShell](appv-enable-reporting-on-the-appv-client-with-powershell.md)|Describes how to enable the computer running the App-V Client to send reporting information.| -|[How to install the App-V databases and convert the associated security identifiers by using Windows PowerShell](appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md)|Describes how to take an array of account names and to convert each of them to the corresponding SID in standard and hexadecimal formats.| -|[How to configure the client to receive package and connection groups updates from the publishing server](appv-configure-the-client-to-receive-updates-from-the-publishing-server.md)|Describes how to use Windows PowerShell to configure a client after you have deployed the App-V management and publishing servers and added the required packages and connection groups.| - ->[!IMPORTANT] ->Make sure that any script you execute with your App-V packages matches the execution policy that you have configured for Windows PowerShell. - -## Windows PowerShell error handling - -The following table describes Windows PowerShell error handling for App-V. - -|Event|Action| -|---|---| -|Using the **RollbackOnError** attribute with embedded scripts|When you use the **RollbackOnError** attribute with embedded scripts, the attribute is ignored for the following events:
                        - Removing a package
                        - Unpublishing a package
                        - Terminating a virtual environment
                        - Terminating a process| -|Package name contains **$**|If a package name contains the character \$\, you must use a single-quote ( **'** ).
                        For example:
                        ```Add-AppvClientPackage 'Contoso$App.appv'```| - - - - - -## Related articles - -* [Operations for App-V](appv-operations.md) diff --git a/windows/application-management/app-v/appv-administering-virtual-applications-with-the-management-console.md b/windows/application-management/app-v/appv-administering-virtual-applications-with-the-management-console.md deleted file mode 100644 index cf6f1e8a76..0000000000 --- a/windows/application-management/app-v/appv-administering-virtual-applications-with-the-management-console.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -title: Administering App-V Virtual Applications by using the Management Console (Windows 10/11) -description: Administering App-V Virtual Applications by using the Management Console -author: aczechowski -ms.prod: windows-client -ms.date: 06/08/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.technology: itpro-apps ---- -# Administering App-V Virtual Applications by using the Management Console - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -Use the Microsoft Application Virtualization (App-V) management server to manage packages, connection groups, and package access in your environment. The server publishes application icons, shortcuts, and file type associations to authorized computers running the App-V client. One or more management servers typically share a common data store for configuration and package information. - -The management server uses Active Directory Domain Services (AD DS) groups to manage user authorization and has SQL Server installed to manage the database and data store. - -Because the management servers stream applications to end users on demand, these servers are ideally suited for system configurations that have reliable, high-bandwidth LANs. The management server consists of the following components: - -- The **management server** manages packages and connection groups. -- The **publishing server** deploys packages to computers running the App-V Client. -- The **management database** manages the package access publishes the server’s synchronization with the management server. - -## Management Console tasks - -Here are some articles that can show you how to perform the most common tasks that the App-V Management Console is used for: - -- [How to connect to the Management Console](appv-connect-to-the-management-console.md) -- [How to add or upgrade packages by using the Management Console](appv-add-or-upgrade-packages-with-the-management-console.md) -- [How to configure access to packages by using the Management Console](appv-configure-access-to-packages-with-the-management-console.md) -- [How to publish a package by using the Management Console](appv-publish-a-packages-with-the-management-console.md) -- [How to delete a package in the Management Console](appv-delete-a-package-with-the-management-console.md) -- [How to add or remove an administrator by using the Management Console](appv-add-or-remove-an-administrator-with-the-management-console.md) -- [How to register and unregister a publishing server by using the Management Console](appv-register-and-unregister-a-publishing-server-with-the-management-console.md) -- [How to create a custom configuration file by using the App-V Management Console](appv-create-a-custom-configuration-file-with-the-management-console.md) -- [How to transfer access and configurations to another version of a package by using the Management Console](appv-transfer-access-and-configurations-to-another-version-of-a-package-with-the-management-console.md) -- [How to customize virtual application extensions for a specific AD group by using the Management Console](appv-customize-virtual-application-extensions-with-the-management-console.md) -- [How to view and configure applications and default virtual application extensions by using the Management Console](appv-view-and-configure-applications-and-default-virtual-application-extensions-with-the-management-console.md) - -The main elements of the App-V Management Console are: - -|Management Console tab|Description| -|---|---| -|Packages tab|Use the **Packages** tab to add or upgrade packages.| -|Connection Groups tab|Use the **Connection Groups** tab to manage connection groups.| -|Servers tab|Use the **Servers** tab to register a new server.| -|Administrators tab|Use the **Administrators** tab to register, add, or remove administrators in your App-V environment.| - ->[!IMPORTANT] ->The browser you're using to open the Web Management Console must have JavaScript enabled. - - - - - -## Other resources for this App-V deployment - -- [Application Virtualization (App-V) overview](appv-for-windows.md) -- [Operations for App-V](appv-operations.md) diff --git a/windows/application-management/app-v/appv-allow-administrators-to-enable-connection-groups.md b/windows/application-management/app-v/appv-allow-administrators-to-enable-connection-groups.md deleted file mode 100644 index a02875375a..0000000000 --- a/windows/application-management/app-v/appv-allow-administrators-to-enable-connection-groups.md +++ /dev/null @@ -1,36 +0,0 @@ ---- -title: Only Allow Admins to Enable Connection Groups (Windows 10/11) -description: Configure the App-V client so that only administrators, not users, can enable or disable connection groups. -author: aczechowski -ms.prod: windows-client -ms.date: 06/08/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.technology: itpro-apps ---- -# How to allow only administrators to enable connection groups - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -You can configure the App-V client so that only administrators, not users, can enable or disable connection groups. In earlier versions of App-V, there was no way to restrict access to disabling connection groups to users. - ->[!NOTE] ->This feature is supported starting in App-V 5.0 SP3. - -Use one of the following methods to allow only administrators to enable or disable connection groups. - -|Method|Steps| -|---|---| -|Group Policy setting|Enable the “Require publish as administrator” Group Policy setting, which is located in the following Group Policy Object node:

                        **Computer Configuration** > **Administrative Templates** > **System** > **App-V** > **Publishing**| -|Windows PowerShell cmdlet|Run the **Set-AppvClientConfiguration** cmdlet with the *-RequirePublishAsAdmin* parameter.

                        Parameter values:
                        - **0** – False
                        - **1** – True

                        Example: ```Set-AppvClientConfiguration -RequirePublishAsAdmin 1```| - - - - - -## Related articles - -- [Managing Connection Groups](appv-managing-connection-groups.md) diff --git a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md deleted file mode 100644 index 025efdca77..0000000000 --- a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md +++ /dev/null @@ -1,899 +0,0 @@ ---- -title: Application Publishing and Client Interaction (Windows 10/11) -description: Learn technical information about common App-V Client operations and their integration with the local operating system. -author: aczechowski -ms.prod: windows-client -ms.date: 06/08/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.technology: itpro-apps ---- -# Application publishing and client interaction - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -This article provides technical information about common App-V Client operations and their integration with the local operating system. - -## App-V package files created by the Sequencer - -The Sequencer creates App-V packages and produces a virtualized application. The sequencing process creates the following files: - -|File|Description| -|---|---| -|.appv|- The primary package file, which contains captured assets and state information from the sequencing process.
                        - Architecture of the package file, publishing information, and registry in a tokenized form that can be reapplied to a machine and to a specific user upon delivery.| -|.MSI|Executable deployment wrapper that you can use to deploy .appv files manually or by using a third-party deployment platform.| -|_DeploymentConfig.XML|File used to customize the default publishing parameters for all applications in a package that is deployed globally to all users on a computer that is running the App-V Client.| -|_UserConfig.XML|File used to customize the publishing parameters for all applications in a package that is a deployed to a specific user on a computer that is running the App-V Client.| -|Report.xml|Summary of messages resulting from the sequencing process, including omitted drivers, files, and registry locations.| -|.CAB|Optional: Package accelerator file used to automatically rebuild a previously sequenced virtual application package.| -|.appvt|Optional: Sequencer template file used to retain commonly reused Sequencer settings.| - -To learn more about sequencing, see [How to Sequence a New Application with App-V](appv-sequence-a-new-application.md). - -## What’s in the appv file? - -The appv file is a container that stores XML and non-XML files together in a single entity. This file is built from the AppX format, which is based on the Open Packaging Conventions (OPC) standard. - -To view the appv file contents, make a copy of the package, and then rename the copied file to a .zip extension. - -The appv file contains the following folder and files, which are used when creating and publishing a virtual application: - -| Name | Type | Description | -|---|---|---| -| Root | File folder | Directory that contains the file system for the virtualized application captured during sequencing. | -| [Content_Types].xml | XML File | List of the core content types in the appv file (for example, DLL, EXE, BIN). | -| AppxBlockMap.xml | XML File | Layout of the appv file, which uses File, Block, and BlockMap elements that enable location and validation of files in the App-V package.| -| AppxManifest.xml | XML File | Metadata for the package that contains the required information for adding, publishing, and launching the package. Includes extension points (file type associations and shortcuts) and the names and GUIDs associated with the package.| -| FilesystemMetadata.xml | XML File | List of the files captured during sequencing, including attributes (such as directories, files, opaque directories, empty directories, and long and short names). | -| PackageHistory.xml | XML File | Information about the sequencing computer (operating system version, Internet Explorer version, .Net Framework version) and process (upgrade, package version).| -| Registry.dat | DAT File | Registry keys and values captured during the sequencing process for the package.| -| StreamMap.xml | XML File | List of files for the primary and publishing feature block. The publishing feature block contains the ICO files and required portions of files (EXE and DLL) for publishing the package. When present, the primary feature block includes files that have been optimized for streaming during the sequencing process.| - -## App-V Client data storage locations - -The App-V Client performs tasks to keep virtual applications running properly and working like locally installed applications. The process of opening and running virtual applications requires mapping from the virtual file system and registry to ensure the application has the required components of a traditional application expected by users. This section describes the assets that are required to run virtual applications and lists the location where App-V stores the assets. - -| Name | Location | Description | -|---|---|---| -| Package Store | %ProgramData%\App-V| Default location for read-only package files.| -| Machine Catalog | %ProgramData%\Microsoft\AppV\Client\Catalog| Contains per-machine configuration documents.| -| User Catalog | %AppData%\Microsoft\AppV\Client\Catalog| Contains per-user configuration documents.| -| Shortcut Backups | %AppData%\Microsoft\AppV\Client\Integration\ShortCutBackups| Stores previous integration points that enable restore on package unpublish.| -| Copy on Write (COW) Roaming | %AppData%\Microsoft\AppV\Client\VFS| Writeable roaming location for package modification.| -| Copy on Write (COW) Local | %LocalAppData%\Microsoft\AppV\Client\VFS| Writeable non-roaming location for package modification.| -| Machine Registry | HKLM\Software\Microsoft\AppV| Contains package state information, including VReg for machine or globally published packages (Machine hive).| -| User Registry | HKCU\Software\Microsoft\AppV| Contains user package state information including VReg.| -| User Registry Classes | HKCU\Software\Classes\AppV| Contains more user package state information.| - -More details for the table are provided in the section below and throughout the document. - -### Package store - -The App-V Client manages the applications assets mounted in the package store. This default storage location is %ProgramData%\App-V, but you can configure it during or after setup by using the **Set-AppVClientConfiguration** Windows PowerShell cmdlet, which modifies the local registry (**PackageInstallationRoot** value under the HKLM\Software\Microsoft\AppV\Client\Streaming key). The package store must be located at a local path on the client operating system. The individual packages are stored in the package store in subdirectories named after the Package GUID and Version GUID. - -The following is an example of a path to a specific application: - -```syntax -C:\ProgramData\App-V\PackGUID\VersionGUID -``` - -To change the default location of the package store during setup, see [Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md). - -### Shared Content Store - -If the App-V Client is configured in Shared Content Store mode, no data is written to disk when a stream fault occurs, which means that the packages require minimal local disk space (publishing data). In VDI environments where local storage can be limited, it's important to use as little disk space as possible. You can minimize disk space usage by streaming applications from a high-performance network location (such as a SAN). For more information, see [Shared Content Store in Microsoft App-V 5.0 - Behind the Scenes](/archive/blogs/appv/shared-content-store-in-microsoft-app-v-5-0-behind-the-scenes). - ->[!NOTE] ->The machine and package store must be located on a local drive, even when you’re using Shared Content Store configurations for the App-V Client. - -### Package catalogs - -The App-V Client manages the following file-based locations: - -- **Catalogs (user and machine).** -- **Registry locations**—depends on how the package is targeted for publishing. There's a Catalog (data store) for the computer, and a catalog for each individual user. The Machine catalog stores global information applicable to all users or any specific user, and the User catalog stores information applicable to a specific user. The catalog is a collection of Dynamic Configurations and manifest files; there's discrete data for both file and registry per package version. - -### Machine catalog - -The locations described in this table can be found in the %programdata%\Microsoft\AppV\Client\Catalog\ folder. - -| | Location | -|:---|:---| -|**Description**|Stores package documents that are available to users on the machine when packages are added and published. However, if a package is “global” at publishing time, the integrations are available to all users.

                        If a package is non-global, the integrations are published only for specific users, but there are still global resources that are modified and visible to anyone on the client computer (such as when the package directory is in a shared disk location).

                        If a package is available to a user on the computer (global or non-global), the manifest is stored in the Machine Catalog. When a package is published globally, there's a Dynamic Configuration file, stored in the Machine Catalog; therefore, the determination of whether a package is global is defined according to whether there's a policy file (UserDeploymentConfiguration file) in the Machine Catalog.| -|**Default storage location**|%programdata%\Microsoft\AppV\Client\Catalog\

                        This location isn't the same as the Package Store location. The Package Store is the golden or pristine copy of the package files.| -|**Files in the machine catalog**|- Manifest.xml
                        - DeploymentConfiguration.xml
                        - UserManifest.xml (Globally Published Package)
                        - UserDeploymentConfiguration.xml (Globally Published Package)| -|**Additional machine catalog location, used when the package is part of a connection group**|The following location is in addition to the specific package location mentioned previously as the default storage location:

                        %programdata%\Microsoft\AppV\Client\Catalog\PackageGroups\ConGroupGUID\ConGroupVerGUID| -|**Additional files in the machine catalog when the package is part of a connection group**|- PackageGroupDescriptor.xml
                        - UserPackageGroupDescriptor.xml (globally published Connection Group)| - -### User catalog - -The locations described in this table can be found in the appdata\roaming\Microsoft\AppV\Client\Catalog\ folder. - -|| Location | -|:---|:---| -|**Description**|Created during the publishing process. Contains information used for publishing the package, and for making sure that a package is provisioned to a specific user at launch. Created in a roaming location and includes user-specific publishing information.

                        When a package is published for a user, the policy file is stored in the User Catalog. At the same time, a copy of the manifest is also stored in the User Catalog. When a package entitlement is removed for a user, the relevant package files are removed from the User Catalog. Looking at the user catalog, an administrator can view the presence of a Dynamic Configuration file, which indicates that the package is entitled for that user.

                        For roaming users, the User Catalog needs to be in a roaming or shared location to preserve the legacy App-V behavior of targeting users by default. Entitlement and policy are tied to a user, not a computer, so they should roam with the user once they're provisioned.| -|**Default storage location**|appdata\roaming\Microsoft\AppV\Client\Catalog\Packages\PkgGUID\VerGUID| -|**Files in the user catalog**|- UserManifest.xml
                        - DynamicConfiguration.xml or UserDeploymentConfiguration.xml| -|**Additional user catalog location, used when the package is part of a connection group**|The following location is in addition to the specific package location mentioned above:

                        appdata\roaming\Microsoft\AppV\Client\Catalog\PackageGroups\PkgGroupGUID\PkgGroupVerGUID| -|**Additional file in the machine catalog when the package is part of a connection group**|UserPackageGroupDescriptor.xml| - -### Shortcut backups - -During the publishing process, the App-V Client backs up any shortcuts and integration points to %AppData%\Microsoft\AppV\Client\Integration\ShortCutBackups. This backup lets integration points restore to the previous versions when the package is unpublished. - -### Copy on Write files - -The Package Store contains a pristine copy of the package files that have been streamed from the publishing server. During normal operation of an App-V application, the user or service may require changes to the files. However, these changes aren't made in the package store to preserve your ability to repair the application, which removes these changes. These locations, called Copy on Write (COW), support both roaming and non-roaming locations. The location where the modifications are stored depends where the application has been programmed to write changes to in a native experience. - -### COW roaming - -The COW Roaming location described above stores changes to files and directories that are targeted to the typical %AppData% location or \\Users\\*<username>*\\AppData\\Roaming location. These directories and files are then roamed based on the operating system settings. - -### COW local - -The COW Local location is similar to the roaming location, but the directories and files aren't roamed to other computers, even if roaming support has been configured. The COW Local location described above stores changes applicable to typical windows and not the %AppData% location. The directories listed will vary but there will be two locations for any typical Windows locations (for example, Common AppData and Common AppDataS). The **S** signifies the restricted location when the virtual service requests the change as a different elevated user from the signed-in users. The non-**S** location stores user-based changes. - -## Package registry - -Before an application can access the package registry data, the App-V Client must make the package registry data available to the applications. The App-V Client uses the real registry as a backing store for all registry data. - -When a new package is added to the App-V Client, a copy of the REGISTRY.DAT file from the package is created at %ProgramData%\Microsoft\AppV\Client\VREG\{Version GUID}.dat. The name of the file is the version GUID with the .DAT extension. The reason this copy is made is to ensure that the actual hive file in the package is never in use, which would prevent the removal of the package at a later time. - -**Registry.dat from Package Store** > **%ProgramData%\Microsoft\AppV\Client\Vreg\\{VersionGUID}.dat** - -When the first application from the package is launched on the client, the client stages or copies the contents out of the hive file, re-creating the package registry data in an alternate location under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AppV\Client\Packages\PackageGuid\Versions\VersionGUID\REGISTRY. The staged registry data has two distinct types of machine data and user data. Machine data is shared across all users on the machine. User data is staged for each user to a user-specific location HKCU\Software\Microsoft\AppV\Client\Packages\PackageGUID\Registry\User. The machine data is ultimately removed at package removal time, and the user data is removed on a user unpublish operation. - -### Package registry staging vs. connection group registry staging - -When connection groups are present, the previous process of staging the registry holds true, but instead of having one hive file to process, there are more than one. The files are processed in the order in which they appear in the connection group XML, with the first writer winning any conflicts. - -The staged registry persists the same way as in the single package case. Staged user registry data remains for the connection group until it's disabled; staged machine registry data is removed on connection group removal. - -### Virtual registry - -The purpose of the virtual registry (VREG) is to provide a single merged view of the package registry and the native registry to applications. It also provides copy-on-write (COW) functionality—that is, any changes made to the registry from the context of a virtual process are made to a separate COW location. This functionality means that the VREG must combine up to three separate registry locations into a single view based on the populated locations in the **registry COW** > **package** > **native**. When a request is made for a registry data it will locate in order until it finds the data it was requesting. Meaning if there's a value stored in a COW location it will not proceed to other locations, however, if there's no data in the COW location it will proceed to the Package and then Native location until it finds the appropriate data. - -### Registry locations - -There are two package registry locations and two connection group locations where the App-V Client stores registry information, depending on whether the Package is published individually or as part of a connection group. There are three COW locations for packages and three for connection groups, which are created and managed by the VREG. Settings for packages and connection groups aren't shared: - -#### Single Package VReg - -The registries in the following table are located in the Registry\Client\Packages\PkgGUID\ folder. - -|Location|Description| -|---|---| -|COW|- Machine Registry\Client\Packages\PkgGUID\REGISTRY (Only elevate process can write)
                        - User Registry\Client\Packages\PkgGUID\REGISTRY (User Roaming anything written under HKCU except Software\Classes
                        - User Registry Classes\Client\Packages\PkgGUID\REGISTRY (HKCU\Software\Classes writes and HKLM for non-elevated process)| -|Package|- Machine Registry\Client\Packages\PkgGUID\Versions\VerGuid\Registry\Machine
                        - User Registry Classes\Client\Packages\PkgGUID\Versions\VerGUID\Registry| -|Native|- Native application registry location| - -#### Connection Group VReg - -The registries in the following table are located in the Machine Registry\Client\PackageGroups\GrpGUID\ and User Registry Classes\Client\PackageGroups\GrpGUID\ folders. - -|Location|Description| -|---|---| -|COW|- Machine Registry\Client\PackageGroups\GrpGUID\REGISTRY (only elevate process can write)
                        - User Registry\Client\PackageGroups\GrpGUID\REGISTRY (Anything written to HKCU except Software\Classes)
                        - User Registry Classes\Client\PackageGroups\GrpGUID\REGISTRY| -|Package|- Machine Registry\Client\PackageGroups\GrpGUID\Versions\VerGUID\REGISTRY
                        - User Registry Classes\Client\PackageGroups\GrpGUID\Versions\VerGUID\REGISTRY| -|Native|- Native application registry location| - -There are two COW locations for HKLM: elevated and non-elevated processes. Elevated processes always write HKLM changes to the secure COW under HKLM. Non-elevated processes always write HKLM changes to the non-secure COW under HKCU\\Software\\Classes. When an application reads changes from HKLM, elevated processes will read changes from the secure COW under HKLM. Non-elevated reads from both, favoring the changes made in the unsecure COW first. - -### Pass-through keys - -An administrator can use pass-through keys to configure certain keys to only be read from the native registry, bypassing the Package and COW locations. Pass-through locations are global to the machine (not package-specific) and can be configured by adding the path to the key, which should be treated as pass-through to the **REG\_MULTI\_SZ** value called **PassThroughPaths** of the key HKLM\Software\Microsoft\AppV\Subsystem\VirtualRegistry. Any key that appears under this multi-string value (and their children) will be treated as pass-through. - -The following locations are configured as pass-through locations by default: - -- HKEY\_CURRENT\_USER\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel - -- HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel - -- HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WINEVT - -- HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\services\\eventlog\\Application - -- HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger - -- HKEY\_CURRENT\_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings - -- HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Perflib - -- HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies - -- HKEY\_CURRENT\_USER\\SOFTWARE\\Policies - -The purpose of pass-through keys is to ensure that a virtual application doesn't write registry data in the VReg that is required for non-virtual applications for successful operation or integration. The Policies key ensures that Group Policy-based settings set by the administrator are utilized and not per package settings. The AppModel key is required for integration with Windows Modern UI-based applications. Administers ideally shouldn't modify any of the default pass-through keys, but in some instances, the admin may need to add more pass-through keys to adjust application behavior. - -## App-V package store behavior - -App-V manages the Package Store, which is the location where the expanded asset files from the appv file are stored. By default, this location is stored at %ProgramData%\\App-V, and is limited in terms of storage capabilities only by free disk space. The package store is organized by the GUIDs for the package and version as mentioned in the previous section. - -### Add packages - -App-V Packages are staged upon addition to the computer with the App-V Client. The App-V Client provides on-demand staging. When publishing or manually entering the **Add-AppVClientPackage** cmdlet, the data structure is built in the package store (C:\\programdata\\App-V\\{PkgGUID}\\{VerGUID}). The package files identified in the publishing block defined in the StreamMap.xml file are added to the system, and the top level folders and child files are staged to ensure proper application assets exist at launch. - -### Mounting packages - -Packages can be explicitly loaded by entering the **Mount-AppVClientPackage** PowerShell cmdlet or by using the **App-V Client UI** to download a package. This operation completely loads the entire package into the package store. - -### Streaming packages - -The App-V Client can be configured to change the default behavior of streaming. All streaming policies are stored under the following registry key: HKEY_LOCAL_MACHINE\Software\Microsoft\AppV\Client\Streaming. Policies are set by entering the **Set-AppvClientConfiguration** PowerShell cmdlet. The following policies apply to streaming: - -|Policy|Description| -|---|---| -|AllowHighCostLaunch|Allows streaming over 3G and cellular networks| -|AutoLoad|Specifies the Background Load setting:
                        0 – Disabled
                        1 – Previously Used Packages only
                        2 – All Packages| -|PackageInstallationRoot|The root folder for the package store in the local machine| -|PackageSourceRoot|The root override where packages should be streamed from| -|SharedContentStoreMode|Enables the use of Shared Content Store for VDI scenarios| - -These settings affect the behavior of streaming App-V package assets to the client. By default, App-V only downloads the assets required after downloading the initial publishing and primary feature blocks. There are three specific behaviors in streaming packages that are important to understand: - -- Background Streaming -- Optimized Streaming -- Stream Faults - -### Background streaming - -The Windows PowerShell cmdlet **Get-AppvClientConfiguration** can be used to determine the current mode for background streaming with the AutoLoad setting and modified with either the **Set-AppvClientConfiguration** cmdlet or from the registry (HKLM\\SOFTWARE\\Microsoft\\AppV\\ClientStreaming key). Background streaming is a default setting where the Autoload setting is set to download previously used packages. The behavior based on default setting (value=1) downloads App-V data blocks in the background after the application has been launched. This setting can either be disabled altogether (value=0) or enabled for all packages (value=2), regardless of whether they've been launched. - -### Optimized streaming - -App-V packages can be configured with a primary feature block during sequencing. This setting allows the sequencing engineer to monitor launch files for a specific application, or applications, and mark the blocks of data in the App-V package for streaming at first launch of any application in the package. - -### Stream faults - -After the initial stream of any publishing data and the primary feature block, requests for more files perform stream faults. These blocks of data are downloaded to the package store on an as-needed basis. This flexibility allows a user to download only a small part of the package, typically enough to launch the package and run normal tasks. All other blocks are downloaded when a user initiates an operation that requires data not currently in the package store. - -### Package upgrades - -App-V Packages require updating throughout the lifecycle of the application. App-V Package upgrades are like the package publish operation, as each version will be created in its own PackageRoot location: %ProgramData%\App-V\{PkgGUID}\{newVerGUID}. The upgrade operation is optimized by creating hard links to identical and streamed files from other versions of the same package. - -### Package removal - -The App-V Client's behavior when packages are removed depends on the package removal method. Using an App-V full infrastructure to unpublish the application, the user catalog files (machine catalog for globally published applications) are removed, but the package store location and COW locations remain. When the **Remove-AppVClientPackge** Windows PowerShell cmdlet is used to remove an App-V Package, the package store location is cleaned. Remember that unpublishing an App-V Package from the Management Server doesn't perform a Remove operation. Neither operation will remove the Package Store package files. - -## Roaming registry and data - -App-V is able to provide a near-native experience when roaming, depending on how the application being used is written. By default, App-V roams AppData that is stored in the roaming location, based on the roaming configuration of the operating system. Other locations for storage of file-based data don't roam from computer to computer, since they're in locations that aren't roamed. - -### Roaming requirements and user catalog data storage - -App-V stores data, which represents the state of the user’s catalog, in the form of: - -- Files under %appdata%\\Microsoft\\AppV\\Client\\Catalog -- Registry settings under HKEY_CURRENT_USER\Software\Microsoft\AppV\Client\Packages - -Together, these files and registry settings represent the user’s catalog, so either both must be roamed, or neither must be roamed for a given user. App-V doesn't support roaming %AppData%, but not roaming the user’s profile (registry), or vice versa. - ->[!NOTE] ->The **Repair-AppvClientPackage** cmdlet doesn't repair the publishing state of packages where the user’s App-V state under HKEY_CURRENT_USER is missing or mismatched with the data in %appdata%. - -### Registry-based data - -App-V registry roaming falls into two scenarios, as shown in the following table. - -|Scenario|Description| -|---|---| -|Applications that are run as standard users|When a standard user launches an App-V application, both HKLM and HKCU for App-V applications are stored in the HKCU hive on the machine. This scenario presents two distinct paths:

                        - HKLM's location is HKCU\SOFTWARE\Classes\AppV\Client\Packages\\{PkgGUID}\REGISTRY\MACHINE\SOFTWARE
                        - HKCU's location is HKCU\SOFTWARE\Microsoft\AppV\Client\Packages\\{PkgGUID}\REGISTRY\USER\\{UserSID}\SOFTWARE

                        The locations are enabled for roaming based on the operating system settings.| -|Applications that are run with elevation|When an application is launched with elevation:

                        - HKLM data is stored in the HKLM hive on the local computer
                        - HKCU data is stored in the User Registry location

                        In this scenario, these settings aren't roamed with normal operating system roaming configurations, and the resulting registry keys and values are stored in the following locations:

                        - HKLM's location is HKLM\SOFTWARE\Microsoft\AppV\Client\Packages\\{PkgGUID}\\{UserSID}\REGISTRY\MACHINE\SOFTWARE
                        - HKCU's location is HKCU\SOFTWARE\Microsoft\AppV\Client\Packages\\{PkgGUID}\\Registry\User\\{UserSID}\SOFTWARE| - -### App-V and folder redirection - -App-V supports folder redirection of the roaming AppData folder (%AppData%). When the virtual environment is started, the roaming AppData state from the user’s roaming AppData directory is copied to the local cache. Conversely, when the virtual environment is shut down, the local cache that is associated with a specific user’s roaming AppData is transferred to the actual location of that user’s roaming AppData directory. - -A typical package has several locations mapped in the user’s backing store for settings in both AppData\\Local and AppData\\Roaming. These locations are the Copy on Write locations that are stored per user in the user’s profile, and that are used to store changes made to the package VFS directories and to protect the default package VFS. - -The following table shows local and roaming locations when folder redirection hasn't been implemented. - -| VFS directory in package | Mapped location of backing store | -|---|---| -| ProgramFilesX86 | C:\Users\Local\AppData\Local\Microsoft\AppV\Client\VFS\\<GUID>\ProgramFilesX86 | -| SystemX86 | C:\Users\username\AppData\Local\Microsoft\AppV\Client\VFS\\<GUID>\SystemX86 | -| Windows | C:\Users\username\AppData\Local\Microsoft\AppV\Client\VFS\\<GUID>\Windows | -| appv\_ROOT | C:\Users\username\AppData\Local\Microsoft\AppV\Client\VFS\\<GUID>\appv_ROOT| -| AppData | C:\Users\username\AppData\Local\Microsoft\AppV\Client\VFS\\<GUID>\AppData | - -The following table shows local and roaming locations when folder redirection has been implemented for %AppData% and the location has been redirected (typically to a network location). - -| VFS directory in package | Mapped location of backing store | -|---|---| -| ProgramFilesX86 | C:\Users\Local\AppData\Local\Microsoft\AppV\Client\VFS\\<GUID>\ProgramFilesX86 | -| SystemX86 | C:\Users\Local\AppData\Local\Microsoft\AppV\Client\VFS\\<GUID>\SystemX86 | -| Windows | C:\Users\Local\AppData\Local\Microsoft\AppV\Client\VFS\\<GUID>\Windows | -| appv_ROOT | C:\Users\Local\AppData\Local\Microsoft\AppV\Client\VFS\\<GUID>\appv\_ROOT | -| AppData | \\Fileserver\users\Local\roaming\Microsoft\AppV\Client\VFS\\<GUID>\AppData | - -The current App-V Client VFS driver can't write to network locations, so the App-V Client detects the presence of folder redirection and copies the data on the local drive during publishing and when the virtual environment starts. After the user closes the App-V application and the App-V Client closes the virtual environment, the local storage of the VFS AppData is copied back to the network, enabling roaming to more machines, where the process will be repeated. Here's what happens during the process: - -1. During publishing or virtual environment startup, the App-V Client detects the location of the AppData directory. -2. If the roaming AppData path is local or no AppData\\Roaming location is mapped, nothing happens. -3. If the roaming AppData path isn't local, the VFS AppData directory is mapped to the local AppData directory. - -This process solves the problem of a non-local %AppData% that isn't supported by the App-V Client VFS driver. However, the data stored in this new location isn't roamed with folder redirection. All changes during the running of the application happen to the local AppData location and must be copied to the redirected location. The process does the following things: - -1. Shuts down the App-V application, which also shuts down the virtual environment. -2. Compresses the local cache of the roaming AppData location and store it in a .zip file. -3. Uses the time stamp at the end of the .zip packaging process to name the file. -4. Records the time stamp in the HKEY\_CURRENT\_USER\\Software\\Microsoft\\AppV\\Client\\Packages\\<GUID>\\AppDataTime registry as the last known AppData time stamp. -5. Calls the folder redirection process to evaluate and initiate the .zip file uploaded to the roaming AppData directory. - -The time stamp is used to determine a “last writer wins” scenario if there's a conflict and is used to optimize the download of the data when the App-V application is published, or the virtual environment is started. Folder redirection will make the data available from any other clients covered by the supporting policy and will initiate the process of storing the AppData\\Roaming data to the local AppData location on the client. Here's what happens during the process: - -1. The user starts an application, which also starts the virtual environment. -2. The application’s virtual environment checks for the most recent time stamped .zip file, if present. -3. The virtual environment checks the registry for the last known uploaded time stamp, if present. -4. The virtual environment downloads the most recent .zip file unless the local last known upload time stamp is greater than or equal to the time stamp from the .zip file. -5. If the local last known upload time stamp is earlier than that of the most recent .zip file in the roaming AppData location, the virtual environment extracts the .zip file to the local temp directory in the user’s profile. -6. After the .zip file is successfully extracted, the local cache of the roaming AppData directory is renamed and the new data moved into place. -7. The renamed directory is deleted and the application opens with the most recently saved roaming AppData data. - -This process completes the successful roaming of application settings that are present in AppData\\Roaming locations. The only other condition that must be addressed is a package repair operation. The process does the following things: - -1. During repair, detects if the path to the user’s roaming AppData directory isn't local. -2. Maps the non-local roaming AppData path targets, recreating the expected roaming and local AppData locations. -3. Deletes the time stamp stored in the registry, if present. - -This process will recreate both the local and network locations for AppData and remove the registry record of the time stamp. - -## App-V Client application lifecycle management - -In an App-V Full Infrastructure, after applications are sequenced, they're managed and published to users or computers through the App-V Management and Publishing servers. This section details the operations that occur during the common App-V application lifecycle operations (Add, publishing, launch, upgrade, and removal) and the file and registry locations that are changed and modified from the App-V Client perspective. The App-V Client operations are input as PowerShell commands on the computer running the App-V Client. - -This document focuses on App-V Full Infrastructure solutions. For specific information on App-V Integration with Microsoft Configuration Manager, see [Deploy App-V virtual applications with Configuration Manager](/mem/configmgr/apps/get-started/deploying-app-v-virtual-applications). - -The App-V application lifecycle tasks are triggered at user sign in (default), machine startup, or as background timed operations. The settings for the App-V Client operations, including Publishing Servers, refresh intervals, package script enablement, and others, are configured (after the client is enabled) with Windows PowerShell commands. See [App-V Client Configuration Settings: Windows PowerShell](appv-client-configuration-settings.md#app-v-client-configuration-settings-windows-powershell). - -### Publishing refresh - -The publishing refresh process comprises several smaller operations that are performed on the App-V Client. Since App-V is an application virtualization technology and not a task scheduling technology, the Windows Task Scheduler is utilized to enable the process when the user signs in, the machine turns on, and at scheduled intervals. The client configuration during setup listed in the previous section is the preferred method when distributing the client to a large group of computers with the correct settings. These client settings can be configured with the following Windows PowerShell cmdlets: - -- **Add-AppVPublishingServer** configures the client with an App-V Publishing Server that provides App-V packages. -- **Set-AppVPublishingServer** modifies the current settings for the App-V Publishing Server. -- **Set-AppVClientConfiguration** modifies the currents settings for the App-V Client. -- **Sync-AppVPublishingServer** initiates an App-V Publishing Refresh process manually. This process is also utilized in the scheduled tasks created during configuration of the publishing server. - -The following sections will elaborate what goes on during the publishing refresh process. - -#### Adding an App-V package - -Adding an App-V package to the client is the first step of the publishing refresh process. The end result is the same as the **Add-AppVClientPackage** cmdlet in Windows PowerShell, except the publishing refresh add process contacts the configured publishing server and passes a high-level list of applications back to the client to pull more detailed information, rather than just doing a single package add operation. - -The process then configures the client for package or connection group additions or updates, then accesses the appv file. Next, the contents of the appv file are expanded and placed on the local operating system in the appropriate locations. The following steps are a detailed workflow of the process, assuming the package is configured for Fault Streaming. - -#### How to add an App-V package - -1. Initiate installation manually through Windows PowerShell or Task Sequence initiation of the Publishing Refresh process. - - 1. The App-V Client makes an HTTP connection and requests a list of applications based on the target. The Publishing refresh process supports targeting machines or users. - - 2. The App-V Publishing Server uses the identity of the initiating target, user or machine, and queries the database for a list of entitled applications. The list of applications is provided as an XML response, which the client uses to send more requests to the server for more information on a per-package basis. - -2. The Publishing Agent on the App-V Client will evaluate any connection groups that are unpublished or disabled, since package version updates that are part of the connection group can't be processed. - -3. Configure the packages by identifying the **Add** or **Update** operations. - - 1. The App-V Client utilizes the AppX API from Windows and accesses the appv file from the publishing server. - - 2. The package file is opened and the **AppXManifest.xml** and **StreamMap.xml** files are downloaded to the Package Store. - - 3. Completely stream publishing block data defined in the **StreamMap.xml** file. Publishing block data is stored in Package Store\\PkgGUID\\VerGUID\\Root. - - - Icons: Targets of extension points. - - Portable Executable Headers (PE Headers): Targets of extension points that contain the base information about the image need on disk, accessed directly or through file types. - - Scripts: Download scripts directory for use throughout the publishing process. - - 4. Populate the Package store by performing the following sub-steps: - - 1. Create sparse files on disk that represent the extracted package for any directories listed. - - 2. Stage top-level files and directories under root. - - All other files are created when the directory is listed as sparse on disk and streamed on demand. - - 5. Create the machine catalog entries. Create the **Manifest.xml** and **DeploymentConfiguration.xml** files from the package files (if no **DeploymentConfiguration.xml** file in the package a placeholder is created). - - 6. Create location of the package store in the registry **HKLM\\Software\\Microsoft\\AppV\\Client\\Packages\\PkgGUID\\Versions\\VerGUID\\Catalog**. - - 7. Create the **Registry.dat** file from the package store to **%ProgramData%\\Microsoft\\AppV\\Client\\VReg\\{VersionGUID}.dat**. - - 8. Register the package with the App-V Kernel Mode Driver at **HKLM\\Microsoft\\Software\\AppV\\MAV**. - - 9. Invoke scripting from the **AppxManifest.xml** or **DeploymentConfig.xml** file for Package Add timing. - -4. Configure Connection Groups by adding and enabling or disabling. - -5. Remove objects that aren't published to the target (user or machine). - - > [!NOTE] - >This will not perform a package deletion but rather remove integration points for the specific target (user or machine) and remove user catalog files (machine catalog files for globally published). - -6. Invoke background load mounting based on client configuration. - -7. Packages that already have publishing information for the machine or user are immediately restored. - - > [!NOTE] - >This condition occurs as a product of removal without unpublishing with background addition of the package. - -This process completes an App-V package add for the publishing refresh process. The next step is publishing the package to a specific target (machine or user). - -![Package add file and registry data.](images/packageaddfileandregistrydata.png) - -**Package add file and registry data** - -#### Publishing an App-V package - -During the Publishing Refresh operation, the specific publishing operation, **Publish-AppVClientPackage**, adds entries to the user catalog, maps entitlement to the user, identifies the local store, and finishes by completing any integration steps. - -#### How to publish an App-V package - -1. Package entries are added to the user catalog - - 1. User targeted packages: the **UserDeploymentConfiguration.xml** and **UserManifest.xml** files are placed on the machine in the User Catalog. - - 2. Machine targeted (global) packages: the **UserDeploymentConfiguration.xml** is placed in the Machine Catalog. - -2. Register the package with the kernel mode driver for the user at **HKLM\\Software\\Microsoft\\AppV\\MAV**. - -3. Perform integration tasks. - - 1. Create extension points. - - 2. Store backup information in the user’s registry and roaming profile (Shortcut Backups). - - > [!NOTE] - >This enables restore extension points if the package is unpublished. - - 3. Run scripts targeted for publishing timing. - -Publishing an App-V Package that is part of a Connection Group is similar to the above process. For connection groups, the path that stores the specific catalog information includes PackageGroups as a child of the Catalog Directory. Review the Machine and User Catalog information in the preceding sections for details. - -![package add file and registry data - global.](images/packageaddfileandregistrydata-global.png) - -**Package add file and registry data—global** - -### Application launch - -After the Publishing Refresh process, the user launches and then relaunches an App-V application. The App-V Client checks the path to the user catalog for files created during publishing. After establishing rights to launch the package, the App-V Client creates a virtual environment, begins streaming any necessary data, and applies the appropriate manifest and deployment configuration files during virtual environment creation. Once the virtual environment created and configured for the specific package and application, the application starts. This might seem like a lot, but the process in action is fast, and is optimized to minimize network traffic. - -#### How to launch App-V applications - -1. User launches the application by selecting a shortcut or file type invocation. - -2. The App-V Client verifies existence in the User Catalog for the following files - - - **UserDeploymentConfiguration.xml** - - **UserManifest.xml** - -3. If the files are present, the application is entitled for that specific user and the application will start the process for launch. There's no network traffic at this point. - -4. Next, the App-V Client checks that the path for the package registered for the App-V Client service is found in the registry. - -5. Upon finding the path to the package store, the virtual environment is created. - - If this process execution is the first launch, the Primary Feature Block downloads if present. - -6. After downloading, the App-V Client service consumes the manifest and deployment configuration files to configure the virtual environment and all App-V subsystems are loaded. - -7. The Application launches. For any missing files in the package store (sparse files), App-V will stream fault the files on an as-needed basis. - - ![package add file and registry data - stream.](images/packageaddfileandregistrydata-stream.png) - - **Package add file and registry data—stream** - -### Upgrading an App-V package - -The current version of App-V's package upgrade process differs from the older versions in its storage optimization. App-V supports multiple versions of the same package on a machine entitled to different users. Package versions can be added at any time, as the package store and catalogs are updated with the new resources. During an upgrade in the new version, only new files are added to the new version store location, and hard links are created for unchanged files. Such results reduce overall storage by only presenting the file on one disk location, then projecting it into all folders with a file location entry on the disk. - -#### How to upgrade an App-V package - -1. The App-V Client performs a Publishing Refresh and discovers a newer version of an App-V Package. - -2. Package entries are added to the appropriate catalog for the new version. - - 1. User targeted packages: the **UserDeploymentConfiguration.xml** and **UserManifest.xml** files are placed on the machine in the user catalog at **appdata\\roaming\\Microsoft\\AppV\\Client\\Catalog\\Packages\\PkgGUID\\VerGUID**. - - 2. Machine targeted (global) packages: the **UserDeploymentConfiguration.xml** is placed in the machine catalog at **%programdata%\\Microsoft\\AppV\\Client\\Catalog\\Packages\\PkgGUID\\VerGUID**. - -3. Register the package with the kernel mode driver for the user at **HKLM\\Software\\Microsoft\\AppV\\MAV**. - -4. Perform integration tasks. - - 1. Integrate extensions points (EP) from the Manifest and Dynamic Configuration files. - - 2. File based EP data is stored in the AppData folder utilizing Junction Points from the package store. - - 3. Version 1 EPs already exist when a new version becomes available. - - 4. The extension points are switched to the Version 2 location in machine or user catalogs for any newer or updated extension points. - -5. Run scripts targeted for publishing timing. - -6. Install Side-by-Side assemblies as required. - -### Upgrading an in-use App-V package - -If you try to upgrade a package that is currently in use, the upgrade task is placed in a pending state. The upgrade will run later, according to the following rules: - -| Task type | Applicable rule | -|---|---| -| User-based tasks, such as publishing a package to a user | The pending task will be performed after the user signs out and then signs back in. | -| Globally based tasks, such as enabling a connection group globally | The pending task will be performed when the computer is shut down and then restarted. | - -When a task is placed in a pending state, the App-V Client also generates a registry key for the pending task, as follows: - -| User-based or globally based task | Where the registry key is generated | -|---|---| -| User-based tasks | HKEY\_CURRENT\_USER\Software\Microsoft\AppV\Client\PendingTasks | -| Globally based tasks | HKEY\_LOCAL\_MACHINE\Software\Microsoft\AppV\Client\PendingTasks | - -The following operations must be completed before users can use the newer version of the package: - -| Task | Details | -|---|---| -| Add the package to the computer | This task is computer-specific and you can perform it at any time by completing the steps in [How to add an App-V package](#how-to-add-an-app-v-package). | -| Publish the package | See the Package Publishing section above for steps. This process requires that you update extension points on the system. You can't complete this task while the application is in use. | - -Use the following example scenarios as a guide for updating packages. - -| Scenario | Requirements | -|---|---| -| App-V package isn't in use when you try to upgrade | None of the following components of the package can be in use: virtual application, COM server, or shell extensions.

                        The administrator publishes a newer version of the package and the upgrade works the next time a component or application inside the package is launched. The new version of the package is streamed and ran. | -| App-V package is in use when the administrator publishes a newer version of the package | The App-V Client sets the operation to "pending," which means that it's queued and will be carried out later when the package isn't in use.

                        If the package application is in use, the user shuts down the virtual application, after which the upgrade can occur.

                        If the package has shell extensions, which are permanently loaded by Windows Explorer, the user won't be able to sign in. Users must sign off and then sign back in to initiate the App-V package upgrade.| - -### Global vs. user publishing - -App-V Packages can be published in one of two ways; as user, which entitles an App-V package to a specific user or group of users, or as global, which entitles the App-V package to the entire machine for all users of the machine. Once a package upgrade has been pended and the App-V package isn't in use, consider the two types of publishing: - -- Global publishing is when the application is published to a machine; all users on that machine can use it. The upgrade will happen when the App-V Client Service starts, which effectively means a machine restart. -- User publishing is when the application is published to a user. If there are multiple users on the machine, the application can be published to a subset of the users. The upgrade will happen when the user signs in or when it's published again (periodically, ConfigMgr Policy refresh and evaluation, or an App-V periodic publishing/refresh, or explicitly through Windows PowerShell commands). - -### Removing an App-V package - -Removing App-V applications in a Full Infrastructure is an unpublish operation and doesn't perform a package removal. The process is the same as the publish process above, but instead of adding the removal process reverses the changes that have been made for App-V Packages. - -### Repairing an App-V package - -The repair operation is easy to do but may affect many locations on the machine. The previously mentioned Copy on Write (COW) locations are removed, and extension points are deintegrated and then reintegrated. Before repairing, please review where the COW data placement locations are registered in the registry. To perform a Repair operation, all you need to do is initiate it from the App-V Client Console or through the **Repair-AppVClientPackage** PowerShell cmdlet. After that, the operation is completed automatically. - -## Integration of App-V packages - -The App-V Client and package architecture provides specific integration with the local operating system during the addition and publishing of packages. Three files define the integration or extension points for an App-V Package: - -- AppXManifest.xml is stored inside of the package with fallback copies stored in the package store and the user profile. Contains the options created during the sequencing process. -- DeploymentConfig.xml provides configuration information of computer- and user-based integration extension points. -- UserConfig.xml is a subset of the Deploymentconfig.xml file that only provides user-based configurations and only targets user-based extension points. - -### Rules of integration - -When App-V applications are published to a computer with the App-V Client, some specific actions take place as described in the following list: - -- Global Publishing: Shortcuts are stored in the All Users profile location and other extension points are stored in the registry in the HKLM hive. -- User Publishing: Shortcuts are stored in the current user account profile and other extension points are stored in the registry in the HKCU hive. -- Backup and Restore: Existing native application data and registry (such as FTA registrations) are backed up during publishing. - - 1. App-V packages are given ownership based on the last integrated package where the ownership is passed to the newest published App-V application. - 2. Ownership transfers from one App-V package to another when the owning App-V package is unpublished. This transfer won't initiate a restore of the data or registry. - 3. Restore the backed-up data when the last package is unpublished or removed on a per-extension point basis. - -### Extension points - -The App-V publishing files (manifest and dynamic configuration) provide several extension points to integrate the application with the local operating system. These extension points perform typical application installation tasks, such as placing shortcuts, creating file type associations, and registering components. As these are virtualized applications that aren't installed in the same manner a traditional application, there are some differences. The following is a list of extension points covered in this section: - -- Shortcuts -- File type associations -- Shell extensions -- COM -- Software clients -- Application capabilities -- URL Protocol handler -- AppPath -- Virtual application - -### Shortcuts - -The shortcut is one of the basic elements of integration with the OS and is the interface for direct user launch of an App-V application. During the publishing and unpublishing of App-V applications. - -From the package manifest and dynamic configuration XML files, the path to a specific application executable can be found in a section as shown in the following example: - -```XML - - - [{Common Desktop}]\Adobe Reader.lnk - [{AppVPackageRoot}]\Reader\AcroRd32.exe - [{Windows}]\Installer\{AC76BA86-7AD7-1033-7B44-A94000000001}\SC_Reader.ico - - - 1 - [{AppVPackageRoot}]\Reader\AcroRd32.exe - - -``` - -As mentioned previously, the App-V shortcuts are placed by default in the user’s profile based on the refresh operation. Global refresh places shortcuts in the All Users profile and user refresh stores them in the specific user’s profile. The actual executable is stored in the Package Store. The location of the ICO file is a tokenized location in the App-V package. - -### File type associations - -Users can use file type invocations or open a file with a registered extension (.docx) to start an App-V application because the App-V Client manages the local operating system File Type Associations during publishing. File type associations are present in the manifest and dynamic configuration files, as shown in the following example: - -```XML - - - - .xdp - AcroExch.XDPDoc - application/vnd.adobe.xdp+xml - - - AcroExch.XDPDoc - Adobe Acrobat XML Data Package File - 65536 - [{Windows}]\Installer\{AC76BA86-7AD7-1033-7B44-A94000000001}\XDPFile_8.ico - - Read - - [{AppVPackageRoot}]\Reader\AcroRd32.exe - Open - "[{AppVPackageRoot}]\Reader\AcroRd32.exe" "%1" - - - [{AppVPackageRoot}]\Reader\AcroRd32.exe - Printto - "[{AppVPackageRoot}]\Reader\AcroRd32.exe" /t "%1" "%2" "%3" "%4" - - - [{AppVPackageRoot}]\Reader\AcroRd32.exe - Read - Open with Adobe Reader - "[{AppVPackageRoot}]\Reader\AcroRd32.exe" "%1" - - - - - -``` - ->[!NOTE] ->In this example: ->- `.xdp` is the extension ->- `AcroExch.XDPDoc` is the ProgId value (which points to the adjoining ProgId) ->- `"[{AppVPackageRoot}]\Reader\AcroRd32.exe" "%1"` is the command line, which points to the application executable - -### Shell extensions - -Shell extensions are embedded in the package automatically during the sequencing process. When the package is published globally, the shell extension gives users the same functionality as if the application were locally installed. The application requires no extra setup or configuration on the client to enable the shell extension functionality. - -#### Requirements for using shell extensions - -- Packages that contain embedded shell extensions must be published globally. -- The “bitness” of the application, Sequencer, and App-V Client must match, or the shell extensions won’t work. The following example configuration fulfills the matching requirement: - - The version of the application is 64-bit. - - The Sequencer is running on a 64-bit computer. - - The package is being delivered to a 64-bit App-V Client computer. - -The following table displays the supported shell extensions. - -| Handler | Description | -|---|---| -| Context menu handler | Adds menu items to the context menu. it's called before the context menu is displayed. | -| Drag-and-drop handler | Controls the action upon right-click drag-and-drop and modifies the context menu that appears. | -| Drop target handler | Controls the action after a data object is dragged-and-dropped over a drop target, such as a file.| -| Data object handler| Controls the action after a file is copied to the clipboard or dragged-and-dropped over a drop target. It can provide more clipboard formats to the drop target.| -| Property sheet handler| Replaces or adds pages to the property sheet dialog box of an object.| -| Infotip handler| Allows retrieving flags and infotip information for an item and displaying it inside a popup tooltip upon mouse-hover.| -| Column handler| Allows creating and displaying custom columns in Windows Explorer *Details view*. It can be used to extend sorting and grouping.| -| Preview handler| Enables a preview of a file to be displayed in the Windows Explorer Preview Pane.| - -### COM - -The App-V Client supports publishing applications with support for COM integration and virtualization. COM integration allows the App-V Client to register COM objects on the local operating system and virtualization of the objects. For the purposes of this document, the integration of COM objects requires more details. - -App-V supports registering COM objects from the package to the local operating system with two process types: Out-of-process and In-process. Registering COM objects is accomplished with one or a combination of multiple modes of operation for a specific App-V package that includes Off, Isolated, and Integrated. Integrated mode is configured for either the Out-of-process or In-process type. Configuration of COM modes and types is accomplished with dynamic configuration files (deploymentconfig.xml or userconfig.xml). - -For details on App-V integration, see [Microsoft Application Virtualization 5.0 Integration](/archive/blogs/appv/microsoft-application-virtualization-5-0-integration). - -### Software clients and application capabilities - -App-V supports specific software clients and application capabilities extension points to register virtualized applications with the operating system's software client. This specific support means users can select default programs for operations like email, instant messaging, and using the media player. This operation is performed in the control panel with **Set Program Access** and **Computer Defaults**, and is configured during sequencing in the manifest or dynamic configuration files. Application capabilities are only supported when the App-V applications are published globally. - -The following example illustrates a software client registration of an App-V-based mail client. - -```XML - - - - - - - Mozilla Thunderbird - Mozilla Thunderbird - [{ProgramFilesX86}]\Mozilla Thunderbird\thunderbird.exe,0 - - - "[{ProgramFilesX86}]\Mozilla Thunderbird\uninstall\helper.exe" /SetAsDefaultAppGlobal - "[{ProgramFilesX86}]\Mozilla Thunderbird\uninstall\helper.exe" /HideShortcuts - "[{ProgramFilesX86}]\Mozilla Thunderbird\uninstall\helper.exe" /ShowShortcuts - - 1 - - - - [{ProgramFilesX86}]\Mozilla Thunderbird\thunderbird.exe - "[{ProgramFilesX86}]\Mozilla Thunderbird\thunderbird.exe" -mail - - [{ProgramFilesX86}]\Mozilla Thunderbird\mozMapi32_InUse.dll - - Thunderbird URL - 2 - [{ProgramFilesX86}]\Mozilla Thunderbird\thunderbird.exe,0 - - [{ProgramFilesX86}]\Mozilla Thunderbird\thunderbird.exe - "[{ProgramFilesX86}]\Mozilla Thunderbird\thunderbird.exe" -osint -compose "%1" - - - - - - - -``` - ->[!NOTE] ->In this example: ->- `` is the overall Software Clients setting to integrate Email clients. ->- `` is the flag to set a particular Email client as the default Email client. ->- `[{ProgramFilesX86}]\Mozilla Thunderbird\mozMapi32_InUse.dll` is the MAPI dll registration. - -### URL Protocol handler - -Virtual applications don't always specifically utilize file type invocation. For, example, in an application that supports embedding a mailto: link inside a document or web page, the user selects the link expecting to access their registered mail client. App-V supports URL Protocol handlers that can be registered on a per-package basis with the local operating system. During sequencing, the URL Protocol handlers are automatically added to the package. - -For situations where there's more than one application that could register the specific URL Protocol handler, the dynamic configuration files can be utilized to modify the behavior and suppress or disable this feature for an application that shouldn't be the primary application launched. - -### AppPath - -The AppPath extension point supports calling App-V applications directly from the operating system. Administrators can provide access to App-V applications from operating system commands or scripts without calling the specific path to the executable from either the Run or Start Screen, depending on the operating system. It therefore avoids modifying the system path environment variable on all systems, as it's accomplished during publishing. - -The AppPath extension point is configured either in the manifest or in the dynamic configuration files and is stored in the registry on the local machine during publishing for the user. For more information on AppPath review: [App Paths - A Virtual Application Extension in App-V 5.0](/archive/blogs/virtualworld/app-paths-a-virtual-application-extension-in-app-v-5-0). - -### Virtual application - -This subsystem provides a list of applications captured during sequencing which is consumed by other App-V components. Integration of extension points belonging to a specific application can be disabled using dynamic configuration files. For example, if a package contains two applications, you can disable all extension points belonging to one application to only allow integration of extension points for the other application. - -### Extension point rules - -The previously described extension points are integrated into the operating system based on how the packages have been published. Global publishing places extension points in public machine locations, where user publishing places extension points in user locations. For example, a shortcut created on the desktop and published globally will result in the file data for the shortcut (%Public%\\Desktop) and the registry data (HKLM\\Software\\Classes). The same shortcut would have file data (%UserProfile%\\Desktop) and registry data (HKCU\\Software\\Classes). - -Extension points aren't all published the same way, where some extension points will require global publishing and others require sequencing on the specific operating system and architecture where they're delivered. Below is a table that describes these two key rules. - -|Virtual Extension|Requires target OS sequencing|Requires global publishing| -|---|:---:|:---:| -|Shortcut||| -|File Type Association||| -|URL Protocols|X|| -|AppPaths|X|| -|COM Mode||| -|Software Client|X|| -|Application Capabilities|X|X| -|Context Menu Handler|X|X| -|Drag-and-drop Handler|X|| -|Data Object Handler|X|| -|Property Sheet Handler|X|| -|Infotip Handler|X|| -|Column Handler|X|| -|Shell Extensions|X|| -|Browser Helper Object|X|X| -|Active X Object|X|X| - -## Dynamic configuration processing - -Deploying App-V packages to a single machine or user is simple. However, as organizations deploy App-V applications across business lines and geographic and political boundaries, it becomes impossible to sequence all applications with the same settings. App-V was designed to overcome this problem by capturing specific settings and configurations during sequencing in the Manifest file while also supporting modification with Dynamic Configuration files. - -App-V dynamic configuration lets you specify a package policy at either the machine or user levels. Sequencing engineers can use Dynamic Configuration files to modify the configuration of a package post-sequencing to address the needs of individual groups of users or machines. In some instances, it may be necessary to modify the application to provide proper functionality within the App-V environment. For example, you may need to modify the \_\*config.xml files to allow certain actions to be performed at a specified time while executing the application, like disabling a mailto extension to prevent a virtualized application from overwriting that extension from another application. - -App-V packages contain the Manifest file inside of the App-V Package file, which is representative of sequencing operations and is the policy of choice unless Dynamic Configuration files are assigned to a specific package. Post-sequencing, the Dynamic Configuration files can be modified to allow an application to be published to different desktops or users with different extension points. The two Dynamic Configuration files are the Dynamic Deployment Configuration (DDC) and Dynamic User Configuration (DUC) files. This section focuses on the combination of the manifest and dynamic configuration files. - -### Examples of dynamic configuration files - -The following example shows the combination of the Manifest, Deployment Configuration, and User Configuration files after publishing and during normal operation. These examples are abbreviated examples of each of the files. The purpose is to show the combination of the files only, not to be a complete description of the specific categories available in each file. For more information, download the [App-V Sequencing Guide](https://www.microsoft.com/download/details.aspx?id=27760). - -#### Manifest - -```XML - - - [{Common Programs}]\7-Zip\7-Zip File Manager.lnk - [{AppVPackageRoot}]\7zFM.exe - [{AppVPackageRoot}]\7zFM exe.O.ico - - -``` - -#### Deployment Configuration - -```XML - - - - - - - - - - -``` - -#### User Configuration - -```XML - - - - - [{Desktop}]\7-Zip\7-Zip File Manager.lnk - [{AppVPackageRoot}]\7zFM.exe - [{AppVPackageRoot}]\7zFM exe.O.ico - - - - - - - - [{Desktop}]\7-Zip\7-Zip File Manager.lnk - [{AppVPackageRoot}]\7zFM.exe - [{AppVPackageRoot}]\7zFM.exe.O.ico - - - [{Common Programs}]\7-Zip\7-Zip File Manager.Ink - [{AppVPackageRoot}]\7zFM.exe - [{AppVPackageRoot)]\7zFM.exe.O.ico - - - - - - - - - - - - -``` - -## Side-by-side assemblies - -App-V supports automatic packaging of side-by-side assemblies during sequencing and deployment on the client during virtual application publishing. App-V also supports capturing side-by-side assemblies during sequencing for assemblies not present on the sequencing machine. For assemblies consisting of Visual C++ (Version 8 and newer) or MSXML run-time, the Sequencer will automatically detect and capture these dependencies even if they weren't installed during monitoring. - -The side-by-side assemblies feature removes the limitations of previous versions of App-V, where the App-V Sequencer didn't capture assemblies already present on the sequencing workstation, and privatized the assemblies, which limited it to a bit version per package. This behavior resulted in App-V applications being deployed to clients missing the required side-by-side assemblies, which led to application launch failures. This failure forced the packaging process to document and ensure that all assemblies required for packages were locally installed on the user’s client operating system. This task was both a management and implementation challenge due to the number of assemblies and the lack of application documentation for the required dependencies. - -Side-by-side assembly support in App-V has the following features: - -- Automatic captures of side-by-side assembly during sequencing, regardless of whether the assembly was already installed on the sequencing workstation. -- The App-V Client automatically installs required side-by-side assemblies to the client computer at publishing time if they aren't already installed. -- The Sequencer reports the VC run-time dependency in Sequencer reporting mechanism. -- The Sequencer allows opting to not package assemblies already installed on the Sequencer, supporting scenarios where the assemblies have previously been installed on the target computers. - -### Automatic publishing of side-by-side assemblies - -During publishing of an App-V package with side-by-side assemblies, the App-V Client will check for the presence of the assembly on the machine. If it doesn't detect an assembly, the client will deploy the assembly to the machine. Packages that are part of connection groups will rely on the side-by-side assembly installations in the base packages, as the connection groups don't contain any information about assembly installation. - ->[!NOTE] ->Unpublishing or removing a package with an assembly doesn't remove the assemblies for that package. - -## Client logging - -The App-V Client logs information to the Windows Event log in standard ETW format. The specific App-V events can be found in the event viewer under **Applications and Services Logs\\Microsoft\\AppV\\Client**. - -There're three specific categories of events recorded: - -- **Admin** logs events for configurations applied to the App-V Client and also contains the primary warnings and errors. -- **Operational** logs the general App-V execution and usage of individual components, creating an audit log of the App-V Client's completed App-V operations. -- **Virtual Application** logs virtual application launches and use of virtualization subsystems. diff --git a/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md b/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md deleted file mode 100644 index 24903fe377..0000000000 --- a/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: Apply deployment config file via Windows PowerShell (Windows 10/11) -description: How to apply the deployment configuration file by using Windows PowerShell for Windows 10/11. -author: aczechowski -ms.prod: windows-client -ms.date: 06/15/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.technology: itpro-apps ---- -# How to apply the deployment configuration file by using Windows PowerShell - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -When you add or set a package to a computer running the App-V client before it's been published, a dynamic deployment configuration file is applied to it. The dynamic deployment configuration file configures the default settings for the package that all users share on the computer running the App-V client. This section will tell you how to use a deployment configuration file. - -## Apply the deployment configuration file with Windows PowerShell - -> [!NOTE] -> The following example cmdlet uses the following two file paths for the package and configuration files: -> -> * C:\\Packages\\Contoso\\MyApp.appv -> * C:\\Packages\\Contoso\\DynamicConfigurations\\deploymentconfig.xml -> -> If your package and configuration files use different file paths than the example, feel free to replace them as needed. - -To specify a new default set of configurations for all users who will run the package on a specific computer, in a Windows PowerShell console, enter the following cmdlet: - -```PowerShell -Add-AppVClientPackage -Path C:\Packages\Contoso\MyApp.appv -DynamicDeploymentConfiguration C:\Packages\Contoso\DynamicConfigurations\deploymentconfig.xml -``` - ->[!NOTE] ->This command captures the resulting object into $pkg. If the package is already present on the computer, you can use the **Set-AppVclientPackage** cmdlet to apply the deployment configuration document: -> -> ```PowerShell -> Set-AppVClientPackage -Name Myapp -Path C:\Packages\Contoso\MyApp.appv -DynamicDeploymentConfiguration C:\Packages\Contoso\DynamicConfigurations\deploymentconfig.xml -> ``` - - - - - -## Related articles - -* [Operations for App-V](appv-operations.md) diff --git a/windows/application-management/app-v/appv-apply-the-user-configuration-file-with-powershell.md b/windows/application-management/app-v/appv-apply-the-user-configuration-file-with-powershell.md deleted file mode 100644 index 9d78748d49..0000000000 --- a/windows/application-management/app-v/appv-apply-the-user-configuration-file-with-powershell.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: How to apply the user configuration file by using Windows PowerShell (Windows 10/11) -description: How to apply the user configuration file by using Windows PowerShell (Windows 10/11). -author: aczechowski -ms.prod: windows-client -ms.date: 06/15/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.technology: itpro-apps ---- -# How to apply the user configuration file by using Windows PowerShell - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -When you publish a package to a specific user, you'll also need to specify a dynamic user configuration file to tell that package how to run. - -## Apply a user configuration file - -Here's how to specify a user-specific configuration file: - -> [!NOTE] -> The following example cmdlets use this example file path for its package: -> -> * C:\\Packages\\Contoso\\MyApp.appv. -> -> If your package file uses a different file path than the example, feel free to replace it as needed. - -1. Enter the following cmdlet in Windows PowerShell to add the package to the computer: - - ```PowerShell - Add-AppVClientPackage C:\Packages\Contoso\MyApp.appv - ``` -2. Enter the following cmdlet to publish the package to the user and specify the updated the dynamic user configuration file: - - ```PowerShell - Publish-AppVClientPackage $pkg -DynamicUserConfigurationPath C:\Packages\Contoso\config.xml - ``` - - - - - -## Related articles - -* [Operations for App-V](appv-operations.md) diff --git a/windows/application-management/app-v/appv-auto-batch-sequencing.md b/windows/application-management/app-v/appv-auto-batch-sequencing.md deleted file mode 100644 index c8a8e980b5..0000000000 --- a/windows/application-management/app-v/appv-auto-batch-sequencing.md +++ /dev/null @@ -1,103 +0,0 @@ ---- -title: Automatically sequence multiple apps at the same time using Microsoft Application Virtualization Sequencer (App-V Sequencer) (Windows 10/11) -description: How to automatically sequence multiple apps at the same time using Microsoft Application Virtualization Sequencer (App-V Sequencer). -author: aczechowski -ms.prod: windows-client -ms.date: 04/18/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.technology: itpro-apps ---- -# Automatically sequence multiple apps at the same time using Microsoft Application Virtualization Sequencer (App-V Sequencer) - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -Sequencing multiple apps at the same time requires you to install and start Microsoft Application Virtualization Sequencer (App-V Sequencer), and to install the necessary apps to collect any changes made to the operating system during the installation and building of the App-V package. - -Starting with Windows 10 version 1703, running the App-V Sequencer automatically captures and stores your customizations as an App-V project template (.appvt) file. If you want to make changes to this package later, your customizations will be automatically loaded from this template file. This automatic customization load is applicable to all of the sequencing scenarios: - -- Using the **New-BatchAppVSequencerPackages** cmdlet -- Using the App-V Sequencer interface -- Using the **New-AppVSequencerPackage** cmdlet - ->[!NOTE] ->If you're trying to update multiple apps at the same time, see [Automatically update multiple apps at the same time using Microsoft Application Virtualization Sequencer (App-V Sequencer)](appv-auto-batch-updating.md). - -### Sequence multiple apps with a PowerShell cmdlet - -Sequencing multiple apps at the same time requires that you create a **ConfigFile** with info related to each round of sequencing. This file is then used by the cmdlet to start the VM at a "clean" checkpoint, to copy the installer from the Host device to the VM, and then to start the App-V Sequencer to monitor your specified app installations. - -#### Create your ConfigFile for use by the PowerShell cmdlet - -1. Determine the apps that need to be included in your App-V sequencing package, and then open a text editor, such as Notepad. - -2. Add the following required XML info for each app: - - - ``````. The name of the app you're adding to the package. - - ``````. The file path to the folder with the app installer. - - ``````. The file name for the app executable. This file will typically be an .exe or .msi file. - - ``````. The command-line options required for the app installation. - - ``````. The maximum amount of time, in minutes, that the cmdlet should wait for sequencing to complete. You can enter a different value for each app, based on the size and complexity of the app itself. - - ``````. Determines whether the sequencer uses the cmdlet or the App-V Sequencer interface. **True** tells the sequencer to use cmdlet-based sequencing, while **False** tells the sequencer to use the App-V Sequencer interface. You can use both the cmdlet and the interface together in the same ConfigFile, for different apps. - - ``````. Indicates whether the app should be sequenced. **True** includes the app, while **False** ignores it. You can include as many apps as you want in the batch file, but optionally enable only a few of them. - - **Example:** - - ```XML - - - - Skype for Windows - D:\Install\New\SkypeforWindows - SkypeSetup.exe - /S - 20 - True - True - - - Power BI - D:\Install\New\MicrosoftPowerBI - PBIDesktop.msi - /S - 20 - True - True - - - - ``` -3. Save your completed file, using the name **ConfigFile**. - -#### Start the App-V Sequencer interface and app installation process - -Open PowerShell as an admin on the Host computer and run the following commands to start the batch sequencing: - -```PowerShell -New-BatchAppVSequencerPackages –ConfigFile –VMName -OutputPath -``` - -Where `````` is the name of the virtual machine (VM) with the App-V Sequencer installed, where you'll run the batch sequencing, and `````` is the full path to where the sequenced packages should be copied. - -The cmdlet creates a "clean" checkpoint on the VM. Next, the cmdlet copies the first app installer listed in the ConfigFile from the Host computer to the VM, and finally a new session of the VM opens (through VMConnect) and sequencing of the app begins from the command-line. After the sequencing and package creation for the first app on the VM is completed, the package is copied from the VM to the Host computer, specified in the *OutputPath* parameter. The cmdlet then goes to the second app on your list, reverting the VM back to a "clean" checkpoint and running through all of the steps again, until the second app package is copied to your output folder. This process continues until all apps included in your list are done. After the last app, the VM is reverted back to a "clean" checkpoint and turned off. - -### Review the log files - -There are three types of log files that occur when you sequence multiple apps at the same time: - -- **New-BatchAppVSequencerPackages-<*time_stamp*>.txt**. Located in the %temp%\AutoSequencer\Logs directory. This log contains info about the sequencing activities for each app, such as "Copying installer to VM," "Scheduling sequencing task," and so on. Additionally, if an app times out, this log contains the failure along with the checkpoint for troubleshooting the problem. -- **New-BatchAppVSequencerPackages-report-<*time_stamp*>.txt**. Located in the **OutputPath** folder you specified earlier. This log contains info about the connections made to the VM, showing if there were any failures. Additionally, it briefly includes success or failure info for all of the apps. -- **Log.txt file**. Located in the **Output Package** folder. This file contains all code included in the NewAppVSequencerPackage cmdlet, including the allowed parameters. - -### Related articles - -- [Download the Windows ADK](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit) -- [How to install the App-V Sequencer](appv-install-the-sequencer.md) -- [Learn about Hyper-V on Windows Server 2016](/windows-server/virtualization/hyper-v/Hyper-V-on-Windows-Server) -- [Automatically provision your sequencing environment using Microsoft Application Virtualization Sequencer (App-V Sequencer)](appv-auto-provision-a-vm.md) -- [Manually sequence a single app using Microsoft Application Virtualization Sequencer (App-V Sequencer)](appv-sequence-a-new-application.md) -- [Automatically update multiple apps at the same time using Microsoft Application Virtualization Sequencer (App-V Sequencer)](appv-auto-batch-updating.md) -- [Automatically clean up unpublished packages on the App-V client](appv-auto-clean-unpublished-packages.md) diff --git a/windows/application-management/app-v/appv-auto-batch-updating.md b/windows/application-management/app-v/appv-auto-batch-updating.md deleted file mode 100644 index 42e883d6c6..0000000000 --- a/windows/application-management/app-v/appv-auto-batch-updating.md +++ /dev/null @@ -1,157 +0,0 @@ ---- -title: Automatically update multiple apps at the same time using Microsoft Application Virtualization Sequencer (App-V Sequencer) (Windows 10/11) -description: How to automatically update multiple apps at the same time using Microsoft Application Virtualization Sequencer (App-V Sequencer). -author: aczechowski -ms.prod: windows-client -ms.date: 04/18/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.technology: itpro-apps ---- -# Automatically update multiple apps at the same time using Microsoft Application Virtualization Sequencer (App-V Sequencer) - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -Updating multiple apps at the same time follows a similar process to the one used for [automatically sequencing multiple apps at the same time](appv-auto-batch-sequencing.md). However, when updating, you'll also have to pass your previously created app package files to the App-V Sequencer cmdlet. - -Starting with Windows 10 version 1703, running the New-BatchAppVSequencerPackages cmdlet or the App-V Sequencer interface captures and stores all of your customizations as an App-V project template. If you want to make changes to this package later, your customizations are automatically loaded from this template file. - ->[!NOTE] ->If you're trying to sequence multiple apps at the same time, see [Automatically sequence multiple apps at the same time using Microsoft Application Virtualization Sequencer (App-V Sequencer)](appv-auto-batch-sequencing.md). - -## Update multiple apps with a PowerShell cmdlet - -Updating multiple apps at the same time requires that you create a **ConfigFile** with info related to each round of updating. This file is then used by the cmdlet to start the VM at a "clean" checkpoint, to copy the installer from the Host device to the VM, and then to start the App-V Sequencer to monitor your specified app installations. - -### Create your ConfigFile for use by the PowerShell cmdlet - -1. Determine the apps that need to be included in your app package, and then open a text editor, such as Notepad. - -2. Add the following XML info for each app: - - - ``````. The name of the app you're adding to the package. - - ``````. The file path to the folder with the app installer. - - ``````. The file name for the app executable. This file will typically be an .exe or .msi file. - - ``````. The command-line options required for the app installation. - - ``````. The file path to the location of your App-V packages. These packages were created when you sequenced your apps. - - ``````. The maximum amount of time, in minutes, that the cmdlet should wait for updating to complete. You can enter a different value for each app, based on the size and complexity of the app itself. - - ``````. Determines whether the sequencer uses the cmdlet or the App-V Sequencer interface. **True** tells the sequencer to use cmdlet-based updating, while **False** tells the sequencer to use the App-V Sequencer interface. You can use both the cmdlet and the interface together in the same ConfigFile, for different apps. - - ``````. Indicates whether the app should be sequenced. **True** includes the app, while **False** ignores it. You can include as many apps as you want in the batch file, but optionally enable only a few of them. - - **Example:** - ```XML - - - - Skype for Windows Update - D:\Install\Update\SkypeforWindows - SkypeSetup.exe - /S - C:\App-V_Package\Microsoft_Apps\skypeupdate.appv - 20 - true - true - - - Microsoft Power BI Update - D:\Install\Update\PowerBI - PBIDesktop.msi - /S - C:\App-V_Package\MS_Apps\powerbiupdate.appv - 20 - true - true - - - ``` - -3. Save your completed file under the name **ConfigFile**. - -### Start the App-V Sequencer interface and app installation process - -- Open PowerShell as an admin on the Host computer and run the following commands to start the batch updating: - - ```PowerShell - New-BatchAppVSequencerPackages –ConfigFile –VMName -OutputPath - ``` - Where `````` is the name of the virtual machine (VM) with the App-V Sequencer installed that you'll run the batch updating on, and `````` is the full path to where the updated packages should be copied. - - The cmdlet creates a "clean" checkpoint on the VM. After the checkpoint is created, the cmdlet copies the first app installer listed in the ConfigFile from the Host computer to the VM. This copy-operation opens a new session of the VM (through VMConnect), allowing app updates to begin from the command-line. After the update and package creation for the first app on the VM is completed, the package is copied from the VM to the Host computer, specified in the OutputPath parameter. The cmdlet then goes to the second app on your list, reverting the VM back to a "clean" checkpoint and running through all of the steps again, until the second app package is copied to your output folder. This process continues until all apps included in your list are done. After the last app, the VM is reverted back to a "clean" checkpoint and turned off. - -## Update multiple apps with the App-V Sequencer interface - -Updating multiple apps at the same time requires that you create a **ConfigFile** to collect all of the info related to each round of updating. This file is then used by the App-V Sequencer interface after creating a "clean" checkpoint on your VM. - -### Create your ConfigFile for use by the App-V Sequencer interface - -1. Determine the apps that need to be updated and then open a text editor, such as Notepad. - -2. Add the following XML info for each app: - - - ``````. The name of the app you're adding to the package. - - ``````. The file path to the folder with the app installer. - - ``````. The file name for the app executable. This file will typically be an .exe or .msi file. - - ``````. The file path to the location of your App-V packages. These packages were created when you sequenced your apps. - - ``````. The maximum amount of time, in minutes, the cmdlet should wait for updating to complete. You can enter a different value for each app, based on the size and complexity of the app itself. - - ``````. Determines whether the sequencer uses the cmdlet or the App-V Sequencer interface. **True** tells the sequencer to use cmdlet-based updating, while **False** tells the sequencer to use the App-V Sequencer interface. You can use both the cmdlet and the interface together in the same ConfigFile, for different apps. - - ``````. Indicates whether the app should be sequenced. **True** includes the app, while **False** ignores it. You can include as many apps as you want in the batch file, but optionally enable only a few of them. - - **Example:** - - ```XML - - - - Skype for Windows Update - D:\Install\Update\SkypeforWindows - SkypeSetup.exe - /S - C:\App-V_Package\Microsoft_Apps\skypeupdate.appv - 20 - false - true - - - Microsoft Power BI Update - D:\Install\Update\PowerBI - PBIDesktop.msi - /S - C:\App-V_Package\MS_Apps\powerbiupdate.appv - 20 - false - true - - - ``` - -### Start the App-V Sequencer interface and app installation process - -- Open PowerShell as an admin on the Host computer and run the following commands to start the batch updating: - - ```PowerShell - New-BatchAppVSequencerPackages –ConfigFile –VMName -OutputPath - ``` - Where `````` is the name of the virtual machine (VM) with the App-V Sequencer installed, where you'll run the batch updating, and `````` is the full path to where the updated packages should be copied. - - This cmdlet creates a "clean" checkpoint on the VM. After the checkpoint is created, the cmdlet copies the first app installer listed in the ConfigFile from the Host computer to the VM. This opens a new session of the VM (through VMConnect) and app updating begins from the command-line. After the updating and package creation for the first app on the VM is completed, the package is copied from the VM to the Host computer specified in the *OutputPath* parameter. The cmdlet then goes to the second app on your list, reverting the VM back to a "clean" checkpoint and running through all of the steps again, until the second app package is copied to your output folder. This process continues until all apps included in your list are done. After the last app, the VM is reverted to a "clean" checkpoint and turned off. - -### Review the log files - -There are three types of log files that occur when you sequence multiple apps at the same time: - -- **New-BatchAppVSequencerPackages-<*time_stamp*>.txt**. Located in the %temp%\AutoSequencer\Logs directory. This log contains info about updating activities for each app, such as "Copying installer to VM," "Scheduling updating task," and so on. Additionally, if an app times out, this log contains the failure along with the checkpoint for troubleshooting the problem. -- **New-BatchAppVSequencerPackages-report-<*time_stamp*>.txt**. Located in the **OutputPath** folder you specified earlier. This log contains info about the connections made to the VM, showing if there were any failures. Additionally, it briefly includes success or failure info for all of the apps. -- **Log.txt file**. Located in the **Output Package** folder. This file contains all code included in the **NewAppVSequencerPackage** cmdlet, including the allowed parameters. - -### Related articles - -- [Download the Windows ADK](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit) -- [How to install the App-V Sequencer](appv-install-the-sequencer.md) -- [Learn about Hyper-V on Windows Server 2016](/windows-server/virtualization/hyper-v/Hyper-V-on-Windows-Server) -- [Automatically provision your sequencing environment using Microsoft Application Virtualization Sequencer (App-V Sequencer)](appv-auto-provision-a-vm.md) -- [Manually sequence a single app using Microsoft Application Virtualization Sequencer (App-V Sequencer)](appv-sequence-a-new-application.md) -- [Automatically sequence multiple apps at the same time using Microsoft Application Virtualization Sequencer (App-V Sequencer)](appv-auto-batch-sequencing.md) -- [Automatically cleanup unpublished packages on the App-V client](appv-auto-clean-unpublished-packages.md) diff --git a/windows/application-management/app-v/appv-auto-clean-unpublished-packages.md b/windows/application-management/app-v/appv-auto-clean-unpublished-packages.md deleted file mode 100644 index f73f89ee26..0000000000 --- a/windows/application-management/app-v/appv-auto-clean-unpublished-packages.md +++ /dev/null @@ -1,65 +0,0 @@ ---- -title: Auto-remove unpublished packages on App-V client (Windows 10/11) -description: How to automatically clean up any unpublished packages on your App-V client devices. -author: aczechowski -ms.prod: windows-client -ms.date: 06/15/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.technology: itpro-apps ---- -# Automatically clean up unpublished packages on the App-V client - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -If you wanted to free up additional storage space in previous versions of App-V, you would have had to manually remove your unpublished packages from your client devices. Starting with Windows 10 version 1703, use PowerShell or Group Policy settings to automatically clean up your unpublished packages after restarting your device. - -## Clean up with PowerShell cmdlets - -You can enter PowerShell cmdlets to turn on the **AutoCleanupEnabled** setting, which will automatically clean up your unpublished App-V packages from your App-V client devices. - -### Turn on the AutoCleanupEnabled option - -1. Open PowerShell as an admin and enter the following cmdlet to turn on the automatic package cleanup functionality: - - ```PowerShell - Set-AppvClientConfiguration -AutoCleanupEnabled 1 - ``` - - After running the cmdlet, you should see the following info on the PowerShell screen: - - |Name|Value|SetbyGroupPolicy| - |---|---|---| - |AutoCleanupEnabled|1|False| - -1. Run the following cmdlet to check if the configuration has the cleanup setting turned on. - - ```PowerShell - Get-AppvClientConfiguration - ``` - If the **AutoCleanupEnabled** option shows a value of **1** in the configuration list, that means the setting is turned on. - -## Clean up with Group Policy settings - -Using Group Policy, you can turn on the **Enable automatic cleanup of unused App-V packages** setting to automatically clean up your unpublished App-V packages from your App-V client devices. - -### Turn on the Enable automatic cleanup of unused App-V packages setting - -1. Open your Group Policy editor and select the **Administrative Templates\System\App-V\PackageManagement\Enable automatic cleanup of unused App-V packages** setting. - -2. Select **Enabled**, then select **OK**. - - After your Group Policy updates and you reset the client, the setting will clean up any unpublished App-V packages on the App-V client. - - - - - -## Related articles - -- [Download the Windows ADK](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit) -- [Deploying App-V for Windows client](appv-deploying-appv.md) -- [Using the App-V Client Management Console](appv-using-the-client-management-console.md) diff --git a/windows/application-management/app-v/appv-auto-provision-a-vm.md b/windows/application-management/app-v/appv-auto-provision-a-vm.md deleted file mode 100644 index 0f09ca265b..0000000000 --- a/windows/application-management/app-v/appv-auto-provision-a-vm.md +++ /dev/null @@ -1,129 +0,0 @@ ---- -title: Automatically provision your sequencing environment using Microsoft Application Virtualization Sequencer (App-V Sequencer) (Windows 10/11) -description: How to automatically provision your sequencing environment using Microsoft Application Virtualization Sequencer (App-V Sequencer) PowerShell cmdlet or the user interface. -author: aczechowski -ms.prod: windows-client -ms.date: 04/18/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.technology: itpro-apps ---- -# Automatically provision your sequencing environment using Microsoft Application Virtualization Sequencer (App-V Sequencer) - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -Previous versions of the App-V Sequencer have required you to manually create your sequencing environment. Starting with Windows 10 version 1703, the `New-AppVSequencerVM` and `Connect-AppvSequencerVM` Windows PowerShell cmdlets are available, which automatically create your sequencing environment for you, including provisioning your virtual machine. - -## Automatic VM provisioning of the sequencing environment - -You have two options for provisioning a VM for auto-sequencing: - -1. Using a Virtual Hard Disk (VHD) -2. Updating an existing VM - -You can only choose one option. - ->[!NOTE] ->We have reduced the number of environmental checks performed by the App-V Sequencer, narrowing down the list of apps that need to be disabled or turned off for a clean sequencing experience. We've also suppressed antivirus and other similar app warnings. - -### Provision a new VM with a VHD file - -Provisioning your new VM includes creating a VHD file, setting up a user account, turning on remote PowerShell scripting, and installing the App-V Sequencer. - -#### Create a VHD file - -For this process to work, you must have a base operating system available as a VHD image file, we recommend using the [Convert-WindowsImage.ps1](https://www.powershellgallery.com/packages/Convert-WindowsImage/10.0) command-line tool. - -#### Create a VHD file with the Convert-WindowsImage command-line tool - -1. Open PowerShell as an admin and run the **Convert-WindowsImage** tool, using the following commands: - - ```ps1 - Convert-WindowsImage -SourcePath "" -VHDFormat "VHD" -VHDPartitionStyle "MBR" - ``` - Where `````` is the full path to your ISO image. - ->[!IMPORTANT] ->You must specify the *VHDPartitionStyle* as **MBR**. If you use the default value, **GPT**, will cause a boot failure in your VHD image. - -#### Provision your VM with your VHD file - -After you have a VHD file, you must provision your VM for auto-sequencing. - -1. On the Host device, install the Windows client and the **Microsoft Application Virtualization (App-V) Auto Sequencer** component from the matching version of the Windows Assessment and Deployment Kit (ADK). For more info on how to install the App-V Sequencer, see [Install the App-V Sequencer](appv-install-the-sequencer.md). -2. Make sure that Hyper-V is turned on. For more info about turning on and using Hyper-V, see [Hyper-V on Windows Server 2016](/windows-server/virtualization/hyper-v/Hyper-V-on-Windows-Server). -3. Open PowerShell as an admin and run the **New-AppVSequencerVM** cmdlet, using the following parameters: - - ```PowerShell - New-AppVSequencerVM -VMName "" -ADKPath "" -VHDPath "" -VMMemory "" -VMSwitch "" - ``` - - This command creates a new Hyper-V VM file using the provided VHD file and also creates a "clean" checkpoint, from where all sequencing and updating will start. - -### Provision an existing VM for auto-sequencing - -If your apps require custom prerequisites, such as Microsoft SQL Server, we recommend that you preinstall the prerequisites on your VM and then use that VM for auto-sequencing. Using these steps will establish a connection to your existing VM. - -#### Connect to your existing VM - -- Open PowerShell as an admin and run the following commands on your existing VM: - - - **Set the network category of your connection profile on the VM to _Private_:** - - ```PowerShell - Get-netconnectionprofile | set-netconnectionprofile -NetworkCategory Private - ``` - - - **Enable firewall rules for _Remote Desktop_ and _Windows Remote Management_:** - - ```PowerShell - Enable-NetFirewallRule -DisplayGroup “Remote Desktop” - Enable-NetFirewallRule -DisplayGroup “Windows Remote Management” - ``` - - - **Set the VM to receive remote commands without a confirmation prompt:** - - ```PowerShell - Enable-PSRemoting –Force - ``` - -#### Provision an existing VM - -1. On the Host device, install the Windows client and the **Microsoft Application Virtualization (App-V) Auto Sequencer** component from the matching version of the Windows Assessment and Deployment Kit (ADK). For more info on how to install the App-V Sequencer, see [Install the App-V Sequencer](appv-install-the-sequencer.md). - -2. Open PowerShell as an admin and run the **Connect-AppvSequencerVM** cmdlet, using the following parameters: - - ```ps1 - Connect-AppvSequencerVM -VMName "" - ``` - - Where `````` is the name of the VM as shown in the Hyper-V Manager tool. - -This command connects to an existing Hyper-V VM using the provided VM name for auto-sequencing. - -### Review the provisioning log files - -The two types of provisioning log files, located at %temp%\AutoSequencer\Logs, are: - -- **New-AppVSequencerVM-.txt**. Includes info about the provisioning activities, such as "Waiting for VM session", "Copying installer for Sequencer", and so on. -- **Connect-AppvSequencerVM-report-.txt**. Includes info about the connections made to the VM, showing whether there were any failures. - -### Next steps - -After provisioning your sequencing environment, you must sequence your apps, either as a group or individually. For more info about sequencing your apps, see the following articles - -- [Manually sequence a single new app using Microsoft Application Virtualization Sequencer (App-V Sequencer)](appv-sequence-a-new-application.md) -- [Automatically sequence multiple apps at the same time using Microsoft Application Virtualization Sequencer (App-V Sequencer)](appv-auto-batch-sequencing.md) -- [Automatically update multiple apps at the same time using Microsoft Application Virtualization Sequencer (App-V Sequencer)](appv-auto-batch-updating.md) - -After you sequence your packages, you can automatically clean up any unpublished packages on the App-V client. To learn more, see [Automatically clean up unpublished packages on the App-V client](appv-auto-clean-unpublished-packages.md). - -### Related articles - -- [Download the **Convert-WindowsImage** tool](https://www.powershellgallery.com/packages/Convert-WindowsImage/10.0) -- [Download the Windows ADK](/windows-hardware/get-started/adk-install) -- [How to install the App-V Sequencer](appv-install-the-sequencer.md) -- [Learn about Hyper-V on Windows Server 2016](/windows-server/virtualization/hyper-v/Hyper-V-on-Windows-Server) diff --git a/windows/application-management/app-v/appv-available-mdm-settings.md b/windows/application-management/app-v/appv-available-mdm-settings.md deleted file mode 100644 index e869fd86fb..0000000000 --- a/windows/application-management/app-v/appv-available-mdm-settings.md +++ /dev/null @@ -1,34 +0,0 @@ ---- -title: Available Mobile Device Management (MDM) settings for App-V (Windows 10/11) -description: Learn the available Mobile Device Management (MDM) settings you can use to configure App-V on Windows 10. -author: aczechowski -ms.prod: windows-client -ms.date: 06/15/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.technology: itpro-apps ---- -# Available Mobile Device Management (MDM) settings for App-V - -Starting with Windows 10 version 1703, you can configure, deploy, and manage your App-V apps with the following Mobile Device Management (MDM) settings. For the full list of available settings, see the [EnterpriseAppVManagement CSP](/windows/client-management/mdm/enterpriseappvmanagement-csp) page. - -|Policy name|Supported versions|URI full path|Data type|Values| -|---|---|---|---|---| -|Name|Windows 10/11|./Vendor/MSFT/EnterpriseAppVManagement/ AppVPackageManagement// //Name|String|Read-only data, provided by your App-V packages.| -|Version|Windows 10/11|./Vendor/MSFT/EnterpriseAppVManagement/ AppVPackageManagement// //Version|String|Read-only data, provided by your App-V packages.| -|Publisher|Windows 10/11|./Vendor/MSFT/EnterpriseAppVManagement/ AppVPackageManagement// //Publisher|String|Read-only data, provided by your App-V packages.| -|InstallLocation|Windows 10/11|./Vendor/MSFT/EnterpriseAppVManagement/ AppVPackageManagement// //InstallLocation|String|Read-only data, provided by your App-V packages.| -|InstallDate|Windows 10/11|./Vendor/MSFT/EnterpriseAppVManagement/ AppVPackageManagement// //InstallDate|String|Read-only data, provided by your App-V packages.| -|Users|Windows 10/11|./Vendor/MSFT/EnterpriseAppVManagement/ AppVPackageManagement// //Users|String|Read-only data, provided by your App-V packages.| -|AppVPackageID|Windows 10/11|./Vendor/MSFT/EnterpriseAppVManagement/ AppVPackageManagement// //AppVPackageID|String|Read-only data, provided by your App-V packages.| -|AppVVersionID|Windows 10/11|./Vendor/MSFT/EnterpriseAppVManagement/ AppVPackageManagement// //AppVVersionID|String|Read-only data, provided by your App-V packages.| -|AppVPackageUri|Windows 10/11|./Vendor/MSFT/EnterpriseAppVManagement/ AppVPackageManagement// //AppVPackageUri|String|Read-only data, provided by your App-V packages.| -|LastError|Windows 10/11|./Vendor/MSFT/EnterpriseAppVManagement/
                        AppVPublishing/LastSync/LastError|String|Read-only data, provided by your App-V packages.| -|LastErrorDescription|Windows 10/11|./Vendor/MSFT/EnterpriseAppVManagement/ AppVPublishing/LastSync/LastErrorDescription|String|- **0**: No errors returned during publish.
                        - **1**: Unpublish groups failed during publish.
                        - **2**: Publish no-group packages failed during publish.
                        - **3**: Publish group packages failed during publish.
                        - **4**: Unpublish packages failed during publish.
                        - **5**: New policy write failed during publish.
                        - **6**: Multiple non-fatal errors occurred during publish.| -|SyncStatusDescription|Windows 10/11|./Vendor/MSFT/EnterpriseAppVManagement/ AppVPublishing/LastSync/SyncStatusDescription|String|- **0**: App-V publishing is idle.
                        - **1**: App-V connection groups publish in progress.
                        - **2**: App-V packages (non-connection group) publish in progress.
                        - **3**: App-V packages (connection group) publish in progress.
                        - **4**: App-V packages unpublish in progress.| -|SyncProgress|Windows 10/11|./Vendor/MSFT/EnterpriseAppVManagement/ AppVPublishing/LastSync/SyncProgress|String|- **0**: App-V Sync is idle.
                        - **1**: App-V Sync is initializing.
                        - **2**: App-V Sync is in progress.
                        - **3**: App-V Sync is complete.
                        - **4**: App-V Sync requires device reboot.| -|PublishXML|Windows 10/11|./Vendor/MSFT/EnterpriseAppVManagement/
                        AppVPublishing/Sync/PublishXML|String|Custom value, entered by admin.| -|Policy|Windows 10/11|./Vendor/MSFT/EnterpriseAppVManagement/
                        AppVDynamicPolicy/configurationid/Policy|String|Custom value, entered by admin.| diff --git a/windows/application-management/app-v/appv-capacity-planning.md b/windows/application-management/app-v/appv-capacity-planning.md deleted file mode 100644 index 2b7edc6c54..0000000000 --- a/windows/application-management/app-v/appv-capacity-planning.md +++ /dev/null @@ -1,198 +0,0 @@ ---- -title: App-V Capacity Planning (Windows 10/11) -description: Use these recommendations as a baseline to help determine capacity planning information that is appropriate to your organization’s App-V infrastructure. -author: aczechowski -ms.prod: windows-client -ms.date: 04/18/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.technology: itpro-apps ---- -# App-V Capacity Planning - ->Applies to: Windows Server 2016 - -The following recommendations can be used as a baseline to help determine capacity planning information that is appropriate to your organization’s App-V infrastructure. - ->[!IMPORTANT] ->Use the information in this section only as a general guide for planning your App-V deployment. Your system capacity requirements will depend on the specific details of your hardware and application environment. Additionally, the performance numbers displayed in this document are examples and your results may vary. - -## Determine the project scope - -Before you design the App-V infrastructure, determining which applications will be available virtually, and also identify the target users and their locations. This information will determine what type of App-V infrastructure your project should implement. You should base your decisions about your project's scope on your organization's specific needs. - -|Task|More information| -|----|----------------| -|Determine application scope|The App-V infrastructure can be set up in different ways depending on which applications you want to virtualize. This customization in set up means your first task is to define which applications you want to virtualize.| -|Determine location scope|"Location scope" refers to the physical locations where you plan to run the virtualized applications (for example, enterprise-wide or a specific geographic location). It can also refer to the user population that will run the virtual applications (for example, a single department). You should obtain a network map that includes the connection paths, the available bandwidth for each location, the number of users using virtualized applications, and the WAN link speed.| - -## Determine which App-V infrastructure is required - -You can also manage your App-V environment using an electronic software distribution (ESD) solution such as Microsoft Systems Center Configuration Manager. For more information, see [How to deploy App-V packages using electronic software distribution](appv-deploy-appv-packages-with-electronic-software-distribution-solutions.md). - -* **Standalone model**—The standalone model allows virtual applications to be Windows Installer-enabled for distribution without streaming. App-V in Standalone mode only needs the sequencer and the client; no extra components are required. Applications are prepared for virtualization using a process called sequencing. For more information, see [Planning for the App-V Sequencer and Client deployment](appv-planning-for-sequencer-and-client-deployment.md). The standalone model is recommended for the following scenarios: - - * When there are disconnected remote users who can't connect to the App-V infrastructure. - * When you're running a software management system, such as Configuration Manager. - * When network bandwidth limitations inhibit electronic software distribution. -* **Full infrastructure model**—The full infrastructure model provides for software distribution, management, and reporting capabilities; it also includes the streaming of applications across the network. The App-V full infrastructure model consists of one or more App-V management servers that can be used to publish applications to all clients. Publishing places the virtual application icons and shortcuts on the target computer. It can also stream applications to local users. For more information about how to install the management server, see [Planning for App-V Server deployment](appv-planning-for-appv-server-deployment.md). The full infrastructure model is recommended for the following scenarios: - - * When you want to use the Management Server to publish the application to target computers. - * For rapid provisioning of applications to target computers. - * When you want to use App-V reporting. - ->[!IMPORTANT] ->The App-V full infrastructure model requires Microsoft SQL Server to store configuration data. For more information, see [App-V supported configurations](appv-supported-configurations.md). - -## End-to-end server sizing guidance - -The following section describes end-to-end App-V sizing and planning. For more specific information, refer to the subsequent sections. - ->[!NOTE] ->Round trip response time on the client is the time taken by the computer running the App-V client to receive a successful notification from the publishing server. Round trip response time on the publishing server is the time taken by the computer running the publishing server to receive a successful package metadata update from the management server. - -* 20,000 clients can target a single publishing server to obtain the package refreshes in an acceptable round trip time (<3 seconds). -* A single management server can support up to 50 publishing servers for package metadata refreshes in an acceptable round trip time (<5 seconds). - -## App-V Management Server capacity planning recommendations - -The App-V publishing servers require the management server for package refresh requests and package refresh responses. The management server then sends the information to the management database to retrieve information. For more information about App-V management server supported configurations, see [App-V supported configurations](appv-supported-configurations.md). - ->[!NOTE] ->The default refresh time on the App-V publishing server is ten minutes. - -When multiple simultaneous publishing servers contact a single management server for package metadata refreshes, the following three factors will influence the publishing server's round-trip response time: - -1. The number of publishing servers making simultaneous requests. -2. The number of connection groups configured on the management server. -3. The number of access groups configured on the management server. - -The following table describes each factor that impacts round-trip time in more detail. - ->[!NOTE] ->Round trip response time is the time taken by the computer running the App-V publishing server to receive a successful package metadata update from the management server. - -|Factors impacting round-trip response time|Description| -|------------------------------------------|-----------| -|The number of publishing servers simultaneously requesting package metadata refreshes.|A single management server can respond to up to 320 publishing servers simultaneously requesting publishing metadata. For example, in a case with 30 publishing servers simultaneously requesting publishing metadata, the round-trip response time is about 40 seconds, while for less than 50 servers it's less than 5 seconds. From 50 to 320 publishing servers, response team increases linearly (approximately 2×).| -|The number of connection groups configured on the management server.|For up to 100 connection groups, there's no significant change in the round-trip response time on the publishing server. For 100–400 connection groups, there's a minor linear increase in the round-trip response time.| -|The number of access groups configured on the management server.|For up to 40 access groups, there's a linear (approximately 3×) increase in the round-trip response time on the publishing server.| - -The following table displays sample values for each of the previous factors. In each variation, 120 packages are refreshed from the App-V management server. - -|Scenario|Variation|Number of connection groups|Number of access groups|Number of publishing servers|Network connection type|Round-trip response time (seconds)|Management server CPU utilization| -|---|---|---|---|---|---|---|---| -|Publishing servers contact management server for publishing metadata at same time|Number of publishing servers.|0
                        0
                        0
                        0
                        0
                        0|1
                        1
                        1
                        1
                        1
                        1|50
                        100
                        200
                        300
                        315
                        320|LAN|5
                        10
                        19
                        32
                        30
                        37|17
                        17
                        17
                        15
                        17
                        15| -|Publishing metadata contains connection groups|Number of connection groups|10
                        20
                        100
                        150
                        300
                        400|1
                        1
                        1
                        1
                        1
                        1|100
                        100
                        100
                        100
                        100
                        100|LAN|10
                        11
                        11
                        16
                        22
                        25|17
                        19
                        22
                        19
                        20
                        20| -|Publishing metadata contains access groups|Number of access groups|0
                        0
                        0
                        0|1
                        10
                        20
                        40|100
                        100
                        100
                        100|LAN|10
                        43
                        153
                        535|17
                        26
                        24
                        24| - -The CPU utilization of the computer running the management server is around 25% irrespective of the number of publishing servers targeting it. The Microsoft SQL Server database transactions/sec, batch requests/sec and user connections are identical irrespective of the number of publishing servers. For example, transactions/sec is approximately 30, batch requests approximately 200, and user connects approximately six. - -Through a geographically distributed deployment, where the management server and publishing servers utilize a slow link network between them, the round-trip response time on the publishing servers is within acceptable time limits (<5 seconds), even for 100 simultaneous requests on a single management server. - -|Scenario|Variation|Number of connection groups|Number of access groups|Number of publishing servers|Network connection type|Round-trip response time (seconds)|Management server CPU utilization (in %)| -|---|---|---|---|---|---|---|---| -|Network connection between the publishing server and management server|1.5 Mbps Slow link Network|0
                        0|1
                        1|50
                        100|1.5 Mbps Cable DSL|4
                        5|1
                        2| -|Network connection between the publishing server and management server|LAN/WiFi Network|0
                        0|1
                        1|100
                        200|WiFi|11
                        20|15
                        17| - -Whether the management server and publishing servers are connected over a slow link network, or a high speed network, the management server can handle approximately 15,000 package refresh requests in 30 minutes. - -## App-V Reporting Server capacity planning recommendations - -App-V clients send reporting data to the reporting server. The reporting server then records the information in the Microsoft SQL Server database and returns a successful notification back to the computer running App-V client. For more information about the App-V Reporting Server's supported configurations, see [App-V supported configurations](appv-supported-configurations.md). - ->[!NOTE] ->Round-trip response time is the time taken by the computer running the App-V client to send the reporting information to the reporting server and receive a successful notification from the reporting server. - -|Scenario|Summary| -|---|---| -|Multiple App-V clients send reporting information to the reporting server simultaneously.|Round-trip response time from the reporting server is 2.6 seconds for 500 clients. Round-trip response time from the reporting server is 5.65 seconds for 1000 clients. Round-trip response time increases linearly depending on number of clients.| -|Requests per second processed by the reporting server.|A single reporting server and a single database can process a maximum of 139 requests per second. The average is 121 requests/second. With the help of two reporting servers that report to the same Microsoft SQL Server database, the average requests/second, like a single reporting server, is about 127, with a max of 278 requests/second. A single reporting server can process 500 concurrent/active connections. A single reporting server can process a maximum 1,500 concurrent connections.| -|Reporting database.|Lock contention on the computer running Microsoft SQL Server is the limiting factor for requests/second. Throughput and response time are independent of database size.| - -### Calculating random delay - -The random delay specifies the maximum delay (in minutes) for data to be sent to the reporting server. When the scheduled task is started, the client generates a random delay between **0** and **ReportingRandomDelay** and will wait the specified duration before sending data. - -*Random delay = 4 × number of clients/average requests per second*. - -Example: Random delay for 500 clients with 120 requests per second is *4 × 500/120 = about 17 minutes*. - -## App-V publishing server capacity planning recommendations - -Computers running the App-V client connect to the App-V publishing server to send a publishing refresh request and receive a response. Round trip response time is measured on the computer running the App-V client, while processor time is measured on the publishing server. For more information about App-V Publishing Server supported configurations, see [App-V supported configurations](appv-supported-configurations.md). - -> [!IMPORTANT] -> The following list displays the main factors to consider when setting up the App-V publishing server: -> * The number of clients connecting simultaneously to a single publishing server. -> * The number of packages in each refresh. -> * The available network bandwidth in your environment between the client and the App-V publishing server. - -|Scenario|Summary| -|---|---| -|Multiple App-V clients connect to a single publishing server simultaneously.|A publishing server running dual core processors can respond to at most 5000 clients requesting a refresh simultaneously. For 5,000–10,000 clients, the publishing server requires a minimum quad core. For 10,000–20,000 clients, the publishing server should have dual quad cores for more efficient response times. A publishing server with a quad core can refresh up to 10,000 packages within three seconds. (Supports 10,000 simultaneous clients.)| -|Number of packages in each refresh.|Increasing number of packages will increase response time by about 40% (up to 1,000 packages).| -|Network between the App-V client and the publishing server.|Across a slow network (1.5-Mbps bandwidth), there's a 97% increase in response time compared to LAN (up to 1,000 users).| - ->[!NOTE] ->The publishing server CPU usage is always high during the time interval when it must process simultaneous requests (>90% in most cases). The publishing server can handle about 1,500 client requests in one second. - -|Scenario|Variation|Number of App-V clients|Number of packages|Processor configuration on publishing server|Network connection type|App-V client round-trip time (in seconds)|Publishing server CPU utilization (in %)| -|---|---|---|---|---|---|---|---| -|App-V client sends publishing refresh request and receives response, each request containing 120 packages|Number of clients|100
                        1,000
                        5,000
                        10,000|120
                        120
                        120
                        120|Dual Core
                        Dual Core
                        Quad Core
                        Quad Core|LAN|1
                        2
                        2
                        3|100
                        99
                        89
                        77| -|Multiple packages in each refresh.|Number of packages|1,000
                        1,000|500
                        1,000|Quad Core|LAN|2
                        3|92
                        91| -|Network between client and publishing server.|1.5 Mbps Slow link network|100
                        500
                        1,000|120
                        120
                        120|Quad Core|1.5-Mbps intra-continental network|3
                        10 (0.2% failure rate)
                        7 (1% failure rate)|| - -## App-V streaming capacity planning recommendations - -Computers running the App-V client stream the virtual application package from the streaming server. Round trip response time is measured on the computer running the App-V client, and is the time taken to stream the entire package. - -> [!IMPORTANT] -> The following list identifies the main factors to consider when setting up the App-V streaming server: -> * The number of clients streaming application packages simultaneously from a single streaming server. -> * The size of the package being streamed. -> * The available network bandwidth in your environment between the client and the streaming server. - -|Scenario|Summary| -|---|---| -|Multiple App-V clients stream applications from a single streaming server simultaneously.|If the number of clients simultaneously streaming from the same server increases, there's a linear relationship with the package download/streaming time.| -|Size of the package being streamed.|The package size has a significant impact on the streaming/download time only for larger packages with a size of about 1 GB. For package sizes ranging from 3 MB to 100 MB, the streaming time ranges from 20 seconds to 100 seconds, with 100 simultaneous clients.| -|Network between the App-V client and the streaming server.|Across a slow network (1.5-Mbps bandwidth), there's a 70–80% increase in response time compared to LAN (up to 100 users).| - -The following table displays sample values for each of the factors in the previous list: - -|Scenario|Variation|Number of App-V clients|Size of each package|Network connection type|Round-trip time on the App-V client (in seconds)| -|---|---|---|---|---|---| -|Multiple App-V clients streaming virtual application packages from a streaming server.|Number of clients.|100
                        200
                        1,000
                        100
                        200
                        1,000|3.5 MB
                        3.5 MB
                        3.5 MB
                        5 MB
                        5 MB
                        5 MB|LAN|29
                        39
                        391
                        35
                        68
                        461| -|Size of each package being streamed.|Size of each package.|100
                        200
                        100
                        200|21 MB
                        21 MB
                        109 MB
                        109 MB|LAN|33
                        83
                        100
                        160| -|Network connection between client and App-V streaming server.|1.5 Mbps Slow link network.|100
                        100|3.5 MB
                        5 MB|1.5-Mbps intra-continental network|102
                        121| - -Each App-V streaming server should be able to handle a minimum of 200 clients concurrently streaming virtualized applications. - ->[!NOTE] ->The actual time to it will take to stream is determined primarily by the number of clients streaming simultaneously, number of packages, package size, the server’s network activity, and network conditions. - -For example, an average user can stream a 100-MB package in less than 2 minutes, when 100 simultaneous clients are streaming from the server. However, a package of size 1 GB could take up to 30 minutes. In most real-world environments, streaming demand isn't uniformly distributed, you'll need to understand the approximate peak streaming requirements present in your environment to properly size the number of required streaming servers. - -The number of clients a streaming server can support can be increased and the peak streaming requirements reduced if you pre-cache your applications. You can also increase the number of clients a streaming server can support by using on-demand streaming delivery and stream optimized packages. - -## Combining App-V server roles - -Discounting scaling and fault-tolerance requirements, the minimum number of servers that a location with Active Directory connectivity needs to function is 1. This server will host the management server, management server service, and Microsoft SQL Server roles. This coverage means that you can arrange server roles in any combination you like, as they don't conflict with one another. - -Notwithstanding scaling requirements, the minimum number of servers that a fault-tolerant implementation needs to function is four. The management server and Microsoft SQL Server roles support placement in fault-tolerant configurations. The management server service can be combined with any of the roles, but remains a single point of failure. - -Although there are many fault-tolerance strategies and technologies you can use, not all are applicable to a given service. Additionally, if App-V roles are combined, the resulting incompatibilities could cause certain fault-tolerance options to stop working. - - - - - -## Related articles - -* [App-V supported configurations](appv-supported-configurations.md) -* [Planning for high availability with App-V](appv-planning-for-high-availability-with-appv.md) -* [Planning to deploy App-V](appv-planning-to-deploy-appv.md) diff --git a/windows/application-management/app-v/appv-client-configuration-settings.md b/windows/application-management/app-v/appv-client-configuration-settings.md deleted file mode 100644 index d87457a13f..0000000000 --- a/windows/application-management/app-v/appv-client-configuration-settings.md +++ /dev/null @@ -1,114 +0,0 @@ ---- -title: About Client Configuration Settings (Windows 10/11) -description: Learn about the App-V client configuration settings and how to use Windows PowerShell to modify the client configuration settings. -author: aczechowski -ms.prod: windows-client -ms.date: 04/18/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.technology: itpro-apps ---- -# About Client Configuration Settings - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -The Microsoft Application Virtualization (App-V) client stores its configuration in the registry. Understanding how the register's format for data works can help you better understand the client, as you can configure many client actions by changing registry entries. This topic lists the App-V client configuration settings and explains their uses. You can use Windows PowerShell to modify the client configuration settings. For more information about using Windows PowerShell and App-V, see [Administering App-V by using Windows PowerShell](appv-administering-appv-with-powershell.md). - -You can use Group Policy to configure App-V client settings by navigating to the **Group Policy management console** at **Computer Configuration** > **Administrative Templates** > **System** > **App-V**. - -## App-V Client Configuration Settings: Windows PowerShell - -The following table provides information about App-V client configuration settings that can be configured through Windows PowerShell cmdlets: - - -| Windows PowerShell cmdlet or cmdlets,
                        **Option**
                        Type | Description | Disabled policy state keys and values | -|------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------| -| Set-AppvClientConfiguration,
                        Set-AppvPublishingServer

                        **-PackageInstallationRoot**
                        String | Specifies directory where all new applications and updates will be installed. | Policy value not written (same as Not Configured) | -| Set-AppvClientConfiguration,
                        Set-AppvPublishingServer

                        **-PackageSourceRoot**
                        String | Overrides source location for downloading package content. | Policy value not written (same as Not Configured) | -| Set-AppvClientConfiguration,
                        Set-AppvPublishingServer

                        **-AllowHighCostLaunch**
                        True (enabled); False (Disabled state) | This setting controls whether virtualized applications are launched on Windows client machines connected by a metered network connection (for example, 4G). | 0 | -| Set-AppvClientConfiguration,
                        Set-AppvPublishingServer

                        **-ReestablishmentRetries**
                        Integer (0–99) | Specifies the number of times to retry a dropped session. | Policy value not written (same as Not Configured) | -| Set-AppvClientConfiguration,
                        Set-AppvPublishingServer

                        **-ReestablishmentInterval**
                        Integer (0–3600) | Specifies the number of seconds between attempts to reestablish a dropped session. | Policy value not written (same as Not Configured) | -| Set-AppvClientConfiguration,
                        Set-AppvPublishingServer

                        **-LocationProvider**
                        String | Specifies the CLSID for a compatible implementation of the IAppvPackageLocationProvider interface. | Policy value not written (same as Not Configured) | -| Set-AppvClientConfiguration,
                        Set-AppvPublishingServer

                        **-CertFilterForClientSsl**
                        String | Specifies the path to a valid certificate in the certificate store. | Policy value not written (same as Not Configured) | -| Set-AppvClientConfiguration,
                        Set-AppvPublishingServer

                        **-VerifyCertificateRevocationList**
                        True (enabled); False (Disabled state) | Verifies Server certificate revocation status before streaming with HTTPS. | 0 | -| Set-AppvClientConfiguration,
                        Set-AppvPublishingServer

                        **-SharedContentStoreMode**
                        True (enabled); False (Disabled state) | Specifies that streamed package contents will not be saved to the local hard disk. | 0 | -| Set-AppvPublishingServer

                        **-Name**
                        String | Displays the name of publishing server. | Policy value not written (same as Not Configured) | -| Set-AppvPublishingServer

                        **-URL**
                        String | Displays the URL of publishing server. | Policy value not written (same as Not Configured) | -| Set-AppvPublishingServer

                        **-GlobalRefreshEnabled**
                        True (enabled); False (Disabled state) | Enables global publishing refresh (Boolean) | False | -| Set-AppvPublishingServer

                        **-GlobalRefreshOnLogon**
                        True (enabled); False (Disabled state) | Triggers a global publishing refresh on sign in. (Boolean) | False | -| Set-AppvPublishingServer

                        **-GlobalRefreshInterval**
                        Integer (0–744) | Specifies the publishing refresh interval using the GlobalRefreshIntervalUnit. To disable package refresh, specify 0. | 0 | -| Set-AppvPublishingServer

                        **-GlobalRefreshIntervalUnit**
                        0 for hour, 1 for day | Specifies the interval unit (Hour 0–23, Day 0–31). | 1 | -| Set-AppvPublishingServer

                        **-UserRefreshEnabled**
                        True (enabled); False (Disabled state) | Enables user publishing refresh (Boolean) | False | -| Set-AppvPublishingServer

                        **-UserRefreshOnLogon**
                        True (enabled); False (Disabled state) | Triggers a user publishing refresh on sign in. (Boolean) Word count (with spaces): 60 | False | -| Set-AppvPublishingServer

                        **-UserRefreshInterval**
                        Word count (with spaces): 85
                        Integer (0–744 Hours) | Specifies the publishing refresh interval using the UserRefreshIntervalUnit. To disable package refresh, select 0. | 0 | -| Set-AppvPublishingServer

                        **-UserRefreshIntervalUnit**
                        0 for hour, 1 for day | Specifies the interval unit (Hour 0–23, Day 0–31). | 1 | -| Set-AppvClientConfiguration,
                        Set-AppvPublishingServer

                        **-MigrationMode**
                        True (enabled state); False (Disabled state) | Migration mode allows the App-V client to modify shortcuts and FTAs for packages created by a previous version of App-V. | | -| Set-AppvClientConfiguration,
                        Set-AppvPublishingServer

                        **-EnablePackageScripts**
                        True (enabled); False (Disabled state) | Enables scripts defined in the package manifest of configuration files that should run. | | -| Set-AppvClientConfiguration

                        **-RoamingFileExclusions**
                        String | Specifies the file paths relative to %userprofile% that don't roam with a user's profile. For example, ```/ROAMINGFILEEXCLUSIONS='desktop;my pictures'``` | | -| Set-AppvClientConfiguration,
                        Set-AppvPublishingServer

                        **-RoamingRegistryExclusions**
                        String | Specifies the registry paths that don't roam with a user profile. For example, ```/ROAMINGREGISTRYEXCLUSIONS=software\\classes;software\\clients``` | Policy value not written (same as Not Configured) | -| Set-AppvClientConfiguration,
                        Set-AppvPublishingServer

                        **-IntegrationRootUser**
                        String | Specifies the location to create symbolic links associated with the current version of a per-user published package. All virtual application extensions, such as shortcuts and file type associations, will point to this path. If you don't specify a path, symbolic links won't be used when you publish the package. For example, ```%localappdata%\\Microsoft\\AppV\\Client\\Integration```. | Policy value not written (same as Not Configured) | -| Set-AppvClientConfiguration,
                        Set-AppvPublishingServer

                        **-IntegrationRootGlobal**
                        String | Specifies the location to create symbolic links associated with the current version of a globally published package. All virtual application extensions, such as shortcuts and file type associations, will point to this path. If you don't specify a path, symbolic links won't be used when you publish the package. For example, ```%allusersprofile%\\Microsoft\\AppV\\Client\\Integration```. | Policy value not written (same as Not Configured) | -| Set-AppvClientConfiguration,
                        Set-AppvPublishingServer

                        **-VirtualizableExtensions**
                        String | A comma-delineated list of file name extensions that can be used to determine if a locally installed application can be run in the virtual environment. When shortcuts, FTAs, and other extension points are created during publishing, App-V will compare the file name extension to the list if the application associated with the extension point is locally installed. If the extension is located, the **RunVirtual** command-line parameter will be added, and the application will run virtually. For more information about the **RunVirtual** parameter, see [Running a locally installed application inside a virtual environment with virtualized applications](appv-running-locally-installed-applications-inside-a-virtual-environment.md). | Policy value not written | -| Set-AppvClientConfiguration,
                        Set-AppvPublishingServer

                        **-ReportingEnabled**
                        True (enabled); False (Disabled state) | Returns information to a reporting server. | False | -| Set-AppvClientConfiguration,
                        Set-AppvPublishingServer

                        **-ReportingServerURL**
                        String | Specifies the location on the reporting server where client information is saved. | Policy value not written (same as Not Configured) | -| Set-AppvClientConfiguration,
                        Set-AppvPublishingServer

                        **-ReportingDataCacheLimit**
                        Integer \[0–1024\] | Specifies the maximum size in megabytes (MB) of the XML cache for storing reporting information. The size applies to the cache in memory. When the limit is reached, the log file will roll over. Set between 0 and 1024. | Policy value not written (same as Not Configured) | -| Set-AppvClientConfiguration,
                        Set-AppvPublishingServer

                        **-ReportingDataBlockSize**
                        Integer \[1024 - Unlimited\] | Specifies the maximum size in bytes to transmit to the server for reporting upload requests. This limit can help avoid permanent transmission failures when the log has reached a significant size. Set between 1024 and unlimited. | Policy value not written (same as Not Configured) | -| Set-AppvClientConfiguration,
                        Set-AppvPublishingServer

                        **-ReportingStartTime**
                        Integer (0–23) | Specifies the time to initiate the client to send data to the reporting server. You must specify a valid integer between 0–23 corresponding to the hour of the day. By default the **ReportingStartTime** will start on the current day at 10 P.M.or 22.
                        **Note** You should configure this setting to a time when computers running the App-V client are least likely to be offline. | Policy value not written (same as Not Configured) | -| Set-AppvClientConfiguration,
                        Set-AppvPublishingServer

                        **-ReportingInterval**
                        Integer | Specifies the retry interval that the client will use to resend data to the reporting server. | Policy value not written (same as Not Configured) | -| Set-AppvClientConfiguration,
                        Set-AppvPublishingServer

                        **-ReportingRandomDelay**
                        Integer \[0 - ReportingRandomDelay\] | Specifies the maximum delay (in minutes) for data to be sent to the reporting server. When the scheduled task is started, the client generates a random delay between 0 and **ReportingRandomDelay** and will wait the specified duration before sending data. This method can help to prevent collisions on the server. | Policy value not written (same as Not Configured) | -| Set-AppvClientConfiguration,
                        Set-AppvPublishingServer

                        -EnableDynamicVirtualization
                        1 (Enabled), 0 (Disabled) | Enables supported Shell Extensions, Browser Helper Objects, and Active X controls to be virtualized and run with virtual applications. | | -| Set-AppvClientConfiguration,
                        Set-AppvPublishingServer

                        **-EnablePublishingRefreshUI**
                        1 (Enabled), 0 (Disabled) | Enables the publishing refresh progress bar for the computer running the App-V Client. | | -| Sync-AppvPublishingServer

                        **-HidePublishingRefreshUI**
                        1 (Enabled), 0 (Disabled) | Hides the publishing refresh progress bar. | | -| Set-AppvClientConfiguration,
                        Set-AppvPublishingServer

                        **-ProcessesUsingVirtualComponents**
                        String | Specifies a list of process paths (that may contain wildcards) that are candidates for using dynamic virtualization (such as supported shell extensions, browser helper objects, and ActiveX controls). Only processes whose full path matches one of these items can use dynamic virtualization. | Empty string. | - -## App-V client configuration settings: registry keys - -The following table provides information about App-V client configuration settings that can be configured through the registry: - - -| **Setting name**
                        Type | Registry key value | Disabled policy state keys and values | -|--------------------------------------------------------------------------------|-------------------------------------------------------------------------|---------------------------------------------------| -| **PackageInstallationRoot**
                        String | Streaming\\PackageInstallationRoot | Policy value not written (same as Not Configured) | -| **PackageSourceRoot**
                        String | Streaming\\PackageSourceRoot | Policy value not written (same as Not Configured) | -| **AllowHighCostLaunch**
                        True (Enabled); False (Disabled state) | Streaming\\AllowHighCostLaunch | 0 | -| **ReestablishmentRetries**
                        Integer (0–99) | Streaming\\ReestablishmentRetries | Policy value not written (same as Not Configured) | -| **ReestablishmentInterval**
                        Integer (0–3600) | Streaming\\ReestablishmentInterval | Policy value not written (same as Not Configured) | -| **LocationProvider**
                        String | Streaming\\LocationProvider | Policy value not written (same as Not Configured) | -| **CertFilterForClientSsl**
                        String | Streaming\\CertFilterForClientSsl | Policy value not written (same as Not Configured) | -| **VerifyCertificateRevocationList**
                        True (Enabled); False (Disabled state) | Streaming\\VerifyCertificateRevocationList | 0 | -| **SharedContentStoreMode**
                        True (Enabled); False (Disabled state) | Streaming\\SharedContentStoreMode | 0 | -| **Name**
                        String | Publishing\\Servers{serverId}\\FriendlyName | Policy value not written (same as Not Configured) | -| **URL**
                        String | Publishing\\Servers{serverId}\\URL | Policy value not written (same as Not Configured) | -| **GlobalRefreshEnabled**
                        True (Enabled); False (Disabled state) | Publishing\\Servers{serverId}\\GlobalEnabled | False | -| **GlobalRefreshOnLogon**
                        True (Enabled); False (Disabled state) | Publishing\\Servers{serverId}\\GlobalLogonRefresh | False | -| **GlobalRefreshInterval**
                        Integer (0–744) | Publishing\\Servers{serverId}\\GlobalPeriodicRefreshInterval | 0 | -| **GlobalRefreshIntervalUnit**
                        0 for hour, 1 for day | Publishing\\Servers{serverId}\\GlobalPeriodicRefreshIntervalUnit | 1 | -| **UserRefreshEnabled**
                        True (Enabled); False (Disabled state) | Publishing\\Servers{serverId}\\UserEnabled | False | -| **UserRefreshOnLogon**
                        True (Enabled); False (Disabled state) | Publishing\\Servers{serverId}\\UserLogonRefresh | False | -| **UserRefreshInterval**
                        Word count (with spaces): 85; Integer (0–744 Hours) | Publishing\\Servers{serverId}\\UserPeriodicRefreshInterval | 0 | -| **UserRefreshIntervalUnit**
                        0 for hour, 1 for day | Publishing\\Servers{serverId}\\UserPeriodicRefreshIntervalUnit | 1 | -| **MigrationMode**
                        True(Enabled state); False (Disabled state) | Coexistence\\MigrationMode | | -| **EnablePackageScripts**
                        True (Enabled); False (Disabled state) | \\Scripting\\EnablePackageScripts | | -| **RoamingFileExclusions**
                        String | | | -| **RoamingRegistryExclusions**
                        String | Integration\\RoamingRegistryExclusions | Policy value not written (same as Not Configured) | -| **IntegrationRootUser**
                        String | Integration\\IntegrationRootUser | Policy value not written (same as Not Configured) | -| **IntegrationRootGlobal**
                        String | Integration\\IntegrationRootGlobal | Policy value not written (same as Not Configured) | -| **VirtualizableExtensions**
                        String | Integration\\VirtualizableExtensions | Policy value not written | -| **ReportingEnabled**
                        True (Enabled); False (Disabled state) | Reporting\\EnableReporting | False | -| **ReportingServerURL**
                        String | Reporting\\ReportingServer | Policy value not written (same as Not Configured) | -| **ReportingDataCacheLimit**
                        Integer \[0–1024\] | Reporting\\DataCacheLimit | Policy value not written (same as Not Configured) | -| **ReportingDataBlockSize**
                        Integer \[1024–Unlimited\] | Reporting\\DataBlockSize | Policy value not written (same as Not Configured) | -| **ReportingStartTime**
                        Integer (0–23) | Reporting\\ StartTime | Policy value not written (same as Not Configured) | -| **ReportingInterval**
                        Integer | Reporting\\RetryInterval | Policy value not written (same as Not Configured) | -| **ReportingRandomDelay**
                        Integer \[0 - ReportingRandomDelay\] | Reporting\\RandomDelay | Policy value not written (same as Not Configured) | -| EnableDynamicVirtualization
                        1 (Enabled), 0 (Disabled) | HKEY\_LOCAL\_MACHINE\\Software\\Microsoft\\AppV\\Client\\Virtualization | | -| **EnablePublishingRefreshUI**
                        1 (Enabled), 0 (Disabled) | HKEY\_LOCAL\_MACHINE\\Software\\Microsoft\\AppV\\Client\\Publishing | | -| **HidePublishingRefreshUI**
                        1 (Enabled), 0 (Disabled) | | | -| **ProcessesUsingVirtualComponents**
                        String | Virtualization\\ProcessesUsingVirtualComponents | Empty string. | - -## Related topics - -* [Deploying the App-V Sequencer and Configuring the Client](appv-deploying-the-appv-sequencer-and-client.md) diff --git a/windows/application-management/app-v/appv-configure-access-to-packages-with-the-management-console.md b/windows/application-management/app-v/appv-configure-access-to-packages-with-the-management-console.md deleted file mode 100644 index ab350e2a83..0000000000 --- a/windows/application-management/app-v/appv-configure-access-to-packages-with-the-management-console.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -title: How to configure access to packages by using the Management Console (Windows 10/11) -description: How to configure access to packages by using the App-V Management Console. -author: aczechowski -ms.prod: windows-client -ms.date: 06/18/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.technology: itpro-apps ---- -# How to configure access to packages by using the Management Console - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -Before you deploy an App-V virtualized package, you must configure the Active Directory Domain Services (AD DS) security groups that will be allowed to access and run the applications. The security groups may contain computers or users. Entitling a package to a computer group publishes the package globally to all computers in the group. - -Use the following procedure to configure access to virtualized packages. - -## Grant access to an App-V package - -1. Find the package you want to configure: - - 1. Open the App-V Management console. - - 1. Right-click the package to be configured, then select **Edit active directory access** to display the **AD Access** page. Alternatively, select the package and select **Edit** in the **AD Access** pane. - -2. Provision a security group for the package: - - 1. Go to the **Find valid Active Directory names and grant access** page. - - 1. Using the format **mydomain** \\ **groupname**, enter the name or part of the name of an Active Directory group object, then select **Check**. - - > [!NOTE] - > Ensure that you provide an associated domain name for the group that you are searching for. - -3. Grant access to the package by first selecting the desired group, then selecting **Grant Access**. The newly added group is displayed in the **AD entities with access** pane. - -4. Select **Close** to accept the default configuration settings and close the AD Access page. - - To customize configurations for a specific group, select the **Assigned configurations** drop-down menu, then select **Custom**. To make changes to your custom configurations, select **Edit**. After you grant access, select **Close**. - -## Remove access to an App-V package - -1. Find the package you want to configure: - - 1. Open the App-V Management console. - - 1. To display the **AD Access** page, right-click the package to be configured, then select **Edit active directory access**. Alternatively, select the package, then select **Edit** in the **AD Access** pane. - -2. Select the group you want to remove, then select **Delete**. - -3. Select **Close**. - - - - - -## Related articles - -* [Operations for App-V](appv-operations.md) diff --git a/windows/application-management/app-v/appv-configure-connection-groups-to-ignore-the-package-version.md b/windows/application-management/app-v/appv-configure-connection-groups-to-ignore-the-package-version.md deleted file mode 100644 index 9e7f90b5a1..0000000000 --- a/windows/application-management/app-v/appv-configure-connection-groups-to-ignore-the-package-version.md +++ /dev/null @@ -1,68 +0,0 @@ ---- -title: How to make a connection group ignore the package version (Windows 10/11) -description: Learn how to make a connection group ignore the package version with the App-V Server Management Console. -author: aczechowski -ms.prod: windows-client -ms.date: 06/18/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.technology: itpro-apps ---- -# How to make a connection group ignore the package version - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -You can use Application Virtualization (App-V) to configure a connection group to use any version of a package, simplifying package upgrades and reducing the number of connection groups you need to create. - -You can also configure a connection group to accept any version of a package, so that you can upgrade the package without having to disable the connection group. - -- If the connection group has access to multiple versions of a package, App-V will use the latest version. - -- If the connection group contains an optional package with an incorrect version, App-V ignores the package and won't block the connection group's virtual environment from being created. - -- If the connection group contains a non-optional package that has an incorrect version, App-V won't be able to create the connection group's virtual environment. - -## Make a connection group ignore the package version with the App-V Server Management Console - -1. In the Management Console, select **Connection Groups**. - -2. Select the correct connection group from the Connection Groups library. - -3. Select **Edit** in the Connected Packages pane. - -4. Select the **Use Any Version** check box next to the package name, then select **Apply**. - -For more about adding or upgrading packages, see [How to add or upgrade packages by using the Management Console](appv-add-or-upgrade-packages-with-the-management-console.md). - -## Make a connection group ignore the package version from the App-V client on a stand-alone computer - -1. Create the connection group XML document. - -2. Set the **Package** tag attribute **VersionID** to an asterisk (*) to upgrade the package. - -3. Enter the following cmdlet (including the path to the connection group XML document) to add the connection group: - - ```PowerShell - Add-AppvClientConnectionGroup - ``` - - For more information about how to use the **Add-AppvClientConnectionGroup** cmdlet, see [**Add-AppvClientConnectionGroup**](/powershell/module/appvclient/add-appvclientconnectiongroup). - -4. When you upgrade a package, use the following cmdlets to remove the old package, add the upgraded package, and publish the upgraded package: - - - [**Remove-AppvClientPackage**](/powershell/module/appvclient/remove-appvclientpackage) - - [**Add-AppvClientPackage**](/powershell/module/appvclient/add-appvclientpackage) - - [**Publish-AppvClientPackage**](/powershell/module/appvclient/publish-appvclientpackage) - -For more information, see [How to manage App-V packages running on a stand-alone computer by using Windows PowerShell](appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md). - - - - - -## Related articles - -- [Managing connection groups](appv-managing-connection-groups.md) diff --git a/windows/application-management/app-v/appv-configure-the-client-to-receive-updates-from-the-publishing-server.md b/windows/application-management/app-v/appv-configure-the-client-to-receive-updates-from-the-publishing-server.md deleted file mode 100644 index 687c339a07..0000000000 --- a/windows/application-management/app-v/appv-configure-the-client-to-receive-updates-from-the-publishing-server.md +++ /dev/null @@ -1,67 +0,0 @@ ---- -title: How to configure the client to receive package and connection groups updates from the publishing server (Windows 10/11) -description: How to configure the client to receive package and connection groups updates from the publishing server. -author: aczechowski -ms.prod: windows-client -ms.date: 06/25/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.technology: itpro-apps ---- - -# How to configure the client to receive package and connection groups updates from the publishing server - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -The App-V publishing server's single-point management and high scalability lets you deploy packages and connection groups and keep them up to date. - -This article will tell you how to configure the App-V client to receive updates from the publishing server. - ->[!NOTE] ->The following example has the management server installed on a computer named **MyMgmtSrv**, and the publishing server installed on a computer named **MyPubSrv**. If the computers you'll be configuring the App-V client on have different names, you should replace the example's names with your computer's names. - -## Configure the App-V client to receive updates from the publishing server - -1. Deploy the App-V management and publishing servers, and add the required packages and connection groups. For more information about adding packages and connection groups, see [How to add or upgrade packages by using the Management Console](appv-add-or-upgrade-packages-with-the-management-console.md) and [How to create a connection group](appv-create-a-connection-group.md). -2. To open the management console, open a web browser and enter the following URL: `https://MyMgmtSrv/AppvManagement/Console.html`. Import, publish, and entitle all packages and connection groups that your users will need. -3. On the computer running the App-V client, open an elevated Windows PowerShell command prompt, and run the following command: - - ```PowerShell - Add-AppvPublishingServer -Name ABC -URL https://MyPubSrv/AppvPublishing - ``` - - This command will configure the specified publishing server. You should see output similar to the following: - - ```PowerShell - Id                        : 1 - SetByGroupPolicy          : False - Name                      : ABC - URL                       : https://MyPubSrv/AppvPublishing - GlobalRefreshEnabled      : False - GlobalRefreshOnLogon      : False - GlobalRefreshInterval     : 0 - GlobalRefreshIntervalUnit : Day - UserRefreshEnabled        : True - UserRefreshOnLogon        : True - UserRefreshInterval       : 0 - UserRefreshIntervalUnit   : Day - ``` - -4. On the computer running the App-V client, open a Windows PowerShell command prompt and enter the following cmdlet: - - ```PowerShell - Sync-AppvPublishingServer -ServerId 1 - ``` - - This cmdlet will query the publishing server for which packages and connection groups need to be added or removed for this particular client based on your configured entitlements for the packages and connection groups on the management server. - - - - - -## Related article - -* [Operations for App-V](appv-operations.md) diff --git a/windows/application-management/app-v/appv-connect-to-the-management-console.md b/windows/application-management/app-v/appv-connect-to-the-management-console.md deleted file mode 100644 index 95ec5914c4..0000000000 --- a/windows/application-management/app-v/appv-connect-to-the-management-console.md +++ /dev/null @@ -1,33 +0,0 @@ ---- -title: How to connect to the Management Console (Windows 10/11) -description: In this article, learn the procedure for connecting to the App-V Management Console through your web browser. -author: aczechowski -ms.prod: windows-client -ms.date: 06/25/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.technology: itpro-apps ---- - -# How to connect to the Management Console - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -Use the following procedure to connect to the App-V Management Console. - -## Connect to the App-V Management Console - -1. Open your web browser and enter the address for the App-V Management server. For example, **https://\<_management server name_\>:\<_management service port number_\>/console.html**. - -2. To view different sections of the console, select your desired section in the navigation pane. - - - - - -## Related articles - -- [Operations for App-V](appv-operations.md) diff --git a/windows/application-management/app-v/appv-connection-group-file.md b/windows/application-management/app-v/appv-connection-group-file.md deleted file mode 100644 index df85debbf2..0000000000 --- a/windows/application-management/app-v/appv-connection-group-file.md +++ /dev/null @@ -1,146 +0,0 @@ ---- -title: About the connection group file (Windows 10/11) -description: A summary of what the connection group file is and how to configure it. -author: aczechowski -ms.prod: windows-client -ms.date: 06/25/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.technology: itpro-apps ---- - -# About the connection group file - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -## Connection group file overview - -### What is a connection group? - -A connection group is an App-V feature that can group packages together to create a virtual environment where applications within that package group can interact with each other. - -For example, let's say you want to use plug-ins with Microsoft Office. You can create one package that contains the plug-ins and another package that contains Office, and then add both packages to the same connection group to enable Office to use those plug-ins. - -### How a connection group file works - -When you apply an App-V connection group file, all packages specified in the file will be combined at runtime into a single virtual environment. Use the Microsoft Application Virtualization (App-V) connection group file to configure existing App-V connection groups. - -An example file path for a package file would be %APPDATA%\Microsoft\AppV\Client\Catalog\PackageGroups\{6CCC7575-162E-4152-9407-ED411DA138F4}\{4D1E16E1-8EF8-41ED-92D5-8910A8527F96}. - -## Structure of the connection group XML file - -This section will tell you more about the components of the connection group XML file. - -### Parameters that define the connection group - -The following table describes the parameters in the XML file that define the connection group itself, not the packages. - -|Field|Description| -|-----|-----------| -|Schema name|Name of the schema.
                        If you want to use the “optional packages” and “use any version” features described in this table, you must specify the following schema in the XML file:
                        `xmlns="https://schemas.microsoft.com/appv/2014/virtualapplicationconnectiongroup"`| -|AppConnectionGroupId|Unique GUID identifier for this connection group. The connection group state is associated with this identifier. Specify this identifier only when you create the connection group.
                        You can create a new GUID by entering **[Guid]::NewGuid()**.| -|VersionId|Version GUID identifier for this version of the connection group.
                        When you update a connection group (for example, by adding or updating a new package), you must update the version GUID to reflect the new version.| -|DisplayName|Display name of the connection group.| -|Priority|Optional priority field for the connection group.
                        A value of **0** indicates the highest priority.
                        If a priority is required but has not been configured, the package will fail because it can't determine the correct connection group to use.| - -### Parameters that define the packages in the connection group - -In the **<Packages>** section of the connection group XML file, you list the member packages in the connection group by specifying each package’s unique package identifier and version identifier, as described in the following table. The first package in the list has the highest precedence. - -|Field|Description| -|---|---| -|PackageId|Unique GUID identifier for this package. This GUID doesn’t change when newer versions of the package are published.| -|VersionId|Unique GUID identifier for the version of the package.
                        If you specify “*” for the package version, the GUID of the latest available package version is dynamically inserted.| -|IsOptional|Parameter that enables you to make a package optional within the connection group. Valid entries are:
                        - “**true**”—package is optional in the connection group
                        - “**false**”—package is required in the connection group| - -### App-V example connection group XML file - -The following example connection group XML file shows examples of the fields listed in the previous tables. - -```XML - - - - - - -``` - -## Configuring the priority of packages in a connection group - -Package precedence is configured using the package list order. The first package in the document has the highest precedence. Subsequent packages in the list have descending priority. - -Package precedence is the resolution for otherwise inevitable resource collisions during virtual environment initialization. For example, if two packages that are opening in the same virtual environment define the same registry DWORD value, the package with the highest precedence determines the value that is set. - -You can use the connection group file to configure each connection group by using the following methods: - -- Specify runtime priorities for connection groups. To edit priority by using the App-V Management Console, select the connection group and then select **Edit**. - - > [!NOTE] - >A package only requires priority if it's associated with more than one connection group. -- Specify package precedence within the connection group. - -The priority field is required when a running virtual application initiates from a native application request, such as Microsoft Windows Explorer. The App-V client uses the priority to determine which connection group virtual environment the application should run in. This situation occurs if a virtual application is part of multiple connection groups. - -If a virtual application is opened using another virtual application, the client will use the original virtual application's virtual environment. The priority field is not used in this case. - -The following is an example of priority configuration: - -The virtual application Microsoft Outlook is running in virtual environment **XYZ**. When you open an attached Microsoft Word document, a virtualized version Microsoft Word opens in the virtual environment **XYZ**, regardless of the virtualized Microsoft Word’s associated connection groups or runtime priorities. - -## Supported virtual application connection configurations - -App-V supports the following application connection configurations. - -- **An .exe file and plug-in (.dll)**. For example, you might want to distribute Microsoft Office to all users, but only distribute a Microsoft Excel plug-in to a small subset of those users. - - Enable the connection group for the appropriate users. Update each package individually as required. - -- **An .exe file and a middleware application**. This is for cases where you have an application that requires a middleware application, or several applications that all depend on the same middleware runtime version. - - All computers that require one or more of the applications receive the connection groups with the application and middleware application runtime. You can optionally combine multiple middleware applications into a single connection group. - - |Example|Example description| - |---|---| - |Virtual application connection group for the financial division|- Middleware application 1
                        - Middleware application 2
                        - Middleware application 3
                        - Middleware application runtime| - |Virtual application connection group for HR division|- Middleware application 5
                        - Middleware application 6
                        - Middleware application runtime| - -- **An. exe file and an .exe file**. This is for cases where you have an application that relies on another application, but you want to keep the packages separate for operational efficiencies, licensing restrictions, or rollout timelines. - - For example, if you are deploying Microsoft Lync 2010, you can use three packages: - - - Microsoft Office 2010 - - Microsoft Communicator 2007 - - Microsoft Lync 2010 - - You can manage the deployment with the following connection groups: - - - Microsoft Office 2010 and Microsoft Communicator 2007 - - Microsoft Office 2010 and Microsoft Lync 2010 - - After deployment, you can either create a single new Microsoft Office 2010 + Microsoft Lync 2010 package or keep and maintain them as separate packages and deploy them with a connection group. - - - - - -## Related articles - -- [Managing connection groups](appv-managing-connection-groups.md) diff --git a/windows/application-management/app-v/appv-connection-group-virtual-environment.md b/windows/application-management/app-v/appv-connection-group-virtual-environment.md deleted file mode 100644 index 26f5a073a8..0000000000 --- a/windows/application-management/app-v/appv-connection-group-virtual-environment.md +++ /dev/null @@ -1,85 +0,0 @@ ---- -title: About the connection group virtual environment (Windows 10/11) -description: Learn how the connection group virtual environment works and how package priority is determined. -author: aczechowski -ms.prod: windows-client -ms.date: 06/25/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.technology: itpro-apps ---- -# About the connection group virtual environment - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -## How package priority is determined - -The virtual environment and its current state are associated with the connection group, not with the individual packages. If you remove an App-V package from the connection group, the state that existed as part of the connection group won't migrate with the package. - -If the same package is a part of two different connection groups, you have to indicate which connection group App-V should use. For example, you might have two packages in a connection group wherein each defines the same registry DWORD value. - -The connection group that is used is based on the order in which a package appears inside the **AppConnectionGroup** XML document: - -- The first package has the highest precedence. -- The second package has the second highest precedence. - -Consider the following example section: - -```XML - - - - - -``` - -Assume that same DWORD value ABC (HKEY\_LOCAL\_MACHINE\\software\\contoso\\finapp\\region) is defined in the first and third package. - -For this example, the DWORD value definition would be as shown below: - -- Package 1 (A8731008-4523-4713-83A4-CD1363907160): HKEY\_LOCAL\_MACHINE\\software\\contoso\\finapp\\region=5 -- Package 3 (04220DCA-EE77-42BE-A9F5-96FD8E8593F2): HKEY\_LOCAL\_MACHINE\\software\\contoso\\finapp\\region=10 - -Since Package 1 appears first, the AppConnectionGroup's virtual environment will have the single DWORD value of 5 (HKEY\_LOCAL\_MACHINE\\software\\contoso\\finapp\\region=5). This result means that the virtual applications in Package 1, Package 2, and Package 3 will all see the value 5 when they query for HKEY\_LOCAL\_MACHINE\\software\\contoso\\finapp\\region. - -Other virtual environment resources are resolved in a similar way, but usually collisions occur in the registry. - -## Merging identical package paths into one virtual directory in connection groups - -If two or more packages in a connection group contain identical directory paths, the paths are merged into a single virtual directory inside the connection group's virtual environment. Merging these paths allows an application in one package to access files that are in a different package. - -When you remove a package from a connection group, the removed package's applications can no longer access files from packages in the connection group it was removed from. - -App-V looks up a file’s name in the connection group in the order App-V packages are listed in the connection group manifest file. - -The following example shows the order and relationship of a file name lookup in a connection group for **Package A** and **Package B**. - -|Package A|Package B| -|---|---| -|C:\Windows\System32|C:\Windows\System32| -|C:\AppTest|C:\AppTest| - -When a virtualized application tries to find a specific file, App-V will search for a matching file path in Package A. If it doesn't find a matching path in Package A, it will then search Package B using the following mapping rules: - -- If a file named **test.txt** exists in the same virtual folder hierarchy in both application packages, App-V will use the first matching file. -- If a file named **bar.txt** exists in the virtual folder hierarchy of one application package, but not in the other, App-V will use the first matching file. - - - - - -## Related articles - -- [Managing Connection Groups](appv-managing-connection-groups.md) diff --git a/windows/application-management/app-v/appv-convert-a-package-created-in-a-previous-version-of-appv.md b/windows/application-management/app-v/appv-convert-a-package-created-in-a-previous-version-of-appv.md deleted file mode 100644 index 3a2f20cbb5..0000000000 --- a/windows/application-management/app-v/appv-convert-a-package-created-in-a-previous-version-of-appv.md +++ /dev/null @@ -1,93 +0,0 @@ ---- -title: How to convert a package created in a previous version of App-V (Windows 10/11) -description: Use the package converter utility to convert a virtual application package created in a previous version of App-V. -author: aczechowski -ms.prod: windows-client -ms.date: 07/10/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.technology: itpro-apps ---- -# How to convert a package created in a previous version of App-V - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -You can use the package converter utility to upgrade virtual application packages created by previous versions of App-V. This section will tell you how to convert existing virtual application packages for upgrade. - ->[!NOTE] ->If you are running a computer with a 64-bit architecture, you must use the x86 version of Windows PowerShell. - -The package converter can only directly convert packages created by an App-V sequencer version 4.5 or later. Packages created with an App-V version earlier than 4.5 must be upgraded to at least App-V 4.5 before conversion. - ->[!IMPORTANT] ->In order to keep your files secure, you must configure the package converter to always save the package ingredients file to a secure location and directory that can only be accessed by an administrator. When you deploy the package, you should either save the package to a secure location or make sure that no other users can sign in during the conversion process. - -## App-V 4.6 installation folder is redirected to virtual file system root - -When you convert packages from App-V 4.6 to App-V for Windows 10/11, the App-V for Windows client package can access the hardcoded drive that you were required to use when you created 4.6 packages. The drive letter will be the drive you selected as the installation drive on the 4.6 sequencing machine. (The default drive is drive Q.) - -The App-V package converter will save the App-V 4.6 installation root folder and short folder names in the FilesystemMetadata.xml file in the **Filesystem** element. When the App-V for Windows client creates the virtual process, it will map requests from the App-V 4.6 installation root to the virtual file system root. - -## Getting started - -1. Install the App-V Sequencer on a computer in your environment. For information about how to install the Sequencer, see [How to install the Sequencer](appv-install-the-sequencer.md). - -2. You can enter the following cmdlets to check or convert packages: - - - **Test-AppvLegacyPackage**—This cmdlet checks packages. It will return information about any failures with the package such as missing **.sft** files, an invalid source, **.osd** file errors, or invalid package version. This cmdlet won't parse the **.sft** file or do any in-depth validation. For information about options and basic functionality for this cmdlet, using Windows PowerShell, enter the following cmdlet: - - ```PowerShell - Test-AppvLegacyPackage -? - ``` - - - **ConvertFrom-AppvLegacyPackage**—This cmdlet converts packages from legacy versions to updated versions. To convert an existing package, enter the following cmdlet: - - ```PowerShell - ConvertFrom-AppvLegacyPackage C:\contentStore C:\convertedPackages - ``` - - In this cmdlet, `C:\contentStore` represents the location of the existing package and `C:\convertedPackages` is the output directory to which the resulting App-V for Windows client virtual application package file will be saved. By default, if you don't specify a new name, the old package name will be used. - - Additionally, the package converter optimizes performance of packages in App-V for Windows client by setting the package to stream fault the App-V package.  This definition of setting is more performant than the primary feature block and fully downloading the package. The flag **DownloadFullPackageOnFirstLaunch** allows you to convert the package and set the package to be fully downloaded by default. - - > [!NOTE] - > Before you specify the output directory, you must create the output directory. - -### Advanced Conversion Tips - -- Piping—Windows PowerShell supports piping. Piping allows you to enter cmdlets like this example: - - ```PowerShell - dir C:\contentStore\myPackage | Test-AppvLegacyPackage - ``` - - In this example, the directory object that represents `myPackage` will be given as input to the **Test-AppvLegacyPackage** cmdlet and bound to the *-Source* parameter. Piping like this is especially useful when you want to batch commands together, such as in the following example cmdlet: - - ```PowerShell - dir .\ | Test-AppvLegacyPackage | ConvertFrom-AppvLegacyAppvPackage -Target .\ConvertedPackages - ``` - - This piped example command tests packages, then passes the objects on for conversion. You can also apply a filter on packages without errors or only specify a directory that contains an **.sprj** file or pipe them to another cmdlet that adds the filtered package to the server or publishes them to the App-V client. - -- Batching—The Windows PowerShell command enables batching. More specifically, the cmdlets support taking a string\[\] object for the *-Source* parameter that represents a list of directory paths. This feature allows you to enter the following cmdlets together: - - ```PowerShell - $packages = dir C:\contentStore - ConvertFrom-AppvLegacyAppvPackage-Source $packages -Target C:\ConvertedPackages - ``` - - Alternatively, you can use piping like this: - - ```PowerShell - dir C:\ContentStore | ConvertFrom-AppvLegacyAppvPackage -Target C:\ConvertedPackages - ``` - -- Other functionality—Windows PowerShell has other built-in functionality for features such as aliases, lazy-binding, .NET Object, and many others. These features can help you create advanced scenarios for the Package Converter. - - -## Related articles - -- [Operations for App-V](appv-operations.md) diff --git a/windows/application-management/app-v/appv-create-a-connection-group-with-user-published-and-globally-published-packages.md b/windows/application-management/app-v/appv-create-a-connection-group-with-user-published-and-globally-published-packages.md deleted file mode 100644 index 09a658895f..0000000000 --- a/windows/application-management/app-v/appv-create-a-connection-group-with-user-published-and-globally-published-packages.md +++ /dev/null @@ -1,66 +0,0 @@ ---- -title: How to create a connection croup with user-published and globally published packages (Windows 10/11) -description: How to create a connection croup with user-published and globally published packages. -author: aczechowski -ms.prod: windows-client -ms.date: 07/10/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.technology: itpro-apps ---- -# How to create a connection croup with user-published and globally published packages - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -You can create user-entitled connection groups that contain both user-published and globally published packages, using either of the following methods: - -- [How to use Windows PowerShell cmdlets to create user-entitled connection groups](#how-to-use-windows-powershell-cmdlets-to-create-user-entitled-connection-groups) -- [How to use the App-V Server to create user-entitled connection groups](#how-to-use-the-app-v-server-to-create-user-entitled-connection-groups) - -## Unsupported scenarios and potential issues - -Here are some important things to know before you get started: - -- If you add user-published packages in globally entitled connection groups, the connection group will fail. -- Track the connection groups where you've used a non-optional package before removing it with the **Unpublish-AppvClientPackage <package> -global** cmdlet. - - In situations where you have a globally published package that's listed as non-optional in a user-published connection group that also appears in other packages, running **Unpublish-AppvClientPackage <package> -global** cmdlet can unpublish the package from every connection group containing that package. Tracking connection groups can help you avoid unintentionally unpublishing non-optional packages. - -## How to use Windows PowerShell cmdlets to create user-entitled connection groups - -1. Add and publish packages by using the following commands: - - ```PowerShell - Add-AppvClientPackage - Add-AppvClientPackage - Publish-AppvClientPackage -PackageId  -VersionId -Global - Publish-AppvClientPackage -PackageId -VersionId  - ``` - -2. Create the connection group XML file. For more information, see [About the connection group file](appv-connection-group-file.md). - -3. Add and publish the connection group by using the following commands: - - ```PowerShell - Add-AppvClientConnectionGroup - Enable-AppvClientConnectionGroup -GroupId  -VersionId - ``` - -## How to use the App-V Server to create user-entitled connection groups - -1. Open the App-V Management Console. - -2. Follow the instructions in [How to publish a package by using the Management Console](appv-publish-a-packages-with-the-management-console.md) to publish packages globally and to the user. - -3. Follow the instructions in [How to create a connection group](appv-create-a-connection-group.md) to create the connection group and add the user-published and globally published packages. - - - - - -## Related articles - -- [Managing Connection Groups](appv-managing-connection-groups.md) diff --git a/windows/application-management/app-v/appv-create-a-connection-group.md b/windows/application-management/app-v/appv-create-a-connection-group.md deleted file mode 100644 index 18a61bee6e..0000000000 --- a/windows/application-management/app-v/appv-create-a-connection-group.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: How to create a connection group (Windows 10/11) -description: Learn how to create a connection group with the App-V Management Console and where to find information about managing connection groups. -author: aczechowski -ms.prod: windows-client -ms.date: 07/10/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.technology: itpro-apps ---- -# How to create a connection group - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -Use these steps to create a connection group by using the App-V Management Console. To use Windows PowerShell to create connection groups, see [How to manage connection groups on a stand-alone computer by using Windows PowerShell](appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell.md). - -When you place packages in a connection group, their package root paths merge. If you remove packages, only the remaining packages maintain the merged root. - -## Create a connection group - -1. In the App-V Management Console, select **CONNECTION GROUPS** to display the Connection Groups library. - -2. Select **ADD CONNECTION GROUP** to create a new connection group. - -3. In the **New Connection Group** pane, enter a description for the group. - -4. Select **EDIT** in the **CONNECTED PACKAGES** pane to add a new application to the connection group. - -5. In the **PACKAGES Entire Library** pane, select the application to be added, then select the arrow to add the application. - - To remove an application, select the application to be removed in the **PACKAGES IN** pane and select the arrow. - - To reprioritize the applications in your connection group, use the arrows in the **PACKAGES IN** pane. - - >[!IMPORTANT] - >By default, the Active Directory Domain Services access configurations that are associated with a specific application are not added to the connection group. To transfer the Active Directory access configuration, select **ADD PACKAGE ACCESS TO GROUP ACCESS**, which is located in the **PACKAGES IN** pane. - -6. After adding all the applications and configuring Active Directory access, select **Apply**. - - - - - -## Related articles - -- [Operations for App-V](appv-operations.md) -- [Managing connection groups](appv-managing-connection-groups.md) diff --git a/windows/application-management/app-v/appv-create-a-custom-configuration-file-with-the-management-console.md b/windows/application-management/app-v/appv-create-a-custom-configuration-file-with-the-management-console.md deleted file mode 100644 index 0dd4402170..0000000000 --- a/windows/application-management/app-v/appv-create-a-custom-configuration-file-with-the-management-console.md +++ /dev/null @@ -1,39 +0,0 @@ ---- -title: How to create a custom configuration file by using the App-V Management Console (Windows 10/11) -description: How to create a custom configuration file by using the App-V Management Console. -author: aczechowski -ms.prod: windows-client -ms.date: 07/10/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.technology: itpro-apps ---- - -# How to create a custom configuration file by using the App-V Management Console - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -You can use a dynamic configuration to customize an App-V package for a specific user. However, you must first create the dynamic user configuration (.xml) file or the dynamic deployment configuration file before you can use the files. Creation of the file is an advanced manual operation. For general information about dynamic user configuration files, see [About App-V dynamic configuration](appv-dynamic-configuration.md). - -You can create a dynamic user configuration file with the App-V Management Console by following the steps in this article. - -## Create a dynamic user configuration file - -1. Right-click the name of the package that you want to view and select **Edit active directory access** to view the configuration that is assigned to a given user group. Alternatively, select the package, and click **Edit**. - -2. Using the list of **AD Entities with Access**, select the AD group that you want to customize. Select **Custom** from the drop-down list. A link named **Edit** will appear. - -3. Select **Edit**. The Dynamic User Configuration assigned to the AD Group will appear. - -4. Select **Advanced**, and then select **Export Configuration**. Enter a file name and select **Save**. Now you can edit the file to configure a package for a user. - - > [!NOTE] - > If you want to export a configuration while running on Windows Server, make sure to disable the IE Enhanced Security Configuration setting. If this setting is enalbed and set to block downloads, you won't be able to download anything from the App-V Server. - - -## Related articles - -- [Operations for App-V](appv-operations.md) diff --git a/windows/application-management/app-v/appv-create-a-package-accelerator-with-powershell.md b/windows/application-management/app-v/appv-create-a-package-accelerator-with-powershell.md deleted file mode 100644 index 30cddc907d..0000000000 --- a/windows/application-management/app-v/appv-create-a-package-accelerator-with-powershell.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: How to create a package accelerator by using Windows PowerShell (Windows 10/11) -description: Learn how to create an App-v Package Accelerator by using Windows PowerShell. App-V Package Accelerators automatically sequence large, complex applications. -author: aczechowski -ms.prod: windows-client -ms.date: 07/10/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.technology: itpro-apps ---- -# How to create a package accelerator by using Windows PowerShell - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -App-V Package Accelerators automatically sequence large, complex applications. Also, when you apply an App-V Package Accelerator, you don't have to manually install an application to create the virtualized package. - -## Create a package accelerator - -1. Install the App-V sequencer. For more information about installing the sequencer, see [How to install the sequencer](appv-install-the-sequencer.md). -2. To open a Windows PowerShell console, select **Start** and enter **PowerShell**. Right-click **Windows PowerShell** and select **Run as Administrator**. -3. Ensure there's the App-V package to create an accelerator from the installation media or installation files. You can also optionally use a readme file for the accelerator's users to reference. -4. Enter the **New-AppvPackageAccelerator** cmdlet. - - The following parameters are required to use the package accelerator cmdlet: - - - *InstalledFilesPath* specifies the application installation path. - - *Installer* specifies the path to the application installer media. - - *InputPackagePath* specifies the path to the App-V package. - - *Path* specifies the output directory for the package. - - The following example cmdlet shows how you can create a package accelerator with the App-V package and the installation media: - - ```PowerShell - New-AppvPackageAccelerator -InputPackagePath -Installer -Path - ``` - - You can also use the following optional parameter with the **New-AppvPackageAccelerator** cmdlet: - - - *AcceleratorDescriptionFile* specifies the path to user-created package accelerator instructions. The package accelerator instructions are **.txt** or **.rtf** description files that will be included in the package created by the package accelerator. - - - - - -## Related articles - -- [Administering App-V by using Windows PowerShell](appv-administering-appv-with-powershell.md) diff --git a/windows/application-management/app-v/appv-create-a-package-accelerator.md b/windows/application-management/app-v/appv-create-a-package-accelerator.md deleted file mode 100644 index 93333681f5..0000000000 --- a/windows/application-management/app-v/appv-create-a-package-accelerator.md +++ /dev/null @@ -1,81 +0,0 @@ ---- -title: How to create a package accelerator (Windows 10/11) -description: Learn how to create App-V Package Accelerators to automatically generate new virtual application packages. -author: aczechowski -ms.prod: windows-client -ms.date: 07/10/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.technology: itpro-apps ---- - -# How to create a package accelerator - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -App-V Package Accelerators automatically generate new virtual application packages. - ->[!NOTE] ->You can use Windows PowerShell to create a package accelerator. For more information, see [How to create a package accelerator by using Windows PowerShell](appv-create-a-package-accelerator-with-powershell.md). - -Use the following procedure to create a package accelerator. - ->[!IMPORTANT] -> ->- Because package accelerators can contain password and user-specific information, you should save package accelerators and the associated installation media in a secure location, and you should also digitally sign the package accelerator after creating it so that you can verify the publisher when applying the App-V Package Accelerator. ->- Before you begin creating a package accelerator, do the following: -> - Copy the virtual application package that you will use to create the package accelerator locally to the computer running the sequencer. -> - Copy all required installation files associated with the virtual application package to the computer running the sequencer. ->- The App-V Sequencer does not grant any license rights to the software application you are using to create the package accelerator. You must abide by all end user license terms for the application you are using. It is your responsibility to make sure the software application’s license terms allow you to create a package accelerator with the App-V sequencer. - -## Create a package accelerator - -1. To start the App-V sequencer on the computer running the sequencer, select **Start** > **All Programs** > **Microsoft Application Virtualization** > **Microsoft Application Virtualization Sequencer**. - -2. To start the App-V **Create Package Accelerator** wizard, in the App-V sequencer console, select **Tools** > **Create Accelerator**. - -3. On the **Select Package** page, select **Browse** to specify an existing virtual application package to use to create the package accelerator, then locate the existing virtual application package (it will appear as an .appv file). - - >[!TIP] - >Copy the files associated with the virtual application package you plan to use locally to the computer running the Sequencer. - - Select **Next**. - -4. Go to the **Installation Files** page and select **Browse**, then select the directory that contains the installation files to specify the folder containing the original virtual package's installation files. - - >[!TIP] - >Copy the folder that contains the required installation files to the computer running the Sequencer. - -5. If the application is already installed on the computer running the sequencer, then select **Files installed on local system** to specify the installation file. To use this option, the application must already be installed in the default installation location. - -6. On the **Gathering Information** page, review the files that you couldn't find in the location specified by the **Installation Files** page. If the files displayed aren't required, select **Remove these files**, then select **Next**. If the files are required, select **Previous** and copy the required files to the directory specified on the **Installation Files** page. - - > [!NOTE] - >You must either remove the unrequired files or select **Previous** and locate the required files to advance to the next page of this wizard. - -7. On the **Select Files** page, carefully review the detected files. Clear any file the package accelerator doesn't need to run successfully and select only the files that the application requires. When you're done, select **Next**. - -8. Confirm that the **Verify Applications** page displays all installation files required to build the package. The package accelerator requires all installation files displayed in the **Applications** pane in order to create the package. - - If you need to add more Installer files, select **Add**. To remove unnecessary installation files, select the **Installer file**, then select **Delete**. To edit the properties associated with an installer, select **Edit**. The package accelerator requires the installation files specified in this step to create a new virtual application package. After you've confirmed the information displayed, select **Next**. - -9. On the **Select Guidance** page, select **Browse** to specify the file that will provide the package accelerator with application instructions. For example, this file can contain information about how the computer running the Sequencer should be configured, application prerequisite information for target computers, and general notes. You should provide all required information for successful package accelerator application. The file you select must be in rich text (.rtf) or text file (.txt) format. After specifying the file, select **Next**. - -10. On the **Create Package Accelerator** page, select **Browse** and select the directory where you want to save the package accelerator. - -11. On the **Completion** page, select **Close**. - - >[!IMPORTANT] - >You should always digitally sign the package accelerator to ensure that it is secure and can be verified by a publisher during application. - - - - - -## Related articles - -- [Operations for App-V](appv-operations.md) -- [How to create a virtual application package using an App-V Package Accelerator](appv-create-a-virtual-application-package-package-accelerator.md) diff --git a/windows/application-management/app-v/appv-create-a-virtual-application-package-package-accelerator.md b/windows/application-management/app-v/appv-create-a-virtual-application-package-package-accelerator.md deleted file mode 100644 index 162c56efbc..0000000000 --- a/windows/application-management/app-v/appv-create-a-virtual-application-package-package-accelerator.md +++ /dev/null @@ -1,80 +0,0 @@ ---- -title: How to create a virtual application package using an App-V Package Accelerator (Windows 10/11) -description: How to create a virtual application package using an App-V Package Accelerator. -author: aczechowski -ms.prod: windows-client -ms.date: 07/10/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.technology: itpro-apps ---- - -# How to create a virtual application package using an App-V Package Accelerator - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -Use the following procedure to create a virtual application package with the App-V Package Accelerator. - ->[!IMPORTANT] ->The App-V Sequencer does not grant any license rights to the software application that you use to create the package accelerator. You must abide by all end user license terms for the application that you use. It is your responsibility to make sure that the software application’s license terms allow you to create a package accelerator with the App-V Sequencer. - -## Create a virtual application package with an App-V Package Accelerator - -1. Make sure you've copied the required package accelerator locally to the computer running the App-V Sequencer. Also make sure to copy all required installation files for the package to a local folder on the computer running the Sequencer. This is the folder that you have to specify in step 6 of this procedure. - -2. To start the App-V Sequencer on the computer that runs the Sequencer, go to **Start** > **All Programs** > **Microsoft Application Virtualization** > **Microsoft Application Virtualization Sequencer**. - -3. Select **Create a New Virtual Application Package**. To create the package, select the **Create Package using a Package Accelerator** check box, then select **Next**. - -4. To specify the package accelerator that will be used to create the new virtual application package, select **Browse** on the **Select Package Accelerator** page. Select **Next**. - - >[!IMPORTANT] - >If the publisher of the package accelerator cannot be verified and does not contain a valid digital signature, then before you select **Run**, you must confirm that you trust the source of the package accelerator. Confirm your choice in the **Security Warning** dialog box. - -5. On the **Guidance** page, review the publishing guidance information that is displayed in the information pane. This information was added when the package accelerator was created and it contains guidance about how to create and publish the package. To export the guidance information to a text (.txt) file, select **Export** and specify the location where the file should be saved, and then select **Next**. - -6. On the **Select Installation Files** page, select **Make New Folder** to create a local folder that contains all required installation files for the package, and specify where the folder should be saved. You must also specify a name to be assigned to the folder. You must then copy all required installation files to the location that you specified. If the folder that contains the installation files already exists on the computer that runs the Sequencer, select **Browse** to select the folder. - - Alternatively, if you have already copied the installation files to a directory on this computer, select **Make New Folder**, browse to the folder that contains the installation files, then select **Next**. - - > [!NOTE] - >You can specify the following types of supported installation files: - > - Windows Installer files (**.msi**) - > - Cabinet files (.cab) - > - Compressed files with a .zip file name extension - > - The actual application files - > The following file types are not supported: **.msp** and **.exe** files. If you specify an **.exe** file, you must extract the installation files manually. - -7. If the package accelerator requires you to install an application before you apply the package accelerator and you have already installed the required application, select **I have installed all applications**, then select **Next** on the **Local Installation** page. - -8. On the **Package Name** page, specify a name that will be associated with the package. The name you choose will identify the package in the App-V Management Console. Select **Next**. - -9. On the **Create Package** page, provide comments that will be associated with the package. The comments should contain identifying information about the package that you are creating. To confirm the location where the package is created, review the information displayed in **Save Location**. To compress the package, select **Compress Package**. Select the **Compress Package** check box if the package will be streamed across the network or the package size exceeds 4 GB. - -10. To create the package, select **Create**. After the package is created, select **Next**. - -11. On the **Configure Software** page, to enable the Sequencer to configure the applications contained within the package, select **Configure Software**. **Configure Software** will let you configure any associated tasks required to run the application on the target computers. For example, you can configure any associated license agreements. - - The following items can be configured using the Sequencer as part of this step: - - - **Load Package** loads files associated with the package. It can take several seconds to an hour to decode the package. - - **Run Each Program** optionally runs programs contained within the package. This step can help you complete associated license or configuration tasks that must be completed before deploying and running the package on target computers. To run all the programs at once, select at least one program, and then select **Run All**. To run specific programs, select the program or programs that you want to run, and then select **Run Selected**. Complete the required configuration tasks, then close the applications. It can take several minutes for all programs to run. Select **Next**. - - **Save Package** saves the package. - - **Primary Feature Block** optimizes the package for streaming by rebuilding the primary feature block. - - If you don't want to configure the applications, select **Skip this step**, then select **Next**. - -12. On the **Completion** page, after you review the information that is displayed in the **Virtual Application Package Report** pane, select **Close**. - - The package is now available in the Sequencer. To edit the package properties, select **Edit \[Package Name\]**. For more information about how to modify a package, see [How to modify an existing virtual application package](appv-modify-an-existing-virtual-application-package.md). - - - - - -## Related articles - -- [Operations for App-V](appv-operations.md) diff --git a/windows/application-management/app-v/appv-create-and-use-a-project-template.md b/windows/application-management/app-v/appv-create-and-use-a-project-template.md deleted file mode 100644 index 9420f67b5f..0000000000 --- a/windows/application-management/app-v/appv-create-and-use-a-project-template.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: Create and apply an App-V project template to a sequenced App-V package (Windows 10/11) -description: Steps for how to create and apply an App-V project template (.appvt) to a sequenced App-V package. -author: aczechowski -ms.prod: windows-client -ms.date: 07/10/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.technology: itpro-apps ---- - -# Create and apply an App-V project template to a sequenced App-V package - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -You can use an App-V Project Template (.appvt) file to save commonly applied settings associated with an existing virtual application package. You can then apply these settings whenever you create new virtual application packages in your environment, streamlining the package creation process. App-V Project Templates differ from App-V Package Accelerators because App-V Package Accelerators are application-specific, while App-V Project Templates can be applied to multiple applications. To learn more about package accelerators, see [How to create a package accelerator](appv-create-a-package-accelerator.md). - ->[!IMPORTANT] ->Starting with Windows 10 version 1703, running the **New-AppvSequencerPackage** or the **Update-AppvSequencerPackage** cmdlets will automatically capture and store your customizations as an App-V Project Template. If you want to make changes to this package later, you can automatically load your customizations from this template file. If you have an auto-saved template and you attempt to load another template through the *TemplateFilePath* parameter, the customization value from the parameter will override the auto-saved template. - -## Create a project template - -You must first create and save a project template, including a virtual app package with settings to be used by the template. - -1. On the device running the App-V Sequencer, select **Start**, select **All Programs**, select **Microsoft Application Virtualization**, and then select **Microsoft Application Virtualization Sequencer**. - - > [!NOTE] - >If the virtual app package is currently open in the App-V Sequencer console, skip to Step 3 of this procedure. - -2. On the **File** menu, select **Open**, select **Edit Package**, browse for the virtual app package that includes the settings you want to save with the App-V Project Template, and then select **Edit** to change any of the settings or info included in the file. - -3. On the **File** menu, select **Save As Template**, review the settings associated with the new template, select **OK**, name your new template, and then select **Save**. - - The new App-V Project Template is saved in the folder you specified. - -## Apply a project template - -After creating the template, you can apply it to all of your new virtual app packages, automatically including all of the settings. - ->[!IMPORTANT] ->Virtual app packages don't support using both a project template and a package accelerator at the same time. - -1. On the device running the App-V Sequencer, select **Start** > **All Programs** > **Microsoft Application Virtualization** > **Microsoft Application Virtualization Sequencer**. - -2. On the **File** menu, select **New From Template**, browse to your newly created project template and select **Open**. - -3. Create your new virtual app package. The settings saved with your template are automatically applied. - -### Related articles - -- [Download the Windows ADK](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit) -- [How to install the App-V Sequencer](appv-install-the-sequencer.md) -- [Learn about Hyper-V on Windows Server 2016](/windows-server/virtualization/hyper-v/Hyper-V-on-Windows-Server) -- [Automatically sequence multiple apps at the same time using Microsoft Application Virtualization Sequencer (App-V Sequencer)](appv-auto-batch-sequencing.md) -- [Automatically update multiple apps at the same time using Microsoft Application Virtualization Sequencer (App-V Sequencer)](appv-auto-batch-updating.md) -- [Manually sequence a new app using Microsoft Application Virtualization Sequencer (App-V Sequencer)](appv-sequence-a-new-application.md) diff --git a/windows/application-management/app-v/appv-creating-and-managing-virtualized-applications.md b/windows/application-management/app-v/appv-creating-and-managing-virtualized-applications.md deleted file mode 100644 index 4616ec336f..0000000000 --- a/windows/application-management/app-v/appv-creating-and-managing-virtualized-applications.md +++ /dev/null @@ -1,156 +0,0 @@ ---- -title: Creating and managing App-V virtualized applications (Windows 10/11) -description: Create and manage App-V virtualized applications to monitor and record the installation process for an application to be run as a virtualized application. -author: aczechowski -ms.prod: windows-client -ms.date: 04/18/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.technology: itpro-apps ---- -# Creating and managing App-V virtualized applications - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -After you've properly deployed the Microsoft Application Virtualization (App-V) sequencer, you can use it to monitor and record the installation and setup process for an application to be run as a virtualized application. - -For more information about configuring the App-V sequencer, sequencing best practices, and an example of creating and updating a virtual application, see the [Microsoft Application Virtualization 5.0 Sequencing Guide](https://download.microsoft.com/download/F/7/8/F784A197-73BE-48FF-83DA-4102C05A6D44/App-V%205.0%20Sequencing%20Guide.docx). - ->[!NOTE] ->The App-V Sequencer cannot sequence applications with filenames matching "CO_<x>" where x is any numeral. Error 0x8007139F will be generated. - -## Sequencing an application - -You can use the App-V Sequencer to perform the following tasks: - -- Create virtual packages that can be deployed to computers running the App-V client. -- Upgrade existing packages. You can expand an existing package onto the computer running the sequencer and then upgrade the application to create a newer version. -- Edit configuration information associated with an existing package. For example, you can add a shortcut or modify a file type association. - - > [!NOTE] - >You must create shortcuts and save them to an available network location to allow roaming. If a shortcut is created and saved in a private location, the package must be published locally to the computer running the App-V client. - -- Convert existing virtual packages. - -The sequencer uses the **%TMP% \\ Scratch** or **%TEMP% \\ Scratch** directory and the **Temp** directory to store temporary files during sequencing. On the computer that runs the sequencer, you should configure these directories with free disk space equivalent to the estimated application installation requirements. Configuring the temp directories and the Temp directory on different hard drive partitions can help improve performance during sequencing. - -When you use the sequencer to create a new virtual application, the following listed files are created. These files comprise the App-V package. - -- **.msi file**. This Windows Installer (.msi) file is created by the sequencer and is used to install the virtual package on target computers. -- **Report.xml file**. In this file, the sequencer saves all issues, warnings, and errors that were discovered during sequencing. It displays the information after the package has been created. You can us this report for diagnosing and troubleshooting. -- **.appv file**. This file is the virtual application file. -- **Deployment configuration file**. The deployment configuration file determines how the virtual application will be deployed to target computers. -- **User configuration file**. The user configuration file determines how the virtual application will run on target computers. - ->[!IMPORTANT] ->You must configure the %TMP% and %TEMP% folders that the package converter uses to be a secure location and directory. A secure location is only accessible by an administrator. Additionally, when you sequence the package, you should either save the package to a secure location or make sure that no other user is allowed to log in during the conversion and monitoring process. - -The **Options** dialog box in the sequencer console contains the following tabs: - -- **General**. Use this tab to enable Microsoft Updates to run during sequencing. Select **Append Package Version to Filename** to configure the sequence to add a version number to the virtualized package that is being sequenced. Select **Always trust the source of Package Accelerators** to create virtualized packages using a package accelerator without being prompted for authorization. - - >[!IMPORTANT] - >Package Accelerators created using App-V 4.6 are not supported by App-V. - -- **Parse Items**. This tab displays the associated file path locations that will be parsed or tokenized into in the virtual environment. Tokens are useful for adding files using the **Package Files** tab in **Advanced Editing**. -- **Exclusion Items**. Use this tab to specify which folders and directories shouldn't be monitored during sequencing. To add local application data that is saved in the Local App Data folder in the package, click **New** and specify the location and the associated **Mapping Type**. This option is required for some packages. - -App-V supports applications that include Microsoft Windows Services. If an application includes a Windows service, the service will be included in the sequenced virtual package as long as it's installed while being monitored by the sequencer. If a virtual application creates a Windows service when it initially runs, then after installation, the application must be run while the sequencer is monitoring for the Windows Service to be included in the package. Only services running under the Local System account are supported. Services configured for AutoStart or Delayed AutoStart are started before the first virtual application in a package runs inside the package’s Virtual Environment. Windows Services that are configured to be started on demand by an application are started when the virtual application inside the package starts the Service via API call. - -- [Automatically provision your sequencing environment using Microsoft Application Virtualization Sequencer (App-V Sequencer)](appv-auto-provision-a-vm.md) -- [How to Sequence a New Application with App-V](appv-sequence-a-new-application.md) -- [Automatically sequence multiple apps at the same time using Microsoft Application Virtualization Sequencer (App-V Sequencer)](appv-auto-batch-sequencing.md) - -## App-V shell extension support - -App-V supports shell extensions. Shell extensions will be detected and embedded in the package during sequencing. - -Shell extensions are automatically embedded in the package during the sequencing process. When the package is published, the shell extension gives users the same functionality as if the application were locally installed. - -### Requirements for using shell extensions - -- Packages that contain embedded shell extensions must be published globally. The application requires no extra setup or configuration on the client to enable the shell extension functionality. -- The “bitness” of the application, Sequencer, and App-V client must match, or the shell extensions won’t work. For example: - - The version of the application is 64-bit. - - The Sequencer is running on a 64-bit computer. - - The package is being delivered to a 64-bit App-V client computer. - -The following table lists the supported shell extensions: - -|Handler|Description| -|---|---| -|Context menu handler|Adds menu items to the context menu. It's called before the context menu is displayed.| -|Drag-and-drop handler|Controls the action where right-click, drag and drop, and modifies the context menu that appears.| -|Drop target handler|Controls the action after a data object is dragged and dropped over a drop target such as a file.| -|Data object handler|Controls the action after a file is copied to the clipboard or dragged and dropped over a drop target. It can provide more clipboard formats to the drop target.| -|Property sheet handler|Replaces or adds pages to the property sheet dialog box of an object.| -|Infotip handler|Allows retrieving flags and infotip information for an item and displaying it inside a pop-up tooltip upon mouse hover.| -|Column handler|Allows creating and displaying custom columns in **Windows Explorer Details view**. It can be used to extend sorting and grouping.| -|Preview handler|Enables a preview of a file to be displayed in the Windows Explorer Preview pane.| - -## Copy on Write (CoW) file extension support - -Copy on write (CoW) file extensions allow App-V to dynamically write to specific locations contained in the virtual package while it's being used. - -The following list shows the file types that can exist in a virtual package under the VFS directory, since App-V 5.1, but which can't be updated on the computer running the App-V client. All other files and directories can be modified. - -- .com -- .exe -- .dll -- .ocx - -## Modifying an existing virtual application package - -You can use the sequencer to modify an existing package. The computer on which you do this modification should match the chip architecture of the computer you used to create the application. For example, if you initially sequenced a package using a computer running a 64-bit operating system, you should modify the package using a computer running a 64-bit operating system. - -For more information, see [How to Modify an Existing Virtual Application Package](appv-modify-an-existing-virtual-application-package.md). - -## Creating a project template - -An App-V project template (.appvt) file is a project template that can be used to save commonly applied, customized settings. You can then more easily use these settings for future sequencings. App-V project templates differ from App-V Application Accelerators because App-V Application Accelerators are application-specific, and App-V project templates can be applied to multiple applications. Additionally, you can't use a project template when you use a Package Accelerator to create a virtual application package. The following general settings are saved with an App-V project template: - -A template can specify and store multiple settings as follows: - -- **Advanced Monitoring Options**. Enables Microsoft Update to run during monitoring. Saves allow local interaction option settings -- **General Options**. Enables the use of **Windows Installer**, **Append Package Version to Filename**. -- **Exclusion Items.** Contains the Exclusion pattern list. - -Starting with Windows 10 version 1703, running the **new-appvsequencerpackage** or **update-appvsequencepackage** cmdlets automatically captures and stores all of your customizations as an App-V project template. If you want to make changes to this package later, your customizations are automatically loaded from this template file. - ->[!IMPORTANT] ->If you attempt to load another template through the *_TemplateFilePath_* parameter while already having an auto-saved template, the customization value from the parameter will override the auto-saved template. - -For more information, see [How to Create and Use a Project Template](appv-create-and-use-a-project-template.md). - -## Creating a package accelerator - ->[!NOTE] ->Package accelerators created using a previous version of App-V must be recreated using App-V. - -You can use App-V package accelerators to automatically generate a new virtual application package. After you've successfully created a package accelerator, you can reuse and share the package accelerator. - -In some situations, to create the package accelerator, you might have to install the application locally on the computer that runs the sequencer. In such cases, you should first try to create the package accelerator with the installation media. If multiple missing files are required, you should install the application locally to the computer that runs the sequencer, and then create the package accelerator. - -After you've successfully created a Package Accelerator, you can reuse and share the Package Accelerator. Creating App-V Package Accelerators is an advanced task. Package Accelerators can contain password and user-specific information. Therefore you must save Package Accelerators and the associated installation media in a secure location, and you should digitally sign the Package Accelerator after you create it so that the publisher can be verified when the App-V Package Accelerator is applied. - -For more information, see the following articles: - -- [How to Create a Package Accelerator](appv-create-a-package-accelerator.md) -- [How to Create a Virtual Application Package Using an App-V Package Accelerator](appv-create-a-virtual-application-package-package-accelerator.md) - -## Sequencer error reporting - -The App-V Sequencer can detect common sequencing issues during sequencing. The **Installation Report** page at the end of the sequencing wizard displays diagnostic messages categorized into **Errors**, **Warnings**, and **Info** depending on the severity of the issue. - -You can also find additional information about sequencing errors using the Windows Event Viewer. - - - - - -## Related articles - -- [Operations for App-V](appv-operations.md) diff --git a/windows/application-management/app-v/appv-customize-virtual-application-extensions-with-the-management-console.md b/windows/application-management/app-v/appv-customize-virtual-application-extensions-with-the-management-console.md deleted file mode 100644 index 117cbd91bd..0000000000 --- a/windows/application-management/app-v/appv-customize-virtual-application-extensions-with-the-management-console.md +++ /dev/null @@ -1,40 +0,0 @@ ---- -title: How to customize virtual application extensions for a specific AD group by using the Management Console (Windows 10/11) -description: How to customize virtual application extensions for a specific AD group by using the Management Console. -author: aczechowski -ms.prod: windows-client -ms.date: 07/10/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.technology: itpro-apps ---- -# How to customize virtual applications extensions for a specific AD group by using the Management Console - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -Use the following procedure to customize the virtual application extensions for an Active Directory (AD) group. - -## Customize virtual applications extensions for an AD group - -1. To view the package that you want to configure, open the App-V Management Console. To view the configuration assigned to a given user group, select the package, then right-click the package name and select **Edit active directory access**. Alternatively, select the package and select **EDIT** in the **AD ACCESS** pane. - -2. To customize an AD group, you can find the group from the list of **AD Entities with Access**. Then, using the drop-down box in the **Assigned Configuration** pane, select **Custom**, and then select **EDIT**. - -3. To disable all extensions for a given application, clear **ENABLE**. - - To add a new shortcut for the selected application, right-click the application in the **SHORTCUTS** pane, and select **Add new shortcut**. To remove a shortcut, right-click the application in the **SHORTCUTS** pane and select **Remove Shortcut**. To edit an existing shortcut, right-click the application and select **Edit Shortcut**. - -4. To view any other application extensions, select **Advanced**, and select **Export Configuration**. Enter a filename and select **Save**. You can view all application extensions that are associated with the package using the configuration file. - -5. To edit additional application extensions, modify the configuration file and select **Import and Overwrite this Configuration**. Select the modified file and select **Open**. In the dialog, select **Overwrite** to complete the process. - - - - - -## Related articles - -- [Operations for App-V](appv-operations.md) diff --git a/windows/application-management/app-v/appv-delete-a-connection-group.md b/windows/application-management/app-v/appv-delete-a-connection-group.md deleted file mode 100644 index 55dc6b0ec7..0000000000 --- a/windows/application-management/app-v/appv-delete-a-connection-group.md +++ /dev/null @@ -1,34 +0,0 @@ ---- -title: How to delete a connection group (Windows 10/11) -description: Learn how to delete an existing App-V connection group in the App-V Management Console and where to find information about managing connection groups. -author: aczechowski -ms.prod: windows-client -ms.date: 09/27/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.technology: itpro-apps ---- - -# How to delete a connection group - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -Use the following procedure to delete an existing App-V connection group. - -## Delete a connection group - -1. Open the App-V Management Console and select **CONNECTION GROUPS**. - -2. Right-click the connection group to be removed and select **delete**. - - - - - -## Related articles - -- [Operations for App-V](appv-operations.md) -- [Managing connection groups](appv-managing-connection-groups.md) diff --git a/windows/application-management/app-v/appv-delete-a-package-with-the-management-console.md b/windows/application-management/app-v/appv-delete-a-package-with-the-management-console.md deleted file mode 100644 index 1917d768e9..0000000000 --- a/windows/application-management/app-v/appv-delete-a-package-with-the-management-console.md +++ /dev/null @@ -1,33 +0,0 @@ ---- -title: How to delete a package in the Management Console (Windows 10/11) -description: Learn how to delete a package in the App-V Management Console and where to find information about operations for App-V. -author: aczechowski -ms.prod: windows-client -ms.date: 09/27/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.technology: itpro-apps ---- - -# How to delete a package in the Management Console - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -Use the following procedure to delete an App-V package. - -## Delete a package in the Management Console - -1. To view the package you want to delete, open the App-V Management Console and select **Packages**. Select the package to be removed. - -2. Select or right-click the package, then select **Delete** to remove the package. - - - - - -## Related articles - -- [Operations for App-V](appv-operations.md) diff --git a/windows/application-management/app-v/appv-deploy-appv-databases-with-sql-scripts.md b/windows/application-management/app-v/appv-deploy-appv-databases-with-sql-scripts.md deleted file mode 100644 index 3fac560518..0000000000 --- a/windows/application-management/app-v/appv-deploy-appv-databases-with-sql-scripts.md +++ /dev/null @@ -1,188 +0,0 @@ ---- -title: How to Deploy the App-V Databases by Using SQL Scripts (Windows 10/11) -description: Learn how to use SQL scripts to install the App-V databases and upgrade the App-V databases to a later version. -author: aczechowski -ms.prod: windows-client -ms.date: 04/18/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.technology: itpro-apps ---- - -# How to deploy the App-V databases by using SQL scripts - ->Applies to: Windows Server 2016 - -Use the following instructions to use SQL scripts, rather than the Windows Installer, to: - -* Install the App-V databases -* Upgrade the App-V databases to a later version - ->[!NOTE] ->If you have already deployed an App-V 5.0 SP3 database or later, the SQL scripts are not required to upgrade to App-V for Windows. - -## How to install the App-V databases by using SQL scripts - -1. Before you install the database scripts, review and keep a copy of the App-V license terms. By running the database scripts, you are agreeing to the license terms. If you do not accept them, you should not use this software. - -2. Copy **appv\_server\_setup.exe** from the App-V release media to a temporary location. - -3. From a command prompt, run **appv\_server\_setup.exe** and specify a temporary location for extracting the database scripts. - - ```sql - appv\_server\_setup.exe /layout c:\\__ - ``` - -4. Browse to the temporary location that you created, open the extracted **DatabaseScripts** folder, and review the appropriate **readme.txt** file for instructions: - - | Database | Location of readme.txt file to use| - |---|---| - | Management database | ManagementDatabase subfolder | - | Reporting database | ReportingDatabase subfolder | - ->[!CAUTION] ->The readme.txt file in the ManagementDatabase subfolder is out of date. The information in the updated readme files below is the most current and should supersede the readme information provided in the **DatabaseScripts** folders. - ->[!IMPORTANT] -> The InsertVersionInfo.sql script is not required for versions of the App-V management database later than App-V 5.0 SP3. - -### Updated management database README file content - -```syntax -*********************************************************************************************************** -Before you install and use the Application Virtualization Database Scripts, you must: - -- Review the license terms. -- Print and retain a copy of the license terms for your records. - -By running the App-V you agree to such license terms. If you do not accept them, do not use the software. -*********************************************************************************************************** - -Steps to install "AppVManagement" schema in SQL SERVER. - -## PREREQUISITES: - - 1. Review the installation package. The following files MUST exist: - - SQL files - --------- - Database.sql - CreateTables.sql - CreateStoredProcs.sql - UpdateTables.sql - Permissions.sql - - 2. Ensure the target SQL Server instance and SQL Server Agent service are running. - - 3. If you are not running the scripts directly on the server, ensure the - necessary SQL Server client software is installed and available from - the specified location. Specifically, the "osql" command must be supported for these scripts to run. - -## PREPARATION: - - 1. Review the database.sql file and modify as necessary. Although the - defaults are likely sufficient, it is suggested that the following - settings be reviewed: - - DATABASE - ensure name is satisfactory - default is "AppVManagement". - - 2. Review the Permissions.sql file and provide all the necessary account information - for setting up read and write access on the database. Note: Default settings in the file will not work. - -## INSTALLATION: - - 1. Run the database.sql against the "master" database. Your user - credential must have the ability to create databases. - This script will create the database. - - 2. Run the following scripts against the "AppVManagement" database using the - same account as above in order. - - CreateTables.sql - CreateStoredProcs.sql - UpdateTables.sql - Permissions.sql - -``` - -### Updated reporting database README file content - -```syntax -*********************************************************************************************************** -Before you install and use the Application Virtualization Database Scripts, you must: - -- Review the license terms. -- Print and retain a copy of the license terms for your records. - -By running the App-V you agree to such license terms. If you do not accept them, do not use the software. -*********************************************************************************************************** - -Steps to install "AppVReporting" schema in SQL SERVER. - -## PREREQUISITES: - - 1. Review the installation package. The following files MUST exist: - - SQL files - --------- - Database.sql - UpgradeDatabase.sql - CreateTables.sql - CreateReportingStoredProcs.sql - CreateStoredProcs.sql - CreateViews.sql - Permissions.sql - ScheduleReportingJob.sql - - 2. Ensure the target SQL Server instance and SQL Server Agent service are running. - - 3. If you are not running the scripts directly on the server, ensure the - necessary SQL Server client software is installed and executable from - the location you have chosen. Specifically, the "osql" command must be supported for these scripts to run. - -## PREPARATION: - - 1. Review the database.sql file and modify as necessary. Although the - defaults are likely sufficient, it is suggested that the following - settings be reviewed: - - DATABASE - ensure name is satisfactory - default is "AppVReporting". - - 2. Review the Permissions.sql file and provide all the necessary account information - for setting up read and write access on the database. Note: Default settings - in the file will not work. - - 3. Review the ScheduleReportingJob.sql file and make sure that the stored proc schedule - time is acceptable. The default stored proc schedule time is at 12.01 AM (line 84). - If this time is not suitable, you can change this to a more suitable time. The time is in the format HHMMSS. - -## INSTALLATION: - - 1. Run the database.sql against the "master" database. Your user - credential must have the ability to create databases. - This script will create the database. - - 2. If upgrading the database, run UpgradeDatabase.sql This will upgrade database schema. - - 2. Run the following scripts against the "AppVReporting" database using the - same account as above in order. - - CreateTables.sql - CreateReportingStoredProcs.sql - CreateStoredProcs.sql - CreateViews.sql - Permissions.sql - ScheduleReportingJob.sql -``` - - - - - -## Related articles - -* [Deploying the App-V Server](appv-deploying-the-appv-server.md) -* [How to deploy the App-V Server](appv-deploy-the-appv-server.md) diff --git a/windows/application-management/app-v/appv-deploy-appv-packages-with-electronic-software-distribution-solutions.md b/windows/application-management/app-v/appv-deploy-appv-packages-with-electronic-software-distribution-solutions.md deleted file mode 100644 index cbaf3e7123..0000000000 --- a/windows/application-management/app-v/appv-deploy-appv-packages-with-electronic-software-distribution-solutions.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: How to deploy App-V packages using electronic software distribution (Windows 10/11) -description: Learn how to use an electronic software distribution (ESD) system to deploy App-V virtual applications to App-V clients. -author: aczechowski -ms.prod: windows-client -ms.date: 09/27/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.technology: itpro-apps ---- - -# How to deploy App-V packages using electronic software distribution - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -You can use an electronic software distribution (ESD) system to deploy App-V virtual applications to App-V clients. - -For component requirements and options for using an ESD to deploy App-V packages, see [Planning to deploy App-V with an electronic software distribution system](appv-planning-to-deploy-appv-with-electronic-software-distribution-solutions.md). - -Use one of the following methods to publish packages to App-V client computers with an ESD: - -- Use the functionality in a third-party ESD. -- Install the application on the target client computer with the associated Windows Installer (.msi) file that's created when you initially sequence the application. The .msi file contains the associated App-V package file information used to configure a package and copies the required package files to the client. -- Use Windows PowerShell cmdlets to deploy virtualized applications. For more information about using Windows PowerShell and App-V, see [Administering App-V by using Windows PowerShell](appv-administering-appv-with-powershell.md). - -| Method | Description | -|---|---| -| Functionality provided by a third-party ESD | Use the functionality in a third-party ESD.| -| Stand-alone Windows Installer | Install the application on the target client computer by using the associated Windows Installer (.msi) file that is created when you initially sequence an application. The Windows Installer file contains the associated App-V package file information used to configure a package and copies the required package files to the client. | -| Windows PowerShell | Use Windows PowerShell cmdlets to deploy virtualized applications. For more information about using Windows PowerShell and App-V, see [Administering App-V by using Windows PowerShell](appv-administering-appv-with-powershell.md).| - -## Deploy App-V packages with an ESD - -1. Install the App-V Sequencer on a computer in your environment. For more information about installing the sequencer, see [How to install the Sequencer](appv-install-the-sequencer.md). - -2. Use the App-V Sequencer to create a virtual application. To learn more about creating virtual applications, see [Creating and managing App-V virtualized applications](appv-creating-and-managing-virtualized-applications.md). - -3. After you create the virtual application, deploy the package by using your ESD solution. - - - - - -## Related articles - -- [Operations for App-V](appv-operations.md) diff --git a/windows/application-management/app-v/appv-deploy-the-appv-server-with-a-script.md b/windows/application-management/app-v/appv-deploy-the-appv-server-with-a-script.md deleted file mode 100644 index 19e48512a0..0000000000 --- a/windows/application-management/app-v/appv-deploy-the-appv-server-with-a-script.md +++ /dev/null @@ -1,526 +0,0 @@ ---- -title: How to Deploy the App-V Server Using a Script (Windows 10/11) -description: 'Learn how to deploy the App-V server by using a script (appv_server_setup.exe) from the command line.' -author: aczechowski -ms.prod: windows-client -ms.date: 04/18/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.technology: itpro-apps ---- - -# How to deploy the App-V server using a script - ->Applies to: Windows Server 2016 - -In order to complete the **appv_server_setup.exe** server setup successfully using the command line, you must specify and combine multiple parameters. - -## To install the App-V server using a script - -Use the following lists and tables for more information about installing the App-V server using the command line. - -The information in the following lists and tables can also be accessed through the command line by entering the following command: ```appv\_server\_setup.exe /?```. - -## How to use common parameters to install the Management server and Management database on a local machine - -The following examples will show you how to install the Management server and database on a local machine. - -### Parameters for a default instance of Microsoft SQL Server for a new installation on a local machine - -To use the default instance of Microsoft SQL Server, use the following parameters: - -* */MANAGEMENT_SERVER* -* */MANAGEMENT_ADMINACCOUNT* -* */MANAGEMENT_WEBSITE_NAME* -* */MANAGEMENT_WEBSITE_PORT* -* */DB_PREDEPLOY_MANAGEMENT* -* */MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT* -* */MANAGEMENT_DB_NAME* - -### Parameters for a custom instance of Microsoft SQL Server for a new installation on a local machine - -To use a custom instance of Microsoft SQL Server, use the following parameters: - -* */MANAGEMENT_SERVER* -* */MANAGEMENT_ADMINACCOUNT* -* */MANAGEMENT_WEBSITE_NAME* -* */MANAGEMENT_WEBSITE_PORT* -* */DB_PREDEPLOY_MANAGEMENT* -* */MANAGEMENT_DB_CUSTOM_SQLINSTANCE* -* */MANAGEMENT_DB_NAME* - -### Example parameters for using a custom instance of Microsoft SQL Server for a new installation on a local machine - -```SQL -/appv_server_setup.exe /QUIET -/MANAGEMENT_SERVER -/MANAGEMENT_ADMINACCOUNT="Domain\AdminGroup" -/MANAGEMENT_WEBSITE_NAME="Microsoft AppV Management Service" -/MANAGEMENT_WEBSITE_PORT="8080" -/DB_PREDEPLOY_MANAGEMENT -/MANAGEMENT_DB_CUSTOM_SQLINSTANCE="SqlInstanceName" -/MANAGEMENT_DB_NAME="AppVManagement" -``` - -## How to use common parameters to install the Management server using an existing Management database on a local machine - -The following examples will show you how to install the Management server on a local machine with an existing Management database. - -### Default instance of Microsoft SQL Server for installation with an existing Management database on a local machine - -To use the default instance of Microsoft SQL Server, use the following parameters: - -* */MANAGEMENT_SERVER* -* */MANAGEMENT_ADMINACCOUNT* -* */MANAGEMENT_WEBSITE_NAME* -* */MANAGEMENT_WEBSITE_PORT* -* */EXISTING_MANAGEMENT_DB_SQL_SERVER_USE_LOCAL* -* */EXISTING_MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT* -* */EXISTING_MANAGEMENT_DB_NAME* - -### Custom instance of Microsoft SQL Server for installation with an existing Management database on a local machine - -To use a custom instance of Microsoft SQL Server, use these parameters: - -* */MANAGEMENT_SERVER* -* */MANAGEMENT_ADMINACCOUNT* -* */MANAGEMENT_WEBSITE_NAME* -* */MANAGEMENT_WEBSITE_PORT* -* */EXISTING_MANAGEMENT_DB_SQL_SERVER_USE_LOCAL* -* */EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE* -* */EXISTING_MANAGEMENT_DB_NAME* - -### Example parameters for using a custom instance of Microsoft SQL Server for installation with an existing Management database on a local machine - -```SQL -/appv_server_setup.exe /QUIET -/MANAGEMENT_SERVER -/MANAGEMENT_ADMINACCOUNT="Domain\AdminGroup" -/MANAGEMENT_WEBSITE_NAME="Microsoft AppV Management Service" -/MANAGEMENT_WEBSITE_PORT="8080" -/EXISTING_MANAGEMENT_DB_SQL_SERVER_USE_LOCAL -/EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE ="SqlInstanceName" -/EXISTING_MANAGEMENT_DB_NAME ="AppVManagement" -``` - -## How to install the Management server with an existing Management database on a remote machine - -### Default instance of Microsoft SQL Server with an existing Management database on a remote machine - -To use the default instance of Microsoft SQL Server, use the following parameters: - -* */MANAGEMENT_SERVER* -* */MANAGEMENT_ADMINACCOUNT* -* */MANAGEMENT_WEBSITE_NAME* -* */MANAGEMENT_WEBSITE_PORT* -* */EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME* -* */EXISTING_MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT* -* */EXISTING_MANAGEMENT_DB_NAME* - -### Custom instance of Microsoft SQL Server with an existing Management database on a remote machine - -To use a custom instance of Microsoft SQL Server, use these parameters: - -* */MANAGEMENT_SERVER* -* */MANAGEMENT_ADMINACCOUNT* -* */MANAGEMENT_WEBSITE_NAME* -* */MANAGEMENT_WEBSITE_PORT* -* */EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME* -* */EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE* -* */EXISTING_MANAGEMENT_DB_NAME* - -### Example for using a custom instance of Microsoft SQL Server with an existing Management database on a remote machine - -```SQL -/appv_server_setup.exe /QUIET -/MANAGEMENT_SERVER -/MANAGEMENT_ADMINACCOUNT="Domain\AdminGroup" -/MANAGEMENT_WEBSITE_NAME="Microsoft AppV Management Service" -/MANAGEMENT_WEBSITE_PORT="8080" -/EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME="SqlServermachine.domainName" -/EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE ="SqlInstanceName" -/EXISTING_MANAGEMENT_DB_NAME ="AppVManagement" -``` - -## Installing the Management database and the Management Server on the same computer - -The following examples will show you how to install the Management server and database on the same computer. - -### Default instance of Microsoft SQL Server for installation on the same computer - -To use the default instance of Microsoft SQL Server, use these parameters: - -* */DB_PREDEPLOY_MANAGEMENT* -* */MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT* -* */MANAGEMENT_DB_NAME* -* */MANAGEMENT_SERVER_MACHINE_USE_LOCAL* -* */MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT* - -### Custom instance of Microsoft SQL Server for installation on the same computer - -To use a custom instance of Microsoft SQL Server, use these parameters: - -* */DB_PREDEPLOY_MANAGEMENT* -* */MANAGEMENT_DB_CUSTOM_SQLINSTANCE* -* */MANAGEMENT_DB_NAME* -* */MANAGEMENT_SERVER_MACHINE_USE_LOCAL* -* */MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT* - -### Example for using a custom instance of Microsoft SQL Server for installation on the same computer - -```SQL -/appv_server_setup.exe /QUIET -/DB_PREDEPLOY_MANAGEMENT -/MANAGEMENT_DB_CUSTOM_SQLINSTANCE="SqlInstanceName" -/MANAGEMENT_DB_NAME="AppVManagement" -/MANAGEMENT_SERVER_MACHINE_USE_LOCAL -/MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT="Domain\InstallAdminAccount" -``` - -## Installing the Management database on a different computer than the Management server - -The following examples will show you how to install the Management database and server on different computers. - -### Default instance of Microsoft SQL Server for installing the Management database on a different computer than the Management server - -To use the default instance of Microsoft SQL Server, use the following parameters: - -* */DB_PREDEPLOY_MANAGEMENT* -* */MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT* -* */MANAGEMENT_DB_NAME* -* */MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT* -* */MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT* - -### Custom instance of Microsoft SQL Server for installing the Management database on a different computer than the Management server - -To use a custom instance of Microsoft SQL Server, use these parameters: - -* */DB_PREDEPLOY_MANAGEMENT* -* */MANAGEMENT_DB_CUSTOM_SQLINSTANCE* -* */MANAGEMENT_DB_NAME* -* */MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT* -* */MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT* - -### Example for using a custom instance of Microsoft SQL Server for installing the Management database on a different computer than the Management server - -```SQL -/appv_server_setup.exe /QUIET -/DB_PREDEPLOY_MANAGEMENT -/MANAGEMENT_DB_CUSTOM_SQLINSTANCE="SqlInstanceName" -/MANAGEMENT_DB_NAME="AppVManagement" -/MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT="Domain\MachineAccount" -/MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT="Domain\InstallAdminAccount" -``` - -## Installing the Publishing server - -The following examples will show you how to install the Publishing server. - -### Default instance of Microsoft SQL Server for installing the Publishing server - -To use the default instance of Microsoft SQL Server, use the following parameters: - -* */PUBLISHING_SERVER* -* */PUBLISHING_MGT_SERVER* -* */PUBLISHING_WEBSITE_NAME* -* */PUBLISHING_WEBSITE_PORT* - -### Example for installing the Publishing server - -```SQL -/appv_server_setup.exe /QUIET -/PUBLISHING_SERVER -/PUBLISHING_MGT_SERVER="http://ManagementServerName:ManagementPort" -/PUBLISHING_WEBSITE_NAME="Microsoft AppV Publishing Service" -/PUBLISHING_WEBSITE_PORT="8081" -``` - -## Installing the Reporting server and Reporting database on a local machine - -The following examples will show you how to install the Reporting server and database on a local machine. - -### Default instance of Microsoft SQL Server for installing the Reporting server and Reporting database on a local machine - -To use the default instance of Microsoft SQL Server, use the following parameters: - -* */REPORTING_SERVER* -* */REPORTING_WEBSITE_NAME* -* */REPORTING_WEBSITE_PORT* -* */DB_PREDEPLOY_REPORTING* -* */REPORTING_DB_SQLINSTANCE_USE_DEFAULT* -* */REPORTING_DB_NAME* - -### Custom instance of Microsoft SQL Server for installing the Reporting server and Reporting database on a local machine - -To use a custom instance of Microsoft SQL Server, use these parameters: - -* */REPORTING_SERVER* -* */REPORTING_ADMINACCOUNT* -* */REPORTING_WEBSITE_NAME* -* */REPORTING_WEBSITE_PORT* -* */DB_PREDEPLOY_REPORTING* -* */REPORTING_DB_CUSTOM_SQLINSTANCE* -* */REPORTING_DB_NAME* - -### Example for using a custom instance of Microsoft SQL Server for installing the Reporting server and Reporting database on a local machine - -```SQL -/appv_server_setup.exe /QUIET -/REPORTING_SERVER -/REPORTING_WEBSITE_NAME="Microsoft AppV Reporting Service" -/REPORTING_WEBSITE_PORT="8082" -/DB_PREDEPLOY_REPORTING -/REPORTING_DB_CUSTOM_SQLINSTANCE="SqlInstanceName" -/REPORTING_DB_NAME="AppVReporting" -``` - -## Installing the Reporting server using an existing Reporting database on a local machine - -The following examples will show you how to install the reporting machine on a local machine with an existing Reporting database. - -### Default instance of Microsoft SQL Server for installing the Reporting server using an existing Reporting database on a local machine - -To use the default instance of Microsoft SQL Server, use the following parameters: - -* */REPORTING_SERVER* -* */REPORTING_WEBSITE_NAME* -* */REPORTING_WEBSITE_PORT* -* */EXISTING_REPORTING_DB_SQL_SERVER_USE_LOCAL* -* */EXISTING_REPORTING_DB_SQLINSTANCE_USE_DEFAULT* -* */EXISTING_REPORTING_DB_NAME* - -### Custom instance of Microsoft SQL Server for installing the Reporting server using an existing Reporting database on a local machine - -To use a custom instance of Microsoft SQL Server, use these parameters: - -* */REPORTING_SERVER* -* */REPORTING_ADMINACCOUNT* -* */REPORTING_WEBSITE_NAME* -* */REPORTING_WEBSITE_PORT* -* */EXISTING_REPORTING_DB_SQL_SERVER_USE_LOCAL* -* */EXISTING_REPORTING_DB_CUSTOM_SQLINSTANCE* -* */EXISTING_REPORTING_DB_NAME* - -### Example for using a custom instance of Microsoft SQL Server for installing the Reporting server using an existing Reporting database on a local machine - -```SQL -/appv_server_setup.exe /QUIET -/REPORTING_SERVER -/REPORTING_WEBSITE_NAME="Microsoft AppV Reporting Service" -/REPORTING_WEBSITE_PORT="8082" -/EXISTING_REPORTING_DB_SQL_SERVER_USE_LOCAL -/EXISTING_REPORTING _DB_CUSTOM_SQLINSTANCE="SqlInstanceName" -/EXITING_REPORTING_DB_NAME="AppVReporting" -``` - -## Installing the Reporting server using an existing Reporting database on a remote machine - -The following examples will show you how to install the Reporting server and on a remote machine with an existing database. - -### Default instance of Microsoft SQL Server for installing the Reporting server using an existing Reporting database on a remote machine - -To use the default instance of Microsoft SQL Server, use the following parameters: - -* */REPORTING_SERVER* -* */REPORTING_WEBSITE_NAME* -* */REPORTING_WEBSITE_PORT* -* */EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME* -* */EXISTING_REPORTING_DB_SQLINSTANCE_USE_DEFAULT* -* */EXISTING_REPORTING_DB_NAME* - -### Custom instance of Microsoft SQL Server for installing the Reporting server using an existing Reporting database on a remote machine - -To use a custom instance of Microsoft SQL Server, use these parameters: - -* */REPORTING_SERVER* -* */REPORTING_ADMINACCOUNT* -* */REPORTING_WEBSITE_NAME* -* */REPORTING_WEBSITE_PORT* -* */EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME* -* */EXISTING_REPORTING_DB_CUSTOM_SQLINSTANCE* -* */EXISTING_REPORTING_DB_NAME* - -### Example using a custom instance of Microsoft SQL Server for installing the Reporting server using an existing Reporting database on a remote machine - -```SQL -/appv_server_setup.exe /QUIET -/REPORTING_SERVER -/REPORTING_WEBSITE_NAME="Microsoft AppV Reporting Service" -/REPORTING_WEBSITE_PORT="8082" -/EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME="SqlServerMachine.DomainName" -/EXISTING_REPORTING _DB_CUSTOM_SQLINSTANCE="SqlInstanceName" -/EXITING_REPORTING_DB_NAME="AppVReporting" -``` - -## Installing the Reporting database on the same computer as the Reporting server - -The following examples will show you how to install the Reporting database and server on the same computer. - -### Default instance of Microsoft SQL Server for installing the Reporting database on the same computer as the Reporting server - -To use the default instance of Microsoft SQL Server, use the following parameters: - -* */DB_PREDEPLOY_REPORTING* -* */REPORTING_DB_SQLINSTANCE_USE_DEFAULT* -* */REPORTING_DB_NAME* -* */REPORTING_SERVER_MACHINE_USE_LOCAL* -* */REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT* - -### Custom instance of Microsoft SQL Server for installing the Reporting database on the same computer as the Reporting server - -To use a custom instance of Microsoft SQL Server, use these parameters: - -* */DB_PREDEPLOY_REPORTING* -* */REPORTING_DB_CUSTOM_SQLINSTANCE* -* */REPORTING_DB_NAME* -* */REPORTING_SERVER_MACHINE_USE_LOCAL* -* */REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT* - -### Example for using a custom instance of Microsoft SQL Server for installing the Reporting database on the same computer as the Reporting server - -```SQL -/appv_server_setup.exe /QUIET -/DB_PREDEPLOY_REPORTING -/REPORTING_DB_CUSTOM_SQLINSTANCE="SqlInstanceName" -/REPORTING_DB_NAME="AppVReporting" -/REPORTING_SERVER_MACHINE_USE_LOCAL -/REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT="Domain\InstallAdminAccount" -``` - -## Installing the Reporting database on a different computer than the Reporting server - -The following examples will show you how to install the Reporting database and server on different computers. - -### Default instance of Microsoft SQL Server for installing the Reporting database on a different computer than the Reporting server - -To use the default instance of Microsoft SQL Server, use the following parameters: - -* */DB_PREDEPLOY_REPORTING* -* */REPORTING_DB_SQLINSTANCE_USE_DEFAULT* -* */REPORTING_DB_NAME* -* */REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT* -* */REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT* - -### Custom instance of Microsoft SQL Server for installing the Reporting database on a different computer than the Reporting server - -To use a custom instance of Microsoft SQL Server, use these parameters: - -* */DB_PREDEPLOY_REPORTING* -* */REPORTING_DB_CUSTOM_SQLINSTANCE* -* */REPORTING_DB_NAME* -* */REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT* -* */REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT* - -### Example for using a custom instance of Microsoft SQL Server for installing the Reporting database on a different computer than the Reporting server - -```SQL -/appv_server_setup.exe /QUIET -/DB_PREDEPLOY_REPORTING -/REPORTING_DB_CUSTOM_SQLINSTANCE="SqlInstanceName" -/REPORTING_DB_NAME="AppVReporting" -/REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT="Domain\MachineAccount" -/REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT="Domain\InstallAdminAccount" -``` - -## Parameter definitions - -* [General parameters](#parameter-definitions-for-general-parameters) -* [Management Server installation parameters](#parameter-definitions-for-management-server-installation-parameters) -* [Management Server Database parameters](#parameter-definitions-for-the-management-server-database) -* [Publishing Server installation parameters](#parameter-definitions-for-publishing-server-installation-parameters) -* [Reporting Server parameters](#parameter-definitions-for-reporting-server) -* [Parameters for using an existing Reporting Server database](#parameters-for-using-an-existing-reporting-server-database) -* [Reporting Server database installation parameters](#parameter-definitions-for-reporting-server-database-installation) -* [Parameters for using an existing Management Server database](#parameters-for-using-an-existing-management-server-database) - -### Parameter definitions for general parameters - -| Parameter | Description | -|-----------|-------------| -| */QUIET* | Specifies silent install. | -| */UNINSTALL* | Specifies an uninstall. | -| */LAYOUT* | Specifies layout action. This extracts the MSIs and script files to a folder without installing the actual product. No value is expected. | -| */LAYOUTDIR* | Specifies the layout directory with a string. For example, ```/LAYOUTDIR="C:\Application Virtualization Server"```. | -| */INSTALLDIR* | Specifies the installation directory with a string. For example, ```/INSTALLDIR="C:\Program Files\Application Virtualization\Server"```. | -| */MUOPTIN* | Enables Microsoft Update. No value is expected. | -| */ACCEPTEULA* | Accepts the license agreement. This is required for an unattended installation. For example, ```/ACCEPTEULA``` or ```/ACCEPTEULA=1```. | - -### Parameter definitions for Management Server installation parameters - -| Parameter | Description | -|-----------|-------------| -| */MANAGEMENT_SERVER* | Specifies that the management server will be installed. No value is expected. | -| */MANAGEMENT_ADMINACCOUNT* | Specifies the account that will be allowed administrator access to the management server. This account can be an individual user account or a group. For example, ```/MANAGEMENT_ADMINACCOUNT="mydomain\admin"```. If **/MANAGEMENT_SERVER** isn't specified, this parameter will be ignored.| -| */MANAGEMENT_WEBSITE_NAME* | Specifies name of the website that will be created for the management service. For example, ```/MANAGEMENT_WEBSITE_NAME="Microsoft App-V Management Service"``` | -| */MANAGEMENT_WEBSITE_PORT* | Specifies the port number that will be used by the management service will use. For example, ```/MANAGEMENT_WEBSITE_PORT=82```. | - -### Parameter definitions for the Management Server Database - -| Parameter | Description | -|-----------|-------------| -| */DB\_PREDEPLOY\_MANAGEMENT* | Specifies that the management database will be installed. You must have sufficient database permissions to complete this installation. No value is expected. | -| */MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT* | Indicates that the default SQL instance should be used. No value is expected. | -| */MANAGEMENT_DB_CUSTOM_SQLINSTANCE* | Specifies the name of the custom SQL instance that should be used to create a new database. For example, ```/MANAGEMENT_DB_CUSTOM_SQLINSTANCE="MYSQLSERVER"```. If **/DB_PREDEPLOY_MANAGEMENT** isn't specified, this parameter will be ignored. | -| */MANAGEMENT_DB_NAME* | Specifies the name of the new management database that should be created. For example, ```/MANAGEMENT_DB_NAME="AppVMgmtDB"```. If **/DB_PREDEPLOY_MANAGEMENT** isn't specified, this will be ignored. | -| */MANAGEMENT_SERVER_MACHINE_USE_LOCAL* | Indicates if the management server that will be accessing the database is installed on the local server. This is a switch parameter, so no value is expected. | -| */MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT* | Specifies the machine account of the remote machine that the management server will be installed on. For example, ```/MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT="domain\computername"```. | -| */MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT* | Indicates the Administrator account that will be used to install the management server. For example, ```/MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT ="domain\alias"```. | - -### Parameter definitions for Publishing Server installation parameters - -| Parameter | Description | -|-----------|-------------| -| */PUBLISHING_SERVER* | Specifies that the publishing server will be installed. No value is expected. | -| */PUBLISHING_MGT_SERVER* | Specifies the URL to Management Service the Publishing server will connect to. For example, ```http://;```. If **/PUBLISHING_SERVER** isn't used, this parameter will be ignored. | -| */PUBLISHING_WEBSITE_NAME* | Specifies name of the website that will be created for the publishing service. For example, ```/PUBLISHING_WEBSITE_NAME="Microsoft App-V Publishing Service"```. | -| */PUBLISHING_WEBSITE_PORT* | Specifies the port number used by the publishing service. For example, ```/PUBLISHING_WEBSITE_PORT=83```. | - -### Parameter definitions for Reporting Server - -| Parameter | Description | -|-----------|-------------| -| */REPORTING_SERVER* | Specifies that the Reporting Server will be installed. No value is expected. | -| */REPORTING_WEBSITE_NAME* | Specifies name of the website that will be created for the Reporting Service. For example, ```/REPORTING_WEBSITE_NAME="Microsoft App-V ReportingService"```. | -| */REPORTING_WEBSITE_PORT* | Specifies the port number that the Reporting Service will use. For example, ```/REPORTING_WEBSITE_PORT=82```. | - -### Parameters for using an existing Reporting Server database - -| Parameter | Description | -|-----------|-------------| -| */EXISTING\_REPORTING\_DB_SQL_SERVER_USE_LOCAL* | Indicates that the Microsoft SQL Server is installed on the local server. This is a switch parameter, so no value is expected. | -| */EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME* | Specifies the name of the remote computer that SQL Server is installed on. Takes a string. For example, ```/EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME="mycomputer1"```. | -| */EXISTING_REPORTING_DB_SQLINSTANCE_USE_DEFAULT* | Indicates that the default SQL instance is to be used. This is a switch parameter, so no value is expected. | -| */EXISTING_REPORTING_DB_CUSTOM_SQLINSTANCE* | Specifies the name of the custom SQL instance that should be used. Takes a string. For example, ```/EXISTING_REPORTING_DB_CUSTOM_SQLINSTANCE="MYSQLSERVER"```. | -| */EXISTING_REPORTING_DB_NAME* | Specifies the name of the existing Reporting database that should be used. Takes a string. For example, ```/EXISTING_REPORTING_DB_NAME="AppVReporting"```. | - -### Parameter definitions for Reporting Server database installation - -| Parameter | Description | -|-----------|-------------| -| */DB\_PREDEPLOY\_REPORTING* | Specifies that the Reporting Database will be installed. DBA permissions are required for this installation. No value is expected. | -| */REPORTING_DB_SQLINSTANCE_USE_DEFAULT* | Specifies the name of the custom SQL instance that should be used. Takes a string. For example, ```/REPORTING_DB_CUSTOM_SQLINSTANCE="MYSQLSERVER"```. | -| */REPORTING_DB_NAME* | Specifies the name of the new Reporting database that should be created. Takes a string. For example, ```/REPORTING_DB_NAME="AppVMgmtDB"```. | -| */REPORTING_SERVER_MACHINE_USE_LOCAL* | Indicates that the Reporting server that will be accessing the database is installed on the local server. This is a switch parameter, so no value is expected. | -| */REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT* | Specifies the machine account of the remote machine that the Reporting server will be installed on. Takes a string. For example, ```/REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT = "domain\computername"```. | -| */REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT* | Indicates the Administrator account that will be used to install the App-V Reporting Server. Takes a string. For example, ```/REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT = "domain\alias"```. | - -### Parameters for using an existing Management Server database - -| Parameter | Description | -|-----------|-------------| -| */EXISTING\_MANAGEMENT\_DB_SQL_SERVER_USE_LOCAL* | Indicates that the SQL Server is installed on the local server. Switch parameter so no value is expected. If **/DB_PREDEPLOY_MANAGEMENT** isn't specified, this variable will be ignored. | -| */EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME* | Specifies the name of the remote computer that SQL Server is installed on. Takes a string. For example, ```/EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME="mycomputer1"```. | -| */EXISTING_MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT* | Indicates that the default SQL instance is to be used. Switch parameter so no value is expected. If **/DB_PREDEPLOY_MANAGEMENT** isn't specified, this variable will be ignored. | -| */EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE* | Specifies the name of the custom SQL instance that will be used. For example, ```/EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE="AppVManagement"```. If **/DB_PREDEPLOY_MANAGEMENT** isn't specified, this will be ignored. | -| */EXISTING_MANAGEMENT_DB_NAME* | Specifies the name of the existing management database that should be used. For example, ```/EXISTING_MANAGEMENT_DB_NAME="AppVMgmtDB"```. If **/DB_PREDEPLOY_MANAGEMENT** isn't specified, this will be ignored. | - - - - - -## Related articles - -* [Deploying the App-V Server](appv-deploying-the-appv-server.md) diff --git a/windows/application-management/app-v/appv-deploy-the-appv-server.md b/windows/application-management/app-v/appv-deploy-the-appv-server.md deleted file mode 100644 index 4a9f49f03b..0000000000 --- a/windows/application-management/app-v/appv-deploy-the-appv-server.md +++ /dev/null @@ -1,115 +0,0 @@ ---- -title: How to Deploy the App-V Server (Windows 10/11) -description: Use these instructions to deploy the Application Virtualization (App-V) Server in App-V for Windows 10/11. -author: aczechowski -ms.prod: windows-client -ms.date: 04/18/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.technology: itpro-apps ---- - -# How to Deploy the App-V Server (new installation) - ->Applies to: Windows Server 2016 - -## Before you start - ->[!IMPORTANT] ->If you're already using App-V 5.x, you don't need to re-deploy the App-V server components as they haven't changed since App-V 5.0 was released. - -* Ensure that you’ve installed required software. See [App-V prerequisites](appv-prerequisites.md). -* Review the server section of [App-V security considerations](appv-security-considerations.md). -* Specify a port where each component will be hosted. -* Add firewall rules to allow incoming requests to access the specified ports. -* If you use SQL scripts instead of the Windows Installer to set up the Management database or Reporting database, you must run the required SQL scripts before installing the Management Server or Reporting Server. See [How to deploy the App-V databases by using SQL scripts](appv-deploy-appv-databases-with-sql-scripts.md). - -## Installing the App-V server - -1. Download the App-V server components. All five App-V server components are included in the Microsoft Desktop Optimization Pack (MDOP) 2015 ISO package, which can be downloaded from either of the following locations: - - * The [MSDN (Microsoft Developer Network) subscriptions site](https://msdn.microsoft.com/subscriptions/downloads/default.aspx#FileId=65215). You must have a MSDN subscription to download the MDOP ISO package from this site. - * The [Volume Licensing Service Center](https://www.microsoft.com/licensing/default.aspx) if you're using [Windows client for Enterprise or Education](https://www.microsoft.com/WindowsForBusiness/windows-product-home). - -2. Copy the App-V server installation files to the computer on which you want to install it. - -3. Start the App-V server installation by right-clicking and running **appv\_server\_setup.exe** as an administrator, and then click **Install**. - -4. Review and accept the license terms, and choose whether to enable Microsoft updates. - -5. On the **Feature Selection** page, select all components listed in the following table. - - | Component | Description | - |---|---| - | Management server | Provides overall management functionality for the App-V infrastructure. | - | Management database | Facilitates database predeployments for App-V management. | - | Publishing server | Provides hosting and streaming functionality for virtual applications. | - | Reporting server | Provides App-V reporting services. | - | Reporting database | Facilitates database predeployments for App-V reporting. | - -6. On the **Installation Location** page, accept the default location where the selected components will be installed, or change the location by typing a new path on the **Installation Location** line. - -7. On the initial **Create New Management Database** page, configure the **Microsoft SQL Server instance** and **Management Server database** by selecting the appropriate option below. - - | Method | What you need to do | - |---|---| - | You are using a custom Microsoft SQL Server instance. | Select **Use the custom instance**, then specify the instance name.
                        Use the format **INSTANCENAME**. The assumed installation location is the local computer.
                        Not supported: A server name using the format **ServerName**\\**INSTANCE**.| - | You are using a custom database name. | Select **Custom configuration** and type the database name.
                        The database name must be unique, or the installation will fail.| - -8. On the **Configure** page, accept the default value, **Use this local computer**. - - > [!NOTE] - > If you're installing the Management server and Management database side-by-side, the appropriate options are selected by default and cannot be changed. - -9. On the initial **Create New Reporting Database** page, configure the **Microsoft SQL Server instance** and **Reporting Server database** by selecting the appropriate option below. - - | Method | What you need to do | - |---|---| - | You are using a custom Microsoft SQL Server instance. | Select **Use the custom instance**, and type the name of the instance.
                        Use the format **INSTANCENAME**. The assumed installation location is the local computer.
                        Not supported: A server name using the format **ServerName**\\**INSTANCE**.| - | You are using a custom database name. | Select **Custom configuration** and type the database name.
                        The database name must be unique, or the installation will fail.| - -10. On the **Configure** page, accept the default value: **Use this local computer**. - - > [!NOTE] - > If you're installing the Management server and Management database side-by-side, the appropriate options are selected by default and cannot be changed. - -11. On the **Configure** (Management Server Configuration) page, specify the following: - - | Item to configure | Description and examples | - |---|---| - | Specify AD group | Specify the AD group with sufficient permissions to manage the App-V environment. Example: MyDomain\MyUser

                        After installation, you can add users or groups on the management console. However, global security groups and Active Directory Domain Services (AD DS) distribution groups are not supported. You must use Domain local or Universal groups to perform this action.| - |Website name | Specify the custom name that will be used to run the publishing service.
                        If you do not have a custom name, you don't have to change it.| - |Port binding | Specify a unique port number that will be used by App-V. Example: **12345**
                        Ensure that the port specified is not being used by another website. | - -12. On the **Configure Publishing Server Configuration** page, specify the following: - - | Item to configure | Description and examples | - |---|---| - | Specify the management service URL | Example: http://localhost:12345 | - | Website name | Specify the custom website name that will be used to run the publishing service.
                        If you do not have a custom name, do not make any changes. | - | Port binding | Specify a unique port number that will be used by App-V. Example: 54321
                        Ensure that the port specified is not being used by another website. | - -13. On the **Reporting Server** page, specify the following: - - | Item to configure | Description and examples | - |---|---| - | Website name | Specify the custom name that will be used to run the Reporting Service.
                        If you do not have a custom name, do not make any changes. | - | Port binding | Specify a unique port number that will be used by App-V. Example: 55555
                        Ensure that the port specified is not being used by another website.| - -14. To start the installation, click **Install** on the **Ready** page, and then click **Close** on the **Finished** page. - -15. To verify that the setup completed successfully, open a web browser, and type the following URL with the bracketed variables adjusted according to your specifications in the earlier steps: - - `http://:/console.html` - - Example: `http://localhost:12345/console.html`. If the installation succeeded, the App-V Management console will display with no errors. - -## Related articles - -* [Deploying App-V](appv-deploying-appv.md) -* [How to install the management and reporting databases on separate computers from the management and reporting services](appv-install-the-management-and-reporting-databases-on-separate-computers.md) -* [How to install the publishing server on a remote computer](appv-install-the-publishing-server-on-a-remote-computer.md) -* [How to deploy the App-V server using a script](appv-deploy-the-appv-server-with-a-script.md) diff --git a/windows/application-management/app-v/appv-deploying-appv.md b/windows/application-management/app-v/appv-deploying-appv.md deleted file mode 100644 index d1d23d6d74..0000000000 --- a/windows/application-management/app-v/appv-deploying-appv.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: Deploying App-V (Windows 10/11) -description: App-V supports several different deployment options. Learn how to complete App-V deployment at different stages in your App-V deployment. -author: aczechowski -ms.prod: windows-client -ms.date: 04/18/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.technology: itpro-apps ---- - -# Deploying App-V for Windows client - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -App-V supports several different deployment options. Review this article for information about the tasks that you must complete at different stages in your deployment. - -## App-V Deployment Information - -* [Deploying the App-V Sequencer and configuring the client](appv-deploying-the-appv-sequencer-and-client.md) - - This section describes how to install the App-V sequencer used to virtualize applications, and how to enable the App-V client that runs on target computers to facilitate virtualized packages. -* [Deploying the App-V server](appv-deploying-the-appv-server.md) - - This section provides information about installing the App-V management, publishing, database, and reporting severs. -* [App-V deployment checklist](appv-deployment-checklist.md) - - This section provides a deployment checklist that can be used to assist with installing App-V. - -The following sections describe how to use App-V to deliver Microsoft Office as a virtualized application to computers in your organization. - -* [Deploying Microsoft Office 2016 by using App-V](appv-deploying-microsoft-office-2016-with-appv.md) -* [Deploying Microsoft Office 2013 by using App-V](appv-deploying-microsoft-office-2013-with-appv.md) -* [Deploying Microsoft Office 2010 by using App-V](appv-deploying-microsoft-office-2010-wth-appv.md) - -## Other App-V deployment resources - -* [Application Virtualization (App-V) overview](appv-for-windows.md) -* [Getting started with App-V](appv-getting-started.md) -* [Planning for App-V](appv-planning-for-appv.md) -* [Operations for App-V](appv-operations.md) -* [Troubleshooting App-V](appv-troubleshooting.md) -* [Technical reference for App-V](appv-technical-reference.md) - - - - diff --git a/windows/application-management/app-v/appv-deploying-microsoft-office-2010-wth-appv.md b/windows/application-management/app-v/appv-deploying-microsoft-office-2010-wth-appv.md deleted file mode 100644 index 02924fde4f..0000000000 --- a/windows/application-management/app-v/appv-deploying-microsoft-office-2010-wth-appv.md +++ /dev/null @@ -1,78 +0,0 @@ ---- -title: Deploying Microsoft Office 2010 by Using App-V -description: Create Office 2010 packages for Microsoft Application Virtualization (App-V) using the App-V Sequencer or the App-V Package Accelerator. -author: aczechowski -ms.prod: windows-client -ms.date: 04/18/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.technology: itpro-apps ---- - -# Deploying Microsoft Office 2010 by Using App-V - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -You can create Office 2010 packages for Microsoft Application Virtualization (App-V) using one of the following methods: - -* Application Virtualization (App-V) Sequencer -* Application Virtualization (App-V) Package Accelerator - -## App-V support for Office 2010 - -The following table shows the App-V versions, methods of Office package creation, supported licensing, and supported deployments for Office 2010. - -|Supported item|Support level| -|---|---| -|Package creation|- Sequencing
                        - Package Accelerator
                        - Office Deployment Kit| -|Supported licensing|Volume Licensing| -|Supported deployments|- Desktop
                        - Personal VDI
                        - RDS| - -## Creating Office 2010 App-V using the sequencer - -Sequencing Office 2010 is one of the main methods for creating an Office 2010 package on App-V. For more information, see [How to Sequence a New Application with App-V 5.0](/microsoft-desktop-optimization-pack/appv-v5/how-to-sequence-a-new-application-with-app-v-50-beta-gb18030). - -## Deploying the Microsoft Office package for App-V - -You can deploy Office 2010 packages by using any of the following App-V deployment methods: - -* Microsoft Configuration Manager -* App-V server -* Stand-alone through Windows PowerShell commands - -## Office App-V package management and customization - -Office 2010 packages can be managed like any other App-V packages through known package management mechanisms. No special instructions are needed, for example, to add, publish, unpublish, or remove Office packages. - -## Microsoft Office integration with Windows - -The following table provides a full list of supported integration points for Office 2010. - -(POPULATE THE THIRD COLUMN) - -|Extension Point|Description|Office 2010| -|---|---|---| -|Lync meeting Join Plug-in for Firefox and Chrome|User can join Lync meetings from Firefox and Chrome|| -|Sent to OneNote Print Driver|User can print to OneNote|Yes| -|OneNote Linked Notes|OneNote Linked Notes|| -|Send to OneNote Internet Explorer Add-In|User can send to OneNote from IE|| -|Firewall Exception for Lync and Outlook|Firewall Exception for Lync and Outlook|| -|MAPI Client|Native apps and add-ins can interact with virtual Outlook through MAPI|| -|SharePoint Plugin for Firefox|User can use SharePoint features in Firefox|| -|Mail Control Panel Applet|User gets the mail control panel applet in Outlook|Yes| -|Primary Interop Assemblies|Support managed add-ins|| -|Office Document Cache Handler|Allows Document Cache for Office applications|| -|Outlook Protocol Search handler|User can search in Outlook|Yes| -|Active X Controls:
                        - Groove.SiteClient
                        - PortalConnect.PersonalSite
                        - SharePoint.openDocuments
                        - SharePoint.ExportDatabase
                        - SharePoint.SpreadSheetLauncher
                        - SharePoint.StssyncHander
                        - SharePoint.DragUploadCtl
                        - SharePoint.DragDownloadCtl
                        - Sharpoint.OpenXMLDocuments
                        - Sharepoint.ClipboardCtl
                        - WinProj.Activator
                        - Name.NameCtrl
                        - STSUPld.CopyCtl
                        - CommunicatorMeetingJoinAx.JoinManager
                        - LISTNET.Listnet
                        - OneDrive Pro Browser Helper|Active X Control.

                        For more information about ActiveX controls, see the [ActiveX Control API Reference](/previous-versions/office/developer/sharepoint-2010/ms440037(v=office.14)).|| -|OneDrive Pro Icon Overlays|Windows explorer shell icon overlays when users look at folders OneDrive Pro folders|| - -### Connection Groups - -* [Managing Connection Groups](appv-managing-connection-groups.md) - -### Dynamic Configuration - -* [About App-V Dynamic Configuration](appv-dynamic-configuration.md) diff --git a/windows/application-management/app-v/appv-deploying-microsoft-office-2013-with-appv.md b/windows/application-management/app-v/appv-deploying-microsoft-office-2013-with-appv.md deleted file mode 100644 index 0cb31fa36f..0000000000 --- a/windows/application-management/app-v/appv-deploying-microsoft-office-2013-with-appv.md +++ /dev/null @@ -1,430 +0,0 @@ ---- -title: Deploying Microsoft Office 2013 by Using App-V (Windows 10/11) -description: Use Application Virtualization (App-V) to deliver Microsoft Office 2013 as a virtualized application to computers in your organization. -author: aczechowski -ms.prod: windows-client -ms.date: 04/18/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.technology: itpro-apps ---- - -# Deploying Microsoft Office 2013 by Using App-V - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -Use the information in this article to use Application Virtualization (App-V) to deliver Microsoft Office 2013 as a virtualized application to computers in your organization. For information about using App-V to deliver Office 2010, see [Deploying Microsoft Office 2010 by Using App-V](appv-deploying-microsoft-office-2010-wth-appv.md). To successfully deploy Office 2013 with App-V, you need to be familiar with Office 2013 and App-V. - -## What to know before you start - -Before you deploy Office 2013 with App-V, review the following planning information. - -### Supported Office versions and Office coexistence - -The following table will direct you to more information about which versions of Office App-V supports and how to run App-V with coexisting versions of Office. - -|Information to review|Description| -|---|---| -|[Supported versions of Microsoft Office](appv-planning-for-using-appv-with-office.md#supported-versions-of-microsoft-office)|- Supported versions of Office
                        - Supported deployment types like desktop, personal Virtual Desktop Infrastructure (VDI), and pooled VDI
                        - Office licensing options.| -|[Planning for using App-V with coexisting versions of Office](appv-planning-for-using-appv-with-office.md#before-you-implement-office-coexistence)|Considerations for installing different versions of Office on the same computer.| - -### Packaging, publishing, and deployment requirements - -Before you deploy Office with App-V, review the following requirements. - -|Task|Requirement| -|---|---| -|Packaging|All Office applications you wish to deploy to users must be in a single package.
                        In App-V and later, you must use the Office Deployment Tool to create packages. The Sequencer doesn't support package creation.
                        If you're deploying Microsoft Visio 2013 and Microsoft Project 2013 along with Office, you must include them in the same package with Office. For more information, see [Deploying Visio 2013 and Project 2013 with Office](#deploying-visio-2013-and-project-2013-with-office).| -|Publishing|You can only publish one Office package per client computer.
                        You must publish the Office package globally, not to the user.| -|Deploying Microsoft 365 Apps for enterprise, Visio Pro for Office 365, or Project Pro for Office 365 to a shared computer using Remote Desktop Services.|You must enable [shared computer activation](/DeployOffice/overview-of-shared-computer-activation-for-office-365-proplus).
                        You don’t need to use shared computer activation if you’re deploying a volume licensed product, such as Office Professional Plus 2013, Visio Professional 2013, or Project Professional 2013.| - -### Excluding Office applications from a package - -The following table describes the recommended methods for excluding specific Office applications from a package. - -|Task|Details| -|---|---| -|Use the **ExcludeApp** setting when you create the package by using the Office Deployment Tool.|Enables you to exclude specific Office applications from the package when the Office Deployment Tool creates the package. For example, you can use this setting to create a package that contains only Microsoft Word.
                        For more information, see [ExcludeApp element](/DeployOffice/configuration-options-for-the-office-2016-deployment-tool?ad=US&rs=en-US&ui=en-US#excludeapp-element).| -|Modify the **DeploymentConfig.xml** file|Modify the **DeploymentConfig.xml** file after creating the package. This file contains the default package settings for all users on a computer running the App-V Client.
                        For more information, see [Disabling Office 2013 applications](#disabling-office-2013-applications).| - -## Creating an Office 2013 package for App-V with the Office Deployment Tool - -Complete the following steps to create an Office 2013 package for App-V or later. - ->[!IMPORTANT] ->In App-V and later, you must the Office Deployment Tool to create a package. You cannot use the Sequencer to create packages. - -### Review prerequisites for using the Office Deployment Tool - -Before you start, ensure that the computer on which you're installing the Office Deployment Tool has the following prerequisites fulfilled: - -|Prerequisite|Description| -|---|---| -|Prerequisite software|.NET Framework 4| -|Supported operating systems|64-bit version of Windows 8 or later
                        64-bit version of Windows 7| - ->[!NOTE] ->In this topic, the term “Office 2013 App-V package” refers to subscription licensing and volume licensing. - -### Create Office 2013 App-V packages using Office Deployment Tool - -You create Office 2013 App-V packages with the Office Deployment Tool. The following instructions explain how to create an Office 2013 App-V package with Volume Licensing or Subscription Licensing. - -Create Office 2013 App-V packages on 64-bit Windows computers. Once created, the Office 2013 App-V package will run on 32-bit and 64-bit Windows 7, Windows 8.1, and Windows 10/11 computers. - -### Download the Office Deployment Tool - -Office 2013 App-V Packages are created using the Office Deployment Tool, which generates an Office 2013 App-V Package. The App-V sequencer can't create or modify packages. To create a package: - -1. Download the [Office 2013 Deployment Tool for Click-to-Run](https://www.microsoft.com/download/details.aspx?id=36778). -2. Run the .exe file and extract its features into the desired location. To make this process easier, you can create a shared network folder where the features will be saved. - - Example: \\\\Server\\Office2013 -3. Check that a **setup.exe** and a **configuration.xml** file exist and are in the location you specified. - -### Download Office 2013 applications - -After you download the Office Deployment Tool, you can use it to get the latest Office 2013 applications. You can create the Office 2013 App-V package after getting all the Office applications. - -The XML file included in the Office Deployment Tool specifies the product details, such as the languages and Office applications included. - -1. **Customize the sample XML configuration file:** Use the sample XML configuration file that you downloaded with the Office Deployment Tool to customize the Office applications: - - 1. Open the sample XML file in Notepad or your favorite text editor. - - 2. With the sample configuration.xml file open and ready for editing, you can specify products, languages, and the path to which you save the Office 2013 applications. The following example denotes a configuration.xml file: - - ```XML - - - - - - - - - - - ``` - - > [!NOTE] - >The configuration XML is a sample XML file. This file includes lines that are commented out. You can “uncomment” these lines to customize additional settings with the file. - - The previous example of an XML configuration file specifies that Office 2013 ProPlus 32-bit edition, including Visio ProPlus, will be downloaded in English to the \\\\server\\Office 2013, which is the location where Office applications will be saved to. The Product ID of the applications won't affect the final licensing of Office. Office 2013 App-V packages with various licensing can be created from the same applications by specifying licensing in a later stage. For more information, see [Customizable attributes and elements of the XML file](#customizable-attributes-and-elements-of-the-xml-file), later in this topic. - - After editing the configuration.xml file to specify the desired product, languages, and also the location that the Office 2013 applications will be saved onto, you can save the configuration file, for example, as Customconfig.xml. -2. **Download the applications into the specified location:** Use an elevated command prompt and a 64-bit operating system to download the Office 2013 applications that will later be converted into an App-V package. An example command is: - - ```PowerShell - \\server\Office2013\setup.exe /download \\server\Office2013\Customconfig.xml - ``` - - The following table describes each element of the command: - - |Element|Description| - |---|---| - |```\\server\Office2013```|This network share location is the one that contains the Office Deployment Tool and the custom Configuration.xml file, **Customconfig.xml**.| - |```setup.exe```|This element is the Office Deployment Tool.| - |```/download```|This element downloads the Office 2013 applications that you specify in the **Customconfig.xml** file. These bits can be later converted in an Office 2013 App-V package with Volume Licensing.| - |```\\server\Office2013\Customconfig.xml```|This element passes the XML configuration file required to complete the download process. In this example, the file used is **Customconfig.xml**. After the download command is used, Office applications should be found in the location specified in the XML configuration file, which in this example is ```\\Server\Office2013```.| - -#### Customizable attributes and elements of the XML file - -|Input and description|Example| -|---|---| -|Add element:
                        Specifies the products and languages to include in the package.|N/A| -|OfficeClientEdition (attribute of Add element):
                        Specifies the edition of Office 2013 product to use: 32-bit or 64-bit. The operation fails if **OfficeClientEdition** isn't set to a valid value.|```OfficeClientEdition="32"```
                        ```OfficeClientEdition="64"```| -|Product element:
                        Specifies the application. Project 2013 and Visio 2013 must be specified here as an added product to be included in the applications.|```Product ID="O365ProPlusRetail"```
                        ```Product ID="VisioProRetail"```
                        ```Product ID="ProjectProRetail"```
                        ```Product ID="ProPlusVolume"```
                        ```Product ID="ProjectProVolume"```| -|Language element:
                        Specifies the language supported in the applications.|```Language ID="en-us"```| -|Version (attribute of Add element):
                        Optional. Specifies a build to use for the package. Defaults to latest advertised build (as defined in v32.CAB at the Office source).|```15.1.2.3```| -|SourcePath (attribute of Add element):
                        Specifies the location where the applications will be saved to.|```Sourcepath="\Server\Office2013”```| - -### Convert the Office applications into an App-V package - -After you download the Office 2013 applications through the Office Deployment Tool, use the Office Deployment Tool to convert them into an Office 2013 App-V package. You'll need to make sure to have the right procedure depending on your licensing model. - -#### What you'll need to do - -* Create the Office 2013 App-V packages on 64-bit Windows computers. However, the package will run on 32-bit and 64-bit Windows 7, Windows 8, and Windows 10/11 computers. -* Create an Office App-V package for either the Subscription Licensing package or Volume Licensing by using the Office Deployment Tool, then modify the **Customconfig.xml** configuration file. - - The following table summarizes the values you need to enter in the **Customconfig.xml** file for the licensing model you’re using. The steps in the sections that follow the table will specify the exact entries you need to make. - -|Product ID|Volume Licensing|Subscription Licensing| -|---|---|---| -|Office 2013|ProPlusVolume|O365ProPlusRetail| -|Office 2013 with Visio 2013|ProPlusVolume
                        VisioProVolume|O365ProPlusRetail
                        VisioProRetail| -|Office 2013 with Visio 2013 and Project 2013|ProPlusVolume
                        VisioProVolume
                        ProjectProVolume|O365ProPlusRetail
                        VisioProRetail
                        ProjectProRetail| - -#### How to convert the Office applications into an App-V package - -1. In Notepad, reopen the CustomConfig.xml file, and make the following changes to the file: - - * **SourcePath**: Point to the Office applications downloaded earlier. - * **ProductID**: Specify the type of licensing, as shown in the following examples: - * Subscription Licensing: - ```XML - - - - - - - - - - - ``` - In this example, the following changes were made to create a package with Subscription licensing: - - * **SourcePath** is the path, which was changed to point to the Office applications that were downloaded earlier. - * **Product ID** for Office was changed to `O365ProPlusRetail`. - * **Product ID** for Visio was changed to `VisioProRetail`. - * Volume Licensing - ```XML - - - - - - - - - - - ``` - In this example, the following changes were made to create a package with Volume licensing: - - * **SourcePath** is the source's path, which was changed to point to the Office applications that were downloaded earlier. - * **Product ID** for Office was changed to `ProPlusVolume`. - * **Product ID** for Visio was changed to `VisioProVolume`. - * **ExcludeApp** (optional) lets you specify Office programs that you don’t want included in the App-V package that the Office Deployment Tool creates. For example, you can exclude Access and InfoPath. - * **PACKAGEGUID** (optional)—By default, all App-V packages created by the Office Deployment Tool share the same App-V Package ID. You can use PACKAGEGUID to specify a different package ID for each package, which allows you to publish multiple App-V packages, created by the Office Deployment Tool, and manage them by using the App-V Server. - - An example of when to use this parameter is if you create different packages for different users. For example, you can create a package with just Office 2013 for some users, and create another package with Office 2013 and Visio 2013 for another set of users. - - > [!NOTE] - >Even if you use unique package IDs, you can still deploy only one App-V package to a single device. -2. Use the **/packager** command to convert the Office applications to an Office 2013 App-V package. - - For example: - - ```PowerShell - \\server\Office2013\setup.exe /packager \\server\Office2013\Customconfig.xml \\server\share\Office2013AppV - ``` - - In the example: - - |Element|Description| - |---|---| - |```\\server\Office2013```|This network share location is the one that contains the Office Deployment Tool and the custom Configuration.xml file, which in this example is named **Customconfig.xml**.| - |```setup.exe```|This element is the Office Deployment Tool.| - |```/packager```|This element creates the Office 2013 App-V package with Volume Licensing as specified in the **Customconfig.xml** file.| - |```\\server\Office2013\Customconfig.xml```|This element passes the configuration XML file, which in this example is named "Customconfig," that has been prepared for the packaging stage.| - |```\\server\share\Office2013AppV```|This element specifies the location of the newly created Office App-V package.| - - After you run the **/packager** command, the following folders will appear in the directory where you specified the package should be saved: - - * **App-V Packages**, which contains an Office 2013 App-V package and two deployment configuration files.
                        - * **WorkingDir** - - > [!NOTE] - >To troubleshoot any issues, see the log files in the %temp% directory (default). -3. Verify that the Office 2013 App-V package works correctly: - - 1. Publish the Office 2013 App-V package that you created globally to a test computer and verify that the Office 2013 shortcuts appear. - 2. Start a few Office 2013 applications, such as Excel or Word, to test that your package is working as expected. - -## Publishing the Office package for App-V - -Use the following information to publish an Office package. - -### Methods for publishing Office App-V packages - -Deploy the App-V package for Office 2013 by using the same methods you use for any other package: - -* Microsoft Configuration Manager -* App-V Server -* Stand-alone through Windows PowerShell commands - -### Publishing prerequisites and requirements - -|Prerequisite or requirement|Details| -|---|---| -|Enable Windows PowerShell scripting on the App-V clients.|To publish Office 2013 packages, you must run a script. Package scripts are disabled by default on App-V clients. To enable scripting, run the following Windows PowerShell command:
                        ```Set-AppvClientConfiguration –EnablePackageScripts 1```| -|Publish the Office 2013 package globally.|Extension points in the Office App-V package require installation at the computer level.
                        When you publish at the computer level, no prerequisite actions or redistributables are needed, and the Office 2013 package globally enables its applications to work like natively installed Office, eliminating the need for administrators to customize packages.| - -### How to publish an Office package - -Run the following command to publish an Office package globally, with the bracketed value replaced by the path to the App-V package: - -```PowerShell -Add-AppvClientPackage | Publish-AppvClientPackage –global -``` - -* From the Web Management Console on the App-V Server, you can add permissions to a group of computers instead of to a user group to enable packages to be published globally to the computers in the corresponding group. - -## Customizing and managing Office App-V packages - -To manage your Office App-V packages, use the same operations as you would for any other package, but there are a few exceptions, as outlined in the following sections. - -* [Enabling Office plug-ins by using connection groups](#enabling-office-plug-ins-by-using-connection-groups) -* [Disabling Office 2013 applications](#disabling-office-2013-applications) -* [Disabling Office 2013 shortcuts](#disabling-office-2013-shortcuts) -* [Managing Office 2013 package upgrades](#managing-office-2013-package-upgrades) -* [Managing Office 2013 licensing upgrades](#managing-office-2013-licensing-upgrades) -* [Deploying Visio 2013 and Project 2013 with Office](#deploying-visio-2013-and-project-2013-with-office) - -### Enabling Office plug-ins by using connection groups - -Use the steps in this section to enable Office plug-ins with your Office package. To use Office plug-ins, you must use the App-V Sequencer to create a separate package that contains just the plug-ins. You can't use the Office Deployment Tool to create the plug-ins package. You then create a connection group that contains the Office package and the plug-ins package, as described in the following steps. - -#### To enable plug-ins for Office App-V packages - -1. Add a Connection Group through App-V Server, Microsoft Configuration Manager, or a Windows PowerShell cmdlet. -2. Sequence your plug-ins using the App-V Sequencer. Ensure that Office 2013 is installed on the computer being used to sequence the plug-in. It's a good idea to use Microsoft 365 Apps for enterprise (non-virtual) on the sequencing computer when you sequence Office 2013 plug-ins. -3. Create an App-V package that includes the desired plug-ins. -4. Add a Connection Group through App-V Server, Configuration Manager, or a Windows PowerShell cmdlet. -5. Add the Office 2013 App-V package and the plug-ins package you sequenced to the Connection Group you created. - - >[!IMPORTANT] - >The order of the packages in the Connection Group determines the order in which the package contents are merged. In your Connection group descriptor file, add the Office 2013 App-V package first, then add the plug-in App-V package. -6. Ensure that both packages are published to the target computer and that the plug-in package is published globally to match the global settings of the published Office 2013 App-V package. -7. Verify that the Deployment Configuration File of the plug-in package has the same settings that the Office 2013 App-V package has. - - Since the Office 2013 App-V package is integrated with the operating system, the plug-in package settings should match. You can search the Deployment Configuration File for “COM Mode” and ensure that your plug-ins package has that value set as **Integrated** and that both **InProcessEnabled** and **OutOfProcessEnabled** match the settings of the Office 2013 App-V package you published. -8. Open the Deployment Configuration File and set the value for **Objects Enabled** to **false**. -9. If you made any changes to the Deployment Configuration file after sequencing, ensure that the plug-in package is published with the updated file. -10. Ensure that the Connection Group you created is enabled onto your desired computer. The Connection Group created will likely “pend” if the Office 2013 App-V package is in use when the Connection Group is enabled. If that happens, you'll have to reboot to successfully enable the Connection Group. -11. After you successfully publish both packages and enable the Connection Group, start the target Office 2013 application and verify that the plug-in you published and added to the Connection Group works as expected. - -### Disabling Office 2013 applications - -You may want to disable specific applications in your Office App-V package. For instance, you can disable Access, but leave all other Office application main available. When you disable an application, the end user will no longer see the shortcut for that application. You don't have to re-sequence the application. When you change the Deployment Configuration File after the Office 2013 App-V package has been published, you'll save the changes, add the Office 2013 App-V package, then republish it with the new Deployment Configuration File to apply the new settings to Office 2013 App-V Package applications. - ->[!NOTE] ->To exclude specific Office applications (for example, Access and InfoPath) when you create the App-V package with the Office Deployment Tool, use the **ExcludeApp** setting. For more information, see [Reference for Click-to-Run configuration.xml file](/DeployOffice/configuration-options-for-the-office-2016-deployment-tool#excludeapp-element). - -#### To disable an Office 2013 application - -1. Open a Deployment Configuration File with a text editor such as **Notepad** and search for “Applications." -2. Search for the Office application you want to disable, for example, Access 2013. -3. Change the value of "Enabled" from "true" to "false." -4. Save the Deployment Configuration File. -5. Add the Office 2013 App-V Package with the new Deployment Configuration File. - - ``` XML - - - InfoPath Filler 2013 - - - - - - - Lync 2013 - - - - - - - Access 2013 - - - - - ``` -6. Re-add the Office 2013 App-V package, and then republish it with the new Deployment Configuration File to apply the new settings to Office 2013 App-V Package applications. - -### Disabling Office 2013 shortcuts - -You may want to disable shortcuts for certain Office applications instead of unpublishing or removing the package. The following example shows how to disable shortcuts for Microsoft Access. - -1. Open a Deployment Configuration File in Notepad and search for “Shortcuts”. -2. To disable certain shortcuts, delete or comment out the specific shortcuts you don’t want. You must keep the subsystem present and enabled. For example, in the example below, delete the Microsoft Access shortcuts, while keeping the subsystems <shortcut> </shortcut> intact to disable the Microsoft Access shortcut. - - ```XML - Shortcuts - - --> - - - - - [{Common Programs}]\Microsoft Office 2013\Access 2013.lnk - [{AppvPackageRoot}])office15\MSACCESS.EXE - [{Windows}]\Installer\{90150000-000F-0000-0000-000000FF1CE)\accicons.exe.Ø.ico - - - Microsoft.Office.MSACCESS.EXE.15 - true - Build a professional app quickly to manage data. - l - [{AppVPackageRoot}]\office15\MSACCESS.EXE - - ``` -3. Save the Deployment Configuration File. -4. Republish Office 2013 App-V Package with new Deployment Configuration File. - -Many more settings can be changed through modifying the Deployment Configuration for App-V packages, for example, file type associations, Virtual File System, and more. For additional information on how to use Deployment Configuration Files to change App-V package settings, refer to the additional resources section at the end of this document. - -### Managing Office 2013 package upgrades - -To upgrade an Office 2013 package, use the Office Deployment Tool. To upgrade a previously deployed Office 2013 package, perform the following steps. - -#### How to upgrade a previously deployed Office 2013 package - -1. Create a new Office 2013 package through the Office Deployment Tool that uses the most recent Office 2013 application software. The most recent Office 2013 bits can always be obtained through the download stage of creating an Office 2013 App-V Package. The newly created Office 2013 package will have the most recent updates and a new Version ID. All packages created using the Office Deployment Tool have the same lineage. - - > [!NOTE] - > Office App-V packages have two Version IDs: - > * An Office 2013 App-V Package Version ID that is unique across all packages created using the Office Deployment Tool. - > * A second App-V Package Version ID, x.x.x.x for example, in the AppX manifest that will only change if there is a new version of Office itself. For example, if a new Office 2013 release with upgrades is available, and a package is created through the Office Deployment Tool to incorporate these upgrades, the X.X.X.X version ID will change to reflect that the Office version itself has changed. The App-V server will use the X.X.X.X version ID to differentiate this package and recognize that it contains new upgrades to the previously published package, and as a result, publish it as an upgrade to the existing Office 2013 package. -2. Globally publish the newly created Office 2013 App-V Packages onto computers where you would like to apply the new updates. Since the new package has the same lineage of the older Office 2013 App-V Package, publishing the new package with the updates will only apply the new changes to the old package, and thus will be fast. -3. Upgrades will be applied in the same manner of any globally published App-V Packages. Because applications will probably be in use, upgrades might be delayed until the computer is rebooted. - -### Managing Office 2013 licensing upgrades - -If a new Office 2013 App-V Package has a different license than the Office 2013 App-V Package currently deployed. For instance, the Office 2013 package deployed is a subscription based Office 2013 and the new Office 2013 package is Volume Licensing based, the following instructions must be followed to ensure smooth licensing upgrade: - -#### How to upgrade an Office 2013 License - -1. Unpublish the already deployed Office 2013 Subscription Licensing App-V package. -2. Remove the unpublished Office 2013 Subscription Licensing App-V package. -3. Restart the computer. -4. Add the new Office 2013 App-V Package Volume Licensing. -5. Publish the added Office 2013 App-V Package with Volume Licensing. - -An Office 2013 App-V Package with your chosen licensing will be successfully deployed. - -### Deploying Visio 2013 and Project 2013 with Office - -This section describes the requirements and options for deploying Visio 2013 and Project 2013 with Office. - -* **To package and publish Visio 2013 and Project 2013 with Office**: Include Visio 2013 and Project 2013 in the same package with Office. If you aren’t deploying Office, you can create a package that contains Visio and/or Project. -* **To deploy Visio 2013 and Project 2013 to specific users**: Use one of the following methods: - -|Goal|Method| -|---|---| -|Create two different packages and deploy each one to a different group of users|Create and deploy the following packages:
                        A package that contains only Office—deploy to computers whose users need only Office.
                        A package that contains Office, Visio, and Project—deploy to computers whose users need all three applications.| -|Create just one package for the whole organization, or for users who share computers|Follow these steps:
                        1. Create a package that contains Office, Visio, and Project.
                        2. Deploy the package to all users.
                        3. Use [AppLocker](/windows/security/threat-protection/applocker/applocker-overview) to prevent specific users from using Visio and Project.| - -## Additional resources - -### Additional resources for Office 2013 App-V Packages - -* [Office 2013 Deployment Tool for Click-to-Run](https://www.microsoft.com/download/details.aspx?id=36778) - -### Additional resources for Connection Groups - -* [Managing Connection Groups](appv-managing-connection-groups.md) -* [Connection groups on the App-V team blog](/archive/blogs/gladiator/app-v-5-more-on-connection-groups) - -### Additional resources for Dynamic Configuration - -* [About App-V Dynamic Configuration](appv-dynamic-configuration.md) diff --git a/windows/application-management/app-v/appv-deploying-microsoft-office-2016-with-appv.md b/windows/application-management/app-v/appv-deploying-microsoft-office-2016-with-appv.md deleted file mode 100644 index ee4cbe5751..0000000000 --- a/windows/application-management/app-v/appv-deploying-microsoft-office-2016-with-appv.md +++ /dev/null @@ -1,383 +0,0 @@ ---- -title: Deploying Microsoft Office 2016 by using App-V (Windows 10/11) -description: Use Application Virtualization (App-V) to deliver Microsoft Office 2016 as a virtualized application to computers in your organization. -author: aczechowski -ms.prod: windows-client -ms.date: 04/18/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.technology: itpro-apps ---- - -# Deploying Microsoft Office 2016 by using App-V - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -Use the information in this article to use Application Virtualization (App-V) to deliver Microsoft Office 2016 as a virtualized application to computers in your organization. For information about using App-V to deliver Office 2013, see [Deploying Microsoft Office 2013 by using App-V](appv-deploying-microsoft-office-2013-with-appv.md). For information about using App-V to deliver Office 2010, see [Deploying Microsoft Office 2010 by using App-V](appv-deploying-microsoft-office-2010-wth-appv.md). - -## What to know before you start - -Before you deploy Office 2016 with App-V, review the following planning information. - -### Supported Office versions and Office coexistence - -Use the following table to get information about supported versions of Office and running coexisting versions of Office. - -|Information to review|Description| -|---|---| -|[Supported versions of Microsoft Office](appv-planning-for-using-appv-with-office.md#supported-versions-of-microsoft-office)|Supported versions of Office and deployment types (for example, desktop, personal Virtual Desktop Infrastructure (VDI), and pooled VDI), and Office licensing options.| -|[Planning for using App-V with coexisting versions of Office](appv-planning-for-using-appv-with-office.md#before-you-implement-office-coexistence)|Considerations for installing different versions of Office on the same computer.| - -### Packaging, publishing, and deployment requirements - -Before you deploy Office with App-V, review the following requirements. - -|Task|Requirement| -|-----------|-------------------| -| Packaging. | All Office applications that you deploy to users must be in a single package.
                        In App-V 5.0 and later, you must use the Office Deployment Tool to create packages. The Sequencer doesn't support package creation.
                        If you're deploying Microsoft Visio 2016 and Microsoft Project 2016 at the same time as Office, you must put them all in the same package. For more information, see [Deploying Visio 2016 and Project 2016 with Office](#deploying-visio-2016-and-project-2016-with-office). | -| Publishing. | You can only publish one Office package per client computer.
                        You must publish the Office package globally, not to the user. | -| Deploying Microsoft 365 Apps for enterprise, Visio Pro for Office 365, or Project Pro for Office 365 to a shared computer with Remote Desktop Services. | You must enable [shared computer activation](/DeployOffice/overview-of-shared-computer-activation-for-office-365-proplus). | - -### Excluding Office applications from a package - -The following table describes the recommended methods for excluding specific Office applications from a package. - -|Task|Details| -|-------------|---------------| -| Use the **ExcludeApp** setting when you create the package by using the Office Deployment Tool. | With this setting, you can exclude specific Office applications from the package that the Office Deployment Tool creates. For example, you can use this setting to create a package that contains only Microsoft Word.
                        For more information, see [ExcludeApp element](/DeployOffice/configuration-options-for-the-office-2016-deployment-tool?ad=US&rs=en-US&ui=en-US#excludeapp-element). | -| Modify the DeploymentConfig.xml file | Modify the DeploymentConfig.xml file after the package has been created. This file contains the default package settings for all users on a computer that is running the App-V Client.
                        For more information, see [Disabling Office 2016 applications](#disabling-office-2016-applications). | - -## Creating an Office 2016 package for App-V with the Office Deployment Tool - -Complete the following steps to create an Office 2016 package for App-V. - ->[!IMPORTANT] ->In App-V 5.0 and later, you must use the Office Deployment Tool to create a package. You can't use the Sequencer to create packages. - -### Review prerequisites for using the Office Deployment Tool - -The computer on which you're installing the Office Deployment Tool must have the following: - -| Prerequisite | Description | -|----------------------|--------------------| -| Prerequisite software | .NET Framework 4 | -| Supported operating systems | 64-bit version of Windows 10/11
                        64-bit version of Windows 8 or 8.1
                        64-bit version of Windows 7 | - ->[!NOTE] ->In this topic, the term “Office 2016 App-V package” refers to subscription licensing. - -### Create Office 2016 App-V packages with the Office Deployment Tool - -You create Office 2016 App-V packages by using the Office Deployment Tool. The following instructions explain how to create an Office 2016 App-V package with subscription licensing. - -Create Office 2016 App-V packages on 64-bit Windows computers. Once created, the Office 2016 App-V package will run on 32-bit and 64-bit Windows 7, Windows 8.1, and Windows 10/11 computers. - -### Download the Office Deployment Tool - -Office 2016 App-V packages are created using the Office Deployment Tool, which generates an Office 2016 App-V Package. The package can't be created or modified through the App-V sequencer. To begin package creation, follow these steps: - -1. Download the [Office 2016 Deployment Tool for Click-to-Run](https://www.microsoft.com/download/details.aspx?id=49117). - - >[!IMPORTANT] - >You must use the Office 2016 Deployment Tool to create Office 2016 App-V Packages. -2. Run the .exe file and extract its features into the desired location. To make this process easier, you can create a shared network folder where the features will be saved. - - Example location: \\\\Server\\Office2016 -3. Check that the **setup.exe** and **configuration.xml** files exist and are in the location you specified. - -### Download Office 2016 applications - -After you download the Office Deployment Tool, you can use it to get the latest Office 2016 applications. After getting the Office applications, you create the Office 2016 App-V package. - -The XML file included in the Office Deployment Tool specifies the product details, such as the languages and Office applications included. - -1. **Customize the sample XML configuration file:** Use the sample XML configuration file that you downloaded with the Office Deployment Tool to customize the Office applications: - 1. Open the sample XML file in Notepad or your favorite text editor. - 2. With the sample **configuration.xml** file open and ready for editing, you can specify products, languages, and the path to which you save the Office 2016 applications. The following is a basic example of the **configuration.xml** file: - - ```XML - - - - - - - - - - - ``` - - > [!NOTE] - >The configuration XML is a sample XML file. The file includes lines that are commented out. You can “uncomment” these lines to customize additional settings with the file. To uncomment these lines, remove the `````` from the end of the line. - - The previous example of an XML configuration file specifies that Office 2016 ProPlus 32-bit edition, including Visio ProPlus, will be downloaded in English to the \\\\server\\Office2016 location where Office applications will be saved. The Product ID of the applications won't affect Office's final licensing. You can create Office 2016 App-V packages with various licensing from the same applications by specifying licensing in a later stage. The following table summarizes the XML file's customizable attributes and elements: - - | Input | Description | Example | - |--------------|----------------------------|----------------| - | Add element | Specifies which products and languages the package will include. | N/A | - | **OfficeClientEdition** (attribute of **Add** element) | Specifies whether Office 2016 32-bit or 64-bit edition will be used. **OfficeClientEdition**  must be set to a valid value for the operation to succeed. | `OfficeClientEdition="32"`
                        `OfficeClientEdition="64"` | - | Product element | Specifies the application. Project 2016 and Visio 2016 must be specified here as added products to include them in the applications.
                        For more information about Product IDs, see [Product IDs that are supported by the Office Deployment Tool for Click-to-Run](/office365/troubleshoot/installation/product-ids-supported-office-deployment-click-to-run). | `Product ID ="O365ProPlusRetail"`
                        `Product ID ="VisioProRetail"`
                        `Product ID ="ProjectProRetail"` | - | Language element | Specifies which language the applications support. | `Language ID="en-us"` | - | Version (attribute of **Add** element) | Optional. Specifies which build the package will use.
                        Defaults to latest advertised build (as defined in v32.CAB at the Office source). | `16.1.2.3` | - | SourcePath (attribute of **Add** element) | Specifies the location the applications will be saved to. | `Sourcepath = "\\Server\Office2016"` | - | Channel (part of **Add** element) | Optional. Defines which channel will be used to update Office after installation.
                        The default is **Deferred** for Microsoft 365 Apps for enterprise and **Current** for Visio Pro for Office 365 and Project Desktop Client.
                        For more information about update channels, see [Overview of update channels for Microsoft 365 Apps for enterprise](/DeployOffice/overview-of-update-channels-for-office-365-proplus). | `Channel="Current"`
                        `Channel="Deferred"`
                        `Channel="FirstReleaseDeferred"`
                        `Channel="FirstReleaseCurrent"` | - -After editing the **configuration.xml** file to specify the desired product, languages, and the location where the Office 2016 applications will be saved to, you can save the configuration file under a name of your choice, such as "Customconfig.xml." -2. **Download the applications into the specified location:** Use an elevated command prompt and a 64-bit operating system to download the Office 2016 applications that will later be converted into an App-V package. An example command is: - - `\\server\Office2016\setup.exe /download \\server\Office2016\Customconfig.xml` - - The following table describes the example command's elements: - - | Element | Description | - |-------------------------------|--------------------------------------| - | ```\\server\Office2016``` | This network share location is the one that contains the Office Deployment Tool and the custom **Configuration.xml** file, which in this example is **Customconfig.xml**. | - | ``Setup.exe`` | This element is the Office Deployment Tool. | - | ```/download``` | Downloads the Office 2016 applications that you specify in the **Customconfig.xml** file. | - | ```\\server\Office2016\Customconfig.xml```| This element passes the XML configuration file required to complete the download process. In this example, the file used is **Customconfig.xml**. After the download command is used, Office applications should be found in the location specified in the configuration file, which in this example is ```\\Server\Office2016```. | - -### Convert the Office applications into an App-V package - -After you download the Office 2016 applications through the Office Deployment Tool, use the Office Deployment Tool to convert them into an Office 2016 App-V package. Complete the steps that correspond to your licensing model. - -#### What you’ll need to do - -* Create the Office 2016 App-V packages on 64-bit Windows computers. However, the package will run on 32-bit and 64-bit Windows 7, Windows 8 or 8.1, and Windows 10/11 computers. -* Create an Office App-V package for either Subscription Licensing package by using the Office Deployment Tool, and then modify the **Customconfig.xml** configuration file. - - The following table summarizes the values you need to enter in the **Customconfig.xml** file. The steps in the sections that follow the table will specify the exact entries you need to make. - ->[!NOTE] ->You can use the Office Deployment Tool to create App-V packages for Microsoft 365 Apps for enterprise. Creating packages for the volume-licensed versions of Office Professional Plus or Office Standard is not supported. - -| Product ID | Subscription licensing | -|---|---| -| Office 2016| O365ProPlusRetail | -| Office 2016 with Visio 2016 | O365ProPlusRetail
                        VisioProRetail | -| Office 2016 with Visio 2016 and Project 2016 | O365ProPlusRetail
                        VisioProRetail
                        ProjectProRetail | - -#### How to convert the Office applications into an App-V package - -1. In Notepad, reopen the CustomConfig.xml file, and make the following changes to the file: - - * **SourcePath**: Change to the location where you saved the Office applications you downloaded during setup. - * **ProductID**: Specify the type of licensing, as shown in the following example: - - * Subscription Licensing: - ```XML - - - - - - - - - - - ``` - This example made the following changes to create this Subscription Licensing package: - - * **SourcePath** was changed to point to the Office applications that were downloaded earlier. - * **Product ID** for Office was changed to `O365ProPlusRetail`. - * **Product ID** for Visio was changed to `VisioProRetail`. - * **ExcludeApp** (optional): Lets you specify Office programs that you don’t want included in the App-V package created by the Office Deployment Tool. For example, you can exclude Access. - * **PACKAGEGUID** (optional): By default, all App-V packages created by the Office Deployment Tool share the same App-V Package ID. You can use **PACKAGEGUID** to specify a different package ID for each package, which allows you to publish multiple App-V packages created by the Office Deployment Tool, and then manage your published packages with the App-V Server. - - An example of when to use this parameter is if you create different packages for different users. For example, you can create a package with just Office 2016 for some users, and create another package with Office 2016 and Visio 2016 for another set of users. - - > [!NOTE] - >Even if you use unique package IDs, you can still deploy only one App-V package to a single device. -2. Use the /packager command to convert the Office applications to an Office 2016 App-V package. - - An example packager command is: - - ```syntax - \\server\Office2016\setup.exe /packager \\server\Office2016\Customconfig.xml \\server\share\Office2016AppV - ``` - - The following table describes each element used in the example command: - - | Element | Description | - |-------------------------------|--------------------------------------| - |```\\server\Office2016```|This network share location is the one that contains the Office Deployment Tool and the custom Configuration.xml file, which in this example is Customconfig.xml.| - |```Setup.exe```|This element is the Office Deployment Tool.| - |```/packager```|This command creates the Office 2016 App-V package with the license type specified in the Customconfig.xml file.| - |```\\server\Office2016\Customconfig.xml```|This element passes the configuration XML file that has been prepared for the packaging stage. In this example, the file is Customconfig.xml.| - |```\\server\share\Office2016AppV```|This element specifies the location of the newly created Office App-V package.| - - After you run the **/packager** command, the following folders appear up in the directory where you specified the package should be saved: - - * **App-V Packages**—contains an Office 2016 App-V package and two deployment configuration files. - * **WorkingDir** - - > [!NOTE] - >To troubleshoot any issues, see the log files in the %temp% directory (default). -3. Verify that the Office 2016 App-V package works correctly: - - 1. Publish the Office 2016 App-V package that you created globally to a test computer and verify that the Office 2016 shortcuts appear. - 2. Start a few Office 2016 applications, such as Excel or Word, to ensure that your package is working as expected. - -## Publishing the Office package for App-V - -Use the following information to publish an Office package. - -### Methods for publishing Office App-V packages - -Deploy the App-V package for Office 2016 by using the same methods as the other packages that you've already deployed: - -* Microsoft Configuration Manager -* App-V Server -* Stand-alone through Windows PowerShell commands - -### Publishing prerequisites and requirements - -| Prerequisite or requirement | Details | -|---------------------------------------|--------------------| -| Enable Windows PowerShell scripting on the App-V clients. | To publish Office 2016 packages, you must run a script. However, package scripts are disabled by default on App-V clients. To enable scripting, run the following Windows PowerShell command:
                        `Set-AppvClientConfiguration -EnablePackageScripts 1` | -| Publish the Office 2016 package globally. | Extension points in the Office App-V package require installation at the computer level.
                        When you publish at the computer level, no prerequisite actions or redistributables are needed. The Office 2016 package globally enables its applications to work like natively installed Office, eliminating the need for administrators to customize packages. | - -### How to publish an Office package - -Run the following command to publish an Office package globally: - -```PowerShell -Add-AppvClientPackage | Publish-AppvClientPackage -global -``` - -* You can add permissions to a group of computers instead of just a user group through the Web Management Console on the App-V Server. This feature lets packages be published globally to the computers in the corresponding group. - -## Customizing and managing Office App-V packages - -To manage your Office App-V packages, use the same operations as you would for any other package, with a few exceptions as outlined in the following sections. - -* [Enabling Office plug-ins by using connection groups](#enabling-office-plug-ins-by-using-connection-groups) -* [Disabling Office 2016 applications](#disabling-office-2016-applications) -* [Disabling Office 2016 shortcuts](#disabling-office-2016-shortcuts) -* [Managing Office 2016 package upgrades](#managing-office-2016-package-upgrades) -* [Deploying Visio 2016 and Project 2016 with Office](#deploying-visio-2016-and-project-2016-with-office) - -### Enabling Office plug-ins by using connection groups - -The following steps will tell you how to enable Office plug-ins with your Office package. To use Office plug-ins, you must use the App-V Sequencer to create a separate package that only contains the plug-ins (you can't use the Office Deployment Tool to create the plug-ins package). After that, create a connection group that contains the Office package and the plug-ins package. - -#### Enable plug-ins for Office App-V packages - -1. Add a Connection Group through App-V Server, Microsoft Configuration Manager, or a Windows PowerShell cmdlet. -2. Sequence your plug-ins using the App-V Sequencer. Ensure that Office 2016 is installed on the computer that will be used to sequence the plug-in. We recommend that you use Microsoft 365 Apps for enterprise (non-virtual) on the sequencing computer when sequencing Office 2016 plug-ins. -3. Create an App-V package that includes the plug-ins you want. -4. Add a Connection Group through the App-V Server, Configuration Manager, or a Windows PowerShell cmdlet. -5. Add the Office 2016 App-V package and the plug-ins package you sequenced to the Connection Group you created. - - >[!IMPORTANT] - >The order of the packages in the Connection Group determines the order in which the package contents are merged. In your Connection group descriptor file, add the Office 2016 App-V package first, and then add the plug-in App-V package. -6. Ensure that both packages are published to the target computer and that the plug-in package is published globally to match published Office 2016 App-V package's global settings. -7. Verify that the plug-in package's Deployment Configuration file has the same settings as the Office 2016 App-V package. - - The Office 2016 App-V plug-in package's settings must match those of the operating system to allow for integration. You can search the Deployment Configuration File for “COM Mode” and ensure that your plug-ins package has that value set as “Integrated” and that both "InProcessEnabled" and "OutOfProcessEnabled" match the settings of the Office 2016 App-V package you published. -8. Open the Deployment Configuration File and set the value for **Objects Enabled** to **false**. -9. If you made any changes to the Deployment Configuration file after sequencing, ensure that the plug-in package is published with the file. -10. Ensure that the Connection Group you created on your desired computer is enabled. The Connection Group created will be shown as "pending" if the Office 2016 App-V package is being used while the Connection Group is enabled. If that happens, you'll have to reboot the computer to successfully enable the Connection Group. -11. After you successfully publish both packages and enable the Connection Group, verify the plug-ins you published on the Connection Group work as expected. - -### Disabling Office 2016 applications - -You can also disable specific applications in your Office App-V package. For example, if you don't want to use Access, you can disable Access while leaving all other Office applications available. When you disable an application, the user will no longer see its shortcut icon. You don't need to re-sequence the application to disable it. When you change the Deployment Configuration File after the Office 2016 App-V package has been published, just save the changes and add the Office 2016 App-V package, then republish it with the new Deployment Configuration File to apply the new settings to Office 2016 App-V Package applications. - ->[!NOTE] ->To exclude specific Office applications when you create the App-V package with the Office Deployment Tool, use the **ExcludeApp** setting. - -#### Disable an Office 2016 application - -1. Open a Deployment Configuration File with a text editor such as **Notepad** and search for “Applications." -2. Search for the Office application you want to disable, for example, Access 2016. -3. Change the value of **Enabled** to **false**. -4. Save the Deployment Configuration File. -5. Add the Office 2016 App-V Package with the new Deployment Configuration File. - - ```XML - - - Lync 2016 - - - - - - - Access 2016 - - - - - ``` -6. Re-add the Office 2016 App-V package, and then republish it with the new Deployment Configuration File to apply the new settings to Office 2016 App-V Package applications. - -### Disabling Office 2016 shortcuts - -You may want to disable shortcuts for certain Office applications instead of unpublishing or removing the package. The following example shows how to disable shortcuts for Microsoft Access. - -#### Disable shortcuts for Office 2016 applications - -1. Open a Deployment Configuration File in Notepad and search for “Shortcuts”. -2. To disable certain shortcuts, delete or comment out the specific shortcuts you don’t want. You must keep the subsystem present and enabled. The following example shows how to delete the Microsoft Access shortcuts while keeping the subsystems ` ` intact. - - ``` XML - Shortcuts - - --> - - - - - [{Common Programs}]\Microsoft Office 2016\Access 2016.lnk - [{AppvPackageRoot}])office16\MSACCESS.EXE - [{Windows}]\Installer\{90150000-000F-0000-0000-000000FF1CE)\accicons.exe.Ø.ico - - - Microsoft.Office.MSACCESS.EXE.16 - true - Build a professional app quickly to manage data. - l - [{AppVPackageRoot}]\office16\MSACCESS.EXE - - ``` -3. Save the Deployment Configuration File. -4. Republish the Office 2016 App-V Package with the new Deployment Configuration File. - -Many more settings can be changed through modifying the Deployment Configuration for App-V packages, for example, file type associations, Virtual File System, and more. For additional information on how to use Deployment Configuration Files to change App-V package settings, refer to the additional resources section at the end of this document. - -### Managing Office 2016 package upgrades - -To upgrade an Office 2016 package, use the Office Deployment Tool. To upgrade a previously deployed Office 2016 package, perform the steps outlined in the following section. - -#### How to upgrade a previously deployed Office 2016 package - -1. Create a new Office 2016 package through the Office Deployment Tool that uses the most recent Office 2016 application software. The most recent Office 2016 bits can always be obtained through the download stage of creating an Office 2016 App-V Package. The newly created Office 2016 package will have the most recent updates and a new Version ID. All packages created using the Office Deployment Tool have the same lineage. - - > [!NOTE] - >Office App-V packages have two Version IDs: - >* An Office 2016 App-V Package Version ID that is unique across all packages created using the Office Deployment Tool. - >* A second App-V Package Version ID, formatted as X.X.X.X, in the AppX manifest that will only change if there is a new version of Office itself. For example, if a new Office 2016 release with upgrades is available, and a package is created through the Office Deployment Tool to incorporate these upgrades, the X.X.X.X version ID will change to reflect the new version of Office. The App-V server will use the X.X.X.X version ID to differentiate this package and recognize that it contains new upgrades to the previously published package, and as a result, publish it as an upgrade to the existing Office 2016 package. -2. Globally publish the newly created Office 2016 App-V Packages onto the computers you want to apply the new updates to. Since the new package has the same lineage as the older Office 2016 App-V Package, publishing will be fast, as publishing the new package with the updates only applies the new changes to the old package. -3. Upgrades will be applied in the same manner of any globally published App-V packages. Because applications will probably be in use, upgrades might be delayed until the computer is rebooted. - -### Deploying Visio 2016 and Project 2016 with Office - -The following table describes the requirements and options for deploying Visio 2016 and Project 2016 with Office. - -| Task | Details | -|---------------------|---------------| -| How do I package and publish Visio 2016 and Project 2016 with Office? | You must include Visio 2016 and Project 2016 in the same package with Office.
                        If you're not deploying Office, you can create a package that contains Visio and/or Project, as long as you follow the packaging, publishing, and deployment requirements described in this topic. | -| How can I deploy Visio 2016 and Project 2016 to specific users? | Use one of the following methods:
                        **To create two different packages and deploy each one to a different group of users**:
                        Create and deploy the following packages:
                        - A package that contains only Office—deploy to computers whose users need only Office.
                        - A package that contains Office, Visio, and Project—deploy to computers whose users need all three applications.

                        **To create only one package for the whole organization, or to create a package intended for users who share computers**:
                        1. Create a package that contains Office, Visio, and Project.
                        2. Deploy the package to all users.
                        3. Use [AppLocker](/windows/security/threat-protection/applocker/applocker-overview) to prevent specific users from using Visio and Project. | - -## Related articles - -* [Deploying App-V for Windows client](appv-deploying-appv.md) -* [Deploying Microsoft Office 2013 by using App-V](appv-deploying-microsoft-office-2013-with-appv.md) -* [Deploying Microsoft Office 2010 by using App-V](appv-deploying-microsoft-office-2010-wth-appv.md) -* [Office 2016 Deployment Tool for Click-to-Run](https://www.microsoft.com/download/details.aspx?id=49117) diff --git a/windows/application-management/app-v/appv-deploying-packages-with-electronic-software-distribution-solutions.md b/windows/application-management/app-v/appv-deploying-packages-with-electronic-software-distribution-solutions.md deleted file mode 100644 index 20e131feb1..0000000000 --- a/windows/application-management/app-v/appv-deploying-packages-with-electronic-software-distribution-solutions.md +++ /dev/null @@ -1,34 +0,0 @@ ---- -title: Deploying App-V packages by using electronic software distribution (ESD) -description: Deploying App-V packages by using electronic software distribution (ESD) -author: aczechowski -ms.prod: windows-client -ms.date: 09/27/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.technology: itpro-apps ---- - -# Deploying App-V packages by using electronic software distribution (ESD) - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -You can deploy App-V packages using an electronic software distribution (ESD) solution. For information about planning to deploy App-V packages with an ESD, see [Planning to deploy App-V with an electronic software distribution system](appv-planning-to-deploy-appv-with-electronic-software-distribution-solutions.md). - -To learn how to deploy App-V packages with Microsoft System Center 2012 Configuration Manager, see [Introduction to application management in Configuration Manager](/previous-versions/system-center/system-center-2012-R2/gg682125(v=technet.10)#BKMK_Appv) - -## How to deploy virtualized packages using an ESD - -To learn more about how to deploy virtualized packages using an ESD, see [How to deploy App-V packages using electronic software distribution](appv-deploy-appv-packages-with-electronic-software-distribution-solutions.md). - -## How to enable only administrators to publish packages by using an ESD - -To learn how to configure the App-V client to enable only administrators to publish and unpublish packages when you’re using an ESD, see [How to enable only administrators to publish packages by using an ESD](appv-enable-administrators-to-publish-packages-with-electronic-software-distribution-solutions.md). - -## Related articles - -- [App-V and Citrix integration](https://www.microsoft.com/download/details.aspx?id=40885) -- [Operations for App-V](appv-operations.md) diff --git a/windows/application-management/app-v/appv-deploying-the-appv-sequencer-and-client.md b/windows/application-management/app-v/appv-deploying-the-appv-sequencer-and-client.md deleted file mode 100644 index e2fd60d1e8..0000000000 --- a/windows/application-management/app-v/appv-deploying-the-appv-sequencer-and-client.md +++ /dev/null @@ -1,96 +0,0 @@ ---- -title: Deploying the App-V Sequencer and configuring the client (Windows 10/11) -description: Learn how to deploy the App-V Sequencer and configure the client by using the ADMX template and Group Policy. -author: aczechowski -ms.prod: windows-client -ms.date: 04/18/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.technology: itpro-apps ---- - -# Deploying the App-V Sequencer and configuring the client - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -The App-V Sequencer and client let administrators virtualize and run virtual applications. - -## Enable the client - -The App-V client is the component that runs a virtualized application on a target computer. The client lets users interact with icons and file types, starting virtualized applications. The client can also get the virtual application content from the management server. - ->[!NOTE] ->Starting with Windows 10 version 1607, App-V is included with the operating system. You only need to enable it. - -[Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md) - -## Client configuration settings - -The App-V client stores its configuration in the registry. Understanding the format used in the data registry can help you learn useful information about the client. For information about client settings that you can configure through Windows PowerShell or through the registry, see [About client configuration settings](appv-client-configuration-settings.md). - -## Configure the client by using the ADMX template and Group Policy - -You can use Group Policy to configure the client settings for the App-V client and the Remote Desktop Services client. - -To manage the ADMX template, perform the following steps on the computer that you'll use to manage Group Policy. This computer is typically the Domain Controller. - -1. Save the **.admx** file to the following directory: ```Windows\PolicyDefinitions``` -2. Save the **.adml** file to the following directory: ```Windows\PolicyDefinitions\``` - -After you've completed the preceding steps, you can use Group Policy to configure the client settings by using the Group Policy Management Console under **Computer Configuration** > **Administrative Templates** > **System** > **App-V**. - -## Understanding Shared Content Store mode for App-V clients - -App-V Shared Content Store (SCS) mode lets SCS App-V clients run virtualized applications without having to save any of the associated package data locally. All required virtualized package data is transmitted across the network; therefore, you should only use SCS mode in environments with a fast connection. Both the Remote Desktop Services (RDS) and the standard version of the App-V client are supported with SCS mode. - ->[!IMPORTANT] ->If the App-V client is configured to run in the SCS mode, the location where the App-V packages are streamed from must be available, otherwise, the virtualized package will fail. Additionally, we do not recommend deployment of virtualized applications to computers that run the App-V client in the SCS mode across the internet. - -Additionally, the SCS isn't a physical location that contains virtualized packages. It's a mode that allows the App-V client to stream the required virtualized package data across the network. - -The SCS mode is helpful in the following scenarios: - -* Virtual desktop infrastructure (VDI) deployments -* Remote Desktop Services deployments - -To use SCS in your environment, you must configure the App-V client to run in SCS mode, as it doesn't use SCS mode by default. - -There might be cases when the administrator pre-loads some virtual applications on the computer that runs the App-V client in SCS mode. This pre-load operation can be rendered a successful one with Windows PowerShell commands to add, publish, and mount the package. For example, if a package is pre-loaded on all computers, the administrator could add, publish, and mount the package by using Windows PowerShell commands. The package wouldn't stream across the network because it would be locally stored. - -### Configure the Group Policy setting for the SCS Mode for App-V clients - -Use the following steps to locate and configure the Group Policy setting for the SCS Mode for App-V clients. - -1. In the Group Policy Management Console, navigate to **Computer Configuration** > **Administrative Templates** > **System** > **App-V** > **Streaming**. -2. Enable the **Set the Shared Content Mode (SCS) mode** setting. - -### Configure an individual client to use SCS mode - -To configure the App-V client to run in SCS mode, on the client, enter the following Windows PowerShell command: - -```PowerShell -Set-AppvClientConfiguration -SharedContentStoreMode 1 -``` - -## Deploy the Sequencer - -The Sequencer is a tool that is used to convert standard applications into virtual packages for deployment to computers that run the App-V client. The Sequencer helps provide a predictable conversion process with minimal changes to prior sequencing workflows. In addition, the Sequencer allows users to more easily configure applications to enable connections of virtualized applications. - -For a list of changes in the App-V Sequencer, see [What's new in App-V](appv-about-appv.md). - -To deploy the sequencer, see [How to install the Sequencer](appv-install-the-sequencer.md). - -## App-V client and Sequencer logs - -You can use the App-V Sequencer log information to troubleshoot Sequencer installation and operational events while using App-V. The Sequencer-related log information can be reviewed with the **Event Viewer**. The following file path is the specific path for Sequencer-related events: - -**Event Viewer\Applications and Services Logs\Microsoft\App V**. - ->[!NOTE] ->Sequencer-related events are prepended with **AppV\_Sequencer**. Client-related events are prepended with **AppV\_Client**. - - - diff --git a/windows/application-management/app-v/appv-deploying-the-appv-server.md b/windows/application-management/app-v/appv-deploying-the-appv-server.md deleted file mode 100644 index 2b08876aed..0000000000 --- a/windows/application-management/app-v/appv-deploying-the-appv-server.md +++ /dev/null @@ -1,118 +0,0 @@ ---- -title: Deploying the App-V Server (Windows 10/11) -description: Learn how to deploy the Application Virtualization (App-V) Server in App-V for Windows 10/11 by using different deployment configurations described in this article. -author: aczechowski -ms.prod: windows-client -ms.date: 04/18/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.technology: itpro-apps ---- - -# Deploying the App-V server - ->Applies to: Windows Server 2016 - -You can install the Application Virtualization (App-V) server components using different deployment configurations, which are described in this topic. Before you install the server features, review the server section of [App-V security considerations](appv-security-considerations.md). - ->[!NOTE] ->If you plan to use the App-V server components in your deployment, note that the version number is still listed as App-V 5.x, as the App-V server components have not changed in App-V for Windows client. - -To learn more about deploying App-V for Windows client, read [What's new in App-V](appv-about-appv.md). - ->[!IMPORTANT] ->Before installing and configuring the App-V servers, you must specify the port or ports where each component will be hosted. You must also add the associated firewall rules to allow incoming requests to access the specified ports, as the installer does not modify firewall settings. - -## Download and install App-V server components - ->[!NOTE] ->If you're already using App-V 5.x, you don't need to re-deploy the App-V server components, as they haven't changed since App-V 5.0 was released. - -App-V offers the following five server components, each of which serves a specific purpose in an App-V environment. - -* **Management server.** Use the App-V management server and console to manage your App-V infrastructure. See [Administering App-V with the management console](appv-administering-virtual-applications-with-the-management-console.md) for more information about the management server. - - > [!NOTE] - > If you are using App-V with your electronic software distribution solution, you don’t need to use the management server and console. However, you may want to take advantage of the reporting and streaming capabilities in App-V. - -* **Management database.** Use the App-V management database to facilitate database pre-deployments for App-V management. For more information about the management database, see [How to deploy the App-V server](appv-deploy-the-appv-server.md). - -* **Publishing server.** Use the App-V publishing server to host and stream virtual applications. The publishing server supports the HTTP and HTTPS protocols and does not require a database connection. To learn how to configure the publishing server, see [How to install the App-V publishing server](appv-install-the-publishing-server-on-a-remote-computer.md). - -* **Reporting server.** Use the App-V reporting server to generate reports that help you manage your App-V infrastructure. The reporting server requires a connection to the reporting database. To learn more about App-V's reporting capabilities, see [About App-V reporting](appv-reporting.md). - -* **Reporting database.** Use the App-V reporting database to facilitate database pre-deployments for App-V reporting. To learn more about the reporting database, see [How to deploy the App-V server](appv-deploy-the-appv-server.md). - -All five App-V server components are included in the Microsoft Desktop Optimization Pack (MDOP) 2015 ISO package, which can be downloaded from either of the following locations: - -* The [MSDN (Microsoft Developer Network) subscriptions site](https://msdn.microsoft.com/subscriptions/downloads/default.aspx#FileId=65215). You must have a MSDN subscription to download the MDOP ISO package from this site. -* The [Volume Licensing Service Center](https://www.microsoft.com/licensing/default.aspx) if you're using [Windows client for Enterprise or Education](https://www.microsoft.com/WindowsForBusiness/windows-product-home). - -In large organizations, you might want to install more than one instance of the server components to get the following benefits. - -* Fault tolerance for situations when one of the servers is unavailable. -* High availability to balance server requests. A network load balancer can also help you achieve this. -* Scalability to support high loads. For example, you can install additional servers behind a network load balancer. - -## App-V standalone deployment - -The App-V standalone deployment's topology is good for small deployments or test environments. In this implementation type, all server components are installed on a single computer. The services and associated databases will compete for the resources on the computer that runs the App-V components. However, because services and associated databases will compete for the computer's resources, it's not a good idea to use the standalone deployment for larger deployments. - -The following articles will give you more information about how to set up an App-V standalone deployment. - -* [How to deploy the App-V server](appv-deploy-the-appv-server.md) -* [How to deploy the App-V server using a script](appv-deploy-the-appv-server-with-a-script.md) - -## App-V server distributed deployment - -The distributed deployment topology can support a large App-V client base, allowing you to more easily manage and scale your environment. When you use this type of deployment the App-V server components are deployed across multiple computers, based on your organization's structure and requirements. - -* [How to install the management and reporting databases on separate computers from the management and reporting services](appv-install-the-management-and-reporting-databases-on-separate-computers.md) -* [How to install the management server on a standalone computer and connect it to the database](appv-install-the-management-server-on-a-standalone-computer.md) -* [How to deploy the App-V server using a script](appv-deploy-the-appv-server-with-a-script.md) -* [How to install the publishing server on a remote computer](appv-install-the-publishing-server-on-a-remote-computer.md) -* [How to install the management server on a standalone computer and connect it to the database](appv-install-the-management-server-on-a-standalone-computer.md) - -## Using an Enterprise Software Distribution (ESD) solution and App-V - -You can also deploy packages with an ESD. Its full integration capabilities will vary depending on which ESD you use. - ->[!NOTE] ->The App-V reporting server and reporting database can still be deployed alongside the ESD to collect the reporting data from the App-V clients. However, the other three server components should not be deployed, because they will conflict with the ESD functionality. - -* [Deploying App-V packages by Using Electronic Software Distribution (ESD)](appv-deploying-packages-with-electronic-software-distribution-solutions.md) - -## App-V Server logs - -You can use App-V server log information to help troubleshoot the server installation and operational events while using App-V. The server-related log information can be reviewed with the **Event Viewer**. The following line displays the specific path for Server-related events: - -**Event Viewer \\ Applications and Services Logs \\ Microsoft \\ App V** - -Associated setup logs are saved in the following directory: - -**%temp%** - -## App-V reporting - -App-V reporting allows App-V clients to collect data and then send it back to be stored in a central repository. You can use this information to get a better view of the virtual application usage within your organization. The following list displays some of the types of information the App-V client collects: - -* Information about the computer running the App-V client. -* Information about virtualized packages on a specific computer running the App-V client. -* Information about package open and shutdown for a specific user. - -The reporting information will be maintained until it is successfully sent to the reporting server database. After the data is in the database, you can use Microsoft SQL Server Reporting Services (SSRS) to generate any necessary reports. - -If you want to retrieve report information, you must use Microsoft SQL SSRS, which is available with Microsoft SQL. SSRS must be deployed separately to generate the associated reports, as it isn't automatically installed during App-V server installation. - -For more information, see [About App-V reporting](appv-reporting.md) and [How to enable reporting on the App-V client by using Windows PowerShell](appv-enable-reporting-on-the-appv-client-with-powershell.md). - -## Other App-V server resources - -* [Deploying App-V](appv-deploying-appv.md) - - - - diff --git a/windows/application-management/app-v/appv-deployment-checklist.md b/windows/application-management/app-v/appv-deployment-checklist.md deleted file mode 100644 index fd90b055be..0000000000 --- a/windows/application-management/app-v/appv-deployment-checklist.md +++ /dev/null @@ -1,36 +0,0 @@ ---- -title: App-V Deployment Checklist (Windows 10/11) -description: Use the App-V deployment checklist to understand the recommended steps and items to consider when deploying App-V features. -author: aczechowski -ms.prod: windows-client -ms.date: 04/18/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.technology: itpro-apps ---- - -# App-V Deployment Checklist - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -This checklist outlines the recommended steps and items to consider when deploying App-V features. Use it to organize your priorities while you deploy App-V. You can copy this checklist into a spreadsheet program and customize it for your use. - -|Status|Task|References|Notes| -|---|---|---|---| -|![Checklist box.](../app-v/images/checklistbox.gif)|Prepare the computing environment for App-V deployment during your planning phase.|[App-V planning checklist](appv-planning-checklist.md)|| -|![Checklist box.](../app-v/images/checklistbox.gif)|Review App-V's supported configurations.|[App-V supported configurations](appv-supported-configurations.md)|| -|![Checklist box.](../app-v/images/checklistbox.gif)|Run App-V Setup to deploy the required App-V features for your environment.|[How to install the sequencer](appv-install-the-sequencer.md)
                        [Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md)
                        [How to deploy the App-V server](appv-deploy-the-appv-server.md)|| - ->[!NOTE] ->Keep track of server names and associated URLs you create during installation. You'll need this information throughout the installation process. - - - - - -## Related articles - -* [Deploying App-V](appv-deploying-appv.md) diff --git a/windows/application-management/app-v/appv-dynamic-configuration.md b/windows/application-management/app-v/appv-dynamic-configuration.md deleted file mode 100644 index 03ba41c6d2..0000000000 --- a/windows/application-management/app-v/appv-dynamic-configuration.md +++ /dev/null @@ -1,617 +0,0 @@ ---- -title: About App-V Dynamic Configuration (Windows 10/11) -description: Learn how to create or edit an existing Application Virtualization (App-V) dynamic configuration file. -author: aczechowski -ms.prod: windows-client -ms.date: 09/27/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.technology: itpro-apps ---- - -# About App-V dynamic configuration - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -You can use dynamic configuration to customize an App-V package for a user. This article will tell you how to create or edit an existing dynamic configuration file. - -When you edit the Dynamic Configuration file, it customizes how an App-V package will run for a user or group. Therefore, package customization is made more convenient by removing the need to resequence packages using the desired settings and provides a way to keep package content and custom settings independent. - -## Advanced: dynamic configuration - -Virtual application packages contain a manifest that provides all the core information for the package. This information includes the defaults for the package settings and determines settings in the most basic form (with no further customization). If you want to adjust these defaults for a particular user or group, you can create and edit the following files: - -- User Configuration file -- Deployment Configuration file - -These .xml files specify package settings let you customize packages without directly affecting the packages. When a package is created, the sequencer automatically generates default deployment and user configuration .xml files using the package manifest data. These automatically generated configuration files reflect the package's default settings that were configured during sequencing. If you apply these configuration files to a package in the form generated by the sequencer, the packages will have the same default settings that came from their manifest. This result provides you with a package-specific template to get started if any of the defaults must be changed. - ->[!NOTE] ->The following information can only be used to modify sequencer generated configuration files to customize packages to meet specific user or group requirements. - -## Dynamic Configuration file contents - -All of the additions, deletions, and updates in the configuration files need to be made in relation to the default values specified by the package's manifest information. The following list represents the relationship between these files in how they'll be read, from most to least precedence: - -- User Configuration .xml file -- Deployment Configuration .xml file -- Package Manifest - -The first item represents what will be read last. Therefore, its content takes precedence. All packages inherently contain and provide default settings from the Package Manifest, but it also has the least precedence. If you apply a Deployment Configuration .xml file with customized settings, it will override the Package Manifest's defaults. If you apply a User Configuration .xml file with customized settings prior to the override of the Package Manifest's defaults, it will override both the deployment configuration and the Package Manifest's defaults. - -There are two types of configuration files: - -- **User Configuration file (UserConfig)**: Allows you to specify or modify custom settings for a package. These settings will be applied for a specific user when the package is deployed to a computer running the App-V client. -- **Deployment Configuration file (DeploymentConfig)**: Allows you to specify or modify the default settings for a package. These settings will be applied for all users when a package is deployed to a computer running the App-V client. - -You can use the UserConfig file to customize the settings for a package for a specific set of users on a computer or make changes that will be applied to local user locations such as HKCU. You can use the DeploymentConfig file to modify the default settings of a package for all users on a machine or make changes that will be applied to global locations such as HKEY\_LOCAL\_MACHINE and the All Users folder. - -The UserConfig file provides configuration settings that you can apply to a single user without affecting any other users on a client: - -- Extensions that will be integrated into the native system per user: shortcuts, File-Type associations, URL Protocols, AppPaths, Software Clients, and COM. -- Virtual Subsystems: Application Objects, Environment variables, Registry modifications, Services, and Fonts. -- Scripts (user context only). - -The DeploymentConfig file provides configuration settings in two sections, one relative to the machine context and one relative to the user context providing the same capabilities listed in the preceding UserConfig list: - -- All UserConfig settings from the preceding section in this topic -- Extensions that can only be applied globally for all users -- Virtual Subsystems that can be configured for global machine locations, such as the registry -- Product Source URL -- Scripts (Machine context only) -- Controls to terminate child processes - -## File structure - -The structure of the App-V Dynamic Configuration file is explained in the following section. - -## Dynamic User Configuration file - -### Header - -An example of a Dynamic User Configuration file's header is: - -```xml - - -``` - -The **PackageId** is the same value that exists in the Manifest file. - -### Dynamic User Configuration file body - -The Dynamic User Configuration file's body can include all app extension points defined in the Manifest file, and the information to configure virtual applications. There are four subsections allowed in the body: - -**Applications**: All app-extensions contained in the Manifest file within a package are assigned with an Application ID, which is also defined in the manifest file. This allows you to enable or disable all the extensions for a given application within a package. The **Application ID** must exist in the Manifest file or it will be ignored. - -```xml - - - - - - - … - -``` - -**Subsystems**: AppExtensions and other subsystems are arranged as subnodes under ``, as shown in the following example. - -```xml - - - .. - - .. - -``` - -Each subsystem can be enabled/disabled using the **Enabled** attribute. The following sections describe the various subsystems and usage samples. - -### Dynamic User Configuration file extensions - -Extension Subsystems control extensions. These subsystems are Shortcuts, File-Type associations, URL Protocols, AppPaths, Software Clients, and COM. - -Extension Subsystems can be enabled and disabled independently of the content.  Therefore, if Shortcuts are enabled, the client will use the shortcuts contained within the manifest by default. Each Extension Subsystem can contain an `` node. If this child element is present, the client will ignore the content in the Manifest file for that subsystem and only use the content in the configuration file. - -### Examples of the shortcuts subsystem - -#### Example 1 - -Content will be ignored if the user defined the following syntaxes in either the dynamic or deployment config file: - -```xml -                               -                                           -                              
                        -``` - -#### Example 2 - -Content in the manifest will be integrated during publishing if the user defined only the following syntax: - -```xml - -                             `` -``` - -#### Example 3 - -All shortcuts in the manifest will be ignored and no shortcuts will be integrated if the user defines the following syntaxes: - -```xml -                            -                                           -                              
                        -``` - -### Supported Extension Subsystems - -**Shortcuts**: This subsystem controls shortcuts that will be integrated into the local system. The following example has two shortcuts: - -```xml - - -   -     -       -         \[{Common Programs}\]\\Microsoft Contoso\\Microsoft ContosoApp Filler 2010.lnk -         \[{PackageRoot}\]\\Contoso\\ContosoApp.EXE -         \[{Windows}\]\\Installer\\{90140000-0011-0000-0000-0000000FF1CE}\\inficon.exe -          -          -         ContosoApp.Filler.3 -         Fill out dynamic forms to gather and reuse information throughout the organization using Microsoft ContosoApp. -         0 -         1 -         \[{PackageRoot}\]\\Contoso\\ContosoApp.EXE -        -   -   -      -       \[{AppData}\]\\Microsoft\\Contoso\\Recent\\Templates.LNK -       \[{AppData}\]\\Microsoft\\Templates -        -        -        -        -        -       0 -       1 -        -      -   -   - -``` - -**File Type Associations**: Associates file types with programs to open by default and to set up the context menu. (MIME types can also be set up with this subsystem.) An example of a FileType association is: - -```xml - - - - - - .docm - contosowordpad.DocumentMacroEnabled.12 - document - application/vnd.ms-contosowordpad.document.macroEnabled.12 - - wincontosowordpad.exe - - - contosowordpad.8 - - - - - - - true - - - - - - - - contosowordpad.DocumentMacroEnabled.12 - \[{Windows}\]\\Installer\\{90140000-0011-0000-0000-0000000FF1CE}\\contosowordpadicon.exe,15 - Blah Blah Blah - \[{FOLDERID\_ProgramFilesX86}\]\\Microsoft Contoso 14\\res.dll,9182 - \[{FOLDERID\_ProgramFilesX86}\]\\Microsoft Contoso 14\\res.dll,1424 - 0 - - Open - - {e56fa627-c35f-4a01-9e79-7d36aed8225a} - Edit - &Edit - "\[{PackageRoot}\]\\Contoso\\WINcontosowordpad.EXE" /vu "%1" - - - {e56fa627-c35f-4a01-9e79-7d36aed8225a} - Open - &Open - "\[{PackageRoot}\]\\Contoso\\WINcontosowordpad.EXE" /n "%1" - - - mscontosowordpad - ShellSystem - \[SHELLNOOP\] - \[SetForeground\]\[ShellNewDatabase "%1"\] - - - - - - - - -``` - -**URL Protocols**: This subsystem controls the URL Protocols integrated into the local registry of the client machine. The following example illustrates the “mailto:” protocol. - -```xml - - - - -   mailto -    -   \[{ProgramFilesX86}\]\\Microsoft Contoso\\Contoso\\contosomail.EXE,-9403 -   2 -   -   -   -   - -   -   -   2 -   -    -   open -    -   \[{ProgramFilesX86}\]\\Microsoft Contoso\\Contoso\\contosomail.EXE -   open -   \[{ProgramFilesX86}\\Microsoft Contoso\\Contoso\\contosomail.EXE" -c OEP.Note /m "%1" -   -   -   0 -   0 -   2 -     -   -   contosomail -   ShellSystem -   \[SHELLNOOP\] -   \[SetForeground\]\[ShellNewDatabase "%1"\] -   -   -   -   -   -   -   -   -``` - -**Software Clients**: Allows the app to register as an email client, news reader, or media player and makes the app visible in the Set Program Access and Computer Defaults UI. In most cases, you only need to enable and disable it. There's also a control that lets you enable or disable the email client only in case you want all the other clients to remain as they are. - -```xml - -   - -``` - -**AppPaths**: If an application, such as contoso.exe, is registered with an apppath name of “myapp”, this subsystem lets you open the app by entering “myapp” into the run menu. - -```xml - - - - -   \[{ProgramFilesX86}\]\\Microsoft Contoso\\Contoso\\contosomail.EXE -   contosomail.exe -   \[{ProgramFilesX86}\]\\Microsoft Contoso\\Contoso\\contosomail.EXE -   -   false -   - - - - -``` - -**COM**: Allows an Application to register Local COM servers. Mode can be Integration, Isolated or Off. When Isol. - -```xml - -``` - -### Other settings for Dynamic User Configuration file - -In addition to Extensions, the following other subsystems can be enabled/disabled and edited. - -#### Virtual Kernel Objects - -```xml - -```xml - -**Virtual Registry**: use this if you want to set a registry in the Virtual Registry within HKCU. - -```xml - - - - -   -   -   - -   -``` - -#### Virtual File System - -```xml -       -``` - -#### Virtual Fonts - -```xml -       -``` - -#### Virtual Environment Variables - -```xml - - -         -         -         -        -         -          -          -``` - -#### Virtual services - -```xml -       -``` - -#### UserScripts - -Scripts can be used to set up or alter the virtual environment and execute scripts on deployment or removal, before an application executes, or they can clean up the environment after the application terminates. Refer to a sample User Configuration file output by the sequencer to see a sample script. For more information about the various triggers you can use to set up scripts, see the [Scripts](appv-dynamic-configuration.md#scripts) section. - -## Dynamic Deployment Configuration file - -### Dynamic Deployment Configuration file header - -The header of a Deployment Configuration file should look something like this: - -```xml - -``` - -The **PackageId** is the same value as the one that exists in the Manifest file. - -### Dynamic Deployment Configuration file body - -The body of the deployment configuration file includes two sections: - -- The User Configuration section allows the same content as the User Configuration file described in the previous section. When the package is published to a user, any appextensions configuration settings in this section will override corresponding settings in the Manifest within the package unless a user configuration file is also provided. If a UserConfig file is also provided, it will be used instead of the User settings in the deployment configuration file. If the package is published globally, then only the contents of the deployment configuration file will be used in combination with the manifest. -- The Machine Configuration section contains information that can only be configured for an entire machine, not for a specific user on the machine. For example, HKEY\_LOCAL\_MACHINE registry keys in the VFS. - -```xml - - -.. - - -.. - -.. -
                        - -``` - -User Configuration: For more information about this section, see [Dynamic User Configuration](#dynamic-user-configuration-file). - -Machine Configuration: The Machine Configuration section of the Deployment Configuration File configures information that can only be set for an entire machine, not a specific user on the computer, like the HKEY\_LOCAL\_MACHINE registry keys in the Virtual Registry. This element can have the following four subsections. - -#### Subsystems - -AppExtensions and other subsystems are arranged as subnodes under ``: - -```xml - -   -   .. -   - .. - -``` - -The following section describes the various subsystems and usage samples. - -#### Extensions - -Some subsystems (Extension Subsystems) control extensions that can only apply to all users. The subsystem is application capabilities. Because this subsystem can only apply to all users, the package must be published globally in order for this type of extension to be integrated into the local system. The rules for User Configuration extension controls and settings also apply to the ones in Machine Configuration. - -#### Application Capabilities - -Application Capabilities extension is used by default programs in the Windows OS interface; it allows an application to register itself as capable of opening certain file extensions, as a contender for the Start menu's internet browser slot, and as capable of opening certain Windows MIME types. This extension also makes the virtual application visible in the Set Default Programs UI. - -```xml - -   -     -      -      \[{PackageRoot}\]\\LitView\\LitViewBrowser.exe -       -       LitView Browser -       SOFTWARE\\LitView\\Browser\\Capabilities -       -     -      -      @\[{ProgramFilesX86}\]\\LitView\\LitViewBrowser.exe,-12345 -      @\[{ProgramFilesX86}\]\\LitView\\LitViewBrowser.exe,-12346 -      0 -      Lit View E-Mail Client -       -        -        -        -       -       -        -        -       -      -        -       -       -    -     -   - - -``` - -#### Other settings for Dynamic Deployment Configuration file - -You can edit other subsystems in addition to extensions: - -- Machine-wide Virtual Registry: Use this subsystem when you want to set a registry key in the virtual registry within HKEY\_Local\_Machine. - -```xml - - -   -      -     -   -   - - -``` - -- Machine-wide Virtual Kernel Objects - -```xml - - -     -   - -``` - -- ProductSourceURLOptOut: Indicates whether the URL for the package can be modified globally through PackageSourceRoot to support branch office scenarios. It's set to False by default. Changes to the value take effect on the next launch. - -```xml - -   .. -    -   .. - -``` - -- MachineScripts: The package can be configured to execute scripts upon deployment, publishing, or removal. To see an example script, see a sample deployment configuration file generated by the sequencer. The following section provides more information about the various triggers you can use to set up scripts. - -- TerminateChildProcess: You can use this subsystem to specify that an application executable's child processes will be terminated when the application.exe process is terminated. - -```xml - -   .. -    -      -      -      -    -   .. - -``` - -### Scripts - -The following table describes the various script events and the context under which they can be run. - -|Script execution time|Can be specified in Deployment Configuration|Can be specified in User Configuration|Can run in the package's virtual environment|Can be run in the context of a specific application|Runs in system/user context: (Deployment Configuration, User Configuration)| -|---|:---:|:---:|:---:|:---:|:---:| -|AddPackage|X||||(SYSTEM, N/A)| -|PublishPackage|X|X|||(SYSTEM, User)| -|UnpublishPackage|X|X|||(SYSTEM, User)| -|RemovePackage|X||||(SYSTEM, N/A)| -|StartProcess|X|X|X|X|(User, User)| -|ExitProcess|X|X||X|(User, User)| -|StartVirtualEnvironment|X|X|X||(User, User)| -|TerminateVirtualEnvironment|X|X|||(User, User)| - -### Using multiple scripts on a single event trigger - -App-V supports the use of multiple scripts on a single event trigger for App-V packages, including packages that you convert from App-V 4.6 to App-V for Windows client. To enable the use of multiple scripts, App-V uses a script launcher application, named ScriptRunner.exe, which is included in the App-V client. - -#### How to use multiple scripts on a single event trigger - -For each script that you want to run, pass that script as an argument to the ScriptRunner.exe application. The application will run each script separately, along with the arguments that you specify for each script. Use only one script (ScriptRunner.exe) per trigger. - ->[!NOTE] ->We recommended you first run the multi-script line from a command prompt to make sure all arguments are built correctly before adding them to the deployment configuration file. - -#### Example script and parameter descriptions - -Using the following example file and table, modify the deployment or user configuration file to add the scripts that you want to run. - -```xml - - - ScriptRunner.exe - - -appvscript script1.exe arg1 arg2 –appvscriptrunnerparameters –wait –timeout=10 - -appvscript script2.vbs arg1 arg2 - -appvscript script3.bat arg1 arg2 –appvscriptrunnerparameters –wait –timeout=30 –rollbackonerror - - - - -``` - -|Parameter in the example file|Description| -|---|---| -|``|Name of the event trigger you're running a script for, such as when adding or publishing a package.| -|`ScriptRunner.exe`|The script launcher application included in the App-V client.

                        Although ScriptRunner.exe is included in the App-V client, the App-V client's location must be in %path% or ScriptRunner won't run. `ScriptRunner.exe` is typically located in the C:\Program Files\Microsoft Application Virtualization\Client folder.| -|`-appvscript script1.exe arg1 arg2 –appvscriptrunnerparameters –wait –timeout=10`

                        `-appvscript script2.vbs arg1 arg2`

                        `-appvscript script3.bat arg1 arg2 –appvscriptrunnerparameters –wait –timeout=30 -rollbackonerror`|`-appvscript`—token that represents the actual script you want to run.
                        `script1.exe`—name of the script you want to run.
                        `arg1 arg2`—arguments for the script you want to run.
                        `-appvscriptrunnerparameters`—token that represents the execution options for script1.exe.
                        `-wait`—token that tells ScriptRunner to wait for execution of script1.exe to finish before proceeding to the next script.
                        `-timeout=x`—token that informs ScriptRunner to stop running the current script after *x* number of seconds. All other specified scripts will still run.
                        `-rollbackonerror`—token that tells ScriptRunner to stop running all scripts that haven't yet run and roll back an error to the App-V client.| -|``|Waits for overall completion of ScriptRunner.exe.

                        Set the timeout value for the overall runner to be greater than or equal to the sum of the timeout values on the individual scripts.

                        If any individual script reported an error and rollbackonerror was set to True, then ScriptRunner should report the error to App-V client.| - -ScriptRunner will run any script whose file type is associated with an application installed on the computer. If the associated application is missing, or the script’s file type isn't associated with any of the computer's applications, the script won't run. - -### Create a Dynamic Configuration file using an App-V Manifest file - -You can create the Dynamic Configuration file using one of three methods: manually, using the App-V Management Console, or by sequencing a package, which will generate a package with two sample files. - -For more information about how to create the file using the App-V Management Console, see [How to create a Custom Configuration file by using the App-V Management Console](appv-create-a-custom-configuration-file-with-the-management-console.md). - -To create the file manually, you can combine the components listed in the previous sections into a single file. However, we recommend you use files generated by the sequencer instead of manually created ones. - - - - - -## Related topics - -- [How to Apply the Deployment Configuration File by Using Windows PowerShell](appv-apply-the-deployment-configuration-file-with-powershell.md) -- [How to Apply the User Configuration File by Using Windows PowerShell](appv-apply-the-user-configuration-file-with-powershell.md) -- [Operations for App-V](appv-operations.md) diff --git a/windows/application-management/app-v/appv-enable-administrators-to-publish-packages-with-electronic-software-distribution-solutions.md b/windows/application-management/app-v/appv-enable-administrators-to-publish-packages-with-electronic-software-distribution-solutions.md deleted file mode 100644 index 9c19cab0aa..0000000000 --- a/windows/application-management/app-v/appv-enable-administrators-to-publish-packages-with-electronic-software-distribution-solutions.md +++ /dev/null @@ -1,33 +0,0 @@ ---- -title: How to enable only administrators to publish packages by using an ESD -description: Learn how to enable only administrators to publish packages by bsing an electronic software delivery (ESD). -author: aczechowski -ms.prod: windows-client -ms.technology: itpro-apps -ms.date: 05/02/2022 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: how-to ---- - -# How to enable only administrators to publish packages by using an ESD - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -Starting in App-V 5.0 SP3, you can configure the App-V client so that only administrators (not end users) can publish or unpublish packages. In earlier versions of App-V, you couldn't prevent end users from performing these tasks. - -Here's how to enable only administrators to publish or unpublish packages: - -1. Navigate to the following Group Policy Object node: - - **Computer Configuration** > **Administrative Templates** > **System** > **App-V** > **Publishing**. - -2. Enable the **Require publish as administrator** Group Policy setting. - - To instead use Windows PowerShell to set this item, see [Understanding pending packages: UserPending and GlobalPending](appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md#about-pending-packages-userpending-and-globalpending). - - - - diff --git a/windows/application-management/app-v/appv-enable-reporting-on-the-appv-client-with-powershell.md b/windows/application-management/app-v/appv-enable-reporting-on-the-appv-client-with-powershell.md deleted file mode 100644 index cc71b17cb7..0000000000 --- a/windows/application-management/app-v/appv-enable-reporting-on-the-appv-client-with-powershell.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: How to Enable Reporting on the App-V Client by Using Windows PowerShell (Windows 10/11) -description: How to Enable Reporting on the App-V Client by Using Windows PowerShell -author: aczechowski -ms.prod: windows-client -ms.date: 04/19/2017 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.technology: itpro-apps ---- - -# How to Enable Reporting on the App-V Client by Using Windows PowerShell - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -Use the following procedure to configure the App-V for reporting. - -**To configure the computer running the App-V client for reporting** - -1. Enable the App-V client. For more information, see [Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md). - -2. After you have enabled the App-V client, use the **Set-AppvClientConfiguration** cmdlet to configure appropriate Reporting Configuration settings: - -|Setting|Description| -|--- |--- | -|ReportingEnabled|Enables the client to return information to a reporting server. This setting is required for the client to collect the reporting data on the client.| -|ReportingServerURL|Specifies the location on the reporting server where client information is saved. For example, https://<reportingservername>:<reportingportnumber>.
                        **Note:**
                        This is the port number that was assigned during the Reporting Server setup| -|Reporting Start Time|This is set to schedule the client to automatically send the data to the server. This setting will indicate the hour at which the reporting data will start to send. It is in the 24 hour format and will take a number between 0-23.| -|ReportingRandomDelay|Specifies the maximum delay (in minutes) for data to be sent to the reporting server. When the scheduled task is started, the client generates a random delay between 0 and ReportingRandomDelay and will wait the specified duration before sending data.| -|ReportingInterval|Specifies the retry interval that the client will use to resend data to the reporting server.| -|ReportingDataCacheLimit|Specifies the maximum size in megabytes (MB) of the XML cache for storing reporting information. The size applies to the cache in memory. When the limit is reached, the log file will roll over.| -|ReportingDataBlockSize|Specifies the maximum size in megabytes (MB) of the XML cache for storing reporting information. The size applies to the cache in memory. When the limit is reached, the log file will roll over.| - -3. After the appropriate settings have been configured, the computer running the App-V client will automatically collect data and will send the data back to the reporting server. - - Additionally, administrators can manually send the data back in an on-demand manner using the **Send-AppvClientReport** cmdlet. - - - - -
                        For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). - -## Related articles - - -[Administering App-V by Using Windows PowerShell](appv-administering-appv-with-powershell.md) diff --git a/windows/application-management/app-v/appv-enable-the-app-v-desktop-client.md b/windows/application-management/app-v/appv-enable-the-app-v-desktop-client.md deleted file mode 100644 index 5b65a93ac1..0000000000 --- a/windows/application-management/app-v/appv-enable-the-app-v-desktop-client.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: Enable the App-V in-box client (Windows 10/11) -description: Learn how to enable the Microsoft Application Virtualization (App-V) in-box client installed with Windows 10/11. -author: aczechowski -ms.prod: windows-client -ms.date: 04/18/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.technology: itpro-apps ---- - -# Enable the App-V in-box client - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -The App-V client is the component that runs virtualized applications on user devices. Once you enable the client, users can interact with icons and file names to start virtualized applications. The client can also get virtual application content from the management server. - -Starting with Windows 10 version 1607, the App-V client is installed automatically. However, you'll still need to enable the client yourself to allow user devices to access and run virtual applications. You can set up the client with the Group Policy editor or with Windows PowerShell. - -Here's how to enable the App-V client with Group Policy: - -1. Open the device’s **Group Policy Editor**. -2. Navigate to **Computer Configuration** > **Administrative Templates** > **System** > **App-V**. -3. Run **Enables App-V Client**, then select **Enabled**. -4. Restart the device. - -Here's how to enable the App-V client with Windows PowerShell: - -1. Open Windows PowerShell. -2. Enter **Enable-Appv**, then select the Enter key. -3. Restart the device. -4. To verify that the App-V client is working, enter **Get-AppvStatus**, then select the Enter key. - -Check out these articles for more information about how to configure the App-V client: - -* [Deploying the App-V Sequencer and configuring the client](appv-deploying-the-appv-sequencer-and-client.md) -* [How to modify client configuration by using Windows PowerShell](appv-modify-client-configuration-with-powershell.md) -* [Using the client management console](appv-using-the-client-management-console.md) -* [How to configure the client to receive package and connection group updates from the Publishing server](appv-configure-the-client-to-receive-updates-from-the-publishing-server.md) - - - diff --git a/windows/application-management/app-v/appv-evaluating-appv.md b/windows/application-management/app-v/appv-evaluating-appv.md deleted file mode 100644 index 6874ebc260..0000000000 --- a/windows/application-management/app-v/appv-evaluating-appv.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: Evaluating App-V (Windows 10/11) -description: Learn how to evaluate App-V for Windows 10/11 in a lab environment before deploying into a production environment. -author: aczechowski -ms.prod: windows-client -ms.date: 04/19/2017 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.technology: itpro-apps ---- - -# Evaluating App-V - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -> [!NOTE] -> [!INCLUDE [Application Virtualization will be end of life in April 2026](../includes/app-v-end-life-statement.md)] - -Before you deploy App-V into a production environment, you should evaluate it in a lab environment. You can use the information in this article to set up App-V in a lab environment for evaluation purposes only. - -## Configure lab computers for App-V Evaluation - -Use the following links for information about setting up the App-V sequencer on a computer in your lab environment. - -### Installing the App-V Sequencer and Creating Packages - -Use the following links for information about setting up the App-V sequencer and creating packages in your lab environment. - -- [How to Install the Sequencer](appv-install-the-sequencer.md) - -- [Creating and Managing App-V Virtualized Applications](appv-creating-and-managing-virtualized-applications.md) - -### Configuring the App-V Server - -Use the following links for information about setting up the App-V server in your lab environment. - -- [How to Deploy the App-V server](appv-deploy-the-appv-server.md) - -- [Administering App-V Virtual Applications by Using the Management Console](appv-administering-virtual-applications-with-the-management-console.md) - -### Enabling the App-V Client - -Use the following links for more information about creating and managing virtualized packages in your lab environment. - -- [Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md) - -- [How to Configure the Client to Receive Package and Connection Groups Updates From the Publishing Server](appv-configure-the-client-to-receive-updates-from-the-publishing-server.md) - - -## Related articles - -- [Getting Started with App-V](appv-getting-started.md) diff --git a/windows/application-management/app-v/appv-for-windows.md b/windows/application-management/app-v/appv-for-windows.md deleted file mode 100644 index ecb4183907..0000000000 --- a/windows/application-management/app-v/appv-for-windows.md +++ /dev/null @@ -1,72 +0,0 @@ ---- -title: Application Virtualization (App-V) (Windows 10/11) -description: See various articles that can help you administer Application Virtualization (App-V) and its components. -author: aczechowski -ms.prod: windows-client -ms.date: 09/27/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.technology: itpro-apps ---- - -# Application Virtualization (App-V) for Windows client overview - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -> [!NOTE] -> [!INCLUDE [Application Virtualization will be end of life in April 2026](../includes/app-v-end-life-statement.md)] - -The articles in this section provide information and instructions to help you administer App-V and its components. This information is for system administrators who manage large installations with many servers and clients, and for support personnel who interact directly with the computers or users. - -[Getting started with App-V](appv-getting-started.md) - -- [What's new in App-V](appv-about-appv.md) -- [Evaluating App-V](appv-evaluating-appv.md) -- [High-level architecture for App-V](appv-high-level-architecture.md) - -[Planning for App-V](appv-planning-for-appv.md) - -- [Preparing your environment for App-V](appv-preparing-your-environment.md) -- [App-V prerequisites](appv-prerequisites.md) -- [Planning to deploy App-V](appv-planning-to-deploy-appv.md) -- [App-V supported configurations](appv-supported-configurations.md) -- [App-V planning checklist](appv-planning-checklist.md) - -[Deploying App-V](appv-deploying-appv.md) - -- [Deploying the App-V Sequencer and configuring the client](appv-deploying-the-appv-sequencer-and-client.md) -- [Deploying the App-V Server](appv-deploying-the-appv-server.md) -- [App-V deployment checklist](appv-deployment-checklist.md) -- [Deploying Microsoft Office 2016 by using App-V](appv-deploying-microsoft-office-2016-with-appv.md) -- [Deploying Microsoft Office 2013 by using App-V](appv-deploying-microsoft-office-2013-with-appv.md) -- [Deploying Microsoft Office 2010 by using App-V](appv-deploying-microsoft-office-2010-wth-appv.md) - -[Operations for App-V](appv-operations.md) - -- [Creating and managing App-V virtualized applications](appv-creating-and-managing-virtualized-applications.md) -- [Automatically provision your sequencing environment using Microsoft Application Virtualization Sequencer (App-V Sequencer)](appv-auto-provision-a-vm.md) -- [Automatically sequence multiple apps at the same time using Microsoft Application Virtualization Sequencer (App-V Sequencer)](appv-auto-batch-sequencing.md) -- [Automatically update multiple apps at the same time using Microsoft Application Virtualization Sequencer (App-V Sequencer)](appv-auto-batch-updating.md) -- [Administering App-V Virtual Applications by using the Management Console](appv-administering-virtual-applications-with-the-management-console.md) -- [Managing connection groups](appv-managing-connection-groups.md) -- [Deploying App-V packages by using Electronic Software Distribution (ESD)](appv-deploying-packages-with-electronic-software-distribution-solutions.md) -- [Using the App-V Client Management Console](appv-using-the-client-management-console.md) -- [Automatically clean up unpublished packages on the App-V client](appv-auto-clean-unpublished-packages.md) -- [Migrating to App-V from a previous version](appv-migrating-to-appv-from-a-previous-version.md) -- [Maintaining App-V](appv-maintaining-appv.md) -- [Administering App-V by using Windows PowerShell](appv-administering-appv-with-powershell.md) - -[Troubleshooting App-V](appv-troubleshooting.md) - -[Technical reference for App-V](appv-technical-reference.md) - -- [Performance guidance for Application Virtualization](appv-performance-guidance.md) -- [Application publishing and client interaction](appv-application-publishing-and-client-interaction.md) -- [Viewing App-V Server publishing metadata](appv-viewing-appv-server-publishing-metadata.md) -- [Running a locally installed application inside a virtual environment with virtualized applications](appv-running-locally-installed-applications-inside-a-virtual-environment.md) - - - diff --git a/windows/application-management/app-v/appv-getting-started.md b/windows/application-management/app-v/appv-getting-started.md deleted file mode 100644 index f851ca2a85..0000000000 --- a/windows/application-management/app-v/appv-getting-started.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -title: Getting Started with App-V (Windows 10/11) -description: Get started with Microsoft Application Virtualization (App-V) for Windows 10/11. App-V for Windows client devices delivers Win32 applications to users as virtual applications. -author: aczechowski -ms.prod: windows-client -ms.date: 04/18/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.technology: itpro-apps ---- - -# Getting started with App-V for Windows client - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -> [!NOTE] -> [!INCLUDE [Application Virtualization will be end of life in April 2026](../includes/app-v-end-life-statement.md)] - -Microsoft Application Virtualization (App-V) for Windows delivers Win32 applications to users as virtual applications. Virtual applications are installed on centrally managed servers and delivered to users as a service in real time and on an as-needed basis. Users launch virtual applications from familiar access points and interact with them as if they were installed locally. - -Starting with Windows 10 version 1607, App-V is included with the [Windows 10 for Enterprise edition](https://www.microsoft.com/WindowsForBusiness/windows-for-enterprise). If you're new to Windows client and App-V, you’ll need to download, activate, and install server- and client-side components to start delivering virtual applications to users. To learn what you need to know before getting started with App-V, see the [Application Virtualization (App-V) overview](appv-for-windows.md). - -If you’re already using App-V, performing an in-place upgrade to Windows 10/11 on user devices automatically installs the App-V client and migrates users’ App-V applications and settings. For more information about how to configure an existing App-V installation after upgrading user devices to Windows 10/11, see [Upgrading to App-V for Windows from an existing installation](appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation.md). - ->[!IMPORTANT] ->You can upgrade your existing App-V installation to App-V for Windows from App-V versions 5.0 SP2 and higher only. If you are using an earlier version of App-V, you’ll need to upgrade your existing App-V installation to App-V 5.0 SP2 before upgrading to App-V for Windows. - -To learn more about previous versions of App-V, see [MDOP information experience](/microsoft-desktop-optimization-pack/index). - -## Getting started with App-V for Windows (new installations) - -To start using App-V to deliver virtual applications to users, you’ll need to download, enable, and install server- and client-side components. The following table describes the App-V for Windows client components, what they do, and where to find them. - - - -| Component | What it does | Where to find it | -|------------|--|------| -| App-V server components | App-V offers five server components that work together to allow you to host and publish virtual applications, generate usage reports, and manage your App-V environment. For more information, see [Deploying the App-V Server](appv-deploying-the-appv-server.md).

                        If you're already using App-V 5.x, you don't need to redeploy the App-V server components, as they haven't changed since App-V 5.0's release. | The App-V server components are included in the Microsoft Desktop Optimization Pack (MDOP) 2015 ISO package that can be downloaded from the following locations:

                        If you have a Microsoft Developer Network (MSDN) subscription, use the [MSDN (Microsoft Developer Network) subscriptions site](https://msdn.microsoft.com/subscriptions/downloads/default.aspx#FileId=65215) to download the MDOP ISO package.

                        If you're using [Windows client for Enterprise or Education](https://www.microsoft.com/WindowsForBusiness/windows-product-home), download it from the [Volume Licensing Service Center](https://www.microsoft.com/licensing/default.aspx).

                        For more information about installing and using the server components, see [Deploying the App-V Server](appv-deploying-the-appv-server.md).| -| App-V client and App-V Remote Desktop Services (RDS) client | The App-V client is the component that runs virtualized applications on user devices, allowing users to interact with icons and file names to start virtualized applications. | Starting with Windows 10 version 1607, the App-V client is automatically installed.

                        To learn how to enable the client, see [Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md). | -| App-V sequencer | Use the App-V sequencer to convert Win32 applications into virtual packages for deployment to user devices. Devices must run the App-V client to allow users to interact with virtual applications. | Installed with the [Windows Assessment and Deployment kit (ADK) for Windows client](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit). | - -For more information about these components, see [High Level Architecture for App-V](appv-high-level-architecture.md). - -If you're new to App-V, it's a good idea to read the documentation thoroughly. Before deploying App-V in a production environment, you can ensure installation goes smoothly by validating your deployment plan in a test network environment. You might also consider taking a class about relevant technologies. To get started, see the [Microsoft Training Overview](https://www.microsoft.com/learning/default.aspx). - -## Getting started with App-V - -[What's new in App-V](appv-about-appv.md) provides a high-level overview of App-V and how it can be used in your organization? - -[Evaluating App-V](appv-evaluating-appv.md) provides information about how you can best evaluate App-V for use in your organization. - -[High Level Architecture for App-V](appv-high-level-architecture.md) provides a description of the App-V features and how they work together. - -## Other resources for this product - -* [Application Virtualization (App-V) overview](appv-for-windows.md) -* [Planning for App-V](appv-planning-for-appv.md) -* [Deploying App-V](appv-deploying-appv.md) -* [Operations for App-V](appv-operations.md) -* [Troubleshooting App-V](appv-troubleshooting.md) -* [Technical reference for App-V](appv-technical-reference.md) diff --git a/windows/application-management/app-v/appv-high-level-architecture.md b/windows/application-management/app-v/appv-high-level-architecture.md deleted file mode 100644 index 437b20eeb1..0000000000 --- a/windows/application-management/app-v/appv-high-level-architecture.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -title: High-level architecture for App-V (Windows 10/11) -description: Use the information in this article to simplify your Microsoft Application Virtualization (App-V) deployment. -author: aczechowski -ms.prod: windows-client -ms.date: 04/18/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.technology: itpro-apps ---- - -# High-level architecture for App-V - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -Use the following information to simplify your Microsoft Application Virtualization (App-V) deployment. - -## Architecture overview - -A typical App-V implementation consists of the following elements. - -|Element|Description| -|---|---| -|App-V Management server|The App-V Management server provides overall management functionality for the App-V infrastructure. Additionally, you can install more than one instance of the management server in your environment, which provides the following benefits:
                        **Fault tolerance and high availability**—installing and configuring the App-V Management server on two separate computers can help in situations when one of the servers is unavailable or offline. You can also help increase App-V availability by installing the Management server on multiple computers. In this scenario, consider using a network load balancer to keep server requests balanced.
                        **Scalability**—you can add more management servers as necessary to support a high load. For example, you can install multiple servers behind a load balancer.| -|App-V Publishing Server|The App-V publishing server provides functionality for virtual application hosting and streaming. The publishing server doesn't require a database connection and supports HTTP and HTTPS protocols.
                        You can also help increase App-V availability by installing the Publishing server on multiple computers. You should also consider having a network load balancer to keep server requests balanced.| -|App-V Reporting Server|The App-V Reporting server lets authorized users run and view existing App-V reports and unplanned reports for managing App-V infrastructure. The Reporting server requires a connection to the App-V reporting database. You can also help increase App-V availability by installing the Reporting server on multiple computers. You should also consider having a network load balancer to keep server requests balanced.| -|App-V Client|The App-V client enables packages created using App-V to run on target computers.| - ->[!NOTE] ->If you are using App-V with electronic software distribution (ESD), you aren't required to use the App-V Management server. However, you can still use App-V's reporting and streaming functionality. - -## Related articles - -- [Getting Started with App-V](appv-getting-started.md) diff --git a/windows/application-management/app-v/appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md b/windows/application-management/app-v/appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md deleted file mode 100644 index acc244a595..0000000000 --- a/windows/application-management/app-v/appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md +++ /dev/null @@ -1,145 +0,0 @@ ---- -title: How to Install the App-V Databases and Convert the Associated Security Identifiers by Using Windows PowerShell (Windows 10/11) -description: How to Install the App-V Databases and Convert the Associated Security Identifiers by Using Windows PowerShell -author: aczechowski -ms.prod: windows-client -ms.date: 04/19/2017 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.technology: itpro-apps ---- - - -# How to Install the App-V Databases and Convert the Associated Security Identifiers by Using Windows PowerShell - -**Applies to** -- Windows Server 2016 - -Use the following Windows PowerShell procedure to convert any number of Active Directory Domain Services (AD DS) user or machine accounts into formatted Security Identifiers (SIDs) both in the standard format and in the hexadecimal format used by Microsoft SQL Server when running SQL scripts. - -Before attempting this procedure, you should read and understand the information and examples displayed in the following list: - -- **.INPUTS** – The account or accounts used to convert to SID format. This item can be a single account name or an array of account names. - -- **.OUTPUTS** - A list of account names with the corresponding SID in standard and hexadecimal formats. - -- **Examples** - - - **.\\ConvertToSID.ps1 DOMAIN\\user\_account1 DOMAIN\\machine\_account1$ DOMAIN\\user\_account2 | Format-List**. - - **$accountsArray = @("DOMAIN\\user\_account1", "DOMAIN\\machine\_account1$", "DOMAIN\_user\_account2")** - - **.\\ConvertToSID.ps1 $accountsArray | Write-Output -FilePath .\\SIDs.txt -Width 200** - - \#> - -**To convert any number of Active Directory Domain Services (AD DS) user or machine accounts into formatted Security Identifiers (SIDs)** - -1. Copy the following script into a text editor and save it as a Windows PowerShell script file, for example **ConvertToSIDs.ps1**. - -2. To open a Windows PowerShell console, click **Start** and type **PowerShell**. Right-click **Windows PowerShell** and select **Run as Administrator**. - - ```powershell - <# - .SYNOPSIS - This Windows PowerShell script will take an array of account names and try to convert each of them to the corresponding SID in standard and hexadecimal formats. - .DESCRIPTION - This is a Windows PowerShell script that converts any number of Active Directory (AD) user or machine accounts into formatted Security Identifiers (SIDs) both in the standard format and in the hexadecimal format used by SQL server when running SQL scripts. - .INPUTS - The account(s) to convert to SID format. This can be a single account name or an array of account names. Please see examples below. - .OUTPUTS - A list of account names with the corresponding SID in standard and hexadecimal formats - .EXAMPLE - .\ConvertToSID.ps1 DOMAIN\user_account1 DOMAIN\machine_account1$ DOMAIN\user_account2 | Format-List - .EXAMPLE - $accountsArray = @("DOMAIN\user_account1", "DOMAIN\machine_account1$", "DOMAIN_user_account2") - .\ConvertToSID.ps1 $accountsArray | Write-Output -FilePath .\SIDs.txt -Width 200 - #> - - function ConvertSIDToHexFormat - { -    param([System.Security.Principal.SecurityIdentifier]$sidToConvert) -    $sb = New-Object System.Text.StringBuilder -     [int] $binLength = $sidToConvert.BinaryLength -     [Byte[]] $byteArray = New-Object Byte[] $binLength -    $sidToConvert.GetBinaryForm($byteArray, 0) -    foreach($byte in $byteArray) -    { -    $sb.Append($byte.ToString("X2")) |Out-Null -    } -    return $sb.ToString() - } - [string[]]$myArgs = $args - if(($myArgs.Length -lt 1) -or ($myArgs[0].CompareTo("/?") -eq 0)) - { - [string]::Format("{0}====== Description ======{0}{0}" + - "  Converts any number of user or machine account names to string and hexadecimal SIDs.{0}" + -                "  Pass the account(s) as space separated command line parameters. (For example 'ConvertToSID.exe DOMAIN\\Account1 DOMAIN\\Account2 ...'){0}" + -                "  The output is written to the console in the format 'Account name    SID as string   SID as hexadecimal'{0}" + -                "  And can be written out to a file using standard Windows PowerShell redirection{0}" + -                "  Please specify user accounts in the format 'DOMAIN\username'{0}" + -                "  Please specify machine accounts in the format 'DOMAIN\machinename$'{0}" + -                "  For more help content, please run 'Get-Help ConvertToSID.ps1'{0}" + -                "{0}====== Arguments ======{0}" + -                "{0}  /?    Show this help message", [Environment]::NewLine) - { - else - {  -     #If an array was passed in, try to split it -     if($myArgs.Length -eq 1) -     { -         $myArgs = $myArgs.Split(' ') -     } - -     #Parse the arguments for account names -     foreach($accountName in $myArgs) -     {    -         [string[]] $splitString = $accountName.Split('\')  # We're looking for the format "DOMAIN\Account" so anything that does not match, we reject -         if($splitString.Length -ne 2) -         { -             $message = [string]::Format("{0} is not a valid account name. Expected format 'Domain\username' for user accounts or 'DOMAIN\machinename$' for machine accounts.", $accountName) -             Write-Error -Message $message -             continue -         } -         #Convert any account names to SIDs -         try -         { -             [System.Security.Principal.NTAccount] $account = New-Object System.Security.Principal.NTAccount($splitString[0], $splitString[1]) -             [System.Security.Principal.SecurityIdentifier] $SID = [System.Security.Principal.SecurityIdentifier]($account.Translate([System.Security.Principal.SecurityIdentifier])) -         } -         catch [System.Security.Principal.IdentityNotMappedException] -         { -             $message = [string]::Format("Failed to translate account object '{0}' to a SID. Please verify that this is a valid user or machine account.", $account.ToString()) -             Write-Error -Message $message -             continue -         } - -         #Convert regular SID to binary format used by SQL -         $hexSIDString = ConvertSIDToHexFormat $SID -         $SIDs = New-Object PSObject -         $SIDs | Add-Member NoteProperty Account $accountName -         $SIDs | Add-Member NoteProperty SID $SID.ToString() -         $SIDs | Add-Member NoteProperty Hexadecimal $hexSIDString - -         Write-Output $SIDs -     } - } - ``` - -3. Run the script you saved in Step 1 of this procedure passing the accounts to convert as arguments. - - For example, - - **.\\ConvertToSID.ps1 DOMAIN\\user\_account1 DOMAIN\\machine\_account1$ DOMAIN\\user\_account2 | Format-List” or “$accountsArray = @("DOMAIN\\user\_account1", "DOMAIN\\machine\_account1$", "DOMAIN\_user\_account2")** - - **.\\ConvertToSID.ps1 $accountsArray | Write-Output -FilePath .\\SIDs.txt -Width 200”** - - - -
                        For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). - -## Related articles - -[Administering App-V by Using Windows PowerShell](appv-administering-appv-with-powershell.md) diff --git a/windows/application-management/app-v/appv-install-the-management-and-reporting-databases-on-separate-computers.md b/windows/application-management/app-v/appv-install-the-management-and-reporting-databases-on-separate-computers.md deleted file mode 100644 index ae2e2b56c3..0000000000 --- a/windows/application-management/app-v/appv-install-the-management-and-reporting-databases-on-separate-computers.md +++ /dev/null @@ -1,81 +0,0 @@ ---- -title: How to Install the Management and Reporting Databases on separate computers from the Management and Reporting Services (Windows 10/11) -description: How to install the Management and Reporting Databases on separate computers from the Management and Reporting Services. -author: aczechowski -ms.prod: windows-client -ms.date: 04/18/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.technology: itpro-apps ---- - -# How to Install the Management and Reporting Databases on separate computers from the Management and Reporting Services - ->Applies to: Windows Server 2016 - -Use the following procedure to install the database server and management server on different computers. The computer you plan to install the database server on must be running a supported version of Microsoft SQL or the installation will fail. - ->[!NOTE] ->After you complete the deployment, the administrator installing the service will need the Microsoft SQL Server name, instance name and the database name to connect to these databases. - -## Installing the management database and the management server on separate computers - -1. Copy the App-V server installation files to the computer you want to install it on. To start the App-V server installation, run **appv\_server\_setup.exe** as an administrator, then select **Install**. -2. On the **Getting started** page, review and accept the license terms, then select **Next**. -3. On the **Use Microsoft Update to help keep your computer secure and up-to-date** page, to enable Microsoft updates, select **Use Microsoft Update when I check for updates (recommended).** To disable Microsoft updates, select **I don’t want to use Microsoft Update**, then select **Next**. -4. On the **Feature selection** page, select the components you want to install by first selecting the **Management Server Database** checkbox, then selecting **Next**. -5. On the **Installation location** page, accept the default location and select **Next**. -6. On the initial **Create new management server database** page, accept the default selections if appropriate, then select **Next**. - * If you are using a custom SQL Server instance, select **Use a custom instance** and enter the name of the instance. - * If you are using a custom database name, select **Custom configuration** and enter the database name. -7. On the next **Create new management server database** page, select **Use a remote computer**, then enter the remote machine account using the following format: ```Domain\MachineAccount```. - - > [!NOTE] - >If you plan to deploy the management server on the same computer you must select **Use this local computer**. Specify the user name for the management server **Install Administrator** using the following format: ```Domain\AdministratorLoginName```. After that, select **Next**. -8. To start the installation, select **Install**. - -## Installing the reporting database and the reporting server on separate computers - -1. Copy the App-V server installation files to the computer you want to install it on. To start the App-V server installation, run **appv\_server\_setup.exe** as an administrator, then select **Install**. -2. On the **Getting started** page, review and accept the license terms, then select **Next**. -3. On the **Use Microsoft Update to help keep your computer secure and up-to-date** page, to enable Microsoft Update, select **Use Microsoft Update when I check for updates (recommended)**. To disable Microsoft Update, select **I don’t want to use Microsoft Update**. After that, select **Next**. -4. On the **Feature selection** page, select the components you want to install by first selecting the **Reporting Server Database** checkbox, then selecting **Next**. -5. On the **Installation Location** page, accept the default location and select **Next**. -6. On the initial **Create new management server database** page, accept the default selections if appropriate, then select **Next**. - * If you're using a custom SQL Server instance, select **Use a custom instance** and enter the instance name. - * If you're using a custom database name, select **Custom configuration** and enter the database name. -7. On the next **Create new management server database** page, select **Use a remote computer**, and enter the remote machine account using the following format: ```Domain\MachineAccount```. - - > [!NOTE] - >If you plan to deploy the reporting server on the same computer you must select **Use this local computer**. Specify the user name for the reporting server **Install Administrator** using the following format: Domain\\AdministratorLoginName. After that, select **Next**. -8. To start the installation, select **Install**. - -## Installing the management and reporting databases using App-V database scripts - -1. Copy the App-V server installation files to the computer on which you want to install it on. -2. To extract the App-V database scripts, open a command prompt and specify the location where the installation files are saved and run the following command: - - ```SQL - appv\_server\_setup.exe /LAYOUT /LAYOUTDIR=”InstallationExtractionLocation” - ``` - -3. After the extraction has been completed, to access the App-V database scripts and instructions readme file: - - * The App-V Management Database scripts and instructions readme are located in the following folder: **InstallationExtractionLocation** \\ **Database Scripts** \\ **Management Database**. - * The App-V Reporting Database scripts and instructions readme are located in the following folder: **InstallationExtractionLocation** \\ **Database Scripts** \\ **Reporting Database**. -4. For each database, copy the scripts to a share and modify them following the instructions in the readme file. - - > [!NOTE] - >For more information about modifying the required SIDs contained in the scripts, see, [How to Install the App-V Databases and Convert the Associated Security Identifiers by Using Windows PowerShell](appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md). -5. Run the scripts on the computer running Microsoft SQL Server. - - - - - -## Related articles - -* [Deploying App-V](appv-deploying-appv.md) diff --git a/windows/application-management/app-v/appv-install-the-management-server-on-a-standalone-computer.md b/windows/application-management/app-v/appv-install-the-management-server-on-a-standalone-computer.md deleted file mode 100644 index 5b258437f3..0000000000 --- a/windows/application-management/app-v/appv-install-the-management-server-on-a-standalone-computer.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -title: How to install the Management Server on a Standalone Computer and Connect it to the Database (Windows 10/11) -description: How to install the Management Server on a Standalone Computer and Connect it to the Database -author: aczechowski -ms.prod: windows-client -ms.date: 04/18/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.technology: itpro-apps ---- - -# How to install the Management Server on a Standalone Computer and Connect it to the Database - ->Applies to: Windows Server 2016 - -To install the management server on a standalone computer and connect it to the database, follow these steps. - -1. Copy the App-V server installation files to the computer on which you want to install it on. To start the App-V server installation, run **appv\_server\_setup.exe** as an administrator, then select **Install**. -2. On the **Getting Started** page, review and accept the license terms, then select **Next**. -3. On the **Use Microsoft Update to help keep your computer secure and up-to-date** page, to enable Microsoft Update, select **Use Microsoft Update when I check for updates (recommended)**. To disable Microsoft Update, select **I don’t want to use Microsoft Update**, then select **Next**. -4. On the **Feature Selection** page, select the **Management Server** checkbox, then select **Next**. -5. On the **Installation Location** page, accept the default location, then select **Next**. -6. On the **Configure Existing Management Database** page, select **Use a remote SQL Server**, then enter the computer running Microsoft SQL's machine name, such as ```SqlServerMachine```. - - > [!NOTE] - >If the Microsoft SQL Server is deployed on the same server, select **Use local SQL Server**. For the SQL Server Instance, select **Use the default instance**. If you are using a custom Microsoft SQL Server instance, you must select **Use a custom instance**, then enter the instance's name. Specify the **SQL Server Database name** that this management server will use, such as ```AppvManagement```. -7. On the **Configure management server configuration** page, specify the following items: - * The AD group or account that will connect to the management console for administrative purposes for example **MyDomain\\MyUser** or **MyDomain\\AdminGroup**. The account or AD group you specify will be enabled to manage the server through the management console. You can add additional users or groups using the management console after installation - * The **Website Name** you want to use for the management service. Accept the default if you do not have a custom name. - * For the **Port Binding**, specify a unique port number, such as **12345**. -8. Select **Install**. -9. To confirm that the setup has completed successfully, open a web browser and enter the following URL: https://managementserver:portnumber/Console. If the installation was successful, you should see the **Management Console** appear without any error messages or warnings displayed. - - - - - -## Related articles - -* [Deploying App-V](appv-deploying-appv.md) diff --git a/windows/application-management/app-v/appv-install-the-publishing-server-on-a-remote-computer.md b/windows/application-management/app-v/appv-install-the-publishing-server-on-a-remote-computer.md deleted file mode 100644 index 7457b54f82..0000000000 --- a/windows/application-management/app-v/appv-install-the-publishing-server-on-a-remote-computer.md +++ /dev/null @@ -1,65 +0,0 @@ ---- -title: Install the Publishing Server on a Remote Computer (Windows 10/11) -description: Use the procedures in this article to install the Microsoft Application Virtualization (App-V) publishing server on a separate computer. -author: aczechowski -ms.prod: windows-client -ms.date: 04/18/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.technology: itpro-apps ---- - -# How to install the publishing server on a remote computer - ->Applies to: Windows Server 2016 - -Use the following procedure to install the publishing server on a separate computer. Before you perform the following procedure, ensure the database and management server are available. - -## Installing the publishing server on a separate computer - -1. Copy the App-V server installation files to the computer on which you want to install it on. To start the App-V server installation, run **appv\_server\_setup.exe** as an administrator, then select **Install**. -2. On the **Getting started** page, review and accept the license terms, then select **Next**. -3. On the **Use Microsoft Update to help keep your computer secure and up-to-date** page, to enable Microsoft updates, select **Use Microsoft Update when I check for updates (recommended)**. To disable Microsoft Update, select **I don’t want to use Microsoft Update**. Click **Next**. -4. On the **Feature selection** page, select the **Publishing Server** checkbox, then select **Next**. -5. On the **Installation location** page, accept the default location, then select **Next**. -6. On the **Configure publishing server configuration** page, specify the following items: - - * The URL for the management service that the publishing server will connect to. For example, **http://ManagementServerName:12345**. - * Specify the website name that you want to use for the publishing service. If you don't have a custom name, then use the default name. - * For the **Port binding**, specify a unique port number that will be used by App-V. For example, **54321**. -7. On the **Ready to install** page, select **Install**. -8. After the installation is complete, the publishing server must be registered with the management server. In the App-V management console, use the following steps to register the server: - - 1. Open the App-V management server console. - 2. In the left pane, select **Servers**, then select **Register New Server**. - 3. Enter the server name and a description (if required), then select **Add**. -9. To verify that the publishing server is running correctly, you should import a package to the management server, entitle that package to an AD group, then publish it. Using an internet browser, open the following URL: https://publishingserver:pubport. If the server is running correctly, information like the following example should appear. - - ```xml - - - - - - - - - - - - - - - - ``` - - - - - -## Related articles - -* [Deploying App-V](appv-deploying-appv.md) diff --git a/windows/application-management/app-v/appv-install-the-reporting-server-on-a-standalone-computer.md b/windows/application-management/app-v/appv-install-the-reporting-server-on-a-standalone-computer.md deleted file mode 100644 index f5335dd5f0..0000000000 --- a/windows/application-management/app-v/appv-install-the-reporting-server-on-a-standalone-computer.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: How to install the Reporting Server on a standalone computer and connect it to the database (Windows 10/11) -description: How to install the App-V Reporting Server on a Standalone Computer and Connect it to the Database -author: aczechowski -ms.prod: windows-client -ms.date: 04/18/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.technology: itpro-apps ---- - -# How to install the reporting server on a standalone computer and connect it to the database - ->Applies to: Windows Server 2016 - -Use the following procedure to install the reporting server on a standalone computer and connect it to the database. - ->[!IMPORTANT] ->Before performing the following procedure you should read and understand [About App-V reporting](appv-reporting.md). - -## Install the reporting server on a standalone computer and connect it to the database - -1. Copy the App-V server installation files to the computer you plan to install it on. To start the App-V server installation, run **appv\_server\_setup.exe** as an administrator, then select **Install**. -2. On the **Getting started** page, review and accept the license terms, then select **Next**. -3. On the **Use Microsoft Update to help keep your computer secure and up-to-date** page, to enable Microsoft Update, select **Use Microsoft Update when I check for updates (recommended)**. To disable Microsoft Update, select **I don’t want to use Microsoft Update**. Select **Next**. -4. On the **Feature selection** page, select the **Reporting Server** checkbox, then select **Next**. -5. On the **Installation location** page, accept the default location and select **Next**. -6. On the **Configure existing reporting database** page, select **Use a remote SQL Server**, then enter the machine name of the computer running Microsoft SQL Server. For example, you can name your computer **SqlServerMachine**. - - > [!NOTE] - >If the Microsoft SQL Server is deployed on the same server, select **Use local SQL Server**. For the SQL Server instance, select **Use the default instance**. If you're using a custom Microsoft SQL Server instance, select **Use a custom instance**, then enter the name of your custom instance. Specify the **SQL Server Database name** that this reporting server will use; for example, you can name the server **AppvReporting**. -7. On the **Configure reporting server configuration** page. - - * Specify the website name you want to use for the reporting service. Leave the default unchanged if you do not have a custom name. - * For the **Port binding**, specify a unique, five-digit port number for App-V to use, such as **55555**. Make sure that the specified port isn't being used by another website. -8. Select **Install**. - - - - - -## Related articles - -* [About App-V reporting](appv-reporting.md) -* [Deploying App-V](appv-deploying-appv.md) -* [How to enable reporting on the App-V client by using Windows PowerShell](appv-enable-reporting-on-the-appv-client-with-powershell.md) diff --git a/windows/application-management/app-v/appv-install-the-sequencer.md b/windows/application-management/app-v/appv-install-the-sequencer.md deleted file mode 100644 index 2fdd2ec28d..0000000000 --- a/windows/application-management/app-v/appv-install-the-sequencer.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: Install the App-V Sequencer (Windows 10/11) -description: Learn how to install the App-V Sequencer to convert Win32 applications into virtual packages for deployment to user devices. -author: aczechowski -ms.prod: windows-client -ms.date: 04/18/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.technology: itpro-apps ---- - -# Install the App-V Sequencer - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -Use the App-V Sequencer to convert Win32 applications into virtual packages for deployment to user devices. Those devices must be running the App-V client to allow users to interact with virtual applications. - -The App-V Sequencer is included in the Windows client Assessment and Deployment Kit (Windows ADK). - ->[!NOTE] ->The computer that will run the sequencer must not have the App-V client enabled. As a best practice, choose a computer with the same hardware and software configurations as the computers that will run the virtual applications. The sequencing process is resource-intensive, so make sure the computer that will run the Sequencer has plenty of memory, a fast processor, and a fast hard drive. - -## How to install the App-V Sequencer - -1. Go to [Download the Windows ADK](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit). -2. Select the **Get Windows ADK for Windows 10** button on the page to start the ADK installer. Make sure that **Microsoft Application Virtualization (App-V) Sequencer** is selected during the installation. - - ![Selecting APP-V features in ADK.](images/app-v-in-adk.png) -3. To open the Sequencer, go to the **Start** menu and select **Microsoft Application Virtualization (App-V) Sequencer**. - -See [Creating and managing virtual applications](appv-creating-and-managing-virtualized-applications.md) and the [Application Virtualization Sequencing Guide](https://download.microsoft.com/download/F/7/8/F784A197-73BE-48FF-83DA-4102C05A6D44/App-V%205.0%20Sequencing%20Guide.docx) for information about creating virtual applications with the Sequencer. - -## Command-line options for installing the sequencer - -You can also use the command line to install the App-V sequencer. The following list displays information about options for installing the sequencer using the command line and **appv\_sequencer\_setup.exe**: - -| Command | Description | -|-------------------|------------------| -| **/INSTALLDIR** | Specifies the installation directory. | -| **/Log** | Specifies where the installation log will be saved. The default location is **%Temp%**. For example, **C:\\Logs\\log.log**. | -| **/q** | Specifies a quiet or silent installation. | -| **/Uninstall** | Specifies the removal of the sequencer. | -| **/ACCEPTEULA** | Accepts the license agreement. This is required for an unattended installation. For example, **/ACCEPTEULA** or **/ACCEPTEULA=1**. | -| **/LAYOUT** | Specifies the associated layout action. It also extracts the Windows Installer (.msi) and script files to a folder without installing App-V. No value is expected. | -| **/LAYOUTDIR** | Specifies the layout directory. Requires a string value. For example, **/LAYOUTDIR=”C:\\Application Virtualization Client”**. | -| **/?** or **/h** or **/help** | Displays associated help. | - -## To troubleshoot the App-V sequencer installation - -For more information regarding the sequencer installation, you can view the error log in the **%temp%** folder. To review the log files, click **Start**, type **%temp%**, and then look for the **appv\_ log**. - - - - - -## Related articles - -* [Planning to deploy App-V](appv-planning-to-deploy-appv.md) diff --git a/windows/application-management/app-v/appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md b/windows/application-management/app-v/appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md deleted file mode 100644 index 2170f1e25b..0000000000 --- a/windows/application-management/app-v/appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md +++ /dev/null @@ -1,95 +0,0 @@ ---- -title: How to Load the Windows PowerShell Cmdlets for App-V and Get Cmdlet Help (Windows 10/11) -description: How to Load the Windows PowerShell Cmdlets for App-V and Get Cmdlet Help -author: aczechowski -ms.prod: windows-client -ms.date: 09/27/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.technology: itpro-apps ---- - -# How to load the Windows PowerShell cmdlets for App-V and get cmdlet help - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -## Requirements for using Windows PowerShell cmdlets - -This section will tell you what you'll need to use the PowerShell cmdlets. - -### How to let users access PowerShell cmdlets - -You can grant your users access to PowerShell cmdlets through one of the following methods: - -* While you're deploying and configuring the App-V server, specify an Active Directory group or individual user with permissions to manage the App-V environment. For more information, see [How to deploy the App-V Server](appv-deploy-the-appv-server.md). -* After you've deployed the App-V server, you can use the App-V Management console to add an additional Active Directory group or user. For more information, see [How to add or remove an administrator by using the Management console](appv-add-or-remove-an-administrator-with-the-management-console.md). - -### Elevated command prompt - -You'll need an elevated command prompt to run the following cmdlets: - -* **Add-AppvClientPackage** -* **Remove-AppvClientPackage** -* **Set-AppvClientConfiguration** -* **Add-AppvClientConnectionGroup** -* **Remove-AppvClientConnectionGroup** -* **Add-AppvPublishingServer** -* **Remove-AppvPublishingServer** -* **Send-AppvClientReport** -* **Set-AppvClientMode** -* **Set-AppvClientPackage** -* **Set-AppvPublishingServer** - -### Other cmdlets - -The following cmdlets are ones that end-users can run unless you configure them to require an elevated command prompt. - -* **Publish-AppvClientPackage** -* **Unpublish-AppvClientPackage** - -To configure these cmdlets to require an elevated command prompt, use one of the following methods: - -* Run the **Set-AppvClientConfiguration** cmdlet with the *-RequirePublishAsAdmin* parameter. For more information, see the following resources: - * [How to manage connection groups on a stand-alone computer by using Windows PowerShell](appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell.md) - * [Understanding pending packages: UserPending and GlobalPending](appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md#about-pending-packages-userpending-and-globalpending) -* Enable the **Require publish as administrator** Group Policy setting for App-V Clients. For more information, see [How to publish a package by using the Management Console](appv-publish-a-packages-with-the-management-console.md). - -## Loading the Windows PowerShell cmdlets - -To load the Windows PowerShell cmdlet modules: - -1. Open Windows PowerShell or Windows PowerShell Integrated Scripting Environment (ISE). -2. Enter one of the following cmdlets to load a list of usable cmdlets for the module you want: - -|App-v component|Cmdlet to enter| -|---|---| -|App-V Server|**Import-Module AppvServer**| -|App-V Sequencer|**Import-Module AppvSequencer**| -|App-V Client|**Import-Module AppvClient**| - -## Getting help for the Windows PowerShell cmdlets - -Starting in App-V 5.0 SP3, cmdlet help is available in two formats: - -* As a downloadable module in PowerShell. To access the module, open Windows PowerShell or Windows PowerShell Integrated Scripting Environment (ISE) and enter one of the cmdlets from the following table. - -|App-v component|Cmdlet to enter| -|---|---| -|App-V Server|**Update-Help -Module AppvServer**| -|App-V Sequencer|**Update-Help -Module AppvSequencer**| -|App-V Client|**Update-Help -Module AppvClient**| - -* Online in the [Microsoft Desktop Optimization Pack](/powershell/mdop/get-started). - -## Displaying the help for a Windows PowerShell cmdlet - -To display help for a specific Windows PowerShell cmdlet: - -1. Open Windows PowerShell or Windows PowerShell Integrated Scripting Environment (ISE). -2. Enter **Get-Help** followed by the cmdlet you need help with. For example: - ```PowerShell - Get-Help Publish-AppvClientPackage - ``` diff --git a/windows/application-management/app-v/appv-maintaining-appv.md b/windows/application-management/app-v/appv-maintaining-appv.md deleted file mode 100644 index fb3a0ccc4e..0000000000 --- a/windows/application-management/app-v/appv-maintaining-appv.md +++ /dev/null @@ -1,39 +0,0 @@ ---- -title: Maintaining App-V (Windows 10/11) -description: After you have deployed App-V for Windows 10/11, you can use the following information to maintain the App-V infrastructure. -author: aczechowski -ms.prod: windows-client -ms.date: 09/27/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.technology: itpro-apps ---- - -# Maintaining App-V - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -After you have deployed App-V for Windows client, you can use the following information to maintain the App-V infrastructure. - -## Moving the App-V server - -The App-V server connects to the App-V database, which means you can install the management component and connect it to the App-V database on any computer on the network. For more information, see [How to move the App-V server to another computer](appv-move-the-appv-server-to-another-computer.md). - -## Determine if an App-V application is running virtualized - -Independent software vendors (ISV) who want to determine if an application is running virtualized with App-V should open a named object called **AppVVirtual-<PID>** in the default namespace (PID stands for process ID). To find the process ID of the process you're currently using, enter the Windows API **GetCurrentProcessId()**. - -For example, let's say the process ID is 4052. If you can successfully open a named Event object called **AppVVirtual-4052** with the **OpenEvent()** API in the default read access namespace, then the application is virtual. If the **OpenEvent()** call fails, the application isn't virtual. - -Additionally, ISVs who want to explicitly virtualize or not virtualize calls on specific APIs with App-V 5.1 and later can use the **VirtualizeCurrentThread()** and **CurrentThreadIsVirtualized()** functions implemented in the AppEntSubsystems32.dll module to hint to a downstream component whether the call should be virtualized or not. - - - - - -## Other resources for maintaining App-V - -* [Operations for App-V](appv-operations.md) diff --git a/windows/application-management/app-v/appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md b/windows/application-management/app-v/appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md deleted file mode 100644 index e125255c83..0000000000 --- a/windows/application-management/app-v/appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md +++ /dev/null @@ -1,177 +0,0 @@ ---- -title: How to manage App-V packages running on a stand-alone computer by using Windows PowerShell (Windows 10/11) -description: How to manage App-V packages running on a stand-alone computer by using Windows PowerShell. -author: aczechowski -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: windows-client -ms.date: 09/24/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.technology: itpro-apps ---- -# How to manage App-V packages running on a stand-alone computer by using Windows PowerShell - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -The following sections explain how to perform various management tasks on a stand-alone client computer with Windows PowerShell cmdlets. - -## Return a list of packages - -Enter the **Get-AppvClientPackage** cmdlet to return a list of packages entitled to a specific user. Its parameters are *-Name*, *-Version*, *-PackageID*, and *-VersionID*. - -For example: - -```PowerShell -Get-AppvClientPackage –Name "ContosoApplication" -Version 2 -``` - -## Add a package - -Use the **Add-AppvClientPackage** cmdlet to add a package to a computer. - -> [!IMPORTANT] -> This example only adds a package. It does not publish the package to the user or the computer. - -For example: - -```PowerShell -$Contoso = Add-AppvClientPackage \\\\path\\to\\appv\\package.appv -``` - -## Publish a package - -Use the **Publish-AppvClientPackage** cmdlet to publish a package that has been added to either a specific user or globally to any user on the computer. - -Enter the cmdlet with the application name to publish it to the user. - -```PowerShell -Publish-AppvClientPackage "ContosoApplication" -``` - -To publish the application globally, just add the *-Global* parameter. - -```Powershell -Publish-AppvClientPackage "ContosoApplication" -Global -``` - -## Publish a package to a specific user - -> [!NOTE] -> You must use App-V 5.0 SP2 Hotfix Package 5 or later to use this parameter. - -An administrator can publish a package to a specific user by specifying the optional *–UserSID* parameter with the **Publish-AppvClientPackage** cmdlet, where *-UserSID* represents the end user’s security identifier (SID). - -To use this parameter: - -- You can run this cmdlet from the user or administrator session. -- You must be logged in with administrative credentials to use the parameter. -- The end user must be signed in. -- You must provide the end user’s security identifier (SID). - -For example: - -```PowerShell -Publish-AppvClientPackage "ContosoApplication" -UserSID S-1-2-34-56789012-3456789012-345678901-2345 -``` - -## Add and publish a package - -Use the **Add-AppvClientPackage** cmdlet to add a package to a computer and publish it to the user. - -For example: - -```PowerShell -Add-AppvClientPackage | Publish-AppvClientPackage -``` - -## Unpublish an existing package - -Use the **Unpublish-AppvClientPackage** cmdlet to unpublish a package which has been entitled to a user but not remove the package from the computer. - -For example: - -```PowerShell -Unpublish-AppvClientPackage "ContosoApplication" -``` - -## Unpublish a package for a specific user - -> [!NOTE] -> You must use App-V 5.0 SP2 Hotfix Package 5 or later to use this parameter. - -An administrator can unpublish a package for a specific user by using the optional *-UserSID* parameter with the **Unpublish-AppvClientPackage** cmdlet, where *-UserSID* represents the end user’s security identifier (SID). - -To use this parameter: - -- You can run this cmdlet from the user or administrator session. -- You must sign in with administrative credentials to use the parameter. -- The end user must be signed in. -- You must provide the end user’s security identifier (SID). - -For example: - -```PowerShell -Unpublish-AppvClientPackage "ContosoApplication" -UserSID S-1-2-34-56789012-3456789012-345678901-2345 -``` - -## Remove an existing package - -Use the **Remove-AppvClientPackage** cmdlet to remove a package from the computer. - -For example: - -```PowerShell -Remove-AppvClientPackage "ContosoApplication" -``` - -> [!NOTE] -> App-V cmdlets have been assigned to variables for the previous examples for clarity only; assignment is not a requirement. Most cmdlets can be combined as displayed in [Add and publish a package](appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md#add-and-publish-a-package). For a detailed tutorial, see [App-V 5.0 Client PowerShell Deep Dive](/archive/blogs/appv/app-v-5-0-client-powershell-deep-dive). - -## Enable only administrators to publish or unpublish packages - -Starting in App-V 5.0 SP3, you can use the **Set-AppvClientConfiguration** cmdlet and *-RequirePublishAsAdmin* parameter to enable only administrators (not end users) to publish or unpublish packages. - -You can set the *-RequirePublishAsAdmin* parameter to the following values: - -- 0: False -- 1: True - -For example: - -```PowerShell -Set-AppvClientConfiguration –RequirePublishAsAdmin1 -``` - -To use the App-V Management console to set this configuration, see [How to publish a package by using the Management Console](appv-publish-a-packages-with-the-management-console.md). - -## About pending packages: UserPending and GlobalPending - -Starting in App-V 5.0 SP2, if you run a Windows PowerShell cmdlet that affects a package currently in use, the task you're trying to perform is placed in a pending state. For example, if you try to publish a package when an application in that package is being used, and then run **Get-AppvClientPackage**, the pending status appears in the cmdlet output as follows: - -|Cmdlet output item|Description| -|---|---| -|UserPending|Indicates whether the listed package has a pending task that is being applied to the user:
                        - True
                        - False| -|GlobalPending|Indicates whether the listed package has a pending task that is being applied globally to the computer:
                        - True
                        - False| - -The pending task will run later, according to the following rules: - -|Task type|Applicable rule| -|---|---| -|User-based
                        (for example, publishing a package to a user)|The pending task will be performed after the user logs off and then logs back on.| -|Globally based
                        (for example, enabling a connection group globally)|The pending task will be performed when the computer is shut down and then restarted.| - -For more information about pending tasks, see [Upgrading an in-use App-V package](appv-application-publishing-and-client-interaction.md#upgrading-an-in-use-app-v-package). - - - - - -## Related topics - -- [Operations for App-V](appv-operations.md) -- [Administering App-V by using Windows PowerShell](appv-administering-appv-with-powershell.md) diff --git a/windows/application-management/app-v/appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell.md b/windows/application-management/app-v/appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell.md deleted file mode 100644 index c870425b03..0000000000 --- a/windows/application-management/app-v/appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell.md +++ /dev/null @@ -1,96 +0,0 @@ ---- -title: How to Manage Connection Groups on a Stand-alone Computer by Using Windows PowerShell (Windows 10/11) -description: How to Manage Connection Groups on a Stand-alone Computer by Using Windows PowerShell -author: aczechowski -ms.prod: windows-client -ms.date: 04/19/2017 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.technology: itpro-apps ---- - -# How to Manage Connection Groups on a Stand-alone Computer by Using Windows PowerShell - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -An App-V connection group allows you to run all the virtual applications as a defined set of packages in a single virtual environment. For example, you can virtualize an application and its plug-ins by using separate packages, but run them together in a single connection group. - -A connection group XML file defines the connection group for the App-V client. For information about the connection group XML file and how to configure it, see [About the Connection Group File](appv-connection-group-file.md). - -This article explains the following procedures: - -- [To add and publish the App-V packages in the connection group](#to-add-and-publish-the-app-v-packages-in-the-connection-group) - -- [To add and enable the connection group on the App-V client](#to-add-and-enable-the-connection-group-on-the-app-v-client) - -- [To enable or disable a connection group for a specific user](#to-enable-or-disable-a-connection-group-for-a-specific-user) - -- [To allow only administrators to enable connection groups](#to-allow-only-administrators-to-enable-connection-groups) - -## To add and publish the App-V packages in the connection group - -1. To add and publish the App-V packages to the computer running the App-V client, type the following command: - - Add-AppvClientPackage –path c:\\tmpstore\\quartfin.appv | Publish-AppvClientPackage - -2. Repeat **step 1** of this procedure for each package in the connection group. - -## To add and enable the connection group on the App-V client - -1. Add the connection group by typing the following command: - - Add-AppvClientConnectionGroup –path c:\\tmpstore\\financ.xml - -2. Enable the connection group by typing the following command: - - Enable-AppvClientConnectionGroup –name "Financial Applications" - - When any virtual applications that are in the member packages are run on the target computer, they'll run inside the connection group’s virtual environment and will be available to all the virtual applications in the other packages in the connection group. - -## To enable or disable a connection group for a specific user - -1. Review the parameter description and requirements: - - - The parameter enables an administrator to enable or disable a connection group for a specific user. - - - You must use App-V 5.0 SP2 Hotfix Package 5 or later to use this parameter. - - - You can run this cmdlet from the user or administrator session. - - - You must be logged in with administrative credentials to use the parameter. - - - The end user must be logged in. - - - You must provide the end user’s security identifier (SID). - -2. Use the following cmdlets, and add the optional **–UserSID** parameter, where **-UserSID** represents the end user’s security identifier (SID): - - |Cmdlet|Examples| - |--- |--- | - |Enable-AppVClientConnectionGroup|Enable-AppVClientConnectionGroup "ConnectionGroupA" -UserSID S-1-2-34-56789012-3456789012-345678901-2345| - |Disable-AppVClientConnectionGroup|Disable-AppVClientConnectionGroup "ConnectionGroupA" -UserSID S-1-2-34-56789012-3456789012-345678901-2345| - -## To allow only administrators to enable connection groups - -1. Review the description and requirement for using this cmdlet: - - - Use this cmdlet and parameter to configure the App-V client to allow only administrators (not end users) to enable or disable connection groups. - - - You must be using at least App-V 5.0 SP3 to use this cmdlet. - -2. Run the following cmdlet and parameter: - - |Cmdlet|Parameter and values|Example| - |--- |--- |--- | - |Set-AppvClientConfiguration|-RequirePublishAsAdmin
                      • 0 - False
                      • 1 - True|Set-AppvClientConfiguration -RequirePublishAsAdmin
                        1| - -
                        For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). - -## Related articles - - -[Operations for App-V](appv-operations.md) - -[Administering App-V by Using Windows PowerShell](appv-administering-appv-with-powershell.md) diff --git a/windows/application-management/app-v/appv-managing-connection-groups.md b/windows/application-management/app-v/appv-managing-connection-groups.md deleted file mode 100644 index d65f100109..0000000000 --- a/windows/application-management/app-v/appv-managing-connection-groups.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: Managing Connection Groups (Windows 10/11) -description: Connection groups can allow administrators to manage packages independently and avoid having to add the same application multiple times to a client computer. -author: aczechowski -ms.prod: windows-client -ms.date: 04/19/2017 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.technology: itpro-apps ---- - -# Managing Connection Groups - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -Connection groups enable the applications within a package to interact with each other in the virtual environment, while remaining isolated from the rest of the system. By using connection groups, administrators can manage packages independently and can avoid having to add the same application multiple times to a client computer. - -**Note**   -In some previous versions of App-V, connection groups were referred to as Dynamic Suite Composition. - -**In this section:** - -|Links|Description| -|--- |--- | -|[About the Connection Group Virtual Environment](appv-connection-group-virtual-environment.md)|Describes the connection group virtual environment.| -|[About the Connection Group File](appv-connection-group-file.md)|Describes the connection group file.| -|[How to Create a Connection Group](appv-create-a-connection-group.md)|Explains how to create a new connection group.| -|[How to Create a Connection Group with User-Published and Globally Published Packages](appv-create-a-connection-group-with-user-published-and-globally-published-packages.md)|Explains how to create a new connection group that contains a mix of packages that are published to the user and published globally.| -|[How to Delete a Connection Group](appv-delete-a-connection-group.md)|Explains how to delete a connection group.| -|[How to Publish a Connection Group](appv-publish-a-connection-group.md)|Explains how to publish a connection group.| -|[How to Make a Connection Group Ignore the Package Version](appv-configure-connection-groups-to-ignore-the-package-version.md)|Explains how to configure a connection group to accept any version of a package, which simplifies package upgrades and reduces the number of connection groups you need to create.| -[How to Allow Only Administrators to Enable Connection Groups](appv-allow-administrators-to-enable-connection-groups.md)|Explains how to configure the App-V client so that only administrators (not end users) can enable or disable connection groups.| - -
                        For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). - -## Other resources for App-V connection groups - - -- [Operations for App-V](appv-operations.md) - - - - - - - - - diff --git a/windows/application-management/app-v/appv-migrating-to-appv-from-a-previous-version.md b/windows/application-management/app-v/appv-migrating-to-appv-from-a-previous-version.md deleted file mode 100644 index b5ca6b5e48..0000000000 --- a/windows/application-management/app-v/appv-migrating-to-appv-from-a-previous-version.md +++ /dev/null @@ -1,128 +0,0 @@ ---- -title: Migrating to App-V from a Previous Version (Windows 10/11) -description: Learn how to migrate to Microsoft Application Virtualization (App-V) for Windows 10/11 from a previous version. -author: aczechowski -ms.prod: windows-client -ms.date: 04/19/2017 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.technology: itpro-apps ---- - -# Migrating to App-V from previous versions - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -To migrate from App-V 4.x to App-V for Windows 10/11, you must upgrade to App-V 5.x first. - -## Improvements to the App-V Package Converter - - -You can now use the package converter to convert App-V 4.6 packages that contain scripts, and registry information and scripts from source .osd files are now included in package converter output. - -You can also use the `–OSDsToIncludeInPackage` parameter with the `ConvertFrom-AppvLegacyPackage` cmdlet to specify which .osd files’ information is converted and placed within the new package. - -|New in App-V for Windows client|Prior to App-V for Windows 10| -|--- |--- | -|New .xml files are created corresponding to the .osd files associated with a package; these files include the following information:
                      • environment variables
                      • shortcuts
                      • file type associations
                      • registry information
                      • scripts

                        You can now choose to add information from a subset of the .osd files in the source directory to the package using the -OSDsToIncludeInPackage parameter.|Registry information and scripts included in .osd files associated with a package weren't included in package converter output.

                        The package converter would populate the new package with information from all of the .osd files in the source directory.| - -### Example conversion statement - -To understand the new process, review the following example `ConvertFrom-AppvLegacyPackage` package converter statement. - -**If the source directory (\\\\OldPkgStore\\ContosoApp) includes the following:** - -- ContosoApp.sft - -- ContosoApp.msi - -- ContosoApp.sprj - -- ContosoApp\_manifest.xml - -- X.osd - -- Y.osd - -- Z.osd - -**And you run this command:** - -``` syntax -ConvertFrom-AppvLegacyPackage –SourcePath \\OldPkgStore\ContosoApp\ --DestinationPath \\NewPkgStore\ContosoApp\ --OSDsToIncludeInPackage X.osd,Y.osd -``` - -**The following is created in the destination directory (\\\\NewPkgStore\\ContosoApp):** - -- ContosoApp.appv - -- ContosoApp.msi - -- ContosoApp\_DeploymentConfig.xml - -- ContosoApp\_UserConfig.xml - -- X\_Config.xml - -- Y\_Config.xml - -- Z\_Config.xml - -**In the above example:** - -|These Source directory files…|…are converted to these Destination directory files…|…and will contain these items|Description| -|--- |--- |--- |--- | -|
                      • X.osd
                      • Y.osd
                      • Z.osd|
                      • X_Config.xml
                      • Y_Config.xml
                      • Z_Config.xml|
                      • Environment variables:
                      • Shortcuts
                      • File type associations
                      • Registry information
                      • Scripts|Each .osd file is converted to a separate, corresponding .xml file that contains the items listed here in App-V deployment configuration format. These items can then be copied from these .xml files and placed in the deployment configuration or user configuration files as desired.
                        In this example, there are three .xml files, corresponding with the three .osd files in the source directory. Each .xml file contains the environment variables, shortcuts, file type associations, registry information, and scripts in its corresponding .osd file.| -|
                      • X.osd
                      • Y.osd|
                      • ContosoApp.appv
                      • ContosoApp_DeploymentConfig.xml
                      • ContosoApp_UserConfig.xml|
                      • Environment variables
                      • Shortcuts
                      • File type associations|The information from the .osd files specified in the -OSDsToIncludeInPackage parameter is converted and placed inside the package. The converter then populates the deployment configuration file and the user configuration file with the contents of the package, just as App-V Sequencer does when sequencing a new package.
                        In this example, environment variables, shortcuts, and file type associations included in X.osd and Y.osd were converted and placed in the App-V package, and some of this information was also included in the deployment configuration and user configuration files. X.osd and Y.osd were used because they were included as arguments to the -OSDsToIncludeInPackage parameter. No information from Z.osd was included in the package, because it wasn't included as one of these arguments.| - -## Converting packages created using a prior version of App-V - - -Use the package converter utility to upgrade virtual application packages created using versions of App-V prior to App-V 5.0. The package converter uses Windows PowerShell to convert packages and can help automate the process if you have many packages that require conversion. App-V packages created with App-V 5.x don't need to be converted. - - -**Important**   -After you convert an existing package you should test the package prior to deploying the package to ensure the conversion process was successful. - - - -**What to know before you convert existing packages** - -|Issue|Workaround| -|--- |--- | -|Virtual packages using DSC aren't linked after conversion.|Link the packages using connection groups. See [Managing Connection Groups](appv-managing-connection-groups.md).| -|Environment variable conflicts are detected during conversion.|Resolve any conflicts in the associated **.osd** file.| -|Hard-coded paths are detected during conversion.|Hard-coded paths are difficult to convert correctly. The package converter will detect and return packages with files that contain hard-coded paths. View the file with the hard-coded path, and determine whether the package requires the file. If so, it's recommended to re-sequence the package.| - -When converting a package check for failing files or shortcuts, locate the item in App-V 4.6 package. It could possibly be a hard-coded path. Convert the path. - -**Note**   -It's recommended that you use the App-V sequencer for converting critical applications or applications that need to take advantage of features. See [How to Sequence a New Application with App-V](appv-sequence-a-new-application.md). - -If a converted package doesn't open after you convert it, it's also recommended that you resequence the application using the App-V sequencer. - -[How to Convert a Package Created in a Previous Version of App-V](appv-convert-a-package-created-in-a-previous-version-of-appv.md) - -## Migrating the App-V Server Full Infrastructure - - -There's no direct method to upgrade to a full App-V infrastructure. Use the information in the following section for information about upgrading the App-V server. - -|Task|More Information| -|--- |--- | -|Review prerequisites.|[App-V Server prerequisite software](appv-prerequisites.md#app-v-server-prerequisite-software)| -|Enable the App-V client.|[Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md)| -|Install App-V Server.|[How to Deploy the App-V Server](appv-deploy-the-appv-server.md)| -|Migrate existing packages.|See [Converting packages created using a prior version of App-V](#converting-packages-created-using-a-prior-version-of-app-v) earlier in this article.| - -
                        For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). - -## Other resources for performing App-V migration tasks - -- [Operations for App-V](appv-operations.md) - -- [A simplified Microsoft App-V 5.1 Management Server upgrade procedure](/archive/blogs/appv/a-simplified-microsoft-app-v-5-1-management-server-upgrade-procedure) diff --git a/windows/application-management/app-v/appv-modify-an-existing-virtual-application-package.md b/windows/application-management/app-v/appv-modify-an-existing-virtual-application-package.md deleted file mode 100644 index db81d9833c..0000000000 --- a/windows/application-management/app-v/appv-modify-an-existing-virtual-application-package.md +++ /dev/null @@ -1,154 +0,0 @@ ---- -title: How to Modify an Existing Virtual Application Package (Windows 10/11) -description: Learn how to modify an existing virtual application package and add a new application to an existing virtual application package. -author: aczechowski -ms.prod: windows-client -ms.date: 04/19/2017 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.technology: itpro-apps ---- - -# How to Modify an Existing Virtual Application Package - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -This article explains how to: - -- [Update an application in an existing virtual application package](#update-an-application-in-an-existing-virtual-application-package) - -- [Modify the properties associated with an existing virtual application package](#modify-the-properties-associated-with-an-existing-virtual-application-package) - -- [Add a new application to an existing virtual application package](#add-a-new-application-to-an-existing-virtual-application-package) - -**Before you update a package:** - -- Ensure that you’ve installed the Microsoft Application Virtualization (App-V) Sequencer, which is required for modifying a virtual application package. To install the App-V Sequencer, see [How to Install the Sequencer](appv-install-the-sequencer.md). - -- Save the .appv file in a secure location and always trust the source before trying to open the package for editing. - -- The Managing Authority section is erroneously removed from the deployment configuration file when you update a package. Before starting the update, copy the Managing Authority section from the existing deployment configuration file, and then paste the copied section into the new configuration file after the conversion is complete. - -- If you click **Modify an Existing Virtual Application Package** in the Sequencer in order to edit a package, but then make no changes and close the package, the streaming behavior of the package is changed. The primary feature block is removed from the StreamMap.xml file, and any files that were listed in the publishing feature block are removed. Users who receive the edited package experience that package as if it were stream-faulted, regardless of how the original package was configured. - -## Update an application in an existing virtual application package - -1. On the computer that runs the sequencer, click **All Programs**, point to **Microsoft Application Virtualization**, and then click **Microsoft Application Virtualization Sequencer**. - -2. In the App-V Sequencer, click **Modify an Existing Virtual Application Package** > **Next**. - -3. On the **Select Task** page, click **Update Application in Existing Package** > **Next**. - -4. On the **Select Package** page, click **Browse** to locate the virtual application package that contains the application to update, and then click **Next**. - -5. On the **Prepare Computer** page, review the issues that could cause the application update to fail or cause the updated application to contain unnecessary data. Resolve all potential issues before you continue. After making any corrections and resolving all potential issues, click **Refresh** > **Next**. - - **Important**   - If you're required to disable virus scanning software, first scan the computer that runs the sequencer to ensure that no unwanted or malicious files are added to the package. - -6. On the **Select Installer** page, click **Browse** and specify the update installation file for the application. If the update doesn't have an associated installer file, and if you plan to run all installation steps manually, select the **Select this option to perform a custom installation** check box, and then click **Next**. - -7. On the **Installation** page, when the sequencer and application installer are ready you can proceed to install the application update so the sequencer can monitor the installation process. If additional installation files must be run as part of the installation, click **Run**, and then locate and run the additional installation files. When you're finished with the installation, select **I am finished installing**. Click **Next**. - - >**Note**  The sequencer monitors all changes and installations that occur on the computer that runs the sequencer. This includes any changes and installations that are performed outside of the sequencing wizard. - -8. On the **Installation Report** page, you can review information about the updated virtual application. In **Additional Information**, double-click the event to obtain more detailed information. To proceed, click **Next**. - -9. On the **Streaming** page, run each program so that it can be optimized and run more efficiently on target computers. It can take several minutes for all of the applications to run. After all applications have run, close each of the applications, and then click **Next**. - - >**Note**  You can stop an application from loading during this step. In the **Application Launch** dialog box, click **Stop**, and then select either **Stop all applications** or **Stop this application only**. - -10. On the **Create Package** page, to modify the package without saving it, select the check box for **Continue to modify package without saving using the package editor**. When you select this option, the package opens in the App-V Sequencer console, where you can modify the package before it's saved. Click **Next**. - - To save the package immediately, select the default **Save the package now**. Add optional **Comments** to associate with the package. Comments are useful to identify the application version and provide other information about the package. The default **Save Location** is also displayed. To change the default location, click **Browse** and specify the new location. Click **Create**. - -11. On the **Completion** page, click **Close** to close the wizard. The package is now available in the sequencer. - - -## Modify the properties associated with an existing virtual application package - -1. On the computer that runs the sequencer, click **All Programs**, point to **Microsoft Application Virtualization**, and then click **Microsoft Application Virtualization Sequencer**. - -2. In the App-V Sequencer, click **Modify an Existing Virtual Application Package** > **Next**. - -3. On the **Select Task** page, click **Edit Package** > **Next**. - -4. On the **Select Package** page, click **Browse** to locate the virtual application package that contains the application properties to modify, and then click **Edit**. - -5. In the App-V Sequencer console, perform any of the following tasks as needed: - - - Import and export the manifest file. - - - Enable or disable Browser Helper Objects. - - - Import or export a VFS file. - - - Import a directory into the virtual file system. - - - Import and export virtual registry keys. - - - View package properties. - - - View associated package files. - - - Edit registry settings. - - - Review the extra package settings (except operating system file properties). - - - Set virtualized registry key state (override or merge). - - - Set virtualized folder state. - - - Add or edit shortcuts and file type associations. - - >**Note**  To edit shortcuts or file type associations, you must first open the package for upgrade to add a new application, and then proceed to the final editing page. - -6. When you finish changing the package properties, click **File** > **Save** to save the package. - -## Add a new application to an existing virtual application package - -1. On the computer that runs the sequencer, click **All Programs**, point to **Microsoft Application Virtualization**, and then click **Microsoft Application Virtualization Sequencer**. - -2. In the App-V Sequencer, click **Modify an Existing Virtual Application Package** > **Next**. - -3. On the **Select Task** page, click **Add New Application** > **Next**. - -4. On the **Select Package** page, click **Browse** to locate the virtual application package to which you'll add the application, and then click **Next**. - -5. On the **Prepare Computer** page, review the issues that could cause the package creation to fail or cause the revised package to contain unnecessary data. Resolve all potential issues before you continue. After making any corrections and resolving all potential issues, click **Refresh** > **Next**. - - >**Important**  If you're required to disable virus scanning software, first scan the computer that runs the sequencer to ensure that no unwanted or malicious files can be added to the package. - -6. On the **Select Installer** page, click **Browse** and specify the installation file for the application. If the application doesn't have an associated installer file and you plan to run all installation steps manually, select the **Select this option to perform a custom installation** check box, and then click **Next**. - -7. On the **Installation** page, when the sequencer and application installer are ready, install the application so that the sequencer can monitor the installation process. If more installation files must be run as part of the installation, click **Run**, and locate and run those installation files. When you finish the installation, select **I am finished installing** > **Next**. In the **Browse for Folder** dialog box, specify the primary directory where the application will be installed. Ensure that this directory is a new location so that you don’t overwrite the existing version of the virtual application package. - - >**Note**  The sequencer monitors all changes and installations that occur on the computer that runs the sequencer. This includes any changes and installations that are performed outside of the sequencing wizard. - -8. On the **Configure Software** page, optionally run the programs contained in the package. This step completes any associated license or configuration tasks that are required to run the application before you deploy and run the package on target computers. To run all the programs at the same time, select at least one program, and then click **Run All**. To run specific programs, select the program or programs you want to run, and then click **Run Selected**. Complete the required configuration tasks and then close the applications. It can take several minutes for all programs to run. Click **Next**. - -9. On the **Installation Report** page, you can review information about the updated virtual application. In **Additional Information**, double-click the event to obtain more detailed information, and then click **Next** to open the **Customize** page. - -10. If you're finished installing and configuring the virtual application, select **Stop now** and skip to step 13 of this procedure. If you want to perform the following described customization, click **Customize**. - - If you're customizing, prepare the virtual package for streaming, and then click **Next**. Streaming improves the experience when the virtual application package is run on target computers. - -11. On the **Streaming** page, run each program so that it can be optimized and run more efficiently on target computers. It can take several minutes for all the applications to run. After all applications have run, close each of the applications, and then click **Next**. - - >**Note**  You can stop an application from loading during this step. In the **Application Launch** dialog box, click **Stop** and then select either **Stop all applications** or **Stop this application only**. - -12. On the **Create Package** page, to modify the package without saving it, select the **Continue to modify package without saving using the package editor** check box. Selecting this option opens the package in the App-V Sequencer console, where you can modify the package before saving it. Click **Next**. - - To save the package immediately, select the default **Save the package now**. Add optional **Comments** to associate with the package. Comments are useful for providing application versions and other information about the package. The default **Save Location** is also displayed. To change the default location, click **Browse** and specify the new location. The uncompressed package size is displayed. Click **Create**. - -13. On the **Completion** page, click **Close**. The package is now available in the sequencer. - - - -
                        For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). - -## Related articles - -[Operations for App-V](appv-operations.md) diff --git a/windows/application-management/app-v/appv-modify-client-configuration-with-powershell.md b/windows/application-management/app-v/appv-modify-client-configuration-with-powershell.md deleted file mode 100644 index 6e0950dbf8..0000000000 --- a/windows/application-management/app-v/appv-modify-client-configuration-with-powershell.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -title: How to Modify Client Configuration by Using Windows PowerShell (Windows 10/11) -description: Learn how to modify the Application Virtualization (App-V) client configuration by using Windows PowerShell. -author: aczechowski -ms.prod: windows-client -ms.date: 04/19/2017 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.technology: itpro-apps ---- - -# How to Modify Client Configuration by Using Windows PowerShell - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -Use the following procedure to configure the App-V client configuration. - -1. To configure the client settings using Windows PowerShell, use the **Set-AppVClientConfiguration** cmdlet. For more information about installing Windows PowerShell, and a list of cmdlets see, [How to Load the Windows PowerShell Cmdlets for App-V and Get Cmdlet Help](appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md). - -2. To modify the client configuration, open a Windows PowerShell Command prompt and run **Set-AppVClientConfiguration** with any required parameters. For example: - - `$config = Get-AppVClientConfiguration` - - `Set-AppVClientConfiguration $config` - - `Set-AppVClientConfiguration –Name1 MyConfig –Name2 "xyz"` - - - - -
                        For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). - -## Related articles - -[Operations for App-V](appv-operations.md) diff --git a/windows/application-management/app-v/appv-move-the-appv-server-to-another-computer.md b/windows/application-management/app-v/appv-move-the-appv-server-to-another-computer.md deleted file mode 100644 index 4b844f29a5..0000000000 --- a/windows/application-management/app-v/appv-move-the-appv-server-to-another-computer.md +++ /dev/null @@ -1,36 +0,0 @@ ---- -title: How to Move the App-V Server to Another Computer (Windows 10/11) -description: Learn how to create a new management server console in your environment and learn how to connect it to the App-V database. -author: aczechowski -ms.prod: windows-client -ms.date: 04/19/2017 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.technology: itpro-apps ---- - -# How to move the App-V server to another computer - -**Applies to** -- Windows Server 2016 - -Use the following information to create a new management server console in your environment. - -## To create a new management server console - - -Follow these steps to create a new management server console: - -1. Install the management server on a computer in your environment. For more information about installing the management server, see [Deploying the App-V server](appv-deploying-the-appv-server.md). - -2. After you've completed the installation, use the following link to connect it to the App-V database - [How to install the Management Server on a Standalone Computer and Connect it to the Database](appv-install-the-management-server-on-a-standalone-computer.md). - - - -
                        For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). - -## Related articles - -[Operations for App-V](appv-operations.md) diff --git a/windows/application-management/app-v/appv-operations.md b/windows/application-management/app-v/appv-operations.md deleted file mode 100644 index 7b2ef74380..0000000000 --- a/windows/application-management/app-v/appv-operations.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: Operations for App-V (Windows 10/11) -description: Learn about the various types of App-V administration and operating tasks that are typically performed by an administrator. -author: aczechowski -ms.prod: windows-client -ms.date: 04/18/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.technology: itpro-apps ---- - -# Operations for App-V - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -This section of the Microsoft Application Virtualization (App-V) Administrator’s Guide includes information about the various types of App-V administration and operating tasks that are typically performed by an administrator. This section also includes step-by-step procedures to help you successfully perform those tasks. - -## Operations Information - -- [Creating and Managing App-V Virtualized Applications](appv-creating-and-managing-virtualized-applications.md) - - Describes how to create, modify, and convert virtualized packages. -- [Administering App-V Virtual Applications by Using the Management Console](appv-administering-virtual-applications-with-the-management-console.md) - - Describes how to use the App-V Management console to perform tasks such as sequencing an application, changing a package, using a project template, and using a package accelerator. -- [Managing Connection Groups](appv-managing-connection-groups.md) - - Describes how connection groups enable virtualized applications to communicate with each other in the virtual environment; explains how to create, publish, and delete them; and describes how connection groups can help you better manage your virtualized applications. -- [Deploying App-V Packages by Using Electronic Software Distribution (ESD)](appv-deploying-packages-with-electronic-software-distribution-solutions.md) - - Describes how to deploy App-V packages by using an ESD. -- [Using the App-V Client Management Console](appv-using-the-client-management-console.md) - - Describes how to perform client configuration tasks using the client management console. -- [Migrating to App-V from a Previous Version](appv-migrating-to-appv-from-a-previous-version.md) - - Provides instructions for migrating to App-V from a previous version. -- [Administering App-V by Using Windows PowerShell](appv-administering-appv-with-powershell.md) - - Describes the set of Windows PowerShell cmdlets available for administrators performing various App-V server tasks. - -## Additional information - -- [Application Virtualization (App-V) overview](appv-for-windows.md) -- [Getting Started with App-V](appv-getting-started.md) -- [Planning for App-V](appv-planning-for-appv.md) -- [Deploying App-V](appv-deploying-appv.md) -- [Troubleshooting App-V](appv-troubleshooting.md) -- [Technical Reference for App-V](appv-technical-reference.md) - - - diff --git a/windows/application-management/app-v/appv-performance-guidance.md b/windows/application-management/app-v/appv-performance-guidance.md deleted file mode 100644 index cb7e615a02..0000000000 --- a/windows/application-management/app-v/appv-performance-guidance.md +++ /dev/null @@ -1,495 +0,0 @@ ---- -title: Performance Guidance for Application Virtualization -description: Learn how to configure App-V for optimal performance, optimize virtual app packages, and provide a better user experience with RDS and VDI. -author: aczechowski -ms.prod: windows-client -ms.date: 04/19/2017 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.technology: itpro-apps ---- - -# Performance Guidance for Application Virtualization - -**Applies to**: - -- Windows 7 SP1 -- Windows 10 -- Windows 11 -- Server 2012 R2 -- Server 2016 - -Learn how to configure App-V for optimal performance, optimize virtual app packages, and provide a better user experience with RDS and VDI. - -Implementing multiple methods can help you improve the end-user experience. However, your environment may not support all methods. - -You should read and understand the following information before reading this document. - -- [Application Virtualization (App-V) overview](appv-for-windows.md) - -- [Application Publishing and Client Interaction](appv-application-publishing-and-client-interaction.md) - -- [App-V Sequencing Guide](https://www.microsoft.com/download/details.aspx?id=27760) - -> [!Note] -> Some terms used in this document may have different meanings depending on external source and context. For more information about terms used in this document followed by an asterisk `*`, review the [Application Virtualization Performance Guidance Terminology](#bkmk-terms1) section of this document. - -Finally, this document will provide you with the information to configure the computer running App-V client and the environment for optimal performance. Optimize your virtual application packages for performance using the sequencer, and to understand how to use User Experience Virtualization (UE-V) or other user environment management technologies to provide the optimal user experience with App-V in both Remote Desktop Services (RDS) and non-persistent virtual desktop infrastructure (VDI). - -To help determine what information is relevant to your environment, you should review each section's brief overview and applicability checklist. - -## App-V in stateful\* non-persistent deployments - -This section provides information about an approach that helps ensure a user will have access to all virtual applications within seconds after logging in. This access is achieved by uniquely addressing the often long-running App-V publishing refresh. As you'll discover the basis of the approach, the fastest publishing refresh, is one that doesn't have to actually do anything. Many conditions must be met and steps followed to provide the optimal user experience. - -Use the information in the following section for more information: - -[Usage Scenarios](#bkmk-us) - As you review the two scenarios, keep in mind that these scenarios are the approach extremes. Based on your usage requirements, you may choose to apply these steps to a subset of users and/or virtual applications packages. - -- Optimized for Performance – To provide the optimal experience, you can expect the base image to include some of the App-V virtual application package. This and other requirements are discussed. - -- Optimized for Storage – If you're concerned with the storage impact, following this scenario will help address those concerns. - -[Preparing your Environment](#bkmk-pe) - -- Steps to Prepare the Base Image – Whether in a non-persistent VDI or RDSH environment, only a few steps must be completed in the base image to enable this approach. - -- Use UE-V as the User Profile Management (UPM) solution for the App-V approach – the cornerstone of this approach is the ability of a UEM solution to persist the contents of just a few registry and file locations. These locations constitute the user integrations\*. Be sure to review the specific requirements for the UPM solution. - -[User Experience Walk-through](#bkmk-uewt) - -- Walk-through – It's a step-by-step walk-through of the App-V and UE-V operations and the expectations users should have. - -- Outcome – It describes the expected results. - -[Impact to Package Lifecycle](#bkmk-plc) - -[Enhancing the VDI Experience through Performance Optimization/Tuning](#bkmk-evdi) - -### Applicability Checklist - -|Checklist|Deployment Environment| -|--- |--- | -|![Checklist box](images/checklistbox.gif)|Non-Persistent VDI or RDSH.| -|![Checklist box](images/checklistbox.gif)|User Experience Virtualization (UE-V), other UPM solutions or User Profile Disks (UPD).| - -|Checklist|Expected Configuration| -|--- |--- | -|![Checklist box](images/checklistbox.gif)|User Experience Virtualization (UE-V) with the App-V user state template enabled or User Profile Management (UPM) software. Non-UE-V UPM software must be capable of triggering on Login or Process/Application Start and Logoff.| -|![Checklist box](images/checklistbox.gif)|App-V Shared Content Store (SCS) is configured or can be configured.| - - -|Checklist|IT Administration| -|--- |--- | -|![Checklist box](images/checklistbox.gif)|Admin may need to update the VM base image regularly to ensure optimal performance or Admin may need to manage multiple images for different user groups.| - -### Usage Scenarios - -As you review the two scenarios, keep in mind that these scenarios represent the extremes. Based on your usage requirements, you may choose to apply these steps to a subset of users, virtual application packages, or both. - -- **Performance**: To provide the most optimal user experience, this approach uses the capabilities of a UPM solution and requires extra image preparation and can incur some more image management overhead. - - The following section describes many performance improvements in stateful non-persistent deployments. For more information, see [Sequencing Steps to Optimize Packages for Publishing Performance](#sequencing-steps-to-optimize-packages-for-publishing-performance) (in this article). - -- **Storage**: The general expectations of the previous scenario still apply here. However, keep in mind that VM images are typically stored in costly arrays; a slight alteration has been made to the approach. Don't pre-configure user-targeted virtual application packages in the base image. - - The impact of this alteration is detailed in the [User Experience Walk-through](#bkmk-uewt) (in this article). - -### Preparing your Environment - -The following information displays the required steps to prepare the base image and the UE-V or another UPM solution for the approach. - -#### Prepare the Base Image - -- **Performance**: - - - Enable the App-V client as described in [Enable the App-V in-box client](appv-enable-the-app-v-desktop-client.md). - - Enable UE-V and download the App-V Settings Template from the UE-V template Gallery, see the following steps. - - Configure for Shared Content Store (SCS) mode. For more information, see [Deploying the App-V Sequencer and Configuring the Client](appv-deploying-the-appv-sequencer-and-client.md). - - Configure Preserve User Integrations on Login Registry DWORD. - - Pre-configure all user and global-targeted packages, for example, **Add-AppvClientPackage**. - - Pre-configure all user- and global-targeted connection groups, for example, **Add-AppvClientConnectionGroup**. - - Pre-publish all global-targeted packages. Or: - - Perform a global publishing/refresh. - - Perform a user publishing/refresh. - - Unpublish all user-targeted packages. - - Delete the following user-Virtual File System (VFS) entries: - - - `AppData\Local\Microsoft\AppV\Client\VFS` - - `AppData\Roaming\Microsoft\AppV\Client\VFS` - -- **Storage**: - - - Enable the App-V client as described in [Enable the App-V in-box client](appv-enable-the-app-v-desktop-client.md). - - Enable UE-V and download the App-V Settings Template from the UE-V template Gallery, see the following steps. - - Configure for Shared Content Store (SCS) mode. For more information, see [Deploying the App-V Sequencer and Configuring the Client](appv-deploying-the-appv-sequencer-and-client.md). - - Configure Preserve User Integrations on Login Registry DWORD. - - Pre-configure all global-targeted packages, for example, **Add-AppvClientPackage**. - - Pre-configure all global-targeted connection groups, for example, **Add-AppvClientConnectionGroup**. - - Pre-publish all global-targeted packages. - -#### Configurations - -For critical App-V Client configurations and for a little more context and how-to, review the following configuration settings: - -- **Shared Content Store (SCS) Mode**: When running the shared content store, only publishing data is maintained on hard disk; other virtual application assets are maintained in memory (RAM). Such a result helps to conserve local storage and minimize disk I/O per second (IOPS). - - This setting is recommended when low-latency connections are available between the App-V Client endpoint and the SCS content server, SAN. - - - Configurable in Windows PowerShell: `Set-AppvClientConfiguration -SharedContentStoreMode 1` - - Configurable with Group Policy: See [Deploying the App-V Sequencer and Configuring the Client](appv-deploying-the-appv-sequencer-and-client.md). - -- **PreserveUserIntegrationsOnLogin**: If you have not pre-configured (**Add-AppvClientPackage**) a specific package and this setting isn't configured, the App-V Client will de-integrate* the persisted user integrations, then reintegrate*. - - For every package that meets the above conditions, effectively twice the work will be done during publishing/refresh. - - If you don't plan to pre-configure every available user package in the base image, use this setting. - - - Configure in the Registry under `HKEY_LOCAL_MACHINE\Software\Microsoft\AppV\Client\Integration`. - - Create the DWORD value **PreserveUserIntegrationsOnLogin** with a value of 1. - - Restart the App-V client service or restart the computer running the App-V Client. - -- **MaxConcurrentPublishingRefresh**: This setting determines the number of users that can perform a publishing refresh/sync at the same time. The default setting is no limit. - - Limiting the number of concurrent publishing refreshes prevents excessive CPU usage that could impact computer performance. This limit is recommended in an RDS environment, where multiple users can log in to the same computer at the same time and perform a publishing refresh sync. - - If the concurrent publishing refresh threshold is reached, the time required to publish new applications and make them available to end users after they sign in could take an indeterminate amount of time. - - - Configure in the Registry under `HKEY_LOCAL_MACHINE\Software\Microsoft\AppV\Client\Publishing`. - - Create the DWORD value **MaxConcurrentPublishingrefresh** with the desired maximum number of concurrent publishing refreshes. - - The App-V client service and computer don't need to be restarted. - -### Configure UE-V solution for App-V Approach - -We recommend using User Experience Virtualization (UE-V) to capture and centralize application settings and Windows operating system settings for a specific user. These settings are then applied to the different computers that are accessed by the user, including desktop computers, laptop computers, and virtual desktop infrastructure (VDI) sessions. UE-V is optimized for RDS and VDI scenarios. - -For more information, see: - -- [User Experience Virtualization (UE-V) for Windows client overview](/windows/configuration/ue-v/uev-for-windows) - -- [Get Started with UE-V](/windows/configuration/ue-v/uev-getting-started) - -> [!Note] -> Without performing an additional configuration step, User Environment Virtualization (UE-V) won't be able to synchronize the Start menu shortcuts (.lnk files) on the target computer. The .lnk file type is excluded by default. - -UE-V will only support removing the .lnk file type from the exclusion list in the RDS and VDI scenarios, where every user's device will have the same set of applications installed to the same location and every .lnk file is valid for all the users' devices. For example, UE-V wouldn't currently support the following two scenarios, because the net result will be that the shortcut will be valid on one but not all devices. - -- If a user has an application installed on one device with .lnk files enabled and the same native application installed on another device to a different installation root with .lnk files enabled. - -- If a user has an application installed on one device but not another with .lnk files enabled. - -> [!Important] -> This topic describes how to change the Windows registry by using Registry Editor. If you change the Windows registry incorrectly, you can cause serious problems that might require you to reinstall Windows. You should make a backup copy of the registry files (System.dat and User.dat) before you change the registry. Microsoft cannot guarantee that the problems that might occur when you change the registry can be resolved. Change the registry at your own risk. - -Using the Microsoft Registry Editor (regedit.exe), navigate to `HKEY\_LOCAL\_MACHINE\Software\Microsoft\UEV\Agent\Configuration\ExcludedFileTypes` and remove `.lnk` from the excluded file types. - -## Configure other User Profile Management (UPM) solutions for App-V Approach - -The expectation in a stateful environment is that a UPM solution is implemented and can support persistence of user data across sessions and between logins. - -The requirements for the UPM solution are as follows. - -To enable an optimized sign-in experience, for example the App-V approach for the user, the solution must be capable of: - -- Persisting the below user integrations as part of the user profile/persona. - -- Triggering a user profile sync on sign in (or application start), which can guarantee that all user integrations are applied before publishing/refresh begin, or, - -- Attaching and detaching a user profile disk (UPD) or similar technology that contains the user integrations. - - > [!Note] - > - > App-V is supported when using UPD only when the entire profile is stored on the user profile disk. - > - > App-V packages are not supported when using UPD with selected folders stored in the user profile disk. The Copy on Write driver doesn't handle UPD selected folders. - -- Capturing changes to the locations, which constitute the user integrations, prior to session sign out. - -With App-V when you add a publishing server (**Add-AppvPublishingServer**) you can configure synchronization, for example refresh during a sign in and/or after a specified refresh interval. In both cases, a scheduled task is created. - -In previous versions of App-V, both scheduled tasks were configured using a VBScript that would initiate the user and global refresh. Starting with Hotfix Package 4 for Application Virtualization 5.0 SP2, the user refresh on a sign in was initiated by **SyncAppvPublishingServer.exe**. This change was introduced to provide UPM solutions a trigger process. This process delays the publish /refresh to allow the UPM solution to apply the user integrations. It will exit once the publishing/refresh is complete. - -### User Integrations - -Registry – HKEY\_CURRENT\_USER - -- Path - Software\\Classes - - Exclude: Local Settings, ActivatableClasses, AppX\* - -- Path - Software\\Microsoft\\AppV - -- Path- Software\\Microsoft\\Windows\\CurrentVersion\\App Paths - -### File Locations - -- Root – “Environment Variable” APPDATA - - Path – Microsoft\\AppV\\Client\\Catalog - -- Root – “Environment Variable” APPDATA - - Path – Microsoft\\AppV\\Client\\Integration - -- Root – “Environment Variable” APPDATA - - Path - Microsoft\\Windows\\Start Menu\\Programs - -- (To persist all desktop shortcuts, virtual and non-virtual) - - Root - “KnownFolder” {B4BFCC3A-DB2C-424C-B029-7FE99A87C641}FileMask - \*.lnk - -### User Experience Walk-through - -This following process is a step-by-step walk-through of the App-V and UPM operations, and the users' expectations. - -- **Performance**: After implementing this approach in the VDI/RDSH environment, on first login, - - (Operation) A user-publishing/refresh is initiated. - - (Expectation) If it's the first time that a user has published virtual applications (for example, non-persistent), this operation will take the usual duration of a publishing/refresh. - -- (Operation) After the publishing/refresh, the UPM solution captures the user integrations. - - (Expectation) Depending on how the UPM solution is configured, this capture may occur as part of the sign-out process. This result will incur the same/similar overhead as persisting the user state. - - **On subsequent logins**: - - - (Operation) UPM solution applies the user integrations to the system prior to publishing/refresh. - - (Expectation) There will be shortcuts present on the desktop, or in the start menu, which work immediately. When the publishing/refresh completes (that is, package entitlements change), some may go away. - - - (Operation) Publishing/refresh will process unpublish and publish operations for changes in user package entitlements. - - (Expectation) If there are no entitlement changes, publishing will complete in seconds. Otherwise, the publishing/refresh will increase relative to the number and complexity of virtual applications - - The publishing operation (**Publish-AppVClientPackage**) adds entries to the user catalog, maps entitlement to the user, identifies the local store, and finishes by completing any integration steps. - - - (Operation) UPM solution will capture user integrations again at sign off. - - (Expectation) Same as previous. - - **Outcome**: - - - Because the user integrations are entirely preserved, there will be no work for example, integration for the publishing/refresh to complete. All virtual applications will be available within seconds of sign in. - - The publishing/refresh will process changes to the users-entitled virtual applications, which impacts the experience. - -- **Storage**: After implementing this approach in the VDI/RDSH environment, on first login - - - (Operation) A user-publishing/refresh is initiated. - - (Expectation): - - - If this instance is the first time a user has published virtual applications (for example, non-persistent), this will take the usual duration of a publishing/refresh. - - First and subsequent logins will be impacted by pre-configuring of packages (add/refresh). - - - (Operation) After the publishing/refresh, the UPM solution captures the user integrations. - - (Expectation) Depending on how the UPM solution is configured, this capture may occur as part of the sign-off process. This result will incur the same/similar overhead as persisting the user state. - - **On subsequent logins**: - - - (Operation) UPM solution applies the user integrations to the system prior to publishing/refresh. - - (Operation) Add/refresh must pre-configure all user targeted applications. - - - (Expectation): - - This may increase the time to application availability significantly (on the order of 10s of seconds). - - This will increase the publishing refresh time relative to the number and complexity* of virtual applications. - - - (Operation) Publishing/refresh will process unpublish and publish operations for changes to user package entitlements. - - **Outcome**: Because the add/refresh must reconfigure all the virtual applications to the VM, the publishing refresh time on every login will be extended. - -### Impact to Package Life Cycle - -Upgrading a package is a crucial aspect of the package lifecycle. To help guarantee users have access to the appropriate upgraded (published) or downgraded (unpublished) virtual application packages, it's recommended you update the base image to reflect these changes. To understand why review the following section: - -App-V 5.0 SP2 introduced the concept of pending states. In the past, - -- If an administrator changed entitlements or created a new version of a package (upgraded) and during a publishing/refresh that package was in-use, the unpublish or publish operation, respectively, would fail. - -- Now, if a package is in use, the operation will be pended. The unpublish and publish-pend operations will be processed on service restart or if another publish or unpublish command is issued. In the latter case, if the virtual application is in-use otherwise, the virtual application will remain in a pending state. For globally published packages, a restart (or service restart) often needed. - -In a non-persistent environment, it's unlikely these pended operations will be processed. The pended operations, for example tasks are captured under **HKEY\_CURRENT\_USER** \\ **Software** \\ **Microsoft** \\ **AppV** \\ **Client** \\ **PendingTasks**. Although this location is persisted by the UPM solution, if it isn't applied to the environment prior to a sign in, it will not be processed. - -### Enhancing the VDI Experience through Performance Optimization Tuning - -The following section contains lists with information about Microsoft documentation and downloads that may be useful when optimizing your environment for performance. - -#### Windows Server - -Server performance tuning guidelines for [Microsoft Windows Server 2012 R2](/previous-versions/dn529133(v=vs.85)) - -#### Server roles - -- [Remote Desktop Virtualization Host](/previous-versions/dn567643(v=vs.85)) - -- [Remote Desktop Session Host](/previous-versions/dn567648(v=vs.85)) - -- [IIS Relevance: App-V Management, Publishing, Reporting Web Services](/previous-versions/dn567678(v=vs.85)) - -- [File Server (SMB) Relevance: If used for App-V Content Storage and Delivery in SCS Mode](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/jj134210(v=ws.11)) - -#### Windows Client (guest OS) performance tuning guidance - -- [The Microsoft Premier Field Engineer (PFE) view on Virtual Desktop (VDI) Density](/archive/blogs/jeff_stokes/the-microsoft-premier-field-engineer-pfe-view-on-virtual-desktop-vdi-density) - -- [Optimization Script: (Provided by Microsoft Support)](/archive/blogs/jeff_stokes/hot-off-the-presses-get-it-now-the-windows-8-vdi-optimization-script-courtesy-of-pfe) - -## Sequencing Steps to Optimize Packages for Publishing Performance - -Several App-V features facilitate new scenarios or enable new customer deployment scenarios. These following features can impact the performance of the publishing and launch operations. - -|Step|Consideration|Benefits|Tradeoffs| -|--- |--- |--- |--- | -|No Feature Block 1 (FB1, also known as Primary FB)|No FB1 means the application will launch immediately and stream fault (application requires file, DLL and must pull down over the network) during launch. If there are network limitations, FB1 will:
                      • Reduce the number of stream faults and network bandwidth used when you launch an application for the first time.
                      • Delay launch until the entire FB1 has been streamed.|Stream faulting decreases the launch time.|Virtual application packages with FB1 configured will need to be resequenced.| - -### Removing FB1 - -Removing FB1 doesn't require the original application installer. After completing the following steps, it's suggested that you revert the computer running the sequencer to a clean snapshot. - -**Sequencer UI** - Create a New Virtual Application Package. - -1. Complete the sequencing steps up to Customize -> Streaming. - -2. At the Streaming step, don't select **Optimize the package for deployment over slow or unreliable network**. - -3. If desired, move on to **Target OS**. - -**Modify an Existing Virtual Application Package** - -1. Complete the sequencing steps up to Streaming. - -2. Don't select **Optimize the package for deployment over a slow or unreliable network**. - -3. Move to **Create Package**. - -**Windows PowerShell** - Update an Existing Virtual Application Package. - -1. Open an elevated Windows PowerShell session. - -2. Import-module **appvsequencer**. - -3. **Update-AppvSequencerPackage** - **AppvPackageFilePath** - - "C:\\Packages\\MyPackage.appv" -Installer - - "C:\\PackageInstall\\PackageUpgrade.exe empty.exe" -OutputPath - - "C:\\UpgradedPackages" - - > [!Note] - > This cmdlet requires an executable (.exe) or batch file (.bat). You must provide an empty (does nothing) executable or batch file. - -|Step|Considerations|Benefits|Tradeoffs| -|--- |--- |--- |--- | -|No SXS Install at Publish (Pre-Install SxS assemblies)|Virtual Application packages don't need to be resequenced. SxS Assemblies can remain in the virtual application package.|The SxS Assembly dependencies won't install at publishing time.|SxS Assembly dependencies must be pre-installed.| - - -### Creating a new virtual application package on the sequencer - -If, during sequencer monitoring, an SxS Assembly (such as a VC++ Runtime) is installed as part of an application's installation, SxS Assembly will be automatically detected and included in the package. The administrator will be notified and will have the option to exclude the SxS Assembly. - -**Client Side**: - -When publishing a virtual application package, the App-V Client will detect if a required SxS dependency is already installed. If the dependency is unavailable on the computer and it's included in the package, a traditional Windows Installer (.**msi**) installation of the SxS assembly will be initiated. As previously documented, simply install the dependency on the computer running the client to ensure that the Windows Installer (.msi) installation won't occur. - -|Step|Considerations|Benefits|Tradeoffs| -|--- |--- |--- |--- | -|Selectively Employ Dynamic Configuration files|The App-V client must parse and process these Dynamic Configuration files.

                        Be conscious of size and complexity (script execution, VREG inclusions/exclusions) of the file.

                        Numerous virtual application packages may already have User- or computer–specific dynamic configurations files.|Publishing times will improve if these files are used selectively or not at all.|Virtual application packages would need to be reconfigured individually or via the App-V server management console to remove associated Dynamic Configuration files.| - - -### Disabling a Dynamic Configuration by using Windows PowerShell - -- For already published packages, you can use `Set-AppVClientPackage –Name Myapp –Path c:\Packages\Apps\MyApp.appv` without - - **-DynamicDeploymentConfiguration** parameter - -- Similarly, when adding new packages using `Add-AppVClientPackage –Path c:\Packages\Apps\MyApp.appv`, don't use the - - **-DynamicDeploymentConfiguration** parameter. - -For documentation on How to Apply a Dynamic Configuration, see: - -- [How to Apply the User Configuration File by Using Windows PowerShell](appv-apply-the-user-configuration-file-with-powershell.md) - -- [How to Apply the Deployment Configuration File by Using Windows PowerShell](appv-apply-the-deployment-configuration-file-with-powershell.md) - -|Step|Considerations|Benefits|Tradeoffs| -|--- |--- |--- |--- | -|Account for Synchronous Script Execution during Package Lifecycle.|If script collateral is embedded in the package, Add cmdlets may be slower.
                        Running of scripts during virtual application launch (StartVirtualEnvironment, StartProcess) and/or Add+Publish will impact the perceived performance during one or more of these lifecycle operations.|Use of Asynchronous (Non-Blocking) Scripts will ensure that the lifecycle operations complete efficiently.|This step requires working knowledge of all virtual application packages with embedded script collateral, which have associated dynamic configurations files and which reference and run scripts synchronously.| -|Remove Extraneous Virtual Fonts from Package.|Most applications investigated by the App-V product team contained a few fonts, typically fewer than 20.|Virtual Fonts impact publishing refresh performance.|Desired fonts will need to be enabled/installed natively. For instructions, see Install or uninstall fonts.| - -### Determining what virtual fonts exist in the package - -- Make a copy of the package. - -- Rename Package\_copy.appv to Package\_copy.zip - -- Open AppxManifest.xml and locate the following syntax: - - ```xml - - - - - ``` - - > [!Note] - > If there are fonts marked as **DelayLoad**, those won't impact first launch. - -### Excluding virtual fonts from the package - -Use the dynamic configuration file that best suits the user scope – deployment configuration for all users on computer, user configuration for specific user or users. - -- Disable fonts with the deployment or user configuration. - -Fonts - -```xml ---> - - - - -
                        For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). - -Help us to improve diff --git a/windows/application-management/app-v/appv-reporting.md b/windows/application-management/app-v/appv-reporting.md deleted file mode 100644 index 0108207c9e..0000000000 --- a/windows/application-management/app-v/appv-reporting.md +++ /dev/null @@ -1,218 +0,0 @@ ---- -title: About App-V Reporting (Windows 10/11) -description: Learn how the App-V reporting feature collects information about computers running the App-V client and virtual application package usage. -author: aczechowski -ms.prod: windows-client -ms.date: 04/16/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.technology: itpro-apps ---- - -# About App-V reporting - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -Application Virtualization (App-V) includes a built-in reporting feature that collects information about computers running the App-V client and virtual application package usage. You can generate reports from a centralized database with this information. - -## App-V reporting overview - -The following list displays the end–to-end high-level workflow for reporting in App-V. - -1. The App-V Reporting server requires the following things: - - * Internet Information Service (IIS) web server role - * Windows Authentication role (under **IIS / Security**) - * SQL Server installed and running with SQL Server Reporting Services (SSRS) - - To confirm SQL Server Reporting Services is running, enter `https://localhost/Reports` in a web browser as administrator on the server that will host App-V Reporting. The SQL Server Reporting Services Home page should appear. -2. Install the App-V reporting server and associated database. For more information about installing the reporting server, see [How to install the Reporting Server on a standalone computer and connect it to the database](appv-install-the-reporting-server-on-a-standalone-computer.md). Configure the time when the computer running the App-V client should send data to the reporting server. -3. If you aren't using an electronic software distribution system such as Configuration Manager to view reports, then you can define reports in SQL Server Reporting Service. - - > [!NOTE] - >If you are using the Configuration Manager integration with App-V, most reports are generated from Configuration Manager rather than from App-V. -4. After importing the App-V Windows PowerShell module using **Import-Module AppvClient** as administrator, enable App-V client reporting. This sample Windows PowerShell command enables App-V reporting: - - ```PowerShell - Set-AppvClientConfiguration -ReportingServerURL : -ReportingEnabled 1 -ReportingStartTime <0-23> -ReportingRandomDelay <#min> - ``` - - To immediately send App-V report data, run **Send-AppvClientReport** on the App-V client. - - For more information about configuring reporting on the App-V client, see [About client configuration settings](appv-client-configuration-settings.md). To administer App-V Reporting with Windows PowerShell, see [How to enable reporting on the App-V client by using PowerShell](appv-enable-reporting-on-the-appv-client-with-powershell.md). -5. After the reporting server receives the data from the App-V client, it sends the data to the reporting database. When the database receives and processes the client data, a successful reply is sent to the reporting server, which then notifies the App-V client. -6. When the App-V client receives the success notification, it empties the data cache to conserve space. - - > [!NOTE] - >By default, the cache is cleared after the server confirms receipt of data. You can manually configure the client to save the data cache. - - If the App-V client device doesn't receive a success notification from the server, it retains data in the cache and tries to resend data at the next configured interval. Clients continue to collect data and add it to the cache. - -### App-V reporting server frequently asked questions - -The following sections provide answers to frequently asked questions about how App-V reporting works. - -#### How frequently is reporting information sent to the reporting database? - -Frequency depends on the computer running the App-V client's reporting configuration. You must configure the frequency or interval for sending the reporting data manually, as App-V reporting isn't enabled by default. - -#### What information is stored in the reporting server database? - -The following information is stored in the reporting database: - -* The operating system running on the computer running the App-V client: host name, version, service pack, type - client/server, processor architecture. -* App-V client information: version. -* Published package list: GUID, version GUID, name. -* Application usage information: name, version, streaming server, user (domain\alias), package version GUID, launch status and time, shutdown time. - -#### What is the average volume of information that is sent to the reporting server? - -It depends. Three sets of data can be sent to the reporting server: - -* Operating system and App-V client information, which is about 150 Bytes every time it gets sent to the server. -* Published package lists, which are about 7 KB per 30 packages. This is sent only when the package list is updated with a publishing refresh, which is done infrequently; if there's no change, this information isn't sent. -* Virtual application usage information is about 0.25 KB per event. Opening and closing count as one event if both occur before sending the information. When the information is sent through a scheduled task, only the data since the last successful upload is sent to the server. If sending manually through the Windows PowerShell cmdlet, there's an optional argument called **DeleteOnSuccess** that controls if the data needs to be resent the next time around. - -For example, if 20 applications are opened and closed and reporting information is scheduled to be sent daily, the typical daily traffic should be about 0.15 KB + 20 × 0.25 KB, or about 5 KB/user. - -#### Can I schedule reporting? - -Yes. Besides manually sending reporting using Windows PowerShell cmdlets (**Send-AppvClientReport**), the task can be scheduled so it will happen automatically. There are two ways to schedule the reporting: - -* Using a Windows PowerShell cmdlet: **Set-AppvClientConfiguration**. For example: - - ```PowerShell - Set-AppvClientConfiguration -ReportingEnabled 1 -ReportingServerURL http://any.com/appv-reporting - ``` - - For a complete list of client configuration settings, go to [About client configuration settings](appv-client-configuration-settings.md) and look for the following entries: **ReportingEnabled**, **ReportingServerURL**, **ReportingDataCacheLimit**, **ReportingDataBlockSize**, **ReportingStartTime**, **ReportingRandomDelay**, **ReportingInterval**. -* Using Group Policy. If distributed using the domain controller, the settings are the same as previously listed. - - > [!NOTE] - >Group Policy settings override local settings configured using Windows PowerShell. - -## App-V Client reporting - -To use App-V reporting, you must enable and configure the App-V client. To configure reporting on the client, use the Windows PowerShell cmdlet **Set-AppVClientConfiguration**, or the Group Policy **ADMX Template**. For more information about the Windows PowerShell cmdlets, see [About client configuration settings](appv-client-configuration-settings.md). The following section provides examples of Windows PowerShell commands for configuring App-V client reporting. - -### Configuring App-V client reporting using Windows PowerShell - -The following examples show how Windows PowerShell parameters can configure the reporting features of the App-V client. - ->[!NOTE] ->The following configuration tasks can also be configured using Group Policy settings in the App-V ADMX template. The App-V settings are under **Computer Configuration** > **Administrative Templates** > **System** > **App-V**. - -#### Enabling reporting and initiating data collection on the computer running the App-V client - -Use the following command to enable reporting and initiate date collection on the computer running the App-V client: - -```PowerShell -Set-AppVClientConfiguration –ReportingEnabled 1 -``` - -#### Configuring the client to automatically send data to a specific reporting server - -To configure the client to automatically send data to a specific reporting server, use a command with the following format: - -```PowerShell -Set-AppVClientConfiguration -ReportingServerURL http://MyReportingServer:MyPort/ -ReportingStartTime 20 -ReportingInterval 1 -ReportingRandomDelay 30 -``` - -This example command configures the client to automatically send the reporting data to the reporting server URL ```http://MyReportingServer:MyPort/```. The reporting data will be sent to the URL daily between 8:00 PM and 8:30 PM, depending on the session's generated random delay. - -#### Limiting the size of the client's data cache - -To limit the client's data cache size, use a command with the following format: - -```PowerShell -Set-AppvClientConfiguration –ReportingDataCacheLimit 100 -``` - -This example command configures the maximum size of the App-V client computer's reporting cache to 100 MB. If the cache limit is reached before the data is sent to the server, then the log rolls over and data will be overwritten as necessary. - -#### Configuring the data block size transmitted across the network between the client and the server - -To configure the data block size, use a command with the following format: - -```PowerShell -Set-AppvClientConfiguration –ReportingDataBlockSize 10240 -``` - -This example command specifies the maximum size of the data block as 10,240 MB. - -### Types of data collected - -The following table displays the types of information you can collect by using App-V reporting. - -|Client information|Package information|Application usage| -|---|---|---| -|Host name|Package name|Start and end times| -|App-V client version|Package version|Run status| -|Processor architecture|Package source|Shutdown state| -|Operating system version|Percent cached|Application name| -|Service Pack level||Application version| -|Operating system type||Username| -|||Connection group| - -The client collects and saves this data in an **.xml** format. The data cache is hidden by default and requires administrator rights to open the XML file. - -### Sending data to the server - -You can configure the computer that is running the App-V client to automatically send data to the specified reporting server. To specify the server, use the **Set-AppvClientConfiguration** cmdlet with the following settings: - -* ReportingEnabled -* ReportingServerURL -* ReportingStartTime -* ReportingInterval -* ReportingRandomDelay - -After you configure the previous settings, you must create a scheduled task. The scheduled task will contact the server specified by the **ReportingServerURL** setting and will initiate the transfer. If you want to manually send data outside of the scheduled times, use the following Windows PowerShell cmdlet: - -```PowerShell -Send-AppVClientReport –URL http://MyReportingServer:MyPort/ -DeleteOnSuccess -``` - -If the reporting server has been previously configured, then the **–URL** parameter can be omitted. Alternatively, if the data should be sent to an alternate location, specify a different URL to override the configured **ReportingServerURL** for this data collection. - -The **-DeleteOnSuccess** parameter indicates that if the transfer is successful, then the data cache will be cleared. If the transfer-status isn't specified, then the cache won't be cleared. - -### Manual Data Collection - -You can also use the **Send-AppVClientReport** cmdlet to manually collect data. This solution is helpful with or without an existing reporting server. The following list displays information about collecting data with or without a reporting server. - -|With a reporting server|Without a reporting server| -|---|---| -|f you have an existing App-V reporting server, create a customized scheduled task or script. Specify that the client sends the data to the specified location at the desired frequency.|If you don't have an existing App-V reporting Server, use the **–URL** parameter to send the data to a specified share. For example: ```Send-AppVClientReport –URL \\Myshare\MyData\ -DeleteOnSuccess```
                        The previous example will send the reporting data to the ```\\MyShare\MyData\``` location indicated by the **-URL** parameter. After the data has been sent, the cache is cleared.| - ->[!NOTE] ->If a location other than the Reporting Server is specified, the data is sent in **.xml** format with no additional processing. - -### Creating reports - -To retrieve report information and create reports using App-V, you must use one of the following methods: - -* Microsoft SQL Server Reporting Services (SSRS)—Microsoft SSRS is available with Microsoft SQL Server. SSRS isn't installed when you install the App-V reporting server. It must be deployed separately to generate the associated reports. For more information, see the [What is SQL Server Reporting Services (SSRS)?](/sql/reporting-services/create-deploy-and-manage-mobile-and-paginated-reports) article. - -* Scripting—You can generate reports by scripting directly against the App-V reporting database. For example: - - **Stored Procedure:** - - **spProcessClientReport** is scheduled to run at midnight or 12:00 AM. - - To run the Microsoft SQL Server Scheduled Stored procedure, the Microsoft SQL Server Agent must be running. Make sure the Microsoft SQL Server Agent is set to **AutoStart**. For more information, see [Autostart SQL Server Agent (SQL Server Management Studio)](/sql/ssms/agent/autostart-sql-server-agent-sql-server-management-studio). - - The stored procedure is also created when you use the App-V database scripts. - -You should also ensure that the reporting server web service’s **Maximum Concurrent Connections** is set to a value that the server can manage without affecting availability. The recommended number of **Maximum Concurrent Connections** for the **Reporting Web Service** is **10,000**. - - - - - -## Related articles - -* [Deploying the App-V server](appv-deploying-the-appv-server.md) -* [How to install the reporting server on a standalone computer and connect it to the database](appv-install-the-reporting-server-on-a-standalone-computer.md) diff --git a/windows/application-management/app-v/appv-running-locally-installed-applications-inside-a-virtual-environment.md b/windows/application-management/app-v/appv-running-locally-installed-applications-inside-a-virtual-environment.md deleted file mode 100644 index ce0c73c061..0000000000 --- a/windows/application-management/app-v/appv-running-locally-installed-applications-inside-a-virtual-environment.md +++ /dev/null @@ -1,139 +0,0 @@ ---- -title: Running a Locally Installed Application Inside a Virtual Environment with Virtualized Applications (Windows 10/11) -description: Running a Locally Installed Application Inside a Virtual Environment with Virtualized Applications -author: aczechowski -ms.prod: windows-client -ms.date: 03/08/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.technology: itpro-apps ---- - -# Running a Locally Installed Application Inside a Virtual Environment with Virtualized Applications - -**Applies to** -- Windows 7 SP1 -- Windows 10 -- Windows 11 -- Windows Server 2012 R2 -- Windows Server 2016 - -You can run a locally installed application in a virtual environment, alongside applications that have been virtualized by using Microsoft Application Virtualization (App-V). You might want to do this task if you: - -- Want to install and run an application locally on client computers, but want to virtualize and run specific plug-ins that work with that local application. - -- Are troubleshooting an App-V client package and want to open a local application within the App-V virtual environment. - -Use any of the following methods to open a local application inside the App-V virtual environment: - -- [RunVirtual registry key](#bkmk-runvirtual-regkey) - -- [Get-AppvClientPackage Windows PowerShell cmdlet](#bkmk-get-appvclientpackage-posh) - -- [Command line switch /appvpid:<PID>](#bkmk-cl-switch-appvpid) - -- [Command line hook switch /appvve:<GUID>](#bkmk-cl-hook-switch-appvve) - -Each method accomplishes essentially the same task, but some methods may be better suited for some applications than others, depending on whether the virtualized application is already running. - -## RunVirtual registry key - - -To add a locally installed application to a package or to a connection group’s virtual environment, you add a subkey to the `RunVirtual` registry key in the Registry Editor, as described in the following sections. - -There's no Group Policy setting available to manage this registry key. So, you have to use Microsoft Intune or Configuration Manager, another electronic software distribution (ESD) system, or manually edit the registry. - -Starting with App-V 5.0 SP3, when using RunVirtual, you can publish packages globally or to the user. - - -### Steps to create the subkey - -1. Using the information in the following table, create a new registry key using the name of the executable file, for example, **MyApp.exe**. - - - **Published globally**: Create the `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AppV\Client\RunVirtual` registry key. - - For example, create `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AppV\Client\RunVirtual\MyApp.exe`. - - - **Published to the user**: Create the `HKEY_CURRENT_USER\SOFTWARE\Microsoft\AppV\Client\RunVirtual` registry key. - - For example, create `HKEY_CURRENT_USER \SOFTWARE\Microsoft\AppV\Client\RunVirtual\MyApp.exe`. - - - Connection group can be: - - Packages that are published globally or just to the user - - Packages that are published globally and to the user - - Use the `HKEY_LOCAL_MACHINE` or `HKEY_CURRENT_USER` key. But, all of the following conditions must be fulfilled: - - - If you want to include multiple packages in the virtual environment, you must include them in an enabled connection group. - - Create only one subkey for one of the packages in the connection group. For example, you have one package that is published globally and another package that is published to the user. You create a subkey for either of these packages, but not both. Although you create a subkey for only one of the packages, all of the packages in the connection group, plus the local application, will be available in the virtual environment. - - The key under which you create the subkey must match the publishing method you used for the package. - - For example, if you published the package to the user, you must create the subkey under `HKEY_CURRENT_USER\SOFTWARE\Microsoft\AppV\Client\RunVirtual`. Don't add a key for the same application under both hives. - -2. Set the new registry subkey’s value to the PackageId and VersionId of the package, separating the values with an underscore. - - **Syntax**: `_` - - **Example**: 4c909996-afc9-4352-b606-0b74542a09c1\_be463724-Oct1-48f1-8604-c4bd7ca92fa - - The application in the previous example would produce a registry export file (.reg file) like the following example: - - ```registry - Windows Registry Editor Version 5.00 - [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AppV\Client\RunVirtual] - @="" - [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AppV\Client\RunVirtual\MyApp.exe] - @="aaaaaaaa-bbbb-cccc-dddd-eeeeeeee_11111111-2222-3333-4444-555555555 - ``` - -## Get-AppvClientPackage Windows PowerShell cmdlet - - -You can use the **Start-AppVVirtualProcess** cmdlet to retrieve the package name and then start a process within the specified package's virtual environment. This method lets you launch any command within the context of an App-V package, regardless of whether the package is currently running. - -Use the following example syntax, and substitute the name of your package for ``: - -`$AppVName = Get-AppvClientPackage ` - -`Start-AppvVirtualProcess -AppvClientObject $AppVName cmd.exe` - -If you don’t know the exact name of your package, you can use the command line `Get-AppvClientPackage YourExecutable`, where `YourExecutable` is the name of the application. For example, enter `Get-AppvClientPackage Word`. - -## Command line switch `/appvpid:` - - -You can apply the `/appvpid:` switch to any command, which enables that command to run within a virtual process that you select by specifying its process ID (PID). Using this method launches the new executable in the same App-V environment as an executable that is already running. - -Example: `cmd.exe /appvpid:8108` - -To find the process ID (PID) of your App-V process, run the command **tasklist.exe** from an elevated command prompt. - -## Command line hook switch `/appvve:` - - -This switch lets you run a local command within the virtual environment of an App-V package. Unlike the **/appvid** switch, where the virtual environment must already be running, this switch enables you to start the virtual environment. - -Syntax: `cmd.exe /appvve:` - -Example: `cmd.exe /appvve:aaaaaaaa-bbbb-cccc-dddd-eeeeeeee_11111111-2222-3333-4444-55555555` - -To get the package GUID and version GUID of your application, run the **Get-AppvClientPackage** cmdlet. Concatenate the **/appvve** switch with the following: - -- A colon - -- Package GUID of the desired package - -- An underscore - -- Version ID of the desired package - -If you don’t know the exact name of your package, use the command line `Get-AppvClientPackage YourExecutable`, where `YourExecutable` is the name of the application. For example, enter `Get-AppvClientPackage Word`. - -This method lets you launch any command within the context of an App-V package, regardless of whether the package is currently running. - -## Related articles - - -[Technical Reference for App-V](appv-technical-reference.md) diff --git a/windows/application-management/app-v/appv-security-considerations.md b/windows/application-management/app-v/appv-security-considerations.md deleted file mode 100644 index 5c13af93a6..0000000000 --- a/windows/application-management/app-v/appv-security-considerations.md +++ /dev/null @@ -1,75 +0,0 @@ ---- -title: App-V Security Considerations (Windows 10/11) -description: Learn about accounts and groups, log files, and other security-related considerations for Microsoft Application Virtualization (App-V). -author: aczechowski -ms.prod: windows-client -ms.date: 04/16/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.technology: itpro-apps ---- - -# App-V security considerations - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -This article contains a brief overview of the accounts and groups, log files, and other security-related considerations for Microsoft Application Virtualization (App-V). - ->[!IMPORTANT] ->App-V isn't a security product and doesn't provide any guarantees for a secure environment. - -## The PackageStoreAccessControl (PSAC) feature has been deprecated - -Effective as of June 2014, the PackageStoreAccessControl (PSAC) feature introduced in Microsoft Application Virtualization (App-V) 5.0 Service Pack 2 (SP2) has been deprecated in both single-user and multi-user environments. - -## General security considerations - -**Understand the security risks.** The most serious risk to App-V is from unauthorized users hijacking an App-V client's functionality, giving the hacker the ability to reconfigure key data on App-V clients. By comparison, short-term loss of App-V functionality from a denial-of-service attack wouldn't be as catastrophic. - -**Physically secure your computers**. A security strategy that doesn't consider physical security is incomplete. Anyone with physical access to an App-V server could potentially attack the entire client base, so potential physical attacks or thefts should be prevented at all cost. App-V servers should be stored in a physically secure server room with controlled access. Lock the computer with the operating system or a secured screen saver to keep computers secure when the administrators are away. - -**Apply the most recent security updates to all computers**. To stay informed about the latest updates for operating systems, Microsoft SQL Server, and App-V, see the [Microsoft Security TechCenter](https://technet.microsoft.com/security/bb291012). (THIS LINK NEEDS TO BE UPDATED) - -**Use strong passwords or pass phrases**. Always use strong passwords with 15 or more characters for all App-V and App-V administrator accounts. Never use blank passwords. For more information about password concepts, see [Password Policy](/sql/relational-databases/security/password-policy) and [Strong Passwords](/sql/relational-databases/security/strong-passwords). (THIS LINK NEEDS TO BE UPDATED) - -## Accounts and groups in App-V - -A best practice for user account management is to create domain global groups and add user accounts to them. After that, add the domain global accounts to the necessary App-V local groups on the App-V servers. - ->[!NOTE] ->App-V client computer accounts that need to connect to the publishing server must be part of the publishing server’s **Users** local group. By default, all computers in the domain are part of the **Authorized Users** group, which is part of the **Users** local group. - -### App-V server security - -No groups are created automatically during App-V setup. You should create the following Active Directory Domain Services global groups to manage App-V server operations. - -|Group name|Details|Important notes| -|---|---|---| -|App-V Management Admin group|Used to manage the App-V management server. This group is created during the App-V Management Server installation.|The management console can't create a new group after installation is complete.| -|Database read/write for Management Service account|Provides read/write access to the management database. This account should be created during App-V management database installation.|| -|App-V Management Service install admin account|Provides public access to schema-version table in management database. This account should be created during App-V management database installation.|This account is only required if the management database is being installed separately from the service.| -|App-V Reporting Service install admin account|Public access to schema-version table in reporting database. This account should be created during the App-V reporting database installation.|This account is only required if reporting database is being installed separately from the service.| - -Consider the following additional information: - -* Access to the package shares: If a share exists on the same computer as the management Server, the **Network** service requires read access to the share. In addition, each App-V client computer must have read access to the package share. - > [!NOTE] - >In previous versions of App-V, package share was referred to as content share. -* Registering publishing servers with Management Server: A publishing server must be registered with the Management server. For example, it must be added to the database, so that the Publishing server machine accounts are able to call into the Management service API. - -### App-V package security - -The following information will help you plan how to ensure that virtualized packages are secure. - -* If an application installer applies an access control list (ACL) to a file or directory, then that ACL isn't persisted in the package. If the file or directory is modified by a user when the package is deployed, the modified file or directory will either inherit the ACL in the **%userprofile%** or inherit the ACL of the target computer’s directory. The former occurs if the file or directory doesn't exist in a virtual file system location; the latter occurs if the file or directory exists in a virtual file system location, such as **%windir%**. - -## App-V log files - -During App-V setup, setup log files are created in the **%temp%** folder of the installing user. - -## Related articles - -[Preparing Your Environment for App-V](appv-preparing-your-environment.md) diff --git a/windows/application-management/app-v/appv-sequence-a-new-application.md b/windows/application-management/app-v/appv-sequence-a-new-application.md deleted file mode 100644 index a19c89cc1c..0000000000 --- a/windows/application-management/app-v/appv-sequence-a-new-application.md +++ /dev/null @@ -1,218 +0,0 @@ ---- -title: Manually sequence a new app using the Microsoft Application Virtualization Sequencer (App-V Sequencer) (Windows 10/11) -description: Learn how to manually sequence a new app by using the App-V Sequencer that's included with the Windows ADK. -author: aczechowski -ms.prod: windows-client -ms.date: 04/16/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.technology: itpro-apps ---- - -# Manually sequence a new app using the Microsoft Application Virtualization Sequencer (App-V Sequencer) - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -Starting with Windows 10 version 1607, the App-V Sequencer is included with the Windows ADK. For more info on how to install the App-V Sequencer, see [Install the App-V Sequencer](appv-install-the-sequencer.md). - -## Before you start sequencing - -1. Determine the type of virtualized application package you want to create: - - | Application type | Description | - |---|---| - | Standard | Creates a package that contains an application or a suite of applications. This is the preferred option for most application types. | - | Add-on or plug-in | Creates a package that extends the functionality of a standard application, for example, a plug-in for Microsoft Excel. Additionally, you can use plug-ins for natively installed applications, or for another package that is linked by using connection groups. | - | Middleware | Creates a package that is required by a standard application, for example, Java. Middleware packages are used for linking to other packages through connection groups. | - -2. Copy all required installation files to the computer that is running the sequencer. - -3. Make a backup image of your virtual environment before sequencing an application, and then revert to that image each time after you finish sequencing an application. - -4. Review the following items: - - - If an application installer changes the security access to a new or existing file or directory, those changes are not captured in the package. - - If short paths have been disabled for the virtualized package’s target volume, you must also sequence the package to a volume that was created and still has short-paths disabled. It cannot be the system volume. - - > [!NOTE] - > The App-V Sequencer cannot sequence applications with filenames matching "CO_<_x_>" where *x* is any numeral. Error 0x8007139F will be generated. - -## Sequence a new standard application - -1. On the computer that runs the sequencer, select **All Programs**, and then select **Microsoft Application Virtualization**, and then select **Microsoft Application Virtualization Sequencer**. - -2. In the sequencer, select **Create a New Virtual Application Package**. Select **Create Package (default)**, and then select **Next**. - -3. On the **Prepare Computer** page, review the issues that could cause the package creation to fail or could cause the package to contain unnecessary data. You should resolve all potential issues before you continue. After making any corrections, select **Refresh** to display the updated information. After you have resolved all potential issues, select **Next**. - - >[!IMPORTANT] - >If you are required to disable virus scanning software, you should first scan the computer that runs the sequencer in order to ensure that no unwanted or malicious files could be added to the package. - -4. On the **Type of Application** page, select the **Standard Application (default)** check box, and then select **Next**. - -5. On the **Select Installer** page, select **Browse** and specify the installation file for the application. - - > [!NOTE] - > If the specified application installer modifies security access to a file or directory, existing or new, the associated changes will not be captured into the package. - - If the application does not have an associated installer file and you plan to run all installation steps manually, select the **Perform a Custom Installation** check box, and then select **Next**. - -6. On the **Package Name** page, specify a name for the package. Use a name that helps identify the purpose and version of the application that will be added to the package. The package name is displayed in the App-V Management Console. Once you're done, select **Next**. - -7. On the **Installation** page, when the sequencer and application installer are ready, you can install the application so that the sequencer can monitor the installation process. - - >[!IMPORTANT] - >You should always install applications to a secure location and make sure no other users are logged on to the computer running the sequencer during monitoring. - - Use the application's installation process to perform the installation. If additional installation files must be run as part of the installation, select **Run** to locate and run the additional installation files. When you are finished with the installation, select **I am finished installing**, then select **Next**. - -8. On the **Installation** page, wait while the sequencer configures the virtualized application package. - -9. On the **Configure Software** page, optionally run the programs contained in the package. This step allows you to complete any necessary license or configuration tasks before you deploy and run the package on target computers. To run all the programs at one time, select at least one program, and then select **Run All**. To run specific programs, select the program or programs, and then select **Run Selected**. Complete the required configuration tasks and then close the applications. You may need to wait several minutes for all programs to run. - - > [!NOTE] - >To run first-use tasks for any application that is not available in the list, open the application. The associated information will be captured during this step. - - Select **Next**. - -10. On the **Installation Report** page, you can review information about the virtualized application package you have just sequenced. In **Additional Information**, double-click an event to obtain more detailed information. To proceed, select **Next**. - -11. The **Customize** page is displayed. If you've finished installing and configuring the virtual application, select **Stop now** and skip to step 14 of this procedure. To perform either of the following customizations, select **Customize**. - - - Prepare the virtual package for streaming. Streaming improves the experience when the virtual application package is run on target computers. - - Specify the operating systems that can run this package. - - Once you're ready, select **Next**. - -12. On the **Streaming** page, run each program so that it can be optimized and run more efficiently on target computers. It can take several minutes for all the applications to run. After all applications have run, close each of the applications, and then select **Next**. - - > [!NOTE] - > If you do not open any applications during this step, the default streaming method is on-demand streaming delivery. This means applications will be downloaded bit by bit until it can be opened. After that, depending on how the background loading is configured, it will load the rest of the application. - -13. On the **Target OS** page, specify the operating systems that can run this package. To allow all supported operating systems in your environment to run this package, select **Allow this package to run on any operating system**. To configure this package to run only on specific operating systems, select **Allow this package to run only on the following operating systems** and select the operating systems that can run this package. After that, select **Next**. - - > [!IMPORTANT] - > Make sure that the operating systems you specify here are supported by the application you are sequencing. - -14. The **Create Package** page is displayed. To modify the package without saving it, select **Continue to modify package without saving using the package editor**. This option opens the package in the sequencer console so that you can modify the package before saving it. Select **Next**. - - To save the package immediately, select **Save the package now** (default). Add optional **Comments** to be associated with the package. Comments are useful for identifying the program version and other information about the package. - - > [!IMPORTANT] - > The system does not support non-printable characters in **Comments** and **Descriptions**. - - The default **Save Location** is also displayed on this page. To change the default location, select **Browse** and specify the new location. After that, select **Create**. - -15. The **Completion** page is displayed. Review the information in the **Virtual Application Package Report** pane as needed, then select **Close**. This information is also available in the **Report.xml** file located in the directory where the package was created. - - Your package should now be available in the sequencer. - - > [!IMPORTANT] - > After you have successfully created a virtual application package, you can't run the virtual application package on the computer that is running the sequencer. - -## Sequence an add-on or plug-in application - -> [!NOTE] -> Before performing the following procedure, install the parent application locally on the computer that is running the sequencer. Or if you have the parent application virtualized, you can follow the steps in the add-on or plug-in workflow to unpack the parent application on the computer. -> -> For example, if you are sequencing a plug-in for Microsoft Excel, install Microsoft Excel locally on the computer that's running the sequencer. You should also install the parent application in the same directory where the application is installed on target computers. If the plug-in or add-on is going to be used with an existing virtual application package, install the application on the same virtual application drive that was used when you created the parent virtual application package. - -1. On the computer that runs the sequencer, first, select **All Programs**, then select **Microsoft Application Virtualization**, and then select **Microsoft Application Virtualization Sequencer**. - -2. In the sequencer, select **Create a New Virtual Application Package**, select **Create Package (default)**, and then select **Next**. - -3. On the **Prepare Computer** page, review the issues that might cause the package creation to fail or could cause the package to contain unnecessary data. You should resolve all potential issues before you continue. After making any corrections, select **Refresh** to display the updated information. After you have resolved all potential issues, select **Next**. - - >[!IMPORTANT] - >If you are required to disable virus scanning software, you should first scan the computer that runs the sequencer in order to ensure that no unwanted or malicious files could be added to the package. - -4. On the **Type of Application** page, select **Add-on or Plug-in**, and then select **Next**. - -5. On the **Select Installer** page, select **Browse** and specify the installation file for the add-on or plug-in. If the add-on or plug-in does not have an associated installer file and you plan to run all installation steps manually, select the **Select this option to perform a custom installation** check box, then select **Next**. - -6. On the **Install Primary** page, ensure that the primary application is installed on the computer that runs the sequencer. Alternatively, you can expand an existing package that has been saved locally on the computer that runs the sequencer. To do this, select **Expand Package**, and then select the package. After you have expanded or installed the parent program, select **I have installed the primary parent program**. - -7. Select **Next**. - -8. On the **Package Name** page, type a name that will be associated with the package. Use a name that helps identify the purpose and version of the application that will be added to the package. The package name will be displayed in the App-V Management Console. - -9. Select **Next**. - -10. On the **Installation** page, when the sequencer and application installer are ready you can proceed to install the plug-in or add-in application so the sequencer can monitor the installation process. Use the application's installation process to perform the installation. If additional installation files must be run as part of the installation, select **Run** and locate and run the additional installation files. When you are finished with the installation, select **I am finished installing**, and then select **Next**. - -11. On the **Installation Report** page, you can review information about the virtual application package that you just sequenced. For a more detailed explanation about the information displayed in **Additional Information**, double-click the event. After you have reviewed the information, select **Next**. - -12. The **Customize** page is displayed. If you are finished installing and configuring the virtual application, select **Stop now** and skip to step 12 of this procedure. To perform either of the following customizations, select **Customize**. - - - Optimize how the package will run across a slow or unreliable network. - - Specify the operating systems that can run this package. - - When you're finished, select **Next**. - -13. On the **Streaming** page, run each program so that it can be optimized and run more efficiently on target computers. Streaming improves the experience when the virtual application package is run on target computers on high-latency networks. It can take several minutes for all applications to run. After all applications have run, close each application. You can also configure the package to be required to be fully downloaded before opening by selecting the **Force applications to be downloaded** check-box. Select **Next**. - - > [!NOTE] - > If necessary, you can stop an application from loading during this step. In the **Application Launch** dialog box, select **Stop** and select one of the check boxes: **Stop all applications** or **Stop this application only**. - -14. On the **Target OS** page, specify the operating systems that can run this package. To allow all supported operating systems in your environment to run this package, select the **Allow this package to run on any operating system** check box. To configure this package to run only on specific operating systems, select the **Allow this package to run only on the following operating systems** check box, and then select the operating systems that can run this package. Select **Next**. - -15. The **Create Package** page is displayed. To modify the package without saving it, select **Continue to modify package without saving using the package editor** check box. This option opens the package in the sequencer console so that you can modify the package before it is saved. Select **Next**. - - To save the package immediately, select **Save the package now**. Optionally, add a **Description** for the package. Descriptions are useful for identifying the version and other important information about the package. - - >[!IMPORTANT] - >The system does not support non-printable characters in Comments and Descriptions. - - The default **Save Location** is also displayed on this page. To change the default location, select **Browse** and specify the new location. Select **Create**. - -### Sequence a middleware application - -1. On the computer that runs the sequencer, select **All Programs**, then select **Microsoft Application Virtualization**, and then select **Microsoft Application Virtualization Sequencer**. - -2. In the sequencer, select **Create a New Virtual Application Package**, select **Create Package (default)**, and then select **Next**. - -3. On the **Prepare Computer** page, review the issues that could cause the package creation to fail or could cause the package to contain unnecessary data. You should resolve all potential issues before you continue. After making any corrections, select **Refresh** to display the updated information. After you have resolved all potential issues, select **Next**. - - >[!IMPORTANT] - >If you are required to disable virus scanning software, you should first scan the computer that runs the App-V Sequencer in order to ensure that no unwanted or malicious files can be added to the package. - -4. On the **Type of Application** page, select **Middleware**, and then select **Next**. - -5. On the **Select Installer** page, select **Browse** and specify the installation file for the application. If the application does not have an associated installer file and you plan to run all installation steps manually, select the **Select this option to perform a custom installation** check box, then select **Next**. - -6. On the **Package Name** page, type a name that will be associated with the package. Use a name that helps identify the purpose and version of the application that will be added to the package. The package name is displayed in the App-V Management Console. - -7. Select **Next**. - -8. On the **Installation** page, when the sequencer and middleware application installer are ready you can proceed to install the application so that the sequencer can monitor the installation process. Use the application's installation process to perform the installation. If additional installation files must be run as part of the installation, select **Run**, to locate and run the additional installation files. When you are finished with the installation, select the **I am finished installing** check box, and then select **Next**. - -9. On the **Installation** page, wait while the sequencer configures the virtual application package. - -10. On the **Installation Report** page, you can review information about the virtual application package that you have just sequenced. In **Additional Information**, double-click an event to obtain more detailed information. To proceed, select **Next**. - -11. On the **Target OS** page, specify the operating systems that can run this package. To enable all supported operating systems in your environment to run this package, select the **Allow this package to run on any operating system** check box. To configure this package to run only on specific operating systems, select the **Allow this package to run only on the following operating systems** check box and select the operating systems that can run this package. Once you're done, select **Next**. - -12. On the **Create Package** page is displayed. To modify the package without saving it, select **Continue to modify package without saving using the package editor**. This option opens the package in the sequencer console so that you can modify the package before it is saved. Select **Next**. - - To save the package immediately, select **Save the package now**. Optionally, add a **Description** to be associated with the package. Descriptions are useful for identifying the program version and other information about the package. - - >[!IMPORTANT] - >The system does not support non-printable characters in comments and descriptions. - - The default **Save Location** is also displayed on this page. To change the default location, select **Browse** and specify the new location. Select **Create**. - -13. The **Completion** page is displayed. Review the information in the **Virtual Application Package Report** pane as needed, then select **Close**. This information is also available in the **Report.xml** file that is located in the directory specified in step 11 of this procedure. - - The package is now available in the sequencer. To edit the package properties, select **Edit \[Package Name\]**. - - >[!IMPORTANT] - >After you have successfully created a virtual application package, you can't run the virtual application package on the computer that is running the sequencer. - - -## Related articles - -- [Install the App-V Sequencer](appv-install-the-sequencer.md) -- [Operations for App-V](appv-operations.md) diff --git a/windows/application-management/app-v/appv-sequence-a-package-with-powershell.md b/windows/application-management/app-v/appv-sequence-a-package-with-powershell.md deleted file mode 100644 index 1b289057fe..0000000000 --- a/windows/application-management/app-v/appv-sequence-a-package-with-powershell.md +++ /dev/null @@ -1,74 +0,0 @@ ---- -title: How to sequence a package by using Windows PowerShell (Windows 10/11) -description: Learn how to sequence a new Microsoft Application Virtualization (App-V) package by using Windows PowerShell. -author: aczechowski -ms.prod: windows-client -ms.date: 04/19/2017 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.technology: itpro-apps ---- - -# How to Sequence a Package by using Windows PowerShell - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -Use the following procedure to create a new App-V package using Windows PowerShell. - -> [!NOTE] -> Before you use this procedure you must copy the associated installer files to the computer running the sequencer and you have read and understand the sequencer section of [Planning for the App-V Sequencer and Client Deployment](appv-planning-for-sequencer-and-client-deployment.md). - - -**To create a new virtual application by using Windows PowerShell** - -1. Install the App-V sequencer. For more information about installing the sequencer, see [How to Install the Sequencer](appv-install-the-sequencer.md). - -2. Click **Start** and type **Windows PowerShell**. Right-click **Windows PowerShell**, and select **Run as Administrator**. - -3. Using the Windows PowerShell console, type the following: **import-module appvsequencer**. - -4. To create a package, use the **New-AppvSequencerPackage** cmdlet. The following parameters are required to create a package: - - - **Name** - specifies the name of the package. - - - **PrimaryVirtualApplicationDirectory** - specifies the path to the directory that will be used to install the application. This path must exist. - - - **Installer** - specifies the path to the associated application installer. - - - **Path** - specifies the output directory for the package. - - For example: - - ``` - New-AppvSequencerPackage –Name -PrimaryVirtualApplicationDirectory -Installer -OutputPath - ``` - - -Wait for the sequencer to create the package. Creating a package by using Windows PowerShell can take time. If the package was not created successfully, an error will be returned. - -The following list displays additional optional parameters that can be used with **New-AppvSequencerPackage** cmdlet: - -- AcceleratorFilePath – specifies the path to the accelerator .cab file to generate a package. - -- InstalledFilesPath - specifies the path to where the local installed files of the application are saved. - -- InstallMediaPath - specifies the path of the installation media - -- TemplateFilePath - specifies the path to a template file if you want to customize the sequencing process. - -- FullLoad - specifies that the package must be fully downloaded to the computer running the App-V before it can be opened. - -Starting with Windows 10 version 1703, the `new-appvsequencerpackage` or the `update-appvsequencepackage` cmdlets automatically capture and store all of your customizations as an App-V project template. If you want to make changes to this package later, your customizations are automatically loaded from this template file. - -> [!IMPORTANT] -> If you have an auto-saved template and you attempt to load another template through the _TemplateFilePath_ parameter, the customization value from the parameter will override the auto-saved template. - -## Related articles - -- [Administering App-V by using Windows PowerShell](appv-administering-appv-with-powershell.md) - - - -
                        For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). diff --git a/windows/application-management/app-v/appv-supported-configurations.md b/windows/application-management/app-v/appv-supported-configurations.md deleted file mode 100644 index 059ef24c65..0000000000 --- a/windows/application-management/app-v/appv-supported-configurations.md +++ /dev/null @@ -1,129 +0,0 @@ ---- -title: App-V Supported Configurations (Windows 10/11) -description: Learn the requirements to install and run App-V supported configurations in your Windows 10/11 environment. -author: aczechowski -ms.prod: windows-client -ms.date: 04/16/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.technology: itpro-apps ---- - -# App-V Supported Configurations - -**Applies to**: - -- Windows 10 -- Windows 11 -- Windows Server 2019 -- Windows Server 2016 -- Windows Server 2012 R2 -- Windows Server 2012 -- Windows Server 2008 R2 (Extended Security Update) - -This article specifies the requirements to install and run App-V in your Windows client environment. For information about prerequisite software such as the .NET Framework, see [App-V prerequisites](appv-prerequisites.md). - -## App-V Server system requirements - -This section lists the operating system and hardware requirements for all App-V server components. - -### Unsupported App-V server scenarios - -The App-V server does not support the following scenarios: - -* Deployment to a computer that runs the Server Core installation option. -* Deployment to a computer that runs a previous version of the App-V server components. You can only install App-V side-by-side with the App-V 4.5 Lightweight Streaming Server (LWS) server. This scenario doesn't support side-by-side deployment of App-V and the Application Virtualization Management Service (HWS) 4.x. -* Deployment to a computer running Microsoft SQL Server Express edition. -* Deployment to a domain controller. -* Short paths. If you plan to use a short path, you must create a new volume. - -### Management server operating system requirements - -You can install the App-V Management server on a server running Windows Server 2008 R2 with SP1 (Extended Security Update) or later. - ->[!IMPORTANT] ->Deploying a Management server role to a computer with Remote Desktop Services enabled is not supported. - -### Management server hardware requirements - -* A 64-bit (x64) processor that runs at 1.4 GHz or faster. -* 1-GB RAM (64-bit). -* 200 MB of available hard disk space, not including the content directory. - -### Management server database requirements - -The following table lists the SQL Server versions that the App-V Management database installation supports. - -|SQL Server version|Service pack|System architecture| -|---|---|---| -|Microsoft SQL Server 2019|CU4|32-bit or 64-bit| -|Microsoft SQL Server 2017||32-bit or 64-bit| -|Microsoft SQL Server 2016|SP2|32-bit or 64-bit| -|Microsoft SQL Server 2014||32-bit or 64-bit| -|Microsoft SQL Server 2012|SP2|32-bit or 64-bit| -|Microsoft SQL Server 2008 R2|SP3|32-bit or 64-bit| - -For more information on user configuration files with SQL server 2016 or later, see the [support article](https://support.microsoft.com/help/4548751/app-v-server-publishing-might-fail-when-you-apply-user-configuration-f). - -### Publishing server operating system requirements - -The App-V Publishing server can be installed on a server that runs Windows Server 2008 R2 with SP1 or later. - -### Publishing server hardware requirements - -App-V adds require nothing beyond the requirements of Windows Server. - -* A 64-bit (x64) processor that runs at 1.4 GHz or faster. -* 2-GB RAM (64-bit). -* 200 MB of available hard disk space, not including the content directory. - -### Reporting server operating system requirements - -You can install the App-V Reporting server on a server running Windows Server 2008 R2 with SP1 or later. - -### Reporting server hardware requirements - -App-V adds no other requirements beyond those requirements of Windows Server. - -* A 64-bit (x64) processor that runs at 1.4 GHz or faster. -* 2-GB RAM (64-bit). -* 200 MB of available hard disk space, not including the content directory. - -### Reporting server database requirements - -The following table lists the SQL Server versions that are supported for the App-V Reporting database installation. - -|SQL Server version|Service pack|System architecture| -|---|---|---| -|Microsoft SQL Server 2019|CU4|32-bit or 64-bit| -|Microsoft SQL Server 2017||32-bit or 64-bit| -|Microsoft SQL Server 2016|SP2|32-bit or 64-bit| -|Microsoft SQL Server 2014||32-bit or 64-bit| -|Microsoft SQL Server 2012|SP2|32-bit or 64-bit| -|Microsoft SQL Server 2008 R2|SP3|32-bit or 64-bit| - -## App-V client and Remote Desktop Services client requirements - -Starting with Windows 10 version 1607, the App-V client is included with Windows Enterprise and Windows Education. The App-V client is no longer part of the Microsoft Desktop Optimization Pack. Before you can use the App-V client, it must be enabled, as described in [Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md). - -Similarly, the App-V Remote Desktop Services (RDS) client is included with Windows Server 2016 Standard and Windows Server 2016 Datacenter. - -## Sequencer system requirements - -Sequencer is now part of the Windows Assessment and Deployment Kit (Windows ADK). [Download the latest Windows ADK](/windows-hardware/get-started/adk-install) that is recommended for your version of the Windows OS. - -### Sequencer hardware requirements - -See the Windows or Windows Server documentation for the hardware requirements. - -## Supported versions of Microsoft Configuration Manager - -The App-V client works with Configuration Manager versions starting with Technical Preview for Configuration Manager, version 1606. - -## Related articles - -* [Planning to deploy App-V](appv-planning-to-deploy-appv.md) -* [App-V prerequisites](appv-prerequisites.md) diff --git a/windows/application-management/app-v/appv-technical-reference.md b/windows/application-management/app-v/appv-technical-reference.md deleted file mode 100644 index 5feee6e5a9..0000000000 --- a/windows/application-management/app-v/appv-technical-reference.md +++ /dev/null @@ -1,60 +0,0 @@ ---- -title: Technical Reference for App-V (Windows 10/11) -description: Learn strategy and context for many performance optimization practices in this technical reference for Application Virtualization (App-V). -author: aczechowski -ms.prod: windows-client -ms.date: 04/19/2017 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.technology: itpro-apps ---- - -# Technical Reference for App-V - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -This section provides reference information related to managing App-V. - -## In This Section - - -- [Performance Guidance for Application Virtualization](appv-performance-guidance.md) - - Provides strategy and context for many performance optimizations. Not all practices will be applicable. However, these practices are tested and supported. Using all suggested practices that are applicable to your organization will provide the optimal end-user experience. - -- [Application Publishing and Client Interaction](appv-application-publishing-and-client-interaction.md) - -Describes how the following App-V client operations affect the local operating system: - -- App-V files and data storage locations -- Package registry -- Package store behavior -- Roaming registry and data -- Client application lifecycle management -- Integration of App-V packages -- Dynamic configuration -- Side-by-side assemblies -- Client logging - -- [Viewing App-V Server Publishing Metadata](appv-viewing-appv-server-publishing-metadata.md) - - Tells how to view publishing metadata, which can help you resolve publishing-related issues. - -- [Running a Locally Installed Application Inside a Virtual Environment with Virtualized Applications](appv-running-locally-installed-applications-inside-a-virtual-environment.md) - - Describes reasons and methods for running a locally installed application in a virtual environment, alongside applications that have been virtualized by using Application Virtualization (App-V). - - - - -
                        For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). - -## Related articles - -[How to Deploy the App-V Databases by Using SQL Scripts](appv-deploy-appv-databases-with-sql-scripts.md) - -[Administering App-V by Using Windows PowerShell](appv-administering-appv-with-powershell.md) - -[Windows PowerShell reference for App-V](/previous-versions/) diff --git a/windows/application-management/app-v/appv-transfer-access-and-configurations-to-another-version-of-a-package-with-the-management-console.md b/windows/application-management/app-v/appv-transfer-access-and-configurations-to-another-version-of-a-package-with-the-management-console.md deleted file mode 100644 index 6ad489e6d0..0000000000 --- a/windows/application-management/app-v/appv-transfer-access-and-configurations-to-another-version-of-a-package-with-the-management-console.md +++ /dev/null @@ -1,36 +0,0 @@ ---- -title: How to Transfer Access and Configurations to Another Version of a Package by Using the Management Console (Windows 10/11) -description: How to Transfer Access and Configurations to Another Version of a Package by Using the Management Console -author: aczechowski -ms.prod: windows-client -ms.date: 04/19/2017 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.technology: itpro-apps ---- - -# How to Transfer Access and Configurations to Another Version of a Package by Using the Management Console - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -Use the following procedure to transfer the access and default package configurations to another version of a package by using the management console. - -**To transfer access and configurations to another version of a package** - -1. To view the package that you want to configure, open the App-V Management Console. Select the package to which you'll transfer the new configuration, right-click the package and select **transfer default configuration from** or **transfer access and configurations from**, depending on the configuration that you want to transfer. - -2. To transfer the configuration, in the **Select Previous Version** dialog box, select the package that contains the settings that you want to transfer, and then click **OK**. - - If you select **transfer default configuration from**, then only the underlying dynamic deployment configuration will be transferred. - - If you select **transfer access and configurations from**, then all access permissions, and the configuration settings, will be copied. - - - -
                        For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). - -## Related articles - -[Operations for App-V](appv-operations.md) diff --git a/windows/application-management/app-v/appv-troubleshooting.md b/windows/application-management/app-v/appv-troubleshooting.md deleted file mode 100644 index 8e916937ed..0000000000 --- a/windows/application-management/app-v/appv-troubleshooting.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: Troubleshooting App-V (Windows 10/11) -description: Learn how to find information about troubleshooting Application Virtualization (App-V) and information about other App-V articles. -author: aczechowski -ms.prod: windows-client -ms.date: 04/19/2017 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.technology: itpro-apps ---- - -# Troubleshooting App-V - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -For information that can help with troubleshooting App-V for Windows client, see: - -- [Application Virtualization (App-V): List of Microsoft Support Knowledge Base Articles](https://social.technet.microsoft.com/wiki/contents/articles/14272.app-v-v5-x-list-of-microsoft-support-knowledge-base-articles.aspx) - -- [Microsoft App-V Team Blog](/archive/blogs/appv/) - -- [Release Notes for App-V](appv-release-notes-for-appv-for-windows.md) - -- [Technical Reference for App-V](appv-technical-reference.md) - -- [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv) - - -## Other resources - -- [Application Virtualization (App-V) for Windows client overview](appv-for-windows.md) - -- [Getting Started with App-V for Windows client](appv-getting-started.md) - -- [Planning for App-V](appv-planning-for-appv.md) - -- [Deploying App-V](appv-deploying-appv.md) - -- [Operations for App-V](appv-operations.md) - - - -
                        For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). diff --git a/windows/application-management/app-v/appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation.md b/windows/application-management/app-v/appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation.md deleted file mode 100644 index d9769d9ac3..0000000000 --- a/windows/application-management/app-v/appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation.md +++ /dev/null @@ -1,100 +0,0 @@ ---- -title: Upgrading to App-V for Windows 10/11 from an existing installation (Windows 10/11) -description: Learn about upgrading to Application Virtualization (App-V) for Windows 10/11 from an existing installation. -author: aczechowski -ms.prod: windows-client -ms.date: 04/19/2017 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.technology: itpro-apps ---- - -# Upgrading to App-V for Windows client from an existing installation - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -If you’re already using App-V and you’re planning to upgrade user devices to Windows 10/11, you need to make only the following few adjustments to your existing environment to start using App-V for Windows client. - -1. [Upgrade user devices to Windows 10/11](#upgrade-user-devices-to-windows-1011). Performing an in-place upgrade automatically installs the App-V client and migrates users’ App-V applications and settings. - -2. [Verify that App-V applications and settings were migrated correctly](#verify-that-app-v-applications-and-settings-were-migrated-correctly). - -3. [Enable the in-box App-V client](#enable-the-in-box-app-v-client). - -4. [Configure the in-box App-V client to point to previously installed App-V server components](#configure-the-in-box-app-v-client-to-point-to-previously-installed-app-v-server-components). - -5. [Verify that the in-box App-V client can receive and launch .appv packages](#verify-that-the-in-box-app-v-client-can-receive-and-launch-appv-packages). - -These steps are explained in more detail below. - -## Upgrade user devices to Windows 10/11 - -Performing an in-place upgrade automatically installs the App-V client and migrates users’ App-V applications and settings. See the [Windows document set](/windows/windows-10/) for information about upgrading user devices. - -## Verify that App-V applications and settings were migrated correctly - -After upgrading a user device, it’s important to verify that App-V applications and settings were migrated correctly during the upgrade. - -To verify that the user’s App-V application packages were migrated correctly, type `Get-AppvClientPackage` in Windows PowerShell. - -To verify that the user’s App-V settings were migrated correctly, type `Get-AppvClientConfiguration` in Windows PowerShell. - -## Enable the in-box App-V client - -With Windows 10/11, the App-V client is installed automatically. You need to enable the client to allow user devices to access and run virtual applications. You can enable the client with the Group Policy editor or with Windows PowerShell. - -**To enable the App-V client with Group Policy** - -1. Open the device’s **Group Policy Editor**. - -2. Navigate to **Computer Configuration > Administrative Templates > System > App-V**. - -3. Run **Enables App-V Client** and then select **Enabled** on the screen that appears. - -4. Restart the device. - -**To enable the App-V client with Windows PowerShell** - -1. Open Windows PowerShell. - -2. Type `Enable-Appv` and press enter. - -3. Restart the device. - -4. To verify that the App-V client is enabled on the device, enter `AppvClientEnabled` or `Get-AppvStatus` in Windows PowerShell. - -## Configure the in-box App-V client to point to previously installed App-V server components - -Once you’ve enabled the in-box App-V client, you need to configure it to point to your existing App-V server components. You can configure the App-V client with Windows PowerShell cmdlets or with the device’s local Group Policy editor. - -**To modify client settings to point to an existing App-V publishing server with Windows PowerShell** - -Type the following cmdlet in a Windows PowerShell window: - -`Add-AppvPublishingServer -Name AppVServer -URL https:// appvserver:2222` - -**To modify client settings to point to an existing App-V publishing server with Group Policy** - -1. Open the device’s **Local Group Policy Editor**. - -2. Navigate to **Computer Configuration > Administrative Templates > System > App-V > Publishing**. - -3. Enter your existing App-V publishing server’s details in **Options** and then click or press **Apply**. - -## Verify that the in-box App-V client can receive and launch .appv packages - -1. Add and publish a package using the following Windows PowerShell cmdlets: - - `Add-AppvClientPackage \\path\to\appv\package.appv | Publish-AppvClientPackage` - -2. Launch the published package. - -3. Unpublish an existing package use the following cmdlet: - - `Unpublish-AppvClientPackage "ContosoApplication"` - - - -
                        For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). diff --git a/windows/application-management/app-v/appv-using-the-client-management-console.md b/windows/application-management/app-v/appv-using-the-client-management-console.md deleted file mode 100644 index 3cdd99110d..0000000000 --- a/windows/application-management/app-v/appv-using-the-client-management-console.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -title: Using the App-V Client Management Console (Windows 10/11) -description: Learn how to use the Application Virtualization (App-V) client management console to manage packages on the computer running the App-V client. -author: aczechowski -ms.prod: windows-client -ms.date: 04/19/2017 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.technology: itpro-apps ---- - -# Using the App-V Client Management Console - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -This article provides information about using the Application Virtualization (App-V) client management console to manage packages on the computer running the App-V client. - -## Options for managing the App-V client - -The App-V client has associated settings that can be configured to determine how the client will run in your environment. You can manage these settings on the computer that runs the client, or you can use Windows PowerShell or Group Policy. For more information about configuring the client by using Windows PowerShell or Group Policy, see: - -- [Deploying the App-V Sequencer and Configuring the Client](appv-deploying-the-appv-sequencer-and-client.md) - -- [How to Modify Client Configuration by Using Windows PowerShell](appv-modify-client-configuration-with-powershell.md) - -- [How to Configure the Client to Receive Package and Connection Groups Updates From the Publishing Server](appv-configure-the-client-to-receive-updates-from-the-publishing-server.md) - -## The App-V client management console - -You can obtain information about the App-V client or perform specific tasks by using the App-V client management console. Many of the tasks that you can perform in the client management console you can also perform by using Windows PowerShell. The associated Windows PowerShell cmdlets for each action are also displayed in the following table. For more information about how to use Windows PowerShell, see [Administering App-V by Using Windows PowerShell](appv-administering-appv-with-powershell.md). - -The client management console contains the following described main tabs. - -- **Overview**: The **Overview** tab contains the following elements: - - - **Update**: Refreshes a virtualized application or to receive a new virtualized package. - - **Last Refresh**: Displays the current version of the virtualized package. - - **Download all virtual applications**: Use the Download tile to download all of the packages provisioned to the current user. - - Associated Windows PowerShell cmdlet: `Mount-AppvClientPackage` - - - **Work Offline**: Disallows all automatic and manual virtual application updates. - - Associated Windows PowerShell cmdlet: `-AppvPublishServer –UserRefreshEnabled –GlobalRefreshEnabled` - -- **VIRTUAL APPS**: Displays all of the packages that have been published to the user. - - You can also click a specific package and see all of the applications that are part of that package. This option displays information about packages that are currently in use and how much of each package has been downloaded to the computer. You can also start and stop package downloads, and repair the user state. A repair will delete all user data that is associated with a package. - -- **APP CONNECTION GROUPS**: Displays all of the connection groups that are available to the current user. Click a specific connection group to see all of the packages that are part of the selected group. This displays information about connection groups that are already in use and how much of the connection group contents have been downloaded to the computer. Additionally, you can start and stop connection group downloads. You can use this section to initiate a repair. A repair will remove all of the user state that is associated a connection group. - - Associated Windows PowerShell cmdlets: - - - Download: `Mount-AppvClientConnectionGroup` - - Repair: `AppvClientConnectionGroup` - -For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). - -## Related articles - -[Operations for App-V](appv-operations.md) diff --git a/windows/application-management/app-v/appv-view-and-configure-applications-and-default-virtual-application-extensions-with-the-management-console.md b/windows/application-management/app-v/appv-view-and-configure-applications-and-default-virtual-application-extensions-with-the-management-console.md deleted file mode 100644 index 92b64eb2ec..0000000000 --- a/windows/application-management/app-v/appv-view-and-configure-applications-and-default-virtual-application-extensions-with-the-management-console.md +++ /dev/null @@ -1,40 +0,0 @@ ---- -title: How to View and Configure Applications and Default Virtual Application Extensions by Using the Management Console (Windows 10/11) -description: How to View and Configure Applications and Default Virtual Application Extensions by Using the Management Console -author: aczechowski -ms.prod: windows-client -ms.date: 04/19/2017 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.technology: itpro-apps ---- - -# How to View and Configure Applications and Default Virtual Application Extensions by Using the Management Console - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -Use the following procedure to view and configure default package extensions. - -**To view and configure default virtual application extensions** - -1. To view the package that you want to configure, open the App-V Management Console. Select the package that you want to configure, right-click the package name and select **edit default configuration**. - -2. To view the applications contained in the specified package, in the **Default Configuration** pane, click **Applications**. To view the shortcuts for that package, click **Shortcuts**. To view the file type associations for that package, click **File Types**. - -3. To enable the application extensions, select **ENABLE**. - - To enable shortcuts, select **ENABLE SHORTCUTS**. To add a new shortcut for the selected application, right-click the application in the **SHORTCUTS** pane and select **Add new shortcut**. To remove a shortcut, right-click the application in the **SHORTCUTS** pane and select **Remove Shortcut**. To edit an existing shortcut, right-click the application and select **Edit Shortcut**. - -4. To view any other application extensions, click **Advanced** and click **Export Configuration**. Type in a filename and click **Save**. You can view all application extensions associated with the package using the configuration file. - -5. To edit other application extensions, modify the configuration file and click **Import and Overwrite this Configuration**. Select the modified file and click **Open**. In the dialog box, click **Overwrite** to complete the process. - - - -
                        For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). - -## Related articles - -[Operations for App-V](appv-operations.md) diff --git a/windows/application-management/app-v/appv-viewing-appv-server-publishing-metadata.md b/windows/application-management/app-v/appv-viewing-appv-server-publishing-metadata.md deleted file mode 100644 index ed8de7183d..0000000000 --- a/windows/application-management/app-v/appv-viewing-appv-server-publishing-metadata.md +++ /dev/null @@ -1,98 +0,0 @@ ---- -title: Viewing App-V Server Publishing Metadata (Windows 10/11) -description: Use this procedure to view App-V Server publishing metadata, which can help you resolve publishing-related issues. -author: aczechowski -ms.prod: windows-client -ms.date: 04/19/2017 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.technology: itpro-apps ---- - -# Viewing App-V Server Publishing Metadata - -**Applies to** -- Windows Server 2016 - -Use this procedure to view App-V Server publishing metadata, which can help you resolve publishing-related issues. You must be using the App-V Management server to use this procedure. - -This article contains the following information: - -- [Definition of publishing metadata](#bkmk-whatis-pub-metadata) - -- [Syntax to use for viewing publishing metadata](#bkmk-syntax-view-pub-meta) - -- [Query values for client operating system](#bkmk-values-query-pub-meta) - -## Definition of publishing metadata - -When packages are published to a computer that is running the App-V client, metadata is sent to that computer indicating which packages and connection groups are being published. The App-V Client makes two separate requests for the following: - -- Packages and connection groups that are entitled to the client computer. - -- Packages and connection groups that are entitled to the current user. - -The Publishing server communicates with the Management server to determine which packages and connection groups are available to the requester. The Publishing server must be registered with the Management server in order for the metadata to be generated. - -You can view the metadata for each request in an Internet browser by using a query that is in the context of the specific user or computer. - -## Query syntax for viewing publishing metadata - -This section provides information about queries for viewing publishing metadata for App-V 5.0 SP3 Server and App-V 5.1 server. The App-V server components have not changed since App-V 5.0 was released, so App-V 5.x Server is the version of the server used with App-V for Windows client. - -**Query syntax** - -`http://:/?ClientVersion=&ClientOS=` - -For information about the variables in this syntax, see the table that follows. - -**Query example** - -`http://pubsvr01:2718/?ClientVersion=10.0.14393&ClientOS=WindowsClient_10.0_x64` - -In this example: - -- A computer running Windows Server 2016 named “pubsvr01” hosts the Publishing service. - -- The Windows client is 64-bit. - -**Query parameter descriptions** - -The following table describes the parameters shown in the preceding **Query syntax**. - -| Parameter | Description | -|------------|---------------| -| `` | Name of the App-V Publishing server. | -| `` | Port to the App-V Publishing server, which you defined when you configured the Publishing server. | -| `ClientVersion=` | Windows client build number. You can obtain this number by running the following Windows PowerShell command:
                        `(Get-CimInstance Win32_OperatingSystem).version` | -| `ClientOS=` | Operating system of the computer that is running the App-V client. Refer to the table that follows for the correct value.
                        You can omit this parameter, with the result that only the packages that were sequenced to support all operating systems will appear in the metadata. | - -To get the name of the Publishing server and the port number (`http://:`) from the App-V client, look at the URL configuration of the Get-AppvPublishingServer Windows PowerShell cmdlet. - -## Query values for client operating system - -In your publishing metadata query, enter the string values that correspond to the client operating system that you’re using. - -|Operating system|Architecture|String value| -|--- |--- |--- | -|Windows 10/11|64-bit|WindowsClient_10.0_x64| -|Windows 10/11|32-bit|WindowsClient_10.0_x86| -|Windows 8.1|64-bit|WindowsClient_6.2_x64| -|Windows 8.1|32-bit|WindowsClient_6.2_x86| -|Windows 8|64-bit|WindowsClient_6.2_x64| -|Windows 8|32-bit|WindowsClient_6.2_x86| -|Windows Server 2012 R2|64-bit|WindowsServer_6.2_x64| -|Windows Server 2012 R2|32-bit|WindowsServer_6.2_x86| -|Windows Server 2012|64-bit|WindowsServer_6.2_x64| -|Windows Server 2012|32-bit|WindowsServer_6.2_x86| -|Windows Server 2008 R2|64-bit|WindowsServer_6.1_x64| -|Windows Server 2008 R2|32-bit|WindowsServer_6.1_x86| - - -
                        For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). - -## Related articles - -[Technical Reference for App-V](appv-technical-reference.md) diff --git a/windows/application-management/app-v/images/app-v-in-adk.png b/windows/application-management/app-v/images/app-v-in-adk.png deleted file mode 100644 index a36ef9f00f..0000000000 Binary files a/windows/application-management/app-v/images/app-v-in-adk.png and /dev/null differ diff --git a/windows/application-management/app-v/images/checklistbox.gif b/windows/application-management/app-v/images/checklistbox.gif deleted file mode 100644 index cbcf4a4f11..0000000000 Binary files a/windows/application-management/app-v/images/checklistbox.gif and /dev/null differ diff --git a/windows/application-management/app-v/images/packageaddfileandregistrydata-global.png b/windows/application-management/app-v/images/packageaddfileandregistrydata-global.png deleted file mode 100644 index 775e290a36..0000000000 Binary files a/windows/application-management/app-v/images/packageaddfileandregistrydata-global.png and /dev/null differ diff --git a/windows/application-management/app-v/images/packageaddfileandregistrydata-stream.png b/windows/application-management/app-v/images/packageaddfileandregistrydata-stream.png deleted file mode 100644 index 0e1205c62b..0000000000 Binary files a/windows/application-management/app-v/images/packageaddfileandregistrydata-stream.png and /dev/null differ diff --git a/windows/application-management/app-v/images/packageaddfileandregistrydata.png b/windows/application-management/app-v/images/packageaddfileandregistrydata.png deleted file mode 100644 index 603420e627..0000000000 Binary files a/windows/application-management/app-v/images/packageaddfileandregistrydata.png and /dev/null differ diff --git a/windows/application-management/docfx.json b/windows/application-management/docfx.json index 8b50896c5a..4f5ec979b0 100644 --- a/windows/application-management/docfx.json +++ b/windows/application-management/docfx.json @@ -39,11 +39,11 @@ "ms.collection": [ "tier2" ], + "zone_pivot_group_filename": "resources/zone-pivot-groups.json", "uhfHeaderId": "MSDocsHeader-Windows", - "ms.technology": "itpro-apps", - "ms.topic": "article", - "feedback_system": "GitHub", - "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", + "ms.service": "windows-client", + "ms.subservice": "itpro-apps", + "feedback_system": "Standard", "feedback_product_url": "https://support.microsoft.com/windows/send-feedback-to-microsoft-with-the-feedback-hub-app-f59187f8-8739-22d6-ba93-f66612949332", "_op_documentIdPathDepotMapping": { "./": { @@ -53,27 +53,24 @@ }, "titleSuffix": "Windows Application Management", "contributors_to_exclude": [ - "rjagiewich", - "traya1", - "rmca14", - "claydetels19", + "dstrome2", + "rjagiewich", + "American-Dipper", + "claydetels19", "jborsecnik", - "tiburd", - "garycentric", - "beccarobins", + "v-stchambers", + "shdyas", "Stacyrch140", - "v-stsavell", - "American-Dipper" + "garycentric", + "dstrome", + "beccarobins" ], - "searchScope": ["Windows 10"] - }, - "fileMetadata": { - "feedback_system": { - "app-v/**/*.*": "None" - } + "searchScope": [ + "Windows 10" + ] }, "template": [], "dest": "win-app-management", "markdownEngineName": "markdig" } -} +} \ No newline at end of file diff --git a/windows/application-management/enterprise-background-activity-controls.md b/windows/application-management/enterprise-background-activity-controls.md index 1ed95c362a..2a00963aef 100644 --- a/windows/application-management/enterprise-background-activity-controls.md +++ b/windows/application-management/enterprise-background-activity-controls.md @@ -6,8 +6,8 @@ ms.author: aaroncz manager: aaroncz ms.date: 10/03/2017 ms.topic: article -ms.prod: windows-client -ms.technology: itpro-apps +ms.service: windows-client +ms.subservice: itpro-apps ms.localizationpriority: medium ms.collection: tier2 ms.reviewer: diff --git a/windows/application-management/images/insider.png b/windows/application-management/images/insider.png new file mode 100644 index 0000000000..dbe00408cb Binary files /dev/null and b/windows/application-management/images/insider.png differ diff --git a/windows/application-management/includes/app-v-end-life-statement.md b/windows/application-management/includes/app-v-end-life-statement.md index f9844e71b1..932390fc2d 100644 --- a/windows/application-management/includes/app-v-end-life-statement.md +++ b/windows/application-management/includes/app-v-end-life-statement.md @@ -4,9 +4,7 @@ ms.author: aaroncz manager: aaroncz ms.date: 09/20/2021 ms.topic: include -ms.prod: w10 -ms.collection: tier1 -ms.reviewer: +ms.service: windows-client --- Application Virtualization will be [end of life in April 2026](/lifecycle/announcements/mdop-extended). We recommend looking at Azure Virtual Desktop with MSIX app attach. For more information, see [What is Azure Virtual Desktop?](/azure/virtual-desktop/overview) and [Set up MSIX app attach with the Azure portal](/azure/virtual-desktop/app-attach-azure-portal). diff --git a/windows/application-management/includes/applies-to-windows-client-versions.md b/windows/application-management/includes/applies-to-windows-client-versions.md index 35084641c6..f4b2934ded 100644 --- a/windows/application-management/includes/applies-to-windows-client-versions.md +++ b/windows/application-management/includes/applies-to-windows-client-versions.md @@ -5,8 +5,8 @@ manager: aaroncz ms.date: 09/28/2021 manager: aaroncz ms.topic: include -ms.prod: windows-client -ms.technology: itpro-apps +ms.service: windows-client +ms.subservice: itpro-apps ms.localizationpriortiy: medium ms.collection: tier1 ms.reviewer: diff --git a/windows/application-management/includes/insider-note.md b/windows/application-management/includes/insider-note.md new file mode 100644 index 0000000000..a1160f8047 --- /dev/null +++ b/windows/application-management/includes/insider-note.md @@ -0,0 +1,16 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.topic: include +ms.date: 01/11/2024 +--- + +:::row::: +:::column span="1"::: +:::image type="content" source="../images/insider.png" alt-text="Logo of Windows Insider." border="false"::: +:::column-end::: +:::column span="3"::: +> [!IMPORTANT] +>This article describes features or settings that are under development and only applicable to [Windows Insider Preview builds](/windows-insider/). The content is subject to change and may have dependencies on other features or services in preview. +:::column-end::: +:::row-end::: diff --git a/windows/application-management/index.yml b/windows/application-management/index.yml index 46ff46e15f..ae406114d7 100644 --- a/windows/application-management/index.yml +++ b/windows/application-management/index.yml @@ -9,9 +9,10 @@ metadata: author: aczechowski ms.author: aaroncz manager: aaroncz - ms.date: 08/18/2023 + ms.date: 06/28/2024 ms.topic: landing-page - ms.prod: windows-client + ms.service: windows-client + ms.subservice: itpro-apps ms.collection: - tier1 @@ -39,22 +40,3 @@ landingContent: url: per-user-services-in-windows.md - text: Changes to Service Host grouping in Windows 10 url: svchost-service-refactoring.md - - - title: Application Virtualization (App-V) - linkLists: - - linkListType: overview - links: - - text: App-V overview - url: app-v/appv-for-windows.md - - text: Getting started with App-V - url: app-v/appv-getting-started.md - - text: Planning for App-V - url: app-v/appv-planning-for-appv.md - - text: Deploying App-V - url: app-v/appv-deploying-appv.md - - text: Operations for App-V - url: app-v/appv-operations.md - - text: Troubleshooting App-V - url: app-v/appv-troubleshooting.md - - text: Technical Reference for App-V - url: app-v/appv-technical-reference.md diff --git a/windows/application-management/overview-windows-apps.md b/windows/application-management/overview-windows-apps.md index 1c54d148ce..7188ebe6e0 100644 --- a/windows/application-management/overview-windows-apps.md +++ b/windows/application-management/overview-windows-apps.md @@ -4,10 +4,10 @@ description: Learn about the different types of apps that run on Windows. For ex author: aczechowski ms.author: aaroncz manager: aaroncz -ms.date: 08/28/2023 +ms.date: 06/28/2024 ms.topic: overview -ms.prod: windows-client -ms.technology: itpro-apps +ms.service: windows-client +ms.subservice: itpro-apps ms.localizationpriority: medium ms.collection: tier2 appliesto: @@ -31,7 +31,7 @@ For more information on deploying Microsoft 365 apps, see the [Deployment guide ### Power Apps -These apps are custom, low-code apps to connect to business data, modernize processes, and solve unique challenges. Power Apps are available online and on-premises, can run in a web browser, and on mobile devices. They can be created by business analysts and professional developers. +These apps are custom, low-code apps to connect to business data, modernize processes, and solve unique challenges. Power Apps are available online and on-premises, can run in a web browser, and on mobile devices. They can be created by business analysts and professional developers. For more information, see [What is Power Apps?](/power-apps/powerapps-overview). @@ -182,7 +182,7 @@ App-V allows Win32 apps to be used as virtual apps. On an on-premises server, you install and configure the App-V server components, and then install your Win32 apps. On Windows Enterprise client devices, you use the App-V client components to run the virtualized apps. They allow users to open the virtual apps using the icons and file names they're familiar with. Users use the apps as if they're installed locally. -The benefit is to deliver virtual apps in real time, and as-needed. For more information, see [Application Virtualization (App-V) for Windows overview](./app-v/appv-for-windows.md). +The benefit is to deliver virtual apps in real time, and as-needed. For more information, see [Application Virtualization (App-V) for Windows overview](/microsoft-desktop-optimization-pack/app-v/appv-for-windows). ## Manage apps diff --git a/windows/application-management/per-user-services-in-windows.md b/windows/application-management/per-user-services-in-windows.md index 200ea7e859..9e6cefb8ae 100644 --- a/windows/application-management/per-user-services-in-windows.md +++ b/windows/application-management/per-user-services-in-windows.md @@ -1,81 +1,152 @@ --- title: Per-user services -description: Learn about per-user services, how to change the template service Startup Type, and manage per-user services through Group Policy and security templates. +description: Learn about per-user services, how to change the template service startup type, and manage per-user services through group policy and security templates. author: aczechowski ms.author: aaroncz manager: aaroncz -ms.date: 09/14/2017 +ms.date: 12/22/2023 ms.topic: how-to -ms.prod: windows-client -ms.technology: itpro-apps +ms.service: windows-client +ms.subservice: itpro-apps ms.localizationpriority: medium ms.collection: tier2 appliesto: + - ✅ Windows 11 - ✅ Windows 10 - ✅ Windows Server --- # Per-user services in Windows -Per-user services are services that are created when a user signs into Windows or Windows Server and are stopped and deleted when that user signs out. These services run in the security context of the user account - this provides better resource management than the previous approach of running these kinds of services in Explorer, associated with a preconfigured account, or as tasks. +When a user signs in to Windows, the OS creates *per-user services*. When the user signs out, these services are stopped and deleted. They run in the security context of the user account instead of a built-in security principal. This behavior provides better resource management than the previous approach of running these services associated with a preconfigured account or as tasks. > [!NOTE] -> Per-user services are only in available in Windows Server if you have installed the Desktop Experience. If you are running a Server Core or Nano Server installation, you won't see these services. +> Per-user services are only available in Windows Server if you install the Desktop Experience. For more information, see [Server Core vs Server with Desktop Experience install options](/windows-server/get-started/install-options-server-core-desktop-experience). -You can set the template service's **Startup Type** to **Disabled** to create per-user services in a stopped and disabled state. +Windows creates these per-user services based on templates defined in the registry. If you need to manage or control behaviors of these services, you can adjust the template. For example, you can set a template service's startup type to **Disabled**. In this example, Windows creates the per-user service in a stopped and disabled state. > [!IMPORTANT] -> Carefully test any changes to the template service's Startup Type before deploying to a production environment. +> Carefully test any changes to the template service's configuration before you broadly deploy them to a production environment. -Use the following information to understand per-user services, change the template service Startup Type, and manage per-user services through Group Policy and security templates. -For more information about disabling system services for Windows Server, see [Guidance on disabling system services on Windows Server with Desktop Experience](/windows-server/security/windows-services/security-guidelines-for-disabling-system-services-in-windows-server). +Use the information in this article to understand per-user services, configure user service templates, and manage per-user services through group policy and security templates. -## Per-user services +## List of per-user services -The following table lists per-user services and when they were added to Windows 10 and Windows Server with the Desktop Experience. The template services are located in the registry at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services. +The following table lists per-user services in the current version of Windows. Other versions of Windows 10/11 might not have the same services available. -Before you disable any of these services, review the **Description** column in this table to understand the implications, including dependent apps that will no longer work correctly. +Before you reconfigure any of these services, review this information to understand the implications. For example, if you disable the per-user service, there might be dependent apps that don't work correctly. -| Windows version | Key name | Display name | Default start type | Dependencies | Description | -|-----------------|------------------------|-----------------------------------------|--------------------|--------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| 1803 | BcastDVRUserService | GameDVR and Broadcast User Service | Manual | | Used for Game Recordings and Live Broadcasts | -| 1803 | BluetoothUserService | Bluetooth User Support Service | Manual | | Supports proper functionality of Bluetooth features relevant to each user session | -| 1803 | CaptureService | CaptureService | Manual | | OneCore Capture Service | -| 1607 | CDPUserSvc | CDPUserSvc | Auto | - Network Connection Broker
                        - Remote Procedure Call (RPC)
                        - TCP/IP Protocol Driver | Used for Connected Devices Platform scenarios | -| 1803 | DevicePickerUserSvc | DevicePicker | Manual | | Device Picker | -| 1703 | DevicesFlowUserSvc | DevicesFlow | Manual | | Device Discovery and Connecting | -| 1703 | MessagingService | MessagingService | Manual | | Service supporting text messaging and related functionality | -| 1607 | OneSyncSvc | Sync Host | Auto (delayed) | | Synchronizes mail, contacts, calendar, and other user data. Mail and other applications dependent on this service don't work correctly when this service isn't running. | -| 1607 | PimIndexMaintenanceSvc | Contact Data | Manual | UnistoreSvc | Indexes contact data for fast contact searching. If you stop or disable this service, search results might not display all contacts. | -| 1709 | PrintWorkflowUserSvc | PrintWorkflow | Manual | | Print Workflow | -| 1607 | UnistoreSvc | User Data Storage | Manual | | Handles storage of structured user data, including contact info, calendars, and messages. If you stop or disable this service, apps that use this data might not work correctly. | -| 1607 | UserDataSvc | User Data Access | Manual | UnistoreSvc | Provides apps access to structured user data, including contact info, calendars, and messages. If you stop or disable this service, apps that use this data might not work correctly. | -| 1607 | WpnUserService | Windows Push Notifications User Service | Manual | | Hosts Windows notification platform, which provides support for local and push notifications. Supported notifications are tile, toast, and raw. | +| Display name | Service name | Default start type | Dependencies | Description | +|--|--|--|--|--| +| **Agent Activation Runtime** | AarSvc | Manual | | Runtime for activating conversational agent applications. | +| **Bluetooth User Support Service** | BluetoothUserService | Manual | | Supports proper functionality of Bluetooth features relevant to each user session. | +| **OneCore Capture Service** | CaptureService | Manual | | Enables optional screen capture functionality for applications that call [screen capture](/windows/uwp/audio-video-camera/screen-capture) APIs of the [Windows.Graphics.Capture](/uwp/api/windows.graphics.capture) namespace. | +| **Clipboard User Service** | cbdhsvc | Automated (Delayed Start) | | Windows uses this user service for clipboard scenarios. For example, clipboard history or sync across devices. For more information, see [Clipboard in Windows](https://support.microsoft.com/windows/clipboard-in-windows-c436501e-985d-1c8d-97ea-fe46ddf338c6). | +| **Cloud Backup and Restore Service** | CloudBackupRestoreSvc | Manual | | Monitors the system for changes in application and setting states. When required, this service does cloud backup and restore operations. | +| **Connected Devices Platform User Service** | CDPUserSvc | Automatic | - Network Connection Broker
                        - Remote Procedure Call (RPC)
                        - TCP/IP Protocol Driver | This service allows the user to connect, manage, and control connected devices. These connected devices include mobile, Xbox, HoloLens, or smart/IoT devices. For one specific example, see [Share things with nearby devices in Windows](https://support.microsoft.com/windows/share-things-with-nearby-devices-in-windows-0efbfe40-e3e2-581b-13f4-1a0e9936c2d9). | +| **Consent UX User Service** | ConsentUxUserSvc | Manual | | Allows the system to request user consent to allow apps to access sensitive resources and information such as the device's location. | +| **Contact Data** | PimIndexMaintenanceSvc | Manual | UnistoreSvc | Indexes contact data for fast contact searching. If you stop or disable this service, contacts might be missing from your search results. | +| **Credential Enrollment Manager** | CredentialEnrollmentManagerUserSvc | Manual | | This service supports the secure storage and retrieval of user credentials. For example, tokens for web sites, remote desktop connections, or other apps. | +| **Device Association Broker** | DeviceAssociationBrokerSvc | Manual | - DevicePicker
                        - Shell Pairing UX | Supports in-app pairing and access checks for new device scenarios. | +| **Device Picker** | DevicePickerUserSvc | Manual | | Windows uses this user service to manage Miracast, Digital Living Network Alliance (DLNA), and Discovery and Launch (DIAL) experiences. | +| **Devices Flow** | DevicesFlowUserSvc | Manual | | Allows the Connect user interface and Settings app to connect and pair with WiFi displays and Bluetooth devices. | +| **Game DVR and Broadcast User Service** | BcastDVRUserService | Manual | | Windows uses this user service for game recordings and live broadcasts. | +| **Messaging Service** | MessagingService | Manual | | This service supports text messaging and related functionality. | +| **Now Playing Session Manager** | NPSMSvc | Manual | | The *now playing session manager* (NPSM) service manages media sessions running on the device. | +| **Plan 9 Redirector Service** | P9RdrService | Manual | | Enables trigger-starting plan9 file servers, which are supported by [Windows Subsystem for Linux](/windows/wsl/). For more information, see [Plan 9 from Bell Labs](https://wikipedia.org/wiki/Plan_9_from_Bell_Labs). | +| **Pen Service** | PenService | Manual | | When you press the tail button on a pen input device, this service responds to those actions. It can launch applications or take another action that you customize in Settings. For more information, see user documentation on [How to use your Surface Pen](https://support.microsoft.com/surface/how-to-use-your-surface-pen-8a403519-cd1f-15b2-c9df-faa5aa924e98) or hardware developer documentation on [Pen devices](/windows-hardware/design/component-guidelines/pen-devices). | +| **Print Workflow** | PrintWorkflowUserSvc | Manual | | Provides support for [Print Workflow](/windows/uwp/devices-sensors/print-workflow-customize) applications. If you turn off this service, some printing functions might not work successfully. | +| **Sync Host** | OneSyncSvc | Automated (Delayed Start) | | This service synchronizes mail, contacts, calendar, and other user data. When this service is stopped, mail and other applications dependent on this functionality don't work properly. | +| **UDK User Service** | UdkUserSvc | Manual | | Windows uses this service to coordinate between shell experiences. | +| **User Data Access** | UserDataSvc | Manual | UnistoreSvc | Provides apps access to structured user data, including contact info, calendars, messages, and other content. If you stop or disable this service, apps that use this data might not work correctly. | +| **User Data Storage** | UnistoreSvc | Manual | | Handles storage of structured user data, including contact info, calendars, messages, and other content. If you stop or disable this service, apps that use this data might not work correctly. | +| **Web Threat Defense User Service** | webthreatdefusersvc | Automatic | | This service helps protect your computer by warning the user when unauthorized entities attempt to gain access to their credentials. | +| **Windows Push Notifications User Service** | WpnUserService | Automatic | | This service hosts the [Windows push notification services](/windows/apps/design/shell/tiles-and-notifications/windows-push-notification-services--wns--overview) (WNS) platform, which provides support for local and push notifications. Supported notifications are tile, toast, and raw. | -## Disable per-user services +## View per-user services -The template service isn't displayed in the Services console (services.msc) so you need to edit the registry directly, either with Group Policy or a scripted solution, to disable a per-user service. +You can't view the user service templates outside of the Windows Registry, but you can see the user-specific per-user services. Windows displays these services with the following format: `_LUID` where `` is the display name of the user service and `LUID` is a locally unique identifier for the user context. + +For example, you might see the following per-user service names: + +- `Contact Data_443f50` +- `Sync Host_443f50` +- `User Data Access_443f50` +- `User Data Storage_443f50` > [!NOTE] -> Disabling a per-user service simply means that it is created in a stopped and disabled state. When the user signs out, the per-user service is removed. +> The display name and the service name for all per-user services include the same LUID suffix. -You can't manage all of the per-user service templates services using normal Group Policy management methods. Because the per-user services aren't displayed in the Services management console, they're also not displayed in the Group Policy Services policy editor UI. +### View per-user services in the Windows Services console + +When you sign in to Windows, run `services.msc` to open the Services console. When you view the local machine, you can see these services for your user account. + +### View per-user services using Windows PowerShell + +The following PowerShell script is an example of how to query for per-user services. It queries for service type values that include the `64` bit value. + +```powershell +# Define the bit value for per-user services in the ServiceType property of a service object +$flag = 64 + +# Define an empty array to store the resulting services that match the criteria +$serviceList = @() + +# Get all services on the computer and store them in the variable +$services = Get-Service + +# Loop through each service in the array of services. +foreach ( $service in $services ) { + # For each specific service, check if the service type property includes the 64 bit using the bitwise AND operator (-band). + # If the result equals the flag value, then the service is a per-user service. + if ( ( $service.ServiceType -band $flag ) -eq $flag ) { + # When a per-user service is found, then add that service object to the results array. + $serviceList += $service + } +} + +# Display the results array, sorted by display name, in a table format with the specified properties. +$serviceList | Sort-Object DisplayName | Format-Table DisplayName, Name, StartType, ServiceType +``` + +### View per-user services from the command line + +Run `cmd.exe` to open a Windows command prompt. Use the `sc qc` command to query these services. The **Type** value indicates whether the service is a user-service template or user-service instance. + +The following example queries for the template and user-specific instance of the **Game DVR and Broadcast User Service** (`BcastDVRUserService`) service: + +```cmd +sc qc BcastDVRUserService +sc qc BcastDVRUserService_18f113 +``` + +:::image type="content" source="media/cmd-type.png" alt-text="Screenshot of a Windows command line session running sc.exe qc on two services and highlighting the type values in the output."::: + +## How to disable per-user services + +The templates for user services aren't displayed in the **Services** console (services.msc). To disable a per-user service, you need to directly edit the registry, either with group policy or a scripted solution. The templates are located in the registry at `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services`. + +> [!NOTE] +> When you disable a per-user service, Windows still creates it when the user signs in, but in a stopped and disabled state. When the user signs out, Windows removes the per-user service. + +You can't manage all of the per-user service templates using normal group policy management methods. Because the per-user services aren't displayed in the **Services** management console, they're also not displayed in the group policy services policy editor. + +Additionally, there are four user services that you can't manage with a security template: -Additionally, there are four template services that can't be managed with a security template: - PimIndexMaintenanceSvc - UnistoreSvc - UserDataSvc - WpnUserService -In light of these restrictions, you can use the following methods to manage per-user services template services: +With these restrictions, you can use the following methods to manage per-user service templates: -- A combination of a security template and a script or Group Policy preferences registry policy -- Group Policy preferences for all of the services -- A script for all of the services +- A combination of a security template and a script, or group policy preferences registry policy. +- Group policy preferences for all of the services. +- A script for all of the services. ### Manage template services using a security template -You can manage the CDPUserSvc and OneSyncSvc per-user services with a [security template](/windows/device-security/security-policy-settings/administer-security-policy-settings#bkmk-sectmpl). For more information, visit [Administer security policy settings](/windows/device-security/security-policy-settings/administer-security-policy-settings). +You can manage the CDPUserSvc and OneSyncSvc per-user services with a [security template](/windows/security/threat-protection/security-policy-settings/administer-security-policy-settings#security-templates). For example: @@ -89,41 +160,74 @@ Revision=1 "CDPUserSVC".4,"" ``` -### Manage template services using Group Policy preferences +### Use a script to manage per-user services -If a per-user service can't be disabled using the security template, you can disable it by using Group Policy preferences. +You can create a script to change the startup type for the per-user services. Then use group policy or another management solution such as Microsoft Configuration Manager to deploy the script to targeted devices. -1. On a Windows Server domain controller or Windows 10 PC that has the [Remote Server Administration Tools (RSAT)](https://www.microsoft.com/download/details.aspx?id=45520) installed, select **Start**, type GPMC.MSC, and then press **Enter** to open the **Group Policy Management Console**. +#### Example 1: Use the `Set-Service` PowerShell cmdlet -2. Create a new Group Policy Object (GPO) or use an existing GPO. +The following sample script uses the [Set-Service](/powershell/module/microsoft.powershell.management/set-service) PowerShell cmdlet to configure the PimIndexMaintenanceSvc service start type to disabled: -3. Right-click the GPO and select **Edit** to launch the Group Policy Object Editor. +```powershell +Set-Service -Name PimIndexMaintenanceSvc -StartupType Disabled +``` -4. Depending on how you want to target the Group Policy, under **Computer configuration** or **User configuration** browse to Preferences\Windows Settings\Registry. +#### Example 2: Use the `sc.exe config` command line -5. Right-click **Registry** > **New** > **Registry Item**. +The following sample script uses [`sc.exe config`](/windows-server/administration/windows-commands/sc-config) to configure the PimIndexMaintenanceSvc service start type to disabled: - ![Group Policy preferences disabling per-user services.](media/gpp-per-user-services.png) - -6. Make sure that HKEY_Local_Machine is selected for Hive and then select ... (the ellipses) next to Key Path. +```cmd +sc.exe configure PimIndexMaintenanceSvc start= disabled +``` - ![Choose HKLM.](media/gpp-hklm.png) - -7. Browse to **System\CurrentControlSet\Services\PimIndexMaintenanceSvc**. In the list of values, highlight **Start** and select **Select**. +> [!NOTE] +> The space after `=` is intentional. - ![Select Start.](media/gpp-svc-start.png) - -8. Change **Value data** from **00000003** to **00000004** and select **OK**. Note setting the Value data to **4** = **Disabled**. +### Manage template services using group policy preferences - ![Startup Type is Disabled.](media/gpp-svc-disabled.png) - -9. To add the other services that can't be managed with Group Policy templates, edit the policy and repeat steps 5-8. +If you can't disable a per-user service with the security template, use group policy preferences. -### Managing Template Services with reg.exe +1. Open the **Group Policy Management Console** (gpmc.msc). -If you can't use Group Policy Preferences to manage the per-user services, you can edit the registry with reg.exe. -To disable the Template Services, change the Startup Type for each service to 4 (disabled). -For example: +1. Create a new group policy object (GPO) or use an existing GPO. + +1. **Edit** the GPO to launch the group policy object editor. + +1. Depending on how you want to target the group policy, under **Computer configuration** or **User configuration** browse to **Preferences**, **Windows Settings**, and select **Registry**. + +1. Go to the **Action** menu, select **New**, and select **Registry Item**. + + :::image type="content" source="media/gpp-per-user-services.png" alt-text="Screenshot of the Group Policy Management Editor highlighting the contextual menu on registry preferences to create a new registry item."::: + +1. For the **Hive** select `HKEY_LOCAL_MACHINE`. + + :::image type="content" source="media/gpp-hklm.png" alt-text="Screenshot of the New Registry Properties window highlighting the Hive value set to HKEY_LOCAL_MACHINE."::: + +1. Select the ellipses (`...`) next to **Key Path**. Browse to `System\CurrentControlSet\Services` and then select the user service template. For example, `PimIndexMaintenanceSvc`. In the list of values, highlight **Start** and select **Select**. + + :::image type="content" source="media/gpp-svc-start.png" alt-text="Screenshot of the Registry Item Browser window with the PimIndexMaintenanceSvc registry item selected, and the Start value selected."::: + +1. In the **Start Properties** window, Change **Value data** from `00000003` to `00000004` and select **OK**. Note setting the Value data to **4** = **Disabled**. + + :::image type="content" source="media/gpp-svc-disabled.png" alt-text="Screenshot of the Start Properties window highlighting the Value data field with the value 00000004."::: + + > [!NOTE] + > The service start value `4` is **Disabled**. + +1. To add the other services that can't be managed with group policy templates, edit the policy and repeat the previous steps. + +### Managing user service templates with the Windows Registry + +If you can't use group policy preferences to manage the per-user services, you can edit the Windows Registry. To disable a user service template, change the startup type for each service to `4`, which is **Disabled**. + +> [!CAUTION] +> Don't directly edit the registry unless there's no other alternative. The Registry Editor or Windows don't validate these manual modifications to the registry. Incorrect values can be stored, which can result in unrecoverable errors in the system. When possible, instead of editing the registry directly, use group policy or other supported Windows tools to accomplish these tasks. If you must edit the registry, use extreme caution. + +#### Example 1: Use the `reg.exe` command line command to edit the registry + +1. As an administrator, run `cmd.exe` to open a Windows command prompt. + +1. The following example includes multiple commands that disable the specified Windows services by changing their **Start** value in the Windows Registry to `4`: ```cmd REG.EXE ADD HKLM\System\CurrentControlSet\Services\CDPUserSvc /v Start /t REG_DWORD /d 4 /f @@ -132,60 +236,26 @@ REG.EXE ADD HKLM\System\CurrentControlSet\Services\PimIndexMaintenanceSvc /v Sta REG.EXE ADD HKLM\System\CurrentControlSet\Services\UnistoreSvc /v Start /t REG_DWORD /d 4 /f REG.EXE ADD HKLM\System\CurrentControlSet\Services\UserDataSvc /v Start /t REG_DWORD /d 4 /f REG.EXE ADD HKLM\System\CurrentControlSet\Services\WpnUserService /v Start /t REG_DWORD /d 4 /f -``` - -> [!CAUTION] -> We recommend that you do not directly edit the registry unless there is no other alternative. Modifications to the registry are not validated by the Registry Editor or by the Windows operating system before they are applied. As a result, incorrect values can be stored, and this can result in unrecoverable errors in the system. When possible, instead of editing the registry directly, use Group Policy or other Windows tools such as the Microsoft Management Console (MMC) to accomplish tasks. If you must edit the registry, use extreme caution. - -### Managing Template Services with regedit.exe - -If you can't use Group Policy preferences to manage the per-user services, you can edit the registry with regedit.exe. To disable the template services, change the Startup Type for each service to 4 (disabled): - -![Using Regedit to change servive Starup Type.](media/regedit-change-service-startup-type.png) - -> [!CAUTION] -> We recommend that you do not directly edit the registry unless there is no other alternative. Modifications to the registry are not validated by the Registry Editor or by the Windows operating system before they are applied. As a result, incorrect values can be stored, and this can result in unrecoverable errors in the system. When possible, instead of editing the registry directly, use Group Policy or other Windows tools such as the Microsoft Management Console (MMC) to accomplish tasks. If you must edit the registry, use extreme caution. - -Beginning with Windows 10, version 1709 and Windows Server, version 1709, you can prevent the per-user service from being created by setting **UserServiceFlags** to 0 under the same service configuration in the registry: - -![Create per-user services in disabled state.](media/user-service-flag.png) - -### Manage template services by modifying the Windows image - -If you're using custom images to deploy Windows, you can modify the Startup Type for the template services as part of the normal imaging process. - -### Use a script to manage per-user services - -You can create a script to change the Startup Type for the per-user services. Then use Group Policy or another management solution to deploy the script in your environment. - -Sample script using [sc.exe](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc990290(v=ws.11)?f=255&MSPPError=-2147217396): - -```cmd -sc.exe configure start= disabled ``` -The space after "=" is intentional. +#### Example 2: Use the Registry Editor user interface to edit the registry -Sample script using the [Set-Service PowerShell cmdlet](/previous-versions/windows/it-pro/windows-powershell-1.0/ee176963(v=technet.10)): +1. As an administrator, run `regedit.exe` to open the Registry Editor. -```powershell -Set-Service -StartupType Disabled -``` +1. Browse to `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services` and then select the user service template. For example, `CDPSvc`. -## View per-user services in the Services console (services.msc) +1. In the list of values, open the **Start** value. -As mentioned you can't view the template services in the Services console, but you can see the user-specific per-user services - they're displayed using the \_LUID format (where LUID is the locally unique identifier). +1. Change the **Value data** to `4`. -For example, you might see the following per-user services listed in the Services console: +:::image type="content" source="media/regedit-change-service-startup-type.png" alt-text="Screenshot of the Registry Editor open to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\CDPSvc and highlighting the Start value set to 4."::: -- CPDUserSVC_443f50 -- ContactData_443f50 -- Sync Host_443f50 -- User Data Access_443f50 -- User Data Storage_443f50 +#### Example 3: Prevent the creation of per-user services -## View per-user services from the command line +You can prevent Windows from creating a per-user service when a user signs on. In the same service template node of the registry, set `UserServiceFlags` to `0`. -You can query the service configuration from the command line. The **Type** value indicates whether the service is a user-service template or user-service instance. +:::image type="content" source="media/user-service-flag.png" alt-text="Screenshot of the Registry Editor open to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\PimIndexMaintenanceSvc highlighting the UserServiceFlag set to 0."::: -![Use sc.exe to view service type.](media/cmd-type.png) +## Next steps + +For more information about disabling system services for Windows Server, see [Guidance on disabling system services on Windows Server with Desktop Experience](/windows-server/security/windows-services/security-guidelines-for-disabling-system-services-in-windows-server). diff --git a/windows/application-management/private-app-repository-mdm-company-portal-windows-11.md b/windows/application-management/private-app-repository-mdm-company-portal-windows-11.md index cb4377d22d..90281afcd3 100644 --- a/windows/application-management/private-app-repository-mdm-company-portal-windows-11.md +++ b/windows/application-management/private-app-repository-mdm-company-portal-windows-11.md @@ -6,8 +6,8 @@ ms.author: aaroncz manager: aaroncz ms.date: 04/04/2023 ms.topic: article -ms.prod: windows-client -ms.technology: itpro-apps +ms.service: windows-client +ms.subservice: itpro-apps ms.localizationpriority: medium ms.collection: tier2 ms.reviewer: amanh diff --git a/windows/application-management/remove-provisioned-apps-during-update.md b/windows/application-management/remove-provisioned-apps-during-update.md index 23b08e028e..84cf6dc297 100644 --- a/windows/application-management/remove-provisioned-apps-during-update.md +++ b/windows/application-management/remove-provisioned-apps-during-update.md @@ -6,8 +6,8 @@ ms.author: aaroncz manager: aaroncz ms.date: 05/25/2018 ms.topic: how-to -ms.prod: windows-client -ms.technology: itpro-apps +ms.service: windows-client +ms.subservice: itpro-apps ms.localizationpriority: medium ms.collection: tier1 appliesto: diff --git a/windows/application-management/sideload-apps-in-windows-10.md b/windows/application-management/sideload-apps-in-windows-10.md deleted file mode 100644 index be0e459235..0000000000 --- a/windows/application-management/sideload-apps-in-windows-10.md +++ /dev/null @@ -1,104 +0,0 @@ ---- -title: Sideload line of business apps -description: Learn how to sideload line-of-business (LOB) apps in Windows client operating systems. When you sideload an app, you deploy a signed app package to a device. -author: aczechowski -ms.author: aaroncz -manager: aaroncz -ms.date: 12/07/2017 -ms.topic: how-to -ms.prod: windows-client -ms.technology: itpro-apps -ms.localizationpriority: medium -ms.collection: tier2 -appliesto: - - ✅ Windows 11 - - ✅ Windows 10 ---- - -# Sideload line of business (LOB) apps - -> [!NOTE] -> Starting with Windows 10 2004, sideloading is enabled by default. You can deploy a signed package onto a device without a special configuration. - -Sideloading apps is when you install apps that aren't from an official source, such as the Microsoft store. Your organization may create its own apps, including line-of-business (LOB) apps. Many organizations create their own apps to solve problems unique to their business. - -When you sideload an app, you deploy a signed app package to a device. You maintain the signing, hosting, and deployment of these apps. Sideloading was also available with Windows 8 and Windows 8.1 - -Starting with Windows 10, sideloading is different than earlier versions of Windows: - -- You can unlock a device for sideloading using an enterprise policy, or through the **Settings** app. -- License keys aren't required. -- Devices don't have to be joined to a domain. - -To allow these apps to run on your Windows devices, you might have to enable sideloading on your devices. - -This article shows you how to: - -- **Turn on sideloading**: You can deploy using Group Policy or a mobile device management (MDM) provider. Or, you can use the **Settings** app to turn on sideloading. -- **Install the app certificate**: Import the security certificate to the local device. This certificate tells the local device to trust the app. -- **Install the app**: Use Windows PowerShell to install the app package. - -## Prerequisites - -- Windows devices that are unlocked for sideloading (unlock policy enabled). Meaning, sideloading isn't blocked by a policy. -- A trusted certificate that's assigned to your app. -- An app package that's signed with your certificate. - -## Step 1: Turn on sideloading - -You can sideload apps on managed or unmanaged devices. - -Managed devices are typically owned by your organization. They're managed by Group Policy (on-premises), or a Mobile Device Management (MDM) provider, such as Microsoft Intune (cloud). Bring your own devices (BYOD) and personal devices can also be managed by your organization. On managed devices, you can create a policy that turns on sideloading, and then deploy this policy to your Windows devices. - -Unmanaged devices are devices that aren't managed by your organization. These devices are typically personal devices owned by users. Users can turn on sideloading using the Settings app. - -> [!IMPORTANT] -> To install an app on Windows client, you can: -> -> - [Install Windows apps from a web page](/windows/msix/app-installer/installing-windows10-apps-web). -> - Users can double-click any `.msix` or `.appx` package. - -### User interface - -If you're working on your own device, or if devices are unmanaged, use the Settings app: - -1. Open the **Settings** app > **Update & Security** > **For developers**. -2. Select **Sideload apps**. - -For more information, see [Enable your device for development](/windows/apps/get-started/enable-your-device-for-development) and [Developer Mode features and debugging](/windows/apps/get-started/developer-mode-features-and-debugging). - -### Group Policy - -If you use Group Policy, use the `Computer Configuration\Administrative Templates\Windows Components\App Package Deployment` policies to enable or prevent sideloading apps: - -- `Allows development of Windows Store apps and installing them from an integrated development environment (IDE)` -- `Allow all trusted apps to install` - -By default, the OS might set these policies to **Not configured**, which means app sideloading is turned off. If you set these policies to **Enabled**, then users can sideload apps. - -### MDM - -Using Microsoft Intune, you can also enable sideloading apps on managed devices. For more information, see: - -- [Sign line-of-business apps so they can be deployed to Windows devices with Intune](/mem/intune/apps/app-sideload-windows) -- [App Store device settings to allow or restrict features using Intune](/mem/intune/configuration/device-restrictions-windows-10#app-store) - -## Step 2: Import the security certificate - -This step installs the app certificate to the local device. Installing the certificate creates the trust between the app and the device. - -1. Open the security certificate for the `.msix` package, and select **Install Certificate**. - -2. On the **Certificate Import Wizard**, select **Local Machine**. - -3. Import the certificate to the **Trusted Root Certification Authorities** folder. - - -OR- - - You can use a runtime provisioning package to import a security certificate. For information about applying a provisioning package, see runtime instructions on [Create a provisioning package](/windows/configuration/provisioning-packages/provisioning-create-package). - -## Step 3: Install the app - -From the folder with the `.msix` package, run the Windows PowerShell `Add-AppxPackage` command to install the `.msix` package. - -For more information on this command, see [Add-AppxPackage](/powershell/module/appx/add-appxpackage). diff --git a/windows/application-management/sideload-apps-in-windows.md b/windows/application-management/sideload-apps-in-windows.md new file mode 100644 index 0000000000..3779938afc --- /dev/null +++ b/windows/application-management/sideload-apps-in-windows.md @@ -0,0 +1,137 @@ +--- +title: Sideload line of business apps +description: Learn how to sideload line-of-business (LOB) apps in Windows client operating systems. When you sideload an app, you deploy a signed app package to a device. +author: aczechowski +ms.author: aaroncz +manager: aaroncz +ms.date: 12/22/2023 +ms.topic: how-to +ms.service: windows-client +ms.subservice: itpro-apps +ms.localizationpriority: medium +ms.collection: tier2 +appliesto: + - ✅ Windows 11 + - ✅ Windows 10 +--- + +# Sideload line of business (LOB) apps + +Sideloading apps is when you install apps that aren't from an official source, such as the Microsoft Store. Your organization can create its own apps, including line-of-business (LOB) apps. When you sideload an app, you deploy a signed app package to a device. You maintain the signing, hosting, and deployment of these apps. + +To allow these apps to run on your Windows devices, you might have to enable sideloading. + +> [!IMPORTANT] +> When you enable sideloading, you allow installing and running apps from outside the Microsoft Store. This action might increase security risks to the device and your data. Sideloaded apps need to be signed with a certificate that the device trusts. + +## Prerequisites + +- Windows devices with sideloading enabled. You can enable it with a group policy or a mobile device management (MDM) provider like Microsoft Intune. You can also use the **Settings** app to manually turn on sideloading. + +- A trusted certificate that you assign to your app. Import the security certificate to the local device. This certificate allows the device to trust the app. + +- An app package that you sign with the same certificate. + +> [!TIP] +> Unlike in earlier versions, with Windows 10/11: +> +> - License keys aren't required. +> - Devices don't have to be joined to a domain. + +## Step 1: Turn on sideloading + +You can sideload apps on managed or unmanaged devices. + +A *managed device* typically means your organization owns it and applies policies based on business requirements. You manage it with on-premises group policy or a mobile device management (MDM) provider like Microsoft Intune. On managed devices, you can create a policy that turns on sideloading, and then assign this policy to targeted devices. + +An *unmanaged device* means your organization doesn't manage it. These devices are typically personal devices that users own. Users can manually turn on sideloading with the **Settings** app. + +### User interface + +If you're working on your own device, or if devices are unmanaged, use the Settings app. The experience differs between Windows 11 and Windows 10. + +> [!NOTE] +> If sideloading is blocked by an organizational policy, then users can't even manually enable sideloading. + +#### Windows 11 setting + +1. Open the **Settings** app. + +1. Go to **System** and select **For developers**. + +1. Turn on the **Developer mode** setting. + +1. Review the notice, and select **Yes** to continue. + +> [!TIP] +> If you don't see the setting in this location on your version of Windows, use the *Find a setting* option. Search for *developer mode* to quickly jump to its location. + +#### Windows 10 setting + +1. Open the **Settings** app. + +1. Go to **Update & Security** and select **For developers**. + +1. Turn on the option to **Sideload apps**. + +1. Review the notice, and select **Yes** to continue. + +### Group policy + +If you use group policy, use the following policies to enable or prevent sideloading apps: + +Path: **Computer Configuration\Administrative Templates\Windows Components\App Package Deployment** + +- **Allows development of Windows Store apps and installing them from an integrated development environment (IDE)** +- **Allow all trusted apps to install** + +By default, the OS might set these policies to **Not configured**, which means app sideloading is turned off. If you set these policies to **Enabled**, then users can sideload apps. + +### MDM + +When you use Microsoft Intune, you can enable sideloading apps on managed devices. For more information, see the following articles: + +- [Sign line-of-business apps so they can be deployed to Windows devices with Intune](/mem/intune/apps/app-sideload-windows) +- [App Store device settings to allow or restrict features using Intune](/mem/intune/configuration/device-restrictions-windows-10#app-store) + +Other MDM servers can implement similar behaviors using the [ApplicationManagement](/windows/client-management/mdm/policy-csp-applicationmanagement) policy CSP. + +## Step 2: Import the security certificate + +This step installs the app certificate to the local device. Installing the certificate creates the trust between the app and the device. + +1. Open the **Properties** for the app package. + + 1. Go to the **Digital Signatures** tab. + + 1. Select the certificate, and select **Details** to open the digital signature details window. + + 1. Select **View Certificate** to open the certificate window. + + 1. Select **Install Certificate** to launch the certificate import wizard. + +1. On the **Certificate Import Wizard**, select **Local Machine**. This action might require an administrator to elevate. + +1. Continue the process to import the certificate into the **Trusted Root Certification Authorities** store. + +> [!NOTE] +> There are other methods to install and manage certificates on devices. For example, with group policy or a provisioning package. + +## Step 3: Install the app + +After you enable sideloading and import the certificate, there are multiple methods you can use to install the app on devices. + +- Manually open the `.msix` or `.appx` package in Windows Explorer. + +- Distribute an [MSIX app](/windows/msix/overview) over the network with a web-based app installer. For more information, see [Install Windows apps from a web page](/windows/msix/app-installer/installing-windows10-apps-web). + +- Use the Windows PowerShell `Add-AppxPackage` cmdlet. For more information, see [Add-AppxPackage](/powershell/module/appx/add-appxpackage). + +## Next steps + +Learn about the [private app repository in Windows 11](private-app-repository-mdm-company-portal-windows-11.md) with the Company Portal and Microsoft Intune. + +For more information on sideloading, see the following articles on Windows app development: + +- [Enable your device for development](/windows/apps/get-started/enable-your-device-for-development) +- [Developer Mode features and debugging](/windows/apps/get-started/developer-mode-features-and-debugging) diff --git a/windows/application-management/svchost-service-refactoring.md b/windows/application-management/svchost-service-refactoring.md index 7bc1bcf117..5d7b3a998c 100644 --- a/windows/application-management/svchost-service-refactoring.md +++ b/windows/application-management/svchost-service-refactoring.md @@ -6,8 +6,8 @@ ms.author: aaroncz manager: aaroncz ms.date: 07/20/2017 ms.topic: concept-article -ms.prod: windows-client -ms.technology: itpro-apps +ms.service: windows-client +ms.subservice: itpro-apps ms.localizationpriority: medium ms.colletion: tier2 appliesto: diff --git a/windows/application-management/toc.yml b/windows/application-management/toc.yml index be08bb1e0f..eaea302b9c 100644 --- a/windows/application-management/toc.yml +++ b/windows/application-management/toc.yml @@ -1,257 +1,17 @@ items: - name: Manage Windows applications href: index.yml -- name: Application management - items: - - name: Overview of apps in Windows - href: overview-windows-apps.md - - name: Add or hide Windows features - href: add-apps-and-features.md - - name: Sideload line of business (LOB) apps - href: sideload-apps-in-windows-10.md - - name: Private app repo on Windows 11 - href: private-app-repository-mdm-company-portal-windows-11.md - - name: Remove background task resource restrictions - href: enterprise-background-activity-controls.md - - name: Service host grouping in Windows 10 - href: svchost-service-refactoring.md - - name: Per-user services in Windows - href: per-user-services-in-windows.md - - name: Keep removed apps from returning during an update - href: remove-provisioned-apps-during-update.md -- name: Application Virtualization (App-V) - items: - - name: App-V for Windows overview - href: app-v/appv-for-windows.md - - name: Getting Started - items: - - name: Getting Started with App-V - href: app-v/appv-getting-started.md - - name: What's new - items: - - name: What's new in App-V for Windows 10, version 1703 and earlier - href: app-v/appv-about-appv.md - - name: Release Notes for App-V for Windows 10, version 1607 - href: app-v/appv-release-notes-for-appv-for-windows.md - - name: Release Notes for App-V for Windows 10, version 1703 - href: app-v/appv-release-notes-for-appv-for-windows-1703.md - - name: Evaluating App-V - href: app-v/appv-evaluating-appv.md - - name: High Level Architecture for App-V - href: app-v/appv-high-level-architecture.md - - name: Planning - items: - - name: Planning for App-V - href: app-v/appv-planning-for-appv.md - - name: Preparing your environment - items: - - name: Preparing your environment for App-V - href: app-v/appv-preparing-your-environment.md - - name: App-V Prerequisites - href: app-v/appv-prerequisites.md - - name: App-V security considerations - href: app-v/appv-security-considerations.md - - name: Planning to deploy - items: - - name: Planning to Deploy App-V - href: app-v/appv-planning-to-deploy-appv.md - - name: App-V Supported Configurations - href: app-v/appv-supported-configurations.md - - name: App-V Capacity Planning - href: app-v/appv-capacity-planning.md - - name: Planning for High Availability with App-V - href: app-v/appv-planning-for-high-availability-with-appv.md - - name: Planning to Deploy App-V with an Electronic Software Distribution System - href: app-v/appv-planning-to-deploy-appv-with-electronic-software-distribution-solutions.md - - name: Planning for the App-V Server Deployment - href: app-v/appv-planning-for-appv-server-deployment.md - - name: Planning for the App-V Sequencer and Client Deployment - href: app-v/appv-planning-for-sequencer-and-client-deployment.md - - name: Planning for Using App-V with Office - href: app-v/appv-planning-for-using-appv-with-office.md - - name: Planning to Use Folder Redirection with App-V - href: app-v/appv-planning-folder-redirection-with-appv.md - - name: App-V Planning Checklist - href: app-v/appv-planning-checklist.md - - name: Deploying - items: - - name: Deploying App-V - href: app-v/appv-deploying-appv.md - - name: App-V sequencer and client configuration - items: - - name: Deploying the App-V Sequencer and Configuring the Client - href: app-v/appv-deploying-the-appv-sequencer-and-client.md - - name: About Client Configuration Settings - href: app-v/appv-client-configuration-settings.md - - name: Enable the App-V desktop client - href: app-v/appv-enable-the-app-v-desktop-client.md - - name: How to Install the Sequencer - href: app-v/appv-install-the-sequencer.md - - name: App-V server deployment - items: - - name: Deploying the App-V Server - href: app-v/appv-deploying-the-appv-server.md - - name: How to Deploy the App-V Server - href: app-v/appv-deploy-the-appv-server.md - - name: How to Deploy the App-V Server Using a Script - href: app-v/appv-deploy-the-appv-server-with-a-script.md - - name: How to Deploy the App-V Databases by Using SQL Scripts - href: app-v/appv-deploy-appv-databases-with-sql-scripts.md - - name: How to Install the Publishing Server on a Remote Computer - href: app-v/appv-install-the-publishing-server-on-a-remote-computer.md - - name: How to Install the Management and Reporting Databases on Separate Computers from the Management and Reporting Services - href: app-v/appv-install-the-management-and-reporting-databases-on-separate-computers.md - - name: How to install the Management Server on a Standalone Computer and Connect it to the Database - href: app-v/appv-install-the-management-server-on-a-standalone-computer.md - - name: About App-V Reporting - href: app-v/appv-reporting.md - - name: How to install the Reporting Server on a Standalone Computer and Connect it to the Database - href: app-v/appv-install-the-reporting-server-on-a-standalone-computer.md - - name: App-V Deployment Checklist - href: app-v/appv-deployment-checklist.md - - name: Deploying Microsoft Office 2016 by Using App-V - href: app-v/appv-deploying-microsoft-office-2016-with-appv.md - - name: Deploying Microsoft Office 2013 by Using App-V - href: app-v/appv-deploying-microsoft-office-2013-with-appv.md - - name: Deploying Microsoft Office 2010 by Using App-V - href: app-v/appv-deploying-microsoft-office-2010-wth-appv.md - - name: Operations - items: - - name: Operations for App-V - href: app-v/appv-operations.md - - name: Creating and managing virtualized applications - items: - - name: Creating and Managing App-V Virtualized Applications - href: app-v/appv-creating-and-managing-virtualized-applications.md - - name: Automatically provision your sequencing environment using Microsoft Application Virtualization Sequencer (App-V Sequencer) - href: app-v/appv-auto-provision-a-vm.md - - name: Automatically sequence multiple apps at the same time using Microsoft Application Virtualization Sequencer (App-V Sequencer) - href: app-v/appv-auto-batch-sequencing.md - - name: Automatically update multiple apps at the same time using Microsoft Application Virtualization Sequencer (App-V Sequencer) - href: app-v/appv-auto-batch-updating.md - - name: Manually sequence a new app using Microsoft Application Virtualization Sequencer (App-V Sequencer) - href: app-v/appv-sequence-a-new-application.md - - name: How to Modify an Existing Virtual Application Package - href: app-v/appv-modify-an-existing-virtual-application-package.md - - name: How to Create and Use a Project Template - href: app-v/appv-create-and-use-a-project-template.md - - name: How to Create a Package Accelerator - href: app-v/appv-create-a-package-accelerator.md - - name: How to Create a Virtual Application Package Using an App-V Package Accelerator - href: app-v/appv-create-a-virtual-application-package-package-accelerator.md - - name: Administering App-V - items: - - name: Administering App-V Virtual Applications by Using the Management Console - href: app-v/appv-administering-virtual-applications-with-the-management-console.md - - name: About App-V Dynamic Configuration - href: app-v/appv-dynamic-configuration.md - - name: How to Connect to the Management Console - href: app-v/appv-connect-to-the-management-console.md - - name: How to Add or Upgrade Packages by Using the Management Console - href: app-v/appv-add-or-upgrade-packages-with-the-management-console.md - - name: How to Configure Access to Packages by Using the Management Console - href: app-v/appv-configure-access-to-packages-with-the-management-console.md - - name: How to Publish a Package by Using the Management Console - href: app-v/appv-publish-a-packages-with-the-management-console.md - - name: How to Delete a Package in the Management Console - href: app-v/appv-delete-a-package-with-the-management-console.md - - name: How to Add or Remove an Administrator by Using the Management Console - href: app-v/appv-add-or-remove-an-administrator-with-the-management-console.md - - name: How to Register and Unregister a Publishing Server by Using the Management Console - href: app-v/appv-register-and-unregister-a-publishing-server-with-the-management-console.md - - name: How to Create a Custom Configuration File by Using the App-V Management Console - href: app-v/appv-create-a-custom-configuration-file-with-the-management-console.md - - name: How to Transfer Access and Configurations to Another Version of a Package by Using the Management Console - href: app-v/appv-transfer-access-and-configurations-to-another-version-of-a-package-with-the-management-console.md - - name: How to Customize Virtual Applications Extensions for a Specific AD Group by Using the Management Console - href: app-v/appv-customize-virtual-application-extensions-with-the-management-console.md - - name: How to View and Configure Applications and Default Virtual Application Extensions by Using the Management Console - href: app-v/appv-view-and-configure-applications-and-default-virtual-application-extensions-with-the-management-console.md - - name: Connection groups - items: - - name: Managing Connection Groups - href: app-v/appv-managing-connection-groups.md - - name: About the Connection Group Virtual Environment - href: app-v/appv-connection-group-virtual-environment.md - - name: About the Connection Group File - href: app-v/appv-connection-group-file.md - - name: How to Create a Connection Group - href: app-v/appv-create-a-connection-group.md - - name: How to Create a Connection Group with User-Published and Globally Published Packages - href: app-v/appv-create-a-connection-group-with-user-published-and-globally-published-packages.md - - name: How to Delete a Connection Group - href: app-v/appv-delete-a-connection-group.md - - name: How to Publish a Connection Group - href: app-v/appv-publish-a-connection-group.md - - name: How to Make a Connection Group Ignore the Package Version - href: app-v/appv-configure-connection-groups-to-ignore-the-package-version.md - - name: How to Allow Only Administrators to Enable Connection Groups - href: app-v/appv-allow-administrators-to-enable-connection-groups.md - - name: Deploying App-V packages with ESD - items: - - name: Deploying App-V Packages by Using Electronic Software Distribution (ESD) - href: app-v/appv-deploying-packages-with-electronic-software-distribution-solutions.md - - name: How to deploy App-V Packages Using Electronic Software Distribution - href: app-v/appv-deploy-appv-packages-with-electronic-software-distribution-solutions.md - - name: How to Enable Only Administrators to Publish Packages by Using an ESD - href: app-v/appv-enable-administrators-to-publish-packages-with-electronic-software-distribution-solutions.md - - name: Using the management console - items: - - name: Using the App-V client management console - href: app-v/appv-using-the-client-management-console.md - - name: Automatically clean up unpublished packages on the App-V client - href: app-v/appv-auto-clean-unpublished-packages.md - - name: Migrating - items: - - name: Migrating to App-V from a previous version - href: app-v/appv-migrating-to-appv-from-a-previous-version.md - - name: How to convert a package created in a previous version of App-V - href: app-v/appv-convert-a-package-created-in-a-previous-version-of-appv.md - - name: Maintenance - items: - - name: Maintaining App-V - href: app-v/appv-maintaining-appv.md - - name: How to Move the App-V Server to Another Computer - href: app-v/appv-move-the-appv-server-to-another-computer.md - - name: Administering App-V with Windows PowerShell - items: - - name: Administering App-V by using Windows PowerShell - href: app-v/appv-administering-appv-with-powershell.md - - name: How to Load the Windows PowerShell Cmdlets for App-V and Get Cmdlet Help - href: app-v/appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md - - name: How to Manage App-V Packages Running on a Stand-Alone Computer by Using Windows PowerShell - href: app-v/appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md - - name: How to Manage Connection Groups on a Stand-alone Computer by Using Windows PowerShell - href: app-v/appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell.md - - name: How to Modify Client Configuration by Using Windows PowerShell - href: app-v/appv-modify-client-configuration-with-powershell.md - - name: How to Configure the Client to Receive Package and Connection Groups Updates From the Publishing Server - href: app-v/appv-configure-the-client-to-receive-updates-from-the-publishing-server.md - - name: How to Apply the User Configuration File by Using Windows PowerShell - href: app-v/appv-apply-the-user-configuration-file-with-powershell.md - - name: How to Apply the Deployment Configuration File by Using Windows PowerShell - href: app-v/appv-apply-the-deployment-configuration-file-with-powershell.md - - name: How to Sequence a Package by Using Windows PowerShell - href: app-v/appv-sequence-a-package-with-powershell.md - - name: How to Create a Package Accelerator by Using Windows PowerShell - href: app-v/appv-create-a-package-accelerator-with-powershell.md - - name: How to Enable Reporting on the App-V Client by Using Windows PowerShell - href: app-v/appv-enable-reporting-on-the-appv-client-with-powershell.md - - name: How to Install the App-V Databases and Convert the Associated Security Identifiers by Using Windows PowerShell - href: app-v/appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md - - name: Troubleshooting App-V - href: app-v/appv-troubleshooting.md - - name: Technical Reference - items: - - name: Technical Reference for App-V - href: app-v/appv-technical-reference.md - - name: Available Mobile Device Management (MDM) settings for App-V - href: app-v/appv-available-mdm-settings.md - - name: Performance Guidance for Application Virtualization - href: app-v/appv-performance-guidance.md - - name: Application Publishing and Client Interaction - href: app-v/appv-application-publishing-and-client-interaction.md - - name: Viewing App-V Server Publishing Metadata - href: app-v/appv-viewing-appv-server-publishing-metadata.md - - name: Running a Locally Installed Application Inside a Virtual Environment with Virtualized Applications - href: app-v/appv-running-locally-installed-applications-inside-a-virtual-environment.md +- name: Overview of apps in Windows + href: overview-windows-apps.md +- name: Sideload line of business (LOB) apps + href: sideload-apps-in-windows.md +- name: Private app repo on Windows 11 + href: private-app-repository-mdm-company-portal-windows-11.md +- name: Remove background task resource restrictions + href: enterprise-background-activity-controls.md +- name: Service host grouping in Windows 10 + href: svchost-service-refactoring.md +- name: Per-user services in Windows + href: per-user-services-in-windows.md +- name: Keep removed apps from returning during an update + href: remove-provisioned-apps-during-update.md diff --git a/windows/client-management/azure-active-directory-integration-with-mdm.md b/windows/client-management/azure-active-directory-integration-with-mdm.md index efb65c5991..eefc2151ab 100644 --- a/windows/client-management/azure-active-directory-integration-with-mdm.md +++ b/windows/client-management/azure-active-directory-integration-with-mdm.md @@ -1,22 +1,22 @@ --- title: Microsoft Entra integration with MDM description: Microsoft Entra ID is the world's largest enterprise cloud identity management service. -ms.topic: article +ms.topic: conceptual ms.collection: - highpri - tier2 -ms.date: 08/10/2023 +ms.date: 07/08/2024 --- # Microsoft Entra integration with MDM -Microsoft Entra ID is the world's largest enterprise cloud identity management service. It's used by organizations to access Microsoft 365 and business applications from Microsoft and third-party software as a service (SaaS) vendors. Many of the rich Windows experiences for organizational users (such as store access or OS state roaming) use Microsoft Entra ID as the underlying identity infrastructure. Windows integrates with Microsoft Entra ID, allowing devices to be registered in Microsoft Entra ID and enrolled into MDM in an integrated flow. +Microsoft Entra ID is the world's largest enterprise cloud identity management service. It's used by organizations to access Microsoft 365 and business applications from Microsoft and third-party software as a service (SaaS) vendors. Many of the rich Windows experiences for organizational users (such as store access or OS state roaming) use Microsoft Entra ID as the underlying identity infrastructure. Windows integrates with Microsoft Entra ID, allowing devices to be registered in Microsoft Entra ID and enrolled into Mobile Device Management (MDM) in an integrated flow. Once a device is enrolled in MDM, the MDM: - Can enforce compliance with organization policies, add or remove apps, and more. - Can report a device's compliance in Microsoft Entra ID. -- Microsoft Entra ID can allow access to organization resources or applications secured by Microsoft Entra ID to devices that comply with policies. +- Can allow access to organization resources or applications secured by Microsoft Entra ID to devices that comply with policies. To support these rich experiences with their MDM product, MDM vendors can integrate with Microsoft Entra ID. @@ -24,23 +24,21 @@ To support these rich experiences with their MDM product, MDM vendors can integr There are several ways to connect your devices to Microsoft Entra ID: -- [Join device to Microsoft Entra ID](/azure/active-directory/devices/concept-azure-ad-join) -- [Join device to on-premises AD and Microsoft Entra ID](/azure/active-directory/devices/concept-azure-ad-join-hybrid) -- [Add a Microsoft work account to Windows](/azure/active-directory/devices/concept-azure-ad-register) +- [Join device to Microsoft Entra ID](/entra/identity/devices/concept-directory-join) +- [Join device to on-premises AD and Microsoft Entra ID](/entra/identity/devices/concept-hybrid-join) +- [Add a Microsoft work account to Windows](/entra/identity/devices/concept-device-registration) In each scenario, Microsoft Entra authenticates the user and the device. It provides a verified unique device identifier that can be used for MDM enrollment. The enrollment flow provides an opportunity for the MDM service to render its own UI, using a web view. MDM vendors should use the UI to render the Terms of Use (TOU), which can be different for company-owned and bring-your-own-device (BYOD) devices. MDM vendors can also use the web view to render more UI elements, such as asking for a one-time PIN. In Windows 10, the web view during the out-of-the-box scenario is displayed as full-screen by default, providing MDM vendors with the capability to create a seamless edge-to-edge user experience. However, in Windows 11 the web view is rendered within an iframe. It's important that MDM vendors who integrate with Microsoft Entra ID respect the Windows design guidelines. This step includes using a responsive web design and respecting the Windows accessibility guidelines. For example, include the forward and back buttons that are properly wired to the navigation logic. More details are provided later in this article. -For Microsoft Entra enrollment to work for an Active Directory Federated Services (AD FS) backed Microsoft Entra account, you must enable password authentication for the intranet on the ADFS service. For more information, see [Configure Azure MFA as authentication provider with AD FS](/windows-server/identity/ad-fs/operations/configure-ad-fs-and-azure-mfa). +For Microsoft Entra enrollment to work for an Active Directory Federated Services (AD FS) backed Microsoft Entra account, you must enable password authentication for the intranet on the ADFS service. For more information, see [Configure Microsoft Entra multifactor authentication as authentication provider with AD FS](/windows-server/identity/ad-fs/operations/configure-ad-fs-and-azure-mfa). Once a user has a Microsoft Entra account added to Windows and enrolled in MDM, the enrollment can be managed through **Settings** > **Accounts** > **Access work or school**. Device management of either Microsoft Entra join for organization scenarios or BYOD scenarios is similar. > [!NOTE] > Users can't remove the device enrollment through the **Access work or school** user interface because management is tied to the Microsoft Entra ID or work account. - - ### MDM endpoints involved in Microsoft Entra integrated enrollment Microsoft Entra MDM enrollment is a two-step process: @@ -64,17 +62,15 @@ To support Microsoft Entra enrollment, MDM vendors must host and expose a **Term The MDM is expected to use this information about the device (Device ID) when reporting device compliance back to Microsoft Entra ID using the [Microsoft Graph API](/azure/active-directory/develop/active-directory-graph-api). A sample for reporting device compliance is provided later in this article. - - ## Make MDM a reliable party of Microsoft Entra ID To participate in the integrated enrollment flow outlined in the previous section, the MDM must consume access tokens issued by Microsoft Entra ID. To report compliance with Microsoft Entra ID, the MDM must authenticate itself to Microsoft Entra ID and obtain authorization in the form of an access token that allows it to invoke the [Microsoft Graph API](/azure/active-directory/develop/active-directory-graph-api). ### Cloud-based MDM -A cloud-based MDM is a SaaS application that provides device management capabilities in the cloud. It's a multi-tenant application. This application is registered with Microsoft Entra ID in the home tenant of the MDM vendor. When an IT admin decides to use this MDM solution, an instance of this application is made visible in the tenant of the customer. +A cloud-based MDM is a SaaS application that provides device management capabilities in the cloud. It's a multitenant application. This application is registered with Microsoft Entra ID in the home tenant of the MDM vendor. When an IT admin decides to use this MDM solution, an instance of this application is made visible in the tenant of the customer. -The MDM vendor must first register the application in their home tenant and mark it as a multi-tenant application. For more information about how to add multi-tenant applications to Microsoft Entra ID, see the [Integrate an app that authenticates users and calls Microsoft Graph using the multi-tenant integration pattern (SaaS)](https://go.microsoft.com/fwlink/p/?LinkId=613661) code sample on GitHub. +The MDM vendor must first register the application in their home tenant and mark it as a multitenant application. For more information about how to add multitenant applications to Microsoft Entra ID, see the [Integrate an app that authenticates users and calls Microsoft Graph using the multitenant integration pattern (SaaS)](https://go.microsoft.com/fwlink/p/?LinkId=613661) code sample on GitHub. > [!NOTE] > For the MDM provider, if you don't have an existing Microsoft Entra tenant with a Microsoft Entra subscription that you manage, follow these step-by-step guides: @@ -82,7 +78,7 @@ The MDM vendor must first register the application in their home tenant and mark > - [Quickstart: Create a new tenant in Microsoft Entra ID](/azure/active-directory/fundamentals/active-directory-access-create-new-tenant) to set up a tenant. > - [Associate or add an Azure subscription to your Microsoft Entra tenant](/azure/active-directory/fundamentals/active-directory-how-subscriptions-associated-directory) to add a subscription, and manage it via the Azure Portal. -The MDM application uses keys to request access tokens from Microsoft Entra ID. These keys are managed within the tenant of the MDM provider and not visible to individual customers. The same key is used by the multi-tenant MDM application to authenticate itself with Microsoft Entra ID, in the customer tenant where the managed device belongs. +The MDM application uses keys to request access tokens from Microsoft Entra ID. These keys are managed within the tenant of the MDM provider and not visible to individual customers. The same key is used by the multitenant MDM application to authenticate itself with Microsoft Entra ID, in the customer tenant where the managed device belongs. > [!NOTE] > All MDM apps must implement Microsoft Entra v2 tokens before we certify that integration works. Due to changes in the Microsoft Entra app platform, using Microsoft Entra v2 tokens is a hard requirement. For more information, see [Microsoft identity platform access tokens](/azure/active-directory/develop/access-tokens#token-formats). @@ -107,8 +103,6 @@ For cloud-based MDM, you can roll over the application keys without requiring a For the on-premises MDM, the Microsoft Entra authentication keys are within the customer tenant and the customer's administrator must roll over the keys. To improve security, provide guidance to customers about rolling over and protecting the keys. - - ## Publish your MDM app to Microsoft Entra app gallery IT administrators use the Microsoft Entra app gallery to add an MDM for their organization to use. The app gallery is a rich store with over 2400 SaaS applications that are integrated with Microsoft Entra ID. @@ -124,7 +118,7 @@ The following table shows the required information to create an entry in the Mic | Item | Description | |---------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| **Application ID** | The client ID of your MDM app that is configured within your tenant. This ID is the unique identifier for your multi-tenant app. | +| **Application ID** | The client ID of your MDM app that is configured within your tenant. This ID is the unique identifier for your multitenant app. | | **Publisher** | A string that identifies the publisher of the app. | | **Application URL** | A URL to the landing page of your app where your administrators can get more information about the MDM app and contains a link to the landing page of your app. This URL isn't used for the actual enrollment. | | **Description** | A brief description of your MDM app, which must be under 255 characters. | @@ -191,7 +185,7 @@ The following claims are expected in the access token passed by Windows to the T |-----------|----------------------------------------------------------------------------------------------| | Object ID | Identifier of the user object corresponding to the authenticated user. | | UPN | A claim containing the user principal name (UPN) of the authenticated user. | -| TID | A claim representing the tenant ID of the tenant. In the example above, it's Fabrikam. | +| TID | A claim representing the tenant ID of the tenant. In the previous example, it's Fabrikam. | | Resource | A sanitized URL representing the MDM application. Example: `https://fabrikam.contosomdm.com` | > [!NOTE] @@ -206,7 +200,7 @@ https://fabrikam.contosomdm.com/TermsOfUse?redirect_uri=ms-appx-web://ContosoMdm Authorization: Bearer eyJ0eXAiOi ``` -The MDM is expected to validate the signature of the access token to ensure it is issued by Microsoft Entra ID and that the recipient is appropriate. +The MDM is expected to validate the signature of the access token to ensure it's issued by Microsoft Entra ID and that the recipient is appropriate. ### Terms of Use content @@ -260,8 +254,6 @@ The following table shows the error codes. | Microsoft Entra token validation failed | 302 | unauthorized_client | unauthorized_client | | internal service error | 302 | server_error | internal service error | - - ## Enrollment protocol with Microsoft Entra ID With Azure integrated MDM enrollment, there's no discovery phase and the discovery URL is directly passed down to the system from Azure. The following table shows the comparison between the traditional and Azure enrollments. @@ -284,8 +276,6 @@ With Azure integrated MDM enrollment, there's no discovery phase and the discove |EnrollmentData Terms of Use binary blob as AdditionalContext for EnrollmentServiceURL|Not supported|Supported|Supported| |CSPs accessible during enrollment|Windows 10 support:
                        - DMClient
                        - CertificateStore
                        - RootCATrustedCertificates
                        - ClientCertificateInstall
                        - EnterpriseModernAppManagement
                        - PassportForWork
                        - Policy
                        - w7 APPLICATION||| - - ## Management protocol with Microsoft Entra ID There are two different MDM enrollment types that integrate with Microsoft Entra ID, and use Microsoft Entra user and device identities. Depending on the enrollment type, the MDM service may need to manage a single user or multiple users. @@ -318,8 +308,6 @@ There are two different MDM enrollment types that integrate with Microsoft Entra - Use the JWT Token Handler extension for WIF to validate the contents of the access token and extract claims required for use. For more information, see [JwtSecurityTokenHandler Class](/dotnet/api/system.identitymodel.tokens.jwt.jwtsecuritytokenhandler). - Refer to the Microsoft Entra authentication code samples to get a sample for working with access tokens. For an example, see [NativeClient-DotNet](https://go.microsoft.com/fwlink/p/?LinkId=613667). - - ## Device Alert 1224 for Microsoft Entra user token An alert is sent when the DM session starts and there's a Microsoft Entra user logged in. The alert is sent in OMA DM package #1. Here's an example: @@ -372,15 +360,13 @@ Here's an example. ``` - - ## Report device compliance to Microsoft Entra ID Once a device is enrolled with the MDM for management, organization policies configured by the IT administrator are enforced on the device. MDM evaluates the device compliance with configured policies and then reports it to Microsoft Entra ID. This section covers the Graph API call you can use to report a device compliance status to Microsoft Entra ID. For a sample that illustrates how an MDM can obtain an access token using OAuth 2.0 client\_credentials grant type, see [Daemon\_CertificateCredential-DotNet](https://go.microsoft.com/fwlink/p/?LinkId=613822). -- **Cloud-based MDM** - If your product is a cloud-based multi-tenant MDM service, you have a single key configured for your service within your tenant. To obtain authorization, use this key to authenticate the MDM service with Microsoft Entra ID. +- **Cloud-based MDM** - If your product is a cloud-based multitenant MDM service, you have a single key configured for your service within your tenant. To obtain authorization, use this key to authenticate the MDM service with Microsoft Entra ID. - **On-premises MDM** - If your product is an on-premises MDM, customers must configure your product with the key used to authenticate with Microsoft Entra ID. This key configuration is because each on-premises instance of your MDM product has a different tenant-specific key. So, you may need to expose a configuration experience in your MDM product that enables administrators to specify the key to be used to authenticate with Microsoft Entra ID. ### Use Microsoft Graph API @@ -415,8 +401,6 @@ Response: - Success - HTTP 204 with No Content. - Failure/Error - HTTP 404 Not Found. This error may be returned if the specified device or tenant can't be found. - - ## Data loss during unenrollment from Microsoft Entra join When a user is enrolled into MDM through Microsoft Entra join and then disconnects the enrollment, there's no warning that the user will lose Windows Information Protection (WIP) data. The disconnection message doesn't indicate the loss of WIP data. diff --git a/windows/client-management/azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md b/windows/client-management/azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md index e1c894e2c5..aca40777f6 100644 --- a/windows/client-management/azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md +++ b/windows/client-management/azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md @@ -1,8 +1,8 @@ --- title: Automatic MDM enrollment in the Intune admin center description: Automatic MDM enrollment in the Intune admin center -ms.topic: article -ms.date: 08/10/2023 +ms.topic: conceptual +ms.date: 07/08/2024 --- # Automatic MDM enrollment in the Intune admin center diff --git a/windows/client-management/bulk-enrollment-using-windows-provisioning-tool.md b/windows/client-management/bulk-enrollment-using-windows-provisioning-tool.md index 522b5d05b6..c248120cff 100644 --- a/windows/client-management/bulk-enrollment-using-windows-provisioning-tool.md +++ b/windows/client-management/bulk-enrollment-using-windows-provisioning-tool.md @@ -1,13 +1,13 @@ --- title: Bulk enrollment -description: Bulk enrollment is an efficient way to set up a large number of devices to be managed by an MDM server without the need to reimage the devices. -ms.topic: article -ms.date: 08/10/2023 +description: Bulk enrollment is an efficient way to set up an MDM server to manage a large number of devices without the need to reimage the devices. +ms.topic: conceptual +ms.date: 07/08/2024 --- # Bulk enrollment using Windows Configuration Designer -Bulk enrollment is an efficient way to set up a large number of devices to be managed by an MDM server without the need to reimage the devices. You can use the [Provisioning CSP](mdm/provisioning-csp.md) for bulk enrollment, except for the Microsoft Entra join enrollment scenario. +Bulk enrollment is an efficient way to set up an MDM server to manage a large number of devices without the need to reimage the devices. You can use the [Provisioning CSP](mdm/provisioning-csp.md) for bulk enrollment, except for the Microsoft Entra join enrollment scenario. ## Typical use cases @@ -68,7 +68,7 @@ Using the WCD, create a provisioning package using the enrollment information re ![bulk enrollment screenshot.](images/bulk-enrollment.png) 1. Configure the other settings, such as the Wi-Fi connections so that the device can join a network before joining MDM (for example, **Runtime settings** > **ConnectivityProfiles** > **WLANSetting**). -1. When you're done adding all the settings, on the **File** menu, select **Save**. +1. After adding all the settings, select **Save** on the **File** menu. 1. On the main menu, select **Export** > **Provisioning package**. ![icd menu for export.](images/bulk-enrollment2.png) @@ -120,7 +120,7 @@ Using the WCD, create a provisioning package using the enrollment information re For detailed descriptions of these settings, see [Provisioning CSP](mdm/provisioning-csp.md). 1. Configure the other settings, such as the Wi-Fi connection so that the device can join a network before joining MDM (for example, **Runtime settings** > **ConnectivityProfiles** > **WLANSetting**). -1. When you're done adding all the settings, on the **File** menu, select **Save**. +1. After adding all the settings, select **Save** on the **File** menu. 1. Export and build the package (steps 10-13 in previous section). 1. Apply the package to some test devices and verify that they work. For more information, see [Apply a provisioning package](#apply-a-provisioning-package). 1. Apply the package to your devices. @@ -142,7 +142,7 @@ Using the WCD, create a provisioning package using the enrollment information re - If the provisioning engine receives a failure from a CSP, it retries provisioning three times in a row. - If all immediate attempts fail, a delayed task is launched to try provisioning again later. It will retry four times at a decaying rate of 15 minutes -> 1 hr -> 4 hr -> "Next System Start". These attempts are run from the SYSTEM context. - It also retries the provisioning each time it's launched, if started from somewhere else as well. -- In addition, provisioning will be restarted in the SYSTEM context after a sign in and the [system has been idle](/windows/win32/taskschd/task-idle-conditions). +- In addition, provisioning will be restarted in the SYSTEM context after a sign in and the [system is idle](/windows/win32/taskschd/task-idle-conditions). ## Related articles diff --git a/windows/client-management/certificate-authentication-device-enrollment.md b/windows/client-management/certificate-authentication-device-enrollment.md index c1ab833e1c..2cea712e44 100644 --- a/windows/client-management/certificate-authentication-device-enrollment.md +++ b/windows/client-management/certificate-authentication-device-enrollment.md @@ -1,8 +1,8 @@ --- title: Certificate authentication device enrollment description: This section provides an example of the mobile device enrollment protocol using certificate authentication policy. -ms.topic: article -ms.date: 08/10/2023 +ms.topic: conceptual +ms.date: 07/08/2024 --- # Certificate authentication device enrollment diff --git a/windows/client-management/certificate-renewal-windows-mdm.md b/windows/client-management/certificate-renewal-windows-mdm.md index 233a34e3dc..66d42a4d90 100644 --- a/windows/client-management/certificate-renewal-windows-mdm.md +++ b/windows/client-management/certificate-renewal-windows-mdm.md @@ -1,8 +1,8 @@ --- title: Certificate Renewal description: Learn how to find all the resources that you need to provide continuous access to client certificates. -ms.topic: article -ms.date: 08/10/2023 +ms.topic: conceptual +ms.date: 07/08/2024 --- # Certificate Renewal @@ -19,7 +19,7 @@ Windows supports automatic certificate renewal, also known as Renew On Behalf Of > [!NOTE] > Certificate renewal of the enrollment certificate through ROBO is only supported with Microsoft PKI. -Auto certificate renewal is the only supported MDM client certificate renewal method for the device that's enrolled using WAB authentication. Meaning, the AuthPolicy is set to Federated. It also means if the server supports WAB authentication, then the MDM certificate enrollment server MUST also support client TLS to renew the MDM client certificate. +Auto certificate renewal is the only supported MDM client certificate renewal method for a device enrolled using WAB authentication. Meaning, the AuthPolicy is set to Federated. It also means if the server supports WAB authentication, then the MDM certificate enrollment server MUST also support client TLS to renew the MDM client certificate. For Windows devices, during the MDM client certificate enrollment phase or during MDM management section, the enrollment server or MDM server could configure the device to support automatic MDM client certificate renewal using [CertificateStore CSP's](mdm/certificatestore-csp.md) ROBOSupport node under `CertificateStore/My/WSTEP/Renew` URL. @@ -89,7 +89,7 @@ In Windows, the renewal period can only be set during the MDM enrollment phase. For more information about the parameters, see the [CertificateStore configuration service provider](mdm/certificatestore-csp.md). -Unlike manual certificate renewal, the device doesn't perform an automatic MDM client certificate renewal if the certificate is already expired. To make sure the device has enough time to automatically renew, we recommend you set a renewal period a couple months (40-60 days) before the certificate expires. And, set the renewal retry interval to every few days, like every 4-5 days instead of every seven days (weekly). This change increases the chance that the device will try to connect at different days of the week. +Unlike manual certificate renewal, the device doesn't perform an automatic MDM client certificate renewal if the certificate is already expired. To make sure the device has enough time to automatically renew, we recommend you set a renewal period a couple months (40-60 days) before the certificate expires. And, set the renewal retry interval to every few days, like every 4-5 days instead of every seven days (weekly). This change increases the chance that the device tries to connect at different days of the week. ## Certificate renewal response @@ -99,7 +99,7 @@ When RequestType is set to Renew, the web service verifies the following (in add - The client's certificate is in the renewal period - The certificate is issued by the enrollment service - The requester is the same as the requester for initial enrollment -- For standard client's request, the client hasn't been blocked +- For standard client's request, the client isn't blocked After validation is completed, the web service retrieves the PKCS#10 content from the PKCS#7 BinarySecurityToken. The rest is the same as initial enrollment, except that the Provisioning XML only needs to have the new certificate issued by the CA. diff --git a/windows/client-management/client-tools/add-remove-hide-features.md b/windows/client-management/client-tools/add-remove-hide-features.md new file mode 100644 index 0000000000..92fa8aaf85 --- /dev/null +++ b/windows/client-management/client-tools/add-remove-hide-features.md @@ -0,0 +1,160 @@ +--- +title: Add, remove, or hide Windows features +description: Learn how to add or remove Windows optional features using the Optional features page in the Settings app. Also see the group policy objects (GPO) and MDM policies that show or hide Windows Features in the Settings app. Use Windows PowerShell to show or hide specific features in Windows Features. +ms.date: 07/01/2024 +ms.topic: how-to +zone_pivot_groups: windows-versions-11-10 +--- + +# Add, remove, or hide Windows features + +Windows has optional features that aren't included by default, but you can add later. These features are called [Features on Demand](/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities), and can be added at any time. Some of these features are language resources like language packs or handwriting support. On organization-owned devices, you can control access to these other features. You can use group policy or mobile device management (MDM) policies to hide the UI from users, or use Windows PowerShell to enable or disable specific features. + +## Use the Windows Settings app to add or remove features + + + +Open the **Optional features** pane in the **Settings** app by selecting the following link: + +> [!div class="nextstepaction"] +> [Optional features](ms-settings:optionalfeatures) + +Or + +1. Right-click on the **Start** menu and select **Run**. + +1. In the **Run** window, next to **Open:**, enter: + + ```console + ms-settings:optionalfeatures + ``` + + and then select **OK**. + +Or + +::: zone pivot="windows-11" + +1. Right-click on the **Start** menu and select **Settings**. + +1. In the left hand pane of the Settings app, select **System**. + +1. In the right hand **System** pane, select **Optional features**. + +> [!NOTE] +> +> The navigation steps, UI elements, and UI text in this section are based on the latest version of Windows 11 with the latest cumulative update installed. For other versions of Windows 11 that are currently supported or don't have the latest cumulative update, some of the navigation steps, UI elements, and UI text might be different. For example, the [**Optional features**](ms-settings:optionalfeatures) pane might be located under **Settings** > **Apps**. + +::: zone-end + +::: zone pivot="windows-10" + +1. Right-click on the **Start** menu and select **Settings**. + +1. In the Settings app, select **System**. + +1. In the left hand pane, select **Optional features**. + +> [!NOTE] +> +> The navigation steps, UI elements, and UI text in this section are based on Windows 10 22H2 with the latest cumulative update installed. For other versions of Windows 10 that are currently supported or don't have the latest cumulative update, some of the navigation steps, UI elements, and UI text might be different. For example, the [**Optional features**](ms-settings:optionalfeatures) pane might be located under **Settings** > **Apps** > **Apps & features**. + +::: zone-end + +### Add a feature + +::: zone pivot="windows-11" + +Once the **System > Optional features** pane is open, add a feature with the following steps: + +1. Select the **View features** button next to **Add an optional feature**. + +1. In the **Add an optional feature** window that opens: + + 1. Find the desired feature to add and then select the box next to the feature to add it. Multiple features can be selected. + + 1. Once all of the desired features are selected, select the **Next** button. + + 1. Review the selected list of features and then select the **Add** button to add the selected features. + +::: zone-end + +::: zone pivot="windows-10" + +Once the **Optional features** pane is open, add a feature with the following steps: + +1. Select the **+** button next to **Add a feature**. + +1. In the **Add an optional feature** window that opens: + + 1. Find the desired feature to add and then select the box next to the feature to add it. Multiple features can be selected. + + 1. Once all of the desired features are selected, select the **Add** button. + +::: zone-end + +> [!IMPORTANT] +> +> Windows Update is used to add the optional features. The device needs to be online so Windows Update can download the content that it needs to add. + +### Remove a feature + +::: zone pivot="windows-11" + +Once the **System > Optional features** pane is open, remove a feature with the following steps: + +1. Under **Installed features**, search for the feature that needs to be removed in the **Search installed features** search box, or scroll through the list of added features until the feature that needs to be removed is found. + +1. Once the feature that needs to be removed is found, select the feature to expand it, and then select the **Remove** button. + +::: zone-end + +::: zone pivot="windows-10" + +Once the **Optional features** pane is open, remove a feature with the following steps: + +1. Under **Installed features**, search for the feature that needs to be removed in the **Find an installed optional feature** search box, or scroll through the list of added features until the feature that needs to be removed is found. + +1. Once the feature that needs to be removed is found, select the feature to expand it, and then select the **Remove** button. + +::: zone-end + +## Use group policy or MDM policies to hide Windows features + +By default, the OS might show Windows features and allow users to add and remove these optional apps and features. To hide Windows features on your user devices, you can use group policy or an MDM provider like Microsoft Intune. + +### Group policy + +If you use group policy, use the `User Configuration\Administrative Template\Control Panel\Programs\Hide "Windows Features"` policy. By default, this policy might be set to **Not configured**, which means users can add or remove features. When this setting is **Enabled**, the settings page to add optional features is hidden on the device. + +You can't use group policy to disable specific Windows features. If you want to disable specific features, use [Windows PowerShell](#use-windows-powershell-to-disable-specific-features). + +If you want to hide the entire **Apps** feature in the Settings app, use the `User Configuration\Administrative Template\Control Panel\Programs\Hide "Programs and Features" page` policy. + +### MDM + +Using Microsoft Intune, you can use [administrative templates](/mem/intune/configuration/administrative-templates-windows) or the [settings catalog](/mem/intune/configuration/settings-catalog) to hide Windows features. + +If you want to hide the entire **Apps** feature in the Settings app, you can use a configuration policy on Intune enrolled devices. For more information on the settings you can configure, see [Control Panel and Settings device restrictions in Microsoft Intune](/mem/intune/configuration/device-restrictions-windows-10#control-panel-and-settings). + +## Use Windows PowerShell to disable specific features + +To disable specific features, use the Windows PowerShell [Disable-WindowsOptionalFeature](/powershell/module/dism/disable-windowsoptionalfeature) cmdlet. + +> [!NOTE] +> +> There isn't a group policy that disables specific Windows features. + +To automate disabling specific features, create a scheduled task to run a PowerShell script. For more information about Windows task scheduler, see [Task Scheduler for developers](/windows/win32/taskschd/task-scheduler-start-page). + +Microsoft Intune can also run PowerShell scripts. For more information, see [Use PowerShell scripts on Windows client devices in Intune](/mem/intune/apps/intune-management-extension). + +To enable specific features, use the [Enable-WindowsOptionalFeature](/powershell/module/dism/enable-windowsoptionalfeature) cmdlet. + +Another useful PowerShell cmdlet is [Get-WindowsOptionalFeature](/powershell/module/dism/get-windowsoptionalfeature). Use this cmdlet to view information about optional features in the current OS or a mounted image. This cmdlet returns the current state of features, and whether a restart might be required when the state changes. + +## Related content + +- [Features on Demand overview](/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities). +- [Available Features on Demand](/windows-hardware/manufacture/desktop/features-on-demand-non-language-fod). +- [Language and region Features on Demand (FOD)](/windows-hardware/manufacture/desktop/features-on-demand-language-fod). diff --git a/windows/client-management/client-tools/administrative-tools-in-windows.md b/windows/client-management/client-tools/administrative-tools-in-windows.md index 7c30da23de..785eb740cc 100644 --- a/windows/client-management/client-tools/administrative-tools-in-windows.md +++ b/windows/client-management/client-tools/administrative-tools-in-windows.md @@ -1,17 +1,28 @@ --- -title: Windows Tools/Administrative Tools +title: Windows Tools description: The folders for Windows Tools and Administrative Tools are folders in the Control Panel that contain tools for system administrators and advanced users. -ms.localizationpriority: medium -ms.date: 08/10/2023 -ms.topic: article +ms.date: 07/01/2024 +ms.topic: conceptual +zone_pivot_groups: windows-versions-11-10 ms.collection: -- highpri -- tier2 +- essentials-manage --- -# Windows Tools/Administrative Tools +# Windows Tools -**Windows Tools** is a folder in the Windows 11 Control Panel. **Administrative Tools** is a folder in the Windows 10 Control Panel. These folders contain tools for system administrators and advanced users. +::: zone pivot="windows-11" + +**Windows Tools** is a folder in the Windows 11 Control Panel. This folder contains tools for system administrators and advanced users. + +::: zone-end + +::: zone pivot="windows-10" + +**Administrative Tools** is a folder in the Windows 10 Control Panel. This folder contains tools for system administrators and advanced users. + +::: zone-end + +::: zone pivot="windows-11" ## Windows Tools folder @@ -23,6 +34,10 @@ The tools in the folder might vary depending on which edition of Windows you use :::image type="content" source="images/win11-windows-tools.png" alt-text="Screenshot of the contents of the Windows Tools folder in Windows 11." lightbox="images/win11-windows-tools.png"::: +::: zone-end + +::: zone pivot="windows-10" + ## Administrative Tools folder The following graphic shows the **Administrative Tools** folder in Windows 10: @@ -33,34 +48,7 @@ The tools in the folder might vary depending on which edition of Windows you use ![Screenshot of the contents of the Administrative Tools folder in Windows 10.](images/admin-tools-folder.png) -## Tools - -The tools are located in the folder `C:\Windows\System32\` or its subfolders. - -These tools were included in previous versions of Windows. The associated documentation for each tool can help you use them. The following list provides links to documentation for each tool. - -- [Component Services](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731901(v=ws.11)) -- [Computer Management](https://support.microsoft.com/topic/how-to-use-computer-management-in-windows-xp-d5872f93-4498-f4dd-3a34-36d6f569924f) -- [Defragment and Optimize Drives](https://support.microsoft.com/windows/ways-to-improve-your-computer-s-performance-c6018c78-0edd-a71a-7040-02267d68ea90) -- [Disk Cleanup](https://support.microsoft.com/windows/disk-cleanup-in-windows-8a96ff42-5751-39ad-23d6-434b4d5b9a68) -- [Event Viewer](/previous-versions/windows/it-pro/windows-2000-server/cc938674(v=technet.10)) -- [iSCSI Initiator](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ee338476(v=ws.10)) -- [Local Security Policy](/previous-versions/tn-archive/dd277395(v=technet.10)) -- [ODBC Data Sources](/sql/odbc/admin/odbc-data-source-administrator) -- [Performance Monitor](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc749115(v=ws.11)) -- [Print Management](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731857(v=ws.11)) -- [Recovery Drive](https://support.microsoft.com/windows/create-a-recovery-drive-abb4691b-5324-6d4a-8766-73fab304c246) -- [Registry Editor](/windows/win32/sysinfo/registry) -- [Resource Monitor](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd883276(v=ws.10)) -- [Services](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc772408(v=ws.11)) -- [System Configuration](/troubleshoot/windows-client/performance/system-configuration-utility-troubleshoot-configuration-errors) -- [System Information](/previous-versions/windows/it-pro/windows-2000-server/cc957818(v=technet.10)) -- [Task Scheduler](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc766428(v=ws.11)) -- [Windows Firewall with Advanced Security](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc754274(v=ws.11)) -- [Windows Memory Diagnostic](/previous-versions/technet-magazine/cc745953(v=msdn.10)) - -> [!TIP] -> If the linked content in this list doesn't provide the information you need to use that tool, send feedback with the **This page** link in the **Feedback** section at the bottom of this article. +::: zone-end ## Related articles diff --git a/windows/client-management/client-tools/change-default-removal-policy-external-storage-media.md b/windows/client-management/client-tools/change-default-removal-policy-external-storage-media.md index 1bcd9ff753..725c23927a 100644 --- a/windows/client-management/client-tools/change-default-removal-policy-external-storage-media.md +++ b/windows/client-management/client-tools/change-default-removal-policy-external-storage-media.md @@ -1,12 +1,11 @@ --- title: Windows default media removal policy -description: In Windows 10 and later, the default removal policy for external storage media changed from Better performance to Quick removal. -ms.date: 08/10/2023 -ms.topic: article -ms.localizationpriority: medium +description: Manage default media removal policy in Windows. +ms.date: 07/01/2024 +ms.topic: conceptual --- -# Change in default removal policy for external storage media in Windows +# Manage default media removal policy Windows defines two main policies, **Quick removal** and **Better performance**, that control how the system interacts with external storage devices such as USB thumb drives or Thunderbolt-enabled external drives. Beginning in Windows 10 version 1809, the default policy is **Quick removal**. In earlier versions of Windows, the default policy was **Better performance**. @@ -16,7 +15,7 @@ You can change the policy setting for each external device, and the policy that You can use the storage device policy setting to change the manner in which Windows manages storage devices to better meet your needs. The policy settings have the following effects: -- **Quick removal**: This policy manages storage operations in a manner that keeps the device ready to remove at any time. You can remove the device without using the Safely Remove Hardware process. However, to do this, Windows can't cache disk write operations. This may degrade system performance. +- **Quick removal**: This policy manages storage operations in a manner that keeps the device ready to remove at any time. You can remove the device without using the Safely Remove Hardware process. However, to do this, Windows can't cache disk write operations. This can degrade system performance. - **Better performance**: This policy manages storage operations in a manner that improves system performance. When this policy is in effect, Windows can cache write operations to the external device. However, you must use the Safely Remove Hardware process to remove the external drive. The Safely Remove Hardware process protects the integrity of data on the device by making sure that all cached operations finish. > [!IMPORTANT] diff --git a/windows/client-management/client-tools/connect-to-remote-aadj-pc.md b/windows/client-management/client-tools/connect-to-remote-aadj-pc.md index 2e3e741284..c08492c201 100644 --- a/windows/client-management/client-tools/connect-to-remote-aadj-pc.md +++ b/windows/client-management/client-tools/connect-to-remote-aadj-pc.md @@ -2,8 +2,8 @@ title: Connect to remote Microsoft Entra joined device description: Learn how to use Remote Desktop Connection to connect to a Microsoft Entra joined device. ms.localizationpriority: medium -ms.date: 08/10/2023 -ms.topic: article +ms.date: 07/01/2024 +ms.topic: conceptual ms.collection: - highpri - tier2 @@ -14,18 +14,16 @@ ms.collection: Windows supports remote connections to devices joined to Active Directory s well as devices joined to Microsoft Entra ID using Remote Desktop Protocol (RDP). - Starting in Windows 10, version 1809, you can [use biometrics to authenticate to a remote desktop session](/windows/whats-new/whats-new-windows-10-version-1809#remote-desktop-with-biometrics). -- Starting in Windows 10/11, with 2022-10 update installed, you can [use Microsoft Entra authentication to connect to the remote Microsoft Entra device](#connect-with-azure-ad-authentication). +- Starting in Windows 10/11, with 2022-10 update installed, you can [use Microsoft Entra authentication to connect to the remote Microsoft Entra device](#connect-with-microsoft-entra-authentication). ## Prerequisites - Both devices (local and remote) must be running a supported version of Windows. - Remote device must have the **Connect to and use this PC from another device using the Remote Desktop app** option selected under **Settings** > **System** > **Remote Desktop**. - - It's recommended to select **Require devices to use Network Level Authentication to connect** option. + - Select **Require devices to use Network Level Authentication to connect** option is recommended. - If the user who joined the device to Microsoft Entra ID is the only one who is going to connect remotely, no other configuration is needed. To allow more users or groups to connect to the device remotely, you must [add users to the Remote Desktop Users group](#add-users-to-remote-desktop-users-group) on the remote device. - Ensure [Remote Credential Guard](/windows/access-protection/remote-credential-guard) is turned off on the device you're using to connect to the remote device. - - ## Connect with Microsoft Entra authentication Microsoft Entra authentication can be used on the following operating systems for both the local and remote device: @@ -64,8 +62,6 @@ The Windows lock screen in the remote session doesn't support Microsoft Entra au Disconnecting the session also ensures that when the connection is relaunched after a period of inactivity, Microsoft Entra ID reevaluates the applicable conditional access policies. - - ## Connect without Microsoft Entra authentication By default, RDP doesn't use Microsoft Entra authentication, even if the remote PC supports it. This method allows you to connect to the remote Microsoft Entra joined device from: diff --git a/windows/client-management/client-tools/images/change-def-rem-policy-2.png b/windows/client-management/client-tools/images/change-def-rem-policy-2.png index d05d5dd16f..d99919de15 100644 Binary files a/windows/client-management/client-tools/images/change-def-rem-policy-2.png and b/windows/client-management/client-tools/images/change-def-rem-policy-2.png differ diff --git a/windows/client-management/client-tools/images/settings-page-visibility-gp.png b/windows/client-management/client-tools/images/settings-page-visibility-gp.png index 198fc83a7c..eabe085176 100644 Binary files a/windows/client-management/client-tools/images/settings-page-visibility-gp.png and b/windows/client-management/client-tools/images/settings-page-visibility-gp.png differ diff --git a/windows/client-management/client-tools/manage-device-installation-with-group-policy.md b/windows/client-management/client-tools/manage-device-installation-with-group-policy.md index 8efcf24c66..052dc9e72a 100644 --- a/windows/client-management/client-tools/manage-device-installation-with-group-policy.md +++ b/windows/client-management/client-tools/manage-device-installation-with-group-policy.md @@ -1,8 +1,8 @@ --- title: Manage Device Installation with Group Policy description: Find out how to manage Device Installation Restrictions with Group Policy. -ms.date: 08/10/2023 -ms.topic: article +ms.date: 07/01/2024 +ms.topic: conceptual --- # Manage Device Installation with Group Policy diff --git a/windows/client-management/client-tools/manage-settings-app-with-group-policy.md b/windows/client-management/client-tools/manage-settings-app-with-group-policy.md index afc00a6203..fb091f005b 100644 --- a/windows/client-management/client-tools/manage-settings-app-with-group-policy.md +++ b/windows/client-management/client-tools/manage-settings-app-with-group-policy.md @@ -1,8 +1,8 @@ --- title: Manage the Settings app with Group Policy description: Find out how to manage the Settings app with Group Policy so you can hide specific pages from users. -ms.date: 08/10/2023 -ms.topic: article +ms.date: 07/01/2024 +ms.topic: conceptual --- # Manage the Settings app with Group Policy diff --git a/windows/client-management/client-tools/mandatory-user-profile.md b/windows/client-management/client-tools/mandatory-user-profile.md index 5c867f498d..5e64dd2f66 100644 --- a/windows/client-management/client-tools/mandatory-user-profile.md +++ b/windows/client-management/client-tools/mandatory-user-profile.md @@ -1,16 +1,13 @@ --- title: Create mandatory user profiles -description: A mandatory user profile is a special type of pre-configured roaming user profile that administrators can use to specify settings for users. -ms.date: 08/10/2023 -ms.topic: article -ms.collection: -- highpri -- tier2 +description: A mandatory user profile is a special type of preconfigured roaming user profile that administrators can use to specify settings for users. +ms.date: 07/01/2024 +ms.topic: conceptual --- # Create mandatory user profiles -A mandatory user profile is a roaming user profile that has been pre-configured by an administrator to specify settings for users. Settings commonly defined in a mandatory profile include (but aren't limited to) icons that appear on the desktop, desktop backgrounds, user preferences in Control Panel, printer selections, and more. Configuration changes made during a user's session that are normally saved to a roaming user profile aren't saved when a mandatory user profile is assigned. +A mandatory user profile is a roaming user profile that has been preconfigured by an administrator to specify settings for users. Settings commonly defined in a mandatory profile include (but aren't limited to) icons that appear on the desktop, desktop backgrounds, user preferences in Control Panel, printer selections, and more. Configuration changes made during a user's session that are normally saved to a roaming user profile aren't saved when a mandatory user profile is assigned. Mandatory user profiles are useful when standardization is important, such as on a kiosk device or in educational settings. Only system administrators can make changes to mandatory user profiles. @@ -118,12 +115,12 @@ In a domain, you modify properties for the user account to point to the mandator ### How to apply a mandatory user profile to users 1. Open **Active Directory Users and Computers** (dsa.msc). -1. Navigate to the user account that you'll assign the mandatory profile to. +1. Navigate to the user account that you want to assign the mandatory profile to. 1. Right-click the user name and open **Properties**. 1. On the **Profile** tab, in the **Profile path** field, enter the path to the shared folder without the extension. For example, if the folder name is `\\server\share\profile.v6`, you would enter `\\server\share\profile`. 1. Select **OK**. -It may take some time for this change to replicate to all domain controllers. +It can take some time for this change to replicate to all domain controllers. ## Apply policies to improve sign-in time diff --git a/windows/client-management/client-tools/quick-assist.md b/windows/client-management/client-tools/quick-assist.md index 58eceea5e1..25a3039918 100644 --- a/windows/client-management/client-tools/quick-assist.md +++ b/windows/client-management/client-tools/quick-assist.md @@ -1,9 +1,8 @@ --- title: Use Quick Assist to help users description: Learn how IT Pros can use Quick Assist to help users. -ms.date: 08/10/2023 -ms.topic: article -ms.localizationpriority: medium +ms.date: 07/01/2024 +ms.topic: conceptual ms.collection: - highpri - tier1 @@ -11,11 +10,16 @@ ms.collection: # Use Quick Assist to help users -Quick Assist is a Microsoft Store application that enables a person to share their device with another person over a remote connection. Your support staff can use it to remotely connect to a user's device and then view its display, make annotations, or take full control. In this way, they can troubleshoot, diagnose technological issues, and provide instructions to users directly on their devices. +Quick Assist is an application that enables a person to share their [Windows](#install-quick-assist-on-windows) or [macOS](#install-quick-assist-on-macos) device with another person over a remote connection. Your support staff can use it to remotely connect to a user's device and then view its display, make annotations, or take full control. In this way, they can troubleshoot, diagnose technological issues, and provide instructions to users directly on their devices. + +> [!IMPORTANT] +> Learn how to [protect yourself from tech support scams](https://support.microsoft.com/help/4013405). Tech support scams are an industry-wide issue where scammers use scare tactics to trick you into unnecessary technical support services. Only allow a Helper to connect to your device if you initiated the interaction by contacting Microsoft Support or your IT support staff directly. +> +> If you or someone you know has been affected by a tech support scam, use the [technical support scam form](https://support.microsoft.com/windows/cfa4609a-92cc-4808-95e8-392b4ffd0753) to report it. ## Before you begin -All that's required to use Quick Assist is suitable network and internet connectivity. No roles, permissions, or policies are involved. Neither party needs to be in a domain. The helper must have a Microsoft account. The sharer doesn't have to authenticate. +All you need to use Quick Assist is suitable network and internet connectivity. No roles, permissions, or policies are involved. Neither party needs to be in a domain. The helper must have a Microsoft account. The sharer doesn't have to authenticate. ### Authentication @@ -38,7 +42,7 @@ Quick Assist communicates over port 443 (https) and connects to the Remote Assis | `*.trouter.skype.com` | Used for Azure Communication Service for chat and connection between parties. | | `aadcdn.msauth.net` | Required for logging in to the application (Microsoft Entra ID). | | `edge.skype.com` | Used for Azure Communication Service for chat and connection between parties. | -| `login.microsoftonline.com` | Required for Microsoft login service. | +| `login.microsoftonline.com` | Required for Microsoft sign-in service. | | `remoteassistanceprodacs.communication.azure.com` | Used for Azure Communication Service for chat and connection between parties. | | `turn.azure.com` | Required for Azure Communication Service. | @@ -89,52 +93,80 @@ Microsoft logs a small amount of session data to monitor the health of the Quick In some scenarios, the helper does require the sharer to respond to application permission prompts (User Account Control), but otherwise the helper has the same permissions as the sharer on the device. -## Install Quick Assist +## Install Quick Assist on Windows ### Install Quick Assist from the Microsoft Store 1. Download the new version of Quick Assist by visiting the [Microsoft Store](https://apps.microsoft.com/store/detail/quick-assist/9P7BP5VNWKX5). -1. In the Microsoft Store, select **Get in Store app**. Then, give permission to install Quick Assist. When the installation is complete, **Get** changes to **Open**.
                        :::image type="content" source="images/quick-assist-get.png" lightbox="images/quick-assist-get.png" alt-text="Microsoft Store window showing the Quick Assist app with a button labeled get in the bottom right corner."::: +1. In the Microsoft Store, select **View in store**, then install Quick Assist. When the installation is complete, **Install** changes to **Open**. For more information, visit [Install Quick Assist](https://support.microsoft.com/windows/install-quick-assist-c17479b7-a49d-4d12-938c-dbfb97c88bca). ### Install Quick Assist with Intune -Before installing Quick Assist, you need to set up synchronization between Intune and Microsoft Store for Business. If you've already set up sync, log into [Microsoft Store for Business](https://businessstore.microsoft.com) and skip to step 5. - -1. In the [Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), go to **Tenant administration** / **Connectors and tokens** / **Microsoft Store for Business** and verify that **Microsoft Store for Business sync** is set to **Enable**. -1. Using your Global Admin account, log into [Microsoft Store for Business](https://businessstore.microsoft.com). -1. Select **Manage** / **Settings** and enable **Show offline apps**. -1. Choose the **Distribute** tab and verify that **Microsoft Intune** is **Active**. You may need to use the **+Add management tool** link if it's not. -1. Search for **Quick Assist** and select it from the Search results. -1. Choose the **Offline** license and select **Get the app** -1. In the Intune admin center, choose **Sync**. -1. Navigate to **Apps** / **Windows** and you should see **Quick Assist (Offline)** in the list. -1. Select it to view its properties. -1. By default, the app isn't assigned to any user or device, select the **Edit** link. Assign the app to the required group of devices and choose **Review + save** to complete the application install. - -> [!NOTE] -> Assigning the app to a device or group of devices instead of a user is important because it's the only way to install a store app in device context. - -Visit [Add Microsoft Store apps to Microsoft Intune](/mem/intune/apps/store-apps-windows) for more information. +To deploy Quick Assist with Intune, see [Add Microsoft Store apps to Microsoft Intune](/mem/intune/apps/store-apps-microsoft). ### Install Quick Assist Offline To install Quick Assist offline, you need to download your APPXBUNDLE and unencoded XML file from [Microsoft Store for Business](https://businessstore.microsoft.com). Visit [Download an offline-licensed app](/microsoft-store/distribute-offline-apps#download-an-offline-licensed-app) for more information. -1. Start **Windows PowerShell** with Administrative privileges. -1. In PowerShell, change the directory to the location you've saved the file to in step 1: `cd ` -1. Run the following command to install Quick Assist: `Add-AppxProvisionedPackage -Online -PackagePath "MicrosoftCorporationII.QuickAssist_8wekyb3d8bbwe.AppxBundle" -LicensePath "MicrosoftCorporationII.QuickAssist_8wekyb3d8bbwe_4bc27046-84c5-8679-dcc7-d44c77a47dd0.xml"` -1. After Quick Assist has installed, run this command to confirm that Quick Assist is installed for the user: `Get-AppxPackage *QuickAssist* -AllUsers` +1. Start **Windows PowerShell** with Administrative privileges +1. In PowerShell, change the directory to the location where you saved the file in step 1: `cd ` +1. To install Quick Assist, run the following command: `Add-AppxProvisionedPackage -Online -PackagePath "MicrosoftCorporationII.QuickAssist_8wekyb3d8bbwe.AppxBundle" -LicensePath "MicrosoftCorporationII.QuickAssist_8wekyb3d8bbwe_4bc27046-84c5-8679-dcc7-d44c77a47dd0.xml"` +1. After Quick Assist is installed, run this command to confirm that Quick Assist is installed for the user: `Get-AppxPackage *QuickAssist* -AllUsers` -## Microsoft Edge WebView2 +### Microsoft Edge WebView2 -The Microsoft Edge WebView2 is a development control that uses Microsoft Edge as the rendering engine to display web content in native apps. The new Quick Assist application has been developed using this control, making it a necessary component for the app to function. +The Microsoft Edge WebView2 is a development control that uses Microsoft Edge as the rendering engine to display web content in native apps. The new Quick Assist application is developed using this control, making it a necessary component for the app to function. - For Windows 11 users, this runtime control is built in. - For Windows 10 users, the Quick Assist Store app detects if WebView2 is present on launch and if necessary, installs it automatically. If an error message or prompt is shown indicating WebView2 isn't present, it needs to be installed separately. -For more information on distributing and installing Microsoft Edge WebView2, visit [Distribute your app and the WebView2 Runtime](/microsoft-edge/webview2/concepts/distribution) +For more information on distributing and installing Microsoft Edge WebView2, visit [Distribute your app and the WebView2 Runtime.](/microsoft-edge/webview2/concepts/distribution) + +## Install Quick Assist on macOS + +Quick Assist for macOS is available for interactions with Microsoft Support. If Microsoft products on your macOS device aren't working as expected, contact [Microsoft Support](https://support.microsoft.com/contactus) for assistance. Your Microsoft Support agent will guide you through the process of downloading and installing it on your device. + +> [!NOTE] +> Quick Assist for macOS is not available outside of Microsoft Support interactions. + +## Disable Quick Assist within your organization + +If your organization utilizes another remote support tool such as [Remote Help](https://www.microsoft.com/security/business/endpoint-management/microsoft-intune-remote-help), disable or remove Quick Assist as a best practice, if it isn't used within your environment. This prevents guests from using Quick Assist to gain access to devices within your organization. + +### Disable Quick Assist + +To disable Quick Assist, block traffic to the `https://remoteassistance.support.services.microsoft.com` endpoint. This is the primary endpoint used by Quick Assist to establish a session, and once blocked, Quick Assist can't be used to get help or help someone. + +### Uninstall Quick Assist + +#### Uninstall via PowerShell + +Run the following PowerShell command as Administrator: + +`Get-AppxPackage -Name MicrosoftCorporationII.QuickAssist | Remove-AppxPackage -AllUsers` + +#### Uninstall via Windows Settings + +Navigate to **Settings** > **Apps** > **Installed apps** > Quick Assist > select the ellipsis (…), then select **Uninstall**. + +## Report Abuse + +Before joining a session, it's important for you to know who you are connecting to. Anyone that has control over your device can perform actions on your device, and potentially install malicious applications or take other actions that can damage your device. + +Follow these best practices for using Quick Assist or any remote desktop software: + +- Never allow a connection to your device by someone claiming to be "IT Support" unless you initiated the interaction with them. +- Don't provide access to anyone claiming to have an urgent need to access your device. +- Don't share credentials to any websites or applications. + +> [!NOTE] +> Microsoft will never contact you through unsolicited emails, phone calls, or other methods to request access to your device. Microsoft will only request access to your device if you have contacted us and directly requested help with solving an issue you are experiencing. If you need customer service support from Microsoft, please visit [Microsoft Support](https://support.microsoft.com/). + +If you suspect that the person connecting to your device is being malicious, disconnect from the session immediately and report the concern to your local authorities and/or any relevant IT members within your organization. + +If you or someone you know has been affected by a tech support scam, use the [technical support scam form](https://support.microsoft.com/windows/cfa4609a-92cc-4808-95e8-392b4ffd0753) to report it. ## Next steps diff --git a/windows/client-management/client-tools/toc.yml b/windows/client-management/client-tools/toc.yml index 115ff9afd8..9600b605e4 100644 --- a/windows/client-management/client-tools/toc.yml +++ b/windows/client-management/client-tools/toc.yml @@ -1,4 +1,6 @@ items: + - name: Add, remove, or hide Windows features + href: add-remove-hide-features.md - name: Windows Tools/Administrative Tools href: administrative-tools-in-windows.md - name: Use Quick Assist to help users @@ -13,7 +15,7 @@ items: href: manage-settings-app-with-group-policy.md - name: Manage default media removal policy href: change-default-removal-policy-external-storage-media.md - - name: What version of Windows am I running - href: windows-version-search.md - name: Windows libraries href: windows-libraries.md + - name: What version of Windows am I running + href: windows-version-search.md \ No newline at end of file diff --git a/windows/client-management/client-tools/windows-libraries.md b/windows/client-management/client-tools/windows-libraries.md index 43666505af..65a263719f 100644 --- a/windows/client-management/client-tools/windows-libraries.md +++ b/windows/client-management/client-tools/windows-libraries.md @@ -1,14 +1,16 @@ --- title: Windows Libraries description: All about Windows Libraries, which are containers for users' content, such as Documents and Pictures. -ms.topic: article -ms.date: 08/10/2023 +ms.topic: conceptual +ms.date: 07/01/2024 --- # Windows libraries Libraries are virtual containers for users' content. A library can contain files and folders stored on the local computer or in a remote storage location. In Windows Explorer, users interact with libraries in ways similar to how they would interact with other folders. Libraries are built upon the legacy known folders (such as My Documents, My Pictures, and My Music) that users are familiar with, and these known folders are automatically included in the default libraries and set as the default save location. +To show libraries in File Explorer, go to **Options**, select the **View** tab, and then select **Show libraries**. + ## Features for Users Windows libraries provide full content search and rich metadata. Libraries offer the following advantages to users: diff --git a/windows/client-management/client-tools/windows-version-search.md b/windows/client-management/client-tools/windows-version-search.md index a9ff816f27..2c34266131 100644 --- a/windows/client-management/client-tools/windows-version-search.md +++ b/windows/client-management/client-tools/windows-version-search.md @@ -1,8 +1,8 @@ --- title: What version of Windows am I running? description: Discover which version of Windows you're running to determine whether or not your device is enrolled in the Long-Term Servicing Channel or General Availability Channel. -ms.date: 08/10/2023 -ms.topic: article +ms.date: 07/01/2024 +ms.topic: conceptual --- # What version of Windows am I running? @@ -17,8 +17,6 @@ To determine if your device is enrolled in the Long-Term Servicing Channel or th Select **Start** > **Settings** > **System**, then select **About**. You then see **Edition**, **Version**, and **OS Build** information. -:::image type="content" source="images/systemcollage.png" alt-text="screenshot of the system properties window for a device running Windows 10."::: - ## Using Keyword Search You can type the following in the search bar and press **ENTER** to see version details for your device. diff --git a/windows/client-management/config-lock.md b/windows/client-management/config-lock.md index 443c29c949..f497c86712 100644 --- a/windows/client-management/config-lock.md +++ b/windows/client-management/config-lock.md @@ -1,8 +1,8 @@ --- title: Secured-core configuration lock description: A secured-core PC (SCPC) feature that prevents configuration drift from secured-core PC features caused by unintentional misconfiguration. -ms.topic: article -ms.date: 08/10/2023 +ms.topic: conceptual +ms.date: 07/08/2024 appliesto: - ✅ Windows 11 --- @@ -63,7 +63,7 @@ The steps to turn on config lock using Microsoft Intune are as follows: Config lock is designed to ensure that a secured-core PC isn't unintentionally misconfigured. You keep the ability to enable or disable SCPC features, for example, firmware protection. You can make these changes with group policies or MDM services like Microsoft Intune. -:::image type="content" source="images/configlock-mem-firmwareprotect.png" alt-text="The Defender Firmware protection setting, with a description of Windows Defender System Guard protects your device from compromised firmware. The setting is set to Off."::: +:::image type="content" source="images/configlock-mem-firmwareprotect.png" alt-text="The Defender Firmware protection setting, with a description of System Guard protects your device from compromised firmware. The setting is set to Off."::: ## FAQ diff --git a/windows/client-management/declared-configuration-extensibility.md b/windows/client-management/declared-configuration-extensibility.md index 3121be77f0..7b1f9991f8 100644 --- a/windows/client-management/declared-configuration-extensibility.md +++ b/windows/client-management/declared-configuration-extensibility.md @@ -1,13 +1,13 @@ --- title: Declared configuration extensibility description: Learn more about declared configuration extensibility through native WMI providers. -ms.date: 09/26/2023 +ms.date: 07/08/2024 ms.topic: how-to --- # Declared configuration extensibility providers -The declared configuration enrollment, which supports the declared configuration client stack, offers extensibility through native WMI providers. This feature instantiates and interfaces with a Windows Management Instrumentation (WMI) provider that has implemented a management infrastructure (MI) interface. The interface must implement GetTargetResource, TestTargetResource, and SetTargetResource methods, and may implement any number of string properties. +The declared configuration enrollment, which supports the declared configuration client stack, offers extensibility through native WMI providers. This feature instantiates and interfaces with a Windows Management Instrumentation (WMI) provider that implements a management infrastructure (MI) interface. The interface must implement GetTargetResource, TestTargetResource, and SetTargetResource methods, and can implement any number of string properties. > [!NOTE] > Only string properties are currently supported by extensibility providers. @@ -51,7 +51,7 @@ uint32 SetTargetResource( To create a native WMI provider, follow the steps outlined in [How to implement an MI provider](/previous-versions/windows/desktop/wmi_v2/how-to-implement-an-mi-provider). These steps include how to generate the source code for an MI interface using the `Convert-MofToProvider.exe` tool to generate the DLL and prepare it for placement. -1. Create a MOF file that defines the schema for the desired state configuration resource including parameters and methods. This file includes the required parameters for the resource. +1. Create a Managed Object Format (MOF) file that defines the schema for the desired state configuration resource including parameters and methods. This file includes the required parameters for the resource. 2. Copy the schema MOF file along with any required files into the provider tools directory, for example: ProviderGenerationTool. 3. Edit the required files and include the correct file names and class names. 4. Invoke the provider generator tool to generate the provider's project files. diff --git a/windows/client-management/declared-configuration.md b/windows/client-management/declared-configuration.md index f655d1ae19..e12a89b7ca 100644 --- a/windows/client-management/declared-configuration.md +++ b/windows/client-management/declared-configuration.md @@ -1,7 +1,7 @@ --- title: Declared configuration protocol description: Learn more about using declared configuration protocol for desired state management of Windows devices. -ms.date: 09/26/2023 +ms.date: 07/08/2024 ms.topic: overview --- diff --git a/windows/client-management/device-update-management.md b/windows/client-management/device-update-management.md index e6c914668a..5f61783f99 100644 --- a/windows/client-management/device-update-management.md +++ b/windows/client-management/device-update-management.md @@ -1,8 +1,8 @@ --- title: Mobile device management MDM for device updates description: Windows provides several APIs to help mobile device management (MDM) solutions manage updates. Learn how to use these APIs to implement update management. -ms.topic: article -ms.date: 08/10/2023 +ms.topic: conceptual +ms.date: 07/08/2024 ms.collection: - highpri - tier2 @@ -25,7 +25,7 @@ In particular, Windows provides APIs to enable MDMs to: - Enter a per-device update approval list. The list makes sure devices only install updates that are approved and tested. - Approve end-user license agreements (EULAs) for the end user so update deployment can be automated even for updates with EULAs. -This article provides independent software vendors (ISV) with the information they need to implement update management in Windows. For more information, see [Policy CSP - Update](mdm/policy-csp-update.md). +This article provides independent software publishers (ISV) with the information they need to implement update management in Windows. For more information, see [Policy CSP - Update](mdm/policy-csp-update.md). > [!NOTE] > The OMA DM APIs for specifying update approvals and getting compliance status refer to updates by using an Update ID. The Update ID is a GUID that identifies a particular update. The MDM will want to show IT-friendly information about the update, instead of a raw GUID, including the update's title, description, KB, update type, like a security update or service pack. For more information, see [[MS-WSUSSS]: Windows Update Services: Server-Server Protocol](/openspecs/windows_protocols/ms-wsusss/f49f0c3e-a426-4b4b-b401-9aeb2892815c). @@ -88,7 +88,7 @@ This section describes a possible algorithm for using the server-server sync pro First some background: -- If you have a multi-tenant MDM, the update metadata can be kept in a shared partition, since it's common to all tenants. +- If you have a multitenant MDM, the update metadata can be kept in a shared partition, since it's common to all tenants. - A metadata sync service can then be implemented. The service periodically calls server-server sync to pull in metadata for the updates IT cares about. - The MDM component that uses OMA DM to control devices (described in the next section) should send the metadata sync service the list of needed updates it gets from each client, if those updates aren't already known to the device. @@ -130,7 +130,7 @@ The following screenshots of the administrator console show the list of update t ### SyncML example -Set auto update to notify and defer. +Set Microsoft AutoUpdate to notify and defer. ```xml diff --git a/windows/client-management/disconnecting-from-mdm-unenrollment.md b/windows/client-management/disconnecting-from-mdm-unenrollment.md index 00e2645545..cfc52d7c69 100644 --- a/windows/client-management/disconnecting-from-mdm-unenrollment.md +++ b/windows/client-management/disconnecting-from-mdm-unenrollment.md @@ -1,8 +1,8 @@ --- title: Disconnecting from the management infrastructure (unenrollment) description: Disconnecting is initiated either locally by the user using a phone or remotely by the IT admin using management server. -ms.topic: article -ms.date: 08/10/2023 +ms.topic: conceptual +ms.date: 07/08/2024 --- # Disconnecting from the management infrastructure (unenrollment) @@ -22,14 +22,14 @@ During disconnection, the client executes the following tasks: In Windows, after the user confirms the account deletion command and before the account is deleted, the MDM client will notify to the MDM server that the account will be removed. This notification is a best-effort action as no retry is built in to ensure the notification is successfully sent to the device. -This action utilizes the OMA DM generic alert 1226 function to send a user an MDM unenrollment user alert to the MDM server after the device accepts the user unenrollment request, but before it deletes any enterprise data. The server should set the expectation that unenrollment may succeed or fail, and the server can check whether the device is unenrolled by either checking whether the device calls back at scheduled time or by sending a push notification to the device to see whether it responds back. If the server plans to send a push notification, it should allow for some delay to give the device the time to complete the unenrollment work. +This action utilizes the OMA DM generic alert 1226 function to send a user an MDM unenrollment user alert to the MDM server after the device accepts the user unenrollment request, but before it deletes any enterprise data. The server should set the expectation that unenrollment can succeed or fail, and the server can check whether the device is unenrolled by either checking whether the device calls back at scheduled time or by sending a push notification to the device to see whether it responds back. If the server plans to send a push notification, it should allow for some delay to give the device the time to complete the unenrollment work. > [!NOTE] > The user unenrollment is an OMA DM standard. For more information about the 1226 generic alert, see the OMA Device Management Protocol specification (OMA-TS-DM\_Protocol-V1\_2\_1-20080617-A), available from the [OMA website](https://www.openmobilealliance.org/release/DM/V1_1_2-20031209-A/). The vendor uses the Type attribute to specify what type of generic alert it is. For device initiated MDM unenrollment, the alert type is **com.microsoft:mdm.unenrollment.userrequest**. -After the user elects to unenroll, any active MDM OMA DM sessions are terminated. After that, the DM client starts a DM session, including a user unenroll generic alert in the first package that it sends to the server. +After the user elects to unenroll, any active MDM OMA DM sessions are terminated. After that, the DMClient starts a DM session, including a user unenroll generic alert in the first package that it sends to the server. The following sample shows an OMA DM first package that contains a generic alert message. For more information on WP OMA DM support, see the [OMA DM protocol support](oma-dm-protocol-support.md) article. @@ -107,15 +107,13 @@ You can only use the Work Access page to unenroll under the following conditions - Enrollment was done using bulk enrollment. - Enrollment was created using the Work Access page. - - ## Unenrollment from Microsoft Entra join When a user is enrolled into MDM through Microsoft Entra join and later, the enrollment disconnects, there's no warning that the user will lose Windows Information Protection (WIP) data. The disconnection message doesn't indicate the loss of WIP data. ![aadj unenerollment.](images/azure-ad-unenrollment.png) -During the process in which a device is enrolled into MDM through Microsoft Entra join and then remotely unenrolled, the device may get into a state where it must be reimaged. When devices are remotely unenrolled from MDM, the Microsoft Entra association is also removed. This safeguard is in place to avoid leaving the corporate devices in unmanaged state. +During the process in which a device is enrolled into MDM through Microsoft Entra join and then remotely unenrolled, the device can get into a state where it must be reimaged. When devices are remotely unenrolled from MDM, the Microsoft Entra association is also removed. This safeguard is in place to avoid leaving the corporate devices in unmanaged state. Before remotely unenrolling corporate devices, you must ensure that there is at least one admin user on the device that isn't part of Microsoft Entra ID, otherwise the device won't have any admin user after the operation. diff --git a/windows/client-management/docfx.json b/windows/client-management/docfx.json index c0fe754915..07e6f430e8 100644 --- a/windows/client-management/docfx.json +++ b/windows/client-management/docfx.json @@ -41,15 +41,14 @@ "zone_pivot_group_filename": "resources/zone-pivot-groups.json", "breadcrumb_path": "/windows/resources/breadcrumb/toc.json", "uhfHeaderId": "MSDocsHeader-Windows", - "ms.technology": "itpro-manage", "audience": "ITPro", - "ms.prod": "windows-client", - "ms.topic": "article", + "ms.service": "windows-client", + "ms.subservice": "itpro-manage", + "ms.topic": "conceptual", "ms.author": "vinpa", "author": "vinaypamnani-msft", "manager": "aaroncz", - "feedback_system": "GitHub", - "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", + "feedback_system": "Standard", "feedback_product_url": "https://support.microsoft.com/windows/send-feedback-to-microsoft-with-the-feedback-hub-app-f59187f8-8739-22d6-ba93-f66612949332", "_op_documentIdPathDepotMapping": { "./": { @@ -59,18 +58,17 @@ }, "titleSuffix": "Windows Client Management", "contributors_to_exclude": [ - "rjagiewich", - "traya1", - "rmca14", - "claydetels19", + "dstrome2", + "rjagiewich", + "American-Dipper", + "claydetels19", "jborsecnik", - "tiburd", + "v-stchambers", + "shdyas", + "Stacyrch140", "garycentric", - "beccarobins", - "american-dipper", - "angelamotherofdragons", - "v-stsavell", - "stacyrch140" + "dstrome", + "beccarobins" ], "searchScope": [ "Windows 10" @@ -86,6 +84,9 @@ "✅ Windows 11", "✅ Windows 10" ] + }, + "ms.topic": { + "mdm/*.md": "reference" } }, "template": [], diff --git a/windows/client-management/enable-admx-backed-policies-in-mdm.md b/windows/client-management/enable-admx-backed-policies-in-mdm.md index bd41f63d4d..db0f36a085 100644 --- a/windows/client-management/enable-admx-backed-policies-in-mdm.md +++ b/windows/client-management/enable-admx-backed-policies-in-mdm.md @@ -1,9 +1,9 @@ --- title: Enable ADMX policies in MDM description: Use this step-by-step guide to configure a selected set of Group Policy administrative templates (ADMX policies) in Mobile Device Management (MDM). -ms.topic: article +ms.topic: conceptual ms.localizationpriority: medium -ms.date: 08/10/2023 +ms.date: 07/08/2024 --- # Enable ADMX policies in MDM diff --git a/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy.md b/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy.md index 853f60c4dd..409c283821 100644 --- a/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy.md +++ b/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy.md @@ -1,8 +1,8 @@ --- title: Enroll a Windows device automatically using Group Policy description: Learn how to use a Group Policy to trigger autoenrollment to MDM for Active Directory (AD) domain-joined devices. -ms.topic: article -ms.date: 08/10/2023 +ms.topic: conceptual +ms.date: 07/08/2024 ms.collection: - highpri - tier2 @@ -12,7 +12,7 @@ ms.collection: You can use a Group Policy to trigger autoenrollment to Mobile Device Management (MDM) for Active Directory (AD) domain-joined devices. -The enrollment into Intune is triggered by a group policy created on your local AD and happens without any user interaction. This cause-and-effect mechanism means you can automatically mass-enroll a large number of domain-joined corporate devices into Microsoft Intune. The enrollment process starts in the background once you sign in to the device with your Microsoft Entra account. +The group policy created on your local AD triggers enrollment into Intune without any user interaction. This cause-and-effect mechanism means you can automatically mass-enroll a large number of domain-joined corporate devices into Microsoft Intune. The enrollment process starts in the background once you sign in to the device with your Microsoft Entra account. **Requirements**: diff --git a/windows/client-management/enterprise-app-management.md b/windows/client-management/enterprise-app-management.md index 976b340e5a..323376d673 100644 --- a/windows/client-management/enterprise-app-management.md +++ b/windows/client-management/enterprise-app-management.md @@ -1,8 +1,8 @@ --- title: Enterprise app management description: This article covers one of the key mobile device management (MDM) features for managing the lifecycle of apps across Windows devices. -ms.topic: article -ms.date: 08/10/2023 +ms.topic: conceptual +ms.date: 07/08/2024 --- # Enterprise app management @@ -116,7 +116,7 @@ There are two basic types of apps you can deploy: - Store apps. - Enterprise signed apps. -To deploy enterprise signed apps, you must enable a setting on the device to allow trusted apps. The apps can be signed by a Microsoft approved root (such as Symantec), an enterprise deployed root, or apps that are self-signed. This section covers the steps to configure the device for non-store app deployment. +To deploy enterprise signed apps, you must enable a setting on the device to allow trusted apps. The apps can be signed by a Microsoft approved root (such as Symantec), an enterprise deployed root, or apps that are self-signed. This section covers the steps to configure the device for nonstore app deployment. ### Unlock the device for non-Store apps @@ -154,7 +154,7 @@ Here's an example: ### Unlock the device for developer mode -Development of apps on Windows devices no longer requires a special license. You can enable debugging and deployment of non-packaged apps using [ApplicationManagement/AllowDeveloperUnlock](mdm/policy-csp-applicationmanagement.md) policy in Policy CSP. +Development of apps on Windows devices no longer requires a special license. You can enable debugging and deployment of nonpackaged apps using [ApplicationManagement/AllowDeveloperUnlock](mdm/policy-csp-applicationmanagement.md) policy in Policy CSP. AllowDeveloperUnlock policy enables the development mode on the device. The AllowDeveloperUnlock isn't configured by default, which means only Microsoft Store apps can be installed. If the management server explicitly sets the value to off, the setting is disabled in the settings panel on the device. @@ -238,8 +238,8 @@ If you purchased an app from the Store for Business, the app license must be dep In the SyncML, you need to specify the following information in the `Exec` command: -- License ID - This ID is specified in the LocURI. The License ID for the offline license is referred to as the "Content ID" in the license file. You can retrieve this information from the Base64 encoded license download from the Store for Business. -- License Content - This content is specified in the data section. The License Content is the Base64 encoded blob of the license. +- License ID - This ID is specified in the LocURI. The License ID for the offline license is referred to as the "Content ID" in the license file. You can retrieve this information from the Base 64 encoded license download from the Store for Business. +- License Content - This content is specified in the data section. The License Content is the Base 64 encoded blob of the license. Here's an example of an offline license installation. @@ -469,7 +469,7 @@ When an app installation is completed, a Windows notification is sent. You can a - NOT\_INSTALLED (0) - The node was added, but the execution wasn't completed. - INSTALLING (1) - Execution has started, but the deployment hasn't completed. If the deployment completes regardless of success, then this value is updated. - FAILED (2) - Installation failed. The details of the error can be found under LastError and LastErrorDescription. - - INSTALLED (3) - Once an install is successful this node is cleaned up. If the clean up action hasn't completed, then this state may briefly appear. + - INSTALLED (3) - Once an install is successful this node is cleaned up. If the clean-up action hasn't completed, then this state may briefly appear. - LastError - The last error reported by the app deployment server. - LastErrorDescription - Describes the last error reported by the app deployment server. - Status - An integer that indicates the progress of the app installation. In cases of an HTTPS location, this status shows the estimated download progress. Status isn't available for provisioning and only used for user-based installations. For provisioning, the value is always 0. diff --git a/windows/client-management/esim-enterprise-management.md b/windows/client-management/esim-enterprise-management.md index 970b5917af..2a28981591 100644 --- a/windows/client-management/esim-enterprise-management.md +++ b/windows/client-management/esim-enterprise-management.md @@ -3,7 +3,7 @@ title: eSIM Enterprise Management description: Learn how Mobile Device Management (MDM) Providers support the eSIM Profile Management Solution on Windows. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 08/10/2023 +ms.date: 07/08/2024 --- # How Mobile Device Management Providers support eSIM Management on Windows @@ -28,7 +28,7 @@ If you're a Mobile Device Management (MDM) Provider and want to support eSIM Man - Assess solution type that you would like to provide your customers - Batch/offline solution - IT Admin can manually import a flat file containing list of eSIM activation codes, and provision eSIM on LTE enabled devices. -- Operator doesn't have visibility over status of the eSIM profiles and device eSIM has been downloaded and installed to +- Operator doesn't have visibility over status of the eSIM profiles - Real-time solution - MDM automatically syncs with the Operator backend system for subscription pool and eSIM management, via SIM vendor solution component. IT Admin can view subscription pool and provision eSIM in real time. - Operator is notified of the status of each eSIM profile and has visibility on which devices are being used diff --git a/windows/client-management/federated-authentication-device-enrollment.md b/windows/client-management/federated-authentication-device-enrollment.md index a96b2ed7e3..32b2fef7ef 100644 --- a/windows/client-management/federated-authentication-device-enrollment.md +++ b/windows/client-management/federated-authentication-device-enrollment.md @@ -1,8 +1,8 @@ --- title: Federated authentication device enrollment description: This section provides an example of the mobile device enrollment protocol using federated authentication policy. -ms.topic: article -ms.date: 08/10/2023 +ms.topic: conceptual +ms.date: 07/08/2024 --- # Federated authentication device enrollment @@ -122,7 +122,7 @@ The discovery response is in the XML format and includes the following fields: > [!NOTE] > The HTTP server response must not set Transfer-Encoding to Chunked; it must be sent as one message. -When authentication policy is set to be Federated, Web Authentication Broker (WAB) is used by the enrollment client to get a security token. The WAB start page URL is provided by the discovery service in the response message. The enrollment client calls the WAB API within the response message to start the WAB process. WAB pages are server hosted web pages. The server should build those pages to fit the device screen nicely and be as consistent as possible to other builds in the MDM enrollment UI. The opaque security token that is returned from WAB as an endpage is used by the enrollment client as the device security secret during the client certificate enrollment request call. +When authentication policy is set to be Federated, Web Authentication Broker (WAB) is used by the enrollment client to get a security token. The WAB start page URL is provided by the discovery service in the response message. The enrollment client calls the WAB API within the response message to start the WAB process. WAB pages are server hosted web pages. The server should build those pages to fit the device screen nicely and be as consistent as possible to other builds in the MDM enrollment UI. The opaque security token that is returned from WAB as an end page is used by the enrollment client as the device security secret during the client certificate enrollment request call. > [!NOTE] > Instead of relying on the user agent string that is passed during authentication to get information, such as the OS version, use the following guidance: @@ -183,7 +183,7 @@ Content-Length: 556 ``` -The server has to send a POST to a redirect URL of the form `ms-app://string` (the URL scheme is ms-app) as indicated in the POST method action. The security token value is the base64-encoded string `http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd\#base64binary` contained in the `` EncodingType attribute. Windows does the binary encode when it sends it back to enrollment server, in the form its just HTML encoded. This string is opaque to the enrollment client; the client doesn't interpret the string. +The server has to send a POST to a redirect URL of the form `ms-app://string` (the URL scheme is ms-app) as indicated in the POST method action. The security token value is the base64-encoded string `http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd\#base64binary` contained in the `` EncodingType attribute. Windows does the binary encode when it sends it back to enrollment server, in the form it's just HTML encoded. This string is opaque to the enrollment client; the client doesn't interpret the string. The following example shows a response received from the discovery web service that requires authentication via WAB. @@ -367,7 +367,7 @@ The following snippet shows the policy web service response. ## Enrollment web service -This web service implements the MS-WSTEP protocol. It processes the RequestSecurityToken (RST) message from the client, authenticates the client, requests the certificate from the CA, and returns it in the RequestSecurityTokenResponse (RSTR) to the client. Besides the issued certificate, the response also contains configurations needed to provision the DM client. +This web service implements the MS-WSTEP protocol. It processes the RequestSecurityToken (RST) message from the client, authenticates the client, requests the certificate from the CA, and returns it in the RequestSecurityTokenResponse (RSTR) to the client. Besides the issued certificate, the response also contains configurations needed to provision the DMClient. The RequestSecurityToken (RST) must have the user credential and a certificate request. The user credential in an RST SOAP envelope is the same as in GetPolicies, and can vary depending on whether the authentication policy is OnPremise or Federated. The BinarySecurityToken in an RST SOAP body contains a Base64-encoded PKCS\#10 certificate request, which is generated by the client based on the enrollment policy. The client could have requested an enrollment policy by using MS-XCEP before requesting a certificate using MS-WSTEP. If the PKCS\#10 certificate request is accepted by the certification authority (CA) (the key length, hashing algorithm, and so on, match the certificate template), the client can enroll successfully. @@ -471,15 +471,15 @@ Similar to the TokenType in the RST, the RSTR uses a custom ValueType in the Bin The provisioning XML contains: - The requested certificates (required) -- The DM client configuration (required) +- The DMClient configuration (required) -The client installs the client certificate, the enterprise root certificate, and intermediate CA certificate if there's one. The DM configuration includes the name and address of the DM server, which client certificate to use, and schedules when the DM client calls back to the server. +The client installs the client certificate, the enterprise root certificate, and intermediate CA certificate if there's one. The DM configuration includes the name and address of the DM server, which client certificate to use, and schedules when the DMClient calls back to the server. Enrollment provisioning XML should contain a maximum of one root certificate and one intermediate CA certificate that is needed to chain up the MDM client certificate. More root and intermediate CA certificates could be provisioned during an OMA DM session. When root and intermediate CA certificates are being provisioned, the supported CSP node path is: CertificateStore/Root/System for root certificate provisioning, CertificateStore/My/User for intermediate CA certificate provisioning. -Here's a sample RSTR message and a sample of OMA client provisioning XML within RSTR. For more information about the configuration service providers (CSPs) used in provisioning XML, see the Enterprise settings, policies and app management section. +Here's a sample RSTR message and a sample of OMA client provisioning XML within RSTR. For more information about the configuration service providers (CSPs) used in provisioning XML, see the Enterprise settings, policies, and app management section. The following example shows the enrollment web service response. diff --git a/windows/client-management/images/8908044-recall.png b/windows/client-management/images/8908044-recall.png new file mode 100644 index 0000000000..92c93c46cb Binary files /dev/null and b/windows/client-management/images/8908044-recall.png differ diff --git a/windows/client-management/images/bing-chat-enterprise-chat-provider.png b/windows/client-management/images/bing-chat-enterprise-chat-provider.png deleted file mode 100644 index 6213a99d16..0000000000 Binary files a/windows/client-management/images/bing-chat-enterprise-chat-provider.png and /dev/null differ diff --git a/windows/client-management/images/copilot-commercial-data-protection-chat-provider.png b/windows/client-management/images/copilot-commercial-data-protection-chat-provider.png new file mode 100644 index 0000000000..a7db0da381 Binary files /dev/null and b/windows/client-management/images/copilot-commercial-data-protection-chat-provider.png differ diff --git a/windows/client-management/images/insider.png b/windows/client-management/images/insider.png new file mode 100644 index 0000000000..dbe00408cb Binary files /dev/null and b/windows/client-management/images/insider.png differ diff --git a/windows/client-management/images/work-toggle-graph-grounded-chat.png b/windows/client-management/images/work-toggle-graph-grounded-chat.png new file mode 100644 index 0000000000..6b54325f3a Binary files /dev/null and b/windows/client-management/images/work-toggle-graph-grounded-chat.png differ diff --git a/windows/client-management/implement-server-side-mobile-application-management.md b/windows/client-management/implement-server-side-mobile-application-management.md index ae35a82630..6d2acde09e 100644 --- a/windows/client-management/implement-server-side-mobile-application-management.md +++ b/windows/client-management/implement-server-side-mobile-application-management.md @@ -1,8 +1,8 @@ --- title: Support for Windows Information Protection (WIP) on Windows description: Learn about implementing the Windows version of Windows Information Protection (WIP), which is a lightweight solution for managing company data access and security on personal devices. -ms.topic: article -ms.date: 08/10/2023 +ms.topic: conceptual +ms.date: 07/08/2024 --- # Support for Windows Information Protection (WIP) on Windows @@ -11,8 +11,6 @@ Windows Information Protection (WIP) is a lightweight solution for managing comp [!INCLUDE [Deprecate Windows Information Protection](../security/information-protection/windows-information-protection/includes/wip-deprecation.md)] - - ## Integration with Microsoft Entra ID WIP is integrated with Microsoft Entra identity service. The WIP service supports Microsoft Entra integrated authentication for the user and the device during enrollment and the downloading of WIP policies. WIP integration with Microsoft Entra ID is similar to mobile device management (MDM) integration. See [Microsoft Entra integration with MDM](azure-active-directory-integration-with-mdm.md). @@ -78,7 +76,7 @@ Since the [Poll](mdm/dmclient-csp.md#deviceproviderprovideridpoll) node isn't pr ## Supported CSPs -WIP supports the following configuration service providers (CSPs). All other CSPs are blocked. Note the list may change later based on customer feedback: +WIP supports the following configuration service providers (CSPs). All other CSPs are blocked. Note the list can change later based on customer feedback: - [AppLocker CSP](mdm/applocker-csp.md) for configuration of Windows Information Protection enterprise allowed apps. - [ClientCertificateInstall CSP](mdm/clientcertificateinstall-csp.md) for installing VPN and Wi-Fi certs. diff --git a/windows/client-management/includes/insider-note.md b/windows/client-management/includes/insider-note.md new file mode 100644 index 0000000000..a1160f8047 --- /dev/null +++ b/windows/client-management/includes/insider-note.md @@ -0,0 +1,16 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.topic: include +ms.date: 01/11/2024 +--- + +:::row::: +:::column span="1"::: +:::image type="content" source="../images/insider.png" alt-text="Logo of Windows Insider." border="false"::: +:::column-end::: +:::column span="3"::: +> [!IMPORTANT] +>This article describes features or settings that are under development and only applicable to [Windows Insider Preview builds](/windows-insider/). The content is subject to change and may have dependencies on other features or services in preview. +:::column-end::: +:::row-end::: diff --git a/windows/client-management/includes/mdm-enrollment-error-codes.md b/windows/client-management/includes/mdm-enrollment-error-codes.md index 017a48153f..186805615f 100644 --- a/windows/client-management/includes/mdm-enrollment-error-codes.md +++ b/windows/client-management/includes/mdm-enrollment-error-codes.md @@ -1,7 +1,7 @@ --- author: vinaypamnani-msft ms.author: vinpa -ms.prod: windows +ms.service: windows-client ms.topic: include ms.date: 04/06/2023 --- diff --git a/windows/client-management/index.yml b/windows/client-management/index.yml index 40f4cb654f..4cee76e2bb 100644 --- a/windows/client-management/index.yml +++ b/windows/client-management/index.yml @@ -7,15 +7,14 @@ metadata: title: Manage Windows client # Required; page title displayed in search results. Include the brand. < 60 chars. description: Learn about the administrative tools, tasks, and best practices for managing Windows clients across your enterprise. # Required; article description that is displayed in search results. < 160 chars. ms.topic: landing-page - ms.prod: windows-client - ms.technology: itpro-manage ms.collection: - highpri - tier1 + - essentials-manage author: vinaypamnani-msft ms.author: vinpa manager: aaroncz - ms.date: 09/26/2023 + ms.date: 07/08/2024 localization_priority: medium # linkListType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | tutorial | video | whats-new diff --git a/windows/client-management/manage-recall.md b/windows/client-management/manage-recall.md new file mode 100644 index 0000000000..82a405289c --- /dev/null +++ b/windows/client-management/manage-recall.md @@ -0,0 +1,96 @@ +--- +title: Manage Recall for Windows clients +description: Learn how to manage Recall for commercial environments using MDM and group policy. Learn about Recall features. +ms.topic: how-to +ms.subservice: windows-copilot +ms.date: 06/13/2024 +ms.author: mstewart +author: mestew +ms.collection: + - windows-copilot + - magic-ai-copilot +appliesto: +- ✅ Copilot+ PCs +--- + + +# Manage Recall + +>**Looking for consumer information?** See [Retrace your steps with Recall](https://support.microsoft.com/windows/retrace-your-steps-with-recall-aa03f8a0-a78b-4b3e-b0a1-2eb8ac48701c). + +Recall allows you to search across time to find the content you need. Just describe how you remember it, and Recall retrieves the moment you saw it. Recall takes snapshots of your screen and stores them in a timeline. Snapshots are taken every five seconds while content on the screen is different from the previous snapshot. Snapshots are locally stored and locally analyzed on your PC. Recall's analysis allows you to search for content, including both images and text, using natural language. + +> [!NOTE] +> Recall is coming soon through a post-launch Windows update. See [aka.ms/copilotpluspcs](https://aka.ms/copilotpluspcs). + +When Recall opens the snapshot a user selected, it enables screenray, which runs on top of the saved snapshot. Screenray analyzes what's in the snapshot and allows users to interact with individual elements in the snapshot. For instance, users can copy text from the snapshot or send pictures from the snapshot to an app that supports `jpeg` files. + +:::image type="content" source="images/8908044-recall.png" alt-text="Screenshot of Recall with search results displayed for a query about a restaurant that the user's friend sent them." lightbox="images/8908044-recall.png"::: + +## System requirements +Recall has the following minimum system requirements: + +- A [Copilot+ PC](https://www.microsoft.com/windows/business/devices/copilot-plus-pcs#copilot-plus-pcs) +- 16 GB RAM +- 8 logical processors +- 256 GB storage capacity + - To enable Recall, you need at least 50 GB of space free + - Snapshot capture automatically pauses once the device has less than 25 GB of disk space + +## Supported browsers + +Users need a supported browser for Recall to [filter websites](#user-controlled-settings-for-recall) and to automatically filter private browsing activity. Supported browsers, and their capabilities include: + +- **Microsoft Edge**: blocks websites and filters private browsing activity +- **Firefox**: blocks websites and filters private browsing activity +- **Opera**: blocks websites and filters private browsing activity +- **Google Chrome**: blocks websites and filters private browsing activity +- **Chromium based browsers** (124 or later): For Chromium-based browsers not listed above, filters private browsing activity only, doesn't block specific websites + + +## Configure policies for Recall + +Organizations that aren't ready to use AI for historical analysis can disable it until they're ready with the **Turn off saving snapshots for Windows** policy. If snapshots were previously saved on a device, they'll be deleted when this policy is enabled. The following policy allows you to disable analysis of user content: + +|   | Setting | +|---|---| +| **CSP** | ./User/Vendor/MSFT/Policy/Config/WindowsAI/[DisableAIDataAnalysis](mdm/policy-csp-windowsai.md#disableaidataanalysis) | +| **Group policy** | User Configuration > Administrative Templates > Windows Components > Windows AI > **Turn off saving snapshots for Windows** | + +## Limitations + +In two specific scenarios, Recall captures snapshots that include InPrivate windows, blocked apps, and blocked websites. If Recall gets launched, or the **Now** option is selected in Recall, then a snapshot is taken even when InPrivate windows, blocked apps, and blocked websites are displayed. However, Recall doesn't save these snapshots. If you choose to send the information from this snapshot to another app, a temp file is created in `C:\Users\[username]\AppData\Local\Temp` to share the content. The temporary file is deleted once the content is transferred over the app you selected to use. + +## User controlled settings for Recall + +The following options are user controlled in Recall from the **Settings** > **Privacy & Security** > **Recall & Snapshots** page: + +- Website filtering +- App filtering +- Storage allocation + - When the storage limit is reached, the oldest snapshots are deleted first. +- Deleting snapshots + - Delete all snapshots + - Delete snapshots within a specific time frame + + +### Storage allocation + +The amount of disk space users can allocate to Recall varies depending on how much storage the device has. The following chart shows the storage space options for Recall: + +| Device storage capacity | Storage allocation options for Recall | +|---|---| +| 256 GB | 25 GB (default), 10 GB | +| 512 GB | 75 GB (default), 50 GB, 25 GB | +| 1 TB, or more | 150 GB (default), 100 GB, 75 GB, 50 GB, 25 GB | + + +## Microsoft's commitment to responsible AI + +Microsoft has been on a responsible AI journey since 2017, when we defined our principles and approach to ensuring this technology is used in a way that is driven by ethical principles that put people first. For more about our responsible AI journey, the ethical principles that guide us, and the tooling and capabilities we've created to assure that we develop AI technology responsibly, see [Responsible AI](https://www.microsoft.com/ai/responsible-ai). + +Recall uses optical character recognition (OCR), local to the PC, to analyze snapshots and facilitate search. For more information about OCR, see [Transparency note and use cases for OCR](/legal/cognitive-services/computer-vision/ocr-transparency-note). For more information about privacy and security, see [Privacy and control over your Recall experience](https://support.microsoft.com/windows/privacy-and-control-over-your-recall-experience-d404f672-7647-41e5-886c-a3c59680af15). + +## Information for developers + +If you're a developer and want to launch Recall, you can call the `ms-recall` protocol URI. When you call this, Recall opens and takes a snapshot of the screen, which is the default behavior for when Recall is launched. For more information about using Recall in your Windows app, see [Recall overview](/windows/ai/apis/recall) in the Windows AI API documentation. diff --git a/windows/client-management/manage-windows-10-in-your-organization-modern-management.md b/windows/client-management/manage-windows-10-in-your-organization-modern-management.md index 7129573f55..a43167be49 100644 --- a/windows/client-management/manage-windows-10-in-your-organization-modern-management.md +++ b/windows/client-management/manage-windows-10-in-your-organization-modern-management.md @@ -2,13 +2,13 @@ title: Manage Windows devices in your organization - transitioning to modern management description: This article offers strategies for deploying and managing Windows devices, including deploying Windows in a mixed environment. ms.localizationpriority: medium -ms.date: 08/10/2023 -ms.topic: article +ms.date: 07/08/2024 +ms.topic: conceptual --- # Manage Windows devices in your organization - transitioning to modern management -Use of personal devices for work, and employees working outside the office, may be changing how your organization manages devices. Certain parts of your organization might require deep, granular control over devices, while other parts might seek lighter, scenario-based management that empowers the modern workforce. Windows offers the flexibility to respond to these changing requirements, and can easily be deployed in a mixed environment. You can shift the percentage of Windows devices gradually, following the normal upgrade schedules used in your organization. +Use of personal devices for work, and users working outside the office, may be changing how your organization manages devices. Certain parts of your organization might require deep, granular control over devices, while other parts might seek lighter, scenario-based management that empowers the modern workforce. Windows offers the flexibility to respond to these changing requirements, and can easily be deployed in a mixed environment. You can shift the percentage of Windows devices gradually, following the normal upgrade schedules used in your organization. Your organization can support various operating systems across a wide range of device types, and manage them through a common set of tools such as Microsoft Configuration Manager, Microsoft Intune, or other third-party products. This "managed diversity" enables you to empower your users to benefit from the productivity enhancements available on their new Windows devices (including rich touch and ink support), while still maintaining your standards for security and manageability. It can help you and your organization benefit from Windows faster. @@ -45,13 +45,13 @@ You can use Windows and services like [Microsoft Entra ID](/azure/active-directo You can envision user and device management as falling into these two categories: -- **Corporate (CYOD) or personal (BYOD) devices used by mobile users for SaaS apps such as Office 365.** With Windows, your employees can self-provision their devices: +- **Corporate (CYOD) or personal (BYOD) devices used by mobile users for SaaS apps such as Office 365.** With Windows, your users can self-provision their devices: - For corporate devices, they can set up corporate access with [Microsoft Entra join](/azure/active-directory/devices/overview). When you offer them Microsoft Entra join with automatic Intune MDM enrollment, they can bring devices into a corporate-managed state in [*one step*](https://techcommunity.microsoft.com/t5/azure-active-directory-identity/windows-10-azure-ad-and-microsoft-intune-automatic-mdm/ba-p/244067), all from the cloud. - Microsoft Entra join is also a great solution for temporary staff, partners, or other part-time employees. These accounts can be kept separate from the on-premises AD domain but still access needed corporate resources. + Microsoft Entra join is also a great solution for temporary staff, partners, or other part-time users. These accounts can be kept separate from the on-premises AD domain but still access needed corporate resources. - - Likewise, for personal devices, employees can use a new, simplified [BYOD experience](/azure/active-directory/devices/overview) to add their work account to Windows, then access work resources on the device. + - Likewise, for personal devices, users can use a new, simplified [BYOD experience](/azure/active-directory/devices/overview) to add their work account to Windows, then access work resources on the device. - **Domain joined PCs and tablets used for traditional applications and access to important resources.** These applications and resources may be traditional ones that require authentication or accessing highly sensitive or classified resources on-premises. @@ -71,7 +71,7 @@ As you review the roles in your organization, you can use the following generali ## Settings and configuration -Your configuration requirements are defined by multiple factors, including the level of management needed, the devices and data managed, and your industry requirements. Meanwhile, employees are frequently concerned about IT applying strict policies to their personal devices, but they still want access to corporate email and documents. You can create a consistent set of configurations across PCs, tablets, and phones through the common MDM layer. +Your configuration requirements are defined by multiple factors, including the level of management needed, the devices and data managed, and your industry requirements. Meanwhile, users are frequently concerned about IT applying strict policies to their personal devices, but they still want access to corporate email and documents. You can create a consistent set of configurations across PCs, tablets, and phones through the common MDM layer. - **MDM**: MDM gives you a way to configure settings that achieve your administrative intent without exposing every possible setting. (In contrast, group policy exposes fine-grained settings that you control individually.) One benefit of MDM is that it enables you to apply broader privacy, security, and application management settings through lighter and more efficient tools. MDM also allows you to target Internet-connected devices to manage policies without using group policy that requires on-premises domain-joined devices. This provision makes MDM the best choice for devices that are constantly on the go. diff --git a/windows/client-management/manage-windows-copilot.md b/windows/client-management/manage-windows-copilot.md index 1b811341cb..46d7c8c8dc 100644 --- a/windows/client-management/manage-windows-copilot.md +++ b/windows/client-management/manage-windows-copilot.md @@ -1,29 +1,37 @@ --- title: Manage Copilot in Windows description: Learn how to manage Copilot in Windows for commercial environments using MDM and group policy. Learn about the chat providers available to Copilot in Windows. -ms.topic: conceptual -ms.technology: itpro-windows-copilot -ms.date: 11/06/2023 +ms.topic: how-to +ms.subservice: windows-copilot +ms.date: 06/13/2024 ms.author: mstewart -author: mestew +author: mestew +ms.collection: + - windows-copilot + - magic-ai-copilot appliesto: - ✅ Windows 11, version 22H2 or later --- # Manage Copilot in Windows + >**Looking for consumer information?** See [Welcome to Copilot in Windows](https://support.microsoft.com/windows/welcome-to-copilot-in-windows-675708af-8c16-4675-afeb-85a5a476ccb0). -Copilot in Windows provides centralized generative AI assistance to your users right from the Windows desktop. Copilot in Windows appears as a side bar docked on the Windows desktop. It's designed to help your users get things done in Windows. Copilot in Windows can perform common tasks in Windows like changing Windows settings, which makes it different from the browser-based [Copilot in Edge](/bing-chat-enterprise/edge). However, both user experiences, Copilot in Windows and Copilot in Edge, can share the same underlying chat provider platform. It's important for organizations to properly configure the chat provider platform that Copilot in Windows uses, since it is possible for users to copy and paste sensitive information into the chat provider. - > [!Note] -> - Copilot in Windows is currently available as a preview. We will continue to experiment with new ideas and methods using your feedback. -> - Copilot in Windows is being released in preview to select global markets as part of our latest update to Windows 11. The initial markets for the Copilot in Windows preview include North America and parts of Asia and South America. It is our intention to add additional markets over time. +> - This article and the [TurnOffWindowsCopilot](mdm/policy-csp-windowsai.md#turnoffwindowscopilot) policy isn't for the [new Copilot experience](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/evolving-copilot-in-windows-for-your-workforce/ba-p/4141999) that's in some [Windows Insider builds](https://blogs.windows.com/windows-insider/2024/05/22/releasing-windows-11-version-24h2-to-the-release-preview-channel/) and that will be gradually rolling out to Windows 11 and Windows 10 devices. + +Copilot in Windows provides centralized generative AI assistance to your users right from the Windows desktop. Copilot in Windows appears as a side bar docked on the Windows desktop and is designed to help users get things done in Windows. Copilot in Windows can perform common tasks in Windows like changing Windows settings, which makes it different from the browser-based [Copilot in Edge](/copilot/edge). However, both user experiences, Copilot in Windows and Copilot in Edge, can share the same underlying chat provider platform. It's important for organizations to properly configure the chat provider platform that Copilot in Windows uses, since it's possible for users to copy and paste sensitive information into the chat. + ## Configure Copilot in Windows for commercial environments At a high level, managing and configuring Copilot in Windows for your organization involves the following steps: +> [!Note] +> - Copilot in Windows is currently available as a preview. We will continue to experiment with new ideas and methods using your feedback. +> - Copilot in Windows (in preview) is available in select global markets and will be rolled out to additional markets over time. [Learn more](https://www.microsoft.com/windows/copilot-ai-features#faq). + 1. Understand the [available chat provider platforms for Copilot in Windows](#chat-provider-platforms-for-copilot-in-windows) 1. [Configure the chat provider platform](#configure-the-chat-provider-platform-that-copilot-in-windows-uses) used by Copilot in Windows 1. Ensure the [Copilot in Windows user experience](#ensure-the-copilot-in-windows-user-experience-is-enabled) is enabled @@ -39,62 +47,83 @@ Organizations that aren't ready to use Copilot in Windows can disable it until t ## Chat provider platforms for Copilot in Windows -Copilot in Windows can use either Bing Chat or Bing Chat Enterprise as its chat provider platform. The chat provider platform is the underlying service that Copilot in Windows uses to communicate with the user. The chat provider platform that Copilot in Windows uses is important because it is possible for users to copy and paste sensitive information into the chat provider. Each chat provider platform has different privacy and security protections. +Copilot in Windows can use either Microsoft Copilot, Copilot with commercial data protection, or Copilot with Graph-grounded chat as its chat provider platform. The chat provider platform is the underlying service that Copilot in Windows uses to communicate with the user. The chat provider platform is important because it's possible for users to copy and paste sensitive information into the chat. Each chat provider platform has different privacy and security protections. -**Bing Chat**: +### Copilot -[Bing Chat](https://www.microsoft.com/bing/do-more-with-ai/what-is-bing-chat-and-how-can-you-use-it) is a consumer experience and if a user isn't signed in with their Microsoft account, the number of chat queries per user has a daily limit. Bing Chat doesn't offer the same commercial data protection as Bing Chat Enterprise does. The following privacy and security protections apply for Bing Chat: - - [Copilot in Windows: Your data and privacy](https://support.microsoft.com/windows/3e265e82-fc76-4d0a-afc0-4a0de528b73a) - - The privacy statement for using Bing Chat follows the [Microsoft privacy statement](https://privacy.microsoft.com/privacystatement) including the product specific guidance in the Microsoft privacy statement for **Bing** under the **Search, Microsoft Edge, and artificial intelligence** section. +Copilot is a consumer experience and has a daily limit on the number of chat queries per user when not signed in with a Microsoft account. It doesn't offer the same data protection as Copilot with commercial data protection. +- [Copilot in Windows: Your data and privacy](https://support.microsoft.com/windows/3e265e82-fc76-4d0a-afc0-4a0de528b73a) +- The privacy statement for using Copilot follows the [Microsoft privacy statement](https://privacy.microsoft.com/privacystatement) including the product specific guidance in the Microsoft privacy statement for **Bing** under the **Search, Microsoft Edge, and artificial intelligence** section. -**Bing Chat Enterprise**: + > [!Note] + > Copilot doesn't have access to Microsoft 365 Apps data, such as email, calendar, or files using Microsoft Graph, unlike [Microsoft Copilot with Graph-grounded chat](#microsoft-copilot-with-graph-grounded-chat). -[Bing Chat Enterprise](/bing-chat-enterprise/overview) is intended for commercial use scenarios and offers commercial data protection. The following privacy and security protections apply for Bing Chat Enterprise: +### Copilot with commercial data protection -- With [Bing Chat Enterprise](/bing-chat-enterprise/overview), user and organizational data is protected, chat data isn't saved, and your data isn't used to train the underlying large language models. Because of this protection, chat history, 3rd-party plugins, and the Bing mobile app for iOS or Android aren't currently supported. Bing Chat Enterprise is accessible from mobile browsers, including Edge mobile on iOS and Android. Review the Bing Chat Enterprise [privacy statement](/bing-chat-enterprise/privacy-and-protections). -- Bing Chat Enterprise is available, at no additional cost, for the following licenses: +[Copilot with commercial data protection](/copilot/overview) is intended for commercial use scenarios and offers commercial data protection. The following privacy and security protections apply for Copilot with commercial data protection: + +- User and organizational data is protected, chat data isn't saved, and your data isn't used to train the underlying large language models (LLMs). Because of this protection, chat history, 3rd-party plugins, and the Bing app for iOS or Android aren't currently supported. Copilot with commercial data protection is accessible from mobile browsers, including Edge mobile on iOS and Android. Review the Copilot with commercial data protection [privacy statement](/copilot/privacy-and-protections). +- Copilot with commercial data protection is available, at no additional cost, for the following licenses: - Microsoft 365 E3 or E5 - - Microsoft 365 A3 or A5 for faculty + - Microsoft 365 F3 + - Microsoft 365 A1, A3, or A5 + - Copilot with commercial data protection is limited to faculty and higher education students over 18 years of age + - Office 365 A1, A3, or A5 + - Copilot with commercial data protection is limited to faculty and higher education students over 18 years of age - Microsoft 365 Business Standard - Microsoft 365 Business Premium > [!Note] - > Bing Chat Enterprise and Bing Chat don't have access to Microsoft Graph, unlike [Microsoft 365 Copilot](/microsoft-365-copilot/microsoft-365-copilot-overview) which can be used in the Microsoft 365 apps. This means that Bing Chat Enterprise and Bing Chat can't access Microsoft 365 Apps data, such as email, calendar, or files. + > Copilot with commercial data protection doesn't have access to Microsoft 365 Apps data, such as email, calendar, or files using Microsoft Graph, unlike [Microsoft Copilot with Graph-grounded chat](#microsoft-copilot-with-graph-grounded-chat). + +### Microsoft Copilot with Graph-grounded chat + +Copilot with Graph-grounded chat enables you to use your work content and context in Copilot for Windows. With Graph-grounded chat, you can draft content and get answers to questions, all securely grounded in your Microsoft Graph data such as user documents, emails, calendar, chats, meetings, and contacts. When you use the **Work** toggle in Copilot in Windows to query Graph-grounded chat, the following high-level privacy and security protections apply: + +- Prompts, responses, and data accessed through Microsoft Graph aren't used to train foundational LLMs. +- It only surfaces organizational data to which individual users have at least view permissions. +- The information contained within your prompts, the data retrieved, and the generated responses remain within your tenant's service boundary. For more information about privacy and security for Graph-grounded chat, see [Data, Privacy, and Security for Microsoft Copilot for Microsoft 365](/microsoft-365-copilot/microsoft-365-copilot-privacy) +- Copilot with Graph-grounded chat is part of Copilot for Microsoft 365. Copilot for Microsoft 365 is an add-on plan. For more information about prerequisites and license requirements, see [Microsoft Copilot for Microsoft 365 requirements](/microsoft-365-copilot/microsoft-365-copilot-requirements#license-requirements). ## Configure the chat provider platform that Copilot in Windows uses -Configuring the correct chat provider platform for Copilot in Windows is important because it is possible for users to copy and paste sensitive information into the chat provider. Each chat provider platform has different privacy and security protections. Once you have selected the chat provider platform that you want to use for Copilot in Windows, ensure it's configured for your organization's users. The following sections describe how to configure the chat provider platform that Copilot in Windows uses. +Configuring the correct chat provider platform for Copilot in Windows is important because it's possible for users to copy and paste sensitive information into the chat. Each chat provider platform has different privacy and security protections. Once you select the chat provider platform that you want to use for Copilot in Windows, ensure it's configured for your organization's users. The following sections describe how to configure the chat provider platform that Copilot in Windows uses. -### Bing Chat as the chat provider platform +### Microsoft Copilot as the chat provider platform -Bing Chat is used as the default chat provider platform for Copilot in Windows when any of the following conditions occur: +Copilot is used as the default chat provider platform for Copilot in Windows when any of the following conditions occur: -- Bing Chat Enterprise isn't configured for the user -- The user isn't assigned a license that includes Bing Chat Enterprise -- Bing Chat Enterprise is [turned off](/bing-chat-enterprise/manage) -- The user isn't signed in with a Microsoft Entra account that's licensed for Bing Chat Enterprise +- Commercial data protection isn't configured for the user. +- Commercial data protection is [turned off](/copilot/manage). +- The user isn't assigned a license that includes Copilot with commercial data protection. +- The user isn't signed in with a Microsoft Entra account that's licensed for Copilot with commercial data protection. -### Bing Chat Enterprise as the chat provider platform (recommended for commercial environments) +### Copilot with commercial data protection as the chat provider platform (recommended for commercial environments) -To verify that Bing Chat Enterprise is enabled for the user as the chat provider platform for Copilot in Windows, use the following instructions: +To verify that Copilot with commercial data protection is enabled for the user as the chat provider platform for Copilot in Windows, use the following instructions: 1. Sign into the [Microsoft 365 admin center](https://admin.microsoft.com/). -1. In the admin center, select **Users** > **Active users** and verify that users are assigned a license that includes Bing Chat Enterprise. Bing Chat Enterprise is included and enabled by default for users that are assigned one of the following licenses: +1. In the admin center, select **Users** > **Active users** and verify that users are assigned a license that includes **Copilot**. Copilot with commercial data protection is included and enabled by default for users that are assigned one of the following licenses: - Microsoft 365 E3 or E5 - - Microsoft 365 A3 or A5 for faculty - - Currently, Microsoft 365 A3 and A5 for faculty requires additional configuration. For more information, see [Manage Bing Chat Enterprise](/bing-chat-enterprise/manage). + - Microsoft 365 F3 + - Microsoft 365 A1, A3, or A5 + - Copilot with commercial data protection is limited to faculty and higher education students over 18 years of age + - Office 365 A1, A3, or A5 + - Copilot with commercial data protection is limited to faculty and higher education students over 18 years of age - Microsoft 365 Business Standard - Microsoft 365 Business Premium -1. To verify that Bing Chat Enterprise is enabled for the user, select the user's **Display name** to open the flyout menu. +1. To verify that commercial data protection is enabled for the user, select the user's **Display name** to open the flyout menu. 1. In the flyout, select the **Licenses & apps** tab, then expand the **Apps** list. -1. Verify that **Bing Chat Enterprise** is enabled for the user. -1. If you prefer to view a user's licenses from the [Azure portal](https://portal.azure.com), you will find it under **Microsoft Entra ID** > **Users**. Select the user's name, then **Licenses**. Select a license that includes Bing Chat Enterprise, and verify that it's listed as **On**. +1. Verify that **Copilot** is enabled for the user. +1. If you prefer to view a user's licenses from the [Azure portal](https://portal.azure.com), you'll find it under **Microsoft Entra ID** > **Users**. Select the user's name, then **Licenses**. Select a license that includes **Copilot**, and verify that it's listed as **On**. If you previously disabled Copilot with commercial data protection (formerly Bing Chat Enterprise), see [Manage Copilot](/copilot/manage) for verifying that commercial data protection is enabled for your users. +1. Copilot with commercial data protection is used as the chat provider platform for users when the following conditions are met: + - Users have an eligible license, commercial data protection in Copilot is enabled, and the [Copilot in Windows user experience is enabled](#enable-the-copilot-in-windows-user-experience-for-windows-11-version-22h2-clients). + - Users are signed in with their Microsoft Entra ID (work accounts) + - Users can sign into Windows with their Microsoft Entra ID + - For Active Directory users on Windows 11, a Microsoft Entra ID in the Web Account Manager (WAM) authentication broker can be used. Entra IDs in Microsoft Edge profiles and Microsoft 365 Apps would both be in WAM. - > [!Note] - > If you previously disabled Bing Chat Enterprise using the URL, `https://aka.ms/TurnOffBCE`, see [Manage Bing Chat Enterprise](/bing-chat-enterprise/manage) for verifying that Bing Chat Enterprise is enabled for your users. - -The following sample PowerShell script connects to Microsoft Graph and lists which users that have Bing Chat Enterprise enabled and disabled: +The following sample PowerShell script connects to Microsoft Graph and lists which users that have Copilot with commercial data protection enabled and disabled: ```powershell # Install Microsoft Graph module @@ -108,20 +137,28 @@ Connect-MgGraph -Scopes 'User.Read.All' # Get all users $users = Get-MgUser -All -ConsistencyLevel eventual -Property Id, DisplayName, Mail, UserPrincipalName, AssignedPlans -# Users with Bing Chat Enterprise enabled +# Users with Copilot with commercial data protection enabled $users | Where-Object { $_.AssignedPlans -and $_.AssignedPlans.Service -eq "Bing" -and $_.AssignedPlans.CapabilityStatus -eq "Enabled" } | Format-Table -# Users without Bing Chat Enterprise enabled +# Users without Copilot with commercial data protection enabled $users | Where-Object { -not $_.AssignedPlans -or ($_.AssignedPlans.Service -eq "Bing" -and $_.AssignedPlans.CapabilityStatus -ne "Enabled") } | Format-Table ``` -When Bing Chat Enterprise is the chat provider platform, the user experience clearly states that **Your personal and company data are protected in this chat**. There's also a shield symbol labeled **Protected** at the top of the Copilot in Windows sidebar and the provider is listed under the Copilot logo when the sidebar is first opened. The following image shows the message that's displayed when Bing Chat Enterprise is the chat provider platform for Copilot in Windows: +When Copilot with commercial data protection is the chat provider platform, the user experience clearly states that **Your personal and company data are protected in this chat**. There's also a shield symbol labeled **Protected** at the top of the Copilot in Windows sidebar and the provider is listed under the Copilot logo when the sidebar is first opened. The following image shows the message that's displayed in this scenario: -:::image type="content" source="images/bing-chat-enterprise-chat-provider.png" alt-text="Screenshot of the Copilot in Windows user experience when Bing Chat Enterprise is the chat provider." lightbox="images/bing-chat-enterprise-chat-provider.png"::: +:::image type="content" source="images/copilot-commercial-data-protection-chat-provider.png" alt-text="Screenshot of the Copilot in Windows user experience when Copilot with commercial data protection is the chat provider." lightbox="images/copilot-commercial-data-protection-chat-provider.png"::: + + +### Copilot with Graph-grounded chat as the chat provider platform + + +When users are assigned [Microsoft Copilot for Microsoft 365](/microsoft-365-copilot/microsoft-365-copilot-setup) licenses, they're automatically presented with a **Work** toggle in Copilot for Windows. When **Work** is selected, Copilot with Graph-grounded chat is the chat provider platform used by Copilot in Windows. When using Graph-grounded chat, user prompts can securely access Microsoft Graph content, such as emails, chats, and documents. + +:::image type="content" source="images/work-toggle-graph-grounded-chat.png" alt-text="Screenshot of the Copilot in Windows user experience when the work toggle is selected and the chart provider is Copilot with Graph-grounded chat." lightbox="images/work-toggle-graph-grounded-chat.png"::: ## Ensure the Copilot in Windows user experience is enabled -Once you've configured the chat provider platform that Copilot in Windows uses, you need to ensure that the Copilot in Windows user experience is enabled. Ensuring the Copilot in Windows user experience is enabled varies by the Windows version. +Once you've configured the chat provider platform that Copilot in Windows uses, you need to ensure that the Copilot in Windows user experience is enabled. Ensuring the Copilot in Windows user experience is enabled varies by the Windows version. ### Enable the Copilot in Windows user experience for Windows 11, version 22H2 clients @@ -130,7 +167,7 @@ Copilot in Windows isn't technically enabled by default for managed Windows 11, To enable Copilot in Windows for managed Windows 11, version 22H2 devices, you need to enable features under temporary enterprise control for these devices. Since enabling features behind [temporary enterprise control](/windows/whats-new/temporary-enterprise-feature-control) can be impactful, you should test this change before deploying it broadly. To enable Copilot in Windows for managed Windows 11, version 22H2 devices, use the following instructions: 1. Verify that the user accounts have the correct chat provider platform configured for Copilot in Windows. For more information, see the [Configure the chat provider platform that Copilot in Windows uses](#configure-the-chat-provider-platform-that-copilot-in-windows-uses) section. -1. Apply a policy to enable features under temporary enterprise control for managed clients. The following polices apply to Windows 11, version 22H2 with [KB5022845](https://support.microsoft.com/en-us/topic/february-14-2023-kb5022845-os-build-22621-1265-90a807f4-d2e8-486e-8a43-d09e66319f38) and later: +1. Apply a policy to enable features under temporary enterprise control for managed clients. The following polices apply to Windows 11, version 22H2 with [KB5022845](https://support.microsoft.com/topic/february-14-2023-kb5022845-os-build-22621-1265-90a807f4-d2e8-486e-8a43-d09e66319f38) and later: - **Group Policy:** Computer Configuration\Administrative Templates\Windows Components\Windows Update\Manage end user experience\\**Enable features introduced via servicing that are off by default** - **CSP**: ./Device/Vendor/MSFT/Policy/Config/Update/[AllowTemporaryEnterpriseFeatureControl](/windows/client-management/mdm/policy-csp-update?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#allowtemporaryenterprisefeaturecontrol) @@ -142,7 +179,7 @@ To enable Copilot in Windows for managed Windows 11, version 22H2 devices, you n - **Group Policy:** Computer Configuration\Administrative Templates\Windows Components\Windows Update\Windows Update for Business\\**Allow updates to Windows optional features** - **CSP**: ./Device/Vendor/MSFT/Policy/Config/Update/[AllowOptionalUpdates](/windows/client-management/mdm/policy-csp-update?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#allowoptionalupdates) - In the Intune [settings catalog](/mem/intune/configuration/settings-catalog), this setting is named **Allow optional updates** under the **Windows Update for Business** category. - + The optional updates policy applies to Windows 11, version 22H2 with [KB5029351](https://support.microsoft.com/help/5029351) and later. When setting policy for [optional updates](/windows/deployment/update/waas-configure-wufb#enable-optional-updates), ensure you select one of the following options that includes CFRs: - Automatically receive optional updates (including CFRs) - This selection places devices into an early CFR phase @@ -152,9 +189,9 @@ To enable Copilot in Windows for managed Windows 11, version 22H2 devices, you n ### Enable the Copilot in Windows user experience for Windows 11, version 23H2 clients -Once a managed device installs the version 23H2 update, the [temporary enterprise control](/windows/whats-new/temporary-enterprise-feature-control) for Copilot in Windows will be removed. This means that Copilot in Windows will be enabled by default for these devices. +Once a managed device installs the version 23H2 update, the [temporary enterprise control](/windows/whats-new/temporary-enterprise-feature-control) for Copilot in Windows is removed. This means that Copilot in Windows is enabled by default for these devices. -While the user experience for Copilot in Windows is enabled by default, you still need to verify that the correct chat provider platform configured for Copilot in Windows. While every effort has been made to ensure that Bing Chat Enterprise is the default chat provider for commercial organizations, it's still possible that Bing Chat might still be used if the configuration is incorrect, or if other settings are affecting Copilot in Windows. For more information, see: +While the user experience for Copilot in Windows is enabled by default, you still need to verify that the correct chat provider platform configured for Copilot in Windows. While every effort is made to ensure that Copilot with commercial data protection is the default chat provider for commercial organizations, it's still possible that Copilot might still be used if the configuration is incorrect, or if other settings are affecting Copilot in Windows. For more information, see: - [Configure the chat provider platform that Copilot in Windows uses](#configure-the-chat-provider-platform-that-copilot-in-windows-uses) - [Other settings that might affect Copilot in Windows and its underlying chat provider](#other-settings-that-might-affect-copilot-in-windows-and-its-underlying-chat-provider) @@ -165,25 +202,26 @@ Organizations that aren't ready to use Copilot in Windows can disable it until t ## Other settings that might affect Copilot in Windows and its underlying chat provider -Copilot in Windows and [Copilot in Edge](/bing-chat-enterprise/edge), can share the same underlying chat provider platform. This also means that some settings that affect Bing Chat, Bing Chat Enterprise, and Copilot in Edge can also affect Copilot in Windows. The following common settings might affect Copilot in Windows and its underlying chat provider: +Copilot in Windows and [Copilot in Edge](/copilot/edge), can share the same underlying chat provider platform. This also means that some settings that affect Copilot, Copilot with commercial data protection, and Copilot in Edge can also affect Copilot in Windows. The following common settings might affect Copilot in Windows and its underlying chat provider: ### Bing settings -- If [SafeSearch](https://support.microsoft.com/topic/946059ed-992b-46a0-944a-28e8fb8f1814) is enabled for Bing, it can block chat providers for Copilot in Windows. The following network changes block the chat providers for Copilot in Windows and Copilot in Edge: - - mapping `www.bing.com` to `strict.bing.com` - - mapping `edgeservices.bing.com` to `strict.bing.com` - - blocking `bing.com` +- If [SafeSearch](https://support.microsoft.com/topic/946059ed-992b-46a0-944a-28e8fb8f1814) is enabled for Bing, it can block chat providers for Copilot in Windows. The following network changes block the chat providers for Copilot in Windows and Edge: -- If Bing Chat Enterprise is turned on for your organization, users will be able to access it through Edge mobile when signed in with their work account. If you would like to remove the Bing Chat button from the Edge mobile interface, you can use an [Intune Mobile Application Management (MAM) policy for Microsoft Edge](/mem/intune/apps/manage-microsoft-edge) to remove it: + - Mapping `www.bing.com` to `strict.bing.com` + - Mapping `edgeservices.bing.com` to `strict.bing.com` + - Blocking `bing.com` - |Key |Value | - |:---------|:------------| - |com.microsoft.intune.mam.managedbrowser.Chat| **true** (default) shows the interface
                        **false** hides the interface | +- If Copilot with commercial data protection is turned on for your organization, users can access it through Edge mobile when signed in with their work account. If you would like to remove the Bing Chat button from the Edge mobile interface, you can use an [Intune Mobile Application Management (MAM) policy for Microsoft Edge](/mem/intune/apps/manage-microsoft-edge) to remove it: + + | Key | Value | + |:---------------------------------------------|:---------------------------------------------------------------------------| + | com.microsoft.intune.mam.managedbrowser.Chat | **true** (default) shows the interface
                        **false** hides the interface | ### Microsoft Edge policies - If [HubsSidebarEnabled](/deployedge/microsoft-edge-policies#hubssidebarenabled) is set to `disabled`, it blocks Copilot in Edge from being displayed. -- If [DiscoverPageContextEnabled](/deployedge/microsoft-edge-policies#discoverpagecontextenabled) is set to `disabled`, it blocks Bing Chat and Bing Chat Enterprise from reading the current webpage context. The chat providers need access to the current webpage context for providing page summarizations and sending user selected strings from the webpage into the chat provider. +- If [DiscoverPageContextEnabled](/deployedge/microsoft-edge-policies#discoverpagecontextenabled) is set to `disabled`, it blocks Copilot from reading the current webpage context. The chat providers need access to the current webpage context for providing page summarizations and sending user selected strings from the webpage into the chat provider. ### Search settings diff --git a/windows/client-management/mdm-collect-logs.md b/windows/client-management/mdm-collect-logs.md index 5756913331..0a3b883dcd 100644 --- a/windows/client-management/mdm-collect-logs.md +++ b/windows/client-management/mdm-collect-logs.md @@ -1,8 +1,8 @@ --- title: Collect MDM logs description: Learn how to collect MDM logs. Examining these logs can help diagnose enrollment or device management issues in Windows devices managed by an MDM server. -ms.topic: article -ms.date: 08/10/2023 +ms.topic: conceptual +ms.date: 07/08/2024 ms.collection: - highpri - tier2 @@ -40,7 +40,7 @@ mdmdiagnosticstool.exe -area "DeviceEnrollment;DeviceProvisioning;Autopilot" -zi ### Understanding zip structure -The zip file has logs according to the areas that were used in the command. This explanation is based on DeviceEnrollment, DeviceProvisioning and Autopilot areas. It applies to the zip files collected via command line or Feedback Hub +The zip file has logs according to the areas that were used in the command. This explanation is based on DeviceEnrollment, DeviceProvisioning, and Autopilot areas. It applies to the zip files collected via command line or Feedback Hub - DiagnosticLogCSP_Collector_Autopilot_*: Autopilot etls - DiagnosticLogCSP_Collector_DeviceProvisioning_*: Provisioning etls (Microsoft-Windows-Provisioning-Diagnostics-Provider) diff --git a/windows/client-management/mdm-diagnose-enrollment.md b/windows/client-management/mdm-diagnose-enrollment.md index c3dd757bb5..5610d29c34 100644 --- a/windows/client-management/mdm-diagnose-enrollment.md +++ b/windows/client-management/mdm-diagnose-enrollment.md @@ -1,8 +1,8 @@ --- title: Diagnose MDM enrollment failures description: Learn how to diagnose enrollment failures for Windows devices -ms.topic: article -ms.date: 08/10/2023 +ms.topic: conceptual +ms.date: 07/08/2024 --- # Diagnose MDM enrollment diff --git a/windows/client-management/mdm-enrollment-of-windows-devices.md b/windows/client-management/mdm-enrollment-of-windows-devices.md index ef09eea68f..f57170b82c 100644 --- a/windows/client-management/mdm-enrollment-of-windows-devices.md +++ b/windows/client-management/mdm-enrollment-of-windows-devices.md @@ -1,16 +1,16 @@ --- title: MDM enrollment of Windows devices description: Learn about mobile device management (MDM) enrollment of Windows devices to simplify access to your organization's resources. -ms.topic: article +ms.topic: conceptual ms.collection: - highpri - tier2 -ms.date: 08/10/2023 +ms.date: 07/08/2024 --- # MDM enrollment of Windows devices -In today's cloud-first world, enterprise IT departments increasingly want to let employees use their own devices, or even choose and purchase corporate-owned devices. Connecting your devices to work makes it easy for you to access your organization's resources, such as apps, the corporate network, and email. +In today's cloud-first world, enterprise IT departments increasingly want to let users use their own devices, or even choose and purchase corporate-owned devices. Connecting your devices to work makes it easy for you to access your organization's resources, such as apps, the corporate network, and email. > [!NOTE] > When you connect your device using mobile device management (MDM) enrollment, your organization may enforce certain policies on your device. @@ -24,8 +24,6 @@ You can connect corporate-owned devices to work by either joining the device to > [!NOTE] > For devices joined to on-premises Active Directory, see [Group policy enrollment](enroll-a-windows-10-device-automatically-using-group-policy.md). - - ### Connect your device to a Microsoft Entra domain (join Microsoft Entra ID) All Windows devices can be connected to a Microsoft Entra domain. These devices can be connected during OOBE. Additionally, desktop devices can be connected to a Microsoft Entra domain using the Settings app. diff --git a/windows/client-management/mdm-known-issues.md b/windows/client-management/mdm-known-issues.md index 3b715665e0..43e571ecb6 100644 --- a/windows/client-management/mdm-known-issues.md +++ b/windows/client-management/mdm-known-issues.md @@ -1,8 +1,8 @@ --- title: Known issues in MDM description: Learn about known issues for Windows devices in MDM -ms.topic: article -ms.date: 08/10/2023 +ms.topic: conceptual +ms.date: 07/08/2024 --- # Known issues @@ -11,11 +11,11 @@ ms.date: 08/10/2023 A Get command inside an atomic command isn't supported. -## Apps installed using WMI classes are not removed +## Apps installed using WMI classes aren't removed Applications installed using WMI classes aren't removed when the MDM account is removed from device. -## Passing CDATA in SyncML does not work +## Passing CDATA in SyncML doesn't work Passing CDATA in data in SyncML to ConfigManager and CSPs doesn't work. @@ -222,8 +222,6 @@ Alternatively you can use the following procedure to create an EAP Configuration After the MDM client automatically renews the WNS channel URI, the MDM client will immediately check in with the MDM server. Henceforth, for every MDM client check-in, the MDM server should send a GET request for "ProviderID/Push/ChannelURI" to retrieve the latest channel URI and compare it with the existing channel URI; then update the channel URI if necessary. - - ## User provisioning failure in Microsoft Entra joined devices For Microsoft Entra joined devices, provisioning `.\User` resources fails when the user isn't logged in as a Microsoft Entra user. If you attempt to join Microsoft Entra ID from **Settings** > **System** > **About** user interface, ensure to sign out and sign in with Microsoft Entra credentials to get your organizational configuration from your MDM server. This behavior is by design. @@ -232,6 +230,6 @@ For Microsoft Entra joined devices, provisioning `.\User` resources fails when t If you want to use the certificate used for VPN authentication also for Kerberos authentication (required if you need access to on-premises resources using NTLM or Kerberos), the user's certificate must meet the requirements for smart card certificate, the Subject field should contain the DNS domain name in the DN or the SAN should contain a fully qualified UPN so that the DC can be located from the DNS registrations. If certificates that don't meet these requirements are used for VPN, users may fail to access resources that require Kerberos authentication. -## Device management agent for the push-button reset is not working +## Device management agent for the push-button reset isn't working The DM agent for [push-button reset](/windows-hardware/manufacture/desktop/push-button-reset-overview) keeps the registry settings for OMA DM sessions, but deletes the task schedules. The client enrollment is retained, but it never syncs with the MDM service. diff --git a/windows/client-management/mdm-overview.md b/windows/client-management/mdm-overview.md index 4777c1d28c..1db4cb2fee 100644 --- a/windows/client-management/mdm-overview.md +++ b/windows/client-management/mdm-overview.md @@ -1,12 +1,13 @@ --- title: Mobile Device Management overview description: Windows provides an enterprise-level solution to mobile management, to help IT pros comply with security policies while avoiding compromise of user's privacy. -ms.date: 08/10/2023 -ms.topic: article +ms.date: 07/08/2024 +ms.topic: conceptual ms.localizationpriority: medium ms.collection: - highpri - tier2 +- essentials-manage --- # Mobile Device Management overview @@ -56,8 +57,6 @@ For information about the MDM policies defined in the Intune security baseline, No. Only one MDM is allowed. - - ### How do I set the maximum number of Microsoft Entra joined devices per user? 1. Sign in to the portal as tenant admin: . diff --git a/windows/client-management/mdm/Language-pack-management-csp.md b/windows/client-management/mdm/Language-pack-management-csp.md index 25ff8939c4..3fd4c9a6d5 100644 --- a/windows/client-management/mdm/Language-pack-management-csp.md +++ b/windows/client-management/mdm/Language-pack-management-csp.md @@ -1,14 +1,7 @@ --- title: LanguagePackManagement CSP description: Learn more about the LanguagePackManagement CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 05/20/2024 --- @@ -48,7 +41,7 @@ The following list shows the LanguagePackManagement configuration service provid | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview [99.9.9999] | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -87,7 +80,7 @@ Language to be installed or being installed. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview [99.9.9999] | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -127,7 +120,7 @@ Language tag of the language to be installed or being installed. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview [99.9.9999] | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -176,7 +169,7 @@ Copies the language to the international settings (that is, locale, input layout | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview [99.9.9999] | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -225,7 +218,7 @@ Enables installations of all available language features when the value is true. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview [99.9.9999] | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -264,7 +257,7 @@ Error code of queued language installation. 0 if there is no error. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview [99.9.9999] | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -303,7 +296,7 @@ Execution node to queue a language for installation on the device. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview [99.9.9999] | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -342,7 +335,7 @@ Status of the language queued for install. 0 - not started; 1 - in progress; 2 - | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview [99.9.9999] | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -381,7 +374,7 @@ Languages currently installed on the device. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview [99.9.9999] | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -421,7 +414,7 @@ Language tag of an installed language on the device. Delete to uninstall. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview [99.9.9999] | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -460,7 +453,7 @@ Numeric representation of the language features installed. Basic Typing - 1 (0x1 | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview [99.9.9999] | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -499,7 +492,7 @@ Numeric representation of how a language is installed. 1 - The system language p | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview [99.9.9999] | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -538,7 +531,7 @@ Language settings of the device. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview [99.9.9999] | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | diff --git a/windows/client-management/mdm/accountmanagement-csp.md b/windows/client-management/mdm/accountmanagement-csp.md index 4fdc019a91..55180da611 100644 --- a/windows/client-management/mdm/accountmanagement-csp.md +++ b/windows/client-management/mdm/accountmanagement-csp.md @@ -1,14 +1,7 @@ --- title: AccountManagement CSP description: Learn more about the AccountManagement CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/29/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/accountmanagement-ddf.md b/windows/client-management/mdm/accountmanagement-ddf.md index 7589b07ab4..06093b49ae 100644 --- a/windows/client-management/mdm/accountmanagement-ddf.md +++ b/windows/client-management/mdm/accountmanagement-ddf.md @@ -1,14 +1,7 @@ --- title: AccountManagement DDF file description: View the XML file containing the device description framework (DDF) for the AccountManagement configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/29/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/accounts-csp.md b/windows/client-management/mdm/accounts-csp.md index 86ff222dcc..e32ee78e33 100644 --- a/windows/client-management/mdm/accounts-csp.md +++ b/windows/client-management/mdm/accounts-csp.md @@ -1,14 +1,7 @@ --- title: Accounts CSP description: The Accounts configuration service provider (CSP) is used by the enterprise to rename devices, and create local Windows accounts & join them to a group. -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 03/27/2020 -ms.reviewer: -manager: aaroncz --- # Accounts CSP diff --git a/windows/client-management/mdm/accounts-ddf-file.md b/windows/client-management/mdm/accounts-ddf-file.md index 330218b819..9fb71bd404 100644 --- a/windows/client-management/mdm/accounts-ddf-file.md +++ b/windows/client-management/mdm/accounts-ddf-file.md @@ -1,14 +1,7 @@ --- title: Accounts DDF file description: View the XML file containing the device description framework (DDF) for the Accounts configuration service provider. -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 04/17/2018 -ms.reviewer: -manager: aaroncz --- # Accounts DDF file diff --git a/windows/client-management/mdm/activesync-csp.md b/windows/client-management/mdm/activesync-csp.md index 842d9225c2..8d862c057a 100644 --- a/windows/client-management/mdm/activesync-csp.md +++ b/windows/client-management/mdm/activesync-csp.md @@ -1,14 +1,7 @@ --- title: ActiveSync CSP description: Learn more about the ActiveSync CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/activesync-ddf-file.md b/windows/client-management/mdm/activesync-ddf-file.md index 06f77c27b9..99038f75e0 100644 --- a/windows/client-management/mdm/activesync-ddf-file.md +++ b/windows/client-management/mdm/activesync-ddf-file.md @@ -1,14 +1,7 @@ --- title: ActiveSync DDF file description: View the XML file containing the device description framework (DDF) for the ActiveSync configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 07/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 06/28/2024 --- @@ -47,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the A 10.0.10240 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; diff --git a/windows/client-management/mdm/alljoynmanagement-csp.md b/windows/client-management/mdm/alljoynmanagement-csp.md index c87f85294d..a7df16f516 100644 --- a/windows/client-management/mdm/alljoynmanagement-csp.md +++ b/windows/client-management/mdm/alljoynmanagement-csp.md @@ -1,13 +1,6 @@ --- title: AllJoynManagement CSP description: The AllJoynManagement configuration service provider (CSP) allows an IT administrator to enumerate the AllJoyn devices that are connected to the AllJoyn bus. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/alljoynmanagement-ddf.md b/windows/client-management/mdm/alljoynmanagement-ddf.md index 32030275e8..a3ef6dc003 100644 --- a/windows/client-management/mdm/alljoynmanagement-ddf.md +++ b/windows/client-management/mdm/alljoynmanagement-ddf.md @@ -1,13 +1,6 @@ --- title: AllJoynManagement DDF description: Learn the OMA DM device description framework (DDF) for the AllJoynManagement configuration service provider. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 12/05/2017 --- diff --git a/windows/client-management/mdm/application-csp.md b/windows/client-management/mdm/application-csp.md index c53a080791..b20e289a43 100644 --- a/windows/client-management/mdm/application-csp.md +++ b/windows/client-management/mdm/application-csp.md @@ -1,13 +1,6 @@ --- title: APPLICATION CSP description: Learn how the APPLICATION configuration service provider is used to configure an application transport using Open Mobile Alliance (OMA) Client Provisioning. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/applicationcontrol-csp-ddf.md b/windows/client-management/mdm/applicationcontrol-csp-ddf.md index 199adf8620..8b27862509 100644 --- a/windows/client-management/mdm/applicationcontrol-csp-ddf.md +++ b/windows/client-management/mdm/applicationcontrol-csp-ddf.md @@ -1,14 +1,7 @@ --- title: ApplicationControl DDF file description: View the XML file containing the device description framework (DDF) for the ApplicationControl configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 06/02/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 06/28/2024 --- @@ -47,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the A 10.0.18362 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; @@ -320,6 +313,50 @@ The following XML file contains the device description framework (DDF) for the A + + BasePolicyId + + + + + The BasePolicyId of the Policy Indicated by the Policy GUID + + + + + + + + + + BasePolicyId + + + + + + + PolicyOptions + + + + + The PolicyOptions of the Policy Indicated by the Policy GUID + + + + + + + + + + PolicyOptions + + + + + diff --git a/windows/client-management/mdm/applicationcontrol-csp.md b/windows/client-management/mdm/applicationcontrol-csp.md index 9c5875b5a4..dd8f2e1b6b 100644 --- a/windows/client-management/mdm/applicationcontrol-csp.md +++ b/windows/client-management/mdm/applicationcontrol-csp.md @@ -1,14 +1,7 @@ --- title: ApplicationControl CSP description: Learn more about the ApplicationControl CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/31/2024 --- @@ -31,12 +24,14 @@ The following list shows the ApplicationControl configuration service provider n - [{Policy GUID}](#policiespolicy-guid) - [Policy](#policiespolicy-guidpolicy) - [PolicyInfo](#policiespolicy-guidpolicyinfo) + - [BasePolicyId](#policiespolicy-guidpolicyinfobasepolicyid) - [FriendlyName](#policiespolicy-guidpolicyinfofriendlyname) - [IsAuthorized](#policiespolicy-guidpolicyinfoisauthorized) - [IsBasePolicy](#policiespolicy-guidpolicyinfoisbasepolicy) - [IsDeployed](#policiespolicy-guidpolicyinfoisdeployed) - [IsEffective](#policiespolicy-guidpolicyinfoiseffective) - [IsSystemPolicy](#policiespolicy-guidpolicyinfoissystempolicy) + - [PolicyOptions](#policiespolicy-guidpolicyinfopolicyoptions) - [Status](#policiespolicy-guidpolicyinfostatus) - [Version](#policiespolicy-guidpolicyinfoversion) - [Tokens](#tokens) @@ -207,6 +202,45 @@ Information Describing the Policy indicated by the GUID. + +##### Policies/{Policy GUID}/PolicyInfo/BasePolicyId + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1903 [10.0.18362] and later | + + + +```Device +./Vendor/MSFT/ApplicationControl/Policies/{Policy GUID}/PolicyInfo/BasePolicyId +``` + + + + +The BasePolicyId of the Policy Indicated by the Policy GUID. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `chr` (string) | +| Access Type | Get | + + + + + + + + ##### Policies/{Policy GUID}/PolicyInfo/FriendlyName @@ -453,6 +487,45 @@ TRUE/FALSE if the Policy is a System Policy, that's a policy managed by Microsof + +##### Policies/{Policy GUID}/PolicyInfo/PolicyOptions + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1903 [10.0.18362] and later | + + + +```Device +./Vendor/MSFT/ApplicationControl/Policies/{Policy GUID}/PolicyInfo/PolicyOptions +``` + + + + +The PolicyOptions of the Policy Indicated by the Policy GUID. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `chr` (string) | +| Access Type | Get | + + + + + + + + ##### Policies/{Policy GUID}/PolicyInfo/Status diff --git a/windows/client-management/mdm/applocker-csp.md b/windows/client-management/mdm/applocker-csp.md index e7b2417319..b7c198fd13 100644 --- a/windows/client-management/mdm/applocker-csp.md +++ b/windows/client-management/mdm/applocker-csp.md @@ -1,14 +1,7 @@ --- title: AppLocker CSP description: Learn more about the AppLocker CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/applocker-ddf-file.md b/windows/client-management/mdm/applocker-ddf-file.md index 9ffbf897b8..9d1ededd2a 100644 --- a/windows/client-management/mdm/applocker-ddf-file.md +++ b/windows/client-management/mdm/applocker-ddf-file.md @@ -1,14 +1,7 @@ --- title: AppLocker DDF file description: View the XML file containing the device description framework (DDF) for the AppLocker configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 06/02/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 06/28/2024 --- @@ -47,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the A 10.0.10586 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; diff --git a/windows/client-management/mdm/assignedaccess-csp.md b/windows/client-management/mdm/assignedaccess-csp.md index 6aea2cc955..cc69b6bb5a 100644 --- a/windows/client-management/mdm/assignedaccess-csp.md +++ b/windows/client-management/mdm/assignedaccess-csp.md @@ -1,14 +1,7 @@ --- title: AssignedAccess CSP description: Learn more about the AssignedAccess CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 04/10/2024 --- @@ -18,19 +11,9 @@ ms.topic: reference -The AssignedAccess configuration service provider (CSP) is used to set the device to run in kiosk mode. Once the CSP has been executed, the next user login that is associated with the kiosk mode puts the device into the kiosk mode running the application specified in the CSP configuration. +The AssignedAccess configuration service provider (CSP) is used to configure a kiosk or restricted user experience. Once the CSP is executed, the next user login that is associated with the Assigned Access profile puts the device into the kiosk mode specified in the CSP configuration. -- For a step-by-step guide for setting up devices to run in kiosk mode, see [Set up a single-app kiosk on Windows 10/11](/windows/configuration/kiosk-single-app). -- For a step-by-step guide for configuring multi-app kiosks, see [Create a Windows 10 kiosk that runs multiple apps](/windows/configuration/lock-down-windows-10-to-specific-apps). - -> [!IMPORTANT] -> The AssignedAccess CSP is supported in Windows 10 Enterprise and Windows 10 Education. Starting from Windows 10, version 1709, it is supported in Windows 10 Pro and Windows 10 S. Starting from Windows 10, version 1803, it is also supported in Windows Holographic for Business edition. - -> [!WARNING] -> You can only assign one single app kiosk profile to an individual user account on a device. The single app profile does not support domain groups. - -> [!NOTE] -> If the application calls `KeyCredentialManager.IsSupportedAsync` when it is running in assigned access mode and it returns false on the first run, invoke the settings screen and select an appropriate PIN to use with Windows Hello. This is the settings screen that is hidden by the application running in assigned access mode. You can only use Windows Hello if you first leave assigned access mode, select your convenience pin, and then go back into assigned access mode again. +To learn more about how to configure Assigned Access, see [Configure kiosks and restricted user experiences](/windows/configuration/assigned-access). @@ -66,20 +49,7 @@ This node accepts an AssignedAccessConfiguration xml as input. -The input XML specifies the settings that you can configure in the kiosk or device. - -In **Windows 10, version 1803** the Configuration node introduces single app kiosk profile to replace KioskModeApp CSP node. KioskModeApp node will be deprecated soon, so you should use the single app kiosk profile in config xml for Configuration node to configure public-facing single app Kiosk. - -In **Windows 10, version 1909**, Microsoft Edge kiosk mode support was added. This allows Microsoft Edge to be the specified kiosk application. For details about configuring Microsoft Edge kiosk mode, see [Configure a Windows 10 kiosk that runs Microsoft Edge](/DeployEdge/microsoft-edge-configure-kiosk-mode). Windows 10, version 1909 also allows for configuration of the breakout sequence. The breakout sequence specifies the keyboard shortcut that returns a kiosk session to the lock screen. The breakout sequence is defined with the format modifiers + keys. An example breakout sequence would look something like `shift+alt+a`, where `shift` and `alt` are the modifiers and `a` is the key. - -In **Windows 11, version 22H2 with [KB5026446](https://support.microsoft.com/kb/5026446)**, AssignedAccessConfiguration schema was updated to add StartPins and TaskbarLayout nodes to support pinning apps to the Start Menu and Taskbar respectively. - -- For more information about setting up a multi-app kiosk, see [Create a Windows 10 kiosk that runs multiple apps](/windows/configuration/lock-down-windows-10-to-specific-apps). -- For more information on the schema, see [AssignedAccessConfiguration XSD](#assignedaccessconfiguration-xsd). -- For examples, see [AssignedAccessConfiguration examples](#assignedaccessconfiguration-examples). - -> [!NOTE] -> Deleting the multi-app configuration will remove the assigned access lockdown profiles associated with the users, but it can't revert all the enforced policies (for example, Start Layout). +To learn how to configure xml file, see [Create an Assigned Access configuration XML file](/windows/configuration/assigned-access/configuration-file) @@ -95,8 +65,6 @@ In **Windows 11, version 22H2 with [KB5026446](https://support.microsoft.com/kb/ **Examples**: -For more examples, see [AssignedAccessConfiguration examples](#assignedaccessconfiguration-examples). - - Get Configuration ```xml @@ -172,8 +140,7 @@ This node supports Add, Delete, Replace and Get methods. When there's no configu > > This applies to both `domain\user`, `AzureAD\someone@contoso.onmicrosoft.com`, as long as a `\` is used in JSON string. -- For more information about how to get the AUMID, see [Find the Application User Model ID of an installed app](/windows/configuration/find-the-application-user-model-id-of-an-installed-app). -- For more information about single-app kiosk, see [Set up a single-app kiosk on Windows 10/11.](/windows/configuration/kiosk-single-app) +For more information about how to get the AUMID, see [Find the Application User Model ID of an installed app](/windows/configuration/store/find-aumid). > [!IMPORTANT] > @@ -300,9 +267,8 @@ This node accepts a ShellLauncherConfiguration xml as input. -In **Windows 10, version 1903**, Shell Launcher V2 was introduced to support both UWP and Win32 apps as the custom shell. -For more information, see [Shell Launcher](/windows/configuration/kiosk-shelllauncher). +To learn about Shell Launcher, see [What is Shell Launcher?](/windows/configuration/assigned-access/shell-launcher). > [!IMPORTANT] > You can't set both ShellLauncher and KioskModeApp at the same time on the device. @@ -324,193 +290,8 @@ For more information, see [Shell Launcher](/windows/configuration/kiosk-shelllau -**ShellLauncherConfiguration XSD**: -> [!NOTE] -> Shell Launcher V2 uses a separate XSD and namespace for backward compatibility. The original V1 XSD has a reference to the V2 XSD. - -- Shell Launcher V1 XSD - - ```xml - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ``` - -- Shell Launcher V2 XSD - - ```xml - - - - - - - - - - - - - - - - ``` +Here's the Shell Launcher XSD reference article: [Shell Launcher XML Schema Definition (XSD)](/windows/configuration/assigned-access/shell-launcher/xsd). **Examples**: @@ -530,160 +311,7 @@ For more information, see [Shell Launcher](/windows/configuration/kiosk-shelllau - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ]]> - - - - - -
                        - ``` - -- Add AutoLogon - - This function creates an auto-logon account on your behalf. It's a standard user with no password. The auto-logon account is managed by AssignedAccessCSP, so the account name isn't exposed. - - > [!NOTE] - > The auto-logon function is designed to be used after OOBE with provisioning packages. - - ```xml - - - - 2 - - - ./Device/Vendor/MSFT/AssignedAccess/ShellLauncher - - - chr - - - - - - - - - - - - - - - - - - - - - - - - - - - ]]> - - - - - - - ``` - -- V2 Add - - ```xml - - - - 2 - - - ./Device/Vendor/MSFT/AssignedAccess/ShellLauncher - - - chr - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + ]]> @@ -1033,594 +661,15 @@ By default, the StatusConfiguration node doesn't exist, and it implies this feat ## AssignedAccessConfiguration XSD -- Schema for AssignedAccessConfiguration. +Here's the Assigned Access XSD reference article: [Assigned Access XML Schema Definition (XSD)](/windows/configuration/assigned-access/xsd). - ```xml - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ); - ``` - -- Schema for features introduced in Windows 10, version 1809 which added support for Microsoft Edge kiosk mode and breakout key sequence customization. - - ```xml - - - - - - - - - - - - - - ``` - -- Schema for new features introduced in Windows 10 1809 release. - - ```xml - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ``` - -- Schema for Windows 10 prerelease. - - ```xml - - - - - - - - - - - - - - - - - - - ``` - -## AssignedAccessConfiguration examples - -> [!NOTE] -> To authorize a compatible configuration XML that includes 1809 or prerelease elements and attributes, always include the namespace of these add-on schemas, and decorate the attributes and elements accordingly with the namespace alias. For example, to configure the auto-launch feature that was added in the 1809 release, use the below sample. Notice an alias `r1809` is given to the 201810 namespace for the 1809 release, and the alias is tagged on AutoLaunch and AutoLaunchArguments inline. -> -> ```xml -> xmlns="http://schemas.microsoft.com/AssignedAccess/2017/config" -> xmlns:r1809="http://schemas.microsoft.com/AssignedAccess/201810/config" -> > -> -> -> -> -> -> ... -> -> ``` - -- Example XML configuration for a multi-app kiosk for Windows 11, version 22H2 with [KB5026446](https://support.microsoft.com/kb/5026446). - - > [!NOTE] - > This example demonstrates the use of StartPins and TaskbarLayout elements. For more information, see [Set up a multi-app kiosk on Windows 11 devices](/windows/configuration/lock-down-windows-11-to-specific-apps). - > - > - StartPins element is used to pin apps to the Start menu and uses the [pinnedList JSON](/windows/configuration/customize-start-menu-layout-windows-11#get-the-pinnedlist-json) format. - > - TaskbarLayout element is used to pin apps to the taskbar and uses the [TaskbarLayoutModification XML](/windows/configuration/customize-taskbar-windows-11#create-the-xml-file) format. - - ```xml - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ]]> - - - - - - - - - - - - - - - - ]]> - - - - - - MultiAppKioskUser - - - - - ``` - -- Example XML configuration for a multi-app kiosk for Windows 10. - - ```xml - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ]]> - - - - - - - MultiAppKioskUser - - - - - ``` - -- Example XML configuration for a Microsoft Edge kiosk. This Microsoft Edge kiosk is configured to launch www.bing.com on startup in a public browsing mode. - - ```xml - - - - - - - - - - EdgeKioskUser - - - - - ``` - -- Example XML configuration for setting a breakout sequence to be Ctrl+A on a Microsoft Edge kiosk. - - > [!NOTE] - > **BreakoutSequence** can be applied to any kiosk type, not just an Edge kiosk. - - ```xml - - - - - - - - - - - EdgeKioskUser - - - - - ``` - - - -## Windows Holographic for Business edition example - -This example configures the following apps: Skype, Learning, Feedback Hub, and Calibration, for first line workers. Use this XML in a provisioning package using Windows Configuration Designer. For instructions, see [Configure HoloLens using a provisioning package](/hololens/hololens-provisioning). - -```xml - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ]]> - - - - - - - - - AzureAD\multiusertest@analogfre.onmicrosoft.com - - - - -``` +For practical examples of Assigned Access configuration files, see [Assigned Access examples](/windows/configuration/assigned-access/examples). ## Handling XML in Configuration XML encoding (escaped) and CDATA of the XML in the Data node will both ensure that DM client can properly interpret the SyncML and send the configuration xml as string (in original format, unescaped) to AssignedAccess CSP to handle. -Similarly, the StartLayout xml inside the configuration xml is using the same format, xml inside xml as string. In the sample Configuration xml provided above, CDATA is used to embed the StartLayout xml. If you use CDATA to embed configuration xml in SyncML as well, you'll have nested CDATA, so pay attention to how CDATA is used in the provided CDATA sample. With that being said, when the Configuration xml is being constructed, MDM server can either escape start layout xml or put startlayout xml inside CDATA, when MDM server puts configuration xml inside SyncML, MDM server can also either escape it or wrap with CDATA. +Similarly, the StartLayout xml inside the configuration xml is using the same format, xml inside xml as string. In the sample Configuration xml provided above, CDATA is used to embed the StartLayout xml. If you use CDATA to embed configuration xml in SyncML as well, you have nested CDATA, so pay attention to how CDATA is used in the provided CDATA sample. With that being said, when the Configuration xml is being constructed, MDM server can either escape start layout xml or put startlayout xml inside CDATA, when MDM server puts configuration xml inside SyncML, MDM server can also either escape it or wrap with CDATA. Escape and CDATA are mechanisms used when handling xml in xml. Consider that it's a transportation channel to send the configuration xml as payload from server to client. It's transparent to both, the end user who configures the CSP and to our CSP. Both the customer on the server side and our CSP must only see the original configuration XML. @@ -1645,12 +694,6 @@ Escape and CDATA are mechanisms used when handling xml in xml. Consider that it' <Profile Id="{9A2A490F-10F6-4764-974A-43B19E722C23}"> <AllAppsList> <AllowedApps> - <App AppUserModelId="Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic" /> - <App AppUserModelId="Microsoft.ZuneVideo_8wekyb3d8bbwe!Microsoft.ZuneVideo" /> - <App AppUserModelId="Microsoft.Windows.Photos_8wekyb3d8bbwe!App" /> - <App AppUserModelId="Microsoft.BingWeather_8wekyb3d8bbwe!App" /> - <App AppUserModelId="Microsoft.WindowsCalculator_8wekyb3d8bbwe!App" /> - <App DesktopAppPath="%windir%\system32\mspaint.exe" /> <App DesktopAppPath="C:\Windows\System32\notepad.exe" /> </AllowedApps> </AllAppsList> @@ -1662,14 +705,6 @@ Escape and CDATA are mechanisms used when handling xml in xml. Consider that it' <defaultlayout:StartLayout GroupCellWidth="6"> <start:Group Name="Group1"> <start:Tile Size="4x4" Column="0" Row="0" AppUserModelID="Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic" /> - <start:Tile Size="2x2" Column="4" Row="2" AppUserModelID="Microsoft.ZuneVideo_8wekyb3d8bbwe!Microsoft.ZuneVideo" /> - <start:Tile Size="2x2" Column="4" Row="0" AppUserModelID="Microsoft.Windows.Photos_8wekyb3d8bbwe!App" /> - <start:Tile Size="2x2" Column="4" Row="4" AppUserModelID="Microsoft.BingWeather_8wekyb3d8bbwe!App" /> - <start:Tile Size="4x2" Column="0" Row="4" AppUserModelID="Microsoft.WindowsCalculator_8wekyb3d8bbwe!App" /> - </start:Group> - <start:Group Name="Group2"> - <start:DesktopApplicationTile Size="2x2" Column="2" Row="0" DesktopApplicationID="{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\mspaint.exe" /> - <start:DesktopApplicationTile Size="2x2" Column="0" Row="0" DesktopApplicationID="{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\notepad.exe" /> </start:Group> </defaultlayout:StartLayout> </StartLayoutCollection> @@ -1719,12 +754,6 @@ Escape and CDATA are mechanisms used when handling xml in xml. Consider that it' - - - - - - @@ -1736,10 +765,6 @@ Escape and CDATA are mechanisms used when handling xml in xml. Consider that it' - - - - diff --git a/windows/client-management/mdm/assignedaccess-ddf.md b/windows/client-management/mdm/assignedaccess-ddf.md index 5ef69490c0..81d21dbfab 100644 --- a/windows/client-management/mdm/assignedaccess-ddf.md +++ b/windows/client-management/mdm/assignedaccess-ddf.md @@ -1,14 +1,7 @@ --- title: AssignedAccess DDF file description: View the XML file containing the device description framework (DDF) for the AssignedAccess configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 06/02/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 06/28/2024 --- @@ -47,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the A 10.0.10240 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; diff --git a/windows/client-management/mdm/bitlocker-csp.md b/windows/client-management/mdm/bitlocker-csp.md index ab201e6028..647b90ac50 100644 --- a/windows/client-management/mdm/bitlocker-csp.md +++ b/windows/client-management/mdm/bitlocker-csp.md @@ -1,14 +1,7 @@ --- title: BitLocker CSP description: Learn more about the BitLocker CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -23,13 +16,19 @@ ms.topic: reference The BitLocker configuration service provider (CSP) is used by the enterprise to manage encryption of PCs and devices. This CSP was added in Windows 10, version 1703. Starting in Windows 10, version 1809, it's also supported in Windows 10 Pro. > [!NOTE] +> To manage BitLocker through CSP except to enable and disable it using the `RequireDeviceEncryption` policy, one of the following licenses must be assigned to your users regardless of your management platform: > -> - Settings are enforced only at the time encryption is started. Encryption isn't restarted with settings changes. -> - You must send all the settings together in a single SyncML to be effective. +> - Windows 10/11 Enterprise E3 or E5 (included in Microsoft 365 F3, E3, and E5). +> - Windows 10/11 Enterprise A3 or A5 (included in Microsoft 365 A3 and A5). A `Get` operation on any of the settings, except for `RequireDeviceEncryption` and `RequireStorageCardEncryption`, returns the setting configured by the admin. For RequireDeviceEncryption and RequireStorageCardEncryption, the Get operation returns the actual status of enforcement to the admin, such as if Trusted Platform Module (TPM) protection is required and if encryption is required. And if the device has BitLocker enabled but with password protector, the status reported is 0. A Get operation on RequireDeviceEncryption doesn't verify that a minimum PIN length is enforced (SystemDrivesMinimumPINLength). + +> [!NOTE] +> +> - Settings are enforced only at the time encryption is started. Encryption isn't restarted with settings changes. +> - You must send all the settings together in a single SyncML to be effective. @@ -661,7 +660,7 @@ Sample value for this node to enable this policy is: `` **Example**: -To disable this policy, use hte following SyncML: +To disable this policy, use the following SyncML: ```xml diff --git a/windows/client-management/mdm/bitlocker-ddf-file.md b/windows/client-management/mdm/bitlocker-ddf-file.md index fb912358e4..51e2260bba 100644 --- a/windows/client-management/mdm/bitlocker-ddf-file.md +++ b/windows/client-management/mdm/bitlocker-ddf-file.md @@ -1,14 +1,7 @@ --- title: BitLocker DDF file description: View the XML file containing the device description framework (DDF) for the BitLocker configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 06/28/2024 --- @@ -46,7 +39,7 @@ The following XML file contains the device description framework (DDF) for the B 10.0.15063 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; diff --git a/windows/client-management/mdm/cellularsettings-csp.md b/windows/client-management/mdm/cellularsettings-csp.md index 629021dd17..993b08f2bf 100644 --- a/windows/client-management/mdm/cellularsettings-csp.md +++ b/windows/client-management/mdm/cellularsettings-csp.md @@ -1,13 +1,6 @@ --- title: CellularSettings CSP description: Learn how the CellularSettings configuration service provider is used to configure cellular settings on a mobile device. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 06/26/2017 --- @@ -42,8 +35,8 @@ CellularSettings |Value|Setting| |--- |--- | -|0|Don’t roam| -|1|Don’t roam (or Domestic roaming if applicable)| +|0|Don't roam| +|1|Don't roam (or Domestic roaming if applicable)| |2|Roam| ## Related topics diff --git a/windows/client-management/mdm/certificatestore-csp.md b/windows/client-management/mdm/certificatestore-csp.md index cc17da3674..fc94239b02 100644 --- a/windows/client-management/mdm/certificatestore-csp.md +++ b/windows/client-management/mdm/certificatestore-csp.md @@ -1,14 +1,7 @@ --- title: CertificateStore CSP description: Learn more about the CertificateStore CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/31/2024 --- @@ -2391,6 +2384,7 @@ Optional. Notify the client whether enrollment server supports ROBO auto certifi | Value | Description | |:--|:--| | true (Default) | True. | +| false | False. | diff --git a/windows/client-management/mdm/certificatestore-ddf-file.md b/windows/client-management/mdm/certificatestore-ddf-file.md index 5c819f96bc..b552ae24ad 100644 --- a/windows/client-management/mdm/certificatestore-ddf-file.md +++ b/windows/client-management/mdm/certificatestore-ddf-file.md @@ -1,14 +1,7 @@ --- title: CertificateStore DDF file description: View the XML file containing the device description framework (DDF) for the CertificateStore configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 06/02/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 06/28/2024 --- @@ -49,7 +42,7 @@ The following XML file contains the device description framework (DDF) for the C 10.0.10586 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; @@ -1259,6 +1252,10 @@ The following XML file contains the device description framework (DDF) for the C true True + + false + False + diff --git a/windows/client-management/mdm/cleanpc-csp.md b/windows/client-management/mdm/cleanpc-csp.md index a1b634ff45..1f90bd010d 100644 --- a/windows/client-management/mdm/cleanpc-csp.md +++ b/windows/client-management/mdm/cleanpc-csp.md @@ -1,14 +1,7 @@ --- title: CleanPC CSP description: The CleanPC configuration service provider (CSP) allows you to remove user-installed and pre-installed applications, with the option to persist user data. -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 06/26/2017 -ms.reviewer: -manager: aaroncz --- # CleanPC CSP diff --git a/windows/client-management/mdm/cleanpc-ddf.md b/windows/client-management/mdm/cleanpc-ddf.md index 1bc37c5325..40c8fdba74 100644 --- a/windows/client-management/mdm/cleanpc-ddf.md +++ b/windows/client-management/mdm/cleanpc-ddf.md @@ -1,13 +1,6 @@ --- title: CleanPC DDF description: Learn about the OMA DM device description framework (DDF) for the CleanPC configuration service provider. DDF files are used only with OMA DM provisioning XML. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 12/05/2017 --- diff --git a/windows/client-management/mdm/clientcertificateinstall-csp.md b/windows/client-management/mdm/clientcertificateinstall-csp.md index a1936f909b..89b0a33e28 100644 --- a/windows/client-management/mdm/clientcertificateinstall-csp.md +++ b/windows/client-management/mdm/clientcertificateinstall-csp.md @@ -1,14 +1,7 @@ --- title: ClientCertificateInstall CSP description: Learn more about the ClientCertificateInstall CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 10/24/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 04/10/2024 --- @@ -16,6 +9,8 @@ ms.topic: reference # ClientCertificateInstall CSP +[!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)] + The ClientCertificateInstall configuration service provider enables the enterprise to install client certificates. A client certificate has a unique ID, which is the *\[UniqueID\]* for this configuration. Each client certificate must have different UniqueIDs for the SCEP enrollment request. @@ -45,6 +40,7 @@ The following list shows the ClientCertificateInstall configuration service prov - [ErrorCode](#devicescepuniqueiderrorcode) - [Install](#devicescepuniqueidinstall) - [AADKeyIdentifierList](#devicescepuniqueidinstallaadkeyidentifierlist) + - [AttestPrivateKey](#devicescepuniqueidinstallattestprivatekey) - [CAThumbprint](#devicescepuniqueidinstallcathumbprint) - [Challenge](#devicescepuniqueidinstallchallenge) - [ContainerName](#devicescepuniqueidinstallcontainername) @@ -83,6 +79,7 @@ The following list shows the ClientCertificateInstall configuration service prov - [ErrorCode](#userscepuniqueiderrorcode) - [Install](#userscepuniqueidinstall) - [AADKeyIdentifierList](#userscepuniqueidinstallaadkeyidentifierlist) + - [AttestPrivateKey](#userscepuniqueidinstallattestprivatekey) - [CAThumbprint](#userscepuniqueidinstallcathumbprint) - [Challenge](#userscepuniqueidinstallchallenge) - [ContainerName](#userscepuniqueidinstallcontainername) @@ -399,7 +396,7 @@ When a value of "2" is contained in PFXCertPasswordEncryptionType, specify the s |:--|:--| | Format | `chr` (string) | | Access Type | Add, Get, Replace | -| Dependency [EncryptionTypeDependency] | Dependency Type: `DependsOn`
                        Dependency URI: `Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/[UniqueID]/PFXCertPasswordEncryptionType`
                        Dependency Allowed Value: `[2]`
                        Dependency Allowed Value Type: `Range`
                        | +| Dependency [EncryptionTypeDependency] | Dependency Type: `DependsOn`
                        Dependency URI: `Device/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/[UniqueID]/PFXCertPasswordEncryptionType`
                        Dependency Allowed Value: `[2]`
                        Dependency Allowed Value Type: `Range`
                        | @@ -499,7 +496,7 @@ The PFX isn't exportable when it's installed to TPM. | Format | `bool` | | Access Type | Add, Get, Replace | | Default Value | true | -| Dependency [KeyLocationDependency] | Dependency Type: `DependsOn`
                        Dependency URI: `Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/[UniqueID]/KeyLocation`
                        Dependency Allowed Value: `[3]`
                        Dependency Allowed Value Type: `Range`
                        | +| Dependency [KeyLocationDependency] | Dependency Type: `DependsOn`
                        Dependency URI: `Device/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/[UniqueID]/KeyLocation`
                        Dependency Allowed Value: `[3]`
                        Dependency Allowed Value Type: `Range`
                        | @@ -835,6 +832,45 @@ Optional. Specify the Microsoft Entra ID Key Identifier List as a semicolon sepa + +##### Device/SCEP/{UniqueID}/Install/AttestPrivateKey + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
                        ✅ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/AttestPrivateKey +``` + + + + +Defines the attest SCEP private key behavior 0 - normal, 1 - best effort, 2 - on error, fail the installation. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Get | + + + + + + + + ##### Device/SCEP/{UniqueID}/Install/CAThumbprint @@ -1975,7 +2011,7 @@ When a value of "2" is contained in PFXCertPasswordEncryptionType, specify the s |:--|:--| | Format | `chr` (string) | | Access Type | Add, Get, Replace | -| Dependency [EncryptionTypeDependency] | Dependency Type: `DependsOn`
                        Dependency URI: `Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/[UniqueID]/PFXCertPasswordEncryptionType`
                        Dependency Allowed Value: `[2]`
                        Dependency Allowed Value Type: `Range`
                        | +| Dependency [EncryptionTypeDependency] | Dependency Type: `DependsOn`
                        Dependency URI: `User/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/[UniqueID]/PFXCertPasswordEncryptionType`
                        Dependency Allowed Value: `[2]`
                        Dependency Allowed Value Type: `Range`
                        | @@ -2073,7 +2109,7 @@ Optional. Used to specify if the private key installed is exportable (can be exp | Format | `bool` | | Access Type | Add, Get, Replace | | Default Value | true | -| Dependency [KeyLocationDependency] | Dependency Type: `DependsOn`
                        Dependency URI: `Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/[UniqueID]/KeyLocation`
                        Dependency Allowed Value: `[3]`
                        Dependency Allowed Value Type: `Range`
                        | +| Dependency [KeyLocationDependency] | Dependency Type: `DependsOn`
                        Dependency URI: `User/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/[UniqueID]/KeyLocation`
                        Dependency Allowed Value: `[3]`
                        Dependency Allowed Value Type: `Range`
                        | @@ -2409,6 +2445,55 @@ Optional. Specify the Microsoft Entra ID Key Identifier List as a semicolon sepa + +##### User/SCEP/{UniqueID}/Install/AttestPrivateKey + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
                        ✅ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```User +./User/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/AttestPrivateKey +``` + + + + +Defines the attest SCEP private key behavior 0 - normal, 1 - best effort, 2 - on error, fail the installation. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Get | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | Don't attest private key. | +| 1 | Attest key, but in case attestation failed, best effort approach - CSR is sent to the server. | +| 2 | Attest key, but in case attestation failed, fail fast (i.e release the key and not issue a CSR to the server). | + + + + + + + + ##### User/SCEP/{UniqueID}/Install/CAThumbprint diff --git a/windows/client-management/mdm/clientcertificateinstall-ddf-file.md b/windows/client-management/mdm/clientcertificateinstall-ddf-file.md index c5b24365ff..20bf836b45 100644 --- a/windows/client-management/mdm/clientcertificateinstall-ddf-file.md +++ b/windows/client-management/mdm/clientcertificateinstall-ddf-file.md @@ -1,14 +1,7 @@ --- title: ClientCertificateInstall DDF file description: View the XML file containing the device description framework (DDF) for the ClientCertificateInstall configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 06/02/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 06/28/2024 --- @@ -46,7 +39,7 @@ The following XML file contains the device description framework (DDF) for the C 10.0.10586 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; @@ -301,7 +294,7 @@ If the value is - Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/[UniqueID]/KeyLocation + User/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/[UniqueID]/KeyLocation [3] @@ -379,7 +372,7 @@ When a value of "2" is contained iin PFXCertPasswordEncryptionType, specify the - Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/[UniqueID]/PFXCertPasswordEncryptionType + User/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/[UniqueID]/PFXCertPasswordEncryptionType [2] @@ -567,6 +560,46 @@ Calling Delete on the this node, should delete the corresponding SCEP certificat + + AttestPrivateKey + + + + + + Defines the attest SCEP private key behavior 0 - normal, 1 - best effort, 2 - on error, fail the installation + + + + + + + + + + + + + + 99.9.99999 + 9.9 + + + + 0 + Do not attest private key + + + 1 + Attest key, but in case attestation failed, best effort approach - CSR is sent to the server + + + 2 + Attest key, but in case attestation failed, fail fast (i.e release the key and not issue a CSR to the server) + + + + SubjectName @@ -1129,7 +1162,7 @@ Valid values are: 10.0.10586 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; @@ -1384,7 +1417,7 @@ If the value is - Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/[UniqueID]/KeyLocation + Device/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/[UniqueID]/KeyLocation [3] @@ -1462,7 +1495,7 @@ When a value of "2" is contained iin PFXCertPasswordEncryptionType, specify the - Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/[UniqueID]/PFXCertPasswordEncryptionType + Device/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/[UniqueID]/PFXCertPasswordEncryptionType [2] @@ -1650,6 +1683,34 @@ Calling Delete on the this node, should delete the corresponding SCEP certificat + + AttestPrivateKey + + + + + + Defines the attest SCEP private key behavior 0 - normal, 1 - best effort, 2 - on error, fail the installation + + + + + + + + + + + + + + 99.9.99999 + 9.9 + + + + + SubjectName diff --git a/windows/client-management/mdm/clouddesktop-csp.md b/windows/client-management/mdm/clouddesktop-csp.md index b8a0a69fad..400b655707 100644 --- a/windows/client-management/mdm/clouddesktop-csp.md +++ b/windows/client-management/mdm/clouddesktop-csp.md @@ -1,14 +1,7 @@ --- title: CloudDesktop CSP description: Learn more about the CloudDesktop CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 10/25/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 06/19/2024 --- @@ -26,17 +19,19 @@ ms.topic: reference The following list shows the CloudDesktop configuration service provider nodes: - ./Device/Vendor/MSFT/CloudDesktop - - [BootToCloudPCEnhanced](#boottocloudpcenhanced) - - [EnableBootToCloudSharedPCMode](#enableboottocloudsharedpcmode) + - [BootToCloudPCEnhanced](#deviceboottocloudpcenhanced) + - [EnableBootToCloudSharedPCMode](#deviceenableboottocloudsharedpcmode) +- ./User/Vendor/MSFT/CloudDesktop + - [EnablePhysicalDeviceAccess](#userenablephysicaldeviceaccess) -## BootToCloudPCEnhanced +## Device/BootToCloudPCEnhanced | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ❌ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ❌ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621.3235] and later | @@ -47,7 +42,7 @@ The following list shows the CloudDesktop configuration service provider nodes: -This node allows to configure different kinds of Boot to Cloud mode. Boot to cloud mode enables users to seamlessly sign-in to a Cloud PC. For using this feature, Cloud Provider application must be installed on the PC and the user must have a Cloud PC provisioned. This node supports the below options: 0. Not Configured. 1. Enable Boot to Cloud Shared PC Mode: Boot to Cloud Shared PC mode allows multiple users to sign-in on the device and use for shared purpose. 2. Enable Boot to Cloud Personal Mode (Cloud only): Personal mode allows user to sign-in on the device using various authentication mechanism configured by their organization (For ex. PIN, Biometrics etc). This mode preserves user personalization, including their profile picture and username in local machine, and facilitates fast account switching. +This node allows to configure different kinds of Boot to Cloud mode. Boot to cloud mode enables users to seamlessly sign-in to a Cloud PC. For using this feature, Cloud Provider application must be installed on the PC and the user must have a Cloud PC provisioned. This node supports the below options: 0. Not Configured. 1. Enable Boot to Cloud Shared PC Mode: Boot to Cloud Shared PC mode allows multiple users to sign-in on the device and use for shared purpose. 2. Enable Boot to Cloud Dedicated Mode (Cloud only): Dedicated mode allows user to sign-in on the device using various authentication mechanism configured by their organization (For ex. PIN, Biometrics etc). This mode preserves user personalization, including their profile picture and username in local machine, and facilitates fast account switching. @@ -73,7 +68,7 @@ This node allows to configure different kinds of Boot to Cloud mode. Boot to clo |:--|:--| | 0 (Default) | Not Configured. | | 1 | Enable Boot to Cloud Shared PC Mode. | -| 2 | Enable Boot to Cloud Personal Mode (Cloud only). | +| 2 | Enable Boot to Cloud Dedicated Mode (Cloud only). | @@ -83,7 +78,7 @@ This node allows to configure different kinds of Boot to Cloud mode. Boot to clo -## EnableBootToCloudSharedPCMode +## Device/EnableBootToCloudSharedPCMode > [!NOTE] > This policy is deprecated and may be removed in a future release. @@ -136,14 +131,63 @@ Setting this node to "true" configures boot to cloud for Shared PC mode. Boot to + +## User/EnablePhysicalDeviceAccess + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ❌ Device
                        ✅ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ❌ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```User +./User/Vendor/MSFT/CloudDesktop/EnablePhysicalDeviceAccess +``` + + + + +Configuring this node gives access to the physical devices used to boot to Cloud PCs from the Ctrl+Alt+Del page for specified users. This node supports these options: 0. Not enabled 1. Enabled. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `bool` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | false | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| false (Default) | Access to physical device disabled. | +| true | Access to physical device enabled. | + + + + + + + + ## BootToCloudPCEnhanced technical reference -BootToCloudPCEnhanced is the setting used to configure **Boot to Cloud** feature either for shared mode or personal mode. When you enable this setting, multiple policies are applied to achieve the intended behavior. If you wish to customize the **Boot to Cloud** experience, you can utilize the [BootToCloudMode](policy-csp-clouddesktop.md#boottocloudmode) policy, which provides the flexibility to tailor the experience according to your requirements. +BootToCloudPCEnhanced is the setting used to configure **Boot to Cloud** feature either for shared mode or dedicated mode. When you enable this setting, multiple policies are applied to achieve the intended behavior. If you wish to customize the **Boot to Cloud** experience, you can utilize the [BootToCloudMode](policy-csp-clouddesktop.md#boottocloudmode) policy, which provides the flexibility to tailor the experience according to your requirements. > [!NOTE] -> It is recommended not to set any of the policies enforced by this setting to different values, as these policies help provide a smooth UX experience for the **Boot to Cloud** feature for shared and personal mode. +> It is recommended not to set any of the policies enforced by this setting to different values, as these policies help provide a smooth UX experience for the **Boot to Cloud** feature for shared and dedicated mode. ### Boot to Cloud Shared PC Mode @@ -189,6 +233,7 @@ When the Shared PC mode is enabled by setting BootToCloudPCEnhanced value to 1: | Start Menu and Taskbar/Notifications/Turn off toast notifications | Enabled | | Start Menu and Taskbar/Notifications/Remove Notifications and Action Center | Enabled | | System/Logon/Do not process the legacy run list | Enabled | + | Windows Components/Windows Copilot/Turn off Windows Copilot | Enabled | - Following registry changes are performed: @@ -197,9 +242,9 @@ When the Shared PC mode is enabled by setting BootToCloudPCEnhanced value to 1: | Software\Policies\Microsoft\PassportForWork\Remote\Enabled (Phone sign-in/Use phone sign-in) | 0 | | Software\Policies\Microsoft\PassportForWork\Enabled (Use Microsoft Passport for Work) | 0 | -### Boot to Cloud Personal Mode +### Boot to Cloud Dedicated Mode -When the Personal mode is enabled by setting BootToCloudPCEnhanced value to 2: +When the Dedicated mode is enabled by setting BootToCloudPCEnhanced value to 2: - Following MDM policies are applied for the Device scope (all users): @@ -218,6 +263,7 @@ When the Personal mode is enabled by setting BootToCloudPCEnhanced value to 2: | Start Menu and Taskbar/Notifications/Turn off toast notifications | Enabled | | Start Menu and Taskbar/Notifications/Remove Notifications and Action Center | Enabled | | System/Logon/Do not process the legacy run list | Enabled | + | Windows Components/Windows Copilot/Turn off Windows Copilot | Enabled | diff --git a/windows/client-management/mdm/clouddesktop-ddf-file.md b/windows/client-management/mdm/clouddesktop-ddf-file.md index daaccf8c6c..776f55aac6 100644 --- a/windows/client-management/mdm/clouddesktop-ddf-file.md +++ b/windows/client-management/mdm/clouddesktop-ddf-file.md @@ -1,14 +1,7 @@ --- title: CloudDesktop DDF file description: View the XML file containing the device description framework (DDF) for the CloudDesktop configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 10/25/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 06/28/2024 --- @@ -24,6 +17,69 @@ The following XML file contains the device description framework (DDF) for the C 1.2 + + CloudDesktop + ./User/Vendor/MSFT + + + + + The CloudDesktop configuration service provider is used to configure different Cloud PC related scenarios. + + + + + + + + + + + + + + 99.9.99999 + 2.0 + 0x4;0x30;0x31;0x7E;0x88;0xA1;0xA2;0xA4;0xA5;0xBC;0xBF;0xCD; + + + + EnablePhysicalDeviceAccess + + + + + + + + false + Configuring this node gives access to the physical devices used to boot to Cloud PCs from the Ctrl+Alt+Del page for specified users. This node supports these options: 0. Not enabled 1. Enabled. + + + + + + + + + + Enable access to physical device + + + + + + false + Access to physical device disabled + + + true + Access to physical device enabled + + + + + CloudDesktop ./Device/Vendor/MSFT @@ -45,9 +101,9 @@ The following XML file contains the device description framework (DDF) for the C - 99.9.99999 - 9.9 - 0x4;0x30;0x31;0x7E;0x87;0x88;0x88*;0xA1;0xA2;0xA4;0xA5;0xB4;0xBC;0xBD;0xBF; + 10.0.22621.3235 + 1.0 + 0x4;0x30;0x31;0x7E;0x88;0xA1;0xA2;0xA4;0xA5;0xBC;0xBF;0xCD;
                        @@ -60,7 +116,7 @@ The following XML file contains the device description framework (DDF) for the C 0 - This node allows to configure different kinds of Boot to Cloud mode. Boot to cloud mode enables users to seamlessly sign-in to a Cloud PC. For using this feature, Cloud Provider application must be installed on the PC and the user must have a Cloud PC provisioned. This node supports the below options: 0. Not Configured. 1. Enable Boot to Cloud Shared PC Mode: Boot to Cloud Shared PC mode allows multiple users to sign-in on the device and use for shared purpose. 2. Enable Boot to Cloud Personal Mode (Cloud only): Personal mode allows user to sign-in on the device using various authentication mechanism configured by their organization (For ex. PIN, Biometrics etc). This mode preserves user personalization, including their profile picture and username in local machine, and facilitates fast account switching. + This node allows to configure different kinds of Boot to Cloud mode. Boot to cloud mode enables users to seamlessly sign-in to a Cloud PC. For using this feature, Cloud Provider application must be installed on the PC and the user must have a Cloud PC provisioned. This node supports the below options: 0. Not Configured. 1. Enable Boot to Cloud Shared PC Mode: Boot to Cloud Shared PC mode allows multiple users to sign-in on the device and use for shared purpose. 2. Enable Boot to Cloud Dedicated Mode (Cloud only): Dedicated mode allows user to sign-in on the device using various authentication mechanism configured by their organization (For ex. PIN, Biometrics etc). This mode preserves user personalization, including their profile picture and username in local machine, and facilitates fast account switching. @@ -75,8 +131,8 @@ The following XML file contains the device description framework (DDF) for the C - 99.9.99999 - 9.9 + 10.0.22621.3235 + 1.0 @@ -89,7 +145,7 @@ The following XML file contains the device description framework (DDF) for the C 2 - Enable Boot to Cloud Personal Mode (Cloud only) + Enable Boot to Cloud Dedicated Mode (Cloud only) diff --git a/windows/client-management/mdm/cm-cellularentries-csp.md b/windows/client-management/mdm/cm-cellularentries-csp.md index 1997c7878c..4051454ae5 100644 --- a/windows/client-management/mdm/cm-cellularentries-csp.md +++ b/windows/client-management/mdm/cm-cellularentries-csp.md @@ -1,13 +1,6 @@ --- title: CM\_CellularEntries CSP description: Learn how to configure the General Packet Radio Service (GPRS) entries using the CM\_CellularEntries CSP. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 08/02/2017 --- diff --git a/windows/client-management/mdm/cmpolicy-csp.md b/windows/client-management/mdm/cmpolicy-csp.md index caf0856091..af8c1facf4 100644 --- a/windows/client-management/mdm/cmpolicy-csp.md +++ b/windows/client-management/mdm/cmpolicy-csp.md @@ -1,13 +1,6 @@ --- title: CMPolicy CSP description: Learn how the CMPolicy configuration service provider (CSP) is used to define rules that the Connection Manager uses to identify correct connections. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 06/26/2017 --- @@ -33,7 +26,7 @@ Each policy entry identifies one or more applications in combination with a host **Policy Ordering**: There's no explicit ordering of policies. The general rule is that the most concrete or specific policy mappings take a higher precedence. -**Default Policies**: Policies are applied in order of their scope with the most specific policies considered before the more general policies. The phone’s default behavior applies to all applications and all domains and is only used when no other, more specific policy is available. The default policy is to use any available Wi-Fi network first and then any available APN. +**Default Policies**: Policies are applied in order of their scope with the most specific policies considered before the more general policies. The phone's default behavior applies to all applications and all domains and is only used when no other, more specific policy is available. The default policy is to use any available Wi-Fi network first and then any available APN. The following shows the CMPolicy configuration service provider management object in tree format as used by both Open Mobile Alliance (OMA) Client Provisioning and OMA Device Management. @@ -88,7 +81,7 @@ Enumerates the connections associated with the policy. Element names begin with **ConnectionID** Specifies a unique identifier for a connection within a group of connections. The exact value is based on the Type parameter. -For `CMST_CONNECTION_NAME`, specify the connection name. For example, if you have a connection configured by using the CM\_CellularEntries configuration service provider, the connection name could be the name of the connection. If you have a NAP configured with the NAPID set to “GPRS1”, the connection name could be “GPRS1@WAP”. +For `CMST_CONNECTION_NAME`, specify the connection name. For example, if you have a connection configured by using the CM\_CellularEntries configuration service provider, the connection name could be the name of the connection. If you have a NAP configured with the NAPID set to "GPRS1", the connection name could be "GPRS1@WAP". For `CMST_CONNECTION_TYPE`, specify the GUID for the desired connection type. The curly brackets {} around the GUID are required. The following connection types are available: @@ -142,7 +135,7 @@ Specifies the type of connection being referenced. The following list describes ## OMA client provisioning examples -Adding an application-based mapping policy. In this example, the ConnectionId for type CMST\_CONNECTION\_NAME is set to the name of the connection (“GPRSConn1”) that is configured with the CM\_CellularEntries configuration service provider. +Adding an application-based mapping policy. In this example, the ConnectionId for type CMST\_CONNECTION\_NAME is set to the name of the connection ("GPRSConn1") that is configured with the CM\_CellularEntries configuration service provider. ```xml @@ -189,7 +182,7 @@ Adding an application-based mapping policy. In this example, the ConnectionId fo Adding a host-based mapping policy: -In this example, the ConnectionId for type CMST\_CONNECTION\_NAME is set to the name of the connection (“GPRSConn1”) that is configured with the CM\_CellularEntries configuration service provider. +In this example, the ConnectionId for type CMST\_CONNECTION\_NAME is set to the name of the connection ("GPRSConn1") that is configured with the CM\_CellularEntries configuration service provider. ```xml diff --git a/windows/client-management/mdm/cmpolicyenterprise-csp.md b/windows/client-management/mdm/cmpolicyenterprise-csp.md index 72db3fe0f1..eee6f8d4b1 100644 --- a/windows/client-management/mdm/cmpolicyenterprise-csp.md +++ b/windows/client-management/mdm/cmpolicyenterprise-csp.md @@ -1,13 +1,6 @@ --- title: CMPolicyEnterprise CSP description: Learn how the CMPolicyEnterprise CSP is used to define rules that the Connection Manager uses to identify the correct connection for a connection request. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 06/26/2017 --- @@ -36,7 +29,7 @@ Each policy entry identifies one or more applications in combination with a host **Policy Ordering**: There's no explicit ordering of policies. The general rule is that the most concrete or specific policy mappings take a higher precedence. -**Default Policies**: Policies are applied in the order of their scope with the most specific policies considered before the more general policies. The phone’s default behavior applies to all applications and all domains and is only used when no other, more specific policy is available. The default policy is to use any available Wi-Fi network first and then any available APN. +**Default Policies**: Policies are applied in the order of their scope with the most specific policies considered before the more general policies. The phone's default behavior applies to all applications and all domains and is only used when no other, more specific policy is available. The default policy is to use any available Wi-Fi network first and then any available APN. The following shows the CMPolicyEnterprise configuration service provider management object in tree format as used by both Open Mobile Alliance (OMA) Client Provisioning and OMA Device Management. @@ -91,7 +84,7 @@ Enumerates the connections associated with the policy. Element names begin with **ConnectionID** Specifies a unique identifier for a connection within a group of connections. The exact value is based on the Type parameter. -For `CMST_CONNECTION_NAME`, specify the connection name. For example, if you have a connection configured by using the CM\_CellularEntries configuration service provider, the connection name could be the name of the connection. If you have a NAP configured with the NAPID set to “GPRS1”, the connection name could be “GPRS1@WAP”. +For `CMST_CONNECTION_NAME`, specify the connection name. For example, if you have a connection configured by using the CM\_CellularEntries configuration service provider, the connection name could be the name of the connection. If you have a NAP configured with the NAPID set to "GPRS1", the connection name could be "GPRS1@WAP". For `CMST_CONNECTION_TYPE`, specify the GUID for the desired connection type. The curly brackets {} around the GUID are required. The following connection types are available: @@ -146,7 +139,7 @@ Specifies the type of connection being referenced. The following list describes ## OMA client provisioning examples -Adding an application-based mapping policy. In this example, the ConnectionId for type CMST\_CONNECTION\_NAME is set to the name of the connection (“GPRSConn1”) that is configured with the CM\_CellularEntries configuration service provider. +Adding an application-based mapping policy. In this example, the ConnectionId for type CMST\_CONNECTION\_NAME is set to the name of the connection ("GPRSConn1") that is configured with the CM\_CellularEntries configuration service provider. ```xml @@ -191,7 +184,7 @@ Adding an application-based mapping policy. In this example, the ConnectionId fo ``` -Adding a host-based mapping policy. In this example, the ConnectionId for type CMST\_CONNECTION\_NAME is set to the name of the connection (“GPRSConn1”) that is configured with the CM\_CellularEntries configuration service provider. +Adding a host-based mapping policy. In this example, the ConnectionId for type CMST\_CONNECTION\_NAME is set to the name of the connection ("GPRSConn1") that is configured with the CM\_CellularEntries configuration service provider. ```xml diff --git a/windows/client-management/mdm/cmpolicyenterprise-ddf-file.md b/windows/client-management/mdm/cmpolicyenterprise-ddf-file.md index 15d65b1bc8..c452430808 100644 --- a/windows/client-management/mdm/cmpolicyenterprise-ddf-file.md +++ b/windows/client-management/mdm/cmpolicyenterprise-ddf-file.md @@ -1,13 +1,6 @@ --- title: CMPolicyEnterprise DDF file description: Learn about the OMA DM device description framework (DDF) for the CMPolicyEnterprise configuration service provider. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 12/05/2017 --- diff --git a/windows/client-management/mdm/configuration-service-provider-ddf.md b/windows/client-management/mdm/configuration-service-provider-ddf.md index ad995b441b..99b94df749 100644 --- a/windows/client-management/mdm/configuration-service-provider-ddf.md +++ b/windows/client-management/mdm/configuration-service-provider-ddf.md @@ -1,13 +1,6 @@ --- title: Configuration service provider DDF files description: Learn more about the OMA DM device description framework (DDF) for various configuration service providers -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 09/18/2020 ms.collection: - highpri @@ -20,7 +13,7 @@ This article lists the OMA DM device description framework (DDF) files for vario As of December 2022, DDF XML schema was updated to include additional information such as OS build applicability. DDF v2 XML files for Windows 10 and Windows 11 are combined, and provided in a single download: -- [DDF v2 Files, September 2023](https://download.microsoft.com/download/0/e/c/0ec027e5-8971-49a2-9230-ec9352bc3ead/DDFv2September2023.zip) +- [DDF v2 Files, May 2024](https://download.microsoft.com/download/f/6/1/f61445f7-1d38-45f7-bc8c-609b86e4aabc/DDFv2May24.zip) ## DDF v2 schema @@ -582,6 +575,7 @@ DDF v2 XML schema definition is listed below along with the schema definition fo You can download the older DDF files for various CSPs from the links below: +- [Download all the DDF files for Windows 10 and 11 September 2023](https://download.microsoft.com/download/0/e/c/0ec027e5-8971-49a2-9230-ec9352bc3ead/DDFv2September2023.zip) - [Download all the DDF files for Windows 10 and 11 December 2022](https://download.microsoft.com/download/7/4/c/74c6daca-983e-4f16-964a-eef65b553a37/DDFv2December2022.zip) - [Download all the DDF files for Windows 10, version 2004](https://download.microsoft.com/download/4/0/f/40f9ec45-3bea-442c-8afd-21edc1e057d8/Windows10_2004_DDF_download.zip) - [Download all the DDF files for Windows 10, version 1903](https://download.microsoft.com/download/6/F/0/6F019079-6EB0-41B5-88E8-D1CE77DBA27B/Windows10_1903_DDF_download.zip) diff --git a/windows/client-management/mdm/configuration-service-provider-support.md b/windows/client-management/mdm/configuration-service-provider-support.md index 84472ed120..161a1ac596 100644 --- a/windows/client-management/mdm/configuration-service-provider-support.md +++ b/windows/client-management/mdm/configuration-service-provider-support.md @@ -1,13 +1,6 @@ --- title: Configuration service provider support description: Learn more about configuration service provider (CSP) supported scenarios. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 09/18/2020 ms.collection: - highpri diff --git a/windows/client-management/mdm/contribute-csp-reference.md b/windows/client-management/mdm/contribute-csp-reference.md index 4f2f637895..b31178f974 100644 --- a/windows/client-management/mdm/contribute-csp-reference.md +++ b/windows/client-management/mdm/contribute-csp-reference.md @@ -1,14 +1,9 @@ --- title: Contributing to CSP reference articles description: Learn more about contributing to the CSP reference articles. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa ms.date: 07/18/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage ms.topic: reference +ms.localizationpriority: medium --- # Contributing to the CSP reference articles diff --git a/windows/client-management/mdm/customdeviceui-csp.md b/windows/client-management/mdm/customdeviceui-csp.md index 7e206209d2..aec5c878b5 100644 --- a/windows/client-management/mdm/customdeviceui-csp.md +++ b/windows/client-management/mdm/customdeviceui-csp.md @@ -1,13 +1,6 @@ --- title: CustomDeviceUI CSP description: Learn how the CustomDeviceUI configuration service provider (CSP) allows OEMs to implement their custom foreground application. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/customdeviceui-ddf.md b/windows/client-management/mdm/customdeviceui-ddf.md index 78d4037e82..e5b3f90423 100644 --- a/windows/client-management/mdm/customdeviceui-ddf.md +++ b/windows/client-management/mdm/customdeviceui-ddf.md @@ -1,13 +1,6 @@ --- title: CustomDeviceUI DDF description: Learn about the OMA DM device description framework (DDF) for the CustomDeviceUI configuration service provider. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 12/05/2017 --- diff --git a/windows/client-management/mdm/declaredconfiguration-csp.md b/windows/client-management/mdm/declaredconfiguration-csp.md index 64297f2f14..5614e38ee4 100644 --- a/windows/client-management/mdm/declaredconfiguration-csp.md +++ b/windows/client-management/mdm/declaredconfiguration-csp.md @@ -1,14 +1,7 @@ --- title: DeclaredConfiguration CSP description: Learn more about the DeclaredConfiguration CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/declaredconfiguration-ddf-file.md b/windows/client-management/mdm/declaredconfiguration-ddf-file.md index a60936f654..07e2e406e6 100644 --- a/windows/client-management/mdm/declaredconfiguration-ddf-file.md +++ b/windows/client-management/mdm/declaredconfiguration-ddf-file.md @@ -1,14 +1,7 @@ --- title: DeclaredConfiguration DDF file description: View the XML file containing the device description framework (DDF) for the DeclaredConfiguration configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 06/28/2024 --- @@ -47,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the D 99.9.99999 9.9 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; diff --git a/windows/client-management/mdm/defender-csp.md b/windows/client-management/mdm/defender-csp.md index ee424411b4..198570987e 100644 --- a/windows/client-management/mdm/defender-csp.md +++ b/windows/client-management/mdm/defender-csp.md @@ -1,14 +1,7 @@ --- title: Defender CSP description: Learn more about the Defender CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 06/21/2024 --- @@ -31,7 +24,23 @@ The following list shows the Defender configuration service provider nodes: - [AllowNetworkProtectionDownLevel](#configurationallownetworkprotectiondownlevel) - [AllowNetworkProtectionOnWinServer](#configurationallownetworkprotectiononwinserver) - [AllowSwitchToAsyncInspection](#configurationallowswitchtoasyncinspection) + - [ArchiveMaxDepth](#configurationarchivemaxdepth) + - [ArchiveMaxSize](#configurationarchivemaxsize) - [ASROnlyPerRuleExclusions](#configurationasronlyperruleexclusions) + - [BehavioralNetworkBlocks](#configurationbehavioralnetworkblocks) + - [BruteForceProtection](#configurationbehavioralnetworkblocksbruteforceprotection) + - [BruteForceProtectionAggressiveness](#configurationbehavioralnetworkblocksbruteforceprotectionbruteforceprotectionaggressiveness) + - [BruteForceProtectionConfiguredState](#configurationbehavioralnetworkblocksbruteforceprotectionbruteforceprotectionconfiguredstate) + - [BruteForceProtectionExclusions](#configurationbehavioralnetworkblocksbruteforceprotectionbruteforceprotectionexclusions) + - [BruteForceProtectionMaxBlockTime](#configurationbehavioralnetworkblocksbruteforceprotectionbruteforceprotectionmaxblocktime) + - [BruteForceProtectionPlugins](#configurationbehavioralnetworkblocksbruteforceprotectionbruteforceprotectionplugins) + - [BruteForceProtectionLocalNetworkBlocking](#configurationbehavioralnetworkblocksbruteforceprotectionbruteforceprotectionpluginsbruteforceprotectionlocalnetworkblocking) + - [BruteForceProtectionSkipLearningPeriod](#configurationbehavioralnetworkblocksbruteforceprotectionbruteforceprotectionpluginsbruteforceprotectionskiplearningperiod) + - [RemoteEncryptionProtection](#configurationbehavioralnetworkblocksremoteencryptionprotection) + - [RemoteEncryptionProtectionAggressiveness](#configurationbehavioralnetworkblocksremoteencryptionprotectionremoteencryptionprotectionaggressiveness) + - [RemoteEncryptionProtectionConfiguredState](#configurationbehavioralnetworkblocksremoteencryptionprotectionremoteencryptionprotectionconfiguredstate) + - [RemoteEncryptionProtectionExclusions](#configurationbehavioralnetworkblocksremoteencryptionprotectionremoteencryptionprotectionexclusions) + - [RemoteEncryptionProtectionMaxBlockTime](#configurationbehavioralnetworkblocksremoteencryptionprotectionremoteencryptionprotectionmaxblocktime) - [DataDuplicationDirectory](#configurationdataduplicationdirectory) - [DataDuplicationLocalRetentionPeriod](#configurationdataduplicationlocalretentionperiod) - [DataDuplicationMaximumQuota](#configurationdataduplicationmaximumquota) @@ -47,6 +56,8 @@ The following list shows the Defender configuration service provider nodes: - [RuleData](#configurationdevicecontrolpolicyrulesruleidruledata) - [DeviceControlEnabled](#configurationdevicecontrolenabled) - [DisableCacheMaintenance](#configurationdisablecachemaintenance) + - [DisableCoreServiceECSIntegration](#configurationdisablecoreserviceecsintegration) + - [DisableCoreServiceTelemetry](#configurationdisablecoreservicetelemetry) - [DisableCpuThrottleOnIdleScans](#configurationdisablecputhrottleonidlescans) - [DisableDatagramProcessing](#configurationdisabledatagramprocessing) - [DisableDnsOverTcpParsing](#configurationdisablednsovertcpparsing) @@ -65,6 +76,8 @@ The following list shows the Defender configuration service provider nodes: - [EnableConvertWarnToBlock](#configurationenableconvertwarntoblock) - [EnableDnsSinkhole](#configurationenablednssinkhole) - [EnableFileHashComputation](#configurationenablefilehashcomputation) + - [EnableUdpReceiveOffload](#configurationenableudpreceiveoffload) + - [EnableUdpSegmentationOffload](#configurationenableudpsegmentationoffload) - [EngineUpdatesChannel](#configurationengineupdateschannel) - [ExcludedIpAddresses](#configurationexcludedipaddresses) - [HideExclusionsFromLocalAdmins](#configurationhideexclusionsfromlocaladmins) @@ -80,6 +93,8 @@ The following list shows the Defender configuration service provider nodes: - [RandomizeScheduleTaskTimes](#configurationrandomizescheduletasktimes) - [ScanOnlyIfIdleEnabled](#configurationscanonlyifidleenabled) - [SchedulerRandomizationTime](#configurationschedulerrandomizationtime) + - [ScheduleSecurityIntelligenceUpdateDay](#configurationschedulesecurityintelligenceupdateday) + - [ScheduleSecurityIntelligenceUpdateTime](#configurationschedulesecurityintelligenceupdatetime) - [SecuredDevicesConfiguration](#configurationsecureddevicesconfiguration) - [SecurityIntelligenceLocationUpdateAtScheduledTimeOnly](#configurationsecurityintelligencelocationupdateatscheduledtimeonly) - [SecurityIntelligenceUpdatesChannel](#configurationsecurityintelligenceupdateschannel) @@ -101,6 +116,8 @@ The following list shows the Defender configuration service provider nodes: - [ComputerState](#healthcomputerstate) - [DefenderEnabled](#healthdefenderenabled) - [DefenderVersion](#healthdefenderversion) + - [DeviceControl](#healthdevicecontrol) + - [State](#healthdevicecontrolstate) - [EngineVersion](#healthengineversion) - [FullScanOverdue](#healthfullscanoverdue) - [FullScanRequired](#healthfullscanrequired) @@ -350,7 +367,7 @@ Control whether network protection can improve performance by switching from rea | Value | Description | |:--|:--| | 1 | Allow switching to asynchronous inspection. | -| 0 (Default) | Don't allow asynchronous inspection. | +| 0 (Default) | Don’t allow asynchronous inspection. | @@ -359,6 +376,88 @@ Control whether network protection can improve performance by switching from rea + +### Configuration/ArchiveMaxDepth + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/ArchiveMaxDepth +``` + + + + +Specify the maximum folder depth to extract from archive files for scanning. If this configuration is off or not set, the default value (0) is applied, and all archives are extracted up to the deepest folder for scanning. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | Range: `[0-4294967295]` | +| Default Value | 0 | + + + + + + + + + +### Configuration/ArchiveMaxSize + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/ArchiveMaxSize +``` + + + + +Specify the maximum size, in KB, of archive files to be extracted and scanned. If this configuration is off or not set, the default value (0) is applied, and all archives are extracted and scanned regardless of size. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | Range: `[0-4294967295]` | +| Default Value | 0 | + + + + + + + + ### Configuration/ASROnlyPerRuleExclusions @@ -398,6 +497,621 @@ Apply ASR only per rule exclusions. + +### Configuration/BehavioralNetworkBlocks + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/BehavioralNetworkBlocks +``` + + + + + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `node` | +| Access Type | Get | + + + + + + + + + +#### Configuration/BehavioralNetworkBlocks/BruteForceProtection + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/BehavioralNetworkBlocks/BruteForceProtection +``` + + + + + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `node` | +| Access Type | Get | + + + + + + + + + +##### Configuration/BehavioralNetworkBlocks/BruteForceProtection/BruteForceProtectionAggressiveness + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/BehavioralNetworkBlocks/BruteForceProtection/BruteForceProtectionAggressiveness +``` + + + + +Set the criteria for when Brute-Force Protection blocks IP addresses. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Low: Only IP addresses that are 100% confidence malicious (default). | +| 1 | Medium: Use cloud aggregation to block IP addresses that are over 99% likely malicious. | +| 2 | High: Block IP addresses identified using client intelligence and context to block IP addresses that are over 90% likely malicious. | + + + + + + + + + +##### Configuration/BehavioralNetworkBlocks/BruteForceProtection/BruteForceProtectionConfiguredState + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/BehavioralNetworkBlocks/BruteForceProtection/BruteForceProtectionConfiguredState +``` + + + + +Brute-Force Protection in Microsoft Defender Antivirus detects and blocks attempts to forcibly sign in and initiate sessions. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Not configured: Apply defaults set by the antivirus engine and platform. | +| 1 | Block: Prevent suspicious and malicious behaviors. | +| 2 | Audit: Generate EDR detections without blocking. | +| 4 | Off: Feature is disabled with no performance impact. | + + + + + + + + + +##### Configuration/BehavioralNetworkBlocks/BruteForceProtection/BruteForceProtectionExclusions + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/BehavioralNetworkBlocks/BruteForceProtection/BruteForceProtectionExclusions +``` + + + + +Specify IP addresses, subnets, or workstation names to exclude from being blocked by Brute-Force Protection. Note that attackers can spoof excluded addresses and names to bypass protection. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `chr` (string) | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | List (Delimiter: `|`) | + + + + + + + + + +##### Configuration/BehavioralNetworkBlocks/BruteForceProtection/BruteForceProtectionMaxBlockTime + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/BehavioralNetworkBlocks/BruteForceProtection/BruteForceProtectionMaxBlockTime +``` + + + + +Set the maximum time an IP address is blocked by Brute-Force Protection. After this time, blocked IP addresses will be able to sign-in and initiate sessions. If set to 0, internal feature logic will determine blocking time. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | Range: `[0-4294967295]` | +| Default Value | 0 | + + + + + + + + + +##### Configuration/BehavioralNetworkBlocks/BruteForceProtection/BruteForceProtectionPlugins + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/BehavioralNetworkBlocks/BruteForceProtection/BruteForceProtectionPlugins +``` + + + + + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `node` | +| Access Type | Get | + + + + + + + + + +###### Configuration/BehavioralNetworkBlocks/BruteForceProtection/BruteForceProtectionPlugins/BruteForceProtectionLocalNetworkBlocking + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1709 [10.0.16299] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/BehavioralNetworkBlocks/BruteForceProtection/BruteForceProtectionPlugins/BruteForceProtectionLocalNetworkBlocking +``` + + + + +Extend brute-force protection coverage in Microsoft Defender Antivirus to block local network addresses. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Brute-force protection won't block local network addresses. | +| 1 | Brute-force protection will block local network addresses. | + + + + + + + + + +###### Configuration/BehavioralNetworkBlocks/BruteForceProtection/BruteForceProtectionPlugins/BruteForceProtectionSkipLearningPeriod + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1709 [10.0.16299] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/BehavioralNetworkBlocks/BruteForceProtection/BruteForceProtectionPlugins/BruteForceProtectionSkipLearningPeriod +``` + + + + +Skip the 2-week initial learning period, so brute-force protection in Microsoft Defender Antivirus can start blocking immediately. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Brute-force protection blocks threats only after completing a 2-week learning period. | +| 1 | Brute-force protection starts blocking threats immediately. | + + + + + + + + + +#### Configuration/BehavioralNetworkBlocks/RemoteEncryptionProtection + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/BehavioralNetworkBlocks/RemoteEncryptionProtection +``` + + + + + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `node` | +| Access Type | Get | + + + + + + + + + +##### Configuration/BehavioralNetworkBlocks/RemoteEncryptionProtection/RemoteEncryptionProtectionAggressiveness + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/BehavioralNetworkBlocks/RemoteEncryptionProtection/RemoteEncryptionProtectionAggressiveness +``` + + + + +Set the criteria for when Remote Encryption Protection blocks IP addresses. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Low: Block only when confidence level is 100% (Default). | +| 1 | Medium: Use cloud aggregation and block when confidence level is above 99%. | +| 2 | High: Use cloud intel and context, and block when confidence level is above 90%. | + + + + + + + + + +##### Configuration/BehavioralNetworkBlocks/RemoteEncryptionProtection/RemoteEncryptionProtectionConfiguredState + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/BehavioralNetworkBlocks/RemoteEncryptionProtection/RemoteEncryptionProtectionConfiguredState +``` + + + + +Remote Encryption Protection in Microsoft Defender Antivirus detects and blocks attempts to replace local files with encrypted versions from another device. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Not configured: Apply defaults set for the antivirus engine and platform. | +| 1 | Block: Prevent suspicious and malicious behaviors. | +| 2 | Audit: Generate EDR detections without blocking. | +| 4 | Off: Feature is off with no performance impact. | + + + + + + + + + +##### Configuration/BehavioralNetworkBlocks/RemoteEncryptionProtection/RemoteEncryptionProtectionExclusions + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/BehavioralNetworkBlocks/RemoteEncryptionProtection/RemoteEncryptionProtectionExclusions +``` + + + + +Specify IP addresses, subnets, or workstation names to exclude from being blocked by Remote Encryption Protection. Note that attackers can spoof excluded addresses and names to bypass protection. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | List (Delimiter: `|`) | +| Default Value | 0 | + + + + + + + + + +##### Configuration/BehavioralNetworkBlocks/RemoteEncryptionProtection/RemoteEncryptionProtectionMaxBlockTime + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/BehavioralNetworkBlocks/RemoteEncryptionProtection/RemoteEncryptionProtectionMaxBlockTime +``` + + + + +Set the maximum time an IP address is blocked by Remote Encryption Protection. After this time, blocked IP addresses will be able to reinitiate connections. If set to 0, internal feature logic will determine blocking time. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | Range: `[0-4294967295]` | +| Default Value | 0 | + + + + + + + + ### Configuration/DataDuplicationDirectory @@ -536,7 +1250,7 @@ Defines the maximum data duplication quota in MB that can be collected. When the -Define data duplication remote location for device control. +Define data duplication remote location for Device Control. When configuring this setting, ensure that Device Control is Enabled and that the provided path is a remote path the user can access. @@ -1014,6 +1728,104 @@ Defines whether the cache maintenance idle task will perform the cache maintenan + +### Configuration/DisableCoreServiceECSIntegration + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/DisableCoreServiceECSIntegration +``` + + + + +Turn off ECS integration for Defender core service. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0x0 | + + + +**Allowed values**: + +| Flag | Description | +|:--|:--| +| 0x0 (Default) | The Defender core service will use the Experimentation and Configuration Service (ECS) to rapidly deliver critical, org-specific fixes. | +| 0x1 | The Defender core service stops using the Experimentation and Configuration Service (ECS). Fixes will continue to be delivered through security intelligence updates. | + + + + + + + + + +### Configuration/DisableCoreServiceTelemetry + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/DisableCoreServiceTelemetry +``` + + + + +Turn off OneDsCollector telemetry for Defender core service. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0x0 | + + + +**Allowed values**: + +| Flag | Description | +|:--|:--| +| 0x0 (Default) | The Defender core service will use the OneDsCollector framework to rapidly collect telemetry. | +| 0x1 | The Defender core service stops using the OneDsCollector framework to rapidly collect telemetry, impacting Microsoft's ability to quickly recognize and address poor performance, false positives, and other problems. | + + + + + + + + ### Configuration/DisableCpuThrottleOnIdleScans @@ -1801,6 +2613,9 @@ This setting controls whether network protection blocks network traffic instead ### Configuration/EnableDnsSinkhole +> [!NOTE] +> This policy is deprecated and may be removed in a future release. + | Scope | Editions | Applicable OS | |:--|:--|:--| @@ -1837,8 +2652,8 @@ This setting enables the DNS Sinkhole feature for Network Protection, respecting | Value | Description | |:--|:--| -| 1 (Default) | DNS Sinkhole is disabled. | -| 0 | DNS Sinkhole is enabled. | +| 0 | DNS Sinkhole is disabled. | +| 1 (Default) | DNS Sinkhole is enabled. | @@ -1896,6 +2711,104 @@ Enables or disables file hash computation feature. When this feature is enabled + +### Configuration/EnableUdpReceiveOffload + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/EnableUdpReceiveOffload +``` + + + + +This setting enables Udp Receive Offload Network Protection. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Udp Receive Offload is disabled. | +| 1 | Udp Receive Offload is enabled. | + + + + + + + + + +### Configuration/EnableUdpSegmentationOffload + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/EnableUdpSegmentationOffload +``` + + + + +This setting enables Udp Segmentation Offload Network Protection. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Udp Segmentation Offload is disabled. | +| 1 | Udp Segmentation Offload is enabled. | + + + + + + + + ### Configuration/EngineUpdatesChannel @@ -1980,7 +2893,7 @@ Allows an administrator to explicitly disable network packet inspection made by |:--|:--| | Format | `chr` (string) | | Access Type | Add, Delete, Get, Replace | -| Allowed Values | List (Delimiter: `|`) | +| Allowed Values | Regular Expression: `^(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$|^(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}$|^(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}$|^(?:[0-9a-fA-F]{1,4}:){1,5}(?::[0-9a-fA-F]{1,4}){1,2}$|^(?:[0-9a-fA-F]{1,4}:){1,4}(?::[0-9a-fA-F]{1,4}){1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,3}(?::[0-9a-fA-F]{1,4}){1,4}$|^(?:[0-9a-fA-F]{1,4}:){1,2}(?::[0-9a-fA-F]{1,4}){1,5}$|^[0-9a-fA-F]{1,4}(?::[0-9a-fA-F]{1,4}){1,6}$|^::1$|^::$` | @@ -2205,7 +3118,7 @@ Allow managed devices to update through metered connections. Default is 0 - not -This sets the reputation mode for Network Protection. +This sets the reputation mode engine for Network Protection. @@ -2222,6 +3135,15 @@ This sets the reputation mode for Network Protection. | Default Value | 0 | + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Use standard reputation engine. | +| 1 | Use ESP reputation engine. | + + @@ -2470,7 +3392,7 @@ This setting allows you to scan excluded files and directories during quick scan | Value | Description | |:--|:--| | 0 (Default) | If you set this setting to 0 or don't configure it, exclusions aren't scanned during quick scans. | -| 1 | If you set this setting to 1, all files and directories that are excluded from real-time protection using contextual exclusions are scanned during a quick scan. Exclusions that contain wildcards aren't supported and aren't scanned. | +| 1 | If you set this setting to 1, all files and directories that are excluded from real-time protection using contextual exclusions are scanned during a quick scan. | @@ -2618,6 +3540,103 @@ This setting allows you to configure the scheduler randomization in hours. The r + +### Configuration/ScheduleSecurityIntelligenceUpdateDay + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/ScheduleSecurityIntelligenceUpdateDay +``` + + + + +This setting allows you to specify the day of the week on which to check for security intelligence updates. By default, this setting is configured to never check for security intelligence updates. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 8 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | Daily. | +| 1 | Sunday. | +| 2 | Monday. | +| 3 | Tuesday. | +| 4 | Wednesday. | +| 5 | Thursday. | +| 6 | Friday. | +| 7 | Saturday. | +| 8 (Default) | Never. | + + + + + + + + + +### Configuration/ScheduleSecurityIntelligenceUpdateTime + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/ScheduleSecurityIntelligenceUpdateTime +``` + + + + +This setting allows you to specify the time of day at which to check for security intelligence updates. The time value is represented as the number of minutes past midnight (00:00). For example, 120 is equivalent to 02:00 AM. By default, this setting is configured to check for security intelligence updates 15 minutes before the scheduled scan time. The schedule is based on local time on the computer where the check is occurring. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | Range: `[0-1439]` | +| Default Value | 105 | + + + + + + + + ### Configuration/SecuredDevicesConfiguration @@ -2635,7 +3654,7 @@ This setting allows you to configure the scheduler randomization in hours. The r -Defines what are the devices primary ids that should be secured by Defender Device Control. The primary id values should be pipe (|) separated. Example: RemovableMediaDevices|CdRomDevices. If this configuration isn't set the default value will be applied, meaning all of the supported devices will be secured. +Defines which device's primary ids should be secured by Defender Device Control. The primary id values should be pipe (|) separated. Example: RemovableMediaDevices|CdRomDevices. If this configuration isn't set the default value will be applied, meaning all supported devices will be secured. Currently supported primary ids are: RemovableMediaDevices, CdRomDevices, WpdDevices, PrinterDevices. @@ -2649,9 +3668,19 @@ Defines what are the devices primary ids that should be secured by Defender Devi |:--|:--| | Format | `chr` (string) | | Access Type | Add, Delete, Get, Replace | -| Allowed Values | List (Delimiter: `|`) | + +**Allowed values**: + +| Value | Description | +|:--|:--| +| RemovableMediaDevices | RemovableMediaDevices. | +| CdRomDevices | CdRomDevices. | +| WpdDevices | WpdDevices. | +| PrinterDevices | PrinterDevices. | + + @@ -3645,6 +4674,84 @@ Version number of Windows Defender on the device. + +### Health/DeviceControl + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Health/DeviceControl +``` + + + + +An interior node to group information about Device Cotrol health status. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `chr` (string) | +| Access Type | Get | + + + + + + + + + +#### Health/DeviceControl/State + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1809 [10.0.17763] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Health/DeviceControl/State +``` + + + + +Provide the current state of the Device Control. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Get | + + + + + + + + ### Health/EngineVersion diff --git a/windows/client-management/mdm/defender-ddf.md b/windows/client-management/mdm/defender-ddf.md index 60fd484a13..f286ba947c 100644 --- a/windows/client-management/mdm/defender-ddf.md +++ b/windows/client-management/mdm/defender-ddf.md @@ -1,14 +1,7 @@ --- title: Defender DDF file description: View the XML file containing the device description framework (DDF) for the Defender configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 06/28/2024 --- @@ -46,7 +39,7 @@ The following XML file contains the device description framework (DDF) for the D 10.0.10586 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; @@ -305,6 +298,52 @@ The following XML file contains the device description framework (DDF) for the D + + DeviceControl + + + + + An interior node to group information about Device Cotrol health status. + + + + + + + + + + + + + + + State + + + + + + + + + + + + + + + + + + + 10.0.17763 + 1.3 + + + + ProductStatus @@ -1059,7 +1098,8 @@ The following XML file contains the device description framework (DDF) for the D 10.0.14393 1.3 - + + ^(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$|^(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}$|^(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}$|^(?:[0-9a-fA-F]{1,4}:){1,5}(?::[0-9a-fA-F]{1,4}){1,2}$|^(?:[0-9a-fA-F]{1,4}:){1,4}(?::[0-9a-fA-F]{1,4}){1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,3}(?::[0-9a-fA-F]{1,4}){1,4}$|^(?:[0-9a-fA-F]{1,4}:){1,2}(?::[0-9a-fA-F]{1,4}){1,5}$|^[0-9a-fA-F]{1,4}(?::[0-9a-fA-F]{1,4}){1,6}$|^::1$|^::$ @@ -1707,14 +1747,15 @@ The following XML file contains the device description framework (DDF) for the D - 1 + 0 DNS Sinkhole is disabled - 0 + 1 DNS Sinkhole is enabled + @@ -2141,7 +2182,7 @@ The following XML file contains the device description framework (DDF) for the D 1 - If you set this setting to 1, all files and directories that are excluded from real-time protection using contextual exclusions are scanned during a quick scan. Exclusions that contain wildcards are not supported and are not scanned. + If you set this setting to 1, all files and directories that are excluded from real-time protection using contextual exclusions are scanned during a quick scan. @@ -2185,6 +2226,105 @@ The following XML file contains the device description framework (DDF) for the D + + ScheduleSecurityIntelligenceUpdateTime + + + + + + + + 105 + This setting allows you to specify the time of day at which to check for security intelligence updates. The time value is represented as the number of minutes past midnight (00:00). For example, 120 is equivalent to 02:00 AM. By default, this setting is configured to check for security intelligence updates 15 minutes before the scheduled scan time. The schedule is based on local time on the computer where the check is occurring. + + + + + + + + + + + + + + 10.0.14393 + 1.3 + + + [0-1439] + + + + + ScheduleSecurityIntelligenceUpdateDay + + + + + + + + 8 + This setting allows you to specify the day of the week on which to check for security intelligence updates. By default, this setting is configured to never check for security intelligence updates. + + + + + + + + + + + + + + 10.0.14393 + 1.3 + + + + 0 + Daily + + + 1 + Sunday + + + 2 + Monday + + + 3 + Tuesday + + + 4 + Wednesday + + + 5 + Thursday + + + 6 + Friday + + + 7 + Saturday + + + 8 + Never + + + + ThrottleForScheduledScanOnly @@ -2325,7 +2465,7 @@ The following XML file contains the device description framework (DDF) for the D - Define data duplication remote location for device control. + Define data duplication remote location for Device Control. When configuring this setting, ensure that Device Control is Enabled and that the provided path is a remote path the user can access. @@ -2355,7 +2495,7 @@ The following XML file contains the device description framework (DDF) for the D - Defines what are the devices primary ids that should be secured by Defender Device Control. The primary id values should be pipe (|) separated. Example: RemovableMediaDevices|CdRomDevices. If this configuration is not set the default value will be applied, meaning all of the supported devices will be secured. + Defines which device's primary ids should be secured by Defender Device Control. The primary id values should be pipe (|) separated. Example: RemovableMediaDevices|CdRomDevices. If this configuration is not set the default value will be applied, meaning all supported devices will be secured. Currently supported primary ids are: RemovableMediaDevices, CdRomDevices, WpdDevices, PrinterDevices. @@ -2372,7 +2512,23 @@ The following XML file contains the device description framework (DDF) for the D 10.0.17763 1.3 - + + + RemovableMediaDevices + RemovableMediaDevices + + + CdRomDevices + CdRomDevices + + + WpdDevices + WpdDevices + + + PrinterDevices + PrinterDevices + @@ -2566,6 +2722,84 @@ The following XML file contains the device description framework (DDF) for the D + + DisableCoreServiceECSIntegration + + + + + + + + 0x0 + Turn off ECS integration for Defender core service + + + + + + + + + + + + + + 10.0.14393 + 1.3 + + + + 0x0 + The Defender core service will use the Experimentation and Configuration Service (ECS) to rapidly deliver critical, org-specific fixes. + + + 0x1 + The Defender core service stops using the Experimentation and Configuration Service (ECS). Fixes will continue to be delivered through security intelligence updates. + + + + + + DisableCoreServiceTelemetry + + + + + + + + 0x0 + Turn off OneDsCollector telemetry for Defender core service + + + + + + + + + + + + + + 10.0.14393 + 1.3 + + + + 0x0 + The Defender core service will use the OneDsCollector framework to rapidly collect telemetry. + + + 0x1 + The Defender core service stops using the OneDsCollector framework to rapidly collect telemetry, impacting Microsoft's ability to quickly recognize and address poor performance, false positives, and other problems. + + + + IntelTDTEnabled @@ -2697,7 +2931,7 @@ The following XML file contains the device description framework (DDF) for the D 0 - This sets the reputation mode for Network Protection. + This sets the reputation mode engine for Network Protection. @@ -2714,6 +2948,94 @@ The following XML file contains the device description framework (DDF) for the D 10.0.14393 1.3 + + + 0 + Use standard reputation engine + + + 1 + Use ESP reputation engine + + + + + + EnableUdpSegmentationOffload + + + + + + + + 0 + This setting enables Udp Segmentation Offload Network Protection. + + + + + + + + + + + + + + 10.0.14393 + 1.3 + + + + 0 + Udp Segmentation Offload is disabled + + + 1 + Udp Segmentation Offload is enabled + + + + + + EnableUdpReceiveOffload + + + + + + + + 0 + This setting enables Udp Receive Offload Network Protection. + + + + + + + + + + + + + + 10.0.14393 + 1.3 + + + + 0 + Udp Receive Offload is disabled + + + 1 + Udp Receive Offload is enabled + + @@ -2794,6 +3116,70 @@ The following XML file contains the device description framework (DDF) for the D + + ArchiveMaxSize + + + + + + + + 0 + Specify the maximum size, in KB, of archive files to be extracted and scanned. If this configuration is off or not set, the default value (0) is applied, and all archives are extracted and scanned regardless of size. + + + + + + + + + + + + + + 10.0.14393 + 1.3 + + + [0-4294967295] + + + + + ArchiveMaxDepth + + + + + + + + 0 + Specify the maximum folder depth to extract from archive files for scanning. If this configuration is off or not set, the default value (0) is applied, and all archives are extracted up to the deepest folder for scanning. + + + + + + + + + + + + + + 10.0.14393 + 1.3 + + + [0-4294967295] + + + ScanOnlyIfIdleEnabled @@ -2872,6 +3258,475 @@ The following XML file contains the device description framework (DDF) for the D + + BehavioralNetworkBlocks + + + + + + + + + + + + + + + + + + 10.0.14393 + 1.3 + + + + RemoteEncryptionProtection + + + + + + + + + + + + + + + + + + + RemoteEncryptionProtectionConfiguredState + + + + + + + + 0 + Remote Encryption Protection in Microsoft Defender Antivirus detects and blocks attempts to replace local files with encrypted versions from another device. + + + + + + + + + + + + + + 10.0.14393 + 1.3 + + + + 0 + Not configured: Apply defaults set for the antivirus engine and platform + + + 1 + Block: Prevent suspicious and malicious behaviors + + + 2 + Audit: Generate EDR detections without blocking + + + 4 + Off: Feature is off with no performance impact + + + + + + RemoteEncryptionProtectionMaxBlockTime + + + + + + + + 0 + Set the maximum time an IP address is blocked by Remote Encryption Protection. After this time, blocked IP addresses will be able to reinitiate connections. If set to 0, internal feature logic will determine blocking time. + + + + + + + + + + + + + + 10.0.14393 + 1.3 + + + [0-4294967295] + + + + + RemoteEncryptionProtectionAggressiveness + + + + + + + + 0 + Set the criteria for when Remote Encryption Protection blocks IP addresses. + + + + + + + + + + + + + + 10.0.14393 + 1.3 + + + + 0 + Low: Block only when confidence level is 100% (Default) + + + 1 + Medium: Use cloud aggregation and block when confidence level is above 99% + + + 2 + High: Use cloud intel and context, and block when confidence level is above 90% + + + + + + RemoteEncryptionProtectionExclusions + + + + + + + + 0 + Specify IP addresses, subnets, or workstation names to exclude from being blocked by Remote Encryption Protection. Note that attackers can spoof excluded addresses and names to bypass protection. + + + + + + + + + + + + + + 10.0.14393 + 1.3 + + + + + + + + + BruteForceProtection + + + + + + + + + + + + + + + + + + + BruteForceProtectionConfiguredState + + + + + + + + 0 + Brute-Force Protection in Microsoft Defender Antivirus detects and blocks attempts to forcibly sign in and initiate sessions. + + + + + + + + + + + + + + 10.0.14393 + 1.3 + + + + 0 + Not configured: Apply defaults set by the antivirus engine and platform + + + 1 + Block: Prevent suspicious and malicious behaviors + + + 2 + Audit: Generate EDR detections without blocking + + + 4 + Off: Feature is disabled with no performance impact + + + + + + BruteForceProtectionMaxBlockTime + + + + + + + + 0 + Set the maximum time an IP address is blocked by Brute-Force Protection. After this time, blocked IP addresses will be able to sign-in and initiate sessions. If set to 0, internal feature logic will determine blocking time. + + + + + + + + + + + + + + 10.0.14393 + 1.3 + + + [0-4294967295] + + + + + BruteForceProtectionAggressiveness + + + + + + + + 0 + Set the criteria for when Brute-Force Protection blocks IP addresses. + + + + + + + + + + + + + + 10.0.14393 + 1.3 + + + + 0 + Low: Only IP addresses that are 100% confidence malicious (default) + + + 1 + Medium: Use cloud aggregation to block IP addresses that are over 99% likely malicious + + + 2 + High: Block IP addresses identified using client intelligence and context to block IP addresses that are over 90% likely malicious + + + + + + BruteForceProtectionPlugins + + + + + + + + + + + + + + + + + + + BruteForceProtectionLocalNetworkBlocking + + + + + + + + 0 + Extend brute-force protection coverage in Microsoft Defender Antivirus to block local network addresses. + + + + + + + + + + + + + + 10.0.16299 + 1.3 + + + + 0 + Brute-force protection will not block local network addresses + + + 1 + Brute-force protection will block local network addresses + + + + + + BruteForceProtectionSkipLearningPeriod + + + + + + + + 0 + Skip the 2-week initial learning period, so brute-force protection in Microsoft Defender Antivirus can start blocking immediately. + + + + + + + + + + + + + + 10.0.16299 + 1.3 + + + + 0 + Brute-force protection blocks threats only after completing a 2-week learning period + + + 1 + Brute-force protection starts blocking threats immediately + + + + + + + BruteForceProtectionExclusions + + + + + + + + Specify IP addresses, subnets, or workstation names to exclude from being blocked by Brute-Force Protection. Note that attackers can spoof excluded addresses and names to bypass protection. + + + + + + + + + + + + + + 10.0.14393 + 1.3 + + + + + + + + Scan diff --git a/windows/client-management/mdm/devdetail-csp.md b/windows/client-management/mdm/devdetail-csp.md index de6aaa2a90..43fa16e588 100644 --- a/windows/client-management/mdm/devdetail-csp.md +++ b/windows/client-management/mdm/devdetail-csp.md @@ -1,14 +1,7 @@ --- title: DevDetail CSP description: Learn more about the DevDetail CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/devdetail-ddf-file.md b/windows/client-management/mdm/devdetail-ddf-file.md index 542ddf9b2d..c7b1a08470 100644 --- a/windows/client-management/mdm/devdetail-ddf-file.md +++ b/windows/client-management/mdm/devdetail-ddf-file.md @@ -1,14 +1,7 @@ --- title: DevDetail DDF file description: View the XML file containing the device description framework (DDF) for the DevDetail configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 06/02/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 06/28/2024 --- @@ -47,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the D 10.0.10586 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; diff --git a/windows/client-management/mdm/developersetup-csp.md b/windows/client-management/mdm/developersetup-csp.md index 55b326e83b..defb0f5945 100644 --- a/windows/client-management/mdm/developersetup-csp.md +++ b/windows/client-management/mdm/developersetup-csp.md @@ -1,13 +1,6 @@ --- title: DeveloperSetup CSP description: The DeveloperSetup configuration service provider (CSP) is used to configure developer mode on the device. This CSP was added in the Windows 10, version 1703. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 06/26/2018 --- diff --git a/windows/client-management/mdm/developersetup-ddf.md b/windows/client-management/mdm/developersetup-ddf.md index daa6a0b7f9..ed60d67574 100644 --- a/windows/client-management/mdm/developersetup-ddf.md +++ b/windows/client-management/mdm/developersetup-ddf.md @@ -1,13 +1,6 @@ --- title: DeveloperSetup DDF file description: This topic shows the OMA DM device description framework (DDF) for the DeveloperSetup configuration service provider. This CSP was added in Windows 10, version 1703. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 12/05/2017 --- diff --git a/windows/client-management/mdm/devicelock-csp.md b/windows/client-management/mdm/devicelock-csp.md index ab39986c26..652574980b 100644 --- a/windows/client-management/mdm/devicelock-csp.md +++ b/windows/client-management/mdm/devicelock-csp.md @@ -1,13 +1,6 @@ --- title: DeviceLock CSP description: Learn how the DeviceLock configuration service provider (CSP) is used by the enterprise management server to configure device lock related policies. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/devicelock-ddf-file.md b/windows/client-management/mdm/devicelock-ddf-file.md index 03f27aef68..57ffe9c63b 100644 --- a/windows/client-management/mdm/devicelock-ddf-file.md +++ b/windows/client-management/mdm/devicelock-ddf-file.md @@ -1,13 +1,6 @@ --- title: DeviceLock DDF file description: Learn about the OMA DM device description framework (DDF) for the DeviceLock configuration service provider (CSP). -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/devicemanageability-csp.md b/windows/client-management/mdm/devicemanageability-csp.md index 38250ba79f..ff94b7f4b8 100644 --- a/windows/client-management/mdm/devicemanageability-csp.md +++ b/windows/client-management/mdm/devicemanageability-csp.md @@ -1,14 +1,7 @@ --- title: DeviceManageability CSP description: Learn more about the DeviceManageability CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/devicemanageability-ddf.md b/windows/client-management/mdm/devicemanageability-ddf.md index 9c0d424446..4769870f2a 100644 --- a/windows/client-management/mdm/devicemanageability-ddf.md +++ b/windows/client-management/mdm/devicemanageability-ddf.md @@ -1,14 +1,7 @@ --- title: DeviceManageability DDF file description: View the XML file containing the device description framework (DDF) for the DeviceManageability configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 06/02/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 06/28/2024 --- @@ -49,7 +42,7 @@ The following XML file contains the device description framework (DDF) for the D 10.0.14393 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; diff --git a/windows/client-management/mdm/devicepreparation-csp.md b/windows/client-management/mdm/devicepreparation-csp.md index 1998989619..b93cdfd164 100644 --- a/windows/client-management/mdm/devicepreparation-csp.md +++ b/windows/client-management/mdm/devicepreparation-csp.md @@ -1,14 +1,7 @@ --- title: DevicePreparation CSP description: Learn more about the DevicePreparation CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 04/10/2024 --- @@ -33,6 +26,9 @@ The following list shows the DevicePreparation configuration service provider no - [Progress](#mdmproviderprogress) - [RebootRequired](#mdmproviderrebootrequired) - [PageEnabled](#pageenabled) + - [PageErrorCode](#pageerrorcode) + - [PageErrorDetails](#pageerrordetails) + - [PageErrorPhase](#pageerrorphase) - [PageSettings](#pagesettings) - [PageStatus](#pagestatus) @@ -188,6 +184,15 @@ This node indicates whether the MDM agent was installed or not. When set to true | Default Value | False | + +**Allowed values**: + +| Value | Description | +|:--|:--| +| false (Default) | Mdm Agent Not Installed. | +| true | Mdm Agent Installed. | + + @@ -267,6 +272,15 @@ This node indicates whether an MDM policy was provisioned that requires a reboot | Default Value | False | + +**Allowed values**: + +| Value | Description | +|:--|:--| +| false (Default) | No Reboot Required. | +| true | Reboot Required. | + + @@ -307,12 +321,148 @@ This node determines whether to show the Device Preparation page during OOBE. | Default Value | false | + +**Allowed values**: + +| Value | Description | +|:--|:--| +| false (Default) | Disable Page. | +| true | Enable Page. | + + + +## PageErrorCode + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/DevicePreparation/PageErrorCode +``` + + + + +This node provides specific overall HRESULT causing a fatal error on the Device Preparation page. This node is valid only if the PageErrorPhase node's value isn't Unknown. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Get | + + + + + + + + + +## PageErrorDetails + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/DevicePreparation/PageErrorDetails +``` + + + + +This node provides optional details for any fatal error on the Device Preparation page. This node is valid only if the PageErrorPhase node's value isn't Unknown, but not all errors will have details. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `chr` (string) | +| Access Type | Get | + + + + + + + + + +## PageErrorPhase + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/DevicePreparation/PageErrorPhase +``` + + + + +This node provides the specific phase that failed during the Device Preparation page. Values are an enum: 0 = Unknown; 1 = AgentDownload; 2 = AgentProgress. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Get | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | Unknown. | +| 1 | AgentDownload. | +| 2 | AgentProgress. | + + + + + + + + ## PageSettings diff --git a/windows/client-management/mdm/devicepreparation-ddf-file.md b/windows/client-management/mdm/devicepreparation-ddf-file.md index ed2c59bec4..903c08866d 100644 --- a/windows/client-management/mdm/devicepreparation-ddf-file.md +++ b/windows/client-management/mdm/devicepreparation-ddf-file.md @@ -1,14 +1,7 @@ --- title: DevicePreparation DDF file description: View the XML file containing the device description framework (DDF) for the DevicePreparation configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 06/28/2024 --- @@ -47,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the D 99.9.99999 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; @@ -71,6 +64,16 @@ The following XML file contains the device description framework (DDF) for the D + + + false + Disable Page + + + true + Enable Page + + @@ -117,6 +120,83 @@ The following XML file contains the device description framework (DDF) for the D + + PageErrorPhase + + + + + This node provides the specific phase that failed during the Device Preparation page. Values are an enum: 0 = Unknown; 1 = AgentDownload; 2 = AgentProgress. + + + + + + + + + + + + + + + 0 + Unknown + + + 1 + AgentDownload + + + 2 + AgentProgress + + + + + + PageErrorCode + + + + + This node provides specific overall HRESULT causing a fatal error on the Device Preparation page. This node is valid only if the PageErrorPhase node's value is not Unknown. + + + + + + + + + + + + + + + + PageErrorDetails + + + + + This node provides optional details for any fatal error on the Device Preparation page. This node is valid only if the PageErrorPhase node's value is not Unknown, but not all errors will have details. + + + + + + + + + + + + + + PageSettings @@ -250,6 +330,16 @@ The following XML file contains the device description framework (DDF) for the D + + + false + Mdm Agent Not Installed + + + true + Mdm Agent Installed + + @@ -272,6 +362,16 @@ The following XML file contains the device description framework (DDF) for the D + + + false + No Reboot Required + + + true + Reboot Required + +
                        diff --git a/windows/client-management/mdm/devicestatus-csp.md b/windows/client-management/mdm/devicestatus-csp.md index f9d45fdc5e..ad6ab08164 100644 --- a/windows/client-management/mdm/devicestatus-csp.md +++ b/windows/client-management/mdm/devicestatus-csp.md @@ -1,14 +1,7 @@ --- title: DeviceStatus CSP description: Learn more about the DeviceStatus CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/devicestatus-ddf.md b/windows/client-management/mdm/devicestatus-ddf.md index 231f3f5a26..0e02205007 100644 --- a/windows/client-management/mdm/devicestatus-ddf.md +++ b/windows/client-management/mdm/devicestatus-ddf.md @@ -1,14 +1,7 @@ --- title: DeviceStatus DDF file description: View the XML file containing the device description framework (DDF) for the DeviceStatus configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 06/02/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 06/28/2024 --- @@ -46,7 +39,7 @@ The following XML file contains the device description framework (DDF) for the D 10.0.10586 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; diff --git a/windows/client-management/mdm/devinfo-csp.md b/windows/client-management/mdm/devinfo-csp.md index 1a9e74c3a2..348fd292dc 100644 --- a/windows/client-management/mdm/devinfo-csp.md +++ b/windows/client-management/mdm/devinfo-csp.md @@ -1,14 +1,7 @@ --- title: DevInfo CSP description: Learn more about the DevInfo CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/devinfo-ddf-file.md b/windows/client-management/mdm/devinfo-ddf-file.md index f28018452e..a57636514a 100644 --- a/windows/client-management/mdm/devinfo-ddf-file.md +++ b/windows/client-management/mdm/devinfo-ddf-file.md @@ -1,14 +1,7 @@ --- title: DevInfo DDF file description: View the XML file containing the device description framework (DDF) for the DevInfo configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 06/02/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 06/28/2024 --- @@ -48,7 +41,7 @@ The following XML file contains the device description framework (DDF) for the D 10.0.10586 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; diff --git a/windows/client-management/mdm/diagnosticlog-csp.md b/windows/client-management/mdm/diagnosticlog-csp.md index baa3ca8990..01c937ef35 100644 --- a/windows/client-management/mdm/diagnosticlog-csp.md +++ b/windows/client-management/mdm/diagnosticlog-csp.md @@ -1,14 +1,7 @@ --- title: DiagnosticLog CSP description: Learn more about the DiagnosticLog CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/diagnosticlog-ddf.md b/windows/client-management/mdm/diagnosticlog-ddf.md index 3308eaf8c9..03887d47c3 100644 --- a/windows/client-management/mdm/diagnosticlog-ddf.md +++ b/windows/client-management/mdm/diagnosticlog-ddf.md @@ -1,14 +1,7 @@ --- title: DiagnosticLog DDF file description: View the XML file containing the device description framework (DDF) for the DiagnosticLog configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 06/02/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 06/28/2024 --- @@ -46,7 +39,7 @@ The following XML file contains the device description framework (DDF) for the D 10.0.10586 1.2 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; diff --git a/windows/client-management/mdm/dmacc-csp.md b/windows/client-management/mdm/dmacc-csp.md index 91624a95d6..271a68b16e 100644 --- a/windows/client-management/mdm/dmacc-csp.md +++ b/windows/client-management/mdm/dmacc-csp.md @@ -1,14 +1,7 @@ --- title: DMAcc CSP description: Learn more about the DMAcc CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 04/10/2024 --- @@ -716,7 +709,7 @@ Specifies the authentication type. If AAuthLevel is CLCRED, the supported types |:--|:--| | Format | `chr` (string) | | Access Type | Add, Get, Replace | -| Dependency [AAuthlevelDependency] | Dependency Type: `DependsOn`
                        Dependency URI: `Vendor/MSFT/DMAcc/[AccountUID]/AppAuth/[ObjectName]/AAuthLevel`
                        Dependency Allowed Value: `SRVCRED`
                        Dependency Allowed Value Type: `ENUM`
                        | +| Dependency [AAuthlevelDependency] | Dependency Type: `DependsOn`
                        Dependency URI: `SyncML/DMAcc/{AccountUID}/AppAuth/{ObjectName}/AAuthLevel`
                        Dependency Allowed Value: `SRVCRED`
                        Dependency Allowed Value Type: `ENUM`
                        | diff --git a/windows/client-management/mdm/dmacc-ddf-file.md b/windows/client-management/mdm/dmacc-ddf-file.md index 8f0a89e31b..15fc5f3231 100644 --- a/windows/client-management/mdm/dmacc-ddf-file.md +++ b/windows/client-management/mdm/dmacc-ddf-file.md @@ -1,14 +1,7 @@ --- title: DMAcc DDF file description: View the XML file containing the device description framework (DDF) for the DMAcc configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 06/02/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 06/28/2024 --- @@ -47,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the D 10.0.10586 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; @@ -534,7 +527,7 @@ The following XML file contains the device description framework (DDF) for the D - Vendor/MSFT/DMAcc/[AccountUID]/AppAuth/[ObjectName]/AAuthLevel + SyncML/DMAcc/{AccountUID}/AppAuth/{ObjectName}/AAuthLevel SRVCRED diff --git a/windows/client-management/mdm/dmclient-csp.md b/windows/client-management/mdm/dmclient-csp.md index e1447e368b..6011d8d162 100644 --- a/windows/client-management/mdm/dmclient-csp.md +++ b/windows/client-management/mdm/dmclient-csp.md @@ -1,14 +1,7 @@ --- title: DMClient CSP description: Learn more about the DMClient CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 06/28/2024 --- @@ -21,6 +14,9 @@ ms.topic: reference The DMClient configuration service provider (CSP) has more enterprise-specific mobile device management (MDM) configuration settings. These settings identify the device in the enterprise domain, include security mitigation for certificate renewal, and are used for server-triggered enterprise unenrollment. + +> [!NOTE] +> The DMClient CSP nodes are intended to be configured by the MDM server to manage device configuration and security features. Custom URI settings for this CSP are not supported for IT admin management scenarios due to the complexity of the settings. @@ -636,7 +632,7 @@ This node, when it's set, tells the client to set how many minutes the device sh | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 21H2 [10.0.22000.2836] and later
                        ✅ Windows 11, version 22H2 [10.0.22621.3235] and later
                        ✅ Windows Insider Preview | @@ -675,7 +671,7 @@ Parent node for ConfigRefresh nodes. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 21H2 [10.0.22000.2836] and later
                        ✅ Windows 11, version 22H2 [10.0.22621.3235] and later
                        ✅ Windows Insider Preview | @@ -716,7 +712,7 @@ This node determines the number of minutes between refreshes. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 21H2 [10.0.22000.2836] and later
                        ✅ Windows 11, version 22H2 [10.0.22621.3235] and later
                        ✅ Windows Insider Preview | @@ -749,8 +745,8 @@ This node determines whether or not a periodic settings refresh for MDM policies | Value | Description | |:--|:--| -| true | ConfigRefresh is enabled. | -| false (Default) | ConfigRefresh is disabled. | +| true | Enabled. | +| false (Default) | Disabled. | @@ -765,7 +761,7 @@ This node determines whether or not a periodic settings refresh for MDM policies | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 21H2 [10.0.22000.2836] and later
                        ✅ Windows 11, version 22H2 [10.0.22621.3235] and later
                        ✅ Windows Insider Preview | diff --git a/windows/client-management/mdm/dmclient-ddf-file.md b/windows/client-management/mdm/dmclient-ddf-file.md index 8ab416c84b..b82d0fe21b 100644 --- a/windows/client-management/mdm/dmclient-ddf-file.md +++ b/windows/client-management/mdm/dmclient-ddf-file.md @@ -1,14 +1,7 @@ --- title: DMClient DDF file description: View the XML file containing the device description framework (DDF) for the DMClient configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 06/28/2024 --- @@ -47,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the D 10.0.10240 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; @@ -484,7 +477,7 @@ The following XML file contains the device description framework (DDF) for the D 10.0.10240 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; @@ -2965,7 +2958,7 @@ The following XML file contains the device description framework (DDF) for the D - 99.9.99999 + 99.9.99999, 10.0.22621.3235, 10.0.22000.2836 1.6 @@ -2995,11 +2988,11 @@ The following XML file contains the device description framework (DDF) for the D true - ConfigRefresh is enabled. + Enabled false - ConfigRefresh is disabled. + Disabled LastWrite diff --git a/windows/client-management/mdm/dmsessionactions-csp.md b/windows/client-management/mdm/dmsessionactions-csp.md index cb1f8535c4..c34c69e898 100644 --- a/windows/client-management/mdm/dmsessionactions-csp.md +++ b/windows/client-management/mdm/dmsessionactions-csp.md @@ -1,14 +1,7 @@ --- title: DMSessionActions CSP description: Learn how the DMSessionActions configuration service provider (CSP) is used to manage the number of sessions the client skips if the device is in a low-power state. -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 06/26/2017 -ms.reviewer: -manager: aaroncz --- # DMSessionActions CSP diff --git a/windows/client-management/mdm/dmsessionactions-ddf.md b/windows/client-management/mdm/dmsessionactions-ddf.md index 3fd2404a22..07079210a8 100644 --- a/windows/client-management/mdm/dmsessionactions-ddf.md +++ b/windows/client-management/mdm/dmsessionactions-ddf.md @@ -1,14 +1,7 @@ --- title: DMSessionActions DDF file description: Learn about the OMA DM device description framework (DDF) for the DMSessionActions configuration service provider (CSP). -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 12/05/2017 -ms.reviewer: -manager: aaroncz --- # DMSessionActions DDF file diff --git a/windows/client-management/mdm/dynamicmanagement-csp.md b/windows/client-management/mdm/dynamicmanagement-csp.md index d4eb392f33..72019eaa9f 100644 --- a/windows/client-management/mdm/dynamicmanagement-csp.md +++ b/windows/client-management/mdm/dynamicmanagement-csp.md @@ -1,14 +1,7 @@ --- title: DynamicManagement CSP description: Learn how the Dynamic Management configuration service provider (CSP) enables configuration of policies that change how the device is managed. -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 06/26/2017 -ms.reviewer: -manager: aaroncz --- # DynamicManagement CSP @@ -24,7 +17,7 @@ The table below shows the applicability of Windows: |Enterprise|Yes|Yes| |Education|Yes|Yes| -Windows 10 or Windows 11 allows you to manage devices differently depending on location, network, or time.  Added in Windows 10, version 1703, the focus is on the most common areas of concern expressed by organizations. For example, managed devices can have cameras disabled when at a work location, the cellular service can be disabled when outside the country/region to avoid roaming charges, or the wireless network can be disabled when the device isn't within the corporate building or campus. Once configured, these settings will be enforced even if the device can’t reach the management server when the location or network changes. The Dynamic Management CSP enables configuration of policies that change how the device is managed in addition to setting the conditions on which the change occurs. +Windows 10 or Windows 11 allows you to manage devices differently depending on location, network, or time.  Added in Windows 10, version 1703, the focus is on the most common areas of concern expressed by organizations. For example, managed devices can have cameras disabled when at a work location, the cellular service can be disabled when outside the country/region to avoid roaming charges, or the wireless network can be disabled when the device isn't within the corporate building or campus. Once configured, these settings will be enforced even if the device can't reach the management server when the location or network changes. The Dynamic Management CSP enables configuration of policies that change how the device is managed in addition to setting the conditions on which the change occurs. This CSP was added in Windows 10, version 1703. diff --git a/windows/client-management/mdm/dynamicmanagement-ddf.md b/windows/client-management/mdm/dynamicmanagement-ddf.md index a5456ee32d..4114467551 100644 --- a/windows/client-management/mdm/dynamicmanagement-ddf.md +++ b/windows/client-management/mdm/dynamicmanagement-ddf.md @@ -1,13 +1,6 @@ --- title: DynamicManagement DDF file description: Learn about the OMA DM device description framework (DDF) for the DynamicManagement configuration service provider (CSP). -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 12/05/2017 --- diff --git a/windows/client-management/mdm/eap-configuration.md b/windows/client-management/mdm/eap-configuration.md index 926d63ac80..cb42cb7572 100644 --- a/windows/client-management/mdm/eap-configuration.md +++ b/windows/client-management/mdm/eap-configuration.md @@ -1,13 +1,6 @@ --- title: EAP configuration description: Learn how to create an Extensible Authentication Protocol (EAP) configuration XML for a VPN profile, including details about EAP certificate filtering in Windows 10. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/email2-csp.md b/windows/client-management/mdm/email2-csp.md index c2b25eca83..cb09b51a30 100644 --- a/windows/client-management/mdm/email2-csp.md +++ b/windows/client-management/mdm/email2-csp.md @@ -1,14 +1,7 @@ --- title: EMAIL2 CSP description: Learn more about the EMAIL2 CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/email2-ddf-file.md b/windows/client-management/mdm/email2-ddf-file.md index fd201ec09e..144f69b17d 100644 --- a/windows/client-management/mdm/email2-ddf-file.md +++ b/windows/client-management/mdm/email2-ddf-file.md @@ -1,14 +1,7 @@ --- title: EMAIL2 DDF file description: View the XML file containing the device description framework (DDF) for the EMAIL2 configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 06/02/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 06/28/2024 --- @@ -47,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the E 10.0.10240 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; diff --git a/windows/client-management/mdm/enrollmentstatustracking-csp-ddf.md b/windows/client-management/mdm/enrollmentstatustracking-csp-ddf.md index 35513a778a..cb401d29af 100644 --- a/windows/client-management/mdm/enrollmentstatustracking-csp-ddf.md +++ b/windows/client-management/mdm/enrollmentstatustracking-csp-ddf.md @@ -1,11 +1,6 @@ --- title: EnrollmentStatusTracking DDF description: View the OMA DM DDF for the EnrollmentStatusTracking configuration service provider. DDF files are used only with OMA DM provisioning XML. -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 05/17/2019 --- diff --git a/windows/client-management/mdm/enrollmentstatustracking-csp.md b/windows/client-management/mdm/enrollmentstatustracking-csp.md index d3c9c60797..94d3e0c6ef 100644 --- a/windows/client-management/mdm/enrollmentstatustracking-csp.md +++ b/windows/client-management/mdm/enrollmentstatustracking-csp.md @@ -1,11 +1,6 @@ --- title: EnrollmentStatusTracking CSP description: Learn how to execute a hybrid certificate trust deployment of Windows Hello for Business, for systems with no previous installations. -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 05/21/2019 --- diff --git a/windows/client-management/mdm/enterpriseapn-csp.md b/windows/client-management/mdm/enterpriseapn-csp.md index 2c93f02a94..0b89ef1f01 100644 --- a/windows/client-management/mdm/enterpriseapn-csp.md +++ b/windows/client-management/mdm/enterpriseapn-csp.md @@ -1,13 +1,6 @@ --- title: EnterpriseAPN CSP description: The EnterpriseAPN configuration service provider is used by the enterprise to provision an APN for the Internet. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 09/22/2017 --- diff --git a/windows/client-management/mdm/enterpriseapn-ddf.md b/windows/client-management/mdm/enterpriseapn-ddf.md index 665a9234c3..5b6c2efba6 100644 --- a/windows/client-management/mdm/enterpriseapn-ddf.md +++ b/windows/client-management/mdm/enterpriseapn-ddf.md @@ -1,13 +1,6 @@ --- title: EnterpriseAPN DDF description: Learn about the OMA DM device description framework (DDF) for the EnterpriseAPN configuration service provider (CSP). -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 12/05/2017 --- diff --git a/windows/client-management/mdm/enterpriseappvmanagement-csp.md b/windows/client-management/mdm/enterpriseappvmanagement-csp.md index c6ad92193c..0a895f7562 100644 --- a/windows/client-management/mdm/enterpriseappvmanagement-csp.md +++ b/windows/client-management/mdm/enterpriseappvmanagement-csp.md @@ -1,14 +1,7 @@ --- title: EnterpriseAppVManagement CSP description: Examine the tree format for EnterpriseAppVManagement CSP to manage virtual applications in Windows 10 or Windows 11 PCs. (Enterprise and Education editions). -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 06/26/2017 -ms.reviewer: -manager: aaroncz --- # EnterpriseAppVManagement CSP diff --git a/windows/client-management/mdm/enterpriseappvmanagement-ddf.md b/windows/client-management/mdm/enterpriseappvmanagement-ddf.md index fa2e075e71..f9e425652e 100644 --- a/windows/client-management/mdm/enterpriseappvmanagement-ddf.md +++ b/windows/client-management/mdm/enterpriseappvmanagement-ddf.md @@ -1,14 +1,7 @@ --- title: EnterpriseAppVManagement DDF file description: Learn about the OMA DM device description framework (DDF) for the EnterpriseAppVManagement configuration service provider (CSP). -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 12/05/2017 -ms.reviewer: -manager: aaroncz --- # EnterpriseAppVManagement DDF file diff --git a/windows/client-management/mdm/enterprisedataprotection-csp.md b/windows/client-management/mdm/enterprisedataprotection-csp.md index a6c2a4662b..0b411fed30 100644 --- a/windows/client-management/mdm/enterprisedataprotection-csp.md +++ b/windows/client-management/mdm/enterprisedataprotection-csp.md @@ -2,13 +2,6 @@ title: EnterpriseDataProtection CSP description: Learn how the EnterpriseDataProtection configuration service provider (CSP) configures Windows Information Protection (formerly, Enterprise Data Protection) settings. ms.assetid: E2D4467F-A154-4C00-9208-7798EF3E25B3 -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 08/09/2017 --- diff --git a/windows/client-management/mdm/enterprisedataprotection-ddf-file.md b/windows/client-management/mdm/enterprisedataprotection-ddf-file.md index 73469ecfa7..5700376c37 100644 --- a/windows/client-management/mdm/enterprisedataprotection-ddf-file.md +++ b/windows/client-management/mdm/enterprisedataprotection-ddf-file.md @@ -1,13 +1,6 @@ --- title: EnterpriseDataProtection DDF file description: The following topic shows the OMA DM device description framework (DDF) for the EnterpriseDataProtection configuration service provider. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 12/05/2017 --- diff --git a/windows/client-management/mdm/enterprisedesktopappmanagement-csp.md b/windows/client-management/mdm/enterprisedesktopappmanagement-csp.md index 02e11e7496..e0331f74f7 100644 --- a/windows/client-management/mdm/enterprisedesktopappmanagement-csp.md +++ b/windows/client-management/mdm/enterprisedesktopappmanagement-csp.md @@ -1,14 +1,7 @@ --- title: EnterpriseDesktopAppManagement CSP description: Learn more about the EnterpriseDesktopAppManagement CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 05/20/2024 --- @@ -179,7 +172,7 @@ For more information, see [DownloadInstall XSD Schema](#downloadinstall-xsd-sche | Property name | Property value | |:--|:--| | Format | `xml` | -| Access Type | Add, Delete, Exec, Get | +| Access Type | Add, Delete, Exec, Get, Replace | @@ -702,7 +695,7 @@ For more information, see [DownloadInstall XSD Schema](#downloadinstall-xsd-sche | Property name | Property value | |:--|:--| | Format | `xml` | -| Access Type | Add, Delete, Exec, Get | +| Access Type | Add, Delete, Exec, Get, Replace | diff --git a/windows/client-management/mdm/enterprisedesktopappmanagement-ddf-file.md b/windows/client-management/mdm/enterprisedesktopappmanagement-ddf-file.md index b20f68bf7f..ba537d72e7 100644 --- a/windows/client-management/mdm/enterprisedesktopappmanagement-ddf-file.md +++ b/windows/client-management/mdm/enterprisedesktopappmanagement-ddf-file.md @@ -1,14 +1,7 @@ --- title: EnterpriseDesktopAppManagement DDF file description: View the XML file containing the device description framework (DDF) for the EnterpriseDesktopAppManagement configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 06/02/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 06/28/2024 --- @@ -47,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the E 10.0.10586 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; @@ -232,6 +225,7 @@ The following XML file contains the device description framework (DDF) for the E + was added to the section of the XML. The default value is 0 (do not send token). This tag is optional and needs to be set to 1 in case the server wants the download URL to get the AADUserToken.]]> @@ -407,7 +401,7 @@ The following XML file contains the device description framework (DDF) for the E 10.0.10586 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; @@ -592,6 +586,7 @@ The following XML file contains the device description framework (DDF) for the E + was added to the section of the XML. The default value is 0 (do not send token). This tag is optional and needs to be set to 1 in case the server wants the download URL to get the AADUserToken.]]> diff --git a/windows/client-management/mdm/enterprisemodernappmanagement-csp.md b/windows/client-management/mdm/enterprisemodernappmanagement-csp.md index 4d1e964bfc..831a924dde 100644 --- a/windows/client-management/mdm/enterprisemodernappmanagement-csp.md +++ b/windows/client-management/mdm/enterprisemodernappmanagement-csp.md @@ -1,14 +1,7 @@ --- title: EnterpriseModernAppManagement CSP description: Learn more about the EnterpriseModernAppManagement CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 04/10/2024 --- @@ -4609,7 +4602,7 @@ Specifies HoursBetweenUpdateChecks for a specific package. | Property name | Property value | |:--|:--| -| Format | `bool` | +| Format | `int` | | Access Type | Get, Replace | | Allowed Values | Range: `[8-10000]` | | Default Value | 8 | diff --git a/windows/client-management/mdm/enterprisemodernappmanagement-ddf.md b/windows/client-management/mdm/enterprisemodernappmanagement-ddf.md index 9067ae0893..e3199dc618 100644 --- a/windows/client-management/mdm/enterprisemodernappmanagement-ddf.md +++ b/windows/client-management/mdm/enterprisemodernappmanagement-ddf.md @@ -1,14 +1,7 @@ --- title: EnterpriseModernAppManagement DDF file description: View the XML file containing the device description framework (DDF) for the EnterpriseModernAppManagement configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 06/02/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 06/28/2024 --- @@ -46,7 +39,7 @@ The following XML file contains the device description framework (DDF) for the E 10.0.10586 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; @@ -2594,7 +2587,7 @@ The following XML file contains the device description framework (DDF) for the E 10.0.10586 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; @@ -4557,7 +4550,7 @@ The following XML file contains the device description framework (DDF) for the E 8 Specifies HoursBetweenUpdateChecks for a specific package - + diff --git a/windows/client-management/mdm/euiccs-csp.md b/windows/client-management/mdm/euiccs-csp.md index 3933d2fb17..a4af4d0697 100644 --- a/windows/client-management/mdm/euiccs-csp.md +++ b/windows/client-management/mdm/euiccs-csp.md @@ -1,14 +1,7 @@ --- title: eUICCs CSP description: Learn more about the eUICCs CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/29/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/euiccs-ddf-file.md b/windows/client-management/mdm/euiccs-ddf-file.md index 5a070577f7..6a148a8d22 100644 --- a/windows/client-management/mdm/euiccs-ddf-file.md +++ b/windows/client-management/mdm/euiccs-ddf-file.md @@ -1,14 +1,7 @@ --- title: eUICCs DDF file description: View the XML file containing the device description framework (DDF) for the eUICCs configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/29/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 06/28/2024 --- @@ -50,7 +43,7 @@ The following XML file contains the device description framework (DDF) for the e 10.0.16299 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; diff --git a/windows/client-management/mdm/firewall-csp.md b/windows/client-management/mdm/firewall-csp.md index 9fb784e982..549c2cbc81 100644 --- a/windows/client-management/mdm/firewall-csp.md +++ b/windows/client-management/mdm/firewall-csp.md @@ -1,14 +1,7 @@ --- title: Firewall CSP description: Learn more about the Firewall CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 06/21/2024 --- @@ -16,8 +9,6 @@ ms.topic: reference # Firewall CSP -[!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)] - The Firewall configuration service provider (CSP) allows the mobile device management (MDM) server to configure the Windows Defender Firewall global settings, per profile settings, and the desired set of custom rules to be enforced on the device. Using the Firewall CSP the IT admin can now manage non-domain devices, and reduce the risk of network security threats across all systems connecting to the corporate network. @@ -3472,7 +3463,7 @@ This value represents the order of rule enforcement. A lower priority rule is ev | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621.2352] and later
                        ✅ Windows Insider Preview [10.0.25398] | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.25398] and later
                        ✅ Windows 11, version 22H2 [10.0.22621.2352] and later | @@ -3812,7 +3803,7 @@ VM Creator ID that these settings apply to. Valid format is a GUID. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621.2352] and later
                        ✅ Windows Insider Preview [10.0.25398] | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.25398] and later
                        ✅ Windows 11, version 22H2 [10.0.22621.2352] and later | @@ -3961,7 +3952,7 @@ This value is the action that the Hyper-V Firewall does by default (and evaluate | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621.2352] and later
                        ✅ Windows Insider Preview [10.0.25398] | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.25398] and later
                        ✅ Windows 11, version 22H2 [10.0.22621.2352] and later | @@ -3999,7 +3990,7 @@ This value is the action that the Hyper-V Firewall does by default (and evaluate | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621.2352] and later
                        ✅ Windows Insider Preview [10.0.25398] | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.25398] and later
                        ✅ Windows 11, version 22H2 [10.0.22621.2352] and later | @@ -4049,7 +4040,7 @@ This value is used as an on/off switch. If this value is false, Hyper-V Firewall | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621.2352] and later
                        ✅ Windows Insider Preview [10.0.25398] | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.25398] and later
                        ✅ Windows 11, version 22H2 [10.0.22621.2352] and later | @@ -4099,7 +4090,7 @@ This value is the action that the Hyper-V Firewall does by default (and evaluate | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621.2352] and later
                        ✅ Windows Insider Preview [10.0.25398] | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.25398] and later
                        ✅ Windows 11, version 22H2 [10.0.22621.2352] and later | @@ -4149,7 +4140,7 @@ This value is the action that the Hyper-V Firewall does by default (and evaluate | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621.2352] and later
                        ✅ Windows Insider Preview [10.0.25398] | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.25398] and later
                        ✅ Windows 11, version 22H2 [10.0.22621.2352] and later | @@ -4296,7 +4287,7 @@ This value is an on/off switch for loopback traffic. This determines if this VM | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621.2352] and later
                        ✅ Windows Insider Preview [10.0.25398] | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.25398] and later
                        ✅ Windows 11, version 22H2 [10.0.22621.2352] and later | @@ -4334,7 +4325,7 @@ This value is an on/off switch for loopback traffic. This determines if this VM | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621.2352] and later
                        ✅ Windows Insider Preview [10.0.25398] | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.25398] and later
                        ✅ Windows 11, version 22H2 [10.0.22621.2352] and later | @@ -4384,7 +4375,7 @@ This value is used as an on/off switch. If this value is false, Hyper-V Firewall | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621.2352] and later
                        ✅ Windows Insider Preview [10.0.25398] | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.25398] and later
                        ✅ Windows 11, version 22H2 [10.0.22621.2352] and later | @@ -4434,7 +4425,7 @@ This value is the action that the Hyper-V Firewall does by default (and evaluate | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621.2352] and later
                        ✅ Windows Insider Preview [10.0.25398] | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.25398] and later
                        ✅ Windows 11, version 22H2 [10.0.22621.2352] and later | @@ -4484,7 +4475,7 @@ This value is the action that the Hyper-V Firewall does by default (and evaluate | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621.2352] and later
                        ✅ Windows Insider Preview [10.0.25398] | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.25398] and later
                        ✅ Windows 11, version 22H2 [10.0.22621.2352] and later | @@ -4533,7 +4524,7 @@ This value is an on/off switch for the Hyper-V Firewall enforcement. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621.2352] and later
                        ✅ Windows Insider Preview [10.0.25398] | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.25398] and later
                        ✅ Windows 11, version 22H2 [10.0.22621.2352] and later | @@ -4571,7 +4562,7 @@ This value is an on/off switch for the Hyper-V Firewall enforcement. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621.2352] and later
                        ✅ Windows Insider Preview [10.0.25398] | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.25398] and later
                        ✅ Windows 11, version 22H2 [10.0.22621.2352] and later | @@ -4621,7 +4612,7 @@ This value is used as an on/off switch. If this value is false, Hyper-V Firewall | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621.2352] and later
                        ✅ Windows Insider Preview [10.0.25398] | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.25398] and later
                        ✅ Windows 11, version 22H2 [10.0.22621.2352] and later | @@ -4671,7 +4662,7 @@ This value is the action that the Hyper-V Firewall does by default (and evaluate | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621.2352] and later
                        ✅ Windows Insider Preview [10.0.25398] | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.25398] and later
                        ✅ Windows 11, version 22H2 [10.0.22621.2352] and later | @@ -4721,7 +4712,7 @@ This value is the action that the Hyper-V Firewall does by default (and evaluate | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621.2352] and later
                        ✅ Windows Insider Preview [10.0.25398] | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.25398] and later
                        ✅ Windows 11, version 22H2 [10.0.22621.2352] and later | diff --git a/windows/client-management/mdm/firewall-ddf-file.md b/windows/client-management/mdm/firewall-ddf-file.md index 1d38c29221..e48568b2b5 100644 --- a/windows/client-management/mdm/firewall-ddf-file.md +++ b/windows/client-management/mdm/firewall-ddf-file.md @@ -1,14 +1,7 @@ --- title: Firewall DDF file description: View the XML file containing the device description framework (DDF) for the Firewall configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 10/03/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 06/28/2024 --- @@ -47,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the F 10.0.16299 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; @@ -4344,6 +4337,7 @@ This is a string in Security Descriptor Definition Language (SDDL) format.. + diff --git a/windows/client-management/mdm/healthattestation-csp.md b/windows/client-management/mdm/healthattestation-csp.md index befe9471cc..4367d3cb2f 100644 --- a/windows/client-management/mdm/healthattestation-csp.md +++ b/windows/client-management/mdm/healthattestation-csp.md @@ -1,14 +1,7 @@ --- title: HealthAttestation CSP description: Learn more about the HealthAttestation CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/31/2024 --- @@ -16,6 +9,8 @@ ms.topic: reference # HealthAttestation CSP +[!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)] + The Device HealthAttestation configuration service provider (DHA-CSP) enables enterprise IT administrators to assess if a device is booted to a trusted and compliant state, and to take enterprise policy actions. @@ -32,6 +27,7 @@ The following list is a description of the functions performed by the Device Hea The following list shows the HealthAttestation configuration service provider nodes: - ./Vendor/MSFT/HealthAttestation + - [AttestErrorMessage](#attesterrormessage) - [AttestStatus](#atteststatus) - [Certificate](#certificate) - [CorrelationID](#correlationid) @@ -49,6 +45,45 @@ The following list shows the HealthAttestation configuration service provider no - [VerifyHealth](#verifyhealth) + +## AttestErrorMessage + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Vendor/MSFT/HealthAttestation/AttestErrorMessage +``` + + + + +AttestErrorMessage maintains the error message for the last attestation session, if returned by the attestation service. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `chr` (string) | +| Access Type | Get | + + + + + + + + ## AttestStatus diff --git a/windows/client-management/mdm/healthattestation-ddf.md b/windows/client-management/mdm/healthattestation-ddf.md index 7207f7cd68..0c9d382872 100644 --- a/windows/client-management/mdm/healthattestation-ddf.md +++ b/windows/client-management/mdm/healthattestation-ddf.md @@ -1,14 +1,7 @@ --- title: HealthAttestation DDF file description: View the XML file containing the device description framework (DDF) for the HealthAttestation configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 06/02/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 06/28/2024 --- @@ -47,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the H 10.0.10586 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; @@ -423,6 +416,31 @@ The following XML file contains the device description framework (DDF) for the H + + AttestErrorMessage + + + + + AttestErrorMessage maintains the error message for the last attestation session, if returned by the attestation service. + + + + + + + + + + + + + + 99.9.99999 + 1.4 + + +
                        ``` diff --git a/windows/client-management/mdm/images/insider.png b/windows/client-management/mdm/images/insider.png new file mode 100644 index 0000000000..dbe00408cb Binary files /dev/null and b/windows/client-management/mdm/images/insider.png differ diff --git a/windows/client-management/mdm/includes/mdm-admx-csp-note.md b/windows/client-management/mdm/includes/mdm-admx-csp-note.md index 68b132c9a5..f6b4842c2a 100644 --- a/windows/client-management/mdm/includes/mdm-admx-csp-note.md +++ b/windows/client-management/mdm/includes/mdm-admx-csp-note.md @@ -1,7 +1,7 @@ --- author: vinaypamnani-msft ms.author: vinpa -ms.prod: windows +ms.service: windows-client ms.topic: include ms.date: 05/09/2023 --- diff --git a/windows/client-management/mdm/includes/mdm-admx-policy-note.md b/windows/client-management/mdm/includes/mdm-admx-policy-note.md index 24b506bf4b..dd4c2dcbdb 100644 --- a/windows/client-management/mdm/includes/mdm-admx-policy-note.md +++ b/windows/client-management/mdm/includes/mdm-admx-policy-note.md @@ -1,7 +1,7 @@ --- author: vinaypamnani-msft ms.author: vinpa -ms.prod: windows +ms.service: windows-client ms.topic: include ms.date: 05/09/2023 --- diff --git a/windows/client-management/mdm/includes/mdm-insider-csp-note.md b/windows/client-management/mdm/includes/mdm-insider-csp-note.md index bc1fc814b6..53aca4ba98 100644 --- a/windows/client-management/mdm/includes/mdm-insider-csp-note.md +++ b/windows/client-management/mdm/includes/mdm-insider-csp-note.md @@ -1,10 +1,17 @@ --- author: vinaypamnani-msft ms.author: vinpa -ms.prod: windows +ms.service: windows-client ms.topic: include ms.date: 05/09/2023 --- +:::row::: +:::column span="1"::: +:::image type="content" source="../images/insider.png" alt-text="Logo of Windows Insider." border="false"::: +:::column-end::: +:::column span="3"::: > [!IMPORTANT] -> This CSP contains some settings that are under development and only applicable for [Windows Insider Preview builds](/windows-insider/). These settings are subject to change and may have dependencies on other features or services in preview. +>This CSP contains some settings that are under development and only applicable for [Windows Insider Preview builds](/windows-insider/). These settings are subject to change and may have dependencies on other features or services in preview. +:::column-end::: +:::row-end::: diff --git a/windows/client-management/mdm/index.yml b/windows/client-management/mdm/index.yml index 7944d29d03..cfa99b1a5f 100644 --- a/windows/client-management/mdm/index.yml +++ b/windows/client-management/mdm/index.yml @@ -7,13 +7,8 @@ metadata: title: Configuration Service Provider # Required; page title displayed in search results. Include the brand. < 60 chars. description: Learn more about the configuration service provider (CSP) policies available on Windows devices. # Required; article description that is displayed in search results. < 160 chars. ms.topic: landing-page - ms.technology: itpro-manage - ms.prod: windows-client ms.collection: - tier1 - author: vinaypamnani-msft - ms.author: vinpa - manager: aaroncz ms.date: 10/25/2023 localization_priority: medium diff --git a/windows/client-management/mdm/language-pack-management-ddf-file.md b/windows/client-management/mdm/language-pack-management-ddf-file.md index 5c5c679379..3739f4f142 100644 --- a/windows/client-management/mdm/language-pack-management-ddf-file.md +++ b/windows/client-management/mdm/language-pack-management-ddf-file.md @@ -1,14 +1,7 @@ --- title: LanguagePackManagement DDF file description: View the XML file containing the device description framework (DDF) for the LanguagePackManagement configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 06/02/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 06/28/2024 --- @@ -49,7 +42,7 @@ The following XML file contains the device description framework (DDF) for the L 99.9.9999 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; diff --git a/windows/client-management/mdm/laps-csp.md b/windows/client-management/mdm/laps-csp.md index a010675895..0e5e7d5b2d 100644 --- a/windows/client-management/mdm/laps-csp.md +++ b/windows/client-management/mdm/laps-csp.md @@ -1,14 +1,7 @@ --- title: LAPS CSP description: Learn more about the LAPS CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 10/24/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 06/21/2024 --- @@ -41,7 +34,13 @@ The following list shows the LAPS configuration service provider nodes: - [AdministratorAccountName](#policiesadministratoraccountname) - [ADPasswordEncryptionEnabled](#policiesadpasswordencryptionenabled) - [ADPasswordEncryptionPrincipal](#policiesadpasswordencryptionprincipal) + - [AutomaticAccountManagementEnableAccount](#policiesautomaticaccountmanagementenableaccount) + - [AutomaticAccountManagementEnabled](#policiesautomaticaccountmanagementenabled) + - [AutomaticAccountManagementNameOrPrefix](#policiesautomaticaccountmanagementnameorprefix) + - [AutomaticAccountManagementRandomizeName](#policiesautomaticaccountmanagementrandomizename) + - [AutomaticAccountManagementTarget](#policiesautomaticaccountmanagementtarget) - [BackupDirectory](#policiesbackupdirectory) + - [PassphraseLength](#policiespassphraselength) - [PasswordAgeDays](#policiespasswordagedays) - [PasswordComplexity](#policiespasswordcomplexity) - [PasswordExpirationProtectionEnabled](#policiespasswordexpirationprotectionenabled) @@ -56,7 +55,7 @@ The following list shows the LAPS configuration service provider nodes: | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.1663] and later
                        ✅ Windows 10, version 1809 [10.0.17763.4244] and later
                        ✅ Windows 10, version 2004 [10.0.19041.2784] and later
                        ✅ Windows 11, version 21H2 [10.0.22000.1754] and later
                        ✅ Windows 11, version 22H2 [10.0.22621.1480] and later
                        ✅ Windows Insider Preview [10.0.25145] | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.1663] and later
                        ✅ [10.0.25145] and later
                        ✅ Windows 10, version 1809 [10.0.17763.4244] and later
                        ✅ Windows 10, version 2004 [10.0.19041.2784] and later
                        ✅ Windows 11, version 21H2 [10.0.22000.1754] and later
                        ✅ Windows 11, version 22H2 [10.0.22621.1480] and later | @@ -95,7 +94,7 @@ Defines the parent interior node for all action-related settings in the LAPS CSP | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.1663] and later
                        ✅ Windows 10, version 1809 [10.0.17763.4244] and later
                        ✅ Windows 10, version 2004 [10.0.19041.2784] and later
                        ✅ Windows 11, version 21H2 [10.0.22000.1754] and later
                        ✅ Windows 11, version 22H2 [10.0.22621.1480] and later
                        ✅ Windows Insider Preview [10.0.25145] | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.1663] and later
                        ✅ [10.0.25145] and later
                        ✅ Windows 10, version 1809 [10.0.17763.4244] and later
                        ✅ Windows 10, version 2004 [10.0.19041.2784] and later
                        ✅ Windows 11, version 21H2 [10.0.22000.1754] and later
                        ✅ Windows 11, version 22H2 [10.0.22621.1480] and later | @@ -135,7 +134,7 @@ This action invokes an immediate reset of the local administrator account passwo | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.1663] and later
                        ✅ Windows 10, version 1809 [10.0.17763.4244] and later
                        ✅ Windows 10, version 2004 [10.0.19041.2784] and later
                        ✅ Windows 11, version 21H2 [10.0.22000.1754] and later
                        ✅ Windows 11, version 22H2 [10.0.22621.1480] and later
                        ✅ Windows Insider Preview [10.0.25145] | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.1663] and later
                        ✅ [10.0.25145] and later
                        ✅ Windows 10, version 1809 [10.0.17763.4244] and later
                        ✅ Windows 10, version 2004 [10.0.19041.2784] and later
                        ✅ Windows 11, version 21H2 [10.0.22000.1754] and later
                        ✅ Windows 11, version 22H2 [10.0.22621.1480] and later | @@ -180,7 +179,7 @@ The value returned is an HRESULT code: | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.1663] and later
                        ✅ Windows 10, version 1809 [10.0.17763.4244] and later
                        ✅ Windows 10, version 2004 [10.0.19041.2784] and later
                        ✅ Windows 11, version 21H2 [10.0.22000.1754] and later
                        ✅ Windows 11, version 22H2 [10.0.22621.1480] and later
                        ✅ Windows Insider Preview [10.0.25145] | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.1663] and later
                        ✅ [10.0.25145] and later
                        ✅ Windows 10, version 1809 [10.0.17763.4244] and later
                        ✅ Windows 10, version 2004 [10.0.19041.2784] and later
                        ✅ Windows 11, version 21H2 [10.0.22000.1754] and later
                        ✅ Windows 11, version 22H2 [10.0.22621.1480] and later | @@ -220,7 +219,7 @@ Root node for LAPS policies. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.1663] and later
                        ✅ Windows 10, version 1809 [10.0.17763.4244] and later
                        ✅ Windows 10, version 2004 [10.0.19041.2784] and later
                        ✅ Windows 11, version 21H2 [10.0.22000.1754] and later
                        ✅ Windows 11, version 22H2 [10.0.22621.1480] and later
                        ✅ Windows Insider Preview [10.0.25145] | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.1663] and later
                        ✅ [10.0.25145] and later
                        ✅ Windows 10, version 1809 [10.0.17763.4244] and later
                        ✅ Windows 10, version 2004 [10.0.19041.2784] and later
                        ✅ Windows 11, version 21H2 [10.0.22000.1754] and later
                        ✅ Windows 11, version 22H2 [10.0.22621.1480] and later | @@ -270,7 +269,7 @@ This setting has a maximum allowed value of 12 passwords. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.1663] and later
                        ✅ Windows 10, version 1809 [10.0.17763.4244] and later
                        ✅ Windows 10, version 2004 [10.0.19041.2784] and later
                        ✅ Windows 11, version 21H2 [10.0.22000.1754] and later
                        ✅ Windows 11, version 22H2 [10.0.22621.1480] and later
                        ✅ Windows Insider Preview [10.0.25145] | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.1663] and later
                        ✅ [10.0.25145] and later
                        ✅ Windows 10, version 1809 [10.0.17763.4244] and later
                        ✅ Windows 10, version 2004 [10.0.19041.2784] and later
                        ✅ Windows 11, version 21H2 [10.0.22000.1754] and later
                        ✅ Windows 11, version 22H2 [10.0.22621.1480] and later | @@ -315,7 +314,7 @@ Note if a custom managed local administrator account name is specified in this s | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.1663] and later
                        ✅ Windows 10, version 1809 [10.0.17763.4244] and later
                        ✅ Windows 10, version 2004 [10.0.19041.2784] and later
                        ✅ Windows 11, version 21H2 [10.0.22000.1754] and later
                        ✅ Windows 11, version 22H2 [10.0.22621.1480] and later
                        ✅ Windows Insider Preview [10.0.25145] | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.1663] and later
                        ✅ [10.0.25145] and later
                        ✅ Windows 10, version 1809 [10.0.17763.4244] and later
                        ✅ Windows 10, version 2004 [10.0.19041.2784] and later
                        ✅ Windows 11, version 21H2 [10.0.22000.1754] and later
                        ✅ Windows 11, version 22H2 [10.0.22621.1480] and later | @@ -377,7 +376,7 @@ If not specified, this setting defaults to True. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.1663] and later
                        ✅ Windows 10, version 1809 [10.0.17763.4244] and later
                        ✅ Windows 10, version 2004 [10.0.19041.2784] and later
                        ✅ Windows 11, version 21H2 [10.0.22000.1754] and later
                        ✅ Windows 11, version 22H2 [10.0.22621.1480] and later
                        ✅ Windows Insider Preview [10.0.25145] | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.1663] and later
                        ✅ [10.0.25145] and later
                        ✅ Windows 10, version 1809 [10.0.17763.4244] and later
                        ✅ Windows 10, version 2004 [10.0.19041.2784] and later
                        ✅ Windows 11, version 21H2 [10.0.22000.1754] and later
                        ✅ Windows 11, version 22H2 [10.0.22621.1480] and later | @@ -427,13 +426,282 @@ If the specified user or group account is invalid the device will fallback to us + +### Policies/AutomaticAccountManagementEnableAccount + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/LAPS/Policies/AutomaticAccountManagementEnableAccount +``` + + + + +Use this setting to configure whether the automatically managed account is enabled or disabled. + +- If this setting is enabled, the target account will be enabled. + +- If this setting is disabled, the target account will be disabled. + +If not specified, this setting defaults to False. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `bool` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | False | +| Dependency [AutomaticAccountManagementEnabled] | Dependency Type: `DependsOn`
                        Dependency URI: `Vendor/MSFT/LAPS/Policies/AutomaticAccountManagementEnabled`
                        Dependency Allowed Value: `true`
                        Dependency Allowed Value Type: `ENUM`
                        | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| False (Default) | The target account will be disabled. | +| True | The target account will be enabled. | + + + + + + + + + +### Policies/AutomaticAccountManagementEnabled + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/LAPS/Policies/AutomaticAccountManagementEnabled +``` + + + + +Use this setting to specify whether automatic account management is enabled. + +- If this setting is enabled, the target account will be automatically managed. + +- If this setting is disabled, the target account won't be automatically managed. + +If not specified, this setting defaults to False. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `bool` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | False | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| false (Default) | The target account won't be automatically managed. | +| true | The target account will be automatically managed. | + + + + + + + + + +### Policies/AutomaticAccountManagementNameOrPrefix + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/LAPS/Policies/AutomaticAccountManagementNameOrPrefix +``` + + + + +Use this setting to configure the name or prefix of the managed local administrator account. + +If specified, the value will be used as the name or name prefix of the managed account. + +If not specified, this setting will default to "WLapsAdmin". + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `chr` (string) | +| Access Type | Add, Delete, Get, Replace | +| Dependency [AutomaticAccountManagementEnabled] | Dependency Type: `DependsOn`
                        Dependency URI: `Vendor/MSFT/LAPS/Policies/AutomaticAccountManagementEnabled`
                        Dependency Allowed Value: `true`
                        Dependency Allowed Value Type: `ENUM`
                        | + + + + + + + + + +### Policies/AutomaticAccountManagementRandomizeName + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/LAPS/Policies/AutomaticAccountManagementRandomizeName +``` + + + + +Use this setting to configure whether the name of the automatically managed account uses a random numeric suffix each time the password is rotated. + +If this setting is enabled, the name of the target account will use a random numeric suffix. + +If this setting is disbled, the name of the target account won't use a random numeric suffix. + +If not specified, this setting defaults to False. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `bool` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | False | +| Dependency [AutomaticAccountManagementEnabled] | Dependency Type: `DependsOn`
                        Dependency URI: `Vendor/MSFT/LAPS/Policies/AutomaticAccountManagementEnabled`
                        Dependency Allowed Value: `true`
                        Dependency Allowed Value Type: `ENUM`
                        | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| False (Default) | The name of the target account won't use a random numeric suffix. | +| True | The name of the target account will use a random numeric suffix. | + + + + + + + + + +### Policies/AutomaticAccountManagementTarget + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/LAPS/Policies/AutomaticAccountManagementTarget +``` + + + + +Use this setting to configure which account is automatically managed. + +The allowable settings are: + +0=The builtin administrator account will be managed. + +1=A new account created by Windows LAPS will be managed. + +If not specified, this setting will default to 1. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 1 | +| Dependency [AutomaticAccountManagementEnabled] | Dependency Type: `DependsOn`
                        Dependency URI: `Vendor/MSFT/LAPS/Policies/AutomaticAccountManagementEnabled`
                        Dependency Allowed Value: `true`
                        Dependency Allowed Value Type: `ENUM`
                        | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | Manage the built-in administrator account. | +| 1 (Default) | Manage a new custom administrator account. | + + + + + + + + ### Policies/BackupDirectory | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.1663] and later
                        ✅ Windows 10, version 1809 [10.0.17763.4244] and later
                        ✅ Windows 10, version 2004 [10.0.19041.2784] and later
                        ✅ Windows 11, version 21H2 [10.0.22000.1754] and later
                        ✅ Windows 11, version 22H2 [10.0.22621.1480] and later
                        ✅ Windows Insider Preview [10.0.25145] | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.1663] and later
                        ✅ [10.0.25145] and later
                        ✅ Windows 10, version 1809 [10.0.17763.4244] and later
                        ✅ Windows 10, version 2004 [10.0.19041.2784] and later
                        ✅ Windows 11, version 21H2 [10.0.22000.1754] and later
                        ✅ Windows 11, version 22H2 [10.0.22621.1480] and later | @@ -485,13 +753,61 @@ If not specified, this setting will default to 0. + +### Policies/PassphraseLength + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/LAPS/Policies/PassphraseLength +``` + + + + +Use this setting to configure the number of passphrase words. + +If not specified, this setting will default to 6 words. + +This setting has a minimum allowed value of 3 words. + +This setting has a maximum allowed value of 10 words. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | Range: `[3-10]` | +| Default Value | 6 | +| Dependency [PasswordComplexity] | Dependency Type: `DependsOn`
                        Dependency URI: `Vendor/MSFT/LAPS/Policies/PasswordComplexity`
                        Dependency Allowed Value: `[6-8]`
                        Dependency Allowed Value Type: `Range`
                        | + + + + + + + + ### Policies/PasswordAgeDays | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.1663] and later
                        ✅ Windows 10, version 1809 [10.0.17763.4244] and later
                        ✅ Windows 10, version 2004 [10.0.19041.2784] and later
                        ✅ Windows 11, version 21H2 [10.0.22000.1754] and later
                        ✅ Windows 11, version 22H2 [10.0.22621.1480] and later
                        ✅ Windows Insider Preview [10.0.25145] | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.1663] and later
                        ✅ [10.0.25145] and later
                        ✅ Windows 10, version 1809 [10.0.17763.4244] and later
                        ✅ Windows 10, version 2004 [10.0.19041.2784] and later
                        ✅ Windows 11, version 21H2 [10.0.22000.1754] and later
                        ✅ Windows 11, version 22H2 [10.0.22621.1480] and later | @@ -539,7 +855,7 @@ This setting has a maximum allowed value of 365 days. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.1663] and later
                        ✅ Windows 10, version 1809 [10.0.17763.4244] and later
                        ✅ Windows 10, version 2004 [10.0.19041.2784] and later
                        ✅ Windows 11, version 21H2 [10.0.22000.1754] and later
                        ✅ Windows 11, version 22H2 [10.0.22621.1480] and later
                        ✅ Windows Insider Preview [10.0.25145] | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.1663] and later
                        ✅ [10.0.25145] and later
                        ✅ Windows 10, version 1809 [10.0.17763.4244] and later
                        ✅ Windows 10, version 2004 [10.0.19041.2784] and later
                        ✅ Windows 11, version 21H2 [10.0.22000.1754] and later
                        ✅ Windows 11, version 22H2 [10.0.22621.1480] and later | @@ -557,9 +873,15 @@ The allowable settings are: 1=Large letters 2=Large letters + small letters 3=Large letters + small letters + numbers -4=Large letters + small letters + numbers + special characters. +4=Large letters + small letters + numbers + special characters +5=Large letters + small letters + numbers + special characters (improved readability) +6=Passphrase (long words) +7=Passphrase (short words) +8=Passphrase (short words with unique prefixes) If not specified, this setting will default to 4. + +Passphrase list taken from "Deep Dive: EFF's New Wordlists for Random Passphrases" by Electronic Frontier Foundation, and is used under a CC-BY-3.0 Attribution license. See for more information. @@ -587,6 +909,10 @@ If not specified, this setting will default to 4. | 2 | Large letters + small letters. | | 3 | Large letters + small letters + numbers. | | 4 (Default) | Large letters + small letters + numbers + special characters. | +| 5 | Large letters + small letters + numbers + special characters (improved readability). | +| 6 | Passphrase (long words). | +| 7 | Passphrase (short words). | +| 8 | Passphrase (short words with unique prefixes). | @@ -601,7 +927,7 @@ If not specified, this setting will default to 4. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.1663] and later
                        ✅ Windows 10, version 1809 [10.0.17763.4244] and later
                        ✅ Windows 10, version 2004 [10.0.19041.2784] and later
                        ✅ Windows 11, version 21H2 [10.0.22000.1754] and later
                        ✅ Windows 11, version 22H2 [10.0.22621.1480] and later
                        ✅ Windows Insider Preview [10.0.25145] | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.1663] and later
                        ✅ [10.0.25145] and later
                        ✅ Windows 10, version 1809 [10.0.17763.4244] and later
                        ✅ Windows 10, version 2004 [10.0.19041.2784] and later
                        ✅ Windows 11, version 21H2 [10.0.22000.1754] and later
                        ✅ Windows 11, version 22H2 [10.0.22621.1480] and later | @@ -657,7 +983,7 @@ If not specified, this setting defaults to True. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.1663] and later
                        ✅ Windows 10, version 1809 [10.0.17763.4244] and later
                        ✅ Windows 10, version 2004 [10.0.19041.2784] and later
                        ✅ Windows 11, version 21H2 [10.0.22000.1754] and later
                        ✅ Windows 11, version 22H2 [10.0.22621.1480] and later
                        ✅ Windows Insider Preview [10.0.25145] | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.1663] and later
                        ✅ [10.0.25145] and later
                        ✅ Windows 10, version 1809 [10.0.17763.4244] and later
                        ✅ Windows 10, version 2004 [10.0.19041.2784] and later
                        ✅ Windows 11, version 21H2 [10.0.22000.1754] and later
                        ✅ Windows 11, version 22H2 [10.0.22621.1480] and later | @@ -690,6 +1016,7 @@ This setting has a maximum allowed value of 64 characters. | Access Type | Add, Delete, Get, Replace | | Allowed Values | Range: `[8-64]` | | Default Value | 14 | +| Dependency [PasswordComplexity] | Dependency Type: `DependsOn`
                        Dependency URI: `Vendor/MSFT/LAPS/Policies/PasswordComplexity`
                        Dependency Allowed Value: `[1-5]`
                        Dependency Allowed Value Type: `Range`
                        | @@ -704,7 +1031,7 @@ This setting has a maximum allowed value of 64 characters. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.1663] and later
                        ✅ Windows 10, version 1809 [10.0.17763.4244] and later
                        ✅ Windows 10, version 2004 [10.0.19041.2784] and later
                        ✅ Windows 11, version 21H2 [10.0.22000.1754] and later
                        ✅ Windows 11, version 22H2 [10.0.22621.1480] and later
                        ✅ Windows Insider Preview [10.0.25145] | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.1663] and later
                        ✅ [10.0.25145] and later
                        ✅ Windows 10, version 1809 [10.0.17763.4244] and later
                        ✅ Windows 10, version 2004 [10.0.19041.2784] and later
                        ✅ Windows 11, version 21H2 [10.0.22000.1754] and later
                        ✅ Windows 11, version 22H2 [10.0.22621.1480] and later | @@ -747,6 +1074,7 @@ If not specified, this setting will default to 3 (Reset the password and logoff | 1 | Reset password: upon expiry of the grace period, the managed account password will be reset. | | 3 (Default) | Reset the password and logoff the managed account: upon expiry of the grace period, the managed account password will be reset and any interactive logon sessions using the managed account will be terminated. | | 5 | Reset the password and reboot: upon expiry of the grace period, the managed account password will be reset and the managed device will be immediately rebooted. | +| 11 | Reset the password, logoff the managed account, and terminate any remaining processes: upon expiration of the grace period, the managed account password is reset, any interactive logon sessions using the managed account are logged off, and any remaining processes are terminated. | @@ -761,7 +1089,7 @@ If not specified, this setting will default to 3 (Reset the password and logoff | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.1663] and later
                        ✅ Windows 10, version 1809 [10.0.17763.4244] and later
                        ✅ Windows 10, version 2004 [10.0.19041.2784] and later
                        ✅ Windows 11, version 21H2 [10.0.22000.1754] and later
                        ✅ Windows 11, version 22H2 [10.0.22621.1480] and later
                        ✅ Windows Insider Preview [10.0.25145] | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.1663] and later
                        ✅ [10.0.25145] and later
                        ✅ Windows 10, version 1809 [10.0.17763.4244] and later
                        ✅ Windows 10, version 2004 [10.0.19041.2784] and later
                        ✅ Windows 11, version 21H2 [10.0.22000.1754] and later
                        ✅ Windows 11, version 22H2 [10.0.22621.1480] and later | diff --git a/windows/client-management/mdm/laps-ddf-file.md b/windows/client-management/mdm/laps-ddf-file.md index d9f29bb7d6..5d06e470a6 100644 --- a/windows/client-management/mdm/laps-ddf-file.md +++ b/windows/client-management/mdm/laps-ddf-file.md @@ -1,14 +1,7 @@ --- title: LAPS DDF file description: View the XML file containing the device description framework (DDF) for the LAPS configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 04/07/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 06/28/2024 --- @@ -47,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the L 10.0.25145, 10.0.22621.1480, 10.0.22000.1754, 10.0.20348.1663, 10.0.19041.2784, 10.0.17763.4244 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x87;0x88;0x88*;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; @@ -201,8 +194,14 @@ The allowable settings are: 2=Large letters + small letters 3=Large letters + small letters + numbers 4=Large letters + small letters + numbers + special characters +5=Large letters + small letters + numbers + special characters (improved readability) +6=Passphrase (long words) +7=Passphrase (short words) +8=Passphrase (short words with unique prefixes) -If not specified, this setting will default to 4. +If not specified, this setting will default to 4. + +Passphrase list taken from "Deep Dive: EFF's New Wordlists for Random Passphrases" by Electronic Frontier Foundation, and is used under a CC-BY-3.0 Attribution license. See https://go.microsoft.com/fwlink/?linkid=2255471 for more information. @@ -232,6 +231,22 @@ If not specified, this setting will default to 4. 4 Large letters + small letters + numbers + special characters
                        + + 5 + Large letters + small letters + numbers + special characters (improved readability) + + + 6 + Passphrase (long words) + + + 7 + Passphrase (short words) + + + 8 + Passphrase (short words with unique prefixes) +
                        @@ -267,6 +282,70 @@ This setting has a maximum allowed value of 64 characters. [8-64] + + + + Vendor/MSFT/LAPS/Policies/PasswordComplexity + + + [1-5] + PasswordComplexity configured to generate a password + + + + + + +
                        + + PassphraseLength + + + + + + + + 6 + Use this setting to configure the number of passphrase words. + +If not specified, this setting will default to 6 words + +This setting has a minimum allowed value of 3 words. + +This setting has a maximum allowed value of 10 words. + + + + + + + + + + + + + + 99.9.9999 + 1.1 + + + [3-10] + + + + + Vendor/MSFT/LAPS/Policies/PasswordComplexity + + + [6-8] + PasswordComplexity configured to generate a passphrase + + + + + @@ -574,9 +653,278 @@ If not specified, this setting will default to 3 (Reset the password and logoff 5 Reset the password and reboot: upon expiry of the grace period, the managed account password will be reset and the managed device will be immediately rebooted. + + 11 + Reset the password, logoff the managed account, and terminate any remaining processes: upon expiration of the grace period, the managed account password is reset, any interactive logon sessions using the managed account are logged off, and any remaining processes are terminated. + + + AutomaticAccountManagementEnabled + + + + + + + + False + Use this setting to specify whether automatic account management is enabled. + +If this setting is enabled, the target account will be automatically managed. + +If this setting is disabled, the target account will not be automatically managed. + +If not specified, this setting defaults to False. + + + + + + + + + + + + + + 99.9.9999 + 1.1 + + + + false + The target account will not be automatically managed + + + true + The target account will be automatically managed + + + + + + AutomaticAccountManagementTarget + + + + + + + + 1 + Use this setting to configure which account is automatically managed. + +The allowable settings are: + +0=The builtin administrator account will be managed. +1=A new account created by Windows LAPS will be managed. + +If not specified, this setting will default to 1. + + + + + + + + + + + + + + 99.9.9999 + 1.1 + + + + 0 + Manage the built-in administrator account + + + 1 + Manage a new custom administrator account + + + + + + Vendor/MSFT/LAPS/Policies/AutomaticAccountManagementEnabled + + + true + AutomaticAccountManagementEnabled enabled + + + + + + + + + AutomaticAccountManagementNameOrPrefix + + + + + + + + Use this setting to configure the name or prefix of the managed local administrator account. + +If specified, the value will be used as the name or name prefix of the managed account. + +If not specified, this setting will default to "WLapsAdmin". + + + + + + + + + + + + + + 99.9.9999 + 1.1 + + + + + Vendor/MSFT/LAPS/Policies/AutomaticAccountManagementEnabled + + + true + AutomaticAccountManagementEnabled enabled + + + + + + + + + AutomaticAccountManagementEnableAccount + + + + + + + + False + Use this setting to configure whether the automatically managed account is enabled or disabled. + +If this setting is enabled, the target account will be enabled. + +If this setting is disabled, the target account will be disabled. + +If not specified, this setting defaults to False. + + + + + + + + + + + + + + 99.9.9999 + 1.1 + + + + False + The target account will be disabled + + + True + The target account will be enabled + + + + + + Vendor/MSFT/LAPS/Policies/AutomaticAccountManagementEnabled + + + true + AutomaticAccountManagementEnabled enabled + + + + + + + + + AutomaticAccountManagementRandomizeName + + + + + + + + False + Use this setting to configure whether the name of the automatically managed account uses a random numeric suffix each time the password is rotated. + +If this setting is enabled, the name of the target account will use a random numeric suffix. + +If this setting is disbled, the name of the target account will not use a random numeric suffix.. + +If not specified, this setting defaults to False. + + + + + + + + + + + + + + 99.9.9999 + 1.1 + + + + False + The name of the target account will not use a random numeric suffix. + + + True + The name of the target account will use a random numeric suffix. + + + + + + Vendor/MSFT/LAPS/Policies/AutomaticAccountManagementEnabled + + + true + AutomaticAccountManagementEnabled enabled + + + + + + +
                        Actions diff --git a/windows/client-management/mdm/multisim-csp.md b/windows/client-management/mdm/multisim-csp.md index b225f2f4c3..d7d8d8d642 100644 --- a/windows/client-management/mdm/multisim-csp.md +++ b/windows/client-management/mdm/multisim-csp.md @@ -1,14 +1,7 @@ --- title: MultiSIM CSP description: MultiSIM configuration service provider (CSP) allows the enterprise to manage devices with dual SIM single active configuration. -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 03/22/2018 -ms.reviewer: -manager: aaroncz --- # MultiSIM CSP diff --git a/windows/client-management/mdm/multisim-ddf.md b/windows/client-management/mdm/multisim-ddf.md index 55f8ef2b32..435a597cc4 100644 --- a/windows/client-management/mdm/multisim-ddf.md +++ b/windows/client-management/mdm/multisim-ddf.md @@ -1,14 +1,7 @@ --- title: MultiSIM DDF file description: XML file containing the device description framework for the MultiSIM configuration service provider. -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 02/27/2018 -ms.reviewer: -manager: aaroncz --- # MultiSIM DDF diff --git a/windows/client-management/mdm/nap-csp.md b/windows/client-management/mdm/nap-csp.md index 801f6fc15d..c8a4ac849f 100644 --- a/windows/client-management/mdm/nap-csp.md +++ b/windows/client-management/mdm/nap-csp.md @@ -1,13 +1,6 @@ --- title: NAP CSP description: Learn how the Network Access Point (NAP) configuration service provider (CSP) is used to manage and query GPRS and CDMA connections. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/napdef-csp.md b/windows/client-management/mdm/napdef-csp.md index 4af7ac6717..06d4684e7a 100644 --- a/windows/client-management/mdm/napdef-csp.md +++ b/windows/client-management/mdm/napdef-csp.md @@ -1,13 +1,6 @@ --- title: NAPDEF CSP description: Learn how the NAPDEF configuration service provider (CSP) is used to add, modify, or delete WAP network access points (NAPs). -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/networkproxy-csp.md b/windows/client-management/mdm/networkproxy-csp.md index 57294de0a0..8eba61aa61 100644 --- a/windows/client-management/mdm/networkproxy-csp.md +++ b/windows/client-management/mdm/networkproxy-csp.md @@ -1,14 +1,7 @@ --- title: NetworkProxy CSP description: Learn more about the NetworkProxy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/networkproxy-ddf.md b/windows/client-management/mdm/networkproxy-ddf.md index 72d1c7936d..4448901798 100644 --- a/windows/client-management/mdm/networkproxy-ddf.md +++ b/windows/client-management/mdm/networkproxy-ddf.md @@ -1,14 +1,7 @@ --- title: NetworkProxy DDF file description: View the XML file containing the device description framework (DDF) for the NetworkProxy configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 06/02/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 06/28/2024 --- @@ -47,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the N 10.0.15063 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; diff --git a/windows/client-management/mdm/networkqospolicy-csp.md b/windows/client-management/mdm/networkqospolicy-csp.md index cc5a8c8ada..cc42fe0b09 100644 --- a/windows/client-management/mdm/networkqospolicy-csp.md +++ b/windows/client-management/mdm/networkqospolicy-csp.md @@ -1,14 +1,7 @@ --- title: NetworkQoSPolicy CSP description: Learn more about the NetworkQoSPolicy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/networkqospolicy-ddf.md b/windows/client-management/mdm/networkqospolicy-ddf.md index 170cfe0fae..04b4528ac6 100644 --- a/windows/client-management/mdm/networkqospolicy-ddf.md +++ b/windows/client-management/mdm/networkqospolicy-ddf.md @@ -1,14 +1,7 @@ --- title: NetworkQoSPolicy DDF file description: View the XML file containing the device description framework (DDF) for the NetworkQoSPolicy configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 06/02/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 06/28/2024 --- @@ -47,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the N 10.0.19042 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; diff --git a/windows/client-management/mdm/nodecache-csp.md b/windows/client-management/mdm/nodecache-csp.md index dea68d13f0..53c5f2e391 100644 --- a/windows/client-management/mdm/nodecache-csp.md +++ b/windows/client-management/mdm/nodecache-csp.md @@ -1,14 +1,7 @@ --- title: NodeCache CSP description: Learn more about the NodeCache CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/nodecache-ddf-file.md b/windows/client-management/mdm/nodecache-ddf-file.md index e2d509178e..4d442904e4 100644 --- a/windows/client-management/mdm/nodecache-ddf-file.md +++ b/windows/client-management/mdm/nodecache-ddf-file.md @@ -1,14 +1,7 @@ --- title: NodeCache DDF file description: View the XML file containing the device description framework (DDF) for the NodeCache configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 06/02/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 06/28/2024 --- @@ -47,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the N 10.0.15063 1.1 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; @@ -301,7 +294,7 @@ The following XML file contains the device description framework (DDF) for the N 10.0.10586 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; diff --git a/windows/client-management/mdm/office-csp.md b/windows/client-management/mdm/office-csp.md index a5fd7fb004..70692efc8b 100644 --- a/windows/client-management/mdm/office-csp.md +++ b/windows/client-management/mdm/office-csp.md @@ -1,14 +1,7 @@ --- title: Office CSP description: Learn more about the Office CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/office-ddf.md b/windows/client-management/mdm/office-ddf.md index e3301499dc..e36405ce71 100644 --- a/windows/client-management/mdm/office-ddf.md +++ b/windows/client-management/mdm/office-ddf.md @@ -1,14 +1,7 @@ --- title: Office DDF file description: View the XML file containing the device description framework (DDF) for the Office configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 06/02/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 06/28/2024 --- @@ -47,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the O 10.0.15063 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; @@ -218,7 +211,7 @@ The following XML file contains the device description framework (DDF) for the O 10.0.15063 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; diff --git a/windows/client-management/mdm/passportforwork-csp.md b/windows/client-management/mdm/passportforwork-csp.md index 14c84143e8..fe7da7ac06 100644 --- a/windows/client-management/mdm/passportforwork-csp.md +++ b/windows/client-management/mdm/passportforwork-csp.md @@ -1,14 +1,7 @@ --- title: PassportForWork CSP description: Learn more about the PassportForWork CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 06/21/2024 --- @@ -32,7 +25,6 @@ The following list shows the PassportForWork configuration service provider node - ./Device/Vendor/MSFT/PassportForWork - [{TenantId}](#devicetenantid) - [Policies](#devicetenantidpolicies) - - [DisablePostLogonCredentialCaching](#devicetenantidpoliciesdisablepostlogoncredentialcaching) - [DisablePostLogonProvisioning](#devicetenantidpoliciesdisablepostlogonprovisioning) - [EnablePinRecovery](#devicetenantidpoliciesenablepinrecovery) - [EnableWindowsHelloProvisioningForSecurityKeys](#devicetenantidpoliciesenablewindowshelloprovisioningforsecuritykeys) @@ -165,62 +157,13 @@ Root node for policies. - -#### Device/{TenantId}/Policies/DisablePostLogonCredentialCaching - - -| Scope | Editions | Applicable OS | -|:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | - - - -```Device -./Device/Vendor/MSFT/PassportForWork/{TenantId}/Policies/DisablePostLogonCredentialCaching -``` - - - - -Disable caching of the Windows Hello for Business credential after sign-in. - - - - - - - -**Description framework properties**: - -| Property name | Property value | -|:--|:--| -| Format | `bool` | -| Access Type | Add, Delete, Get, Replace | -| Default Value | False | - - - -**Allowed values**: - -| Value | Description | -|:--|:--| -| false (Default) | Disabled. | -| true | Enabled. | - - - - - - - - #### Device/{TenantId}/Policies/DisablePostLogonProvisioning | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.2402] and later
                        ✅ Windows 10, version 2004 [10.0.19041.4239] and later
                        ✅ Windows 11, version 21H2 [10.0.22000.2899] and later
                        ✅ Windows 11, version 22H2 [10.0.22621.3374] and later
                        ✅ Windows Insider Preview | @@ -253,8 +196,8 @@ Don't start Windows Hello provisioning after sign-in. | Value | Description | |:--|:--| -| false (Default) | Post Logon Provisioning Enabled. | -| true | Post Logon Provisioning Disabled. | +| false (Default) | Provisioning Enabled. | +| true | Provisioning Disabled. | diff --git a/windows/client-management/mdm/passportforwork-ddf.md b/windows/client-management/mdm/passportforwork-ddf.md index fa9e278d82..c94b22aed5 100644 --- a/windows/client-management/mdm/passportforwork-ddf.md +++ b/windows/client-management/mdm/passportforwork-ddf.md @@ -1,14 +1,7 @@ --- title: PassportForWork DDF file description: View the XML file containing the device description framework (DDF) for the PassportForWork configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 06/28/2024 --- @@ -46,7 +39,7 @@ The following XML file contains the device description framework (DDF) for the P 10.0.10586 1.2 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; @@ -572,7 +565,7 @@ If you do not configure this policy setting, Windows Hello for Business requires 10.0.10586 1.2 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; @@ -877,56 +870,17 @@ If you disable or do not configure this policy setting, the PIN recovery secret - 99.9.99999 + 99.9.99999, 10.0.22621.3374, 10.0.22000.2899, 10.0.20348.2402, 10.0.19041.4239 1.6 false - Post Logon Provisioning Enabled + Provisioning Enabled true - Post Logon Provisioning Disabled - - - - - - DisablePostLogonCredentialCaching - - - - - - - - False - Disable caching of the Windows Hello for Business credential after sign-in. - - - - - - - - - - - - - - 99.9.99999 - 1.6 - - - - false - Disabled - - - true - Enabled + Provisioning Disabled diff --git a/windows/client-management/mdm/personaldataencryption-csp.md b/windows/client-management/mdm/personaldataencryption-csp.md index 6c8eb48c1b..2a4648393a 100644 --- a/windows/client-management/mdm/personaldataencryption-csp.md +++ b/windows/client-management/mdm/personaldataencryption-csp.md @@ -1,14 +1,7 @@ --- title: PDE CSP description: Learn more about the PDE CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/personaldataencryption-ddf-file.md b/windows/client-management/mdm/personaldataencryption-ddf-file.md index b2f9432892..165f97507c 100644 --- a/windows/client-management/mdm/personaldataencryption-ddf-file.md +++ b/windows/client-management/mdm/personaldataencryption-ddf-file.md @@ -1,14 +1,7 @@ --- title: PDE DDF file description: View the XML file containing the device description framework (DDF) for the PDE configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 06/02/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 06/28/2024 --- @@ -46,7 +39,7 @@ The following XML file contains the device description framework (DDF) for the P 10.0.22621 1.0 - 0x4;0x1B;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0xAB;0xAC;0xBC;0xBF;0xCD; + 0x4;0x1B;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0xAB;0xAC;0xBC;0xBF;0xCD;0xCF; diff --git a/windows/client-management/mdm/personalization-csp.md b/windows/client-management/mdm/personalization-csp.md index 6625fb8a84..d455b2968a 100644 --- a/windows/client-management/mdm/personalization-csp.md +++ b/windows/client-management/mdm/personalization-csp.md @@ -1,14 +1,7 @@ --- title: Personalization CSP description: Learn more about the Personalization CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 10/26/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 06/21/2024 --- @@ -16,14 +9,12 @@ ms.topic: reference # Personalization CSP -[!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)] - The Personalization CSP can set the lock screen, desktop background images and company branding on sign-in screen ([BootToCloud mode](policy-csp-clouddesktop.md#boottocloudmode) only). Setting these policies also prevents the user from changing the image. You can also use the Personalization settings in a provisioning package. > [!IMPORTANT] -> Personalization CSP is supported in Windows Enterprise and Education SKUs. It works in Windows Professional only when SetEduPolicies in [SharedPC CSP](sharedpc-csp.md) is set, or when the device is configured in [Shared PC mode with BootToCloudPCEnhanced policy](clouddesktop-csp.md#boottocloudpcenhanced). +> Personalization CSP is supported in Windows Enterprise and Education SKUs. It works in Windows Professional only when SetEduPolicies in [SharedPC CSP](sharedpc-csp.md) is set, or when the device is configured in [Shared PC mode with BootToCloudPCEnhanced policy](clouddesktop-csp.md#deviceboottocloudpcenhanced). @@ -45,7 +36,7 @@ The following list shows the Personalization configuration service provider node | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621.3235] and later | @@ -84,7 +75,7 @@ This represents the status of the Company Logo. 1 - Successfully downloaded or c | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621.3235] and later | @@ -123,7 +114,7 @@ An http or https Url to a jpg, jpeg or png image that needs to be downloaded and | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621.3235] and later | @@ -134,7 +125,7 @@ An http or https Url to a jpg, jpeg or png image that needs to be downloaded and -The name of the company to be displayed on the sign-in screen. This setting is currently available for boot to cloud shared pc mode only. +This represents the name of the company. It can be at most 30 characters long. This setting is currently available only for boot to cloud shared pc mode to display the company name on sign-in screen. diff --git a/windows/client-management/mdm/personalization-ddf.md b/windows/client-management/mdm/personalization-ddf.md index d9f8bf627c..5a52a16784 100644 --- a/windows/client-management/mdm/personalization-ddf.md +++ b/windows/client-management/mdm/personalization-ddf.md @@ -1,14 +1,7 @@ --- title: Personalization DDF file description: View the XML file containing the device description framework (DDF) for the Personalization configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 10/25/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 06/28/2024 --- @@ -49,7 +42,7 @@ The following XML file contains the device description framework (DDF) for the P 10.0.16299 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x87;0x88;0x88*;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBD;0xBF;0xCA;0xCB; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; @@ -108,7 +101,7 @@ The following XML file contains the device description framework (DDF) for the P - A http or https Url to a jpg, jpeg or png image that neeeds to be downloaded and used as the Lock Screen Image or a file Url to a local image on the file system that needs to be used as the Lock Screen Image. + A http or https Url to a jpg, jpeg or png image that needs to be downloaded and used as the Lock Screen Image or a file Url to a local image on the file system that needs to be used as the Lock Screen Image. @@ -155,7 +148,7 @@ The following XML file contains the device description framework (DDF) for the P - A http or https Url to a jpg, jpeg or png image that neeeds to be downloaded and used as the Company Logo or a file Url to a local image on the file system that needs to be used as the Company Logo. This setting is currently available for boot to cloud shared pc mode only. + A http or https Url to a jpg, jpeg or png image that needs to be downloaded and used as the Company Logo or a file Url to a local image on the file system that needs to be used as the Company Logo. This setting is currently available for boot to cloud shared pc mode only. @@ -169,7 +162,7 @@ The following XML file contains the device description framework (DDF) for the P - 99.9.99999 + 10.0.22621.3235 2.0 @@ -196,7 +189,7 @@ The following XML file contains the device description framework (DDF) for the P - 99.9.99999 + 10.0.22621.3235 2.0 @@ -210,7 +203,7 @@ The following XML file contains the device description framework (DDF) for the P - The name of the company to be displayed on the sign-in screen. This setting is currently available for boot to cloud shared pc mode only. + This represents the name of the company. It can be at most 30 characters long. This setting is currently available only for boot to cloud shared pc mode to display the company name on sign-in screen. @@ -224,7 +217,7 @@ The following XML file contains the device description framework (DDF) for the P - 99.9.99999 + 10.0.22621.3235 2.0 diff --git a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md index 8ca51cb2f9..3c0d28e2e6 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md +++ b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md @@ -1,14 +1,7 @@ --- title: ADMX-backed policies in Policy CSP description: Learn about the ADMX-backed policies in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 06/28/2024 --- @@ -1950,6 +1943,7 @@ This article lists the ADMX-backed policies in Policy CSP. - [IZ_Policy_OpenSearchQuery_Trusted](policy-csp-admx-windowsexplorer.md) - [IZ_Policy_OpenSearchPreview_Trusted](policy-csp-admx-windowsexplorer.md) - [EnableShellShortcutIconRemotePath](policy-csp-admx-windowsexplorer.md) +- [DisableMotWOnInsecurePathCopy](policy-csp-admx-windowsexplorer.md) - [EnableSmartScreen](policy-csp-admx-windowsexplorer.md) - [NoNewAppAlert](policy-csp-admx-windowsexplorer.md) - [ShowHibernateOption](policy-csp-admx-windowsexplorer.md) @@ -2217,6 +2211,7 @@ This article lists the ADMX-backed policies in Policy CSP. - [AllowSaveTargetAsInIEMode](policy-csp-internetexplorer.md) - [DisableInternetExplorerApp](policy-csp-internetexplorer.md) - [EnableExtendedIEModeHotkeys](policy-csp-internetexplorer.md) +- [AllowLegacyURLFields](policy-csp-internetexplorer.md) - [ResetZoomForDialogInIEMode](policy-csp-internetexplorer.md) - [EnableGlobalWindowListInIEMode](policy-csp-internetexplorer.md) - [JScriptReplacement](policy-csp-internetexplorer.md) @@ -2522,6 +2517,7 @@ This article lists the ADMX-backed policies in Policy CSP. - [ConfigureRpcAuthnLevelPrivacyEnabled](policy-csp-printers.md) - [ConfigureIppPageCountsPolicy](policy-csp-printers.md) - [ConfigureRedirectionGuardPolicy](policy-csp-printers.md) +- [ConfigureWindowsProtectedPrint](policy-csp-printers.md) ## RemoteAssistance @@ -2541,6 +2537,9 @@ This article lists the ADMX-backed policies in Policy CSP. - [RequireSecureRPCCommunication](policy-csp-remotedesktopservices.md) - [ClientConnectionEncryptionLevel](policy-csp-remotedesktopservices.md) - [DoNotAllowWebAuthnRedirection](policy-csp-remotedesktopservices.md) +- [DisconnectOnLockLegacyAuthn](policy-csp-remotedesktopservices.md) +- [DisconnectOnLockMicrosoftIdentityAuthn](policy-csp-remotedesktopservices.md) +- [TS_SERVER_REMOTEAPP_USE_SHELLAPPRUNTIME](policy-csp-remotedesktopservices.md) ## RemoteManagement diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md index aec0cd363b..a9bd1aa0ed 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md +++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md @@ -1,14 +1,7 @@ --- title: Policies in Policy CSP supported by Group Policy description: Learn about the policies in Policy CSP supported by Group Policy. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 06/28/2024 --- @@ -288,6 +281,9 @@ This article lists the policies in Policy CSP that have a group policy mapping. - [PasswordComplexity](policy-csp-devicelock.md) - [PasswordHistorySize](policy-csp-devicelock.md) - [AllowAdministratorLockout](policy-csp-devicelock.md) +- [MinimumPasswordLength](policy-csp-devicelock.md) +- [MinimumPasswordLengthAudit](policy-csp-devicelock.md) +- [RelaxMinimumPasswordLengthLimits](policy-csp-devicelock.md) ## Display @@ -394,7 +390,7 @@ This article lists the policies in Policy CSP that have a group policy mapping. - [InteractiveLogon_DoNotRequireCTRLALTDEL](policy-csp-localpoliciessecurityoptions.md) - [InteractiveLogon_DoNotDisplayLastSignedIn](policy-csp-localpoliciessecurityoptions.md) - [InteractiveLogon_DoNotDisplayUsernameAtSignIn](policy-csp-localpoliciessecurityoptions.md) -- [InteractiveLogon_MachineAccountThreshold](policy-csp-localpoliciessecurityoptions.md) +- [InteractiveLogon_MachineAccountLockoutThreshold](policy-csp-localpoliciessecurityoptions.md) - [InteractiveLogon_MachineInactivityLimit](policy-csp-localpoliciessecurityoptions.md) - [InteractiveLogon_MessageTextForUsersAttemptingToLogOn](policy-csp-localpoliciessecurityoptions.md) - [InteractiveLogon_MessageTitleForUsersAttemptingToLogOn](policy-csp-localpoliciessecurityoptions.md) @@ -429,10 +425,12 @@ This article lists the policies in Policy CSP that have a group policy mapping. - [UserAccountControl_UseAdminApprovalMode](policy-csp-localpoliciessecurityoptions.md) - [UserAccountControl_AllowUIAccessApplicationsToPromptForElevation](policy-csp-localpoliciessecurityoptions.md) - [UserAccountControl_BehaviorOfTheElevationPromptForAdministrators](policy-csp-localpoliciessecurityoptions.md) +- [UserAccountControl_BehaviorOfTheElevationPromptForEnhancedAdministrators](policy-csp-localpoliciessecurityoptions.md) - [UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers](policy-csp-localpoliciessecurityoptions.md) - [UserAccountControl_OnlyElevateExecutableFilesThatAreSignedAndValidated](policy-csp-localpoliciessecurityoptions.md) - [UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations](policy-csp-localpoliciessecurityoptions.md) - [UserAccountControl_RunAllAdministratorsInAdminApprovalMode](policy-csp-localpoliciessecurityoptions.md) +- [UserAccountControl_TypeOfAdminApprovalMode](policy-csp-localpoliciessecurityoptions.md) - [UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation](policy-csp-localpoliciessecurityoptions.md) - [UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations](policy-csp-localpoliciessecurityoptions.md) - [UserAccountControl_DetectApplicationInstallationsAndPromptForElevation](policy-csp-localpoliciessecurityoptions.md) @@ -532,6 +530,10 @@ This article lists the policies in Policy CSP that have a group policy mapping. - [LetAppsAccessEmail_ForceAllowTheseApps](policy-csp-privacy.md) - [LetAppsAccessEmail_ForceDenyTheseApps](policy-csp-privacy.md) - [LetAppsAccessEmail_UserInControlOfTheseApps](policy-csp-privacy.md) +- [LetAppsAccessGenerativeAI](policy-csp-privacy.md) +- [LetAppsAccessGenerativeAI_ForceAllowTheseApps](policy-csp-privacy.md) +- [LetAppsAccessGenerativeAI_ForceDenyTheseApps](policy-csp-privacy.md) +- [LetAppsAccessGenerativeAI_UserInControlOfTheseApps](policy-csp-privacy.md) - [LetAppsAccessGraphicsCaptureProgrammatic](policy-csp-privacy.md) - [LetAppsAccessGraphicsCaptureProgrammatic_ForceAllowTheseApps](policy-csp-privacy.md) - [LetAppsAccessGraphicsCaptureProgrammatic_ForceDenyTheseApps](policy-csp-privacy.md) @@ -661,6 +663,10 @@ This article lists the policies in Policy CSP that have a group policy mapping. - [ConfigStorageSenseDownloadsCleanupThreshold](policy-csp-storage.md) - [ConfigStorageSenseCloudContentDehydrationThreshold](policy-csp-storage.md) +## Sudo + +- [EnableSudo](policy-csp-sudo.md) + ## System - [AllowTelemetry](policy-csp-system.md) @@ -803,6 +809,7 @@ This article lists the policies in Policy CSP that have a group policy mapping. - [ConfigureDeadlineNoAutoRebootForFeatureUpdates](policy-csp-update.md) - [ConfigureDeadlineNoAutoRebootForQualityUpdates](policy-csp-update.md) - [AllowOptionalContent](policy-csp-update.md) +- [AlwaysAutoRebootAtScheduledTimeMinutes](policy-csp-update.md) ## UserRights @@ -869,6 +876,7 @@ This article lists the policies in Policy CSP that have a group policy mapping. ## WindowsAI - [TurnOffWindowsCopilot](policy-csp-windowsai.md) +- [DisableAIDataAnalysis](policy-csp-windowsai.md) ## WindowsDefenderSecurityCenter diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens-1st-gen-commercial-suite.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens-1st-gen-commercial-suite.md index 2329114e1b..c4376598c8 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens-1st-gen-commercial-suite.md +++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens-1st-gen-commercial-suite.md @@ -1,13 +1,6 @@ --- title: Policies in Policy CSP supported by HoloLens (1st gen) Commercial Suite description: Learn the policies in Policy CSP supported by HoloLens (1st gen) Commercial Suite. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.localizationpriority: medium ms.date: 09/17/2019 --- diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens-1st-gen-development-edition.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens-1st-gen-development-edition.md index 631059455e..dee1ed9c6b 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens-1st-gen-development-edition.md +++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens-1st-gen-development-edition.md @@ -1,13 +1,6 @@ --- title: Policies in Policy CSP supported by HoloLens (1st gen) Development Edition description: Learn about the policies in Policy CSP supported by HoloLens (1st gen) Development Edition. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.localizationpriority: medium ms.date: 07/18/2019 --- diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens2.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens2.md index e45320b0b7..c0c0fd2588 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens2.md +++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens2.md @@ -1,13 +1,6 @@ --- title: Policies in Policy CSP supported by HoloLens 2 description: Learn about the policies in Policy CSP supported by HoloLens 2. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.localizationpriority: medium ms.date: 02/03/2023 --- @@ -46,6 +39,10 @@ ms.date: 02/03/2023 - [DeliveryOptimization/DOSetHoursToLimitForegroundDownloadBandwidth](policy-csp-deliveryoptimization.md#dosethourstolimitforegrounddownloadbandwidth) 10 - [DeliveryOptimization/DOSetHoursToLimitBackgroundDownloadBandwidth](policy-csp-deliveryoptimization.md#dosethourstolimitbackgrounddownloadbandwidth) 10 - [DeliveryOptimization/DOSetHoursToLimitBackgroundDownloadBandwidth](policy-csp-deliveryoptimization.md#dosethourstolimitbackgrounddownloadbandwidth) 10 +- [Device/{TenantId}/Policies/EnableWindowsHelloProvisioningForSecurityKeys](passportforwork-csp.md#devicetenantidpoliciesenablewindowshelloprovisioningforsecuritykeys) 12 +- [DeviceInstallation/AllowInstallationOfMatchingDeviceIDs](policy-csp-deviceinstallation.md#allowinstallationofmatchingdeviceids) 12 +- [DeviceInstallation/DeviceInstall_Removable_Deny](policy-csp-admx-deviceinstallation.md#deviceinstall_removable_deny) 12 +- [DeviceInstallation/EnableInstallationPolicyLayering](policy-csp-deviceinstallation.md#enableinstallationpolicylayering) 12 - [DeviceLock/AllowIdleReturnWithoutPassword](policy-csp-devicelock.md#allowidlereturnwithoutpassword) - [DeviceLock/AllowSimpleDevicePassword](policy-csp-devicelock.md#allowsimpledevicepassword) - [DeviceLock/AlphanumericDevicePasswordRequired](policy-csp-devicelock.md#alphanumericdevicepasswordrequired) @@ -66,12 +63,18 @@ ms.date: 02/03/2023 - [MixedReality/ConfigureMovingPlatform](policy-csp-mixedreality.md#configuremovingplatform) *[Feb. 2022 Servicing release](/hololens/hololens-release-notes#windows-holographic-version-21h2---february-2022-update) - [MixedReality/ConfigureNtpClient](./policy-csp-mixedreality.md#configurentpclient) 12 - [MixedReality/DisallowNetworkConnectivityPassivePolling](./policy-csp-mixedreality.md#disallownetworkconnectivitypassivepolling) 12 +- [MixedReality/EnableStartMenuWristTap](./policy-csp-mixedreality.md#enablestartmenuwristtap)12 +- [MixedReality/EnableStartMenuSingleHandGesture](./policy-csp-mixedreality.md#enablestartmenusinglehandgesture) 12 +- [MixedReality/EnableStartMenuVoiceCommand](./policy-csp-mixedreality.md#enablestartmenuvoicecommand) 12 - [MixedReality/FallbackDiagnostics](./policy-csp-mixedreality.md#fallbackdiagnostics) 9 - [MixedReality/ManualDownDirectionDisabled](policy-csp-mixedreality.md#manualdowndirectiondisabled) *[Feb. 2022 Servicing release](/hololens/hololens-release-notes#windows-holographic-version-21h2---february-2022-update) - [MixedReality/MicrophoneDisabled](./policy-csp-mixedreality.md#microphonedisabled) 9 - [MixedReality/NtpClientEnabled](./policy-csp-mixedreality.md#ntpclientenabled) 12 +- [MixedReality/PreferLogonAsOtherUser](./policy-csp-mixedreality.md#preferlogonasotheruser) 12 - [MixedReality/SkipCalibrationDuringSetup](./policy-csp-mixedreality.md#skipcalibrationduringsetup) 12 - [MixedReality/SkipTrainingDuringSetup](./policy-csp-mixedreality.md#skiptrainingduringsetup) 12 +- [MixedReality/RequireStartIconHold](./policy-csp-mixedreality.md#requirestarticonhold) 12 +- [MixedReality/RequireStartIconVisible](./policy-csp-mixedreality.md#requirestarticonvisible) 12 - [MixedReality/VisitorAutoLogon](policy-csp-mixedreality.md#visitorautologon) 10 - [MixedReality/VolumeButtonDisabled](./policy-csp-mixedreality.md#volumebuttondisabled) 9 - [Power/DisplayOffTimeoutOnBattery](./policy-csp-power.md#displayofftimeoutonbattery) 9, 14 @@ -98,9 +101,9 @@ ms.date: 02/03/2023 - [Privacy/LetAppsAccessGazeInput_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccessgazeinput_forcedenytheseapps) 8 - [Privacy/LetAppsAccessGazeInput_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccessgazeinput_userincontroloftheseapps) 8 - [Privacy/LetAppsAccessLocation](policy-csp-privacy.md#letappsaccesslocation) -- [Privacy/LetAppsAccessLocation_ForceAllowTheseApps](/windows/client-management/mdm/policy-csp-privacy) 12 -- [Privacy/LetAppsAccessLocation_ForceDenyTheseApps](/windows/client-management/mdm/policy-csp-privacy) 12 -- [Privacy/LetAppsAccessLocation_UserInControlOfTheseApps](/windows/client-management/mdm/policy-csp-privacy) 12 +- [Privacy/LetAppsAccessLocation_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccesslocation_forceallowtheseapps) 12 +- [Privacy/LetAppsAccessLocation_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccesslocation_forcedenytheseapps) 12 +- [Privacy/LetAppsAccessLocation_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccesslocation_userincontroloftheseapps) 12 - [Privacy/LetAppsAccessMicrophone](policy-csp-privacy.md#letappsaccessmicrophone) - [Privacy/LetAppsAccessMicrophone_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccessmicrophone_forceallowtheseapps) 8 - [Privacy/LetAppsAccessMicrophone_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccessmicrophone_forcedenytheseapps) 8 @@ -120,8 +123,8 @@ ms.date: 02/03/2023 - [System/AllowLocation](policy-csp-system.md#allowlocation) - [System/AllowStorageCard](policy-csp-system.md#allowstoragecard) - [System/AllowTelemetry](policy-csp-system.md#allowtelemetry) -- [System/ConfigureTelemetryOptInSettingsUx](/windows/client-management/mdm/policy-csp-system) 12 -- [System/DisableDeviceDelete](/windows/client-management/mdm/policy-csp-system) 12 +- [System/ConfigureTelemetryOptInSettingsUx](policy-csp-system.md#configuretelemetryoptinsettingsux) 12 +- [System/DisableDeviceDelete](policy-csp-system.md#disabledevicedelete) 12 - [TimeLanguageSettings/ConfigureTimeZone](./policy-csp-timelanguagesettings.md#configuretimezone) 9 - [Update/ActiveHoursEnd](./policy-csp-update.md#activehoursend) 9 - [Update/ActiveHoursMaxRange](./policy-csp-update.md#activehoursmaxrange) 9 @@ -172,6 +175,3 @@ Footnotes: [Policy CSP](policy-configuration-service-provider.md) [Full HoloLens CSP Details](/windows/client-management/mdm/configuration-service-provider-support) - - - diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md index 7e755cbccd..a51aba5851 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md +++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md @@ -1,14 +1,7 @@ --- title: Policies in Policy CSP supported by Windows 10 Team description: Learn about the policies in Policy CSP supported by Windows 10 Team. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 09/25/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 06/19/2024 --- @@ -322,6 +315,7 @@ This article lists the policies in Policy CSP that are applicable for the Surfac - [AllowOptionalContent](policy-csp-update.md#allowoptionalcontent) - [AllowTemporaryEnterpriseFeatureControl](policy-csp-update.md#allowtemporaryenterprisefeaturecontrol) - [AllowUpdateService](policy-csp-update.md#allowupdateservice) +- [AlwaysAutoRebootAtScheduledTimeMinutes](policy-csp-update.md#alwaysautorebootatscheduledtimeminutes) - [BranchReadinessLevel](policy-csp-update.md#branchreadinesslevel) - [ConfigureFeatureUpdateUninstallPeriod](policy-csp-update.md#configurefeatureupdateuninstallperiod) - [DeferFeatureUpdatesPeriodInDays](policy-csp-update.md#deferfeatureupdatesperiodindays) diff --git a/windows/client-management/mdm/policies-in-policy-csp-that-can-be-set-using-eas.md b/windows/client-management/mdm/policies-in-policy-csp-that-can-be-set-using-eas.md index b2cb734aa7..2cb5d252a7 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-that-can-be-set-using-eas.md +++ b/windows/client-management/mdm/policies-in-policy-csp-that-can-be-set-using-eas.md @@ -1,13 +1,6 @@ --- title: Policies in Policy CSP that can be set using Exchange Active Sync (EAS) description: Learn about the policies in Policy CSP that can be set using Exchange Active Sync (EAS). -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.localizationpriority: medium ms.date: 07/18/2019 --- diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index f7695f6a8a..7aa96cc52c 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -1,14 +1,7 @@ --- title: Policy CSP description: Learn more about the Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/29/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 04/10/2024 --- @@ -1162,6 +1155,7 @@ Specifies the name/value pair used in the policy. See the individual Area DDFs f - [Start](policy-csp-start.md) - [Stickers](policy-csp-stickers.md) - [Storage](policy-csp-storage.md) +- [Sudo](policy-csp-sudo.md) - [System](policy-csp-system.md) - [SystemServices](policy-csp-systemservices.md) - [TaskManager](policy-csp-taskmanager.md) diff --git a/windows/client-management/mdm/policy-csp-abovelock.md b/windows/client-management/mdm/policy-csp-abovelock.md index 44d02d34ed..05e84c1ade 100644 --- a/windows/client-management/mdm/policy-csp-abovelock.md +++ b/windows/client-management/mdm/policy-csp-abovelock.md @@ -1,14 +1,7 @@ --- title: AboveLock Policy CSP description: Learn more about the AboveLock Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 04/10/2024 --- @@ -29,7 +22,7 @@ ms.topic: reference | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1507 [10.0.10240] and later | +| ✅ Device
                        ❌ User | Not applicable | ✅ Windows 10, version 1507 [10.0.10240] and later | diff --git a/windows/client-management/mdm/policy-csp-accounts.md b/windows/client-management/mdm/policy-csp-accounts.md index 58df4beaf2..472fa8e6dc 100644 --- a/windows/client-management/mdm/policy-csp-accounts.md +++ b/windows/client-management/mdm/policy-csp-accounts.md @@ -1,14 +1,7 @@ --- title: Accounts Policy CSP description: Learn more about the Accounts Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -230,7 +223,7 @@ Allows IT Admins the ability to disable the Microsoft Account Sign-In Assistant - + This setting determines whether to only allow enterprise device authentication for the Microsoft Account Sign-in Assistant service (wlidsvc). By default, this setting is disabled and allows both user and device authentication. When the value is set to 1, only allow device authentication, and block user authentication. @@ -263,8 +256,13 @@ Most restricted value is 1. | Name | Value | |:--|:--| -| Name | MicrosoftAccount_RestrictToDeviceAuthenticationOnly | -| Path | MSAPolicy > AT > WindowsComponents > MicrosoftAccountCategory | +| Name | MicrosoftAccount_RestrictToEnterpriseDeviceAuthenticationOnly | +| Friendly Name | Only allow device authentication for the Microsoft Account Sign-In Assistant | +| Location | Computer Configuration | +| Path | Windows Components > Microsoft account | +| Registry Key Name | Software\Microsoft\Windows\CurrentVersion\Policies\System | +| Registry Value Name | EnterpriseDeviceAuthOnly | +| ADMX File Name | MSAPolicy.admx | diff --git a/windows/client-management/mdm/policy-csp-activexcontrols.md b/windows/client-management/mdm/policy-csp-activexcontrols.md index fce92f8dff..7fe5d7be45 100644 --- a/windows/client-management/mdm/policy-csp-activexcontrols.md +++ b/windows/client-management/mdm/policy-csp-activexcontrols.md @@ -1,14 +1,7 @@ --- title: ActiveXControls Policy CSP description: Learn more about the ActiveXControls Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-activexinstallservice.md b/windows/client-management/mdm/policy-csp-admx-activexinstallservice.md index 0055dc812c..5a3a8d415b 100644 --- a/windows/client-management/mdm/policy-csp-admx-activexinstallservice.md +++ b/windows/client-management/mdm/policy-csp-admx-activexinstallservice.md @@ -1,14 +1,7 @@ --- title: ADMX_ActiveXInstallService Policy CSP description: Learn more about the ADMX_ActiveXInstallService Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-addremoveprograms.md b/windows/client-management/mdm/policy-csp-admx-addremoveprograms.md index 10196c3390..481aefeb0c 100644 --- a/windows/client-management/mdm/policy-csp-admx-addremoveprograms.md +++ b/windows/client-management/mdm/policy-csp-admx-addremoveprograms.md @@ -1,14 +1,7 @@ --- title: ADMX_AddRemovePrograms Policy CSP description: Learn more about the ADMX_AddRemovePrograms Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-admpwd.md b/windows/client-management/mdm/policy-csp-admx-admpwd.md index a1bcc9f18b..24516f1874 100644 --- a/windows/client-management/mdm/policy-csp-admx-admpwd.md +++ b/windows/client-management/mdm/policy-csp-admx-admpwd.md @@ -1,14 +1,7 @@ --- title: ADMX_AdmPwd Policy CSP description: Learn more about the ADMX_AdmPwd Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-appcompat.md b/windows/client-management/mdm/policy-csp-admx-appcompat.md index 7899515d31..db2d8555a0 100644 --- a/windows/client-management/mdm/policy-csp-admx-appcompat.md +++ b/windows/client-management/mdm/policy-csp-admx-appcompat.md @@ -1,14 +1,7 @@ --- title: ADMX_AppCompat Policy CSP description: Learn more about the ADMX_AppCompat Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-appxpackagemanager.md b/windows/client-management/mdm/policy-csp-admx-appxpackagemanager.md index 029e7784ba..afc5924f0e 100644 --- a/windows/client-management/mdm/policy-csp-admx-appxpackagemanager.md +++ b/windows/client-management/mdm/policy-csp-admx-appxpackagemanager.md @@ -1,14 +1,7 @@ --- title: ADMX_AppxPackageManager Policy CSP description: Learn more about the ADMX_AppxPackageManager Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-appxruntime.md b/windows/client-management/mdm/policy-csp-admx-appxruntime.md index 749ee6afce..8c3e3054f5 100644 --- a/windows/client-management/mdm/policy-csp-admx-appxruntime.md +++ b/windows/client-management/mdm/policy-csp-admx-appxruntime.md @@ -1,14 +1,7 @@ --- title: ADMX_AppXRuntime Policy CSP description: Learn more about the ADMX_AppXRuntime Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-attachmentmanager.md b/windows/client-management/mdm/policy-csp-admx-attachmentmanager.md index eed1a52c46..43b3293b3c 100644 --- a/windows/client-management/mdm/policy-csp-admx-attachmentmanager.md +++ b/windows/client-management/mdm/policy-csp-admx-attachmentmanager.md @@ -1,14 +1,7 @@ --- title: ADMX_AttachmentManager Policy CSP description: Learn more about the ADMX_AttachmentManager Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-auditsettings.md b/windows/client-management/mdm/policy-csp-admx-auditsettings.md index ff33c79687..255926912f 100644 --- a/windows/client-management/mdm/policy-csp-admx-auditsettings.md +++ b/windows/client-management/mdm/policy-csp-admx-auditsettings.md @@ -1,14 +1,7 @@ --- title: ADMX_AuditSettings Policy CSP description: Learn more about the ADMX_AuditSettings Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-bits.md b/windows/client-management/mdm/policy-csp-admx-bits.md index 311e65ddc9..7762c0431d 100644 --- a/windows/client-management/mdm/policy-csp-admx-bits.md +++ b/windows/client-management/mdm/policy-csp-admx-bits.md @@ -1,14 +1,7 @@ --- title: ADMX_Bits Policy CSP description: Learn more about the ADMX_Bits Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-ciphersuiteorder.md b/windows/client-management/mdm/policy-csp-admx-ciphersuiteorder.md index f7e094a272..c2810e7ba4 100644 --- a/windows/client-management/mdm/policy-csp-admx-ciphersuiteorder.md +++ b/windows/client-management/mdm/policy-csp-admx-ciphersuiteorder.md @@ -1,14 +1,7 @@ --- title: ADMX_CipherSuiteOrder Policy CSP description: Learn more about the ADMX_CipherSuiteOrder Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-com.md b/windows/client-management/mdm/policy-csp-admx-com.md index a5997f9c3f..3497e521fa 100644 --- a/windows/client-management/mdm/policy-csp-admx-com.md +++ b/windows/client-management/mdm/policy-csp-admx-com.md @@ -1,14 +1,7 @@ --- title: ADMX_COM Policy CSP description: Learn more about the ADMX_COM Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-controlpanel.md b/windows/client-management/mdm/policy-csp-admx-controlpanel.md index 488996e8fd..a94e04af2d 100644 --- a/windows/client-management/mdm/policy-csp-admx-controlpanel.md +++ b/windows/client-management/mdm/policy-csp-admx-controlpanel.md @@ -1,14 +1,7 @@ --- title: ADMX_ControlPanel Policy CSP description: Learn more about the ADMX_ControlPanel Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-controlpaneldisplay.md b/windows/client-management/mdm/policy-csp-admx-controlpaneldisplay.md index 8b6ce4783f..bb5edcf621 100644 --- a/windows/client-management/mdm/policy-csp-admx-controlpaneldisplay.md +++ b/windows/client-management/mdm/policy-csp-admx-controlpaneldisplay.md @@ -1,14 +1,7 @@ --- title: ADMX_ControlPanelDisplay Policy CSP description: Learn more about the ADMX_ControlPanelDisplay Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-cpls.md b/windows/client-management/mdm/policy-csp-admx-cpls.md index 65be5aa708..b9744965b8 100644 --- a/windows/client-management/mdm/policy-csp-admx-cpls.md +++ b/windows/client-management/mdm/policy-csp-admx-cpls.md @@ -1,14 +1,7 @@ --- title: ADMX_Cpls Policy CSP description: Learn more about the ADMX_Cpls Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-credentialproviders.md b/windows/client-management/mdm/policy-csp-admx-credentialproviders.md index 099494bfad..6d4b3184a0 100644 --- a/windows/client-management/mdm/policy-csp-admx-credentialproviders.md +++ b/windows/client-management/mdm/policy-csp-admx-credentialproviders.md @@ -1,14 +1,7 @@ --- title: ADMX_CredentialProviders Policy CSP description: Learn more about the ADMX_CredentialProviders Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-credssp.md b/windows/client-management/mdm/policy-csp-admx-credssp.md index 44ad3d65e5..a33e0f4837 100644 --- a/windows/client-management/mdm/policy-csp-admx-credssp.md +++ b/windows/client-management/mdm/policy-csp-admx-credssp.md @@ -1,14 +1,7 @@ --- title: ADMX_CredSsp Policy CSP description: Learn more about the ADMX_CredSsp Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-credui.md b/windows/client-management/mdm/policy-csp-admx-credui.md index b31b580c8b..d173ccb390 100644 --- a/windows/client-management/mdm/policy-csp-admx-credui.md +++ b/windows/client-management/mdm/policy-csp-admx-credui.md @@ -1,14 +1,7 @@ --- title: ADMX_CredUI Policy CSP description: Learn more about the ADMX_CredUI Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-ctrlaltdel.md b/windows/client-management/mdm/policy-csp-admx-ctrlaltdel.md index 54ad86715e..fb39f06a22 100644 --- a/windows/client-management/mdm/policy-csp-admx-ctrlaltdel.md +++ b/windows/client-management/mdm/policy-csp-admx-ctrlaltdel.md @@ -1,14 +1,7 @@ --- title: ADMX_CtrlAltDel Policy CSP description: Learn more about the ADMX_CtrlAltDel Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-datacollection.md b/windows/client-management/mdm/policy-csp-admx-datacollection.md index e1194939bb..88352e9758 100644 --- a/windows/client-management/mdm/policy-csp-admx-datacollection.md +++ b/windows/client-management/mdm/policy-csp-admx-datacollection.md @@ -1,14 +1,7 @@ --- title: ADMX_DataCollection Policy CSP description: Learn more about the ADMX_DataCollection Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-dcom.md b/windows/client-management/mdm/policy-csp-admx-dcom.md index c85d5737b3..5243e0bdb3 100644 --- a/windows/client-management/mdm/policy-csp-admx-dcom.md +++ b/windows/client-management/mdm/policy-csp-admx-dcom.md @@ -1,14 +1,7 @@ --- title: ADMX_DCOM Policy CSP description: Learn more about the ADMX_DCOM Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-desktop.md b/windows/client-management/mdm/policy-csp-admx-desktop.md index 0a0280c52c..74cb4bd0e0 100644 --- a/windows/client-management/mdm/policy-csp-admx-desktop.md +++ b/windows/client-management/mdm/policy-csp-admx-desktop.md @@ -1,14 +1,7 @@ --- title: ADMX_Desktop Policy CSP description: Learn more about the ADMX_Desktop Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-devicecompat.md b/windows/client-management/mdm/policy-csp-admx-devicecompat.md index bc8976cc58..0992bb4dbb 100644 --- a/windows/client-management/mdm/policy-csp-admx-devicecompat.md +++ b/windows/client-management/mdm/policy-csp-admx-devicecompat.md @@ -1,14 +1,7 @@ --- title: ADMX_DeviceCompat Policy CSP description: Learn more about the ADMX_DeviceCompat Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-deviceguard.md b/windows/client-management/mdm/policy-csp-admx-deviceguard.md index 7afb0273de..3873ad69da 100644 --- a/windows/client-management/mdm/policy-csp-admx-deviceguard.md +++ b/windows/client-management/mdm/policy-csp-admx-deviceguard.md @@ -1,14 +1,7 @@ --- title: ADMX_DeviceGuard Policy CSP description: Learn more about the ADMX_DeviceGuard Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-deviceinstallation.md b/windows/client-management/mdm/policy-csp-admx-deviceinstallation.md index c8e2319400..2fb1234e02 100644 --- a/windows/client-management/mdm/policy-csp-admx-deviceinstallation.md +++ b/windows/client-management/mdm/policy-csp-admx-deviceinstallation.md @@ -1,14 +1,7 @@ --- title: ADMX_DeviceInstallation Policy CSP description: Learn more about the ADMX_DeviceInstallation Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-devicesetup.md b/windows/client-management/mdm/policy-csp-admx-devicesetup.md index b6fcaa1949..d298ee4f28 100644 --- a/windows/client-management/mdm/policy-csp-admx-devicesetup.md +++ b/windows/client-management/mdm/policy-csp-admx-devicesetup.md @@ -1,14 +1,7 @@ --- title: ADMX_DeviceSetup Policy CSP description: Learn more about the ADMX_DeviceSetup Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-dfs.md b/windows/client-management/mdm/policy-csp-admx-dfs.md index bf9c77582b..8b8a9fd98e 100644 --- a/windows/client-management/mdm/policy-csp-admx-dfs.md +++ b/windows/client-management/mdm/policy-csp-admx-dfs.md @@ -1,14 +1,7 @@ --- title: ADMX_DFS Policy CSP description: Learn more about the ADMX_DFS Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-digitallocker.md b/windows/client-management/mdm/policy-csp-admx-digitallocker.md index 1cbc73ac60..b9cab4363f 100644 --- a/windows/client-management/mdm/policy-csp-admx-digitallocker.md +++ b/windows/client-management/mdm/policy-csp-admx-digitallocker.md @@ -1,14 +1,7 @@ --- title: ADMX_DigitalLocker Policy CSP description: Learn more about the ADMX_DigitalLocker Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-diskdiagnostic.md b/windows/client-management/mdm/policy-csp-admx-diskdiagnostic.md index 56edf435ca..6fe0e41bc7 100644 --- a/windows/client-management/mdm/policy-csp-admx-diskdiagnostic.md +++ b/windows/client-management/mdm/policy-csp-admx-diskdiagnostic.md @@ -1,14 +1,7 @@ --- title: ADMX_DiskDiagnostic Policy CSP description: Learn more about the ADMX_DiskDiagnostic Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-disknvcache.md b/windows/client-management/mdm/policy-csp-admx-disknvcache.md index 65b61b43e6..7aebe11d5c 100644 --- a/windows/client-management/mdm/policy-csp-admx-disknvcache.md +++ b/windows/client-management/mdm/policy-csp-admx-disknvcache.md @@ -1,14 +1,7 @@ --- title: ADMX_DiskNVCache Policy CSP description: Learn more about the ADMX_DiskNVCache Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-diskquota.md b/windows/client-management/mdm/policy-csp-admx-diskquota.md index 9e04e0f283..3822ac0264 100644 --- a/windows/client-management/mdm/policy-csp-admx-diskquota.md +++ b/windows/client-management/mdm/policy-csp-admx-diskquota.md @@ -1,14 +1,7 @@ --- title: ADMX_DiskQuota Policy CSP description: Learn more about the ADMX_DiskQuota Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-distributedlinktracking.md b/windows/client-management/mdm/policy-csp-admx-distributedlinktracking.md index 948283f347..10ff8682a8 100644 --- a/windows/client-management/mdm/policy-csp-admx-distributedlinktracking.md +++ b/windows/client-management/mdm/policy-csp-admx-distributedlinktracking.md @@ -1,14 +1,7 @@ --- title: ADMX_DistributedLinkTracking Policy CSP description: Learn more about the ADMX_DistributedLinkTracking Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-dnsclient.md b/windows/client-management/mdm/policy-csp-admx-dnsclient.md index 2ba7d810ae..66b65954ea 100644 --- a/windows/client-management/mdm/policy-csp-admx-dnsclient.md +++ b/windows/client-management/mdm/policy-csp-admx-dnsclient.md @@ -1,14 +1,7 @@ --- title: ADMX_DnsClient Policy CSP description: Learn more about the ADMX_DnsClient Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-dwm.md b/windows/client-management/mdm/policy-csp-admx-dwm.md index 22f1c4afd7..d44012983a 100644 --- a/windows/client-management/mdm/policy-csp-admx-dwm.md +++ b/windows/client-management/mdm/policy-csp-admx-dwm.md @@ -1,14 +1,7 @@ --- title: ADMX_DWM Policy CSP description: Learn more about the ADMX_DWM Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-eaime.md b/windows/client-management/mdm/policy-csp-admx-eaime.md index 0008cdb700..f7038edb13 100644 --- a/windows/client-management/mdm/policy-csp-admx-eaime.md +++ b/windows/client-management/mdm/policy-csp-admx-eaime.md @@ -1,14 +1,7 @@ --- title: ADMX_EAIME Policy CSP description: Learn more about the ADMX_EAIME Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-encryptfilesonmove.md b/windows/client-management/mdm/policy-csp-admx-encryptfilesonmove.md index 47de0a1e19..7e4e793bf7 100644 --- a/windows/client-management/mdm/policy-csp-admx-encryptfilesonmove.md +++ b/windows/client-management/mdm/policy-csp-admx-encryptfilesonmove.md @@ -1,14 +1,7 @@ --- title: ADMX_EncryptFilesonMove Policy CSP description: Learn more about the ADMX_EncryptFilesonMove Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-enhancedstorage.md b/windows/client-management/mdm/policy-csp-admx-enhancedstorage.md index 8f8c2edfae..899f863d68 100644 --- a/windows/client-management/mdm/policy-csp-admx-enhancedstorage.md +++ b/windows/client-management/mdm/policy-csp-admx-enhancedstorage.md @@ -1,14 +1,7 @@ --- title: ADMX_EnhancedStorage Policy CSP description: Learn more about the ADMX_EnhancedStorage Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-errorreporting.md b/windows/client-management/mdm/policy-csp-admx-errorreporting.md index 9cff3290ef..4d1b6c454d 100644 --- a/windows/client-management/mdm/policy-csp-admx-errorreporting.md +++ b/windows/client-management/mdm/policy-csp-admx-errorreporting.md @@ -1,14 +1,7 @@ --- title: ADMX_ErrorReporting Policy CSP description: Learn more about the ADMX_ErrorReporting Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-eventforwarding.md b/windows/client-management/mdm/policy-csp-admx-eventforwarding.md index c795cc1b25..1f768733bc 100644 --- a/windows/client-management/mdm/policy-csp-admx-eventforwarding.md +++ b/windows/client-management/mdm/policy-csp-admx-eventforwarding.md @@ -1,14 +1,7 @@ --- title: ADMX_EventForwarding Policy CSP description: Learn more about the ADMX_EventForwarding Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-eventlog.md b/windows/client-management/mdm/policy-csp-admx-eventlog.md index e7ea263655..55c84c956a 100644 --- a/windows/client-management/mdm/policy-csp-admx-eventlog.md +++ b/windows/client-management/mdm/policy-csp-admx-eventlog.md @@ -1,14 +1,7 @@ --- title: ADMX_EventLog Policy CSP description: Learn more about the ADMX_EventLog Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-eventlogging.md b/windows/client-management/mdm/policy-csp-admx-eventlogging.md index 4ab3bea921..f72a8ff776 100644 --- a/windows/client-management/mdm/policy-csp-admx-eventlogging.md +++ b/windows/client-management/mdm/policy-csp-admx-eventlogging.md @@ -1,14 +1,7 @@ --- title: ADMX_EventLogging Policy CSP description: Learn more about the ADMX_EventLogging Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-eventviewer.md b/windows/client-management/mdm/policy-csp-admx-eventviewer.md index 5dbf8de29a..8b171fc73b 100644 --- a/windows/client-management/mdm/policy-csp-admx-eventviewer.md +++ b/windows/client-management/mdm/policy-csp-admx-eventviewer.md @@ -1,14 +1,7 @@ --- title: ADMX_EventViewer Policy CSP description: Learn more about the ADMX_EventViewer Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-explorer.md b/windows/client-management/mdm/policy-csp-admx-explorer.md index 109d2ab3e4..afe2fa4fee 100644 --- a/windows/client-management/mdm/policy-csp-admx-explorer.md +++ b/windows/client-management/mdm/policy-csp-admx-explorer.md @@ -1,14 +1,7 @@ --- title: ADMX_Explorer Policy CSP description: Learn more about the ADMX_Explorer Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-externalboot.md b/windows/client-management/mdm/policy-csp-admx-externalboot.md index 0e9014753c..ea236024a2 100644 --- a/windows/client-management/mdm/policy-csp-admx-externalboot.md +++ b/windows/client-management/mdm/policy-csp-admx-externalboot.md @@ -1,14 +1,7 @@ --- title: ADMX_ExternalBoot Policy CSP description: Learn more about the ADMX_ExternalBoot Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -48,6 +41,8 @@ Specifies whether the PC can use the hibernation sleep state (S4) when started f +> [!IMPORTANT] +> Windows To Go was announced as deprecated in Windows 10, version 1903, and was removed in version 2004. For more information, see [Features and functionality removed in Windows](/windows/whats-new/removed-features). @@ -109,6 +104,8 @@ This policy setting controls whether the PC will boot to Windows To Go if a USB +> [!IMPORTANT] +> Windows To Go was announced as deprecated in Windows 10, version 1903, and was removed in version 2004. For more information, see [Features and functionality removed in Windows](/windows/whats-new/removed-features). @@ -168,6 +165,8 @@ Specifies whether the PC can use standby sleep states (S1-S3) when starting from +> [!IMPORTANT] +> Windows To Go was announced as deprecated in Windows 10, version 1903, and was removed in version 2004. For more information, see [Features and functionality removed in Windows](/windows/whats-new/removed-features). diff --git a/windows/client-management/mdm/policy-csp-admx-filerecovery.md b/windows/client-management/mdm/policy-csp-admx-filerecovery.md index df706d5574..6fa3f2524f 100644 --- a/windows/client-management/mdm/policy-csp-admx-filerecovery.md +++ b/windows/client-management/mdm/policy-csp-admx-filerecovery.md @@ -1,14 +1,7 @@ --- title: ADMX_FileRecovery Policy CSP description: Learn more about the ADMX_FileRecovery Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-filerevocation.md b/windows/client-management/mdm/policy-csp-admx-filerevocation.md index b4db9c6e31..4f69113a08 100644 --- a/windows/client-management/mdm/policy-csp-admx-filerevocation.md +++ b/windows/client-management/mdm/policy-csp-admx-filerevocation.md @@ -1,14 +1,7 @@ --- title: ADMX_FileRevocation Policy CSP description: Learn more about the ADMX_FileRevocation Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-fileservervssprovider.md b/windows/client-management/mdm/policy-csp-admx-fileservervssprovider.md index 4ef165f51b..09b719884e 100644 --- a/windows/client-management/mdm/policy-csp-admx-fileservervssprovider.md +++ b/windows/client-management/mdm/policy-csp-admx-fileservervssprovider.md @@ -1,14 +1,7 @@ --- title: ADMX_FileServerVSSProvider Policy CSP description: Learn more about the ADMX_FileServerVSSProvider Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-filesys.md b/windows/client-management/mdm/policy-csp-admx-filesys.md index 46e9b64dae..125fd2482d 100644 --- a/windows/client-management/mdm/policy-csp-admx-filesys.md +++ b/windows/client-management/mdm/policy-csp-admx-filesys.md @@ -1,14 +1,7 @@ --- title: ADMX_FileSys Policy CSP description: Learn more about the ADMX_FileSys Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-folderredirection.md b/windows/client-management/mdm/policy-csp-admx-folderredirection.md index f899fc45c3..8515f89060 100644 --- a/windows/client-management/mdm/policy-csp-admx-folderredirection.md +++ b/windows/client-management/mdm/policy-csp-admx-folderredirection.md @@ -1,14 +1,7 @@ --- title: ADMX_FolderRedirection Policy CSP description: Learn more about the ADMX_FolderRedirection Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-framepanes.md b/windows/client-management/mdm/policy-csp-admx-framepanes.md index 4879cfd377..bdc13bd323 100644 --- a/windows/client-management/mdm/policy-csp-admx-framepanes.md +++ b/windows/client-management/mdm/policy-csp-admx-framepanes.md @@ -1,14 +1,7 @@ --- title: ADMX_FramePanes Policy CSP description: Learn more about the ADMX_FramePanes Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-fthsvc.md b/windows/client-management/mdm/policy-csp-admx-fthsvc.md index 0a21d317ee..0bd737cd3c 100644 --- a/windows/client-management/mdm/policy-csp-admx-fthsvc.md +++ b/windows/client-management/mdm/policy-csp-admx-fthsvc.md @@ -1,14 +1,7 @@ --- title: ADMX_fthsvc Policy CSP description: Learn more about the ADMX_fthsvc Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-globalization.md b/windows/client-management/mdm/policy-csp-admx-globalization.md index 318b249de9..5266b42db2 100644 --- a/windows/client-management/mdm/policy-csp-admx-globalization.md +++ b/windows/client-management/mdm/policy-csp-admx-globalization.md @@ -1,14 +1,7 @@ --- title: ADMX_Globalization Policy CSP description: Learn more about the ADMX_Globalization Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-grouppolicy.md b/windows/client-management/mdm/policy-csp-admx-grouppolicy.md index b4e3c52267..51baad84e5 100644 --- a/windows/client-management/mdm/policy-csp-admx-grouppolicy.md +++ b/windows/client-management/mdm/policy-csp-admx-grouppolicy.md @@ -1,14 +1,7 @@ --- title: ADMX_GroupPolicy Policy CSP description: Learn more about the ADMX_GroupPolicy Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-help.md b/windows/client-management/mdm/policy-csp-admx-help.md index 3cc624b3ec..b51b3ad8ab 100644 --- a/windows/client-management/mdm/policy-csp-admx-help.md +++ b/windows/client-management/mdm/policy-csp-admx-help.md @@ -1,14 +1,7 @@ --- title: ADMX_Help Policy CSP description: Learn more about the ADMX_Help Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 04/10/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-helpandsupport.md b/windows/client-management/mdm/policy-csp-admx-helpandsupport.md index b207a1fdec..3d1cc2cff2 100644 --- a/windows/client-management/mdm/policy-csp-admx-helpandsupport.md +++ b/windows/client-management/mdm/policy-csp-admx-helpandsupport.md @@ -1,14 +1,7 @@ --- title: ADMX_HelpAndSupport Policy CSP description: Learn more about the ADMX_HelpAndSupport Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-hotspotauth.md b/windows/client-management/mdm/policy-csp-admx-hotspotauth.md index 97c0f896dd..731f6ed051 100644 --- a/windows/client-management/mdm/policy-csp-admx-hotspotauth.md +++ b/windows/client-management/mdm/policy-csp-admx-hotspotauth.md @@ -1,14 +1,7 @@ --- title: ADMX_hotspotauth Policy CSP description: Learn more about the ADMX_hotspotauth Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-icm.md b/windows/client-management/mdm/policy-csp-admx-icm.md index b75dbe301d..643e4044d3 100644 --- a/windows/client-management/mdm/policy-csp-admx-icm.md +++ b/windows/client-management/mdm/policy-csp-admx-icm.md @@ -1,14 +1,7 @@ --- title: ADMX_ICM Policy CSP description: Learn more about the ADMX_ICM Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 02/28/2024 --- @@ -850,7 +843,7 @@ Also see the "Configure Error Reporting", "Display Error Notification" and "Disa This policy setting allows you to remove access to Windows Update. -- If you enable this policy setting, all Windows Update features are removed. This includes blocking access to the Windows Update website at , from the Windows Update hyperlink on the Start menu, and also on the Tools menu in Internet Explorer. Windows automatic updating is also disabled; you'll neither be notified about nor will you receive critical updates from Windows Update. This policy setting also prevents Device Manager from automatically installing driver updates from the Windows Update website. +- If you enable this policy setting, all Windows Update features are removed. This includes blocking access to the Windows Update website at `https://windowsupdate.microsoft.com`, from the Windows Update hyperlink on the Start menu, and also on the Tools menu in Internet Explorer. Windows automatic updating is also disabled; you'll neither be notified about nor will you receive critical updates from Windows Update. This policy setting also prevents Device Manager from automatically installing driver updates from the Windows Update website. - If you disable or don't configure this policy setting, users can access the Windows Update website and enable automatic updating to receive notifications and critical updates from Windows Update. diff --git a/windows/client-management/mdm/policy-csp-admx-iis.md b/windows/client-management/mdm/policy-csp-admx-iis.md index 5a1b4f8ae9..d447964117 100644 --- a/windows/client-management/mdm/policy-csp-admx-iis.md +++ b/windows/client-management/mdm/policy-csp-admx-iis.md @@ -1,14 +1,7 @@ --- title: ADMX_IIS Policy CSP description: Learn more about the ADMX_IIS Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-iscsi.md b/windows/client-management/mdm/policy-csp-admx-iscsi.md index 2bb4a2a986..2e5c716a1d 100644 --- a/windows/client-management/mdm/policy-csp-admx-iscsi.md +++ b/windows/client-management/mdm/policy-csp-admx-iscsi.md @@ -1,14 +1,7 @@ --- title: ADMX_iSCSI Policy CSP description: Learn more about the ADMX_iSCSI Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-kdc.md b/windows/client-management/mdm/policy-csp-admx-kdc.md index c9bad00bc5..f972a10971 100644 --- a/windows/client-management/mdm/policy-csp-admx-kdc.md +++ b/windows/client-management/mdm/policy-csp-admx-kdc.md @@ -1,14 +1,7 @@ --- title: ADMX_kdc Policy CSP description: Learn more about the ADMX_kdc Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-kerberos.md b/windows/client-management/mdm/policy-csp-admx-kerberos.md index 267e0d30d2..085ac4f942 100644 --- a/windows/client-management/mdm/policy-csp-admx-kerberos.md +++ b/windows/client-management/mdm/policy-csp-admx-kerberos.md @@ -1,14 +1,7 @@ --- title: ADMX_Kerberos Policy CSP description: Learn more about the ADMX_Kerberos Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-lanmanserver.md b/windows/client-management/mdm/policy-csp-admx-lanmanserver.md index 8cdab26c32..97c9ecc2d4 100644 --- a/windows/client-management/mdm/policy-csp-admx-lanmanserver.md +++ b/windows/client-management/mdm/policy-csp-admx-lanmanserver.md @@ -1,14 +1,7 @@ --- title: ADMX_LanmanServer Policy CSP description: Learn more about the ADMX_LanmanServer Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-lanmanworkstation.md b/windows/client-management/mdm/policy-csp-admx-lanmanworkstation.md index 474035a993..b507c61a1e 100644 --- a/windows/client-management/mdm/policy-csp-admx-lanmanworkstation.md +++ b/windows/client-management/mdm/policy-csp-admx-lanmanworkstation.md @@ -1,14 +1,7 @@ --- title: ADMX_LanmanWorkstation Policy CSP description: Learn more about the ADMX_LanmanWorkstation Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-leakdiagnostic.md b/windows/client-management/mdm/policy-csp-admx-leakdiagnostic.md index 10bfdf7962..067d3135e1 100644 --- a/windows/client-management/mdm/policy-csp-admx-leakdiagnostic.md +++ b/windows/client-management/mdm/policy-csp-admx-leakdiagnostic.md @@ -1,14 +1,7 @@ --- title: ADMX_LeakDiagnostic Policy CSP description: Learn more about the ADMX_LeakDiagnostic Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-linklayertopologydiscovery.md b/windows/client-management/mdm/policy-csp-admx-linklayertopologydiscovery.md index dc36ab7519..469330d891 100644 --- a/windows/client-management/mdm/policy-csp-admx-linklayertopologydiscovery.md +++ b/windows/client-management/mdm/policy-csp-admx-linklayertopologydiscovery.md @@ -1,14 +1,7 @@ --- title: ADMX_LinkLayerTopologyDiscovery Policy CSP description: Learn more about the ADMX_LinkLayerTopologyDiscovery Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-locationprovideradm.md b/windows/client-management/mdm/policy-csp-admx-locationprovideradm.md index c36607194b..970d6b6704 100644 --- a/windows/client-management/mdm/policy-csp-admx-locationprovideradm.md +++ b/windows/client-management/mdm/policy-csp-admx-locationprovideradm.md @@ -1,14 +1,7 @@ --- title: ADMX_LocationProviderAdm Policy CSP description: Learn more about the ADMX_LocationProviderAdm Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-logon.md b/windows/client-management/mdm/policy-csp-admx-logon.md index cf357ba833..dba5786104 100644 --- a/windows/client-management/mdm/policy-csp-admx-logon.md +++ b/windows/client-management/mdm/policy-csp-admx-logon.md @@ -1,14 +1,7 @@ --- title: ADMX_Logon Policy CSP description: Learn more about the ADMX_Logon Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -97,12 +90,7 @@ This policy prevents the user from showing account details (email address or use - -This policy setting disables the acrylic blur effect on logon background image. - -- If you enable this policy, the logon background image shows without blur. - -- If you disable or don't configure this policy, the logon background image adopts the acrylic blur effect. + diff --git a/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md b/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md index 2ed270ebf6..d56fe04616 100644 --- a/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md +++ b/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md @@ -1,14 +1,7 @@ --- title: ADMX_MicrosoftDefenderAntivirus Policy CSP description: Learn more about the ADMX_MicrosoftDefenderAntivirus Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-mmc.md b/windows/client-management/mdm/policy-csp-admx-mmc.md index 33ef1a700b..d127a3b726 100644 --- a/windows/client-management/mdm/policy-csp-admx-mmc.md +++ b/windows/client-management/mdm/policy-csp-admx-mmc.md @@ -1,14 +1,7 @@ --- title: ADMX_MMC Policy CSP description: Learn more about the ADMX_MMC Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-mmcsnapins.md b/windows/client-management/mdm/policy-csp-admx-mmcsnapins.md index d7e7143b0d..d854617402 100644 --- a/windows/client-management/mdm/policy-csp-admx-mmcsnapins.md +++ b/windows/client-management/mdm/policy-csp-admx-mmcsnapins.md @@ -1,14 +1,7 @@ --- title: ADMX_MMCSnapins Policy CSP description: Learn more about the ADMX_MMCSnapins Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-mobilepcmobilitycenter.md b/windows/client-management/mdm/policy-csp-admx-mobilepcmobilitycenter.md index 54c66c7309..7e94f79eac 100644 --- a/windows/client-management/mdm/policy-csp-admx-mobilepcmobilitycenter.md +++ b/windows/client-management/mdm/policy-csp-admx-mobilepcmobilitycenter.md @@ -1,14 +1,7 @@ --- title: ADMX_MobilePCMobilityCenter Policy CSP description: Learn more about the ADMX_MobilePCMobilityCenter Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-mobilepcpresentationsettings.md b/windows/client-management/mdm/policy-csp-admx-mobilepcpresentationsettings.md index bd007d95f0..7fecf79eed 100644 --- a/windows/client-management/mdm/policy-csp-admx-mobilepcpresentationsettings.md +++ b/windows/client-management/mdm/policy-csp-admx-mobilepcpresentationsettings.md @@ -1,14 +1,7 @@ --- title: ADMX_MobilePCPresentationSettings Policy CSP description: Learn more about the ADMX_MobilePCPresentationSettings Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-msapolicy.md b/windows/client-management/mdm/policy-csp-admx-msapolicy.md index 334498bf41..b253142cc0 100644 --- a/windows/client-management/mdm/policy-csp-admx-msapolicy.md +++ b/windows/client-management/mdm/policy-csp-admx-msapolicy.md @@ -1,14 +1,7 @@ --- title: ADMX_MSAPolicy Policy CSP description: Learn more about the ADMX_MSAPolicy Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-msched.md b/windows/client-management/mdm/policy-csp-admx-msched.md index 34c9f09939..7d53cbdc2b 100644 --- a/windows/client-management/mdm/policy-csp-admx-msched.md +++ b/windows/client-management/mdm/policy-csp-admx-msched.md @@ -1,14 +1,7 @@ --- title: ADMX_msched Policy CSP description: Learn more about the ADMX_msched Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-msdt.md b/windows/client-management/mdm/policy-csp-admx-msdt.md index 61b9d77688..33e06d7063 100644 --- a/windows/client-management/mdm/policy-csp-admx-msdt.md +++ b/windows/client-management/mdm/policy-csp-admx-msdt.md @@ -1,14 +1,7 @@ --- title: ADMX_MSDT Policy CSP description: Learn more about the ADMX_MSDT Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-msi.md b/windows/client-management/mdm/policy-csp-admx-msi.md index 881922d5e8..30e507028d 100644 --- a/windows/client-management/mdm/policy-csp-admx-msi.md +++ b/windows/client-management/mdm/policy-csp-admx-msi.md @@ -1,14 +1,7 @@ --- title: ADMX_MSI Policy CSP description: Learn more about the ADMX_MSI Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-msifilerecovery.md b/windows/client-management/mdm/policy-csp-admx-msifilerecovery.md index 90a1241020..e87b0fb09d 100644 --- a/windows/client-management/mdm/policy-csp-admx-msifilerecovery.md +++ b/windows/client-management/mdm/policy-csp-admx-msifilerecovery.md @@ -1,14 +1,7 @@ --- title: ADMX_MsiFileRecovery Policy CSP description: Learn more about the ADMX_MsiFileRecovery Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-mss-legacy.md b/windows/client-management/mdm/policy-csp-admx-mss-legacy.md index c318f50ecd..27e93c1b63 100644 --- a/windows/client-management/mdm/policy-csp-admx-mss-legacy.md +++ b/windows/client-management/mdm/policy-csp-admx-mss-legacy.md @@ -1,14 +1,7 @@ --- title: ADMX_MSS-legacy Policy CSP description: Learn more about the ADMX_MSS-legacy Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-nca.md b/windows/client-management/mdm/policy-csp-admx-nca.md index 62d426d98e..8e47bcbc86 100644 --- a/windows/client-management/mdm/policy-csp-admx-nca.md +++ b/windows/client-management/mdm/policy-csp-admx-nca.md @@ -1,14 +1,7 @@ --- title: ADMX_nca Policy CSP description: Learn more about the ADMX_nca Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-ncsi.md b/windows/client-management/mdm/policy-csp-admx-ncsi.md index 19a7dcb36f..59719047b8 100644 --- a/windows/client-management/mdm/policy-csp-admx-ncsi.md +++ b/windows/client-management/mdm/policy-csp-admx-ncsi.md @@ -1,14 +1,7 @@ --- title: ADMX_NCSI Policy CSP description: Learn more about the ADMX_NCSI Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-netlogon.md b/windows/client-management/mdm/policy-csp-admx-netlogon.md index c9d7247cac..cc98c5cf2d 100644 --- a/windows/client-management/mdm/policy-csp-admx-netlogon.md +++ b/windows/client-management/mdm/policy-csp-admx-netlogon.md @@ -1,14 +1,7 @@ --- title: ADMX_Netlogon Policy CSP description: Learn more about the ADMX_Netlogon Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-networkconnections.md b/windows/client-management/mdm/policy-csp-admx-networkconnections.md index 04f22cb3cf..e65aa855ba 100644 --- a/windows/client-management/mdm/policy-csp-admx-networkconnections.md +++ b/windows/client-management/mdm/policy-csp-admx-networkconnections.md @@ -1,14 +1,7 @@ --- title: ADMX_NetworkConnections Policy CSP description: Learn more about the ADMX_NetworkConnections Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-offlinefiles.md b/windows/client-management/mdm/policy-csp-admx-offlinefiles.md index 6fe146e767..3f4616f1d8 100644 --- a/windows/client-management/mdm/policy-csp-admx-offlinefiles.md +++ b/windows/client-management/mdm/policy-csp-admx-offlinefiles.md @@ -1,14 +1,7 @@ --- title: ADMX_OfflineFiles Policy CSP description: Learn more about the ADMX_OfflineFiles Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-pca.md b/windows/client-management/mdm/policy-csp-admx-pca.md index 362d358dbb..cf28909853 100644 --- a/windows/client-management/mdm/policy-csp-admx-pca.md +++ b/windows/client-management/mdm/policy-csp-admx-pca.md @@ -1,14 +1,7 @@ --- title: ADMX_pca Policy CSP description: Learn more about the ADMX_pca Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-peertopeercaching.md b/windows/client-management/mdm/policy-csp-admx-peertopeercaching.md index d71f78c562..83ba39d5bd 100644 --- a/windows/client-management/mdm/policy-csp-admx-peertopeercaching.md +++ b/windows/client-management/mdm/policy-csp-admx-peertopeercaching.md @@ -1,14 +1,7 @@ --- title: ADMX_PeerToPeerCaching Policy CSP description: Learn more about the ADMX_PeerToPeerCaching Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-pentraining.md b/windows/client-management/mdm/policy-csp-admx-pentraining.md index f6c7cd6556..1f8f990c0e 100644 --- a/windows/client-management/mdm/policy-csp-admx-pentraining.md +++ b/windows/client-management/mdm/policy-csp-admx-pentraining.md @@ -1,14 +1,7 @@ --- title: ADMX_PenTraining Policy CSP description: Learn more about the ADMX_PenTraining Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-performancediagnostics.md b/windows/client-management/mdm/policy-csp-admx-performancediagnostics.md index 4668a2c205..510a54b8fa 100644 --- a/windows/client-management/mdm/policy-csp-admx-performancediagnostics.md +++ b/windows/client-management/mdm/policy-csp-admx-performancediagnostics.md @@ -1,14 +1,7 @@ --- title: ADMX_PerformanceDiagnostics Policy CSP description: Learn more about the ADMX_PerformanceDiagnostics Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-power.md b/windows/client-management/mdm/policy-csp-admx-power.md index df3ab6fb49..d329f3a34e 100644 --- a/windows/client-management/mdm/policy-csp-admx-power.md +++ b/windows/client-management/mdm/policy-csp-admx-power.md @@ -1,14 +1,7 @@ --- title: ADMX_Power Policy CSP description: Learn more about the ADMX_Power Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 10/23/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-powershellexecutionpolicy.md b/windows/client-management/mdm/policy-csp-admx-powershellexecutionpolicy.md index 68f10aa963..bea468e20c 100644 --- a/windows/client-management/mdm/policy-csp-admx-powershellexecutionpolicy.md +++ b/windows/client-management/mdm/policy-csp-admx-powershellexecutionpolicy.md @@ -1,14 +1,7 @@ --- title: ADMX_PowerShellExecutionPolicy Policy CSP description: Learn more about the ADMX_PowerShellExecutionPolicy Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-previousversions.md b/windows/client-management/mdm/policy-csp-admx-previousversions.md index 12298c8668..f9552c2c37 100644 --- a/windows/client-management/mdm/policy-csp-admx-previousversions.md +++ b/windows/client-management/mdm/policy-csp-admx-previousversions.md @@ -1,14 +1,7 @@ --- title: ADMX_PreviousVersions Policy CSP description: Learn more about the ADMX_PreviousVersions Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-printing.md b/windows/client-management/mdm/policy-csp-admx-printing.md index 4e7b8d6bf5..712df5a4c8 100644 --- a/windows/client-management/mdm/policy-csp-admx-printing.md +++ b/windows/client-management/mdm/policy-csp-admx-printing.md @@ -1,14 +1,7 @@ --- title: ADMX_Printing Policy CSP description: Learn more about the ADMX_Printing Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-printing2.md b/windows/client-management/mdm/policy-csp-admx-printing2.md index a30b68056b..c687d9136e 100644 --- a/windows/client-management/mdm/policy-csp-admx-printing2.md +++ b/windows/client-management/mdm/policy-csp-admx-printing2.md @@ -1,14 +1,7 @@ --- title: ADMX_Printing2 Policy CSP description: Learn more about the ADMX_Printing2 Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-programs.md b/windows/client-management/mdm/policy-csp-admx-programs.md index ce4953e2bd..5548050a9c 100644 --- a/windows/client-management/mdm/policy-csp-admx-programs.md +++ b/windows/client-management/mdm/policy-csp-admx-programs.md @@ -1,14 +1,7 @@ --- title: ADMX_Programs Policy CSP description: Learn more about the ADMX_Programs Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-pushtoinstall.md b/windows/client-management/mdm/policy-csp-admx-pushtoinstall.md index f4c90fd2f1..806d9651ce 100644 --- a/windows/client-management/mdm/policy-csp-admx-pushtoinstall.md +++ b/windows/client-management/mdm/policy-csp-admx-pushtoinstall.md @@ -1,14 +1,7 @@ --- title: ADMX_PushToInstall Policy CSP description: Learn more about the ADMX_PushToInstall Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-qos.md b/windows/client-management/mdm/policy-csp-admx-qos.md index 88eb3a3e85..c19234a322 100644 --- a/windows/client-management/mdm/policy-csp-admx-qos.md +++ b/windows/client-management/mdm/policy-csp-admx-qos.md @@ -1,14 +1,7 @@ --- title: ADMX_QOS Policy CSP description: Learn more about the ADMX_QOS Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-radar.md b/windows/client-management/mdm/policy-csp-admx-radar.md index 787f2686d2..2d7bb746e9 100644 --- a/windows/client-management/mdm/policy-csp-admx-radar.md +++ b/windows/client-management/mdm/policy-csp-admx-radar.md @@ -1,14 +1,7 @@ --- title: ADMX_Radar Policy CSP description: Learn more about the ADMX_Radar Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-reliability.md b/windows/client-management/mdm/policy-csp-admx-reliability.md index 0c9e9c4c91..20c59c50f0 100644 --- a/windows/client-management/mdm/policy-csp-admx-reliability.md +++ b/windows/client-management/mdm/policy-csp-admx-reliability.md @@ -1,14 +1,7 @@ --- title: ADMX_Reliability Policy CSP description: Learn more about the ADMX_Reliability Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-remoteassistance.md b/windows/client-management/mdm/policy-csp-admx-remoteassistance.md index b3b804deb2..d6b3127e2e 100644 --- a/windows/client-management/mdm/policy-csp-admx-remoteassistance.md +++ b/windows/client-management/mdm/policy-csp-admx-remoteassistance.md @@ -1,14 +1,7 @@ --- title: ADMX_RemoteAssistance Policy CSP description: Learn more about the ADMX_RemoteAssistance Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-removablestorage.md b/windows/client-management/mdm/policy-csp-admx-removablestorage.md index 3184140eb7..8e706aa2c0 100644 --- a/windows/client-management/mdm/policy-csp-admx-removablestorage.md +++ b/windows/client-management/mdm/policy-csp-admx-removablestorage.md @@ -1,14 +1,7 @@ --- title: ADMX_RemovableStorage Policy CSP description: Learn more about the ADMX_RemovableStorage Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-rpc.md b/windows/client-management/mdm/policy-csp-admx-rpc.md index 7c8406a263..613e1bb668 100644 --- a/windows/client-management/mdm/policy-csp-admx-rpc.md +++ b/windows/client-management/mdm/policy-csp-admx-rpc.md @@ -1,14 +1,7 @@ --- title: ADMX_RPC Policy CSP description: Learn more about the ADMX_RPC Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-sam.md b/windows/client-management/mdm/policy-csp-admx-sam.md index f50403b71b..1427a02daf 100644 --- a/windows/client-management/mdm/policy-csp-admx-sam.md +++ b/windows/client-management/mdm/policy-csp-admx-sam.md @@ -1,14 +1,7 @@ --- title: ADMX_sam Policy CSP description: Learn more about the ADMX_sam Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-scripts.md b/windows/client-management/mdm/policy-csp-admx-scripts.md index 787caffb91..a507a7dc14 100644 --- a/windows/client-management/mdm/policy-csp-admx-scripts.md +++ b/windows/client-management/mdm/policy-csp-admx-scripts.md @@ -1,14 +1,7 @@ --- title: ADMX_Scripts Policy CSP description: Learn more about the ADMX_Scripts Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-sdiageng.md b/windows/client-management/mdm/policy-csp-admx-sdiageng.md index 6d21f4a202..c23bf10950 100644 --- a/windows/client-management/mdm/policy-csp-admx-sdiageng.md +++ b/windows/client-management/mdm/policy-csp-admx-sdiageng.md @@ -1,14 +1,7 @@ --- title: ADMX_sdiageng Policy CSP description: Learn more about the ADMX_sdiageng Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-sdiagschd.md b/windows/client-management/mdm/policy-csp-admx-sdiagschd.md index 7fe4560ed8..a221dc34b5 100644 --- a/windows/client-management/mdm/policy-csp-admx-sdiagschd.md +++ b/windows/client-management/mdm/policy-csp-admx-sdiagschd.md @@ -1,14 +1,7 @@ --- title: ADMX_sdiagschd Policy CSP description: Learn more about the ADMX_sdiagschd Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-securitycenter.md b/windows/client-management/mdm/policy-csp-admx-securitycenter.md index b485aeaea3..fd54e1f891 100644 --- a/windows/client-management/mdm/policy-csp-admx-securitycenter.md +++ b/windows/client-management/mdm/policy-csp-admx-securitycenter.md @@ -1,14 +1,7 @@ --- title: ADMX_Securitycenter Policy CSP description: Learn more about the ADMX_Securitycenter Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-sensors.md b/windows/client-management/mdm/policy-csp-admx-sensors.md index 467b0c299b..6c890631d8 100644 --- a/windows/client-management/mdm/policy-csp-admx-sensors.md +++ b/windows/client-management/mdm/policy-csp-admx-sensors.md @@ -1,14 +1,7 @@ --- title: ADMX_Sensors Policy CSP description: Learn more about the ADMX_Sensors Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-servermanager.md b/windows/client-management/mdm/policy-csp-admx-servermanager.md index 2e0010499f..0af31e3dda 100644 --- a/windows/client-management/mdm/policy-csp-admx-servermanager.md +++ b/windows/client-management/mdm/policy-csp-admx-servermanager.md @@ -1,14 +1,7 @@ --- title: ADMX_ServerManager Policy CSP description: Learn more about the ADMX_ServerManager Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-servicing.md b/windows/client-management/mdm/policy-csp-admx-servicing.md index 8a4ae0fb37..a31799041a 100644 --- a/windows/client-management/mdm/policy-csp-admx-servicing.md +++ b/windows/client-management/mdm/policy-csp-admx-servicing.md @@ -1,14 +1,7 @@ --- title: ADMX_Servicing Policy CSP description: Learn more about the ADMX_Servicing Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-settingsync.md b/windows/client-management/mdm/policy-csp-admx-settingsync.md index 27aef62087..5b949ace6f 100644 --- a/windows/client-management/mdm/policy-csp-admx-settingsync.md +++ b/windows/client-management/mdm/policy-csp-admx-settingsync.md @@ -1,14 +1,7 @@ --- title: ADMX_SettingSync Policy CSP description: Learn more about the ADMX_SettingSync Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-sharedfolders.md b/windows/client-management/mdm/policy-csp-admx-sharedfolders.md index 78196c2803..486085f08a 100644 --- a/windows/client-management/mdm/policy-csp-admx-sharedfolders.md +++ b/windows/client-management/mdm/policy-csp-admx-sharedfolders.md @@ -1,14 +1,7 @@ --- title: ADMX_SharedFolders Policy CSP description: Learn more about the ADMX_SharedFolders Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-sharing.md b/windows/client-management/mdm/policy-csp-admx-sharing.md index 5af4415dfe..a83e821101 100644 --- a/windows/client-management/mdm/policy-csp-admx-sharing.md +++ b/windows/client-management/mdm/policy-csp-admx-sharing.md @@ -1,14 +1,7 @@ --- title: ADMX_Sharing Policy CSP description: Learn more about the ADMX_Sharing Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-shellcommandpromptregedittools.md b/windows/client-management/mdm/policy-csp-admx-shellcommandpromptregedittools.md index 97565d0fc8..228d08b694 100644 --- a/windows/client-management/mdm/policy-csp-admx-shellcommandpromptregedittools.md +++ b/windows/client-management/mdm/policy-csp-admx-shellcommandpromptregedittools.md @@ -1,14 +1,7 @@ --- title: ADMX_ShellCommandPromptRegEditTools Policy CSP description: Learn more about the ADMX_ShellCommandPromptRegEditTools Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-smartcard.md b/windows/client-management/mdm/policy-csp-admx-smartcard.md index a427fcd365..22338b85ad 100644 --- a/windows/client-management/mdm/policy-csp-admx-smartcard.md +++ b/windows/client-management/mdm/policy-csp-admx-smartcard.md @@ -1,14 +1,7 @@ --- title: ADMX_Smartcard Policy CSP description: Learn more about the ADMX_Smartcard Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-snmp.md b/windows/client-management/mdm/policy-csp-admx-snmp.md index 36d22a34e9..0d2382bb64 100644 --- a/windows/client-management/mdm/policy-csp-admx-snmp.md +++ b/windows/client-management/mdm/policy-csp-admx-snmp.md @@ -1,14 +1,7 @@ --- title: ADMX_Snmp Policy CSP description: Learn more about the ADMX_Snmp Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-soundrec.md b/windows/client-management/mdm/policy-csp-admx-soundrec.md index ead22da785..41cf4a6ccc 100644 --- a/windows/client-management/mdm/policy-csp-admx-soundrec.md +++ b/windows/client-management/mdm/policy-csp-admx-soundrec.md @@ -1,14 +1,7 @@ --- title: ADMX_SoundRec Policy CSP description: Learn more about the ADMX_SoundRec Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-srmfci.md b/windows/client-management/mdm/policy-csp-admx-srmfci.md index 1758b042bb..7fc90a1ff0 100644 --- a/windows/client-management/mdm/policy-csp-admx-srmfci.md +++ b/windows/client-management/mdm/policy-csp-admx-srmfci.md @@ -1,14 +1,7 @@ --- title: ADMX_srmfci Policy CSP description: Learn more about the ADMX_srmfci Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-startmenu.md b/windows/client-management/mdm/policy-csp-admx-startmenu.md index ea6c920ff9..387bcff31c 100644 --- a/windows/client-management/mdm/policy-csp-admx-startmenu.md +++ b/windows/client-management/mdm/policy-csp-admx-startmenu.md @@ -1,14 +1,7 @@ --- title: ADMX_StartMenu Policy CSP description: Learn more about the ADMX_StartMenu Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 04/10/2024 --- @@ -3584,7 +3577,7 @@ This policy setting allows you to remove links and access to Windows Update. - If you enable this policy setting, users are prevented from connecting to the Windows Update Web site. -Enabling this policy setting blocks user access to the Windows Update Web site at< https://windowsupdate.microsoft.com>. Also, the policy setting removes the Windows Update hyperlink from the Start menu and from the Tools menu in Internet Explorer. +Enabling this policy setting blocks user access to the Windows Update Web site at `https://windowsupdate.microsoft.com`. Also, the policy setting removes the Windows Update hyperlink from the Start menu and from the Tools menu in Internet Explorer. Windows Update, the online extension of Windows, offers software updates to keep a user's system up-to-date. The Windows Update Product Catalog determines any system files, security fixes, and Microsoft updates that users need and shows the newest versions available for download. diff --git a/windows/client-management/mdm/policy-csp-admx-systemrestore.md b/windows/client-management/mdm/policy-csp-admx-systemrestore.md index c3c396e287..2e1c03774b 100644 --- a/windows/client-management/mdm/policy-csp-admx-systemrestore.md +++ b/windows/client-management/mdm/policy-csp-admx-systemrestore.md @@ -1,14 +1,7 @@ --- title: ADMX_SystemRestore Policy CSP description: Learn more about the ADMX_SystemRestore Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-tabletpcinputpanel.md b/windows/client-management/mdm/policy-csp-admx-tabletpcinputpanel.md index c031995861..e7b2fb7d4a 100644 --- a/windows/client-management/mdm/policy-csp-admx-tabletpcinputpanel.md +++ b/windows/client-management/mdm/policy-csp-admx-tabletpcinputpanel.md @@ -1,14 +1,7 @@ --- title: ADMX_TabletPCInputPanel Policy CSP description: Learn more about the ADMX_TabletPCInputPanel Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-tabletshell.md b/windows/client-management/mdm/policy-csp-admx-tabletshell.md index 6682bc155c..7ee90e1830 100644 --- a/windows/client-management/mdm/policy-csp-admx-tabletshell.md +++ b/windows/client-management/mdm/policy-csp-admx-tabletshell.md @@ -1,14 +1,7 @@ --- title: ADMX_TabletShell Policy CSP description: Learn more about the ADMX_TabletShell Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-taskbar.md b/windows/client-management/mdm/policy-csp-admx-taskbar.md index 97e296b53b..176660f30b 100644 --- a/windows/client-management/mdm/policy-csp-admx-taskbar.md +++ b/windows/client-management/mdm/policy-csp-admx-taskbar.md @@ -1,14 +1,7 @@ --- title: ADMX_Taskbar Policy CSP description: Learn more about the ADMX_Taskbar Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -105,16 +98,7 @@ A reboot is required for this policy setting to take effect. - -This policy disables the functionality that converts balloons to toast notifications. - -- If you enable this policy setting, system and application notifications will render as balloons instead of toast notifications. - -Enable this policy setting if a specific app or system component that uses balloon notifications has compatibility issues with toast notifications. - -- If you disable or don't configure this policy setting, all notifications will appear as toast notifications. - -A reboot is required for this policy setting to take effect. + diff --git a/windows/client-management/mdm/policy-csp-admx-tcpip.md b/windows/client-management/mdm/policy-csp-admx-tcpip.md index efef32bb83..a394a7a264 100644 --- a/windows/client-management/mdm/policy-csp-admx-tcpip.md +++ b/windows/client-management/mdm/policy-csp-admx-tcpip.md @@ -1,14 +1,7 @@ --- title: ADMX_tcpip Policy CSP description: Learn more about the ADMX_tcpip Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-terminalserver.md b/windows/client-management/mdm/policy-csp-admx-terminalserver.md index d7950d1ff0..42757e235e 100644 --- a/windows/client-management/mdm/policy-csp-admx-terminalserver.md +++ b/windows/client-management/mdm/policy-csp-admx-terminalserver.md @@ -1,14 +1,7 @@ --- title: ADMX_TerminalServer Policy CSP description: Learn more about the ADMX_TerminalServer Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 06/28/2024 --- @@ -1368,7 +1361,7 @@ Note: 1. For connections from client computers that are using Remote Desktop Protocol 7.1 or earlier versions that are connecting to computers running at least Windows 8 or Windows Server 2012, the minimum of the following values is used as the color depth format: -a. Value specified by this policy setting b. Maximum color depth supported by the client c. Value requested by the client. +a. Value specified by this policy setting b. Maximum color depth supported by the client c. Value requested by the client. If the client doesn't support at least 16 bits, the connection is terminated. @@ -2945,7 +2938,7 @@ This policy setting determines whether a user will be prompted on the client com -This policy setting specifies the default connection URL for RemoteApp and Desktop Connections. The default connection URL is a specific connection that can only be configured by using Group Policy. In addition to the capabilities that are common to all connections, the default connection URL allows document file types to be associated with RemoteApp programs. +This policy setting specifies the default connection URL for RemoteApp and Desktop Connections. In addition to the capabilities that are common to all connections, the default connection URL allows document file types to be associated with RemoteApp programs. The default connection URL must be configured in the form of< https://contoso.com/rdweb/Feed/webfeed.aspx>. diff --git a/windows/client-management/mdm/policy-csp-admx-thumbnails.md b/windows/client-management/mdm/policy-csp-admx-thumbnails.md index aa937ea978..1b7747fb27 100644 --- a/windows/client-management/mdm/policy-csp-admx-thumbnails.md +++ b/windows/client-management/mdm/policy-csp-admx-thumbnails.md @@ -1,14 +1,7 @@ --- title: ADMX_Thumbnails Policy CSP description: Learn more about the ADMX_Thumbnails Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-touchinput.md b/windows/client-management/mdm/policy-csp-admx-touchinput.md index 2442bd1a0c..90a38cf981 100644 --- a/windows/client-management/mdm/policy-csp-admx-touchinput.md +++ b/windows/client-management/mdm/policy-csp-admx-touchinput.md @@ -1,14 +1,7 @@ --- title: ADMX_TouchInput Policy CSP description: Learn more about the ADMX_TouchInput Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-tpm.md b/windows/client-management/mdm/policy-csp-admx-tpm.md index c0de908883..299bc993aa 100644 --- a/windows/client-management/mdm/policy-csp-admx-tpm.md +++ b/windows/client-management/mdm/policy-csp-admx-tpm.md @@ -1,14 +1,7 @@ --- title: ADMX_TPM Policy CSP description: Learn more about the ADMX_TPM Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization.md b/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization.md index c89a4542be..5df403b933 100644 --- a/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization.md +++ b/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization.md @@ -1,14 +1,7 @@ --- title: ADMX_UserExperienceVirtualization Policy CSP description: Learn more about the ADMX_UserExperienceVirtualization Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-userprofiles.md b/windows/client-management/mdm/policy-csp-admx-userprofiles.md index df2fd32ecf..adf0ccefe0 100644 --- a/windows/client-management/mdm/policy-csp-admx-userprofiles.md +++ b/windows/client-management/mdm/policy-csp-admx-userprofiles.md @@ -1,14 +1,7 @@ --- title: ADMX_UserProfiles Policy CSP description: Learn more about the ADMX_UserProfiles Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-w32time.md b/windows/client-management/mdm/policy-csp-admx-w32time.md index 4c34ddc617..3aaf1c7335 100644 --- a/windows/client-management/mdm/policy-csp-admx-w32time.md +++ b/windows/client-management/mdm/policy-csp-admx-w32time.md @@ -1,14 +1,7 @@ --- title: ADMX_W32Time Policy CSP description: Learn more about the ADMX_W32Time Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-wcm.md b/windows/client-management/mdm/policy-csp-admx-wcm.md index 2daf25532c..e6fe0c1726 100644 --- a/windows/client-management/mdm/policy-csp-admx-wcm.md +++ b/windows/client-management/mdm/policy-csp-admx-wcm.md @@ -1,14 +1,7 @@ --- title: ADMX_WCM Policy CSP description: Learn more about the ADMX_WCM Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-wdi.md b/windows/client-management/mdm/policy-csp-admx-wdi.md index 14371f71cf..df4c5846ad 100644 --- a/windows/client-management/mdm/policy-csp-admx-wdi.md +++ b/windows/client-management/mdm/policy-csp-admx-wdi.md @@ -1,14 +1,7 @@ --- title: ADMX_WDI Policy CSP description: Learn more about the ADMX_WDI Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-wincal.md b/windows/client-management/mdm/policy-csp-admx-wincal.md index 97141edb41..31833306d1 100644 --- a/windows/client-management/mdm/policy-csp-admx-wincal.md +++ b/windows/client-management/mdm/policy-csp-admx-wincal.md @@ -1,14 +1,7 @@ --- title: ADMX_WinCal Policy CSP description: Learn more about the ADMX_WinCal Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-windowscolorsystem.md b/windows/client-management/mdm/policy-csp-admx-windowscolorsystem.md index c7c06a9fc3..2055d516ec 100644 --- a/windows/client-management/mdm/policy-csp-admx-windowscolorsystem.md +++ b/windows/client-management/mdm/policy-csp-admx-windowscolorsystem.md @@ -1,14 +1,7 @@ --- title: ADMX_WindowsColorSystem Policy CSP description: Learn more about the ADMX_WindowsColorSystem Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-windowsconnectnow.md b/windows/client-management/mdm/policy-csp-admx-windowsconnectnow.md index 10dcf61ff3..b115f7d5e2 100644 --- a/windows/client-management/mdm/policy-csp-admx-windowsconnectnow.md +++ b/windows/client-management/mdm/policy-csp-admx-windowsconnectnow.md @@ -1,14 +1,7 @@ --- title: ADMX_WindowsConnectNow Policy CSP description: Learn more about the ADMX_WindowsConnectNow Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-windowsexplorer.md b/windows/client-management/mdm/policy-csp-admx-windowsexplorer.md index 33ab184dc5..aa8dc35733 100644 --- a/windows/client-management/mdm/policy-csp-admx-windowsexplorer.md +++ b/windows/client-management/mdm/policy-csp-admx-windowsexplorer.md @@ -1,14 +1,7 @@ --- title: ADMX_WindowsExplorer Policy CSP description: Learn more about the ADMX_WindowsExplorer Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 06/28/2024 --- @@ -463,6 +456,56 @@ You can specify a known folder using its known folder id or using its canonical + +## DisableMotWOnInsecurePathCopy + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 2004 [10.0.19041.1202] and later
                        ✅ Windows 10, version 2009 [10.0.19042.1202] and later
                        ✅ Windows 10, version 21H1 [10.0.19043.1202] and later
                        ✅ Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_WindowsExplorer/DisableMotWOnInsecurePathCopy +``` + + + + + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `chr` (string) | +| Access Type | Add, Delete, Get, Replace | + + + + +[!INCLUDE [ADMX-backed policy note](includes/mdm-admx-policy-note.md)] + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | DisableMotWOnInsecurePathCopy | +| ADMX File Name | WindowsExplorer.admx | + + + + + + + + ## DisableSearchBoxSuggestions diff --git a/windows/client-management/mdm/policy-csp-admx-windowsmediadrm.md b/windows/client-management/mdm/policy-csp-admx-windowsmediadrm.md index 9476a4fabb..dbd36541c4 100644 --- a/windows/client-management/mdm/policy-csp-admx-windowsmediadrm.md +++ b/windows/client-management/mdm/policy-csp-admx-windowsmediadrm.md @@ -1,14 +1,7 @@ --- title: ADMX_WindowsMediaDRM Policy CSP description: Learn more about the ADMX_WindowsMediaDRM Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-windowsmediaplayer.md b/windows/client-management/mdm/policy-csp-admx-windowsmediaplayer.md index 46150339f6..04df21d7a7 100644 --- a/windows/client-management/mdm/policy-csp-admx-windowsmediaplayer.md +++ b/windows/client-management/mdm/policy-csp-admx-windowsmediaplayer.md @@ -1,14 +1,7 @@ --- title: ADMX_WindowsMediaPlayer Policy CSP description: Learn more about the ADMX_WindowsMediaPlayer Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-windowsremotemanagement.md b/windows/client-management/mdm/policy-csp-admx-windowsremotemanagement.md index 3a972ef92a..9feebc0561 100644 --- a/windows/client-management/mdm/policy-csp-admx-windowsremotemanagement.md +++ b/windows/client-management/mdm/policy-csp-admx-windowsremotemanagement.md @@ -1,14 +1,7 @@ --- title: ADMX_WindowsRemoteManagement Policy CSP description: Learn more about the ADMX_WindowsRemoteManagement Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-windowsstore.md b/windows/client-management/mdm/policy-csp-admx-windowsstore.md index 757279b2fc..aaadbfb085 100644 --- a/windows/client-management/mdm/policy-csp-admx-windowsstore.md +++ b/windows/client-management/mdm/policy-csp-admx-windowsstore.md @@ -1,14 +1,7 @@ --- title: ADMX_WindowsStore Policy CSP description: Learn more about the ADMX_WindowsStore Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 07/08/2024 --- @@ -207,7 +200,7 @@ Enables or disables the Store offer to update to the latest version of Windows. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ❌ Device
                        ✅ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 2004 [10.0.19041.1202] and later
                        ✅ Windows 10, version 2009 [10.0.19042.1202] and later
                        ✅ Windows 10, version 21H1 [10.0.19043.1202] and later
                        ✅ Windows 11, version 21H2 [10.0.22000] and later | +| ❌ Device
                        ✅ User | ❌ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 2004 [10.0.19041.1202] and later
                        ✅ Windows 10, version 2009 [10.0.19042.1202] and later
                        ✅ Windows 10, version 21H1 [10.0.19043.1202] and later
                        ✅ Windows 11, version 21H2 [10.0.22000] and later | @@ -227,8 +220,6 @@ Denies or allows access to the Store application. -> [!NOTE] -> This policy is not supported on Windows Professional edition, and requires Windows Enterprise or Windows Education to function. For more information, see [Can't disable Microsoft Store in Windows Pro through Group Policy](/troubleshoot/windows-client/group-policy/cannot-disable-microsoft-store). @@ -268,7 +259,7 @@ Denies or allows access to the Store application. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 2004 [10.0.19041.1202] and later
                        ✅ Windows 10, version 2009 [10.0.19042.1202] and later
                        ✅ Windows 10, version 21H1 [10.0.19043.1202] and later
                        ✅ Windows 11, version 21H2 [10.0.22000] and later | +| ✅ Device
                        ❌ User | ❌ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 2004 [10.0.19041.1202] and later
                        ✅ Windows 10, version 2009 [10.0.19042.1202] and later
                        ✅ Windows 10, version 21H1 [10.0.19043.1202] and later
                        ✅ Windows 11, version 21H2 [10.0.22000] and later | @@ -288,8 +279,6 @@ Denies or allows access to the Store application. -> [!NOTE] -> This policy is not supported on Windows Professional edition, and requires Windows Enterprise or Windows Education to function. For more information, see [Can't disable Microsoft Store in Windows Pro through Group Policy](/troubleshoot/windows-client/group-policy/cannot-disable-microsoft-store). diff --git a/windows/client-management/mdm/policy-csp-admx-wininit.md b/windows/client-management/mdm/policy-csp-admx-wininit.md index b4561c36e3..016d00fda3 100644 --- a/windows/client-management/mdm/policy-csp-admx-wininit.md +++ b/windows/client-management/mdm/policy-csp-admx-wininit.md @@ -1,14 +1,7 @@ --- title: ADMX_WinInit Policy CSP description: Learn more about the ADMX_WinInit Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-winlogon.md b/windows/client-management/mdm/policy-csp-admx-winlogon.md index e9191d0a40..7861b20555 100644 --- a/windows/client-management/mdm/policy-csp-admx-winlogon.md +++ b/windows/client-management/mdm/policy-csp-admx-winlogon.md @@ -1,14 +1,7 @@ --- title: ADMX_WinLogon Policy CSP description: Learn more about the ADMX_WinLogon Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-winsrv.md b/windows/client-management/mdm/policy-csp-admx-winsrv.md index f92cba7883..56d9974fe2 100644 --- a/windows/client-management/mdm/policy-csp-admx-winsrv.md +++ b/windows/client-management/mdm/policy-csp-admx-winsrv.md @@ -1,14 +1,7 @@ --- title: ADMX_Winsrv Policy CSP description: Learn more about the ADMX_Winsrv Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -38,12 +31,7 @@ ms.topic: reference - -This policy setting specifies whether Windows will allow console applications and GUI applications without visible top-level windows to block or cancel shutdown. By default, such applications are automatically terminated if they attempt to cancel shutdown or block it indefinitely. - -- If you enable this setting, console applications or GUI applications without visible top-level windows that block or cancel shutdown won't be automatically terminated during shutdown. - -- If you disable or don't configure this setting, these applications will be automatically terminated during shutdown, helping to ensure that Windows can shut down faster and more smoothly. + diff --git a/windows/client-management/mdm/policy-csp-admx-wlansvc.md b/windows/client-management/mdm/policy-csp-admx-wlansvc.md index 67f7fd4932..d09a2030f0 100644 --- a/windows/client-management/mdm/policy-csp-admx-wlansvc.md +++ b/windows/client-management/mdm/policy-csp-admx-wlansvc.md @@ -1,14 +1,7 @@ --- title: ADMX_wlansvc Policy CSP description: Learn more about the ADMX_wlansvc Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-wordwheel.md b/windows/client-management/mdm/policy-csp-admx-wordwheel.md index 8217f78031..a71623c248 100644 --- a/windows/client-management/mdm/policy-csp-admx-wordwheel.md +++ b/windows/client-management/mdm/policy-csp-admx-wordwheel.md @@ -1,14 +1,7 @@ --- title: ADMX_WordWheel Policy CSP description: Learn more about the ADMX_WordWheel Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-workfoldersclient.md b/windows/client-management/mdm/policy-csp-admx-workfoldersclient.md index 90b757d7e6..f5b3d60f6b 100644 --- a/windows/client-management/mdm/policy-csp-admx-workfoldersclient.md +++ b/windows/client-management/mdm/policy-csp-admx-workfoldersclient.md @@ -1,14 +1,7 @@ --- title: ADMX_WorkFoldersClient Policy CSP description: Learn more about the ADMX_WorkFoldersClient Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-wpn.md b/windows/client-management/mdm/policy-csp-admx-wpn.md index 3a2751af33..f69b55da60 100644 --- a/windows/client-management/mdm/policy-csp-admx-wpn.md +++ b/windows/client-management/mdm/policy-csp-admx-wpn.md @@ -1,14 +1,7 @@ --- title: ADMX_WPN Policy CSP description: Learn more about the ADMX_WPN Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-applicationdefaults.md b/windows/client-management/mdm/policy-csp-applicationdefaults.md index f51f27e3ee..ee6da319a3 100644 --- a/windows/client-management/mdm/policy-csp-applicationdefaults.md +++ b/windows/client-management/mdm/policy-csp-applicationdefaults.md @@ -1,14 +1,7 @@ --- title: ApplicationDefaults Policy CSP description: Learn more about the ApplicationDefaults Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -37,7 +30,7 @@ ms.topic: reference -This policy allows an administrator to set default file type and protocol associations. When set, default associations will be applied on sign-in to the PC. The association file can be created using the DISM tool (dism /online /export-defaultappassociations:appassoc. xml), and then needs to be base64 encoded before being added to SyncML. If policy is enabled and the client machine is Microsoft Entra joined, the associations assigned in SyncML will be processed and default associations will be applied. +This policy allows an administrator to set default file type and protocol associations. When set, default associations will be applied on sign-in to the PC. The association file can be created using the DISM tool (dism /online /export-defaultappassociations:appassoc.xml). The file can be further edited by adding attributes to control how often associations are applied by the policy. The file then needs to be base64 encoded before being added to SyncML. If policy is enabled and the client machine is Microsoft Entra joined, the associations assigned in SyncML will be processed and default associations will be applied. diff --git a/windows/client-management/mdm/policy-csp-applicationmanagement.md b/windows/client-management/mdm/policy-csp-applicationmanagement.md index 15396470d3..7b1698c462 100644 --- a/windows/client-management/mdm/policy-csp-applicationmanagement.md +++ b/windows/client-management/mdm/policy-csp-applicationmanagement.md @@ -1,14 +1,7 @@ --- title: ApplicationManagement Policy CSP description: Learn more about the ApplicationManagement Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 04/10/2024 --- @@ -435,7 +428,7 @@ Manages a Windows app's ability to share data between users who have installed t | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ❌ Pro
                        ✅ Enterprise
                        ✅ Education
                        ❌ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1507 [10.0.10240] and later | +| ✅ Device
                        ❌ User | Not applicable | ✅ Windows 10, version 1507 [10.0.10240] and later | @@ -487,7 +480,7 @@ This policy is deprecated. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1507 [10.0.10240] and later | +| ✅ Device
                        ❌ User | Not applicable | ✅ Windows 10, version 1507 [10.0.10240] and later | diff --git a/windows/client-management/mdm/policy-csp-appruntime.md b/windows/client-management/mdm/policy-csp-appruntime.md index c80e7472b4..20cddfc183 100644 --- a/windows/client-management/mdm/policy-csp-appruntime.md +++ b/windows/client-management/mdm/policy-csp-appruntime.md @@ -1,14 +1,7 @@ --- title: AppRuntime Policy CSP description: Learn more about the AppRuntime Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-appvirtualization.md b/windows/client-management/mdm/policy-csp-appvirtualization.md index 7cfb9ef14a..6e677aa3b7 100644 --- a/windows/client-management/mdm/policy-csp-appvirtualization.md +++ b/windows/client-management/mdm/policy-csp-appvirtualization.md @@ -1,14 +1,7 @@ --- title: AppVirtualization Policy CSP description: Learn more about the AppVirtualization Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 10/24/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-attachmentmanager.md b/windows/client-management/mdm/policy-csp-attachmentmanager.md index ad924dc539..63caf16da0 100644 --- a/windows/client-management/mdm/policy-csp-attachmentmanager.md +++ b/windows/client-management/mdm/policy-csp-attachmentmanager.md @@ -1,14 +1,7 @@ --- title: AttachmentManager Policy CSP description: Learn more about the AttachmentManager Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-audit.md b/windows/client-management/mdm/policy-csp-audit.md index 174c8e6dd0..c434116039 100644 --- a/windows/client-management/mdm/policy-csp-audit.md +++ b/windows/client-management/mdm/policy-csp-audit.md @@ -1,14 +1,7 @@ --- title: Audit Policy CSP description: Learn more about the Audit Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-authentication.md b/windows/client-management/mdm/policy-csp-authentication.md index 792538bcd5..ebc00056d8 100644 --- a/windows/client-management/mdm/policy-csp-authentication.md +++ b/windows/client-management/mdm/policy-csp-authentication.md @@ -1,14 +1,7 @@ --- title: Authentication Policy CSP description: Learn more about the Authentication Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 10/24/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -16,8 +9,6 @@ ms.topic: reference # Policy CSP - Authentication -[!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)] - @@ -402,7 +393,7 @@ This policy is intended for use on Shared PCs to enable a quick first sign-in ex | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 23H2 [10.0.22631.2506] and later | diff --git a/windows/client-management/mdm/policy-csp-autoplay.md b/windows/client-management/mdm/policy-csp-autoplay.md index fbf76ab56a..f94c675d89 100644 --- a/windows/client-management/mdm/policy-csp-autoplay.md +++ b/windows/client-management/mdm/policy-csp-autoplay.md @@ -1,14 +1,7 @@ --- title: Autoplay Policy CSP description: Learn more about the Autoplay Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-bitlocker.md b/windows/client-management/mdm/policy-csp-bitlocker.md index bdc7ed5eee..85ba82af82 100644 --- a/windows/client-management/mdm/policy-csp-bitlocker.md +++ b/windows/client-management/mdm/policy-csp-bitlocker.md @@ -1,14 +1,7 @@ --- title: Bitlocker Policy CSP description: Learn more about the Bitlocker Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/09/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-bits.md b/windows/client-management/mdm/policy-csp-bits.md index b1d3449ae2..01dbd07987 100644 --- a/windows/client-management/mdm/policy-csp-bits.md +++ b/windows/client-management/mdm/policy-csp-bits.md @@ -1,14 +1,7 @@ --- title: BITS Policy CSP description: Learn more about the BITS Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-bluetooth.md b/windows/client-management/mdm/policy-csp-bluetooth.md index 03ee87d6ff..fc321bd1b1 100644 --- a/windows/client-management/mdm/policy-csp-bluetooth.md +++ b/windows/client-management/mdm/policy-csp-bluetooth.md @@ -1,14 +1,7 @@ --- title: Bluetooth Policy CSP description: Learn more about the Bluetooth Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-browser.md b/windows/client-management/mdm/policy-csp-browser.md index c6cf0c0b0b..88527a21f7 100644 --- a/windows/client-management/mdm/policy-csp-browser.md +++ b/windows/client-management/mdm/policy-csp-browser.md @@ -1,14 +1,7 @@ --- title: Browser Policy CSP description: Learn more about the Browser Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 04/10/2024 --- @@ -185,7 +178,7 @@ To verify AllowAutofill is set to 0 (not allowed): | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ✅ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1507 [10.0.10240] and later | +| ✅ Device
                        ✅ User | Not applicable | ✅ Windows 10, version 1507 [10.0.10240] and later | @@ -2720,7 +2713,7 @@ Important. Discontinued in Windows 10, version 1511. Use the Browser/EnterpriseM | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ✅ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later | +| ✅ Device
                        ✅ User | ❌ Pro
                        ❌ Enterprise
                        ❌ Education
                        ❌ Windows SE
                        ❌ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later | diff --git a/windows/client-management/mdm/policy-csp-camera.md b/windows/client-management/mdm/policy-csp-camera.md index 3f89630a72..3882e07879 100644 --- a/windows/client-management/mdm/policy-csp-camera.md +++ b/windows/client-management/mdm/policy-csp-camera.md @@ -1,14 +1,7 @@ --- title: Camera Policy CSP description: Learn more about the Camera Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-cellular.md b/windows/client-management/mdm/policy-csp-cellular.md index 1e98fdc8f5..a2cfae0564 100644 --- a/windows/client-management/mdm/policy-csp-cellular.md +++ b/windows/client-management/mdm/policy-csp-cellular.md @@ -1,14 +1,7 @@ --- title: Cellular Policy CSP description: Learn more about the Cellular Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-clouddesktop.md b/windows/client-management/mdm/policy-csp-clouddesktop.md index 66d7fcc0ad..cb287ddd00 100644 --- a/windows/client-management/mdm/policy-csp-clouddesktop.md +++ b/windows/client-management/mdm/policy-csp-clouddesktop.md @@ -1,14 +1,7 @@ --- title: CloudDesktop Policy CSP description: Learn more about the CloudDesktop Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 09/14/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-connectivity.md b/windows/client-management/mdm/policy-csp-connectivity.md index 7e0a5b1426..1a15adf8c0 100644 --- a/windows/client-management/mdm/policy-csp-connectivity.md +++ b/windows/client-management/mdm/policy-csp-connectivity.md @@ -1,14 +1,7 @@ --- title: Connectivity Policy CSP description: Learn more about the Connectivity Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 04/10/2024 --- @@ -259,7 +252,7 @@ To validate, the enterprise can confirm by observing the roaming enable switch i | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1507 [10.0.10240] and later | +| ✅ Device
                        ❌ User | Not applicable | ✅ Windows 10, version 1507 [10.0.10240] and later | @@ -382,7 +375,7 @@ Device that has previously opt-in to MMX will also stop showing on the device li | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1507 [10.0.10240] and later | +| ✅ Device
                        ❌ User | ❌ Pro
                        ❌ Enterprise
                        ❌ Education
                        ❌ Windows SE
                        ❌ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1507 [10.0.10240] and later | diff --git a/windows/client-management/mdm/policy-csp-controlpolicyconflict.md b/windows/client-management/mdm/policy-csp-controlpolicyconflict.md index 4c27326f83..cd2bf997f6 100644 --- a/windows/client-management/mdm/policy-csp-controlpolicyconflict.md +++ b/windows/client-management/mdm/policy-csp-controlpolicyconflict.md @@ -1,14 +1,7 @@ --- title: ControlPolicyConflict Policy CSP description: Learn more about the ControlPolicyConflict Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -44,7 +37,7 @@ If set to 1 then any MDM policy that's set that has an equivalent GP policy will > [!NOTE] -> MDMWinsOverGP only applies to policies in Policy CSP. MDM policies win over Group Policies where applicable; not all Group Policies are available via MDM or CSP. It does not apply to other MDM settings with equivalent GP settings that are defined in other CSPs such as the [Defender CSP](defender-csp.md). Nor does it apply to the [Update Policy CSP](policy-csp-update.md) for managing Windows updates. +> MDMWinsOverGP only applies to policies in Policy CSP. MDM policies win over Group Policies where applicable; not all Group Policies are available via MDM or CSP. It does not apply to other MDM settings with equivalent GP settings that are defined in other CSPs such as the [Defender CSP](defender-csp.md). Nor does it apply to the [Update Policy CSP](policy-csp-update.md) for managing Windows updates. This policy is used to ensure that MDM policy wins over GP when policy is configured on MDM channel. The default value is 0. The MDM policies in Policy CSP will behave as described if this policy value is set 1. diff --git a/windows/client-management/mdm/policy-csp-credentialproviders.md b/windows/client-management/mdm/policy-csp-credentialproviders.md index bf6c62f53a..d73b3ade9c 100644 --- a/windows/client-management/mdm/policy-csp-credentialproviders.md +++ b/windows/client-management/mdm/policy-csp-credentialproviders.md @@ -1,14 +1,7 @@ --- title: CredentialProviders Policy CSP description: Learn more about the CredentialProviders Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-credentialsdelegation.md b/windows/client-management/mdm/policy-csp-credentialsdelegation.md index 943113ee1d..af3cee543f 100644 --- a/windows/client-management/mdm/policy-csp-credentialsdelegation.md +++ b/windows/client-management/mdm/policy-csp-credentialsdelegation.md @@ -1,14 +1,7 @@ --- title: CredentialsDelegation Policy CSP description: Learn more about the CredentialsDelegation Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-credentialsui.md b/windows/client-management/mdm/policy-csp-credentialsui.md index 2fb7881948..f6f9d847a7 100644 --- a/windows/client-management/mdm/policy-csp-credentialsui.md +++ b/windows/client-management/mdm/policy-csp-credentialsui.md @@ -1,14 +1,7 @@ --- title: CredentialsUI Policy CSP description: Learn more about the CredentialsUI Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-cryptography.md b/windows/client-management/mdm/policy-csp-cryptography.md index a5874803b9..27aae04079 100644 --- a/windows/client-management/mdm/policy-csp-cryptography.md +++ b/windows/client-management/mdm/policy-csp-cryptography.md @@ -1,14 +1,7 @@ --- title: Cryptography Policy CSP description: Learn more about the Cryptography Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/29/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-dataprotection.md b/windows/client-management/mdm/policy-csp-dataprotection.md index 591e62bd55..ed3d5d84d4 100644 --- a/windows/client-management/mdm/policy-csp-dataprotection.md +++ b/windows/client-management/mdm/policy-csp-dataprotection.md @@ -1,14 +1,7 @@ --- title: DataProtection Policy CSP description: Learn more about the DataProtection Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-datausage.md b/windows/client-management/mdm/policy-csp-datausage.md index 3bb392662b..37ef82f657 100644 --- a/windows/client-management/mdm/policy-csp-datausage.md +++ b/windows/client-management/mdm/policy-csp-datausage.md @@ -1,14 +1,7 @@ --- title: DataUsage Policy CSP description: Learn more about the DataUsage Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-defender.md b/windows/client-management/mdm/policy-csp-defender.md index bca45399aa..a790f24a26 100644 --- a/windows/client-management/mdm/policy-csp-defender.md +++ b/windows/client-management/mdm/policy-csp-defender.md @@ -1,14 +1,7 @@ --- title: Defender Policy CSP description: Learn more about the Defender Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 06/28/2024 --- @@ -409,7 +402,7 @@ This policy setting allows you to manage whether or not to scan for malicious so |:--|:--| | Format | `int` | | Access Type | Add, Delete, Get, Replace | -| Default Value | 1 | +| Default Value | 0 | @@ -417,8 +410,8 @@ This policy setting allows you to manage whether or not to scan for malicious so | Value | Description | |:--|:--| -| 0 | Not allowed. Turns off scanning on removable drives. | -| 1 (Default) | Allowed. Scans removable drives. | +| 0 (Default) | Not allowed. Turns off scanning on removable drives. | +| 1 | Allowed. Scans removable drives. | @@ -719,7 +712,9 @@ Allows or disallows Windows Defender Realtime Monitoring functionality. -This policy setting allows you to configure real-time scanning for files that are accessed over the network. It is recommended to enable this setting. +This policy setting allows you to configure scheduled scans and on-demand (manually initiated) scans for files that are accessed over the network. It is recommended to enable this setting. +>[!NOTE] +> Real-time protection (on-access) scanning is not impacted by this policy. - If you enable this setting or do not configure this setting, network files will be scanned. - If you disable this setting, network files will not be scanned. @@ -1081,7 +1076,7 @@ This policy setting allows you to configure the maximum percentage CPU utilizati > [!NOTE] > If you enable both of the following policies, then Windows ignores the value of **AvgCPULoadFactor**: -> +> > - [ScanOnlyIfIdle](defender-csp.md#configurationscanonlyifidleenabled): Instructs the product to scan only when the computer isn't in use. > - [DisableCpuThrottleOnIdleScans](defender-csp.md#configurationdisablecputhrottleonidlescans): Instructs the product to disable CPU throttling on idle scans. @@ -1550,12 +1545,12 @@ This policy setting defines the number of days items should be kept in the Quara - + This policy setting allows you to configure catch-up scans for scheduled full scans. A catch-up scan is a scan that's initiated because a regularly scheduled scan was missed. Usually these scheduled scans are missed because the computer was turned off at the scheduled time. -- If you enable this setting, catch-up scans for scheduled full scans will be turned on. If a computer is offline for two consecutive scheduled scans, a catch-up scan is started the next time someone logs on to the computer. If there is no scheduled scan configured, there will be no catch-up scan run. +- If you disable or don't configure this setting, catch-up scans for scheduled full scans will be turned on. If a computer is offline for two consecutive scheduled scans, a catch-up scan is started the next time someone logs on to the computer. If there is no scheduled scan configured, there will be no catch-up scan run. -- If you disable or don't configure this setting, catch-up scans for scheduled full scans will be turned off. +- If you enable this setting, catch-up scans for scheduled full scans will be disabled. @@ -1616,16 +1611,16 @@ This policy setting allows you to configure catch-up scans for scheduled full sc - -This policy setting allows you to configure catch-up scans for scheduled quick scans. A catch-up scan is a scan that's initiated because a regularly scheduled scan was missed. Usually these scheduled scans are missed because the computer was turned off at the scheduled time. - -- If you enable this setting, catch-up scans for scheduled quick scans will be turned on. If a computer is offline for two consecutive scheduled scans, a catch-up scan is started the next time someone logs on to the computer. If there is no scheduled scan configured, there will be no catch-up scan run. - -- If you disable or don't configure this setting, catch-up scans for scheduled quick scans will be turned off. + +This policy setting allows you to configure catch-up scans for scheduled quick scans. A catch-up scan is a scan that's initiated because a regularly scheduled scan was missed. Usually these scheduled scans are missed because the computer was turned off at the scheduled time. + +- If you disable or don't configure this setting, catch-up scans for scheduled quick scans will be turned on. If a computer is offline for two consecutive scheduled scans, a catch-up scan is started the next time someone logs on to the computer. If there is no scheduled scan configured, there will be no catch-up scan run. + +- If you enable this setting, catch-up scans for scheduled quick scans will be disabled. diff --git a/windows/client-management/mdm/policy-csp-deliveryoptimization.md b/windows/client-management/mdm/policy-csp-deliveryoptimization.md index 5e4f2838af..6e3f949a36 100644 --- a/windows/client-management/mdm/policy-csp-deliveryoptimization.md +++ b/windows/client-management/mdm/policy-csp-deliveryoptimization.md @@ -1,14 +1,7 @@ --- title: DeliveryOptimization Policy CSP description: Learn more about the DeliveryOptimization Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 06/19/2024 --- @@ -18,6 +11,8 @@ ms.topic: reference [!INCLUDE [ADMX-backed CSP tip](includes/mdm-admx-csp-note.md)] +[!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)] + @@ -507,7 +502,7 @@ The recommended value is 1 minute (60). | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 21H2 [10.0.22000] and later | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621.2361] and later
                        ✅ Windows Insider Preview | @@ -1505,20 +1500,8 @@ The default value 0 (zero) means that Delivery Optimization dynamically adjusts - -Set this policy to restrict peer selection via selected option. - -Options available are: - -0 = NAT. - -1 = Subnet mask. - -2 = Local discovery (DNS-SD). - -The default value has changed from 0 (no restriction) to 1 (restrict to the subnet). - -These options apply to both Download Mode LAN (1) and Group (2). + +Set this policy to restrict peer selection via selected option. Options available are: 1=Subnet mask, 2 = Local discovery (DNS-SD). These options apply to both Download Mode LAN (1) and Group (2). @@ -1687,7 +1670,7 @@ This policy allows an IT Admin to define the following details: | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 21H2 [10.0.22000] and later | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621.2361] and later
                        ✅ Windows Insider Preview | diff --git a/windows/client-management/mdm/policy-csp-desktop.md b/windows/client-management/mdm/policy-csp-desktop.md index 8c7fe07a3d..60c0d9c6aa 100644 --- a/windows/client-management/mdm/policy-csp-desktop.md +++ b/windows/client-management/mdm/policy-csp-desktop.md @@ -1,14 +1,7 @@ --- title: Desktop Policy CSP description: Learn more about the Desktop Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-desktopappinstaller.md b/windows/client-management/mdm/policy-csp-desktopappinstaller.md index e0c33829f6..2b3fea16a4 100644 --- a/windows/client-management/mdm/policy-csp-desktopappinstaller.md +++ b/windows/client-management/mdm/policy-csp-desktopappinstaller.md @@ -1,14 +1,7 @@ --- title: DesktopAppInstaller Policy CSP description: Learn more about the DesktopAppInstaller Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-deviceguard.md b/windows/client-management/mdm/policy-csp-deviceguard.md index fe3ed53290..c27a142696 100644 --- a/windows/client-management/mdm/policy-csp-deviceguard.md +++ b/windows/client-management/mdm/policy-csp-deviceguard.md @@ -1,14 +1,7 @@ --- title: DeviceGuard Policy CSP description: Learn more about the DeviceGuard Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-devicehealthmonitoring.md b/windows/client-management/mdm/policy-csp-devicehealthmonitoring.md index 0f7c4c5589..271866959b 100644 --- a/windows/client-management/mdm/policy-csp-devicehealthmonitoring.md +++ b/windows/client-management/mdm/policy-csp-devicehealthmonitoring.md @@ -1,14 +1,7 @@ --- title: DeviceHealthMonitoring Policy CSP description: Learn more about the DeviceHealthMonitoring Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-deviceinstallation.md b/windows/client-management/mdm/policy-csp-deviceinstallation.md index 601453f34d..88d04325f2 100644 --- a/windows/client-management/mdm/policy-csp-deviceinstallation.md +++ b/windows/client-management/mdm/policy-csp-deviceinstallation.md @@ -1,14 +1,7 @@ --- title: DeviceInstallation Policy CSP description: Learn more about the DeviceInstallation Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-devicelock.md b/windows/client-management/mdm/policy-csp-devicelock.md index 7b0d273a41..1dea6a8e0c 100644 --- a/windows/client-management/mdm/policy-csp-devicelock.md +++ b/windows/client-management/mdm/policy-csp-devicelock.md @@ -1,14 +1,7 @@ --- title: DeviceLock Policy CSP description: Learn more about the DeviceLock Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 04/10/2024 --- @@ -121,7 +114,7 @@ Allow Administrator account lockout This security setting determines whether the | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1507 [10.0.10240] and later | +| ✅ Device
                        ❌ User | ❌ Pro
                        ❌ Enterprise
                        ❌ Education
                        ❌ Windows SE
                        ❌ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1507 [10.0.10240] and later | @@ -718,7 +711,7 @@ This security setting determines the period of time (in days) that a password ca | Format | `int` | | Access Type | Add, Delete, Get, Replace | | Allowed Values | Range: `[0-999]` | -| Default Value | 1 | +| Default Value | 42 | @@ -789,7 +782,7 @@ On HoloLens, this timeout is controlled by the device's system sleep timeout, re | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1709 [10.0.16299] and later | +| ✅ Device
                        ❌ User | ❌ Pro
                        ❌ Enterprise
                        ❌ Education
                        ❌ Windows SE
                        ❌ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1709 [10.0.16299] and later | @@ -1023,6 +1016,109 @@ This security setting determines the period of time (in days) that a password mu + +## MinimumPasswordLength + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/DeviceLock/MinimumPasswordLength +``` + + + + +This security setting determines the least number of characters that a password for a user account may contain. The maximum value for this setting depends on the value of the Relax minimum password length limits setting. If the Relax minimum password length limits setting isn't defined, this setting may be configured from 0 to 14. If the Relax minimum password length limits setting is defined and disabled, this setting may be configured from 0 to 14. If the Relax minimum password length limits setting is defined and enabled, this setting may be configured from 0 to 128. Setting the required number of characters to 0 means that no password is required. + +> [!NOTE] +> By default, member computers follow the configuration of their domain controllers. Default values: 7 on domain controllers 0 on stand-alone servers Configuring this setting larger than 14 may affect compatibility with clients, services, and applications. We recommend that you only configure this setting larger than 14 after you use the Minimum password length audit setting to test for potential incompatibilities at the new setting. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | Range: `[0-128]` | +| Default Value | 0 | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | Minimum password length | +| Path | Windows Settings > Security Settings > Account Policies > Password Policy | + + + + + + + + + +## MinimumPasswordLengthAudit + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/DeviceLock/MinimumPasswordLengthAudit +``` + + + + +This security setting determines the minimum password length for which password length audit warning events are issued. This setting may be configured from 1 to 128. You should only enable and configure this setting when you try to determine the potential effect of increasing the minimum password length setting in your environment. If this setting isn't defined, audit events won't be issued. If this setting is defined and is less than or equal to the minimum password length setting, audit events won't be issued. If this setting is defined and is greater than the minimum password length setting, and the length of a new account password is less than this setting, an audit event will be issued. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | Range: `[1-128]` | +| Default Value | 4294967295 | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | Minimum password length audit | +| Path | Windows Settings > Security Settings > Account Policies > Password Policy | + + + + + + + + ## PasswordComplexity @@ -1255,6 +1351,64 @@ If you enable this setting, users will no longer be able to modify slide show se + +## RelaxMinimumPasswordLengthLimits + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/DeviceLock/RelaxMinimumPasswordLengthLimits +``` + + + + +This setting controls whether the minimum password length setting can be increased beyond the legacy limit of 14. If this setting isn't defined, minimum password length may be configured to no more than 14. If this setting is defined and disabled, minimum password length may be configured to no more than 14. If this setting is defined and enabled, minimum password length may be configured more than 14. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Disabled. | +| 1 | Enabled. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | Relax minimum password length | +| Path | Windows Settings > Security Settings > Account Policies > Password Policy | + + + + + + + + ## ScreenTimeoutWhileLocked diff --git a/windows/client-management/mdm/policy-csp-display.md b/windows/client-management/mdm/policy-csp-display.md index c716b41a63..8f021f8337 100644 --- a/windows/client-management/mdm/policy-csp-display.md +++ b/windows/client-management/mdm/policy-csp-display.md @@ -1,14 +1,7 @@ --- title: Display Policy CSP description: Learn more about the Display Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-dmaguard.md b/windows/client-management/mdm/policy-csp-dmaguard.md index 0a9aa6d814..ed3b7b4609 100644 --- a/windows/client-management/mdm/policy-csp-dmaguard.md +++ b/windows/client-management/mdm/policy-csp-dmaguard.md @@ -1,14 +1,7 @@ --- title: DmaGuard Policy CSP description: Learn more about the DmaGuard Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-eap.md b/windows/client-management/mdm/policy-csp-eap.md index ccc75b02bf..14022fde28 100644 --- a/windows/client-management/mdm/policy-csp-eap.md +++ b/windows/client-management/mdm/policy-csp-eap.md @@ -1,14 +1,7 @@ --- title: Eap Policy CSP description: Learn more about the Eap Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-education.md b/windows/client-management/mdm/policy-csp-education.md index 4ec2cef651..cfd49a1bf0 100644 --- a/windows/client-management/mdm/policy-csp-education.md +++ b/windows/client-management/mdm/policy-csp-education.md @@ -1,14 +1,7 @@ --- title: Education Policy CSP description: Learn more about the Education Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-enterprisecloudprint.md b/windows/client-management/mdm/policy-csp-enterprisecloudprint.md index 4005e29555..016c5d5a51 100644 --- a/windows/client-management/mdm/policy-csp-enterprisecloudprint.md +++ b/windows/client-management/mdm/policy-csp-enterprisecloudprint.md @@ -1,14 +1,7 @@ --- title: EnterpriseCloudPrint Policy CSP description: Learn more about the EnterpriseCloudPrint Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -274,7 +267,7 @@ Resource URI for which access is being requested by the Mopria discovery client This policy must target ./User, otherwise it fails. -The default value is an empty string. Otherwise, the value should contain a URL. +The default value is an empty string. Otherwise, the value should contain a URL. **Example**: diff --git a/windows/client-management/mdm/policy-csp-errorreporting.md b/windows/client-management/mdm/policy-csp-errorreporting.md index e97461a682..50e401227e 100644 --- a/windows/client-management/mdm/policy-csp-errorreporting.md +++ b/windows/client-management/mdm/policy-csp-errorreporting.md @@ -1,14 +1,7 @@ --- title: ErrorReporting Policy CSP description: Learn more about the ErrorReporting Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-eventlogservice.md b/windows/client-management/mdm/policy-csp-eventlogservice.md index ce940b762e..83a5c6c350 100644 --- a/windows/client-management/mdm/policy-csp-eventlogservice.md +++ b/windows/client-management/mdm/policy-csp-eventlogservice.md @@ -1,14 +1,7 @@ --- title: EventLogService Policy CSP description: Learn more about the EventLogService Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-experience.md b/windows/client-management/mdm/policy-csp-experience.md index 3fbecc7fbe..3bc6e9af56 100644 --- a/windows/client-management/mdm/policy-csp-experience.md +++ b/windows/client-management/mdm/policy-csp-experience.md @@ -1,14 +1,7 @@ --- title: Experience Policy CSP description: Learn more about the Experience Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 04/10/2024 --- @@ -107,7 +100,7 @@ Policy change takes effect immediately. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1507 [10.0.10240] and later | +| ✅ Device
                        ❌ User | Not applicable | ✅ Windows 10, version 1507 [10.0.10240] and later | @@ -840,7 +833,7 @@ This policy allows you to prevent Windows from using diagnostic data to provide | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1507 [10.0.10240] and later | +| ✅ Device
                        ❌ User | Not applicable | ✅ Windows 10, version 1507 [10.0.10240] and later | @@ -956,7 +949,7 @@ Specifies whether to allow app and content suggestions from third-party software | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1507 [10.0.10240] and later | +| ✅ Device
                        ❌ User | Not applicable | ✅ Windows 10, version 1507 [10.0.10240] and later | @@ -1894,7 +1887,7 @@ _**Turn syncing off by default but don’t disable**_ | Scope | Editions | Applicable OS | |:--|:--|:--| -| ❌ Device
                        ✅ User | ❌ Pro
                        ✅ Enterprise
                        ✅ Education
                        ❌ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ❌ Device
                        ✅ User | ❌ Pro
                        ✅ Enterprise
                        ✅ Education
                        ❌ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621.900] and later
                        ✅ Windows Insider Preview | diff --git a/windows/client-management/mdm/policy-csp-exploitguard.md b/windows/client-management/mdm/policy-csp-exploitguard.md index 089a7066d9..6d947b5cd3 100644 --- a/windows/client-management/mdm/policy-csp-exploitguard.md +++ b/windows/client-management/mdm/policy-csp-exploitguard.md @@ -1,14 +1,7 @@ --- title: ExploitGuard Policy CSP description: Learn more about the ExploitGuard Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-federatedauthentication.md b/windows/client-management/mdm/policy-csp-federatedauthentication.md index 18426abce1..4b4de43f51 100644 --- a/windows/client-management/mdm/policy-csp-federatedauthentication.md +++ b/windows/client-management/mdm/policy-csp-federatedauthentication.md @@ -1,14 +1,7 @@ --- title: FederatedAuthentication Policy CSP description: Learn more about the FederatedAuthentication Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 10/23/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-feeds.md b/windows/client-management/mdm/policy-csp-feeds.md index a8a7ae5f57..98a8e70629 100644 --- a/windows/client-management/mdm/policy-csp-feeds.md +++ b/windows/client-management/mdm/policy-csp-feeds.md @@ -1,15 +1,7 @@ --- title: Policy CSP - Feeds description: Use the Policy CSP - Feeds setting policy specifies whether news and interests is allowed on the device. -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft -ms.localizationpriority: medium ms.date: 09/17/2021 -ms.reviewer: -manager: aaroncz --- # Policy CSP - Feeds diff --git a/windows/client-management/mdm/policy-csp-fileexplorer.md b/windows/client-management/mdm/policy-csp-fileexplorer.md index 75e9fb777f..fb55df7a5d 100644 --- a/windows/client-management/mdm/policy-csp-fileexplorer.md +++ b/windows/client-management/mdm/policy-csp-fileexplorer.md @@ -1,14 +1,7 @@ --- title: FileExplorer Policy CSP description: Learn more about the FileExplorer Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/30/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-filesystem.md b/windows/client-management/mdm/policy-csp-filesystem.md index 57ec3f91e0..f1d4135999 100644 --- a/windows/client-management/mdm/policy-csp-filesystem.md +++ b/windows/client-management/mdm/policy-csp-filesystem.md @@ -1,14 +1,7 @@ --- title: FileSystem Policy CSP description: Learn more about the FileSystem Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/30/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -30,7 +23,7 @@ ms.topic: reference | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621.2338] and later
                        ✅ Windows Insider Preview | @@ -86,7 +79,7 @@ A reboot is required for this setting to take effect. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621.2338] and later
                        ✅ Windows Insider Preview | diff --git a/windows/client-management/mdm/policy-csp-games.md b/windows/client-management/mdm/policy-csp-games.md index 7be1ae616e..d16bea4048 100644 --- a/windows/client-management/mdm/policy-csp-games.md +++ b/windows/client-management/mdm/policy-csp-games.md @@ -1,14 +1,7 @@ --- title: Games Policy CSP description: Learn more about the Games Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-handwriting.md b/windows/client-management/mdm/policy-csp-handwriting.md index 941b6ab1ce..6cd40803bd 100644 --- a/windows/client-management/mdm/policy-csp-handwriting.md +++ b/windows/client-management/mdm/policy-csp-handwriting.md @@ -1,14 +1,7 @@ --- title: Handwriting Policy CSP description: Learn more about the Handwriting Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-humanpresence.md b/windows/client-management/mdm/policy-csp-humanpresence.md index 6584e6372b..3ef891ed68 100644 --- a/windows/client-management/mdm/policy-csp-humanpresence.md +++ b/windows/client-management/mdm/policy-csp-humanpresence.md @@ -1,14 +1,7 @@ --- title: HumanPresence Policy CSP description: Learn more about the HumanPresence Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/30/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-internetexplorer.md b/windows/client-management/mdm/policy-csp-internetexplorer.md index d707b4af93..61083dafc6 100644 --- a/windows/client-management/mdm/policy-csp-internetexplorer.md +++ b/windows/client-management/mdm/policy-csp-internetexplorer.md @@ -1,14 +1,7 @@ --- title: InternetExplorer Policy CSP description: Learn more about the InternetExplorer Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 10/03/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 06/21/2024 --- @@ -992,6 +985,60 @@ Note. It's recommended to configure template policy settings in one Group Policy + +## AllowLegacyURLFields + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
                        ✅ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```User +./User/Vendor/MSFT/Policy/Config/InternetExplorer/AllowLegacyURLFields +``` + +```Device +./Device/Vendor/MSFT/Policy/Config/InternetExplorer/AllowLegacyURLFields +``` + + + + + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `chr` (string) | +| Access Type | Add, Delete, Get, Replace | + + + + +[!INCLUDE [ADMX-backed policy note](includes/mdm-admx-policy-note.md)] + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | AllowLegacyURLFields | +| ADMX File Name | inetres.admx | + + + + + + + + ## AllowLocalMachineZoneTemplate @@ -3666,17 +3713,7 @@ If you disable, or don't configure this policy, all sites are opened using the c - -This policy setting determines whether Internet Explorer 11 uses 64-bit processes (for greater security) or 32-bit processes (for greater compatibility) when running in Enhanced Protected Mode on 64-bit versions of Windows. - -> [!IMPORTANT] -> Some ActiveX controls and toolbars may not be available when 64-bit processes are used. - -- If you enable this policy setting, Internet Explorer 11 will use 64-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows. - -- If you disable this policy setting, Internet Explorer 11 will use 32-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows. - -- If you don't configure this policy setting, users can turn this feature on or off using Internet Explorer settings. This feature is turned off by default. + @@ -7735,7 +7772,7 @@ High Safety enables applets to run in their sandbox. Disable Java to prevent any | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ✅ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
                        ✅ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.2227] and later
                        ✅ [10.0.25398.643] and later
                        ✅ [10.0.25965] and later
                        ✅ Windows 10, version 2004 [10.0.19041.3758] and later
                        ✅ Windows 11, version 22H2 [10.0.22621.2792] and later | @@ -8810,7 +8847,7 @@ High Safety enables applets to run in their sandbox. Disable Java to prevent any | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ✅ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
                        ✅ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.2227] and later
                        ✅ [10.0.25398.643] and later
                        ✅ [10.0.25965] and later
                        ✅ Windows 10, version 2004 [10.0.19041.3758] and later
                        ✅ Windows 11, version 22H2 [10.0.22621.2792] and later | @@ -17381,7 +17418,7 @@ High Safety enables applets to run in their sandbox. Disable Java to prevent any | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ✅ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
                        ✅ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.2227] and later
                        ✅ [10.0.25398.643] and later
                        ✅ [10.0.25965] and later
                        ✅ Windows 10, version 2004 [10.0.19041.3758] and later
                        ✅ Windows 11, version 22H2 [10.0.22621.2792] and later | diff --git a/windows/client-management/mdm/policy-csp-kerberos.md b/windows/client-management/mdm/policy-csp-kerberos.md index ed58ffd639..092f0fcfa3 100644 --- a/windows/client-management/mdm/policy-csp-kerberos.md +++ b/windows/client-management/mdm/policy-csp-kerberos.md @@ -1,14 +1,7 @@ --- title: Kerberos Policy CSP description: Learn more about the Kerberos Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 10/23/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/31/2024 --- @@ -323,7 +316,7 @@ If you don't configure this policy, the SHA1 algorithm will assume the **Default | Format | `int` | | Access Type | Add, Delete, Get, Replace | | Default Value | 1 | -| Dependency [PKINIT_Hash_Algorithm_Configuration_DependencyGroup] | Dependency Type: `DependsOn`
                        Dependency URI: `Device/Vendor/MSFT/Policy/Config/Kerberos/PKInitHashAlgorithmConfigurationEnabled`
                        Dependency Allowed Value: `[1]`
                        Dependency Allowed Value Type: `Range`
                        | +| Dependency [PKINIT_Hash_Algorithm_Configuration_DependencyGroup] | Dependency Type: `DependsOn`
                        Dependency URI: `Device/Vendor/MSFT/Policy/Config/Kerberos/PKInitHashAlgorithmConfiguration`
                        Dependency Allowed Value: `[1]`
                        Dependency Allowed Value Type: `Range`
                        | @@ -396,7 +389,7 @@ If you don't configure this policy, the SHA256 algorithm will assume the **Defau | Format | `int` | | Access Type | Add, Delete, Get, Replace | | Default Value | 1 | -| Dependency [PKINIT_Hash_Algorithm_Configuration_DependencyGroup] | Dependency Type: `DependsOn`
                        Dependency URI: `Device/Vendor/MSFT/Policy/Config/Kerberos/PKInitHashAlgorithmConfigurationEnabled`
                        Dependency Allowed Value: `[1]`
                        Dependency Allowed Value Type: `Range`
                        | +| Dependency [PKINIT_Hash_Algorithm_Configuration_DependencyGroup] | Dependency Type: `DependsOn`
                        Dependency URI: `Device/Vendor/MSFT/Policy/Config/Kerberos/PKInitHashAlgorithmConfiguration`
                        Dependency Allowed Value: `[1]`
                        Dependency Allowed Value Type: `Range`
                        | @@ -469,7 +462,7 @@ If you don't configure this policy, the SHA384 algorithm will assume the **Defau | Format | `int` | | Access Type | Add, Delete, Get, Replace | | Default Value | 1 | -| Dependency [PKINIT_Hash_Algorithm_Configuration_DependencyGroup] | Dependency Type: `DependsOn`
                        Dependency URI: `Device/Vendor/MSFT/Policy/Config/Kerberos/PKInitHashAlgorithmConfigurationEnabled`
                        Dependency Allowed Value: `[1]`
                        Dependency Allowed Value Type: `Range`
                        | +| Dependency [PKINIT_Hash_Algorithm_Configuration_DependencyGroup] | Dependency Type: `DependsOn`
                        Dependency URI: `Device/Vendor/MSFT/Policy/Config/Kerberos/PKInitHashAlgorithmConfiguration`
                        Dependency Allowed Value: `[1]`
                        Dependency Allowed Value Type: `Range`
                        | @@ -542,7 +535,7 @@ If you don't configure this policy, the SHA512 algorithm will assume the **Defau | Format | `int` | | Access Type | Add, Delete, Get, Replace | | Default Value | 1 | -| Dependency [PKINIT_Hash_Algorithm_Configuration_DependencyGroup] | Dependency Type: `DependsOn`
                        Dependency URI: `Device/Vendor/MSFT/Policy/Config/Kerberos/PKInitHashAlgorithmConfigurationEnabled`
                        Dependency Allowed Value: `[1]`
                        Dependency Allowed Value Type: `Range`
                        | +| Dependency [PKINIT_Hash_Algorithm_Configuration_DependencyGroup] | Dependency Type: `DependsOn`
                        Dependency URI: `Device/Vendor/MSFT/Policy/Config/Kerberos/PKInitHashAlgorithmConfiguration`
                        Dependency Allowed Value: `[1]`
                        Dependency Allowed Value Type: `Range`
                        | diff --git a/windows/client-management/mdm/policy-csp-kioskbrowser.md b/windows/client-management/mdm/policy-csp-kioskbrowser.md index 957c1a280e..ab923304b0 100644 --- a/windows/client-management/mdm/policy-csp-kioskbrowser.md +++ b/windows/client-management/mdm/policy-csp-kioskbrowser.md @@ -1,14 +1,7 @@ --- title: KioskBrowser Policy CSP description: Learn more about the KioskBrowser Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-lanmanworkstation.md b/windows/client-management/mdm/policy-csp-lanmanworkstation.md index 4c0d5e7b6e..b3e44fe44d 100644 --- a/windows/client-management/mdm/policy-csp-lanmanworkstation.md +++ b/windows/client-management/mdm/policy-csp-lanmanworkstation.md @@ -1,14 +1,7 @@ --- title: LanmanWorkstation Policy CSP description: Learn more about the LanmanWorkstation Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-licensing.md b/windows/client-management/mdm/policy-csp-licensing.md index 27405e9ef7..69f8d74490 100644 --- a/windows/client-management/mdm/policy-csp-licensing.md +++ b/windows/client-management/mdm/policy-csp-licensing.md @@ -1,14 +1,7 @@ --- title: Licensing Policy CSP description: Learn more about the Licensing Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md b/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md index 3edee263b1..bb70540374 100644 --- a/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md +++ b/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md @@ -1,14 +1,7 @@ --- title: LocalPoliciesSecurityOptions Policy CSP description: Learn more about the LocalPoliciesSecurityOptions Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/31/2024 --- @@ -373,7 +366,7 @@ Accounts: Rename guest account This security setting determines whether a differ | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -402,6 +395,7 @@ Audit: Audit the use of Backup and Restore privilege This security setting deter | Format | `b64` | | Access Type | Add, Delete, Get, Replace | | Allowed Values | List (Delimiter: ``) | +| Default Value | 00 | @@ -416,7 +410,7 @@ Audit: Audit the use of Backup and Restore privilege This security setting deter | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -457,7 +451,7 @@ Audit: Force audit policy subcategory settings (Windows Vista or later) to overr | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -722,7 +716,7 @@ Devices: Restrict CD-ROM access to locally logged-on user only This security set | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -771,7 +765,7 @@ Devices: Restrict floppy access to locally logged-on user only This security set | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -824,7 +818,7 @@ Domain member: Digitally encrypt or sign secure channel data (always) This secur | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -880,7 +874,7 @@ Domain member: Digitally encrypt secure channel data (when possible) This securi | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -930,7 +924,7 @@ Domain member: Digitally sign secure channel data (when possible) This security | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -987,7 +981,7 @@ Domain member: Disable machine account password changes Determines whether a dom | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -1040,7 +1034,7 @@ Domain member: Maximum machine account password age This security setting determ | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -1325,31 +1319,31 @@ Interactive logon: Don't require CTRL+ALT+DEL This security setting determines w - -## InteractiveLogon_MachineAccountThreshold + +## InteractiveLogon_MachineAccountLockoutThreshold - + | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | | - +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + - + ```Device -./Device/Vendor/MSFT/Policy/Config/LocalPoliciesSecurityOptions/InteractiveLogon_MachineAccountThreshold +./Device/Vendor/MSFT/Policy/Config/LocalPoliciesSecurityOptions/InteractiveLogon_MachineAccountLockoutThreshold ``` - + - + Interactive logon: Machine account threshold. The machine lockout policy is enforced only on those machines that have BitLocker enabled for protecting OS volumes. Please ensure that appropriate recovery password backup policies are enabled. This security setting determines the number of failed logon attempts that causes the machine to be locked out. A locked out machine can only be recovered by providing recovery key at console. You can set the value between 1 and 999 failed logon attempts. If you set the value to 0, the machine will never be locked out. Values from 1 to 3 will be interpreted as 4. Failed password attempts against workstations or member servers that have been locked using either CTRL+ALT+DELETE or password protected screen savers counts as failed logon attempts. The machine lockout policy is enforced only on those machines that have BitLocker enabled for protecting OS volumes. Please ensure that the appropriate recovery password backup policies are enabled. Default: 0. - + - + - + - + **Description framework properties**: | Property name | Property value | @@ -1358,22 +1352,22 @@ Interactive logon: Machine account threshold. The machine lockout policy is enfo | Access Type | Add, Delete, Get, Replace | | Allowed Values | Range: `[0-999]` | | Default Value | 0 | - + - + **Group policy mapping**: | Name | Value | |:--|:--| | Name | Interactive logon: Machine account lockout threshold | | Path | Windows Settings > Security Settings > Local Policies > Security Options | - + - + - + - + ## InteractiveLogon_MachineInactivityLimit @@ -1531,7 +1525,7 @@ Interactive logon: Message title for users attempting to log on This security se | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -1571,7 +1565,7 @@ Interactive logon: Number of previous logons to cache (in case domain controller | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -1866,7 +1860,7 @@ Microsoft network client: Send unencrypted password to connect to third-party SM | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -1891,8 +1885,8 @@ Microsoft network server: Amount of idle time required before suspending a sessi |:--|:--| | Format | `int` | | Access Type | Add, Delete, Get, Replace | -| Allowed Values | Range: `[0-15]` | -| Default Value | 15 | +| Allowed Values | Range: `[0-99999]` | +| Default Value | 99999 | @@ -2049,7 +2043,7 @@ Microsoft network server: Digitally sign communications (if client agrees) This | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -2090,7 +2084,7 @@ Microsoft network server: Disconnect clients when logon hours expire This securi | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -2312,7 +2306,7 @@ Network access: Don't allow anonymous enumeration of SAM accounts and shares Thi | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -2360,7 +2354,7 @@ Network access: Don't allow storage of passwords and credentials for network aut | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -2410,7 +2404,7 @@ Network access: Let Everyone permissions apply to anonymous users This security | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -2435,6 +2429,7 @@ Network access: Named pipes that can be accessed anonymously This security setti |:--|:--| | Format | `chr` (string) | | Access Type | Add, Delete, Get, Replace | +| Allowed Values | List (Delimiter: `,`) | @@ -2449,7 +2444,7 @@ Network access: Named pipes that can be accessed anonymously This security setti | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -2477,6 +2472,7 @@ Network access: Remotely accessible registry paths This security setting determi |:--|:--| | Format | `chr` (string) | | Access Type | Add, Delete, Get, Replace | +| Allowed Values | List (Delimiter: `,`) | @@ -2491,7 +2487,7 @@ Network access: Remotely accessible registry paths This security setting determi | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -2519,6 +2515,7 @@ Network access: Remotely accessible registry paths and subpaths This security se |:--|:--| | Format | `chr` (string) | | Access Type | Add, Delete, Get, Replace | +| Allowed Values | List (Delimiter: `,`) | @@ -2639,7 +2636,7 @@ Network access: Restrict clients allowed to make remote calls to SAM This policy | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -2664,6 +2661,7 @@ Network access: Shares that can be accessed anonymously This security setting de |:--|:--| | Format | `chr` (string) | | Access Type | Add, Delete, Get, Replace | +| Allowed Values | List (Delimiter: `,`) | @@ -2678,7 +2676,7 @@ Network access: Shares that can be accessed anonymously This security setting de | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -2722,7 +2720,7 @@ Network access: Sharing and security model for local accounts This security sett | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -2980,7 +2978,7 @@ Network security: Force logoff when logon hours expire This security setting det |:--|:--| | Format | `int` | | Access Type | Add, Delete, Get, Replace | -| Default Value | 0 | +| Default Value | 1 | @@ -2988,8 +2986,8 @@ Network security: Force logoff when logon hours expire This security setting det | Value | Description | |:--|:--| -| 1 | Enable. | -| 0 (Default) | Disable. | +| 1 (Default) | Enable. | +| 0 | Disable. | @@ -3078,7 +3076,7 @@ Network security LAN Manager authentication level This security setting determin | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -3110,7 +3108,7 @@ Network security: LDAP client signing requirements This security setting determi | Format | `int` | | Access Type | Add, Delete, Get, Replace | | Allowed Values | Range: `[0-2]` | -| Default Value | 0 | +| Default Value | 1 | @@ -3484,7 +3482,7 @@ Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers This po | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -3534,7 +3532,7 @@ Recovery console: Allow automatic administrative logon This security setting det | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -3691,7 +3689,7 @@ Shutdown: Clear virtual memory pagefile This security setting determines whether | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -3732,7 +3730,7 @@ System Cryptography: Force strong key protection for user keys stored on the com | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -3782,7 +3780,7 @@ System objects: Require case insensitivity for non-Windows subsystems This secur | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -3940,6 +3938,64 @@ User Account Control: Behavior of the elevation prompt for administrators in Adm + +## UserAccountControl_BehaviorOfTheElevationPromptForEnhancedAdministrators + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/LocalPoliciesSecurityOptions/UserAccountControl_BehaviorOfTheElevationPromptForEnhancedAdministrators +``` + + + + +User Account Control: Behavior of the elevation prompt for administrators running with enhanced privilege protection. This policy setting controls the behavior of the elevation prompt for administrators. The options are: - Prompt for credentials on the secure desktop: When an operation requires elevation of privilege, the user is prompted on the secure desktop to enter a privileged user name and password. If the user enters valid credentials, the operation continues with the user's highest available privilege. - Prompt for consent on the secure desktop: When an operation requires elevation of privilege, the user is prompted on the secure desktop to select either Permit or Deny. If the user selects Permit, the operation continues with the user's highest available privilege. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 2 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 1 | Prompt for credentials on the secure desktop. | +| 2 (Default) | Prompt for consent on the secure desktop. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | User Account Control: Behavior of the elevation prompt for administrators running with enhanced privilege protection | +| Path | Windows Settings > Security Settings > Local Policies > Security Options | + + + + + + + + ## UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers @@ -4292,6 +4348,64 @@ User Account Control: Switch to the secure desktop when prompting for elevation + +## UserAccountControl_TypeOfAdminApprovalMode + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/LocalPoliciesSecurityOptions/UserAccountControl_TypeOfAdminApprovalMode +``` + + + + +User Account Control: Configure type of Admin Approval Mode. This policy setting controls whether enhanced privilege protection is applied to admin approval mode elevations. If you change this policy setting, you must restart your computer. This policy is only supported on Windows Desktop, not Server. The options are: - Admin Approval Mode is running in legacy mode (default). - Admin Approval Mode is running with enhanced privilege protection. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 1 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 1 (Default) | Legacy Admin Approval Mode. | +| 2 | Admin Approval Mode with enhanced privilege protection. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | User Account Control: Configure type of Admin Approval Mode | +| Path | Windows Settings > Security Settings > Local Policies > Security Options | + + + + + + + + ## UserAccountControl_UseAdminApprovalMode diff --git a/windows/client-management/mdm/policy-csp-localusersandgroups.md b/windows/client-management/mdm/policy-csp-localusersandgroups.md index 1ae1768b2e..7dc4364747 100644 --- a/windows/client-management/mdm/policy-csp-localusersandgroups.md +++ b/windows/client-management/mdm/policy-csp-localusersandgroups.md @@ -1,14 +1,7 @@ --- title: LocalUsersAndGroups Policy CSP description: Learn more about the LocalUsersAndGroups Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-lockdown.md b/windows/client-management/mdm/policy-csp-lockdown.md index f7afb94964..95f4c33c50 100644 --- a/windows/client-management/mdm/policy-csp-lockdown.md +++ b/windows/client-management/mdm/policy-csp-lockdown.md @@ -1,14 +1,7 @@ --- title: LockDown Policy CSP description: Learn more about the LockDown Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-lsa.md b/windows/client-management/mdm/policy-csp-lsa.md index 3359d00d6a..d4773d4c5d 100644 --- a/windows/client-management/mdm/policy-csp-lsa.md +++ b/windows/client-management/mdm/policy-csp-lsa.md @@ -1,14 +1,7 @@ --- title: LocalSecurityAuthority Policy CSP description: Learn more about the LocalSecurityAuthority Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-maps.md b/windows/client-management/mdm/policy-csp-maps.md index e3a20f4341..7dc52aed91 100644 --- a/windows/client-management/mdm/policy-csp-maps.md +++ b/windows/client-management/mdm/policy-csp-maps.md @@ -1,14 +1,7 @@ --- title: Maps Policy CSP description: Learn more about the Maps Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-memorydump.md b/windows/client-management/mdm/policy-csp-memorydump.md index 5c6eedf729..d6550053a3 100644 --- a/windows/client-management/mdm/policy-csp-memorydump.md +++ b/windows/client-management/mdm/policy-csp-memorydump.md @@ -1,14 +1,7 @@ --- title: MemoryDump Policy CSP description: Learn more about the MemoryDump Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-messaging.md b/windows/client-management/mdm/policy-csp-messaging.md index f0b04e92b7..30117ff84d 100644 --- a/windows/client-management/mdm/policy-csp-messaging.md +++ b/windows/client-management/mdm/policy-csp-messaging.md @@ -1,14 +1,7 @@ --- title: Messaging Policy CSP description: Learn more about the Messaging Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-mixedreality.md b/windows/client-management/mdm/policy-csp-mixedreality.md index 79b92833b7..19bd347e3c 100644 --- a/windows/client-management/mdm/policy-csp-mixedreality.md +++ b/windows/client-management/mdm/policy-csp-mixedreality.md @@ -1,14 +1,7 @@ --- title: MixedReality Policy CSP description: Learn more about the MixedReality Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/29/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 02/20/2024 --- @@ -279,6 +272,59 @@ This policy controls if the HoloLens displays will be automatically adjusted for + +## AutoUnlock + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
                        ✅ User | ❌ Pro
                        ❌ Enterprise
                        ❌ Education
                        ❌ Windows SE
                        ❌ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```User +./User/Vendor/MSFT/Policy/Config/MixedReality/AutoUnlock +``` + +```Device +./Device/Vendor/MSFT/Policy/Config/MixedReality/AutoUnlock +``` + + + + +This policy controls whether a signed-in user will be prompted for credentials when returning to the device after the device has entered suspended state. This policy is available both for the device as well as the user scope. When enabled for the device scope, auto unlock will be enabled for all users on the device. When enabled for the user scope, only the specific user will have auto unlock enabled. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | User will be prompted for credentials. | +| 1 | User won't be prompted for credentials. | + + + + + + + + ## BrightnessButtonDisabled @@ -328,6 +374,97 @@ This policy setting controls if pressing the brightness button changes the brigh + +## ConfigureDeviceStandbyAction + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
                        ❌ User | ❌ Pro
                        ❌ Enterprise
                        ❌ Education
                        ❌ Windows SE
                        ❌ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/MixedReality/ConfigureDeviceStandbyAction +``` + + + + +This policy setting controls device maintenance action during standby. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Not configured. | +| 1 | Logoff users. | +| 2 | Reboot device. | + + + + + + + + + +## ConfigureDeviceStandbyActionTimeout + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
                        ❌ User | ❌ Pro
                        ❌ Enterprise
                        ❌ Education
                        ❌ Windows SE
                        ❌ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/MixedReality/ConfigureDeviceStandbyActionTimeout +``` + + + + +This policy setting controls when to start maintenance action after device enters standby. The timeout value is in hours. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | Range: `[1-168]` | +| Default Value | 8 | + + + + + + + + ## ConfigureMovingPlatform @@ -650,7 +787,7 @@ Windows Network Connectivity Status Indicator may get a false positive internet- | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ❌ Pro
                        ❌ Enterprise
                        ❌ Education
                        ❌ Windows SE
                        ❌ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
                        ❌ User | ❌ Pro
                        ❌ Enterprise
                        ❌ Education
                        ❌ Windows SE
                        ❌ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621] and later | @@ -699,7 +836,7 @@ This policy setting controls if pinching your thumb and index finger, while look | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ❌ Pro
                        ❌ Enterprise
                        ❌ Education
                        ❌ Windows SE
                        ❌ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
                        ❌ User | ❌ Pro
                        ❌ Enterprise
                        ❌ Education
                        ❌ Windows SE
                        ❌ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621] and later | @@ -748,7 +885,7 @@ This policy setting controls if using voice commands to open the Start menu is e | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ❌ Pro
                        ❌ Enterprise
                        ❌ Education
                        ❌ Windows SE
                        ❌ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
                        ❌ User | ❌ Pro
                        ❌ Enterprise
                        ❌ Education
                        ❌ Windows SE
                        ❌ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621] and later | @@ -1111,7 +1248,7 @@ The following example XML string shows the value to enable this policy: | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ❌ Pro
                        ❌ Enterprise
                        ❌ Education
                        ❌ Windows SE
                        ❌ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
                        ❌ User | ❌ Pro
                        ❌ Enterprise
                        ❌ Education
                        ❌ Windows SE
                        ❌ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621] and later | @@ -1160,7 +1297,7 @@ This policy configures whether the Sign-In App should prefer showing Other User | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ❌ Pro
                        ❌ Enterprise
                        ❌ Education
                        ❌ Windows SE
                        ❌ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
                        ❌ User | ❌ Pro
                        ❌ Enterprise
                        ❌ Education
                        ❌ Windows SE
                        ❌ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621] and later | @@ -1209,7 +1346,7 @@ This policy setting controls if it's require that the Start icon to be pressed f | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ❌ Pro
                        ❌ Enterprise
                        ❌ Education
                        ❌ Windows SE
                        ❌ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
                        ❌ User | ❌ Pro
                        ❌ Enterprise
                        ❌ Education
                        ❌ Windows SE
                        ❌ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621] and later | diff --git a/windows/client-management/mdm/policy-csp-mssecurityguide.md b/windows/client-management/mdm/policy-csp-mssecurityguide.md index 9d94c49836..da47e000cd 100644 --- a/windows/client-management/mdm/policy-csp-mssecurityguide.md +++ b/windows/client-management/mdm/policy-csp-mssecurityguide.md @@ -1,14 +1,7 @@ --- title: MSSecurityGuide Policy CSP description: Learn more about the MSSecurityGuide Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/31/2024 --- @@ -18,6 +11,8 @@ ms.topic: reference [!INCLUDE [ADMX-backed CSP tip](includes/mdm-admx-csp-note.md)] +[!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)] + @@ -228,7 +223,7 @@ ms.topic: reference | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1803 [10.0.17134] and later | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | diff --git a/windows/client-management/mdm/policy-csp-msslegacy.md b/windows/client-management/mdm/policy-csp-msslegacy.md index a34a41ff94..6e60b0d9dd 100644 --- a/windows/client-management/mdm/policy-csp-msslegacy.md +++ b/windows/client-management/mdm/policy-csp-msslegacy.md @@ -1,14 +1,7 @@ --- title: MSSLegacy Policy CSP description: Learn more about the MSSLegacy Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-multitasking.md b/windows/client-management/mdm/policy-csp-multitasking.md index c12b74e90f..84df0472de 100644 --- a/windows/client-management/mdm/policy-csp-multitasking.md +++ b/windows/client-management/mdm/policy-csp-multitasking.md @@ -1,14 +1,7 @@ --- title: Multitasking Policy CSP description: Learn more about the Multitasking Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/30/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-networkisolation.md b/windows/client-management/mdm/policy-csp-networkisolation.md index dd7b76de61..14633df6c8 100644 --- a/windows/client-management/mdm/policy-csp-networkisolation.md +++ b/windows/client-management/mdm/policy-csp-networkisolation.md @@ -1,14 +1,7 @@ --- title: NetworkIsolation Policy CSP description: Learn more about the NetworkIsolation Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-networklistmanager.md b/windows/client-management/mdm/policy-csp-networklistmanager.md index ecc77167b9..0ade49a774 100644 --- a/windows/client-management/mdm/policy-csp-networklistmanager.md +++ b/windows/client-management/mdm/policy-csp-networklistmanager.md @@ -1,14 +1,7 @@ --- title: NetworkListManager Policy CSP description: Learn more about the NetworkListManager Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/31/2024 --- @@ -16,10 +9,159 @@ ms.topic: reference # Policy CSP - NetworkListManager +[!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)] + + +## AllNetworks_NetworkIcon + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ❌ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/NetworkListManager/AllNetworks_NetworkIcon +``` + + + + +This policy setting allows you to specify whether users can change the network icon for all networks to which the user connects. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | User can change icon. | +| 1 | User can't change icon. | + + + + + + + + + +## AllNetworks_NetworkLocation + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ❌ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/NetworkListManager/AllNetworks_NetworkLocation +``` + + + + +This policy setting allows you to specify whether users can change the network location for all networks to which the user connects. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | User can change location. | +| 1 | User can't change location. | + + + + + + + + + +## AllNetworks_NetworkName + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ❌ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/NetworkListManager/AllNetworks_NetworkName +``` + + + + +This policy setting allows you to specify whether users can change the network name for all networks to which the user connects. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | User can change name. | +| 1 | User can't change name. | + + + + + + + + ## AllowedTlsAuthenticationEndpoints @@ -114,6 +256,153 @@ This policy setting provides the string that names a network. If this setting is + +## IdentifyingNetworks_LocationType + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ❌ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/NetworkListManager/IdentifyingNetworks_LocationType +``` + + + + +This policy setting allows you to configure the Network Location for networks that are in a temporary state while Windows works to identify the network and location type. A network location identifies the type of network that a computer is connected to and automatically sets the appropriate firewall settings for that location. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Public. | +| 1 | Private. | + + + + + + + + + +## UnidentifiedNetworks_LocationType + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ❌ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/NetworkListManager/UnidentifiedNetworks_LocationType +``` + + + + +This policy setting allows you to configure the Network Location type for networks that Windows can't identify due to a network issue or a lack of identifiable characters in the network information received by the operating system from the network. A network location identifies the type of network that a computer is connected to and automatically sets the appropriate firewall settings for that location. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Public. | +| 1 | Private. | + + + + + + + + + +## UnidentifiedNetworks_UserPermissions + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ❌ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/NetworkListManager/UnidentifiedNetworks_UserPermissions +``` + + + + +This policy setting allows you to configure the Network Location user permissions for networks that Windows can't identify due to a network issue or a lack of identifiable characters in the network information received by the operating system from the network. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | User can change location. | +| 1 | User can't change location. | + + + + + + + + diff --git a/windows/client-management/mdm/policy-csp-newsandinterests.md b/windows/client-management/mdm/policy-csp-newsandinterests.md index c22d8a9bfa..16fabdc822 100644 --- a/windows/client-management/mdm/policy-csp-newsandinterests.md +++ b/windows/client-management/mdm/policy-csp-newsandinterests.md @@ -1,14 +1,7 @@ --- title: NewsAndInterests Policy CSP description: Learn more about the NewsAndInterests Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-notifications.md b/windows/client-management/mdm/policy-csp-notifications.md index 1f7b42377a..65d5cb42bc 100644 --- a/windows/client-management/mdm/policy-csp-notifications.md +++ b/windows/client-management/mdm/policy-csp-notifications.md @@ -1,14 +1,7 @@ --- title: Notifications Policy CSP description: Learn more about the Notifications Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/30/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-power.md b/windows/client-management/mdm/policy-csp-power.md index 68c365431c..e1e5083184 100644 --- a/windows/client-management/mdm/policy-csp-power.md +++ b/windows/client-management/mdm/policy-csp-power.md @@ -1,14 +1,7 @@ --- title: Power Policy CSP description: Learn more about the Power Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 10/24/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-printers.md b/windows/client-management/mdm/policy-csp-printers.md index 10b73e98be..fa423988bf 100644 --- a/windows/client-management/mdm/policy-csp-printers.md +++ b/windows/client-management/mdm/policy-csp-printers.md @@ -1,14 +1,7 @@ --- title: Printers Policy CSP description: Learn more about the Printers Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/31/2024 --- @@ -676,6 +669,56 @@ If you disable or don't configure this policy setting, dynamic TCP ports are use + +## ConfigureWindowsProtectedPrint + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Printers/ConfigureWindowsProtectedPrint +``` + + + + + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `chr` (string) | +| Access Type | Add, Delete, Get, Replace | + + + + +[!INCLUDE [ADMX-backed policy note](includes/mdm-admx-policy-note.md)] + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | ConfigureWindowsProtectedPrint | +| ADMX File Name | Printing.admx | + + + + + + + + ## EnableDeviceControl diff --git a/windows/client-management/mdm/policy-csp-privacy.md b/windows/client-management/mdm/policy-csp-privacy.md index f96c5acb6a..ade6bf6cb1 100644 --- a/windows/client-management/mdm/policy-csp-privacy.md +++ b/windows/client-management/mdm/policy-csp-privacy.md @@ -1,14 +1,7 @@ --- title: Privacy Policy CSP description: Learn more about the Privacy Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/30/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 06/28/2024 --- @@ -16,8 +9,6 @@ ms.topic: reference # Policy CSP - Privacy -[!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)] - @@ -2407,6 +2398,207 @@ List of semi-colon delimited Package Family Names of Windows Store Apps. The use + +## LetAppsAccessGenerativeAI + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Privacy/LetAppsAccessGenerativeAI +``` + + + + +This policy setting specifies whether Windows apps can use generative AI features of Windows. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | Range: `[0-2]` | +| Default Value | 0 | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | LetAppsAccessGenerativeAI | +| Path | AppPrivacy > AT > WindowsComponents > AppPrivacy | +| Element Name | LetAppsAccessGenerativeAI_Enum | + + + + + + + + + +## LetAppsAccessGenerativeAI_ForceAllowTheseApps + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Privacy/LetAppsAccessGenerativeAI_ForceAllowTheseApps +``` + + + + +List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed to use generative AI features of Windows. This setting overrides the default LetAppsAccessGenerativeAI policy setting for the specified apps. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `chr` (string) | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | List (Delimiter: `;`) | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | LetAppsAccessGenerativeAI | +| Path | AppPrivacy > AT > WindowsComponents > AppPrivacy | +| Element Name | LetAppsAccessGenerativeAI_ForceAllowTheseApps_List | + + + + + + + + + +## LetAppsAccessGenerativeAI_ForceDenyTheseApps + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Privacy/LetAppsAccessGenerativeAI_ForceDenyTheseApps +``` + + + + +List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied the use generative AI features of Windows. This setting overrides the default LetAppsAccessGenerativeAI policy setting for the specified apps. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `chr` (string) | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | List (Delimiter: `;`) | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | LetAppsAccessGenerativeAI | +| Path | AppPrivacy > AT > WindowsComponents > AppPrivacy | +| Element Name | LetAppsAccessGenerativeAI_ForceDenyTheseApps_List | + + + + + + + + + +## LetAppsAccessGenerativeAI_UserInControlOfTheseApps + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Privacy/LetAppsAccessGenerativeAI_UserInControlOfTheseApps +``` + + + + +List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the generative AI setting for the listed apps. This setting overrides the default LetAppsAccessGenerativeAI policy setting for the specified apps. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `chr` (string) | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | List (Delimiter: `;`) | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | LetAppsAccessGenerativeAI | +| Path | AppPrivacy > AT > WindowsComponents > AppPrivacy | +| Element Name | LetAppsAccessGenerativeAI_UserInControlOfTheseApps_List | + + + + + + + + ## LetAppsAccessGraphicsCaptureProgrammatic @@ -2936,7 +3128,7 @@ If an app is open when this Group Policy object is applied on a device, employee | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview [10.0.25000] | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.25000] and later | @@ -3012,7 +3204,7 @@ If an app is open when this Group Policy object is applied on a device, employee | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview [10.0.25000] | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.25000] and later | @@ -3077,7 +3269,7 @@ If an app is open when this Group Policy object is applied on a device, employee | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview [10.0.25000] | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.25000] and later | @@ -3142,7 +3334,7 @@ If an app is open when this Group Policy object is applied on a device, employee | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview [10.0.25000] | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.25000] and later | diff --git a/windows/client-management/mdm/policy-csp-remoteassistance.md b/windows/client-management/mdm/policy-csp-remoteassistance.md index fa85c9cec4..1e190204ac 100644 --- a/windows/client-management/mdm/policy-csp-remoteassistance.md +++ b/windows/client-management/mdm/policy-csp-remoteassistance.md @@ -1,14 +1,7 @@ --- title: RemoteAssistance Policy CSP description: Learn more about the RemoteAssistance Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-remotedesktop.md b/windows/client-management/mdm/policy-csp-remotedesktop.md index e112f3b6d8..caa589b6f9 100644 --- a/windows/client-management/mdm/policy-csp-remotedesktop.md +++ b/windows/client-management/mdm/policy-csp-remotedesktop.md @@ -1,14 +1,7 @@ --- title: RemoteDesktop Policy CSP description: Learn more about the RemoteDesktop Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-remotedesktopservices.md b/windows/client-management/mdm/policy-csp-remotedesktopservices.md index a2eceff277..4e865bd15f 100644 --- a/windows/client-management/mdm/policy-csp-remotedesktopservices.md +++ b/windows/client-management/mdm/policy-csp-remotedesktopservices.md @@ -1,14 +1,7 @@ --- title: RemoteDesktopServices Policy CSP description: Learn more about the RemoteDesktopServices Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 06/28/2024 --- @@ -157,6 +150,106 @@ FIPS compliance can be configured through the System cryptography. Use FIPS comp + +## DisconnectOnLockLegacyAuthn + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/RemoteDesktopServices/DisconnectOnLockLegacyAuthn +``` + + + + + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `chr` (string) | +| Access Type | Add, Delete, Get, Replace | + + + + +[!INCLUDE [ADMX-backed policy note](includes/mdm-admx-policy-note.md)] + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | TS_DISCONNECT_ON_LOCK_POLICY | +| ADMX File Name | terminalserver.admx | + + + + + + + + + +## DisconnectOnLockMicrosoftIdentityAuthn + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/RemoteDesktopServices/DisconnectOnLockMicrosoftIdentityAuthn +``` + + + + + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `chr` (string) | +| Access Type | Add, Delete, Get, Replace | + + + + +[!INCLUDE [ADMX-backed policy note](includes/mdm-admx-policy-note.md)] + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | TS_DISCONNECT_ON_LOCK_AAD_POLICY | +| ADMX File Name | terminalserver.admx | + + + + + + + + ## DoNotAllowDriveRedirection @@ -346,7 +439,7 @@ By default, Remote Desktop allows redirection of WebAuthn requests. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ✅ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
                        ✅ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.2523] and later
                        ✅ [10.0.25398.946] and later
                        ✅ Windows 11, version 21H2 [10.0.22000.3014] and later
                        ✅ Windows 11, version 22H2 [10.0.22621.3672] and later
                        ✅ Windows 11, version 23H2 [10.0.22631.3672] and later
                        ✅ Windows Insider Preview | @@ -400,7 +493,7 @@ By default, Remote Desktop allows redirection of WebAuthn requests. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ✅ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
                        ✅ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.2523] and later
                        ✅ [10.0.25398.946] and later
                        ✅ Windows 11, version 21H2 [10.0.22000.3014] and later
                        ✅ Windows 11, version 22H2 [10.0.22621.3672] and later
                        ✅ Windows 11, version 23H2 [10.0.22631.3672] and later
                        ✅ Windows Insider Preview | @@ -579,6 +672,56 @@ If the status is set to Not Configured, unsecured communication is allowed. + +## TS_SERVER_REMOTEAPP_USE_SHELLAPPRUNTIME + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.2400] and later
                        ✅ [10.0.25398.827] and later
                        ✅ Windows 11, version 21H2 [10.0.22000.2898] and later
                        ✅ Windows 11, version 22H2 [10.0.22621.3374] and later
                        ✅ Windows 11, version 23H2 [10.0.22631.3374] and later
                        ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/RemoteDesktopServices/TS_SERVER_REMOTEAPP_USE_SHELLAPPRUNTIME +``` + + + + + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `chr` (string) | +| Access Type | Add, Delete, Get, Replace | + + + + +[!INCLUDE [ADMX-backed policy note](includes/mdm-admx-policy-note.md)] + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | TS_SERVER_REMOTEAPP_USE_SHELLAPPRUNTIME | +| ADMX File Name | TerminalServer.admx | + + + + + + + + diff --git a/windows/client-management/mdm/policy-csp-remotemanagement.md b/windows/client-management/mdm/policy-csp-remotemanagement.md index 1a0bbae405..0f19f54970 100644 --- a/windows/client-management/mdm/policy-csp-remotemanagement.md +++ b/windows/client-management/mdm/policy-csp-remotemanagement.md @@ -1,14 +1,7 @@ --- title: RemoteManagement Policy CSP description: Learn more about the RemoteManagement Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-remoteprocedurecall.md b/windows/client-management/mdm/policy-csp-remoteprocedurecall.md index c939be5ef0..1def7d700f 100644 --- a/windows/client-management/mdm/policy-csp-remoteprocedurecall.md +++ b/windows/client-management/mdm/policy-csp-remoteprocedurecall.md @@ -1,14 +1,7 @@ --- title: RemoteProcedureCall Policy CSP description: Learn more about the RemoteProcedureCall Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-remoteshell.md b/windows/client-management/mdm/policy-csp-remoteshell.md index 95deedc15b..e7c0d076a7 100644 --- a/windows/client-management/mdm/policy-csp-remoteshell.md +++ b/windows/client-management/mdm/policy-csp-remoteshell.md @@ -1,14 +1,7 @@ --- title: RemoteShell Policy CSP description: Learn more about the RemoteShell Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-restrictedgroups.md b/windows/client-management/mdm/policy-csp-restrictedgroups.md index 83c65f6386..6c8af25f6a 100644 --- a/windows/client-management/mdm/policy-csp-restrictedgroups.md +++ b/windows/client-management/mdm/policy-csp-restrictedgroups.md @@ -1,14 +1,7 @@ --- title: RestrictedGroups Policy CSP description: Learn more about the RestrictedGroups Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-search.md b/windows/client-management/mdm/policy-csp-search.md index 624d6566b7..8734513a6e 100644 --- a/windows/client-management/mdm/policy-csp-search.md +++ b/windows/client-management/mdm/policy-csp-search.md @@ -1,14 +1,7 @@ --- title: Search Policy CSP description: Learn more about the Search Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 10/24/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 07/08/2024 --- @@ -293,7 +286,7 @@ The most restrictive value is `0` to not allow indexing of encrypted items. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 2009 [10.0.19042.1620] and later
                        ✅ Windows 10, version 21H1 [10.0.19043.1620] and later
                        ✅ Windows 10, version 21H2 [10.0.19044.1620] and later
                        ✅ Windows 11, version 21H2 [10.0.22000.1761] and later
                        ✅ Windows 11, version 22H2 [10.0.22621] and later | @@ -926,7 +919,7 @@ This policy setting configures whether or not locations on removable drives can | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1803 [10.0.17134] and later | +| ✅ Device
                        ❌ User | ❌ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1803 [10.0.17134] and later | @@ -1123,7 +1116,7 @@ If enabled, clients will be unable to query this computer's index remotely. Thus | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later | +| ✅ Device
                        ❌ User | Not applicable | ✅ Windows 10, version 1607 [10.0.14393] and later | diff --git a/windows/client-management/mdm/policy-csp-security.md b/windows/client-management/mdm/policy-csp-security.md index ef1082ff7d..25e55a8941 100644 --- a/windows/client-management/mdm/policy-csp-security.md +++ b/windows/client-management/mdm/policy-csp-security.md @@ -1,14 +1,7 @@ --- title: Security Policy CSP description: Learn more about the Security Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 04/10/2024 --- @@ -78,7 +71,7 @@ Specifies whether to allow the runtime configuration agent to install provisioni | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1507 [10.0.10240] and later | +| ✅ Device
                        ❌ User | ❌ Pro
                        ❌ Enterprise
                        ❌ Education
                        ❌ Windows SE
                        ❌ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1507 [10.0.10240] and later | @@ -179,7 +172,7 @@ Specifies whether to allow the runtime configuration agent to remove provisionin | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1507 [10.0.10240] and later | +| ✅ Device
                        ❌ User | Not applicable | ✅ Windows 10, version 1507 [10.0.10240] and later | diff --git a/windows/client-management/mdm/policy-csp-servicecontrolmanager.md b/windows/client-management/mdm/policy-csp-servicecontrolmanager.md index 73dbb1343a..46c10a8e9a 100644 --- a/windows/client-management/mdm/policy-csp-servicecontrolmanager.md +++ b/windows/client-management/mdm/policy-csp-servicecontrolmanager.md @@ -1,14 +1,7 @@ --- title: ServiceControlManager Policy CSP description: Learn more about the ServiceControlManager Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-settings.md b/windows/client-management/mdm/policy-csp-settings.md index 9f5437e695..bf9e5d11f5 100644 --- a/windows/client-management/mdm/policy-csp-settings.md +++ b/windows/client-management/mdm/policy-csp-settings.md @@ -1,14 +1,7 @@ --- title: Settings Policy CSP description: Learn more about the Settings Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 05/20/2024 --- @@ -176,10 +169,13 @@ Allows the user to change date and time settings. ## AllowEditDeviceName +> [!NOTE] +> This policy is deprecated and may be removed in a future release. + | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later | +| ✅ Device
                        ❌ User | Not applicable | ✅ Windows 10, version 1607 [10.0.14393] and later | @@ -190,7 +186,7 @@ Allows the user to change date and time settings. -Allows the user to edit the device name. +This policy is deprecated. diff --git a/windows/client-management/mdm/policy-csp-settingssync.md b/windows/client-management/mdm/policy-csp-settingssync.md index 954bbaeaf2..39e032a8b4 100644 --- a/windows/client-management/mdm/policy-csp-settingssync.md +++ b/windows/client-management/mdm/policy-csp-settingssync.md @@ -1,14 +1,7 @@ --- title: SettingsSync Policy CSP description: Learn more about the SettingsSync Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/30/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-smartscreen.md b/windows/client-management/mdm/policy-csp-smartscreen.md index a59c0981e8..6e99e05ccb 100644 --- a/windows/client-management/mdm/policy-csp-smartscreen.md +++ b/windows/client-management/mdm/policy-csp-smartscreen.md @@ -1,14 +1,7 @@ --- title: SmartScreen Policy CSP description: Learn more about the SmartScreen Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/31/2024 --- @@ -77,6 +70,8 @@ App Install Control is a feature of Windows Defender SmartScreen that helps prot |:--|:--| | 0 (Default) | Turns off Application Installation Control, allowing users to download and install files from anywhere on the web. | | 1 | Turns on Application Installation Control, allowing users to only install apps from the Store. | +| 2 | Turns on Application Installation Control, letting users know that there's a comparable app in the Store. | +| 3 | Turns on Application Installation Control, warning users before installing apps from outside the Store. | diff --git a/windows/client-management/mdm/policy-csp-speech.md b/windows/client-management/mdm/policy-csp-speech.md index bf6e6f78d4..437f917212 100644 --- a/windows/client-management/mdm/policy-csp-speech.md +++ b/windows/client-management/mdm/policy-csp-speech.md @@ -1,14 +1,7 @@ --- title: Speech Policy CSP description: Learn more about the Speech Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-start.md b/windows/client-management/mdm/policy-csp-start.md index 838e2faf41..cfa71536be 100644 --- a/windows/client-management/mdm/policy-csp-start.md +++ b/windows/client-management/mdm/policy-csp-start.md @@ -1,14 +1,7 @@ --- title: Start Policy CSP description: Learn more about the Start Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 09/25/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -549,7 +542,7 @@ Allows admin to override the default items pinned to Start. With this policy you can push a new list of pinned apps to override the default/current list of pinned apps in the Windows Start menu. -For more information on how to configure the Start menu, see [Customize the Start menu layout on Windows 11](/windows/configuration/customize-start-menu-layout-windows-11). +For more information on how to configure the Start menu, see [Customize the Start layout](/windows/configuration/start/layout). This string policy takes a JSON file named `LayoutModification.json`. The file enumerates the items to pin and their relative order. diff --git a/windows/client-management/mdm/policy-csp-stickers.md b/windows/client-management/mdm/policy-csp-stickers.md index 9f2e6a4f60..34b5c89385 100644 --- a/windows/client-management/mdm/policy-csp-stickers.md +++ b/windows/client-management/mdm/policy-csp-stickers.md @@ -1,14 +1,7 @@ --- title: Stickers Policy CSP description: Learn more about the Stickers Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-storage.md b/windows/client-management/mdm/policy-csp-storage.md index 3e241acee7..78f789eba8 100644 --- a/windows/client-management/mdm/policy-csp-storage.md +++ b/windows/client-management/mdm/policy-csp-storage.md @@ -1,14 +1,7 @@ --- title: Storage Policy CSP description: Learn more about the Storage Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-sudo.md b/windows/client-management/mdm/policy-csp-sudo.md new file mode 100644 index 0000000000..09a4e3c938 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-sudo.md @@ -0,0 +1,85 @@ +--- +title: Sudo Policy CSP +description: Learn more about the Sudo Area in Policy CSP. +ms.date: 04/10/2024 +--- + + + + +# Policy CSP - Sudo + +[!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)] + + + + + + +## EnableSudo + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
                        ❌ User | ❌ Pro
                        ❌ Enterprise
                        ❌ Education
                        ❌ Windows SE
                        ❌ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Sudo/EnableSudo +``` + + + + + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 3 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | Sudo is disabled. | +| 1 | Sudo is allowed in 'force new window' mode. | +| 2 | Sudo is allowed in 'disable input' mode. | +| 3 (Default) | Sudo is allowed in 'inline' mode. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | EnableSudo | +| Path | Sudo > AT > System | + + + + + + + + + + + + + + +## Related articles + +[Policy configuration service provider](policy-configuration-service-provider.md) diff --git a/windows/client-management/mdm/policy-csp-system.md b/windows/client-management/mdm/policy-csp-system.md index 22ff8ce8ea..337e3987e3 100644 --- a/windows/client-management/mdm/policy-csp-system.md +++ b/windows/client-management/mdm/policy-csp-system.md @@ -1,14 +1,7 @@ --- title: System Policy CSP description: Learn more about the System Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-systemservices.md b/windows/client-management/mdm/policy-csp-systemservices.md index b0e97a7454..2d9c9595f5 100644 --- a/windows/client-management/mdm/policy-csp-systemservices.md +++ b/windows/client-management/mdm/policy-csp-systemservices.md @@ -1,14 +1,7 @@ --- title: SystemServices Policy CSP description: Learn more about the SystemServices Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 04/10/2024 --- @@ -16,6 +9,8 @@ ms.topic: reference # Policy CSP - SystemServices +[!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)] + @@ -26,7 +21,7 @@ ms.topic: reference | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1803 [10.0.17134] and later | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -176,7 +171,7 @@ This setting determines whether the service's start type is Automatic(2), Manual | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1803 [10.0.17134] and later | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -226,7 +221,7 @@ This setting determines whether the service's start type is Automatic(2), Manual | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1803 [10.0.17134] and later | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -276,7 +271,7 @@ This setting determines whether the service's start type is Automatic(2), Manual | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1803 [10.0.17134] and later | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -326,7 +321,7 @@ This setting determines whether the service's start type is Automatic(2), Manual | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1803 [10.0.17134] and later | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -376,7 +371,7 @@ This setting determines whether the service's start type is Automatic(2), Manual | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1803 [10.0.17134] and later | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -426,7 +421,7 @@ This setting determines whether the service's start type is Automatic(2), Manual | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1803 [10.0.17134] and later | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -476,7 +471,7 @@ This setting determines whether the service's start type is Automatic(2), Manual | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1803 [10.0.17134] and later | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -526,7 +521,7 @@ This setting determines whether the service's start type is Automatic(2), Manual | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1803 [10.0.17134] and later | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -576,7 +571,7 @@ This setting determines whether the service's start type is Automatic(2), Manual | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1803 [10.0.17134] and later | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -626,7 +621,7 @@ This setting determines whether the service's start type is Automatic(2), Manual | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1803 [10.0.17134] and later | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -676,7 +671,7 @@ This setting determines whether the service's start type is Automatic(2), Manual | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1803 [10.0.17134] and later | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -726,7 +721,7 @@ This setting determines whether the service's start type is Automatic(2), Manual | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1803 [10.0.17134] and later | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -776,7 +771,7 @@ This setting determines whether the service's start type is Automatic(2), Manual | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1803 [10.0.17134] and later | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -826,7 +821,7 @@ This setting determines whether the service's start type is Automatic(2), Manual | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1803 [10.0.17134] and later | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -876,7 +871,7 @@ This setting determines whether the service's start type is Automatic(2), Manual | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1803 [10.0.17134] and later | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | diff --git a/windows/client-management/mdm/policy-csp-taskmanager.md b/windows/client-management/mdm/policy-csp-taskmanager.md index 9882cd2083..439cfdb8d3 100644 --- a/windows/client-management/mdm/policy-csp-taskmanager.md +++ b/windows/client-management/mdm/policy-csp-taskmanager.md @@ -1,14 +1,7 @@ --- title: TaskManager Policy CSP description: Learn more about the TaskManager Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-taskscheduler.md b/windows/client-management/mdm/policy-csp-taskscheduler.md index 61603da719..a847cb3ec9 100644 --- a/windows/client-management/mdm/policy-csp-taskscheduler.md +++ b/windows/client-management/mdm/policy-csp-taskscheduler.md @@ -1,14 +1,7 @@ --- title: TaskScheduler Policy CSP description: Learn more about the TaskScheduler Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-tenantdefinedtelemetry.md b/windows/client-management/mdm/policy-csp-tenantdefinedtelemetry.md index 32c6595782..6c9181ab8c 100644 --- a/windows/client-management/mdm/policy-csp-tenantdefinedtelemetry.md +++ b/windows/client-management/mdm/policy-csp-tenantdefinedtelemetry.md @@ -1,14 +1,7 @@ --- title: TenantDefinedTelemetry Policy CSP description: Learn more about the TenantDefinedTelemetry Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-tenantrestrictions.md b/windows/client-management/mdm/policy-csp-tenantrestrictions.md index 62451125d8..b0838899b1 100644 --- a/windows/client-management/mdm/policy-csp-tenantrestrictions.md +++ b/windows/client-management/mdm/policy-csp-tenantrestrictions.md @@ -1,14 +1,7 @@ --- title: TenantRestrictions Policy CSP description: Learn more about the TenantRestrictions Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-textinput.md b/windows/client-management/mdm/policy-csp-textinput.md index 49037f5600..359c78a5c8 100644 --- a/windows/client-management/mdm/policy-csp-textinput.md +++ b/windows/client-management/mdm/policy-csp-textinput.md @@ -1,14 +1,7 @@ --- title: TextInput Policy CSP description: Learn more about the TextInput Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-timelanguagesettings.md b/windows/client-management/mdm/policy-csp-timelanguagesettings.md index 216139ba2a..cfd36f3bb7 100644 --- a/windows/client-management/mdm/policy-csp-timelanguagesettings.md +++ b/windows/client-management/mdm/policy-csp-timelanguagesettings.md @@ -1,14 +1,7 @@ --- title: TimeLanguageSettings Policy CSP description: Learn more about the TimeLanguageSettings Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 04/10/2024 --- @@ -29,7 +22,7 @@ ms.topic: reference | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1703 [10.0.15063] and later | +| ✅ Device
                        ❌ User | Not applicable | ✅ Windows 10, version 1703 [10.0.15063] and later | diff --git a/windows/client-management/mdm/policy-csp-troubleshooting.md b/windows/client-management/mdm/policy-csp-troubleshooting.md index 96e90c4433..4e27dcdaee 100644 --- a/windows/client-management/mdm/policy-csp-troubleshooting.md +++ b/windows/client-management/mdm/policy-csp-troubleshooting.md @@ -1,14 +1,7 @@ --- title: Troubleshooting Policy CSP description: Learn more about the Troubleshooting Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-update.md b/windows/client-management/mdm/policy-csp-update.md index 5232cbd5a3..796984d07c 100644 --- a/windows/client-management/mdm/policy-csp-update.md +++ b/windows/client-management/mdm/policy-csp-update.md @@ -1,14 +1,7 @@ --- title: Update Policy CSP description: Learn more about the Update Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 06/19/2024 --- @@ -25,6 +18,7 @@ ms.topic: reference Update CSP policies are listed below based on the group policy area: - [Windows Insider Preview](#windows-insider-preview) + - [AlwaysAutoRebootAtScheduledTimeMinutes](#alwaysautorebootatscheduledtimeminutes) - [ConfigureDeadlineNoAutoRebootForFeatureUpdates](#configuredeadlinenoautorebootforfeatureupdates) - [ConfigureDeadlineNoAutoRebootForQualityUpdates](#configuredeadlinenoautorebootforqualityupdates) - [Manage updates offered from Windows Update](#manage-updates-offered-from-windows-update) @@ -107,6 +101,68 @@ Update CSP policies are listed below based on the group policy area: ## Windows Insider Preview + +### AlwaysAutoRebootAtScheduledTimeMinutes + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/AlwaysAutoRebootAtScheduledTimeMinutes +``` + + + + + +- If you enable this policy, a restart timer will always begin immediately after Windows Update installs important updates, instead of first notifying users on the login screen for at least two days. + +The restart timer can be configured to start with any value from 15 to 180 minutes. When the timer runs out, the restart will proceed even if the PC has signed-in users. + +- If you disable or don't configure this policy, Windows Update won't alter its restart behavior. + +If the "No auto-restart with logged-on users for scheduled automatic updates installations" policy is enabled, then this policy has no effect. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | Range: `[15-180]` | +| Default Value | 15 | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | AlwaysAutoRebootAtScheduledTime | +| Friendly Name | Always automatically restart at the scheduled time | +| Element Name | work (minutes) | +| Location | Computer Configuration | +| Path | Windows Components > Windows Update > Manage end user experience | +| Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate\AU | +| ADMX File Name | WindowsUpdate.admx | + + + + + + + + ### ConfigureDeadlineNoAutoRebootForFeatureUpdates @@ -282,7 +338,7 @@ Allows the IT admin to manage whether Automatic Updates accepts updates signed b | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621] and later | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 21H2 [10.0.19044.3757] and later | @@ -1563,7 +1619,8 @@ Configure this policy to specify whether to receive **Windows Feature Updates** - SetPolicyDrivenUpdateSourceForOtherUpdates > [!NOTE] -> If you have not properly configured Update/UpdateServiceUrl correctly to point to your WSUS server, this policy will have no effect. +> - If you have not properly configured Update/UpdateServiceUrl correctly to point to your WSUS server, this policy will have no effect. +> - If you're also using the **Specify settings for optional component installation and component repair** ([ADMX_Servicing](policy-csp-admx-servicing.md)) policy to enable content for FoDs and language packs, see [How to make Features on Demand and language packs available when you're using WSUS or Configuration Manager](/windows/deployment/update/fod-and-lang-packs) to verify your policy configuration. @@ -1701,7 +1758,8 @@ Configure this policy to specify whether to receive **Windows Quality Updates** - SetPolicyDrivenUpdateSourceForOtherUpdates > [!NOTE] -> If you have not properly configured Update/UpdateServiceUrl correctly to point to your WSUS server, this policy will have no effect. +> - If you have not properly configured Update/UpdateServiceUrl correctly to point to your WSUS server, this policy will have no effect. +> - If you're also using the **Specify settings for optional component installation and component repair** ([ADMX_Servicing](policy-csp-admx-servicing.md)) policy to enable content for FoDs and language packs, see [How to make Features on Demand and language packs available when you're using WSUS or Configuration Manager](/windows/deployment/update/fod-and-lang-packs) to verify your policy configuration. @@ -2294,7 +2352,8 @@ Allows the IT admin to manage whether to scan for app updates from Microsoft Upd > [!NOTE] -> Setting this policy back to 0 or Not configured doesn't revert the configuration to receive updates from Microsoft Update automatically. In order to revert the configuration, you can run the PowerShell commands that are listed below to remove the Microsoft Update service: +> - For a list of other Microsoft products that might be updated, see [Update other Microsoft products](/windows/deployment/update/update-other-microsoft-products). +> - Setting this policy back to 0 or Not configured doesn't revert the configuration to receive updates from Microsoft Update automatically. In order to revert the configuration, you can run the PowerShell commands that are listed below to remove the Microsoft Update service: > > ```powershell > $MUSM = New-Object -ComObject "Microsoft.Update.ServiceManager" @@ -2435,7 +2494,7 @@ Number of days before feature updates are installed on devices automatically reg > [!NOTE] -> +> > - After the deadline passes, restarts will occur regardless of active hours and users won't be able to reschedule. > - When this policy is used, the download, installation, and reboot settings from [Update/AllowAutoUpdate](#allowautoupdate) are ignored. @@ -2494,7 +2553,7 @@ Number of days before quality updates are installed on devices automatically reg > [!NOTE] -> +> > - After the deadline passes, restarts will occur regardless of active hours and users won't be able to reschedule. > - When this policy is used, the download, installation, and reboot settings from [Update/AllowAutoUpdate](#allowautoupdate) are ignored. diff --git a/windows/client-management/mdm/policy-csp-userrights.md b/windows/client-management/mdm/policy-csp-userrights.md index 39a023b122..dc226ea336 100644 --- a/windows/client-management/mdm/policy-csp-userrights.md +++ b/windows/client-management/mdm/policy-csp-userrights.md @@ -1,14 +1,7 @@ --- title: UserRights Policy CSP description: Learn more about the UserRights Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-virtualizationbasedtechnology.md b/windows/client-management/mdm/policy-csp-virtualizationbasedtechnology.md index 5c2fd4615b..bfea6628c8 100644 --- a/windows/client-management/mdm/policy-csp-virtualizationbasedtechnology.md +++ b/windows/client-management/mdm/policy-csp-virtualizationbasedtechnology.md @@ -1,14 +1,7 @@ --- title: VirtualizationBasedTechnology Policy CSP description: Learn more about the VirtualizationBasedTechnology Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-webthreatdefense.md b/windows/client-management/mdm/policy-csp-webthreatdefense.md index e415fba8e2..0b01461d1e 100644 --- a/windows/client-management/mdm/policy-csp-webthreatdefense.md +++ b/windows/client-management/mdm/policy-csp-webthreatdefense.md @@ -1,14 +1,7 @@ --- title: WebThreatDefense Policy CSP description: Learn more about the WebThreatDefense Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/31/2024 --- @@ -16,6 +9,8 @@ ms.topic: reference # Policy CSP - WebThreatDefense +[!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)] + > [!NOTE] @@ -28,7 +23,7 @@ ms.topic: reference | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 23H2 [10.0.22631] and later | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | diff --git a/windows/client-management/mdm/policy-csp-wifi.md b/windows/client-management/mdm/policy-csp-wifi.md index 0eb72b28a0..677a40fffb 100644 --- a/windows/client-management/mdm/policy-csp-wifi.md +++ b/windows/client-management/mdm/policy-csp-wifi.md @@ -1,14 +1,7 @@ --- title: Wifi Policy CSP description: Learn more about the Wifi Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/31/2024 --- @@ -16,6 +9,8 @@ ms.topic: reference # Policy CSP - Wifi +[!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)] + @@ -234,7 +229,7 @@ Allow or disallow connecting to Wi-Fi outside of MDM server-installed networks. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -284,7 +279,7 @@ Allow or disallow the device to use the DSCP to UP Mapping feature from the Wi-F | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | diff --git a/windows/client-management/mdm/policy-csp-windowsai.md b/windows/client-management/mdm/policy-csp-windowsai.md index bf5ad5e22a..c971a471a8 100644 --- a/windows/client-management/mdm/policy-csp-windowsai.md +++ b/windows/client-management/mdm/policy-csp-windowsai.md @@ -1,14 +1,7 @@ --- title: WindowsAI Policy CSP description: Learn more about the WindowsAI Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 06/28/2024 --- @@ -16,17 +9,80 @@ ms.topic: reference # Policy CSP - WindowsAI +[!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)] + + +## DisableAIDataAnalysis + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ❌ Device
                        ✅ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```User +./User/Vendor/MSFT/Policy/Config/WindowsAI/DisableAIDataAnalysis +``` + + + + +This policy setting allows you to determine whether end users have the option to allow snapshots to be saved on their PCs. If disabled, end users will have a choice to save snapshots of their screen on their PC and then use Recall to find things they've seen. If the policy is enabled, end users won't be able to save snapshots on their PC. If the policy isn't configured, end users may or may not be able to save snapshots on their PC-depending on other policy configurations. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Enable Saving Snapshots for Windows. | +| 1 | Disable Saving Snapshots for Windows. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | DisableAIDataAnalysis | +| Path | WindowsAI > AT > WindowsComponents > WindowsAI | + + + + + + + + ## TurnOffWindowsCopilot +> [!NOTE] +> This policy is deprecated and may be removed in a future release. + | Scope | Editions | Applicable OS | |:--|:--|:--| -| ❌ Device
                        ✅ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621.2360] and later
                        ✅ Windows 11, version 23H2 [10.0.22631] and later | +| ❌ Device
                        ✅ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 21H2 [10.0.19044.3758] and later
                        ✅ Windows 10, version 22H2 [10.0.19045.3758] and later
                        ✅ Windows 11, version 22H2 [10.0.22621.2361] and later
                        ✅ Windows 11, version 23H2 [10.0.22631] and later | @@ -45,6 +101,9 @@ This policy setting allows you to turn off Windows Copilot. + +> [!Note] +> - The TurnOffWindowsCopilot policy isn't for the [new Copilot experience](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/evolving-copilot-in-windows-for-your-workforce/ba-p/4141999) that's in some [Windows Insider builds](https://blogs.windows.com/windows-insider/2024/05/22/releasing-windows-11-version-24h2-to-the-release-preview-channel/) and that will be gradually rolling out to Windows 11 and Windows 10 devices. diff --git a/windows/client-management/mdm/policy-csp-windowsautopilot.md b/windows/client-management/mdm/policy-csp-windowsautopilot.md index 6fc277fe8f..1e3b68c37a 100644 --- a/windows/client-management/mdm/policy-csp-windowsautopilot.md +++ b/windows/client-management/mdm/policy-csp-windowsautopilot.md @@ -1,14 +1,7 @@ --- title: WindowsAutopilot Policy CSP description: Learn more about the WindowsAutopilot Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-windowsconnectionmanager.md b/windows/client-management/mdm/policy-csp-windowsconnectionmanager.md index 3b1491564f..ae7bafe0cf 100644 --- a/windows/client-management/mdm/policy-csp-windowsconnectionmanager.md +++ b/windows/client-management/mdm/policy-csp-windowsconnectionmanager.md @@ -1,14 +1,7 @@ --- title: WindowsConnectionManager Policy CSP description: Learn more about the WindowsConnectionManager Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md b/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md index 44ed4083ba..bc665f2973 100644 --- a/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md +++ b/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md @@ -1,14 +1,7 @@ --- title: WindowsDefenderSecurityCenter Policy CSP description: Learn more about the WindowsDefenderSecurityCenter Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-windowsinkworkspace.md b/windows/client-management/mdm/policy-csp-windowsinkworkspace.md index a2608dd9a9..c84c0bded7 100644 --- a/windows/client-management/mdm/policy-csp-windowsinkworkspace.md +++ b/windows/client-management/mdm/policy-csp-windowsinkworkspace.md @@ -1,14 +1,7 @@ --- title: WindowsInkWorkspace Policy CSP description: Learn more about the WindowsInkWorkspace Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-windowslogon.md b/windows/client-management/mdm/policy-csp-windowslogon.md index 7f43647495..d9c4d40da1 100644 --- a/windows/client-management/mdm/policy-csp-windowslogon.md +++ b/windows/client-management/mdm/policy-csp-windowslogon.md @@ -1,14 +1,7 @@ --- title: WindowsLogon Policy CSP description: Learn more about the WindowsLogon Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 10/24/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 04/10/2024 --- @@ -396,6 +389,13 @@ This policy controls the configuration under which winlogon sends MPR notificati +> [!NOTE] +> Starting in Windows Insiders build 25216, the behavior of EnableMPRNotifications policy was changed, and the Group Policy was updated with the following text: +> +> - **Friendly name**: Configure the transmission of the user's password in the content of MPR notifications sent by winlogon +> - **Description**: This policy controls whether the user's password is included in the content of MPR notifications sent by winlogon in the system. +> - If you disable this setting or do not configure it, winlogon sends MPR notifications with empty password fields of the user's authentication info. +> - If you enable this setting, winlogon sends MPR notifications containing the user's password in the authentication info. diff --git a/windows/client-management/mdm/policy-csp-windowspowershell.md b/windows/client-management/mdm/policy-csp-windowspowershell.md index 2a3b6be557..9e4a87efb2 100644 --- a/windows/client-management/mdm/policy-csp-windowspowershell.md +++ b/windows/client-management/mdm/policy-csp-windowspowershell.md @@ -1,14 +1,7 @@ --- title: WindowsPowerShell Policy CSP description: Learn more about the WindowsPowerShell Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-windowssandbox.md b/windows/client-management/mdm/policy-csp-windowssandbox.md index be6709c49c..ffa94e847a 100644 --- a/windows/client-management/mdm/policy-csp-windowssandbox.md +++ b/windows/client-management/mdm/policy-csp-windowssandbox.md @@ -1,14 +1,7 @@ --- title: WindowsSandbox Policy CSP description: Learn more about the WindowsSandbox Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-wirelessdisplay.md b/windows/client-management/mdm/policy-csp-wirelessdisplay.md index 2d101d6563..70e8e67fba 100644 --- a/windows/client-management/mdm/policy-csp-wirelessdisplay.md +++ b/windows/client-management/mdm/policy-csp-wirelessdisplay.md @@ -1,14 +1,7 @@ --- title: WirelessDisplay Policy CSP description: Learn more about the WirelessDisplay Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/printerprovisioning-csp.md b/windows/client-management/mdm/printerprovisioning-csp.md index bea685738c..a80ace3abb 100644 --- a/windows/client-management/mdm/printerprovisioning-csp.md +++ b/windows/client-management/mdm/printerprovisioning-csp.md @@ -1,14 +1,7 @@ --- title: PrinterProvisioning CSP description: Learn more about the PrinterProvisioning CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/printerprovisioning-ddf-file.md b/windows/client-management/mdm/printerprovisioning-ddf-file.md index d7306bda75..e4db037ecb 100644 --- a/windows/client-management/mdm/printerprovisioning-ddf-file.md +++ b/windows/client-management/mdm/printerprovisioning-ddf-file.md @@ -1,14 +1,7 @@ --- title: PrinterProvisioning DDF file description: View the XML file containing the device description framework (DDF) for the PrinterProvisioning configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 06/02/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 06/28/2024 --- @@ -47,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the P 10.0.22000, 10.0.19044.1806, 10.0.19043.1806, 10.0.19042.1806 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; diff --git a/windows/client-management/mdm/provisioning-csp.md b/windows/client-management/mdm/provisioning-csp.md index 11e636ca48..62d027c686 100644 --- a/windows/client-management/mdm/provisioning-csp.md +++ b/windows/client-management/mdm/provisioning-csp.md @@ -1,13 +1,6 @@ --- title: Provisioning CSP description: The Provisioning configuration service provider is used for bulk user enrollment to an MDM service. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/pxlogical-csp.md b/windows/client-management/mdm/pxlogical-csp.md index bfc6a262c4..b452264fde 100644 --- a/windows/client-management/mdm/pxlogical-csp.md +++ b/windows/client-management/mdm/pxlogical-csp.md @@ -1,13 +1,6 @@ --- title: PXLOGICAL configuration service provider description: The PXLOGICAL configuration service provider is used to add, remove, or modify WAP logical and physical proxies by using WAP or the standard Windows techniques. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/reboot-csp.md b/windows/client-management/mdm/reboot-csp.md index f289a7e154..b095998bbd 100644 --- a/windows/client-management/mdm/reboot-csp.md +++ b/windows/client-management/mdm/reboot-csp.md @@ -1,14 +1,7 @@ --- title: Reboot CSP description: Learn more about the Reboot CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/reboot-ddf-file.md b/windows/client-management/mdm/reboot-ddf-file.md index c7de504eb0..ab06e22815 100644 --- a/windows/client-management/mdm/reboot-ddf-file.md +++ b/windows/client-management/mdm/reboot-ddf-file.md @@ -1,14 +1,7 @@ --- title: Reboot DDF file description: View the XML file containing the device description framework (DDF) for the Reboot configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 06/02/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 06/28/2024 --- @@ -47,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the R 10.0.14393 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; diff --git a/windows/client-management/mdm/remotefind-csp.md b/windows/client-management/mdm/remotefind-csp.md index 2b3973921d..2acb98e912 100644 --- a/windows/client-management/mdm/remotefind-csp.md +++ b/windows/client-management/mdm/remotefind-csp.md @@ -1,13 +1,6 @@ --- title: RemoteFind CSP description: The RemoteFind configuration service provider retrieves the location information for a particular device. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/remotefind-ddf-file.md b/windows/client-management/mdm/remotefind-ddf-file.md index e805197cf2..572d1cbf9e 100644 --- a/windows/client-management/mdm/remotefind-ddf-file.md +++ b/windows/client-management/mdm/remotefind-ddf-file.md @@ -1,13 +1,6 @@ --- title: RemoteFind DDF file description: This topic shows the OMA DM device description framework (DDF) for the RemoteFind configuration service provider. DDF files are used only with OMA DM provisioning XML. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 12/05/2017 --- diff --git a/windows/client-management/mdm/remotering-csp.md b/windows/client-management/mdm/remotering-csp.md index 16c44fd50b..12526066f9 100644 --- a/windows/client-management/mdm/remotering-csp.md +++ b/windows/client-management/mdm/remotering-csp.md @@ -1,13 +1,6 @@ --- title: RemoteRing CSP description: The RemoteRing CSP can be used to remotely trigger a device to produce an audible ringing sound regardless of the volume that's set on the device. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: article -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 06/26/2017 --- @@ -17,29 +10,27 @@ ms.date: 06/26/2017 You can use the RemoteRing configuration service provider to remotely trigger a device to produce an audible ringing sound, regardless of the volume that is set on the device. The following DDF format shows the RemoteRing configuration service provider in tree format. + ``` ./User/Vendor/MSFT RemoteRing ----Ring - ./Device/Vendor/MSFT Root - ./User/Vendor/MSFT ./Device/Vendor/MSFT RemoteRing ----Ring ``` -**Ring** -Required. The node accepts requests to ring the device. -The supported operation is Exec. +## Ring + +Required. The node accepts requests to ring the device. The supported operation is Exec. ## Examples - The following sample shows how to initiate a remote ring on the device. ```xml @@ -52,13 +43,3 @@ The following sample shows how to initiate a remote ring on the device. ``` - -  - -  - - - - - - diff --git a/windows/client-management/mdm/remotewipe-csp.md b/windows/client-management/mdm/remotewipe-csp.md index d0ae5d1f19..1c0afff55f 100644 --- a/windows/client-management/mdm/remotewipe-csp.md +++ b/windows/client-management/mdm/remotewipe-csp.md @@ -1,14 +1,7 @@ --- title: RemoteWipe CSP description: Learn more about the RemoteWipe CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/remotewipe-ddf-file.md b/windows/client-management/mdm/remotewipe-ddf-file.md index 1bc56998aa..6ec9d27e89 100644 --- a/windows/client-management/mdm/remotewipe-ddf-file.md +++ b/windows/client-management/mdm/remotewipe-ddf-file.md @@ -1,14 +1,7 @@ --- title: RemoteWipe DDF file description: View the XML file containing the device description framework (DDF) for the RemoteWipe configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 02/17/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/reporting-csp.md b/windows/client-management/mdm/reporting-csp.md index a6ff79d5e1..b8b1422494 100644 --- a/windows/client-management/mdm/reporting-csp.md +++ b/windows/client-management/mdm/reporting-csp.md @@ -1,13 +1,6 @@ --- title: Reporting CSP description: The Reporting configuration service provider is used to retrieve Windows Information Protection (formerly known as Enterprise Data Protection) and security auditing logs. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/reporting-ddf-file.md b/windows/client-management/mdm/reporting-ddf-file.md index 71c1e4a728..b04625ed11 100644 --- a/windows/client-management/mdm/reporting-ddf-file.md +++ b/windows/client-management/mdm/reporting-ddf-file.md @@ -1,13 +1,6 @@ --- title: Reporting DDF file description: View the OMA DM device description framework (DDF) for the Reporting configuration service provider. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 12/05/2017 --- diff --git a/windows/client-management/mdm/rootcacertificates-csp.md b/windows/client-management/mdm/rootcacertificates-csp.md index 67664ef793..6445586c10 100644 --- a/windows/client-management/mdm/rootcacertificates-csp.md +++ b/windows/client-management/mdm/rootcacertificates-csp.md @@ -1,14 +1,7 @@ --- title: RootCATrustedCertificates CSP description: Learn more about the RootCATrustedCertificates CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/rootcacertificates-ddf-file.md b/windows/client-management/mdm/rootcacertificates-ddf-file.md index bf1c7db754..5479190d60 100644 --- a/windows/client-management/mdm/rootcacertificates-ddf-file.md +++ b/windows/client-management/mdm/rootcacertificates-ddf-file.md @@ -1,14 +1,7 @@ --- title: RootCATrustedCertificates DDF file description: View the XML file containing the device description framework (DDF) for the RootCATrustedCertificates configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 06/02/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 06/28/2024 --- @@ -47,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the R 10.0.10586 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; @@ -1074,7 +1067,7 @@ The following XML file contains the device description framework (DDF) for the R 10.0.10586 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; diff --git a/windows/client-management/mdm/secureassessment-csp.md b/windows/client-management/mdm/secureassessment-csp.md index 1ccd2b55b5..172e2ef819 100644 --- a/windows/client-management/mdm/secureassessment-csp.md +++ b/windows/client-management/mdm/secureassessment-csp.md @@ -1,14 +1,7 @@ --- title: SecureAssessment CSP description: Learn more about the SecureAssessment CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 10/23/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/secureassessment-ddf-file.md b/windows/client-management/mdm/secureassessment-ddf-file.md index b7e824c5f7..7d49cb3604 100644 --- a/windows/client-management/mdm/secureassessment-ddf-file.md +++ b/windows/client-management/mdm/secureassessment-ddf-file.md @@ -1,14 +1,7 @@ --- title: SecureAssessment DDF file description: View the XML file containing the device description framework (DDF) for the SecureAssessment configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 07/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 06/28/2024 --- @@ -47,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the S 10.0.15063 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; diff --git a/windows/client-management/mdm/securitypolicy-csp.md b/windows/client-management/mdm/securitypolicy-csp.md index 49390c0ef7..c35bb9bfe7 100644 --- a/windows/client-management/mdm/securitypolicy-csp.md +++ b/windows/client-management/mdm/securitypolicy-csp.md @@ -1,13 +1,6 @@ --- title: SecurityPolicy CSP description: The SecurityPolicy CSP is used to configure security policy settings for WAP push, OMA DM, Service Indication (SI), Service Loading (SL), and MMS. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/sharedpc-csp.md b/windows/client-management/mdm/sharedpc-csp.md index f2446290ae..bdff7ac7bd 100644 --- a/windows/client-management/mdm/sharedpc-csp.md +++ b/windows/client-management/mdm/sharedpc-csp.md @@ -1,14 +1,7 @@ --- title: SharedPC CSP description: Learn more about the SharedPC CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/sharedpc-ddf-file.md b/windows/client-management/mdm/sharedpc-ddf-file.md index d04d885895..4412297df6 100644 --- a/windows/client-management/mdm/sharedpc-ddf-file.md +++ b/windows/client-management/mdm/sharedpc-ddf-file.md @@ -1,14 +1,7 @@ --- title: SharedPC DDF file description: View the XML file containing the device description framework (DDF) for the SharedPC configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 06/02/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 06/28/2024 --- @@ -47,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the S 10.0.14393 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; diff --git a/windows/client-management/mdm/storage-csp.md b/windows/client-management/mdm/storage-csp.md index 7593043812..3319247b9f 100644 --- a/windows/client-management/mdm/storage-csp.md +++ b/windows/client-management/mdm/storage-csp.md @@ -1,13 +1,6 @@ --- title: Storage CSP description: Learn how the Storage enterprise configuration service provider (CSP) is used to configure the storage card settings. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/storage-ddf-file.md b/windows/client-management/mdm/storage-ddf-file.md index 9b582019e9..e0797e83a5 100644 --- a/windows/client-management/mdm/storage-ddf-file.md +++ b/windows/client-management/mdm/storage-ddf-file.md @@ -1,13 +1,6 @@ --- title: Storage DDF file description: Learn about the OMA DM device description framework (DDF) for the Storage configuration service provider (CSP). -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 12/05/2017 --- diff --git a/windows/client-management/mdm/supl-csp.md b/windows/client-management/mdm/supl-csp.md index 90fb91e0bd..3793140f08 100644 --- a/windows/client-management/mdm/supl-csp.md +++ b/windows/client-management/mdm/supl-csp.md @@ -1,14 +1,7 @@ --- title: SUPL CSP description: Learn more about the SUPL CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/supl-ddf-file.md b/windows/client-management/mdm/supl-ddf-file.md index 6bb8f708d1..0797c3447b 100644 --- a/windows/client-management/mdm/supl-ddf-file.md +++ b/windows/client-management/mdm/supl-ddf-file.md @@ -1,14 +1,7 @@ --- title: SUPL DDF file description: View the XML file containing the device description framework (DDF) for the SUPL configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 06/02/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 06/28/2024 --- @@ -49,7 +42,7 @@ The following XML file contains the device description framework (DDF) for the S 10.0.10240 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; diff --git a/windows/client-management/mdm/surfacehub-csp.md b/windows/client-management/mdm/surfacehub-csp.md index 4c9892dc4c..f830d00fd8 100644 --- a/windows/client-management/mdm/surfacehub-csp.md +++ b/windows/client-management/mdm/surfacehub-csp.md @@ -1,14 +1,7 @@ --- title: SurfaceHub CSP description: Learn more about the SurfaceHub CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 05/20/2024 --- @@ -72,6 +65,10 @@ The following list shows the SurfaceHub configuration service provider nodes: - [MOMAgent](#momagent) - [WorkspaceID](#momagentworkspaceid) - [WorkspaceKey](#momagentworkspacekey) + - [MOMAgentGovtCloud](#momagentgovtcloud) + - [AzureCloudIndexGovtCloud](#momagentgovtcloudazurecloudindexgovtcloud) + - [WorkspaceIDGovtCloud](#momagentgovtcloudworkspaceidgovtcloud) + - [WorkspaceKeyGovtCloud](#momagentgovtcloudworkspacekeygovtcloud) - [Properties](#properties) - [AllowAutoProxyAuth](#propertiesallowautoproxyauth) - [AllowSessionResume](#propertiesallowsessionresume) @@ -361,7 +358,7 @@ Possible error values: | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 2004 [10.0.19041.789] and later
                        ✅ Windows 10, version 2009 [10.0.19042.789] and later
                        ✅ Windows Insider Preview [99.9.9999] | +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 2004 [10.0.19041.789] and later
                        ✅ Windows 10, version 2009 [10.0.19042.789] and later
                        ✅ Windows Insider Preview | @@ -2018,6 +2015,162 @@ Primary key for authenticating with workspace. Will always return an empty strin + +## MOMAgentGovtCloud + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 22H2 [10.0.19045.4355] and later | + + + +```Device +./Vendor/MSFT/SurfaceHub/MOMAgentGovtCloud +``` + + + + + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `node` | +| Access Type | Get | + + + + + + + + + +### MOMAgentGovtCloud/AzureCloudIndexGovtCloud + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 22H2 [10.0.19045.4355] and later | + + + +```Device +./Vendor/MSFT/SurfaceHub/MOMAgentGovtCloud/AzureCloudIndexGovtCloud +``` + + + + +Enum value for Azure Clouds supported for OMS tracking in SurfaceHub. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Get, Replace | +| Default Value | 0 | + + + + + + + + + +### MOMAgentGovtCloud/WorkspaceIDGovtCloud + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 22H2 [10.0.19045.4355] and later | + + + +```Device +./Vendor/MSFT/SurfaceHub/MOMAgentGovtCloud/WorkspaceIDGovtCloud +``` + + + + +GUID identifying the Microsoft Operations Management Suite workspace ID to collect the data for Govt Clouds. Set this to an empty string to disable the MOM agent. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `chr` (string) | +| Access Type | Get, Replace | + + + + + + + + + +### MOMAgentGovtCloud/WorkspaceKeyGovtCloud + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
                        ❌ User | ✅ Pro
                        ✅ Enterprise
                        ✅ Education
                        ✅ Windows SE
                        ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 22H2 [10.0.19045.4355] and later | + + + +```Device +./Vendor/MSFT/SurfaceHub/MOMAgentGovtCloud/WorkspaceKeyGovtCloud +``` + + + + +Primary key for authenticating with workspace for Govt Clouds. Will always return an empty string. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `chr` (string) | +| Access Type | Get, Replace | + + + + + + + + ## Properties diff --git a/windows/client-management/mdm/surfacehub-ddf-file.md b/windows/client-management/mdm/surfacehub-ddf-file.md index 2519ecf5d4..3222bade2d 100644 --- a/windows/client-management/mdm/surfacehub-ddf-file.md +++ b/windows/client-management/mdm/surfacehub-ddf-file.md @@ -1,14 +1,7 @@ --- title: SurfaceHub DDF file description: View the XML file containing the device description framework (DDF) for the SurfaceHub configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 04/22/2024 --- @@ -19,11 +12,10 @@ The following XML file contains the device description framework (DDF) for the S ```xml -]> + 1.2 - - + SurfaceHub ./Vendor/MSFT @@ -93,8 +85,7 @@ The following XML file contains the device description framework (DDF) for the S - - + @@ -117,8 +108,7 @@ The following XML file contains the device description framework (DDF) for the S - - + @@ -141,8 +131,7 @@ The following XML file contains the device description framework (DDF) for the S - - + @@ -165,8 +154,7 @@ The following XML file contains the device description framework (DDF) for the S - - + @@ -210,8 +198,7 @@ The following XML file contains the device description framework (DDF) for the S - - + @@ -234,8 +221,7 @@ The following XML file contains the device description framework (DDF) for the S - - + @@ -258,8 +244,7 @@ The following XML file contains the device description framework (DDF) for the S - - + @@ -541,8 +526,7 @@ The following XML file contains the device description framework (DDF) for the S 10.0.15063 1.0 - - +
                        @@ -618,8 +602,7 @@ The following XML file contains the device description framework (DDF) for the S - - +
                        @@ -760,8 +743,7 @@ The following XML file contains the device description framework (DDF) for the S - - +
                        @@ -989,8 +971,7 @@ The following XML file contains the device description framework (DDF) for the S - - +
                        @@ -1035,8 +1016,7 @@ The following XML file contains the device description framework (DDF) for the S - - +
                        @@ -1529,8 +1509,7 @@ The following XML file contains the device description framework (DDF) for the S 10.0.15063, 10.0.14393.969 1.0 - - + @@ -1591,8 +1570,7 @@ The following XML file contains the device description framework (DDF) for the S - - +
                        @@ -1640,8 +1618,7 @@ The following XML file contains the device description framework (DDF) for the S - - +
                        @@ -1664,8 +1641,99 @@ The following XML file contains the device description framework (DDF) for the S - - + + + +
                        + + MOMAgentGovtCloud + + + + + + + + + + + + + + + + + + 10.0.19045.4355 + 1.0 + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBF;0xCA;0xCB;0xCD; + + + + WorkspaceIDGovtCloud + + + + + + GUID identifying the Microsoft Operations Management Suite workspace ID to collect the data for Govt Clouds. Set this to an empty string to disable the MOM agent. + + + + + + + + + + + text/plain + + + + + WorkspaceKeyGovtCloud + + + + + + Primary key for authenticating with workspace for Govt Clouds.. Will always return an empty string. + + + + + + + + + + + text/plain + + + + + AzureCloudIndexGovtCloud + + + + + + 0 + Enum value for Azure Clouds supported for OMS tracking in SurfaceHub. + + + + + + + + + + + text/plain + @@ -1709,8 +1777,7 @@ The following XML file contains the device description framework (DDF) for the S - - +
                        @@ -1733,8 +1800,7 @@ The following XML file contains the device description framework (DDF) for the S - - +
                        @@ -1761,8 +1827,7 @@ The following XML file contains the device description framework (DDF) for the S 10.0.17134, 10.0.16299.64 1.0 - - + LanProfile @@ -1784,8 +1849,7 @@ The following XML file contains the device description framework (DDF) for the S - - + @@ -1808,8 +1872,7 @@ The following XML file contains the device description framework (DDF) for the S - - +
                        diff --git a/windows/client-management/mdm/tenantlockdown-csp.md b/windows/client-management/mdm/tenantlockdown-csp.md index 97551d7680..f9abc97d80 100644 --- a/windows/client-management/mdm/tenantlockdown-csp.md +++ b/windows/client-management/mdm/tenantlockdown-csp.md @@ -1,14 +1,7 @@ --- title: TenantLockdown CSP description: To lock a device to a tenant to prevent accidental or intentional resets or wipes, use the TenantLockdown configuration service provider. -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 08/13/2018 -ms.reviewer: -manager: aaroncz --- # TenantLockdown CSP diff --git a/windows/client-management/mdm/tenantlockdown-ddf.md b/windows/client-management/mdm/tenantlockdown-ddf.md index 3aa78e83a1..05bf7451c6 100644 --- a/windows/client-management/mdm/tenantlockdown-ddf.md +++ b/windows/client-management/mdm/tenantlockdown-ddf.md @@ -1,14 +1,7 @@ --- title: TenantLockdown DDF file description: XML file containing the device description framework for the TenantLockdown configuration service provider (CSP). -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 08/13/2018 -ms.reviewer: -manager: aaroncz --- # TenantLockdown DDF file diff --git a/windows/client-management/mdm/toc.yml b/windows/client-management/mdm/toc.yml index 2ca71c81c0..f6ca93aa95 100644 --- a/windows/client-management/mdm/toc.yml +++ b/windows/client-management/mdm/toc.yml @@ -537,6 +537,8 @@ items: href: policy-csp-stickers.md - name: Storage href: policy-csp-storage.md + - name: Sudo + href: policy-csp-sudo.md - name: System href: policy-csp-system.md - name: SystemServices diff --git a/windows/client-management/mdm/tpmpolicy-csp.md b/windows/client-management/mdm/tpmpolicy-csp.md index 5486abb6d0..299b1077a8 100644 --- a/windows/client-management/mdm/tpmpolicy-csp.md +++ b/windows/client-management/mdm/tpmpolicy-csp.md @@ -1,14 +1,7 @@ --- title: TPMPolicy CSP description: The TPMPolicy configuration service provider (CSP) provides a mechanism to enable zero-exhaust configuration on a Windows device for TPM software components. -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 11/01/2017 -ms.reviewer: -manager: aaroncz --- # TPMPolicy CSP diff --git a/windows/client-management/mdm/tpmpolicy-ddf-file.md b/windows/client-management/mdm/tpmpolicy-ddf-file.md index 2987a036eb..ae8d4f38f6 100644 --- a/windows/client-management/mdm/tpmpolicy-ddf-file.md +++ b/windows/client-management/mdm/tpmpolicy-ddf-file.md @@ -1,14 +1,7 @@ --- title: TPMPolicy DDF file description: Learn about the OMA DM device description framework (DDF) for the TPMPolicy configuration service provider (CSP). -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 12/05/2017 -ms.reviewer: -manager: aaroncz --- # TPMPolicy DDF file diff --git a/windows/client-management/mdm/uefi-csp.md b/windows/client-management/mdm/uefi-csp.md index a818eb9880..e3e130ee43 100644 --- a/windows/client-management/mdm/uefi-csp.md +++ b/windows/client-management/mdm/uefi-csp.md @@ -1,14 +1,7 @@ --- title: UEFI CSP description: The Uefi CSP interfaces to UEFI's Device Firmware Configuration Interface (DFCI) to make BIOS configuration changes. -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 10/02/2018 -ms.reviewer: -manager: aaroncz --- # UEFI CSP diff --git a/windows/client-management/mdm/uefi-ddf.md b/windows/client-management/mdm/uefi-ddf.md index dde7789737..3ce949f7c8 100644 --- a/windows/client-management/mdm/uefi-ddf.md +++ b/windows/client-management/mdm/uefi-ddf.md @@ -1,14 +1,7 @@ --- title: UEFI DDF file description: Learn about the OMA DM device description framework (DDF) for the Uefi configuration service provider (CSP). -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 10/02/2018 -ms.reviewer: -manager: aaroncz --- # UEFI DDF file diff --git a/windows/client-management/mdm/unifiedwritefilter-csp.md b/windows/client-management/mdm/unifiedwritefilter-csp.md index b35a740976..d4bcc4bdc1 100644 --- a/windows/client-management/mdm/unifiedwritefilter-csp.md +++ b/windows/client-management/mdm/unifiedwritefilter-csp.md @@ -1,13 +1,6 @@ --- title: UnifiedWriteFilter CSP description: The UnifiedWriteFilter (UWF) configuration service provider allows you to remotely manage the UWF. Understand how it helps protect physical storage media. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 06/26/2017 --- @@ -26,7 +19,7 @@ The table below shows the applicability of Windows: The UnifiedWriteFilter (UWF) configuration service provider enables the IT administrator to remotely manage the UWF to help protect physical storage media including any writable storage type. -> **Note**  The UnifiedWriteFilter CSP is only supported in Windows 10 Enterprise and Windows 10 Education. +> **Note**  The UnifiedWriteFilter CSP is only supported in Windows 10/11 Enterprise and Windows 10/11 Education. The following example shows the UWF configuration service provider in tree format. ``` diff --git a/windows/client-management/mdm/unifiedwritefilter-ddf.md b/windows/client-management/mdm/unifiedwritefilter-ddf.md index ffaf61bb19..3e28dc3252 100644 --- a/windows/client-management/mdm/unifiedwritefilter-ddf.md +++ b/windows/client-management/mdm/unifiedwritefilter-ddf.md @@ -1,13 +1,6 @@ --- title: UnifiedWriteFilter DDF File description: UnifiedWriteFilter DDF File -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 12/05/2017 --- diff --git a/windows/client-management/mdm/universalprint-csp.md b/windows/client-management/mdm/universalprint-csp.md index cfaae48b05..183576910e 100644 --- a/windows/client-management/mdm/universalprint-csp.md +++ b/windows/client-management/mdm/universalprint-csp.md @@ -1,14 +1,8 @@ --- title: UniversalPrint CSP description: Learn how the UniversalPrint configuration service provider (CSP) is used to install printers on Windows client devices. -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 06/02/2022 ms.reviewer: jimwu -manager: aaroncz --- # UniversalPrint CSP diff --git a/windows/client-management/mdm/universalprint-ddf-file.md b/windows/client-management/mdm/universalprint-ddf-file.md index 3d3fdc2426..e1a1037685 100644 --- a/windows/client-management/mdm/universalprint-ddf-file.md +++ b/windows/client-management/mdm/universalprint-ddf-file.md @@ -1,14 +1,8 @@ --- title: UniversalPrint DDF file description: UniversalPrint DDF file -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 06/02/2022 ms.reviewer: jimwu -manager: aaroncz --- # UniversalPrint DDF file diff --git a/windows/client-management/mdm/update-csp.md b/windows/client-management/mdm/update-csp.md index e825289b3c..ab540156f2 100644 --- a/windows/client-management/mdm/update-csp.md +++ b/windows/client-management/mdm/update-csp.md @@ -1,13 +1,6 @@ --- title: Update CSP description: Learn how the Update configuration service provider (CSP) enables IT administrators to manage and control the rollout of new updates. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 11/16/2023 --- diff --git a/windows/client-management/mdm/update-ddf-file.md b/windows/client-management/mdm/update-ddf-file.md index a1ba78b157..186bfc4f22 100644 --- a/windows/client-management/mdm/update-ddf-file.md +++ b/windows/client-management/mdm/update-ddf-file.md @@ -1,13 +1,6 @@ --- title: Update DDF file description: Learn about the OMA DM device description framework (DDF) for the Update configuration service provider (CSP). -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 02/23/2018 --- diff --git a/windows/client-management/mdm/vpn-csp.md b/windows/client-management/mdm/vpn-csp.md index 4f43fb1e32..da946f07ea 100644 --- a/windows/client-management/mdm/vpn-csp.md +++ b/windows/client-management/mdm/vpn-csp.md @@ -1,13 +1,6 @@ --- title: VPN CSP description: Learn how the VPN configuration service provider (CSP) allows the mobile device management (MDM) server to configure the VPN profile of the device. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 04/02/2017 --- diff --git a/windows/client-management/mdm/vpn-ddf-file.md b/windows/client-management/mdm/vpn-ddf-file.md index f3df5126a9..81e88ca2b9 100644 --- a/windows/client-management/mdm/vpn-ddf-file.md +++ b/windows/client-management/mdm/vpn-ddf-file.md @@ -1,13 +1,6 @@ --- title: VPN DDF file description: Learn about the OMA DM device description framework (DDF) for the VPN configuration service provider (CSP). -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/vpnv2-csp.md b/windows/client-management/mdm/vpnv2-csp.md index 3e5e3a5468..58d6463c97 100644 --- a/windows/client-management/mdm/vpnv2-csp.md +++ b/windows/client-management/mdm/vpnv2-csp.md @@ -1,14 +1,7 @@ --- title: VPNv2 CSP description: Learn more about the VPNv2 CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/vpnv2-ddf-file.md b/windows/client-management/mdm/vpnv2-ddf-file.md index 2bb3347699..abe39e405a 100644 --- a/windows/client-management/mdm/vpnv2-ddf-file.md +++ b/windows/client-management/mdm/vpnv2-ddf-file.md @@ -1,14 +1,7 @@ --- title: VPNv2 DDF file description: View the XML file containing the device description framework (DDF) for the VPNv2 configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 06/02/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 06/28/2024 --- @@ -46,7 +39,7 @@ The following XML file contains the device description framework (DDF) for the V 10.0.10586 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; @@ -3272,7 +3265,7 @@ The following XML file contains the device description framework (DDF) for the V 10.0.10586 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; diff --git a/windows/client-management/mdm/w4-application-csp.md b/windows/client-management/mdm/w4-application-csp.md index 6b33ccc664..a84f2bf593 100644 --- a/windows/client-management/mdm/w4-application-csp.md +++ b/windows/client-management/mdm/w4-application-csp.md @@ -1,13 +1,6 @@ --- title: w4 APPLICATION CSP description: Use an APPLICATION configuration service provider (CSP) that has an APPID of w4 to configure Multimedia Messaging Service (MMS). -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/w7-application-csp.md b/windows/client-management/mdm/w7-application-csp.md index 0c5e7f4cd5..28acb291e9 100644 --- a/windows/client-management/mdm/w7-application-csp.md +++ b/windows/client-management/mdm/w7-application-csp.md @@ -1,13 +1,6 @@ --- title: w7 APPLICATION CSP description: Learn that the APPLICATION configuration service provider (CSP) that has an APPID of w7 is used for bootstrapping a device with an OMA DM account. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/wifi-csp.md b/windows/client-management/mdm/wifi-csp.md index d7b549f5e8..da583b8cd9 100644 --- a/windows/client-management/mdm/wifi-csp.md +++ b/windows/client-management/mdm/wifi-csp.md @@ -1,14 +1,7 @@ --- title: WiFi CSP description: Learn more about the WiFi CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/wifi-ddf-file.md b/windows/client-management/mdm/wifi-ddf-file.md index 269f95f3c7..a2a8cf4407 100644 --- a/windows/client-management/mdm/wifi-ddf-file.md +++ b/windows/client-management/mdm/wifi-ddf-file.md @@ -1,14 +1,7 @@ --- title: WiFi DDF file description: View the XML file containing the device description framework (DDF) for the WiFi configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 07/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 06/28/2024 --- @@ -46,7 +39,7 @@ The following XML file contains the device description framework (DDF) for the W 10.0.10586 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; @@ -329,7 +322,7 @@ The following XML file contains the device description framework (DDF) for the W 10.0.10586 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; diff --git a/windows/client-management/mdm/win32appinventory-csp.md b/windows/client-management/mdm/win32appinventory-csp.md index d76120673d..0c9cc388d4 100644 --- a/windows/client-management/mdm/win32appinventory-csp.md +++ b/windows/client-management/mdm/win32appinventory-csp.md @@ -1,13 +1,6 @@ --- title: Win32AppInventory CSP description: Learn how the Win32AppInventory configuration service provider (CSP) is used to provide an inventory of installed applications on a device. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/win32appinventory-ddf-file.md b/windows/client-management/mdm/win32appinventory-ddf-file.md index 413f6927a8..c30f6ba4a9 100644 --- a/windows/client-management/mdm/win32appinventory-ddf-file.md +++ b/windows/client-management/mdm/win32appinventory-ddf-file.md @@ -1,13 +1,6 @@ --- title: Win32AppInventory DDF file description: Learn about the OMA DM device description framework (DDF) for the Win32AppInventory configuration service provider (CSP). -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 12/05/2017 --- diff --git a/windows/client-management/mdm/win32compatibilityappraiser-csp.md b/windows/client-management/mdm/win32compatibilityappraiser-csp.md index 72e4dc7e0d..0e9a1dd3b8 100644 --- a/windows/client-management/mdm/win32compatibilityappraiser-csp.md +++ b/windows/client-management/mdm/win32compatibilityappraiser-csp.md @@ -1,14 +1,7 @@ --- title: Win32CompatibilityAppraiser CSP description: Learn how the Win32CompatibilityAppraiser configuration service provider enables the IT admin to query the current status of the Appraiser and UTC telemetry health. -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 07/19/2018 -ms.reviewer: -manager: aaroncz --- # Win32CompatibilityAppraiser CSP diff --git a/windows/client-management/mdm/win32compatibilityappraiser-ddf.md b/windows/client-management/mdm/win32compatibilityappraiser-ddf.md index 2412d86ade..6e1017cd32 100644 --- a/windows/client-management/mdm/win32compatibilityappraiser-ddf.md +++ b/windows/client-management/mdm/win32compatibilityappraiser-ddf.md @@ -1,14 +1,7 @@ --- title: Win32CompatibilityAppraiser DDF file description: Learn about the XML file containing the device description framework for the Win32CompatibilityAppraiser configuration service provider. -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 07/19/2018 -ms.reviewer: -manager: aaroncz --- # Win32CompatibilityAppraiser DDF file diff --git a/windows/client-management/mdm/windowsadvancedthreatprotection-csp.md b/windows/client-management/mdm/windowsadvancedthreatprotection-csp.md index ab6d3cfd03..040365664e 100644 --- a/windows/client-management/mdm/windowsadvancedthreatprotection-csp.md +++ b/windows/client-management/mdm/windowsadvancedthreatprotection-csp.md @@ -1,13 +1,6 @@ --- title: WindowsAdvancedThreatProtection CSP description: The Windows Defender Advanced Threat Protection (WDATP) CSP allows IT Admins to onboard, determine configuration and health status, and offboard endpoints for WDATP. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 11/01/2017 --- diff --git a/windows/client-management/mdm/windowsadvancedthreatprotection-ddf.md b/windows/client-management/mdm/windowsadvancedthreatprotection-ddf.md index 1e3460593d..9486c07290 100644 --- a/windows/client-management/mdm/windowsadvancedthreatprotection-ddf.md +++ b/windows/client-management/mdm/windowsadvancedthreatprotection-ddf.md @@ -2,13 +2,6 @@ title: WindowsAdvancedThreatProtection DDF file description: Learn about the OMA DM device description framework (DDF) for the WindowsAdvancedThreatProtection configuration service provider (CSP). ms.assetid: 0C62A790-4351-48AF-89FD-7D46C42D13E0 -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 12/05/2017 --- diff --git a/windows/client-management/mdm/windowsautopilot-csp.md b/windows/client-management/mdm/windowsautopilot-csp.md index 7a34b0a995..788144001b 100644 --- a/windows/client-management/mdm/windowsautopilot-csp.md +++ b/windows/client-management/mdm/windowsautopilot-csp.md @@ -1,13 +1,6 @@ --- title: WindowsAutopilot CSP description: Learn how without the ability to mark a device as remediation required, the device will remain in a broken state, which results in security and privacy concerns in Autopilot. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 05/09/2022 --- diff --git a/windows/client-management/mdm/windowsautopilot-ddf-file.md b/windows/client-management/mdm/windowsautopilot-ddf-file.md index 88313274a6..86b4d615ca 100644 --- a/windows/client-management/mdm/windowsautopilot-ddf-file.md +++ b/windows/client-management/mdm/windowsautopilot-ddf-file.md @@ -1,14 +1,7 @@ --- title: WindowsAutopilot DDF file description: Learn how, without the ability to mark a device as remediation required, the device will remain in a broken state for the WindowsAutopilot DDF file configuration service provider (CSP). -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 02/07/2022 -ms.reviewer: -manager: aaroncz --- # WindowsAutopilot DDF file diff --git a/windows/client-management/mdm/windowsdefenderapplicationguard-csp.md b/windows/client-management/mdm/windowsdefenderapplicationguard-csp.md index 0261c3b007..10546d7713 100644 --- a/windows/client-management/mdm/windowsdefenderapplicationguard-csp.md +++ b/windows/client-management/mdm/windowsdefenderapplicationguard-csp.md @@ -1,14 +1,7 @@ --- title: WindowsDefenderApplicationGuard CSP description: Learn more about the WindowsDefenderApplicationGuard CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/windowsdefenderapplicationguard-ddf-file.md b/windows/client-management/mdm/windowsdefenderapplicationguard-ddf-file.md index fd77cfe61d..06f96f2518 100644 --- a/windows/client-management/mdm/windowsdefenderapplicationguard-ddf-file.md +++ b/windows/client-management/mdm/windowsdefenderapplicationguard-ddf-file.md @@ -1,14 +1,7 @@ --- title: WindowsDefenderApplicationGuard DDF file description: View the XML file containing the device description framework (DDF) for the WindowsDefenderApplicationGuard configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 06/02/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 06/28/2024 --- @@ -47,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the W 10.0.16299 1.1 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; diff --git a/windows/client-management/mdm/windowslicensing-csp.md b/windows/client-management/mdm/windowslicensing-csp.md index 156b999f6d..f880dd265e 100644 --- a/windows/client-management/mdm/windowslicensing-csp.md +++ b/windows/client-management/mdm/windowslicensing-csp.md @@ -1,14 +1,7 @@ --- title: WindowsLicensing CSP description: Learn more about the WindowsLicensing CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/windowslicensing-ddf-file.md b/windows/client-management/mdm/windowslicensing-ddf-file.md index 2fc871423e..d2abdc9fc4 100644 --- a/windows/client-management/mdm/windowslicensing-ddf-file.md +++ b/windows/client-management/mdm/windowslicensing-ddf-file.md @@ -1,14 +1,7 @@ --- title: WindowsLicensing DDF file description: View the XML file containing the device description framework (DDF) for the WindowsLicensing configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/02/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 06/28/2024 --- @@ -47,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the W 10.0.10586 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xBC;0xBF;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xBC;0xBF;0xCD;0xCF;0xD2; diff --git a/windows/client-management/mdm/wirednetwork-csp.md b/windows/client-management/mdm/wirednetwork-csp.md index a609a45d59..12bac7c750 100644 --- a/windows/client-management/mdm/wirednetwork-csp.md +++ b/windows/client-management/mdm/wirednetwork-csp.md @@ -1,14 +1,7 @@ --- title: WiredNetwork CSP description: Learn more about the WiredNetwork CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/wirednetwork-ddf-file.md b/windows/client-management/mdm/wirednetwork-ddf-file.md index bfe5dc35f3..178bba80f3 100644 --- a/windows/client-management/mdm/wirednetwork-ddf-file.md +++ b/windows/client-management/mdm/wirednetwork-ddf-file.md @@ -1,14 +1,7 @@ --- title: WiredNetwork DDF file description: View the XML file containing the device description framework (DDF) for the WiredNetwork configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 06/02/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 06/28/2024 --- @@ -46,7 +39,7 @@ The following XML file contains the device description framework (DDF) for the W 10.0.17763 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; @@ -125,7 +118,7 @@ The following XML file contains the device description framework (DDF) for the W 10.0.17763 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; diff --git a/windows/client-management/mobile-device-enrollment.md b/windows/client-management/mobile-device-enrollment.md index c69c1fb951..214a73f052 100644 --- a/windows/client-management/mobile-device-enrollment.md +++ b/windows/client-management/mobile-device-enrollment.md @@ -1,8 +1,8 @@ --- title: Mobile device enrollment description: Learn how mobile device enrollment verifies that only authenticated and authorized devices are managed by the enterprise. -ms.topic: article -ms.date: 08/10/2023 +ms.topic: conceptual +ms.date: 07/08/2024 ms.collection: - highpri - tier2 @@ -43,13 +43,13 @@ The certificate enrollment is an implementation of the MS-WSTEP protocol. ### Management configuration -The server sends provisioning XML that contains a server certificate (for TLS/SSL server authentication), a client certificate issued by enterprise CA, DM client bootstrap information (for the client to communicate with the management server), an enterprise application token (for the user to install enterprise applications), and the link to download the Company Hub application. +The server sends provisioning XML that contains a server certificate (for TLS/SSL server authentication), a client certificate issued by enterprise CA, DMClient bootstrap information (for the client to communicate with the management server), an enterprise application token (for the user to install enterprise applications), and the link to download the Company Hub application. The following articles describe the end-to-end enrollment process using various authentication methods: - [Federated authentication device enrollment](federated-authentication-device-enrollment.md) - [Certificate authentication device enrollment](certificate-authentication-device-enrollment.md) -- [On-premise authentication device enrollment](on-premise-authentication-device-enrollment.md) +- [On-premises authentication device enrollment](on-premise-authentication-device-enrollment.md) > [!NOTE] > As a best practice, don't use hardcoded server-side checks on values such as: @@ -168,4 +168,4 @@ TraceID is a freeform text node that is logged. It should identify the server si - [MDM enrollment of Windows-based devices](mdm-enrollment-of-windows-devices.md) - [Federated authentication device enrollment](federated-authentication-device-enrollment.md) - [Certificate authentication device enrollment](certificate-authentication-device-enrollment.md) -- [On-premise authentication device enrollment](on-premise-authentication-device-enrollment.md) +- [On-premises authentication device enrollment](on-premise-authentication-device-enrollment.md) diff --git a/windows/client-management/new-in-windows-mdm-enrollment-management.md b/windows/client-management/new-in-windows-mdm-enrollment-management.md index 4ed6e26aaf..053a0dd779 100644 --- a/windows/client-management/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/new-in-windows-mdm-enrollment-management.md @@ -1,9 +1,9 @@ --- title: What's new in MDM enrollment and management description: Discover what's new and breaking changes in mobile device management (MDM) enrollment and management experience across all Windows devices. -ms.topic: article +ms.topic: conceptual ms.localizationpriority: medium -ms.date: 08/10/2023 +ms.date: 07/08/2024 --- # What's new in mobile device enrollment and management diff --git a/windows/client-management/oma-dm-protocol-support.md b/windows/client-management/oma-dm-protocol-support.md index ad62b88273..5caf42c5f0 100644 --- a/windows/client-management/oma-dm-protocol-support.md +++ b/windows/client-management/oma-dm-protocol-support.md @@ -1,8 +1,8 @@ --- title: OMA DM protocol support description: See how the OMA DM client communicates with the server over HTTPS and uses DM Sync (OMA DM v1.2) as the message payload. -ms.topic: article -ms.date: 08/10/2023 +ms.topic: conceptual +ms.date: 07/08/2024 --- # OMA DM protocol support diff --git a/windows/client-management/on-premise-authentication-device-enrollment.md b/windows/client-management/on-premise-authentication-device-enrollment.md index 39e4133d55..e6c445b43c 100644 --- a/windows/client-management/on-premise-authentication-device-enrollment.md +++ b/windows/client-management/on-premise-authentication-device-enrollment.md @@ -1,8 +1,8 @@ --- title: On-premises authentication device enrollment description: This section provides an example of the mobile device enrollment protocol using on-premises authentication policy. -ms.topic: article -ms.date: 08/10/2023 +ms.topic: conceptual +ms.date: 07/08/2024 --- # On-premises authentication device enrollment diff --git a/windows/client-management/push-notification-windows-mdm.md b/windows/client-management/push-notification-windows-mdm.md index d449bbfa9f..e0842698e8 100644 --- a/windows/client-management/push-notification-windows-mdm.md +++ b/windows/client-management/push-notification-windows-mdm.md @@ -1,8 +1,8 @@ --- title: Push notification support for device management description: The DMClient CSP supports the ability to configure push-initiated device management sessions. -ms.topic: article -ms.date: 08/10/2023 +ms.topic: conceptual +ms.date: 07/08/2024 --- # Push notification support for device management diff --git a/windows/client-management/server-requirements-windows-mdm.md b/windows/client-management/server-requirements-windows-mdm.md index e3cafbd896..92e09679f4 100644 --- a/windows/client-management/server-requirements-windows-mdm.md +++ b/windows/client-management/server-requirements-windows-mdm.md @@ -1,8 +1,8 @@ --- title: Server requirements for using OMA DM to manage Windows devices description: Learn about the general server requirements for using OMA DM to manage Windows devices, including the supported versions of OMA DM. -ms.topic: article -ms.date: 08/10/2023 +ms.topic: conceptual +ms.date: 07/08/2024 --- # Server requirements for using OMA DM to manage Windows devices @@ -11,11 +11,11 @@ The following list shows the general server requirements for using OMA DM to man - The OMA DM server must support the OMA DM v1.1.2 or later protocol. -- Secure Sockets Layer (TLS/SSL) must be on the OMA DM server, and it must provide server certificate-based authentication, data integrity check, and data encryption. If the certificate isn't issued by a commercial Certification Authority whose root certificate is preinstalled in the device, you must provision the enterprise root certificate in the device's Root store. +- Secure Sockets Layer (TLS/SSL) must be on the OMA DM server, and it must provide server certificate-based authentication, data integrity check, and data encryption. If the certificate isn't issued by a public Certification Authority whose root certificate is preinstalled in the device, you must provision the enterprise root certificate in the device's Root store. - To authenticate the client at the application level, you must use either Basic or MD5 client authentication. -- The server MD5 nonce must be renewed in each DM session. The DM client sends the new server nonce for the next session to the server over the Status element in every DM session. +- The server MD5 nonce must be renewed in each DM session. The DMClient sends the new server nonce for the next session to the server over the Status element in every DM session. - The MD5 binary nonce is sent over XML B64 encoded format, but the octal form of the binary data should be used when the service calculates the hash. diff --git a/windows/client-management/structure-of-oma-dm-provisioning-files.md b/windows/client-management/structure-of-oma-dm-provisioning-files.md index c239b9d0fd..a1fcf0777c 100644 --- a/windows/client-management/structure-of-oma-dm-provisioning-files.md +++ b/windows/client-management/structure-of-oma-dm-provisioning-files.md @@ -1,8 +1,8 @@ --- title: Structure of OMA DM provisioning files description: Learn about the structure of OMA DM provisioning files, for example how each message is composed of a header, specified by the SyncHdr element, and a message body. -ms.topic: article -ms.date: 08/10/2023 +ms.topic: conceptual +ms.date: 07/08/2024 --- # Structure of OMA DM provisioning files diff --git a/windows/client-management/toc.yml b/windows/client-management/toc.yml index 347afc4322..b6e225d925 100644 --- a/windows/client-management/toc.yml +++ b/windows/client-management/toc.yml @@ -50,6 +50,8 @@ items: href: device-update-management.md - name: Manage Copilot in Windows href: manage-windows-copilot.md + - name: Manage Recall + href: manage-recall.md - name: Secured-Core PC Configuration Lock href: config-lock.md - name: Certificate renewal diff --git a/windows/client-management/understanding-admx-backed-policies.md b/windows/client-management/understanding-admx-backed-policies.md index e7bccddb07..f327359fe3 100644 --- a/windows/client-management/understanding-admx-backed-policies.md +++ b/windows/client-management/understanding-admx-backed-policies.md @@ -1,8 +1,8 @@ --- title: Understanding ADMX policies description: You can use ADMX policies for Windows mobile device management (MDM) across Windows devices. -ms.topic: article -ms.date: 08/10/2023 +ms.topic: conceptual +ms.date: 07/08/2024 --- # Understanding ADMX policies diff --git a/windows/client-management/using-powershell-scripting-with-the-wmi-bridge-provider.md b/windows/client-management/using-powershell-scripting-with-the-wmi-bridge-provider.md index 4c631e20f5..ca347147ab 100644 --- a/windows/client-management/using-powershell-scripting-with-the-wmi-bridge-provider.md +++ b/windows/client-management/using-powershell-scripting-with-the-wmi-bridge-provider.md @@ -1,8 +1,8 @@ --- title: Using PowerShell scripting with the WMI Bridge Provider description: This article covers using PowerShell Cmdlet scripts to configure per-user and per-device policy settings, and how to invoke methods through the WMI Bridge Provider. -ms.topic: article -ms.date: 08/10/2023 +ms.topic: conceptual +ms.date: 07/08/2024 --- # Using PowerShell scripting with the WMI Bridge Provider diff --git a/windows/client-management/win32-and-centennial-app-policy-configuration.md b/windows/client-management/win32-and-centennial-app-policy-configuration.md index 0cab615908..363072d68c 100644 --- a/windows/client-management/win32-and-centennial-app-policy-configuration.md +++ b/windows/client-management/win32-and-centennial-app-policy-configuration.md @@ -1,8 +1,8 @@ --- title: Win32 and Desktop Bridge app ADMX policy Ingestion description: Ingest ADMX files and set ADMX policies for Win32 and Desktop Bridge apps. -ms.topic: article -ms.date: 08/10/2023 +ms.topic: conceptual +ms.date: 07/08/2024 --- # Win32 and Desktop Bridge app ADMX policy Ingestion diff --git a/windows/client-management/windows-mdm-enterprise-settings.md b/windows/client-management/windows-mdm-enterprise-settings.md index e3503a278f..a9b47a78e9 100644 --- a/windows/client-management/windows-mdm-enterprise-settings.md +++ b/windows/client-management/windows-mdm-enterprise-settings.md @@ -1,17 +1,17 @@ --- title: Enterprise settings and policy management -description: The DM client manages the interaction between a device and a server. Learn more about the client-server management workflow. -ms.topic: article -ms.date: 08/10/2023 +description: The DMClient manages the interaction between a device and a server. Learn more about the client-server management workflow. +ms.topic: conceptual +ms.date: 07/08/2024 --- # Enterprise settings and policy management -The actual management interaction between the device and server is done via the DM client. The DM client communicates with the enterprise management server via DM v1.2 SyncML syntax. The full description of the OMA DM protocol v1.2 can be found at the [OMA website](https://technical.openmobilealliance.org/). +The actual management interaction between the device and server is done via the DMClient. The DMClient communicates with the enterprise management server via DM v1.2 SyncML syntax. The full description of the OMA DM protocol v1.2 can be found at the [OMA website](https://technical.openmobilealliance.org/). -Enterprise MDM settings are exposed via various configuration service providers to the DM client. For the list of available configuration service providers, see [Configuration service provider reference](mdm/index.yml). +Enterprise MDM settings are exposed via various configuration service providers to the DMClient. For the list of available configuration service providers, see [Configuration service provider reference](mdm/index.yml). -Windows currently supports one MDM server. The DM client that is configured via the enrollment process is granted access to enterprise related settings. During the enrollment process, the task scheduler is configured to invoke the DM client to periodically poll the MDM server. +Windows currently supports one MDM server. The DMClient that is configured via the enrollment process is granted access to enterprise related settings. During the enrollment process, the task scheduler is configured to invoke the DMClient to periodically poll the MDM server. The following diagram shows the work flow between server and client. @@ -21,9 +21,9 @@ The following diagram shows the work flow between server and client. This protocol defines an HTTPS-based client/server communication with DM SyncML XML as the package payload that carries management requests and execution results. The configuration request is addressed via a managed object (MO). The settings supported by the managed object are represented in a conceptual tree structure. This logical view of configurable device settings simplifies the way the server addresses the device settings by isolating the implementation details from the conceptual tree structure. -To facilitate security-enhanced communication with the remote server for enterprise management, Windows supports certificate-based mutual authentication over an encrypted TLS/SSL HTTP channel between the DM client and management service. The server and client certificates are provisioned during the enrollment process. +To facilitate security-enhanced communication with the remote server for enterprise management, Windows supports certificate-based mutual authentication over an encrypted TLS/SSL HTTP channel between the DMClient and management service. The server and client certificates are provisioned during the enrollment process. -The DM client configuration, company policy enforcement, business application management, and device inventory are all exposed or expressed via configuration service providers (CSPs). CSPs are the Windows term for managed objects. The DM client communicates with the server and sends configuration request to CSPs. The server only needs to know the logical local URIs defined by those CSP nodes in order to use the DM protocol XML to manage the device. +The DMClient configuration, company policy enforcement, business application management, and device inventory are all exposed or expressed via configuration service providers (CSPs). CSPs are the Windows term for managed objects. The DMClient communicates with the server and sends configuration request to CSPs. The server only needs to know the logical local URIs defined by those CSP nodes in order to use the DM protocol XML to manage the device. Here's a summary of the DM tasks supported for enterprise management: diff --git a/windows/client-management/wmi-providers-supported-in-windows.md b/windows/client-management/wmi-providers-supported-in-windows.md index ab34b9d0c7..610f0e36b9 100644 --- a/windows/client-management/wmi-providers-supported-in-windows.md +++ b/windows/client-management/wmi-providers-supported-in-windows.md @@ -1,8 +1,8 @@ --- title: WMI providers supported in Windows description: Manage settings and applications on devices that subscribe to the Mobile Device Management (MDM) service with Windows Management Infrastructure (WMI). -ms.topic: article -ms.date: 08/10/2023 +ms.topic: conceptual +ms.date: 07/08/2024 --- # WMI providers supported in Windows @@ -76,7 +76,7 @@ For links to these classes, see [**MDM Bridge WMI Provider**](/windows/win32/dmw | [**MDM_WirelesssProfileXML**](/previous-versions/windows/desktop/mdmsettingsprov/mdm-wirelessprofilexml) | Yes | | [**MDM_WNSChannel**](/previous-versions/windows/desktop/mdmsettingsprov/mdm-wnschannel) | Yes | | [**MDM_WNSConfiguration**](/previous-versions/windows/desktop/mdmsettingsprov/mdm-wnsconfiguration) | Yes | -| [**MSFT_NetFirewallProfile**](/previous-versions/windows/desktop/wfascimprov/msft-netfirewallprofile) | Yes | +| [**MSFT_NetFirewallProfile**](/windows/win32/fwp/wmi/wfascimprov/msft-netfirewallprofile) | Yes | | [**MSFT_VpnConnection**](/previous-versions/windows/desktop/vpnclientpsprov/msft-vpnconnection) | Yes | | [**SoftwareLicensingProduct**](/previous-versions/windows/desktop/sppwmi/softwarelicensingproduct) | | | [**SoftwareLicensingService**](/previous-versions/windows/desktop/sppwmi/softwarelicensingservice) | | diff --git a/windows/configuration/TOC.yml b/windows/configuration/TOC.yml deleted file mode 100644 index 97c1386a73..0000000000 --- a/windows/configuration/TOC.yml +++ /dev/null @@ -1,367 +0,0 @@ -- name: Configure Windows client - href: index.yml -- name: Customize the appearance - items: - - name: Windows 11 - items: - - name: Start menu - items: - - name: Customize Start menu layout - href: customize-start-menu-layout-windows-11.md - - name: Supported Start menu CSPs - href: supported-csp-start-menu-layout-windows.md - - name: Taskbar - items: - - name: Customize Taskbar - href: customize-taskbar-windows-11.md - - name: Supported Taskbar CSPs - href: supported-csp-taskbar-windows.md - - name: Windows 10 Start and taskbar - items: - - name: Start layout and taskbar - href: windows-10-start-layout-options-and-policies.md - - name: Use XML - items: - - name: Customize and export Start layout - href: customize-and-export-start-layout.md - - name: Customize the taskbar - href: configure-windows-10-taskbar.md - - name: Add image for secondary Microsoft Edge tiles - href: start-secondary-tiles.md - - name: Start layout XML for Windows 10 desktop editions (reference) - href: start-layout-xml-desktop.md - - name: Use group policy - href: customize-windows-10-start-screens-by-using-group-policy.md - - name: Use provisioning packages - href: customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md - - name: Use mobile device management (MDM) - href: customize-windows-10-start-screens-by-using-mobile-device-management.md - - name: Troubleshoot Start menu errors - href: /troubleshoot/windows-client/shell-experience/troubleshoot-start-menu-errors - - name: Changes to Start policies in Windows 10 - href: changes-to-start-policies-in-windows-10.md - - name: Accessibility settings - items: - - name: Accessibility information for IT Pros - href: windows-accessibility-for-ITPros.md - - name: Configure access to Microsoft Store - href: stop-employees-from-using-microsoft-store.md - - name: Configure Windows Spotlight on the lock screen - href: windows-spotlight.md - - name: Manage Windows 10 and Microsoft Store tips, "fun facts", and suggestions - href: manage-tips-and-suggestions.md - - name: Configure cellular settings for tablets and PCs - href: provisioning-apn.md - - name: Lockdown features from Windows Embedded 8.1 Industry - href: lockdown-features-windows-10.md - - -- name: Configure kiosks and digital signs - items: - - name: Configure kiosks and digital signs on Windows desktop editions - href: kiosk-methods.md - - name: Prepare a device for kiosk configuration - href: kiosk-prepare.md - - name: Set up digital signs - href: setup-digital-signage.md - - name: Set up a single-app kiosk - href: kiosk-single-app.md - - name: Set up a multi-app kiosk for Windows 10 - href: lock-down-windows-10-to-specific-apps.md - - name: Set up a multi-app kiosk for Windows 11 - href: lock-down-windows-11-to-specific-apps.md - - name: Kiosk reference information - items: - - name: More kiosk methods and reference information - href: kiosk-additional-reference.md - - name: Find the Application User Model ID of an installed app - href: find-the-application-user-model-id-of-an-installed-app.md - - name: Validate your kiosk configuration - href: kiosk-validate.md - - name: Guidelines for choosing an app for assigned access (kiosk mode) - href: guidelines-for-assigned-access-app.md - - name: Policies enforced on kiosk devices - href: kiosk-policies.md - - name: Assigned access XML reference - href: kiosk-xml.md - - name: Use AppLocker to create a Windows 10 kiosk - href: lock-down-windows-10-applocker.md - - name: Use Shell Launcher to create a Windows client kiosk - href: kiosk-shelllauncher.md - - name: Use MDM Bridge WMI Provider to create a Windows client kiosk - href: kiosk-mdm-bridge.md - - name: Troubleshoot kiosk mode issues - href: /troubleshoot/windows-client/shell-experience/kiosk-mode-issues-troubleshooting - -- name: Configure multi-user and guest devices - items: - - name: Shared devices concepts - href: shared-devices-concepts.md - - name: Configure shared devices with Shared PC - href: set-up-shared-or-guest-pc.md - - name: Shared PC technical reference - href: shared-pc-technical.md - -- name: Use provisioning packages - items: - - name: Provisioning packages for Windows client - href: provisioning-packages/provisioning-packages.md - - name: How provisioning works in Windows client - href: provisioning-packages/provisioning-how-it-works.md - - name: Introduction to configuration service providers (CSPs) - href: provisioning-packages/how-it-pros-can-use-configuration-service-providers.md - - name: Install Windows Configuration Designer - href: provisioning-packages/provisioning-install-icd.md - - name: Create a provisioning package - href: provisioning-packages/provisioning-create-package.md - - name: Apply a provisioning package - href: provisioning-packages/provisioning-apply-package.md - - name: Settings changed when you uninstall a provisioning package - href: provisioning-packages/provisioning-uninstall-package.md - - name: Provision PCs with common settings for initial deployment (desktop wizard) - href: provisioning-packages/provision-pcs-for-initial-deployment.md - - name: Provision PCs with apps - href: provisioning-packages/provision-pcs-with-apps.md - - name: Use a script to install a desktop app in provisioning packages - href: provisioning-packages/provisioning-script-to-install-app.md - - name: Create a provisioning package with multivariant settings - href: provisioning-packages/provisioning-multivariant.md - - name: PowerShell cmdlets for provisioning Windows client (reference) - href: provisioning-packages/provisioning-powershell.md - - name: Diagnose provisioning packages - href: provisioning-packages/diagnose-provisioning-packages.md - - name: Windows Configuration Designer command-line interface (reference) - href: provisioning-packages/provisioning-command-line.md - -- name: Configure Cortana - items: - - name: Configure Cortana in Windows 10 - href: cortana-at-work/cortana-at-work-overview.md - - name: Testing scenarios using Cortana n Windows 10, version 2004 and later - items: - - name: Set up and test Cortana in Windows 10, version 2004 and later - href: cortana-at-work/set-up-and-test-cortana-in-windows-10.md - - name: Cortana at work testing scenarios - href: cortana-at-work/cortana-at-work-testing-scenarios.md - - name: Test scenario 1 - Sign into Microsoft Entra ID, enable the wake word, and try a voice query - href: cortana-at-work/cortana-at-work-scenario-1.md - - name: Test scenario 2 - Run a Bing search with Cortana - href: cortana-at-work/cortana-at-work-scenario-2.md - - name: Test scenario 3 - Set a reminder - href: cortana-at-work/cortana-at-work-scenario-3.md - - name: Test scenario 4 - Use Cortana to find free time on your calendar - href: cortana-at-work/cortana-at-work-scenario-4.md - - name: Test scenario 5 - Find out about a person - href: cortana-at-work/cortana-at-work-scenario-5.md - - name: Test scenario 6 - Change your language and run a quick search with Cortana - href: cortana-at-work/cortana-at-work-scenario-6.md - - name: Send feedback about Cortana back to Microsoft - href: cortana-at-work/cortana-at-work-feedback.md - - name: Testing scenarios using Cortana in Windows 10, versions 1909 and earlier, with Microsoft 365 in your organization - items: - - name: Set up and test Cortana in Windows 10, versions 1909 and earlier, with Microsoft 365 in your organization - href: cortana-at-work/cortana-at-work-o365.md - - name: Testing scenarios using Cortana in your business or organization - href: cortana-at-work/testing-scenarios-using-cortana-in-business-org.md - - name: Test scenario 1 - Sign into Microsoft Entra ID, enable the wake word, and try a voice query - href: cortana-at-work/test-scenario-1.md - - name: Test scenario 2 - Run a quick search with Cortana at work - href: cortana-at-work/test-scenario-2.md - - name: Test scenario 3 - Set a reminder for a specific location using Cortana at work - href: cortana-at-work/test-scenario-3.md - - name: Test scenario 4 - Use Cortana at work to find your upcoming meetings - href: cortana-at-work/test-scenario-4.md - - name: Test scenario 5 - Use Cortana to send email to a coworker - href: cortana-at-work/test-scenario-5.md - - name: Test scenario 6 - Review a reminder suggested by Cortana based on what you’ve promised in email - href: cortana-at-work/test-scenario-6.md - - name: Test scenario 7 - Use Cortana and Windows Information Protection (WIP) to help protect your organization’s data on a device - href: cortana-at-work/cortana-at-work-scenario-7.md - - - name: Set up and test custom voice commands in Cortana for your organization - href: cortana-at-work/cortana-at-work-voice-commands.md - - name: Use Group Policy and mobile device management (MDM) settings to configure Cortana in your organization - href: cortana-at-work/cortana-at-work-policy-settings.md - - -- name: Reference - items: - - name: Windows Configuration Designer reference - items: - - name: Windows Configuration Designer provisioning settings (reference) - href: wcd/wcd.md - - name: Changes to settings in Windows Configuration Designer - href: wcd/wcd-changes.md - - name: AccountManagement - href: wcd/wcd-accountmanagement.md - - name: Accounts - href: wcd/wcd-accounts.md - - name: ADMXIngestion - href: wcd/wcd-admxingestion.md - - name: AssignedAccess - href: wcd/wcd-assignedaccess.md - - name: Browser - href: wcd/wcd-browser.md - - name: CellCore - href: wcd/wcd-cellcore.md - - name: Cellular - href: wcd/wcd-cellular.md - - name: Certificates - href: wcd/wcd-certificates.md - - name: CleanPC - href: wcd/wcd-cleanpc.md - - name: Connections - href: wcd/wcd-connections.md - - name: ConnectivityProfiles - href: wcd/wcd-connectivityprofiles.md - - name: CountryAndRegion - href: wcd/wcd-countryandregion.md - - name: DesktopBackgroundAndColors - href: wcd/wcd-desktopbackgroundandcolors.md - - name: DeveloperSetup - href: wcd/wcd-developersetup.md - - name: DeviceFormFactor - href: wcd/wcd-deviceformfactor.md - - name: DeviceManagement - href: wcd/wcd-devicemanagement.md - - name: DeviceUpdateCenter - href: wcd/wcd-deviceupdatecenter.md - - name: DMClient - href: wcd/wcd-dmclient.md - - name: EditionUpgrade - href: wcd/wcd-editionupgrade.md - - name: FirewallConfiguration - href: wcd/wcd-firewallconfiguration.md - - name: FirstExperience - href: wcd/wcd-firstexperience.md - - name: Folders - href: wcd/wcd-folders.md - - name: HotSpot - href: wcd/wcd-hotspot.md - - name: KioskBrowser - href: wcd/wcd-kioskbrowser.md - - name: Licensing - href: wcd/wcd-licensing.md - - name: Location - href: wcd/wcd-location.md - - name: Maps - href: wcd/wcd-maps.md - - name: NetworkProxy - href: wcd/wcd-networkproxy.md - - name: NetworkQOSPolicy - href: wcd/wcd-networkqospolicy.md - - name: OOBE - href: wcd/wcd-oobe.md - - name: Personalization - href: wcd/wcd-personalization.md - - name: Policies - href: wcd/wcd-policies.md - - name: Privacy - href: wcd/wcd-privacy.md - - name: ProvisioningCommands - href: wcd/wcd-provisioningcommands.md - - name: SharedPC - href: wcd/wcd-sharedpc.md - - name: SMISettings - href: wcd/wcd-smisettings.md - - name: Start - href: wcd/wcd-start.md - - name: StartupApp - href: wcd/wcd-startupapp.md - - name: StartupBackgroundTasks - href: wcd/wcd-startupbackgroundtasks.md - - name: StorageD3InModernStandby - href: wcd/wcd-storaged3inmodernstandby.md - - name: SurfaceHubManagement - href: wcd/wcd-surfacehubmanagement.md - - name: TabletMode - href: wcd/wcd-tabletmode.md - - name: TakeATest - href: wcd/wcd-takeatest.md - - name: Time - href: wcd/wcd-time.md - - name: UnifiedWriteFilter - href: wcd/wcd-unifiedwritefilter.md - - name: UniversalAppInstall - href: wcd/wcd-universalappinstall.md - - name: UniversalAppUninstall - href: wcd/wcd-universalappuninstall.md - - name: UsbErrorsOEMOverride - href: wcd/wcd-usberrorsoemoverride.md - - name: WeakCharger - href: wcd/wcd-weakcharger.md - - name: WindowsHelloForBusiness - href: wcd/wcd-windowshelloforbusiness.md - - name: WindowsTeamSettings - href: wcd/wcd-windowsteamsettings.md - - name: WLAN - href: wcd/wcd-wlan.md - - name: Workplace - href: wcd/wcd-workplace.md - - - name: User Experience Virtualization (UE-V) - items: - - name: User Experience Virtualization (UE-V) for Windows 10 - href: ue-v/uev-for-windows.md - - name: Get started with UE-V - items: - - name: Get started with UE-V - href: ue-v/uev-getting-started.md - - name: What's New in UE-V for Windows 10, version 1607 - href: ue-v/uev-whats-new-in-uev-for-windows.md - - name: User Experience Virtualization Release Notes - href: ue-v/uev-release-notes-1607.md - - name: Upgrade to UE-V for Windows 10 - href: ue-v/uev-upgrade-uev-from-previous-releases.md - - name: Prepare a UE-V Deployment - items: - - name: Prepare a UE-V Deployment - href: ue-v/uev-prepare-for-deployment.md - - name: Deploy Required UE-V Features - href: ue-v/uev-deploy-required-features.md - - name: Deploy UE-V for use with Custom Applications - href: ue-v/uev-deploy-uev-for-custom-applications.md - - name: Administer UE-V - items: - - name: UE-V administration guide - href: ue-v/uev-administering-uev.md - - name: Manage Configurations for UE-V - items: - - name: Manage Configurations for UE-V - href: ue-v/uev-manage-configurations.md - - name: Configuring UE-V with Group Policy Objects - href: ue-v/uev-configuring-uev-with-group-policy-objects.md - - name: Configuring UE-V with Microsoft Configuration Manager - href: ue-v/uev-configuring-uev-with-system-center-configuration-manager.md - - name: Administering UE-V with Windows PowerShell and WMI - href: ue-v/uev-administering-uev-with-windows-powershell-and-wmi.md - - name: Managing the UE-V Service and Packages with Windows PowerShell and WMI - href: ue-v/uev-managing-uev-agent-and-packages-with-windows-powershell-and-wmi.md - - name: Managing UE-V Settings Location Templates Using Windows PowerShell and WMI - href: ue-v/uev-managing-settings-location-templates-using-windows-powershell-and-wmi.md - - name: Working with Custom UE-V Templates and the UE-V Template Generator - href: ue-v/uev-working-with-custom-templates-and-the-uev-generator.md - - name: Manage Administrative Backup and Restore in UE-V - href: ue-v/uev-manage-administrative-backup-and-restore.md - - name: Changing the Frequency of UE-V Scheduled Tasks - href: ue-v/uev-changing-the-frequency-of-scheduled-tasks.md - - name: Migrating UE-V Settings Packages - href: ue-v/uev-migrating-settings-packages.md - - name: Using UE-V with Application Virtualization Applications - href: ue-v/uev-using-uev-with-application-virtualization-applications.md - - name: Troubleshooting UE-V - href: ue-v/uev-troubleshooting.md - - name: Technical Reference for UE-V - items: - - name: Technical Reference for UE-V - href: ue-v/uev-technical-reference.md - - name: Sync Methods for UE-V - href: ue-v/uev-sync-methods.md - - name: Sync Trigger Events for UE-V - href: ue-v/uev-sync-trigger-events.md - - name: Synchronizing Microsoft Office with UE-V - href: ue-v/uev-synchronizing-microsoft-office-with-uev.md - - name: Application Template Schema Reference for UE-V - href: ue-v/uev-application-template-schema-reference.md - - name: Security Considerations for UE-V - href: ue-v/uev-security-considerations.md diff --git a/windows/configuration/windows-accessibility-for-ITPros.md b/windows/configuration/accessibility/index.md similarity index 95% rename from windows/configuration/windows-accessibility-for-ITPros.md rename to windows/configuration/accessibility/index.md index cda104c484..335576ee27 100644 --- a/windows/configuration/windows-accessibility-for-ITPros.md +++ b/windows/configuration/accessibility/index.md @@ -1,19 +1,9 @@ --- title: Windows accessibility information for IT Pros description: Lists the various accessibility features available in Windows client with links to detailed guidance on how to set them. -ms.prod: windows-client -ms.technology: itpro-configure -ms.author: lizlong -author: lizgt2000 -ms.date: 08/11/2023 -ms.reviewer: -manager: aaroncz -ms.localizationpriority: medium +ms.date: 01/25/2024 ms.topic: conceptual ms.collection: tier1 -appliesto: - - ✅ Windows 10 - - ✅ Windows 11 --- @@ -25,76 +15,54 @@ Microsoft is dedicated to making its products and services accessible and usable This article helps you as the IT administrator learn about built-in accessibility features. It also includes recommendations for how to support people in your organization who use these features. -Windows 11, version 22H2, includes improvements for people with disabilities: system-wide live captions, Focus sessions, voice access, and more natural voices for Narrator. For more information, see [New accessibility features coming to Windows 11](https://blogs.windows.com/windowsexperience/2022/05/10/new-accessibility-features-coming-to-windows-11/) and [How inclusion drives innovation in Windows 11](https://blogs.windows.com/windowsexperience/?p=177554). +Windows 11, version 22H2, includes improvements for people with disabilities: system-wide live captions, Focus sessions, voice access, and more natural voices for Narrator. For more information, see [New accessibility features coming to Windows 11](https://blogs.windows.com/windowsexperience/2022/05/10/new-accessibility-features-coming-to-windows-11/) and [How inclusion drives innovation in Windows 11](https://blogs.windows.com/windowsexperience/?p=177554). + ## General recommendations - **Be aware of Ease of Access settings**. Understand how people in your organization might use these settings. Help people in your organization learn how they can customize Windows. - - **Don't block settings**. Avoid using group policy or MDM settings that override Ease of Access settings. - - **Encourage choice**. Allow people in your organization to customize their computers based on their needs. That customization might be installing an add-on for their browser, or a non-Microsoft assistive technology. ## Vision - [Use Narrator to use devices without a screen](https://support.microsoft.com/windows/complete-guide-to-narrator-e4397a0d-ef4f-b386-d8ae-c172f109bdb1). Narrator describes Windows and apps and enables you to control devices by using a keyboard, controller, or with a range of gestures on touch-supported devices. Now the user is able to download and install 10 more natural languages. - - [Create accessible apps](/windows/apps/develop/accessibility). You can develop accessible apps just like Mail, Groove, and Store that work well with Narrator and other leading screen readers. - - Use keyboard shortcuts. Get the most out of Windows with shortcuts for apps and desktops. - - [Keyboard shortcuts in Windows](https://support.microsoft.com/windows/keyboard-shortcuts-in-windows-dcc61a57-8ff0-cffe-9796-cb9706c75eec) - [Narrator keyboard commands and touch gestures](https://support.microsoft.com/windows/appendix-b-narrator-keyboard-commands-and-touch-gestures-8bdab3f4-b3e9-4554-7f28-8b15bd37410a) - [Windows keyboard shortcuts for accessibility](https://support.microsoft.com/windows/windows-keyboard-shortcuts-for-accessibility-021bcb62-45c8-e4ef-1e4f-41b8c1fc87fd) - - Get closer with [Magnifier](https://support.microsoft.com/windows/use-magnifier-to-make-things-on-the-screen-easier-to-see-414948ba-8b1c-d3bd-8615-0e5e32204198). Magnifier enlarges all or part of your screen and offers various configuration settings. - - [Make Windows easier to see](https://support.microsoft.com/windows/make-windows-easier-to-see-c97c2b0d-cadb-93f0-5fd1-59ccfe19345d). - - Changing the size or color of pointers or adding trails or touch feedback make it easier to follow the mouse. - Adjust the size of text, icons, and other screen items to make them easier to see. - Many high-contrast themes are available to suit your needs. - - [Have Cortana assist](https://support.microsoft.com/topic/what-is-cortana-953e648d-5668-e017-1341-7f26f7d0f825). Cortana can handle various tasks for you, including setting reminders, opening apps, finding facts, and sending emails and texts. - - [Dictate text and commands](https://support.microsoft.com/windows/use-voice-recognition-in-windows-83ff75bd-63eb-0b6c-18d4-6fae94050571). Windows includes speech recognition that lets you tell it what to do. - - [Simplify for focus](https://support.microsoft.com/windows/make-it-easier-to-focus-on-tasks-0d259fd9-e9d0-702c-c027-007f0e78eaf2). Reducing animations and turning off background images and transparency can minimize distractions. - - [Keep notifications around longer](https://support.microsoft.com/windows/make-windows-easier-to-hear-9c18cfdc-63be-2d47-0f4f-5b00facfd2e1). If notifications aren't staying visible long enough for you to notice them, you can increase the time a notification will be displayed up to five minutes. - - [Read in braille](https://support.microsoft.com/windows/chapter-8-using-narrator-with-braille-3e5f065b-1c9d-6eb2-ec6d-1d07c9e94b20). Narrator supports braille displays from more than 35 manufacturers using more than 40 languages and multiple braille variants. - - Starting in Windows 11, version 22H2 with [KB5022913](https://support.microsoft.com/kb/5022913), the compatibility of braille displays has been expanded. Braille displays work seamlessly and reliably across multiple screen readers, improving the end user experience. ## Hearing - [Use live captions to better understand audio](https://support.microsoft.com/windows/use-live-captions-to-better-understand-audio-b52da59c-14b8-4031-aeeb-f6a47e6055df). Use Windows 11, version 22H2 or later to better understand any spoken audio with real time captions. - - Starting with Windows 11, version 22H2 with [KB5026446](https://support.microsoft.com/kb/5026446), live captions now supports additional languages. - - [View live transcription in a Teams meeting](https://support.microsoft.com/office/view-live-transcription-in-a-teams-meeting-dc1a8f23-2e20-4684-885e-2152e06a4a8b). During any Teams meeting, view a live transcription so you don't miss what's being said. - - [Use Teams for sign language](https://www.microsoft.com/microsoft-teams/group-chat-software). Teams is available on various platforms and devices, so you don't have to worry about whether your co-workers, friends, and family can communicate with you. - [Make Windows easier to hear](https://support.microsoft.com/windows/make-windows-easier-to-hear-9c18cfdc-63be-2d47-0f4f-5b00facfd2e1). - - Replace audible alerts with visual alerts. - If notifications aren't staying visible long enough for you to notice them, you can increase the time a notification will be displayed up to five minutes. - Send all sounds to both left and right channels, which is helpful for those people with partial hearing loss or deafness in one ear. - - [Read spoken words with captioning](https://support.microsoft.com/windows/change-caption-settings-135c465b-8cfd-3bac-9baf-4af74bc0069a). You can customize things like color, size, and background transparency to suit your needs and tastes. - - Use the [Azure Cognitive Services Translator](/azure/cognitive-services/translator/) service to add machine translation to your solutions. ## Physical - [Have Cortana assist you](https://support.microsoft.com/topic/what-is-cortana-953e648d-5668-e017-1341-7f26f7d0f825). Cortana can handle various tasks for you, including setting reminders, opening apps, finding facts, and sending emails and texts. - - [Dictate text and commands](https://support.microsoft.com/windows/use-voice-recognition-in-windows-83ff75bd-63eb-0b6c-18d4-6fae94050571). Windows includes voice recognition that lets you tell it what to do. - - [Use the On-Screen Keyboard (OSK)](https://support.microsoft.com/windows/use-the-on-screen-keyboard-osk-to-type-ecbb5e08-5b4e-d8c8-f794-81dbf896267a). Instead of relying on a physical keyboard, use the OSK to enter data and select keys with a mouse or other pointing device. It also offers word prediction and completion. - - [Make your mouse, keyboard, and other input devices easier to use](https://support.microsoft.com/windows/make-your-mouse-keyboard-and-other-input-devices-easier-to-use-10733da7-fa82-88be-0672-f123d4b3dcfe). - If you have limited control of your hands, you can personalize your keyboard to do helpful things like ignore repeated keys. @@ -103,32 +71,24 @@ Windows 11, version 22H2, includes improvements for people with disabilities: sy ## Cognition - [Simplify for focus](https://support.microsoft.com/windows/make-it-easier-to-focus-on-tasks-0d259fd9-e9d0-702c-c027-007f0e78eaf2). Reducing animations and turning off background images and transparency can minimize distractions. - - [Download and use fonts that are easier to read](https://www.microsoft.com/download/details.aspx?id=50721). **Fluent Sitka Small** and **Fluent Calibri** are fonts that address "visual crowding" by adding character and enhance word and line spacing. - - [Microsoft Edge reading view](https://support.microsoft.com/windows/take-your-reading-with-you-b6699255-4436-708e-7b93-4d2e19a15af8). Clears distracting content from web pages so you can stay focused on what you really want to read. ## Assistive technology devices built into Windows - [Hear text read aloud with Narrator](https://support.microsoft.com/windows/hear-text-read-aloud-with-narrator-040f16c1-4632-b64e-110a-da4a0ac56917). Narrator reads text on your PC screen aloud and describes events, such as notifications or calendar appointments, so you can use your PC without a display. - - Scripting functionality has been added to Narrator. There is store delivery of Narrator extension scripts which currently include an Outlook script and an Excel script. - - [Use voice recognition](https://support.microsoft.com/windows/use-voice-recognition-in-windows-83ff75bd-63eb-0b6c-18d4-6fae94050571). - With spellings experience in voice access, you can dictate a complex or non-standard word letter-by-letter and add it to Windows dictionary. The next time you try to dictate the same word, voice access improves its recognition. - [Save time with keyboard shortcuts](https://support.microsoft.com/windows/keyboard-shortcuts-in-windows-dcc61a57-8ff0-cffe-9796-cb9706c75eec). - -- [Use voice access to control your PC and author text with your voice](https://support.microsoft.com/en-us/topic/use-voice-access-to-control-your-pc-author-text-with-your-voice-4dcd23ee-f1b9-4fd1-bacc-862ab611f55d). +- [Use voice access to control your PC and author text with your voice](https://support.microsoft.com/topic/use-voice-access-to-control-your-pc-author-text-with-your-voice-4dcd23ee-f1b9-4fd1-bacc-862ab611f55d). ## Other resources [Windows accessibility](https://www.microsoft.com/Accessibility/windows) - [Designing accessible software](/windows/apps/design/accessibility/designing-inclusive-software) - [Inclusive design](https://www.microsoft.com/design/inclusive) - [Accessibility guide for Microsoft 365 Apps](/deployoffice/accessibility-guide) diff --git a/windows/configuration/assigned-access/configuration-file.md b/windows/configuration/assigned-access/configuration-file.md new file mode 100644 index 0000000000..3d2532b2af --- /dev/null +++ b/windows/configuration/assigned-access/configuration-file.md @@ -0,0 +1,520 @@ +--- +title: Create an Assigned Access configuration file +description: Learn how to create an XML file to configure Assigned Access. +ms.topic: how-to +zone_pivot_groups: windows-versions-11-10 +ms.date: 03/04/2024 +appliesto: +--- + +# Create an Assigned Access configuration XML file + +To configure Assigned Access, you must create and apply a configuration XML file to your devices. The configuration file must conform to a *schema*, as defined in [Assigned Access XML Schema Definition (XSD)](xsd.md). + +This article describes how to configure an Assigned Access configuration file, including practical examples. + +Let's start by looking at the basic structure of the XML file. An Assigned Access configuration file contains: + +- One or multiple `profiles`. Each `profile` defines a set of applications that are allowed to run +- One or multiple `configs`. Each `config` associates a user account or a group to a `profile` + +Here's a basic example of an Assigned Access configuration file, with one profile and one config: + +```xml + + + + + + + + + + + + + +``` + +## Versioning + +The Assigned Access configuration XML is versioned. The version is defined in the XML root element, and it's used to determine which schema to use to validate the XML file. The version is also used to determine which features are available for the configuration. Here's a table of the versions, aliases used in the documentation examples, and namespaces: + +| Version | Alias | Namespace | +|-|-|-| +|Windows 11, version 22H2|`v5`|`http://schemas.microsoft.com/AssignedAccess/2022/config`| +|Windows 11, version 21H2|`v4`|`http://schemas.microsoft.com/AssignedAccess/2021/config`| +|Windows 10|`v5`|`http://schemas.microsoft.com/AssignedAccess/202010/config`| +|Windows 10|`v3`|`http://schemas.microsoft.com/AssignedAccess/2020/config`| +|Windows 10|`rs5`|`http://schemas.microsoft.com/AssignedAccess/201810/config`| +|Windows 10|default|`http://schemas.microsoft.com/AssignedAccess/2017/config`| + +To authorize a compatible configuration XML that includes version-specific elements and attributes, always include the namespace of the add-on schemas, and decorate the attributes and elements accordingly with the namespace alias. For example, to configure the `StartPins` feature that was added in Windows 11, version 22H2, use the below example. Note the alias `v5` associated to the `http://schemas.microsoft.com/AssignedAccess/2022/config` namespace for 22H2 release, and the alias is tagged on `StartPins` inline. + +```xml + + + + + + + + + + + + + + + + +``` + +Here you can find the Assigned Access XML schema definitions: [Assigned Access XML Schema Definition (XSD)](xsd.md). + +## Profiles + +A configuration file can contain one or more profiles. Each profile is identified by a unique identifier `Profile Id` and, optionally, a `Name`. For example: + +```xml + + + + + +``` + +> [!TIP] +> The `Profile Id` must be unique within the XML file. You can generate a GUID with the PowerShell cmdlet `New-Guid`. + +A profile can be one of two types: + +- `KioskModeApp`: is used to configure a kiosk experience. Users assigned this profile don't access the desktop, but only the Universal Windows Platform (UWP) application or Microsoft Edge running in full-screen above the Lock screen +- `AllAppList` is used to configure a restricted user experience. Users assigned this profile, access the desktop with the specific apps on the Start menu + +> [!IMPORTANT] +> +> - You can't set both `KioskModeApp` and `ShellLauncher` at the same time on the device +> - A configuration file can contain only one `KioskModeApp` profile, but it can contain multiple `AllAppList` profiles. + +### KioskModeApp + +The properties of a `KioskModeApp` profile are: + +| Property| Description | Details | +|-|-|-| +|`AppUserModelId`|The Application User Model ID (AUMID) of the UWP app.|Learn how to [Find the Application User Model ID of an installed app](../store/find-aumid.md).| +|`v4:ClassicAppPath`|The full path to a desktop app executable.|This is the path to the desktop app used in kiosk mode. The path can contain system environment variables in the form of `%variableName%`.| +|`v4:ClassicAppArguments`|The arguments to be passed to the desktop app.|This property is optional.| + +By default, you can use the CTRL+ALT+DEL sequence to exit kiosk mode. You can define a `BreakoutSequence` element to change the default sequence. The `Key` attribute is a string that represents the key combination. + +Example of two profiles, a desktop app and a UWP app: + +```xml + + + + + + + +``` + +> [!NOTE] +> You can only assign a `KioskModeApp` profile to users, not to groups. + +### AllAppList + +Based on the purpose of the kiosk device, define the list of applications that are allowed to run. This list can contain both UWP apps and desktop apps. When the mult-app kiosk configuration is applied to a device, AppLocker rules are generated to allow the apps that are listed in the configuration. + +> [!NOTE] +> If an app has a dependency on another app, both must be included in the allowed apps list. + +Within the `AllAppList` node, define a list of applications that are allowed execute. Each `App` element has the following properties: + +| Property| Description | Details | +|-|-|-| +|`AppUserModelId`|The Application User Model ID (AUMID) of the UWP app.|Learn how to [Find the Application User Model ID of an installed app](../store/find-aumid.md).| +|`DesktopAppPath`|The full path to a desktop app executable.|This is the path to the desktop app that used in kiosk mode. The path can contain system environment variables in the form of `%variableName%`.| +|`rs5:AutoLaunch`|A Boolean attribute to indicate whether to launch the app (either desktop or UWP app) automatically when the user signs in.|This property is optional. Only one application can autolaunch.| +|`rs5:AutoLaunchArguments`|The arguments to be passed to the app that is configured with `AutoLaunch`.|AutoLaunchArguments are passed to the apps as is and the app needs to handle the arguments explicitly. This property is optional.| + +Example: + +```xml + + + + + + + + + +``` + +::: zone pivot="windows-10" + +### File Explorer restrictions + +In a restricted user experience (`AllAppList`), folder browsing is locked down by default. You can explicitly allow access to known folders by including the `FileExplorerNamespaceRestrictions` node. + +You can specify user access to Downloads folder, Removable drives, or no restrictions at all. Downloads and Removable Drives can be allowed at the same time. + +```xml + + + + + + + + + + + + + +``` + +Here are some practical examples. + +#### Block everything + +Either don't use the node or leave it empty. + +```xml + + +``` + +#### Only allow downloads + +```xml + + + +``` + +#### Only allow removable drives + +```xml + + + +``` + +#### Allow both Downloads, and removable drives + +```xml + + + + +``` + +#### No restrictions, all locations are allowed + +```xml + + + +``` + +> [!TIP] +> To grant access to File Explorer in a restricted user experience, add `Explorer.exe` to the list of allowed apps, and pin a shortcut to the Start menu. + +::: zone-end + +### Start menu customizations + +For a restricted user experience profile (`AllAppList`), you must define the Start layout. The Start layout contains a list of applications that are pinned to the Start menu. You can choose to pin all the allowed applications to the Start menu, or a subset. The easiest way to create a customized Start layout is to configure the Start menu on a test device and then export the layout. + +To learn how to customize and export a Start menu configuration, see [Customize the Start menu](../start/layout.md). + +::: zone pivot="windows-10" + +With the exported Start menu configuration, use the `StartLayout` element and add the content of the XML file. For example: + +```xml + + + ]]> + +``` + +Example with some apps pinned: + +```xml + + + + + + + + + + + + + + + + + + + ]]> + +``` + +::: zone-end + +::: zone pivot="windows-11" + +With the exported Start menu configuration, use the `v5:StartPins` element and add the content of the exported JSON file. For example: + +```xml + + + ]]> + +``` + +Example with some apps pinned: + + + + + +::: zone-end + +> [!NOTE] +> If an app isn't installed for the user, but is included in the Start layout XML, the app isn't shown on the Start screen. + +### Taskbar customizations + +::: zone pivot="windows-10" + +You can't pin apps on the taskbar in a restricted user experience. It's not supported to configure a Taskbar layout using the `` tag in a layout modification XML, as part of the Assigned Access configuration. + +The only Taskbar customization available is the option to show or hide it, using the `ShowTaskbar` boolean attribute. + +The following example exposes the taskbar: + +```xml + +``` + +The following example hides the taskbar: + +```xml + +``` + +> [!NOTE] +> This is different from the **Automatically hide the taskbar** option in tablet mode, which shows the taskbar when swiping up from or moving the mouse pointer down to the bottom of the screen. Setting `ShowTaskbar` as `false` hides the taskbar permanently. + +::: zone-end + +::: zone pivot="windows-11" + +You can customize the Taskbar by creating a custom layout and adding it to your XML file. To learn how to customize and export the Taskbar configuration, see [Customize the Taskbar](../taskbar/configure.md). + +> [!NOTE] +> In Windows 11, the `ShowTaskbar` attribute is no-op. Configure it with a value of `true`. + +With the exported Taskbar configuration, use the `v5:TaskbarLayout` element and add the content of the XML file. For example: + +```xml + + + ]]> + +``` + +Here's an example of a custom Taskbar with a few apps pinned: + +```xml + + + + + + + + + + + + + + ]]> + +``` + +::: zone-end + + + +## Configs + +Under `Configs`, define one or more user accounts, or groups, and their association with a profile. + +When the user account signs in, the associated Assigned Access profile is enforced along with policy settings that are part of the restricted user experience. + +You can assign: + +- A standard user account, which can be local, domain, or Microsoft Entra ID +- A group account, which can be local, Active Directory (domain), or Microsoft Entra ID + +Limitations: + +- Configs that specify group accounts can't use a kiosk profile, only a restricted user experience profile +- Apply the restricted user experience to standard users only. It's not supported to associate an admin user with an Assigned Access profile +- Don't apply the profile to users or groups that are targeted by conditional access policies that require user interaction. For example, multi-factor authentication (MFA), or Terms of Use (TOU). For more information, see [Users can't log on to Windows if a multi-app kiosk profile is assigned](/troubleshoot/mem/intune/device-configuration/users-cannot-logon-windows-multi-app-kiosk) + +>[!NOTE] +> On Microsoft Entra joined and domain joined devices, local user accounts aren't displayed on the sign-in screen by default. To display the local accounts on the sign-in screen, enable the policy setting: +> +>- GPO: **Computer Configuration** > **Administrative Templates** > **System** > **Logon** > **Enumerate local users on domain-joined computers** +>- CSP: `./Device/Vendor/MSFT/Policy/Config/WindowsLogon/`[EnumerateLocalUsersOnDomainJoinedComputers](/windows/client-management/mdm/policy-csp-windowslogon#enumeratelocalusersondomainjoinedcomputers) + +### AutoLogon account + +With ``, Assigned Access creates and manages a user account to automatically sign in after a device restarts. The account is a local standard user. + +The following example shows how to specify an account to sign in automatically, and the optional display name for the account on the sign-in screen: + +```xml + + + + + + +``` + +>[!IMPORTANT] +>When Exchange Active Sync (EAS) password restrictions are active on the device, the autologon feature doesn't work. This behavior is by design. For more informations, see [How to turn on automatic logon in Windows](/troubleshoot/windows-server/user-profiles-and-logon/turn-on-automatic-logon). + +### Global profile + +With `GlobalProfile`, you can define an Assigned Access profile that is applied to every non-admin account that signs in. `GlobalProfile` is useful in scenarios like frontline workers or student devices, where you want to ensure that every user has a consistent experience. + +```xml + + + +``` + +> [!NOTE] +> You can combine a global profile with other profiles. If you assign a user a non-global profile, the global profile won't be applied to that user. + +### User accounts + +Individual accounts are specified using ``. + +> [!IMPORTANT] +> Before applying the Assigned Access configuration, make sure the specified user account is available on the device, otherwise it fails. +> +> For both domain and Microsoft Entra accounts, as long as the device is Active Directory joined or Microsoft Entra joined, the account can be discovered in the domain forest or tenant that the device is joined to. For local accounts, it is required that the account exist before you configure the account for assigned access. + +#### Local user + +Local account can be entered as `devicename\user`, `.\user`, or just `user`. + +```xml + + user + + +``` + +#### Active Directory user + +Domain accounts must be entered using the format `domain\samAccountName`. + +```xml + + contoso\user + + +``` + +#### Microsoft Entra user + +Microsoft Entra accounts must be specified with the format: `AzureAD\{UPN}`. `AzureAD` must be provided *as is*, then follow with the Microsoft Entra user principal name (UPN). + +```xml + + AzureAD\user@contoso.onmicrosoft.com + + +``` + +### Group accounts + +Group accounts are specified using ``. Nested groups aren't supported. For example, if *User A* is member of *Group A*, *Group A* is member of *Group B*, and *Group B* is used in ``, *User A* doesn't have the kiosk experience. + +#### Local group + +Specify the group type as `LocalGroup` and add the group name in the `Name` attribute. + +```xml + + + + +``` + +#### Active Directory group + +Both security and distribution groups are supported. Specify the group type as `ActiveDirectoryGroup`. Use the domain name as the prefix in the name attribute. + +```xml + + + + +``` + +#### Microsoft Entra group + +Use the object ID of the Microsoft Entra group. You can find the object ID on the overview page for the group by signing in to the Microsoft Entra admin center and browsing to **Identity** > **Groups** > **All groups**. Specify the group type as `AzureActiveDirectoryGroup`. The kiosk device must have internet connectivity when users that belong to the group sign-in. + +```xml + + + + +``` + +## Next steps + +> [!div class="nextstepaction"] +> Review some practical examples of Assigned Access XML configurations: +> +> [Assigned Access examples](examples.md) diff --git a/windows/configuration/assigned-access/examples.md b/windows/configuration/assigned-access/examples.md new file mode 100644 index 0000000000..3c0c865d64 --- /dev/null +++ b/windows/configuration/assigned-access/examples.md @@ -0,0 +1,49 @@ +--- +title: Assigned Access examples +description: Practical examples of XML files to configure Assigned Access. +ms.date: 03/04/2024 +ms.topic: reference +zone_pivot_groups: windows-versions-11-10 +appliesto: +--- + +# Assigned Access examples + +This article contains examples of XML files to configure a device with Assigned Access. The files can be easily modified to fit your specific needs. + +To learn more: + +- [Create an Assigned Access configuration XML file](configuration-file.md). +- [Assigned Access XML Schema Definition (XSD)](xsd.md). + +## Kiosk experience with Microsoft Edge + +[!INCLUDE [example-kiosk-edge](includes/example-kiosk-edge.md)] + +## Kiosk experience with Universal Windows Platform (UWP) app + +[!INCLUDE [example-kiosk-uwp](includes/example-kiosk-uwp.md)] + +::: zone pivot="windows-10" + +## File Explorer restrictions + +[!INCLUDE [example-file-explorer-restrictions](includes/example-file-explorer-restrictions.md)] + +::: zone-end + +## Global Profile + +The following configuration demonstrates that only a global profile is used, with no user configured. + +[!INCLUDE [example-global-profile](includes/example-global-profile.md)] + +## User Group + +The following configuration demonstrates how to assign profiles to different users and groups, including a user configured to automatically sign in. + +[!INCLUDE [example-usergroup](includes/example-usergroup.md)] + +## Restricted user experience + +[!INCLUDE [example-restricted-experience](includes/example-restricted-experience.md)] diff --git a/windows/configuration/assigned-access/images/kiosk.png b/windows/configuration/assigned-access/images/kiosk.png new file mode 100644 index 0000000000..bea0e381b6 Binary files /dev/null and b/windows/configuration/assigned-access/images/kiosk.png differ diff --git a/windows/configuration/assigned-access/images/restricted-user-experience-windows-10.png b/windows/configuration/assigned-access/images/restricted-user-experience-windows-10.png new file mode 100644 index 0000000000..81f6ded25e Binary files /dev/null and b/windows/configuration/assigned-access/images/restricted-user-experience-windows-10.png differ diff --git a/windows/configuration/assigned-access/images/restricted-user-experience-windows-11.png b/windows/configuration/assigned-access/images/restricted-user-experience-windows-11.png new file mode 100644 index 0000000000..6105c7bdd7 Binary files /dev/null and b/windows/configuration/assigned-access/images/restricted-user-experience-windows-11.png differ diff --git a/windows/configuration/assigned-access/images/restricted-user-experience.png b/windows/configuration/assigned-access/images/restricted-user-experience.png new file mode 100644 index 0000000000..566b4bd902 Binary files /dev/null and b/windows/configuration/assigned-access/images/restricted-user-experience.png differ diff --git a/windows/configuration/assigned-access/includes/example-file-explorer-restrictions.md b/windows/configuration/assigned-access/includes/example-file-explorer-restrictions.md new file mode 100644 index 0000000000..ff855baa88 --- /dev/null +++ b/windows/configuration/assigned-access/includes/example-file-explorer-restrictions.md @@ -0,0 +1,30 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 03/01/2024 +ms.topic: include +--- + + + +```xml + + + + + + + + + + + + + + + + + + + +``` diff --git a/windows/configuration/assigned-access/includes/example-global-profile.md b/windows/configuration/assigned-access/includes/example-global-profile.md new file mode 100644 index 0000000000..a818640cbd --- /dev/null +++ b/windows/configuration/assigned-access/includes/example-global-profile.md @@ -0,0 +1,22 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 02/05/2024 +ms.topic: include +--- + + + +```xml + + + + + + + + + + + +``` diff --git a/windows/configuration/assigned-access/includes/example-kiosk-edge.md b/windows/configuration/assigned-access/includes/example-kiosk-edge.md new file mode 100644 index 0000000000..91059e7434 --- /dev/null +++ b/windows/configuration/assigned-access/includes/example-kiosk-edge.md @@ -0,0 +1,26 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 03/01/2024 +ms.topic: include +--- + + + +```xml + + + + + + + + + + + Edge kiosk + + + + +``` diff --git a/windows/configuration/assigned-access/includes/example-kiosk-uwp.md b/windows/configuration/assigned-access/includes/example-kiosk-uwp.md new file mode 100644 index 0000000000..69e5a1ac70 --- /dev/null +++ b/windows/configuration/assigned-access/includes/example-kiosk-uwp.md @@ -0,0 +1,25 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 02/05/2024 +ms.topic: include +--- + + + +```xml + + + + + + + + + + Weather app + + + + +``` diff --git a/windows/configuration/assigned-access/includes/example-restricted-experience.md b/windows/configuration/assigned-access/includes/example-restricted-experience.md new file mode 100644 index 0000000000..7ee28b6761 --- /dev/null +++ b/windows/configuration/assigned-access/includes/example-restricted-experience.md @@ -0,0 +1,115 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 02/05/2024 +ms.topic: include +--- + + + +::: zone pivot="windows-10" + +```xml + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + ]]> + + + + + + + + + + +``` + +::: zone-end + +::: zone pivot="windows-11" + +```xml + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +``` + +::: zone-end diff --git a/windows/configuration/assigned-access/includes/example-two-profiles.md b/windows/configuration/assigned-access/includes/example-two-profiles.md new file mode 100644 index 0000000000..42bad92801 --- /dev/null +++ b/windows/configuration/assigned-access/includes/example-two-profiles.md @@ -0,0 +1,37 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 02/05/2024 +ms.topic: include +--- + + + +```xml + + + + + + + + + + + + + + + + + + Weather app + + + + Library Kiosk + + + + +``` diff --git a/windows/configuration/assigned-access/includes/example-usergroup.md b/windows/configuration/assigned-access/includes/example-usergroup.md new file mode 100644 index 0000000000..7d69b07f0b --- /dev/null +++ b/windows/configuration/assigned-access/includes/example-usergroup.md @@ -0,0 +1,47 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 02/05/2024 +ms.topic: include +--- + + + +```xml + + + + + + + + contoso\user + + + + AzureAD\user@contoso.onmicrosoft.com + + + + user + + + + + + + + + + + + + + + + + + + + +``` diff --git a/windows/configuration/assigned-access/includes/quickstart-kiosk-intune.md b/windows/configuration/assigned-access/includes/quickstart-kiosk-intune.md new file mode 100644 index 0000000000..8fb14f8ac6 --- /dev/null +++ b/windows/configuration/assigned-access/includes/quickstart-kiosk-intune.md @@ -0,0 +1,13 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 02/05/2024 +ms.topic: include +--- + +```msgraph-interactive +POST https://graph.microsoft.com/beta/deviceManagement/deviceConfigurations +Content-Type: application/json + +{ "id": "00000000-0000-0000-0000-000000000000", "displayName": "_MSLearn_Example_Kiosk - Assigned Access", "description": "This is a sample policy created from an article on learn.microsoft.com.", "roleScopeTagIds": [ "0" ], "@odata.type": "#microsoft.graph.windows10CustomConfiguration", "omaSettings": [ { "omaUri": "./Vendor/MSFT/AssignedAccess/Configuration", "displayName": "Configuration", "@odata.type": "#microsoft.graph.omaSettingString", "value": "\n\n \n \n \n \n \n \n \n \n \n \n \n \n" } ] } +``` \ No newline at end of file diff --git a/windows/configuration/assigned-access/includes/quickstart-kiosk-ps.md b/windows/configuration/assigned-access/includes/quickstart-kiosk-ps.md new file mode 100644 index 0000000000..4f5ce43c2e --- /dev/null +++ b/windows/configuration/assigned-access/includes/quickstart-kiosk-ps.md @@ -0,0 +1,32 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 02/05/2024 +ms.topic: include +--- + +```powershell +$assignedAccessConfiguration = @" + + + + + + + + + + + + + + + +"@ + +$namespaceName="root\cimv2\mdm\dmmap" +$className="MDM_AssignedAccess" +$obj = Get-CimInstance -Namespace $namespaceName -ClassName $className +$obj.Configuration = [System.Net.WebUtility]::HtmlEncode($assignedAccessConfiguration) +Set-CimInstance -CimInstance $obj +``` diff --git a/windows/configuration/assigned-access/includes/quickstart-kiosk-xml.md b/windows/configuration/assigned-access/includes/quickstart-kiosk-xml.md new file mode 100644 index 0000000000..93a0607346 --- /dev/null +++ b/windows/configuration/assigned-access/includes/quickstart-kiosk-xml.md @@ -0,0 +1,24 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 02/05/2024 +ms.topic: include +--- + +```xml + + + + + + + + + + + + + + + +``` diff --git a/windows/configuration/assigned-access/includes/quickstart-restricted-experience-intune.md b/windows/configuration/assigned-access/includes/quickstart-restricted-experience-intune.md new file mode 100644 index 0000000000..7267d16e53 --- /dev/null +++ b/windows/configuration/assigned-access/includes/quickstart-restricted-experience-intune.md @@ -0,0 +1,28 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 02/05/2024 +ms.topic: include +--- + +::: zone pivot="windows-10" + +```msgraph-interactive +POST https://graph.microsoft.com/beta/deviceManagement/deviceConfigurations +Content-Type: application/json + +{ "id": "00-0000-0000-0000-000000000000", "displayName": "_MSLearn_Example_Restricted_User_Experience - Assigned Access - Windows 10", "description": "This is a sample policy created from an article on learn.microsoft.com.", "roleScopeTagIds": [ "0" ], "@odata.type": "#microsoft.graph.windows10CustomConfiguration", "omaSettings": [ { "@odata.type": "#microsoft.graph.omaSettingString", "displayName": "AssignedAccess_Configuration", "description": null, "omaUri": "./Vendor/MSFT/AssignedAccess/Configuration", "secretReferenceValueId": null, "isEncrypted": true, "value": "\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n ]]>\n \n \n \n \n \n \n \n \n \n \n" } ] } +``` + +::: zone-end + +::: zone pivot="windows-11" + +```msgraph-interactive +POST https://graph.microsoft.com/beta/deviceManagement/deviceConfigurations +Content-Type: application/json + +{ "id": "00-0000-0000-0000-000000000000", "displayName": "_MSLearn_Example_Restricted_User_Experience - Assigned Access - Windows 11", "description": "This is a sample policy created from an article on learn.microsoft.com.", "roleScopeTagIds": [ "0" ], "@odata.type": "#microsoft.graph.windows10CustomConfiguration", "omaSettings": [ { "@odata.type": "#microsoft.graph.omaSettingString", "displayName": "AssignedAccess_Configuration", "description": null, "omaUri": "./Vendor/MSFT/AssignedAccess/Configuration", "secretReferenceValueId": null, "isEncrypted": true, "value": "\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n" } ] } +``` + +::: zone-end \ No newline at end of file diff --git a/windows/configuration/assigned-access/includes/quickstart-restricted-experience-ps.md b/windows/configuration/assigned-access/includes/quickstart-restricted-experience-ps.md new file mode 100644 index 0000000000..35a15c446f --- /dev/null +++ b/windows/configuration/assigned-access/includes/quickstart-restricted-experience-ps.md @@ -0,0 +1,129 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 02/05/2024 +ms.topic: include +--- + +::: zone pivot="windows-10" + +```powershell +$assignedAccessConfiguration = @" + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + ]]> + + + + + + + + + + +"@ + +$namespaceName="root\cimv2\mdm\dmmap" +$className="MDM_AssignedAccess" +$obj = Get-CimInstance -Namespace $namespaceName -ClassName $className +$obj.Configuration = [System.Net.WebUtility]::HtmlEncode($assignedAccessConfiguration) +Set-CimInstance -CimInstance $obj +``` + +::: zone-end + +::: zone pivot="windows-11" + +```powershell +$assignedAccessConfiguration = @" + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +"@ + +$namespaceName="root\cimv2\mdm\dmmap" +$className="MDM_AssignedAccess" +$obj = Get-CimInstance -Namespace $namespaceName -ClassName $className +$obj.Configuration = [System.Net.WebUtility]::HtmlEncode($assignedAccessConfiguration) +Set-CimInstance -CimInstance $obj +``` + +::: zone-end diff --git a/windows/configuration/assigned-access/includes/quickstart-restricted-experience-xml.md b/windows/configuration/assigned-access/includes/quickstart-restricted-experience-xml.md new file mode 100644 index 0000000000..514c6ab44c --- /dev/null +++ b/windows/configuration/assigned-access/includes/quickstart-restricted-experience-xml.md @@ -0,0 +1,113 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 02/05/2024 +ms.topic: include +--- + +::: zone pivot="windows-10" + +```xml + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + ]]> + + + + + + + + + + +``` + +::: zone-end + +::: zone pivot="windows-11" + +```xml + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +``` + +::: zone-end diff --git a/windows/configuration/assigned-access/index.md b/windows/configuration/assigned-access/index.md new file mode 100644 index 0000000000..e8f3ecf20b --- /dev/null +++ b/windows/configuration/assigned-access/index.md @@ -0,0 +1,72 @@ +--- +title: Windows kiosks and restricted user experiences +description: Learn about the options available in Windows to configure kiosks and restricted user experiences. +ms.topic: overview +ms.date: 03/04/2024 +--- + +# Windows kiosks and restricted user experiences + +Organizations are constantly seeking ways to streamline operations, improve customer service, and enhance productivity. One effective solution is the deployment of kiosk devices. These specialized devices offer a range of benefits that can significantly impact an organization's efficiency and success. For example: + +- Cost-effective customer service: kiosks allow organizations to provide essential services without the need for dedicated staff. Whether it's checking in at a hotel, ordering food at a restaurant, or printing boarding passes at an airport, kiosks reduce labor costs while maintaining service quality. Customers appreciate the convenience of self-service options, leading to higher satisfaction levels +- Reduced wait times: long queues and wait times frustrate customers and staff members. Kiosks expedite processes by allowing users to complete tasks independently. Whether it's paying bills, renewing memberships, or accessing information, kiosks empower users to get things done swiftly +- Consistent brand experience: kiosks ensure a uniform brand experience across different locations. Whether in retail stores, schools, airports, or healthcare facilities, the interface remains consistent. Brand consistency builds trust and reinforces the organization's image +- Customization and flexibility: kiosks can be tailored to specific needs. From touchscreens to barcode scanners, organizations choose features that align with their goals. Whether it's self-checkout, wayfinding, or interactive product catalogs, kiosks adapt to diverse requirements + +Windows offers two different options for public or specialized use: + +:::row::: + :::column span="1"::: + :::image type="content" source="images/kiosk.png" alt-text="Icon representing a kiosk." border="false"::: + :::column-end::: + :::column span="3"::: + #### Kiosk experience + :::column-end::: +:::row-end::: + +This option runs a single application in full screen, and people using the device can only use that app. When the designated kiosk account signs in, the kiosk app launches automatically. This option is sometimes referred to as *single-app kiosk*. + +Windows offers two different features to configure a kiosk experience: + +- **Assigned Access**: used to execute a single Universal Windows Platform (UWP) app or Microsoft Edge in full screen above the lock screen. When the kiosk account signs in, the kiosk app launches automatically. If the UWP app is closed, it automatically restarts +- **Shell Launcher**: used to configure a device to execute a Windows desktop application as the user interface. The application that you specify replaces the default Windows shell (`Explorer.exe`) that usually runs when a user signs in. This type of single-app kiosk doesn't run above the lock screen + +:::row::: + :::column span="1"::: + :::image type="content" source="images/restricted-user-experience.png" alt-text="Icon representing a restricted user experience." border="false"::: + :::column-end::: + :::column span="3"::: + #### Restricted user experience + :::column-end::: +:::row-end::: + +This option loads the Windows desktop, but it only allows to run a defined set of applications. When the designated user signs in, the user can only run the apps that are allowed. The Start menu is customized to show only the apps that are allowed to execute. With this approach, you can configure a locked-down experience for different account types. This option is sometimes referred to as *multi-app kiosk*. + +To configure a restricted user experience, you use the **Assigned Access** feature. + +## Choose the right experience + +When you're considering a kiosk or restricted user experience, you need to choose the right experience for your needs. A good approach is to ask yourself the following set of questions: + +| | Question | +|--|--| +| **🔲** | *How many apps?*
                        The number of apps determines the experience to build: **kiosk** or **restricted user experience**.| +| **🔲** | *Desktop experience or custom?*
                        If your users require access to the desktop with a custom Start menu, then you can build a **restricted user experience** with **Assigned Access**. If your users require access to multiple applications but with a custom user interface, then you should use **Shell Launcher**.| +| **🔲** | *In single-app scenario, which type of app will your kiosk run?*
                        If the kiosk requires a Universal Windows Platform (UWP) app or Microsoft Edge, you can build a **kiosk experience** with **Assigned Access**. If the kiosk requires a desktop app, you can build a **kiosk experience** with **Shell Launcher**.| +| **🔲** | *Which edition of Windows client will the kiosk run?"*
                        **Assigned Access** is supported on Windows Pro and Enterprise/Education. **Shell Launcher** is only supported on Windows Enterprise and Education editions.| + +## Next steps + +In the next sections, you can learn more about the options available to configure kiosks and restricted user experiences: + +- [Assigned Access](overview.md) +- [Shell Launcher](shell-launcher/index.md) + +### :::image type="icon" source="../images/icons/rocket.svg" border="false"::: Quickstarts + +If you're ready to try out the options available to configure kiosks and restricted user experiences, check out the following quickstarts: + +- [Quickstart: configure a kiosk with Assigned Access](quickstart-kiosk.md) +- [Quickstart: configure a kiosk experience with Shell Launcher](shell-launcher/quickstart-kiosk.md) +- [Quickstart: configure a restricted user experience with Assigned Access](quickstart-restricted-user-experience.md) \ No newline at end of file diff --git a/windows/configuration/assigned-access/overview.md b/windows/configuration/assigned-access/overview.md new file mode 100644 index 0000000000..12ed03cf42 --- /dev/null +++ b/windows/configuration/assigned-access/overview.md @@ -0,0 +1,344 @@ +--- +title: What is Assigned Access? +description: Learn how to configure a Windows kiosk for single-app and multi-app scenarios with Assigned Access. +ms.date: 06/14/2024 +ms.topic: overview +--- + +# What is Assigned Access? + +Assigned Access is a Windows feature that you can use to configure a device as a kiosk or with a restricted user experience. + +When you configure a **kiosk experience**, a single Universal Windows Platform (UWP) application or Microsoft Edge is executed in full screen, above the lock screen. Users can only use that application. If the kiosk app is closed, it automatically restarts. Practical examples include: + +- Public browsing +- Interactive digital signage + +When you configure a **restricted user experience**, users can only execute a defined list of applications, with a tailored Start menu and Taskbar. Different policy settings and AppLocker rules are enforced, creating a locked down experience. The users can access a familiar Windows desktop, while limiting their access, reducing distractions, and potential for inadvertent uses. Ideal for shared devices, you can create different configurations for different users. Practical examples include: + +- Frontline worker devices +- Student devices +- Lab devices + +> [!NOTE] +> When you configure a restricted user experience, different policy settings are applied to the device. Some policy settings apply to standard users only, and some to administrator accounts too. For more information, see [Assigned Access policy settings](policy-settings.md). + +## Requirements + +Here are the requirements for Assigned Access: + +- To use a kiosk experience, [User account control (UAC)](/windows/security/identity-protection/user-account-control/user-account-control-overview) must be enabled +- To use a kiosk experience, you must sign in from the console. The kiosk experience isn't supported over a remote desktop connection + +[!INCLUDE [assigned-access](../../../includes/licensing/assigned-access.md)] + +## Configure a kiosk experience + +There are several options to configure a kiosk experience. If you need to configure a single device with a local account, you can use: + +- PowerShell: you can use the `Set-AssignedAccess` PowerShell cmdlet to configure a kiosk experience using a local standard account +- Settings: use this option when you need a simple method to configure a single device with a local standard user account + +For advanced customizations, you can use the [Assigned Access CSP](/windows/client-management/mdm/assignedaccess-csp) to configure the kiosk experience. The CSP allows you to configure the kiosk app, the user account, and the kiosk app's behavior. When you use the CSP, you must create an XML configuration file that specifies the kiosk app and the user account. The XML file is applied to the device using one of the following options: + +- A Mobile Device Management (MDM) solution, like Microsoft Intune +- Provisioning packages +- PowerShell, with the MDM Bridge WMI Provider + +To learn how to configure the Shell Launcher XML file, see [Create an Assigned Access configuration file](configuration-file.md). + +[!INCLUDE [tab-intro](../../../includes/configure/tab-intro.md)] + +#### [:::image type="icon" source="../images/icons/intune.svg"::: **Intune/CSP**](#tab/intune) + +You can configure devices using a [custom policy][MEM-1] with the [AssignedAccess CSP][WIN-3]. + +- **Setting:** `./Vendor/MSFT/AssignedAccess/Configuration` +- **Value:** content of the XML configuration file + +Assign the policy to a group that contains as members the devices that you want to configure. + +#### [:::image type="icon" source="../images/icons/provisioning-package.svg"::: **PPKG**](#tab/ppkg) + +[!INCLUDE [provisioning-package-1](../../../includes/configure/provisioning-package-1.md)] + +- **Path:** `AssignedAccess/AssignedAccessSettings` +- **Value:** Enter the account and the application you want to use for Assigned access, using the AUMID of the app. Example: + - `{"Account":"domain\user", "AUMID":"Microsoft.WindowsCalculator_8wekyb3d8bbwe!App"}` + +[!INCLUDE [provisioning-package-2](../../../includes/configure/provisioning-package-2.md)] + +#### [:::image type="icon" source="../images/icons/powershell.svg"::: **PowerShell**](#tab/ps) + +To configure a device using Windows PowerShell: + +1. Sign in as administrator +1. [Create the user account](https://support.microsoft.com/help/4026923/windows-create-a-local-user-or-administrator-account-in-windows-10) for Assigned Access +1. Sign in as the Assigned Access user account +1. Install the required UWP app +1. Sign out as the Assigned Access user account +1. Sign in as administrator and from an elevated PowerShell prompt use one of the following commands: + + ```PowerShell + #Configure Assigned Access by AppUserModelID and user name + Set-AssignedAccess -AppUserModelId -UserName + + #Configure Assigned Access by AppUserModelID and user SID + Set-AssignedAccess -AppUserModelId -UserSID + + #Configure Assigned Access by app name and user name + Set-AssignedAccess -AppName -UserName + + #Configure Assigned Access by app name and user SID**: + Set-AssignedAccess -AppName -UserSID + +> [!NOTE] +> To set up Assigned Access using `-AppName`, the user account that you enter for Assigned Access must have signed in at least once. + +For more information: + +- [Find the Application User Model ID of an installed app](../store/find-aumid.md) +- [Set-AssignedAccess](/powershell/module/assignedaccess/set-assignedaccess) + +To remove assigned access, using PowerShell, run the following cmdlet: + +```powershell +Clear-AssignedAccess +``` + +For advanced customizations that use the XML configuration file, you can use PowerShell scripts via the [MDM Bridge WMI Provider](/windows/win32/dmwmibridgeprov/mdm-bridge-wmi-provider-portal). + +> [!IMPORTANT] +> For all device settings, the WMI Bridge client must be executed as SYSTEM (LocalSystem) account. + +To test the PowerShell script, you can: + +1. [Download the psexec tool](/sysinternals/downloads/psexec) +1. Open an elevated command prompt and run: `psexec.exe -i -s powershell.exe` +1. Run the script in the PowerShell session + +```PowerShell +$shellLauncherConfiguration = @" + +# content of the XML configuration file + +"@ + +$namespaceName="root\cimv2\mdm\dmmap" +$className="MDM_AssignedAccess" +$obj = Get-CimInstance -Namespace $namespaceName -ClassName $className +$obj.ShellLauncher = [System.Net.WebUtility]::HtmlEncode($shellLauncherConfiguration) +$obj = Set-CimInstance -CimInstance $obj -ErrorVariable cimSetError -ErrorAction SilentlyContinue +if($cimSetError) { + Write-Output "An ERROR occurred. Displaying error record and attempting to retrieve error logs...`n" + Write-Error -ErrorRecord $cimSetError[0] + + $timeout = New-TimeSpan -Seconds 30 + $stopwatch = [System.Diagnostics.Stopwatch]::StartNew() + do{ + $events = Get-WinEvent -FilterHashtable $eventLogFilterHashTable -ErrorAction Ignore + } until ($events.Count -or $stopwatch.Elapsed -gt $timeout) # wait for the log to be available + + if($events.Count) { + $events | ForEach-Object { + Write-Output "$($_.TimeCreated) [$($_.LevelDisplayName.ToUpper())] $($_.Message -replace "`n|`r")" + } + } else { + Write-Warning "Timed-out attempting to retrieve event logs..." + } + + Exit 1 +} + +Write-Output "Successfully applied Shell Launcher configuration" +``` + +[!INCLUDE [powershell-wmi-bridge-2](../../../includes/configure/powershell-wmi-bridge-2.md)] + +#### [:::image type="icon" source="../images/icons/settings-app.svg"::: **Settings**](#tab/settings) + +Here are the steps to configure a kiosk using the Settings app: + +1. Open the Settings app to view and configure a device as a kiosk. Go to **Settings > Accounts > Other Users**, or use the following shortcut: + + > [!div class="nextstepaction"] + > + > [Other Users](ms-settings:otherusers) + +1. Under **Set up a kiosk**, select **Get Started** +1. In the **Create an account** dialog, enter the account name, and select **Next** + >[!NOTE] + >If there are any local standard user accounts already, the **Create an account** dialog offers the option to **Choose an existing account** + +1. Choose the application to run when the kiosk account signs in. Only apps that can run above the lock screen are available in the list of apps to choose from. If you select **Microsoft Edge** as the kiosk app, you configure the following options: + + - Whether Microsoft Edge should display your website full-screen (digital sign) or with some browser controls available (public browser) + - Which URL should be open when the kiosk accounts signs in + - When Microsoft Edge should restart after a period of inactivity (if you select to run as a public browser) + +1. Select **Close** + +When the device isn't joined to an Active Directory domain or Microsoft Entra ID, automatic sign-in of the kiosk account is configured automatically: + +- If you want the kiosk account to sign in automatically, and the kiosk app launched when the device restarts, then you don't need to do anything +- If you don't want the kiosk account to sign in automatically when the device restarts, then you must change the default setting before you configure the device as a kiosk. Sign in with the account that you want to use as the kiosk account. Open **Settings** > **Accounts** > **Sign-in options**. Set the **Use my sign-in info to automatically finish setting up my device after an update or restart** setting to **Off**. After you change the setting, you can apply the kiosk configuration to the device + +--- + +> [!TIP] +> For practical examples, see the [Quickstart: Configure a kiosk with Assigned Access](quickstart-kiosk.md). + +## Configure a restricted user experience + +To configure a restricted user experience with Assigned Access, you must create an XML configuration file with the settings for the desired experience. The XML file is applied to the device via the [Assigned Access CSP](/windows/client-management/mdm/assignedaccess-csp#shelllauncher), using one of the following options: + +- A Mobile Device Management (MDM) solution, like Microsoft Intune +- Provisioning packages +- PowerShell, with the MDM Bridge WMI Provider + +To learn how to configure the Assigned Access XML file, see [Create an Assigned Access configuration file](configuration-file.md). + +[!INCLUDE [tab-intro](../../../includes/configure/tab-intro.md)] + +#### [:::image type="icon" source="../images/icons/intune.svg"::: **Intune/CSP**](#tab/intune) + +You can configure devices using a [custom policy][MEM-1] with the [AssignedAccess CSP][WIN-3]. + +- **Setting:** `./Vendor/MSFT/AssignedAccess/ShellLauncher` +- **Value:** content of the XML configuration file + +Assign the policy to a group that contains as members the devices that you want to configure. + +#### [:::image type="icon" source="../images/icons/provisioning-package.svg"::: **PPKG**](#tab/ppkg) + +[!INCLUDE [provisioning-package-1](../../../includes/configure/provisioning-package-1.md)] + +- **Path:** `AssignedAccess/MultiAppAssignedAccessSettings` +- **Value:** content of the XML configuration file + +[!INCLUDE [provisioning-package-2](../../../includes/configure/provisioning-package-2.md)] + +#### [:::image type="icon" source="../images/icons/powershell.svg"::: **PowerShell**](#tab/ps) + +[!INCLUDE [powershell-wmi-bridge-1](../../../includes/configure/powershell-wmi-bridge-1.md)] + +```PowerShell +$assignedAccessConfiguration = @" + +# content of the XML configuration file + +"@ + +$namespaceName="root\cimv2\mdm\dmmap" +$className="MDM_AssignedAccess" +$obj = Get-CimInstance -Namespace $namespaceName -ClassName $className +$obj.Configuration = [System.Net.WebUtility]::HtmlEncode($assignedAccessConfiguration) +$obj = Set-CimInstance -CimInstance $obj -ErrorVariable cimSetError -ErrorAction SilentlyContinue +if($cimSetError) { + Write-Output "An ERROR occurred. Displaying error record and attempting to retrieve error logs...`n" + Write-Error -ErrorRecord $cimSetError[0] + + $timeout = New-TimeSpan -Seconds 30 + $stopwatch = [System.Diagnostics.Stopwatch]::StartNew() + do{ + $events = Get-WinEvent -FilterHashtable $eventLogFilterHashTable -ErrorAction Ignore + } until ($events.Count -or $stopwatch.Elapsed -gt $timeout) # wait for the log to be available + + if($events.Count) { + $events | ForEach-Object { + Write-Output "$($_.TimeCreated) [$($_.LevelDisplayName.ToUpper())] $($_.Message -replace "`n|`r")" + } + } else { + Write-Warning "Timed-out attempting to retrieve event logs..." + } + + Exit 1 +} + +Write-Output "Successfully applied Assigned Access configuration" +``` + +[!INCLUDE [powershell-wmi-bridge-2](../../../includes/configure/powershell-wmi-bridge-2.md)] + +#### [:::image type="icon" source="../images/icons/settings-app.svg"::: **Settings**](#tab/settings) + +This option isn't available using Settings. + +--- + +> [!TIP] +> For practical examples, see the [Quickstart: Configure a restricted user experience with Assigned Access](quickstart-restricted-user-experience.md) + +## User experience + +To validate the kiosk or restricted user experience, sign in with the user account you specified in the configuration file. + +The Assigned Access configuration takes effect the next time the targeted user signs in. If that user account is signed in when you apply the configuration, sign out and sign back in to validate the experience. + +> [!NOTE] +> Starting in Windows 11, a restricted user experience supports the use of multiple monitors. + +### Autotrigger touch keyboard + +The touch keyboard is automatically triggered when there's an input needed and no physical keyboard is attached on touch-enabled devices. You don't need to configure any other setting to enforce this behavior. + +> [!TIP] +> The touch keyboard is triggered only when tapping a textbox. Mouse clicks don't trigger the touch keyboard. If you're testing this feature, use a physical device instead of a virtual machine (VM), as the touch keyboard is not triggered on VMs. + +### Sign out of assigned access + +By default, to exit the kiosk experience, press Ctrl + Alt + Del. The kiosk app exits automatically. If you sign in again as the Assigned Access account, or wait for the sign in screen timeout, the kiosk app relaunches. The default timeout is 30 seconds, but you can change the timeout with the registry key: + +`HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI` + +To change the default time for Assigned Access to resume, add *IdleTimeOut* (DWORD) and enter the value data as milliseconds in hexadecimal. + +> [!NOTE] +> `IdleTimeOut` doesn't apply to the Microsoft Edge kiosk mode. + +The Breakout Sequence of Ctrl + Alt + Del is the default, but this sequence can be configured to be a different sequence of keys. The breakout sequence uses the format **modifiers + keys**. An example breakout sequence is CTRL + ALT + A, where CTRL + ALT are the modifiers, and A is the key value. To learn more, see [Create an Assigned Access configuration XML file](configuration-file.md). + +### Keyboard shortcuts + +The following keyboard shortcuts are blocked for the user accounts with Assigned Access: + +| Keyboard shortcut | Action | +|------------------------------------------------------|-----------------------------------------------------------------------------------------------| +| Ctrl + Shift + Esc | Open Task Manager | +| WIN + , (comma) | Temporarily peek at the desktop | +| WIN + A | Open Action center | +| WIN + Alt + D | Display and hide the date and time on the desktop | +| WIN + Ctrl + F | Find computer objects in Active Directory | +| WIN + D | Display and hide the desktop | +| WIN + E | Open File Explorer | +| WIN + F | Open Feedback Hub | +| WIN + G | Open Game bar when a game is open | +| WIN + I | Open Settings | +| WIN + J | Set focus to a Windows tip when one is available | +| WIN + O | Lock device orientation | +| WIN + Q | Open search | +| WIN + R | Open the Run dialog box | +| WIN + S | Open search | +| WIN + Shift + C | Open Cortana in listening mode | +| WIN + X | Open the Quick Link menu | +| LaunchApp1 | Open the app that is assigned to this key | +| LaunchApp2 | Open the app that is assigned to this key. On many Microsoft keyboards, the app is Calculator | +| LaunchMail | Open the default mail client | + +For information on how to customize keyboard shortcuts, see [Assigned Access recommendations](recommendations.md#keyboard-shortcuts). + +## Remove Assigned Access + +Deleting the restricted user experience removes the policy settings associated with the users, but it can't revert all the configurations. For example, the Start menu configuration is maintained. + +## Next steps + +> [!div class="nextstepaction"] +> Review the recommendations before you deploy Assigned Access: +> +> [Assigned Access recommendations](recommendations.md) + + + +[MEM-1]: /mem/intune/configuration/custom-settings-windows-10 +[WIN-3]: /windows/client-management/mdm/assignedaccess-csp diff --git a/windows/configuration/assigned-access/policy-settings.md b/windows/configuration/assigned-access/policy-settings.md new file mode 100644 index 0000000000..0bf8a93e30 --- /dev/null +++ b/windows/configuration/assigned-access/policy-settings.md @@ -0,0 +1,114 @@ +--- +title: Assigned Access policy settings +description: Learn about the policy settings enforced on a device configured with Assigned Access. +ms.topic: reference +ms.date: 03/04/2024 +--- + +# Assigned Access policy settings + +When the Assigned Access configuration is applied on a device, certain policy settings and AppLocker rules are enforced, impacting the users accessing the device. The policy settings use a combination of configuration service provider (CSP) and group policy (GPO) settings. + +This reference article lists the policy settings and AppLocker rules applied by Assigned Access. + +>[!NOTE] +>It's not recommended to configure policy settings enforced by Assigned Access to different values using other channels. Assigned Access is optimized to provide a locked-down experience. + +## Device policy settings + +The following policy settings are applied at the device level when you deploy a restricted user experience. Any user accessing the device is subject to the policy settings, including administrator accounts: + +| Type | Path | Name/Description | +|---------|----------------------------------------------------------------------------|---------------------------------------------------------------------------| +| **CSP** | `./Vendor/MSFT/Policy/Config/Experience/AllowCortana` | Disable Cortana | +| **CSP** | `./Vendor/MSFT/Policy/Config/Start/AllowPinnedFolderDocuments` | Disable Start documents icon | +| **CSP** | `./Vendor/MSFT/Policy/Config/Start/AllowPinnedFolderDownloads` | Disable Start downloads icon | +| **CSP** | `./Vendor/MSFT/Policy/Config/Start/AllowPinnedFolderFileExplorer` | Disable Start file explorer icon | +| **CSP** | `./Vendor/MSFT/Policy/Config/Start/AllowPinnedFolderHomeGroup` | Disable Start home group icon | +| **CSP** | `./Vendor/MSFT/Policy/Config/Start/AllowPinnedFolderMusic` | Disable Start music icon | +| **CSP** | `./Vendor/MSFT/Policy/Config/Start/AllowPinnedFolderNetwork` | Disable Start network icon | +| **CSP** | `./Vendor/MSFT/Policy/Config/Start/AllowPinnedFolderPersonalFolder` | Disable Start personal folder icon | +| **CSP** | `./Vendor/MSFT/Policy/Config/Start/AllowPinnedFolderPictures` | Disable Start pictures icon | +| **CSP** | `./Vendor/MSFT/Policy/Config/Start/AllowPinnedFolderSettings` | Disable Start settings icon | +| **CSP** | `./Vendor/MSFT/Policy/Config/Start/AllowPinnedFolderVideos` | Disable Start videos icon | +| **CSP** | `./Vendor/MSFT/Policy/Config/Start/HideChangeAccountSettings` | Hide *Change account settings* from appearing in the user tile | +| **CSP** | `./Vendor/MSFT/Policy/Config/Update/SetAutoRestartNotificationDisable` | Hides all update notifications | +| **CSP** | `./Vendor/MSFT/Policy/Config/Update/UpdateNotificationLevel` | Disables auto restart notifications for updates | +| **CSP** | `./Vendor/MSFT/Policy/Config/WindowsInkWorkspace/AllowWindowsInkWorkspace` | Access to ink workspace is disabled | +| **CSP** | `./Vendor/MSFT/Policy/Config/WindowsLogon/DontDisplayNetworkSelectionUI` | Hide networks UI on the logon screen, as well as on "security options" UI | + +## User policy settings + +The following policy settings are applied to any nonadministrator account when you deploy a restricted user experience: + +| Type | Path | Name/Description | +|---------|----------------------------------------------------------------------------------|-------------------------------------------------------------------| +| **CSP** | `./User/Vendor/MSFT/Policy/Config/Start/DisableContextMenus` | Disable Context Menu for Start menu apps | +| **CSP** | `./User/Vendor/MSFT/Policy/Config/Start/HidePeopleBar` | Hide People Bar from appearing on taskbar | +| **CSP** | `./User/Vendor/MSFT/Policy/Config/Start/HideRecentlyAddedApps` | Hide recently added apps from appearing on the Start menu | +| **CSP** | `./User/Vendor/MSFT/Policy/Config/Start/HideRecentJumplists` | Hide recent jumplists from appearing on the Start menu/taskbar | +| **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Clear history of recently opened documents on exit | +| **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Disable showing balloon notifications as toast | +| **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Do not allow pinning items in Jump Lists | +| **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Do not allow pinning programs to the Taskbar | +| **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Do not display or track items in Jump Lists from remote locations | +| **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Hide and disable all items on the desktop | +| **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Hide the Task View button | +| **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Lock all taskbar settings | +| **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Lock the Taskbar | +| **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Prevent users from adding or removing toolbars | +| **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Prevent users from customizing their Start Screen | +| **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Prevent users from moving taskbar to another screen dock location | +| **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Prevent users from rearranging toolbars | +| **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Prevent users from resizing the taskbar | +| **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Prevent users from uninstalling applications from Start | +| **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Remove access to the context menus for the task bar | +| **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Remove All Programs list from the Start menu | +| **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Remove Control Center | +| **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Remove frequent programs list from the Start Menu | +| **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Remove Notification and Action Center | +| **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Remove Quick Settings | +| **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Remove Run menu from Start Menu | +| **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Remove the Security and Maintenance icon | +| **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Turn off all balloon notifications | +| **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Turn off feature advertisement balloon notifications | +| **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar\Notifications | Turn off toast notifications | +| **GPO** | User Configuration\Administrative Templates\System\Ctrl+Alt+Del Options | Remove Change Password | +| **GPO** | User Configuration\Administrative Templates\System\Ctrl+Alt+Del Options | Remove Logoff | +| **GPO** | User Configuration\Administrative Templates\System\Ctrl+Alt+Del Options | Remove Task Manager | +| **GPO** | User Configuration\Administrative Templates\Windows Components\File Explorer | Remove *Map network drive* and *Disconnect Network Drive* | +| **GPO** | User Configuration\Administrative Templates\Windows Components\File Explorer | Remove File Explorer's default context menu | + +The following policy settings are applied to the kiosk account when you configure a kiosk experience with Microsoft Edge: + +| Type | Path | Name/Description | +|---------|-----------------------------------------------------------------------------------|--------------------------------------------------------| +| **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar\Notifications | Run only specified Windows applications > `msedge.exe` | +| **GPO** | User Configuration\Administrative Templates\System | Turn off toast notifications | +| **GPO** | User Configuration\Administrative Templates\Windows Components\Attachment Manager | Default risk level for file attachments > High risk | +| **GPO** | User Configuration\Administrative Templates\Windows Components\Attachment Manager | Inclusion list for low file types > `.pdf;.epub` | +| **GPO** | User Configuration\Administrative Templates\Windows Components\File Explorer | Remove File Explorer's default context menu | + +## AppLocker rules + +When you deploy an Assigned Access restricted user experience, AppLocker rules are generated to allow the apps that are listed in the configuration. Here are the predefined Assigned Access AppLocker rules: + +### Universal Windows Platform (UWP) app rules + +1. The default rule is to allow all users to launch the signed *packaged apps* +1. The packaged app *deny list* is generated at runtime when the Assigned Access user signs in: + 1. Based on the installed apps available for the user account, Assigned Access generates the deny list. The list excludes the default allowed inbox packaged apps, which are critical for the system to function, and then exclude the allowed packages that are defined in the Assigned Access configuration + 1. If there are multiple apps within the same package, all the apps are excluded + +The deny list is used to prevent the user from accessing the apps, which are currently available for the user but not in the allowed list + +> [!NOTE] +> You can't manage AppLocker rules that are generated by the restricted user experience in MMC snap-ins. Avoid creating AppLocker rules that conflict with AppLocker rules generated by Assigned Access. +> +> Assigned access doesn't prevent the organization or users from installing UWP apps. When a new UWP app is installed during an Assigned Access session, the app isn't in the deny list. When the user signs out and signs in again, the installed app is included in the deny list. For apps deployed centrally that you want to allow, like line-of-biness apps, update the Assigned Access configuration and include the apps in the *allow app list*. + +### Desktop app rules + +1. The default rule is to allow all users to launch the desktop programs signed with *Microsoft Certificate* for the system to boot and function. The rule also allows the admin user group to launch all desktop programs. +1. There's a predefined inbox desktop app deny list for the Assigned Access user account, which is updated based on the *desktop app allow list* that you defined in the Assigned Access configuration +1. Enterprise-defined allowed desktop apps are added in the AppLocker allow list diff --git a/windows/configuration/assigned-access/quickstart-kiosk.md b/windows/configuration/assigned-access/quickstart-kiosk.md new file mode 100644 index 0000000000..0dd9ff9fa7 --- /dev/null +++ b/windows/configuration/assigned-access/quickstart-kiosk.md @@ -0,0 +1,104 @@ +--- +title: "Quickstart: configure a kiosk experience with Assigned Access" +description: Learn how to configure a kiosk experience with Assigned Access using the Assigned Access configuration service provider (CSP), Microsoft Intune, PowerShell, or group policy (GPO). +ms.topic: quickstart +ms.date: 03/04/2024 +--- + +# Quickstart: configure a kiosk with Assigned Access + +This quickstart provides practical examples of how to configure a *kiosk experience* on Windows with Assigned Access. The examples describe the steps using the Settings app, a mobile device management solution (MDM) like Microsoft Intune, provisioning packages (PPKG), and PowerShell. While different solutions are used, the configuration settings and results are the same. + +The examples can be modified to fit your specific requirements. For example, you can change the app used, the URL specified when opening Microsoft Edge, or change the name of the user that automatically signs in to Windows. + +## Prerequisites + +>[!div class="checklist"] +>Here's a list of requirements to complete this quickstart: +> +>- A Windows device +>- Microsoft Intune, or a non-Microsoft MDM solution, if you want to configure the settings using MDM +>- Windows Configuration Designer, if you want to configure the settings using a provisioning package +>- Access to the [psexec tool](/sysinternals/downloads/psexec), if you want to test the configuration using Windows PowerShell + +## Configure a kiosk + +[!INCLUDE [tab-intro](../../../includes/configure/tab-intro.md)] + +#### [:::image type="icon" source="../images/icons/intune.svg"::: **Intune/CSP**](#tab/intune) + +> [!TIP] +> Use the following Graph call to automatically create a custom policy in your Microsoft Intune tenant without assignments nor scope tags. +> +> When using this call, authenticate to your tenant in the Graph Explorer window. If it's the first time using Graph Explorer, you may need to authorize the application to access your tenant or to modify the existing permissions. This graph call requires *DeviceManagementConfiguration.ReadWrite.All* permissions. + +[!INCLUDE [quickstart-kiosk-intune](includes/quickstart-kiosk-intune.md)] + +Alternatively, you can configure devices using a [custom policy][MEM-1] with the [AssignedAccess CSP][WIN-3]. + +- **Setting:** `./Vendor/MSFT/AssignedAccess/Configuration` +- **Value:** + +[!INCLUDE [quickstart-kiosk-xml](includes/quickstart-kiosk-xml.md)] + +Assign the policy to a group that contains as members the devices that you want to configure. + +#### [:::image type="icon" source="../images/icons/provisioning-package.svg"::: **PPKG**](#tab/ppkg) + +[!INCLUDE [provisioning-package-1](../../../includes/configure/provisioning-package-1.md)] + +- **Path:** `AssignedAccess/MultiAppAssignedAccessSettings` +- **Value:** + +[!INCLUDE [quickstart-kiosk-xml](includes/quickstart-kiosk-xml.md)] + +[!INCLUDE [provisioning-package-2](../../../includes/configure/provisioning-package-2.md)] + +#### [:::image type="icon" source="../images/icons/powershell.svg"::: **PowerShell**](#tab/ps) + +[!INCLUDE [powershell-wmi-bridge-1](../../../includes/configure/powershell-wmi-bridge-1.md)] + +[!INCLUDE [quickstart-kiosk-ps](includes/quickstart-kiosk-ps.md)] + +[!INCLUDE [powershell-wmi-bridge-2](../../../includes/configure/powershell-wmi-bridge-2.md)] + + + +#### [:::image type="icon" source="../images/icons/settings-app.svg"::: **Settings**](#tab/settings) + +Here are the steps to configure a kiosk using the Settings app: + +1. Open the Settings app to view and configure a device as a kiosk. Go to **Settings > Accounts > Other Users**, or use the following shortcut: + + > [!div class="nextstepaction"] + > + > [Other Users](ms-settings:otherusers) + +1. Under **Set up a kiosk**, select **Get Started** +1. In the **Create an account** dialog, enter the account name, and select **Next** + >[!NOTE] + >If there are any local standard user accounts already, the **Create an account** dialog offers the option to **Choose an existing account** + +1. Choose the application to run when the kiosk account signs in. Only apps that can run above the lock screen are available in the list of apps to choose from. If you select **Microsoft Edge** as the kiosk app, you configure the following options: + + - Whether Microsoft Edge should display your website full-screen (digital sign) or with some browser controls available (public browser) + - Which URL should be open when the kiosk accounts signs in + - When Microsoft Edge should restart after a period of inactivity (if you select to run as a public browser) + +1. Select **Close** + +--- + +## User experience + +After the settings are applied, reboot the device. A local user account is automatically signed in, opening Microsoft Edge. + +## Next steps + +> [!div class="nextstepaction"] +> Learn more about Assigned Access and how to configure it: +> +> [Assigned Access overview](overview.md) + +[WIN-3]: /windows/client-management/mdm/assignedaccess-csp +[MEM-1]: /mem/intune/configuration/custom-settings-windows-10 diff --git a/windows/configuration/assigned-access/quickstart-restricted-user-experience.md b/windows/configuration/assigned-access/quickstart-restricted-user-experience.md new file mode 100644 index 0000000000..de5573c281 --- /dev/null +++ b/windows/configuration/assigned-access/quickstart-restricted-user-experience.md @@ -0,0 +1,93 @@ +--- +title: "Quickstart: configure a restricted user experience with Assigned Access" +description: Learn how to configure a restricted user experience with Assigned Access using the Assigned Access configuration service provider (CSP), Microsoft Intune, PowerShell, or group policy (GPO). +ms.topic: quickstart +ms.date: 03/04/2024 +appliesto: +zone_pivot_groups: windows-versions-11-10 +--- + +# Quickstart: configure a restricted user experience with Assigned Access + +This quickstart provides practical examples of how to configure a *restricted user experience* on Windows. The examples describe the steps using a mobile device management solution (MDM) like Microsoft Intune, provisioning packages (PPKG), and PowerShell. While different solutions are used, the configuration settings and results are the same. + +The examples can be modified to fit your specific requirements. For example, you can add or remove applications from the list of allowed apps, or change the name of the user that automatically signs in to Windows. + +## Prerequisites + +>[!div class="checklist"] +>Here's a list of requirements to complete this quickstart: +> +>- A Windows device +>- Microsoft Intune, or a non-Microsoft MDM solution, if you want to configure the settings using MDM +>- Windows Configuration Designer, if you want to configure the settings using a provisioning package +>- Access to the [psexec tool](/sysinternals/downloads/psexec), if you want to test the configuration using Windows PowerShell + +## Configure a restricted user experience + +[!INCLUDE [tab-intro](../../../includes/configure/tab-intro.md)] + +#### [:::image type="icon" source="../images/icons/intune.svg"::: **Intune/CSP**](#tab/intune) + +> [!TIP] +> Use the following Graph call to automatically create a custom policy in your Microsoft Intune tenant without assignments nor scope tags. +> +> When using this call, authenticate to your tenant in the Graph Explorer window. If it's the first time using Graph Explorer, you may need to authorize the application to access your tenant or to modify the existing permissions. This graph call requires *DeviceManagementConfiguration.ReadWrite.All* permissions. + +[!INCLUDE [quickstart-restricted-experience-intune.md](includes/quickstart-restricted-experience-intune.md)] + +[!INCLUDE [intune-custom-settings-2](../../../includes/configure/intune-custom-settings-2.md)] + +Alternatively, you can configure devices using a [custom policy][MEM-1] with the [AssignedAccess CSP][WIN-3]. + +- **Setting:** `./Vendor/MSFT/AssignedAccess/Configuration` +- **Value:** + +[!INCLUDE [quickstart-restricted-experience-xml.md](includes/quickstart-restricted-experience-xml.md)] + +#### [:::image type="icon" source="../images/icons/provisioning-package.svg"::: **PPKG**](#tab/ppkg) + +[!INCLUDE [provisioning-package-1](../../../includes/configure/provisioning-package-1.md)] + +- **Path:** `AssignedAccess/MultiAppAssignedAccessSettings` +- **Value:** + +[!INCLUDE [quickstart-restricted-experience-xml.md](includes/quickstart-restricted-experience-xml.md)] + +[!INCLUDE [provisioning-package-2](../../../includes/configure/provisioning-package-2.md)] + +#### [:::image type="icon" source="../images/icons/powershell.svg"::: **PowerShell**](#tab/ps) + +[!INCLUDE [powershell-wmi-bridge-1](../../../includes/configure/powershell-wmi-bridge-1.md)] + +[!INCLUDE [quickstart-restricted-experience-ps.md](includes/quickstart-restricted-experience-ps.md)] + +[!INCLUDE [powershell-wmi-bridge-2](../../../includes/configure/powershell-wmi-bridge-2.md)] + +--- + +## User experience + +After the settings are applied, reboot the device. A local user account is automatically signed in, with access to a limited set of applications, which are pinned to the Start menu. + +::: zone pivot="windows-11" +:::image type="content" source="images/restricted-user-experience-windows-11.png" alt-text="Screenshot of the Windows 11 desktop used for the quickstart." border="false"::: + +::: zone-end + +::: zone pivot="windows-10" +:::image type="content" source="images/restricted-user-experience-windows-10.png" alt-text="Screenshot of the Windows 10 desktop used for the quickstart." border="false"::: + +::: zone-end + +## Next steps + +> [!div class="nextstepaction"] +> Learn more about Assigned Access and how to configure it: +> +> [Assigned Access overview](overview.md) + + + +[WIN-3]: /windows/client-management/mdm/assignedaccess-csp +[MEM-1]: /mem/intune/configuration/custom-settings-windows-10 diff --git a/windows/configuration/assigned-access/recommendations.md b/windows/configuration/assigned-access/recommendations.md new file mode 100644 index 0000000000..64b2ce4d5c --- /dev/null +++ b/windows/configuration/assigned-access/recommendations.md @@ -0,0 +1,173 @@ +--- +title: Assigned Access recommendations +description: Learn about the recommended kiosk and restricted user experience configuration options. +ms.topic: best-practice +ms.date: 03/11/2024 +--- + +# Assigned Access recommendations + +This article contains recommendations for devices configured with Assigned Access and Shell Launcher. Most of the recommendations include both group policy (GPO) and configuration service provider (CSP) settings to help you configure your kiosk devices. + +## Kiosk user account + +For kiosks devices located in public-facing environments, configure as a kiosk account a user account with the least privileges, such as a local, standard user account. Using an Active Directory user or Microsoft Entra user might allow an attacker to gain access to domain resources that are accessible to any domain accounts. When using domain accounts with assigned access, proceed with caution. Consider the domain resources potentially exposed by using a domain account. + +### Automatic sign-in + +Consider enabling *automatic sign-in* for your kiosk device. When the device restarts, from an update or power outage, you can configure the device to sign in with the Assigned Access account automatically. Ensure that policy settings applied to the device don't prevent automatic sign in from working as expected. For example, the policy settings [PreferredAadTenantDomainName](/windows/client-management/mdm/policy-csp-authentication#preferredaadtenantdomainname) prevents automatic sign-in from working. + +You can configure the Assigned Access and Shell Launcher XML files with an account to sign-in automatically. For more information, review the articles: + +- [Create an Assigned Access configuration XML file](configuration-file.md) +- [Create a Shell Launcher configuration file](shell-launcher/configuration-file.md) + +Alternatively, you can edit the Registry to have an account sign in automatically: + +| Path | Name | Type | Value | +|--|--|--|--| +| `HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon` | `AutoAdminLogon` | REG_DWORD | 1 | +| `HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon` | `DefaultUserName` | String | Set value as the account that you want signed in. | +| `HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon` | `DefaultPassword` | String | Set value as the password for the account. | +| `HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon` | `DefaultDomainName` | String | Set value for domain, only for domain accounts. For local accounts, don't add this key. | + +Once automatic sign-in is configured, reboot the device. The account will sign in automatically. + +> [!NOTE] +> If you are using [Custom Logon](/windows-hardware/customize/enterprise/custom-logon) with `HideAutoLogonUI` enabled, you might experience a black screen when the user account password expires. Consider [setting the password to never expire](/windows-hardware/customize/enterprise/troubleshooting-custom-logon#the-device-displays-a-black-screen-when-a-password-expiration-screen-is-displayed). + +## Windows Update + +Configure your kiosk devices so that they're always up to date, without disrupting the user experience. Here are some policy settings to consider, to configure Windows Update for your kiosk devices: + +| Type | Path | Name/Description | +|--|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Update/`[ActiveHoursEnd](/windows/client-management/mdm/policy-csp-update#activehoursend) | Integer value that represents the end of active hours. For example, `22` represents 10PM | +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Update/`[ActiveHoursStart](/windows/client-management/mdm/policy-csp-update#activehoursstart) | Integer value that represents the start of active hours. For example, `7` represents 7AM | +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Update/`[AllowAutoUpdate](/windows/client-management/mdm/policy-csp-update#allowautoupdate) | Integer value. Set to `3` - Auto download and schedule the install | +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Update/`[ScheduledInstallTime](/windows/client-management/mdm/policy-csp-update#scheduledinstalltime) | Integer value. Specify the time for the device to install updates. For example, `23` represents 11PM | +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Update/`[UpdateNotificationLevel](/windows/client-management/mdm/policy-csp-update#update-updatenotificationlevel) | Integer value. Set to `2`: turn off all notifications, including restart warnings | +| **GPO** | Computer Configuration\Administrative Templates\Windows Components\Windows Update\Manage end user experience | Display options for update notifications > Set the value to **2 - Turn off all notifications, including restart warnings** | +| **GPO** | Computer Configuration\Administrative Templates\Windows Components\Windows Update\Manage end user experience\Configure Automatic Updates | **4 - Auto download and schedule the install** > specify an install time that is outside the active hours | +| **GPO** | Computer Configuration\Administrative Templates\Windows Components\Windows Update\Manage end user experience\Turn off autorestart for updates during active hours | Configure the start and end active hours, during which the kiosk device can't restart due to Windows Update | + +## Power settings + +You might want to prevent the kiosk device from going to sleep, or prevent users to shut down or restart the kiosk. Here are some options to consider: + +| Type | Path | Name/Description | +|--|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/ADMX_StartMenu/`[HidePowerOptions](/windows/client-management/mdm/policy-csp-admx-startmenu#hidepoweroptions) | String. Set to `` | +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/LocalPoliciesSecurityOptions/`
                        [Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn](/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions#shutdown_allowsystemtobeshutdownwithouthavingtologon) | Integer value. Set to `0` | +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Power/`[DisplayOffTimeoutPluggedIn](/windows/client-management/mdm/policy-csp-power#displayofftimeoutpluggedin) | String. Set to `` | +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Power/`[SelectPowerButtonActionPluggedIn](/windows/client-management/mdm/policy-csp-power#selectpowerbuttonactionpluggedin) | Integer. Set to `0` | +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Power/`[SelectSleepButtonActionPluggedIn](/windows/client-management/mdm/policy-csp-power#SelectSleepButtonActionPluggedIn) | Integer. Set to `0` | +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Power/`[StandbyTimeoutPluggedIn](/windows/client-management/mdm/policy-csp-power#standbytimeoutpluggedin) | String. Set to `` | +| **GPO** | Computer Configuration\Administrative Templates\Start Menu and Taskbar\Remove and prevent access to the Shut Down, Restart, Sleep, and Hibernate commands | **Enable** | +| **GPO** | Computer Configuration\Administrative Templates\System\Power Management\Button Settings\Select the Power button action | Select the action: **Take no action** | +| **GPO** | Computer Configuration\Administrative Templates\System\Power Management\Button Settings\Select the Sleep button action | Select the action: **Take no action** | +| **GPO** | Computer Configuration\Administrative Templates\System\Power Management\Specify the system sleep timeout | Set the value to **0** seconds. | +| **GPO** | Computer Configuration\Administrative Templates\System\Power Management\Video and Display Settings\Turn off the display | Set the value to **0** seconds. | +| **GPO** | Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\Shutdown: Allow system to be shut down without having to log on | **Disabled** | +| **GPO** | Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Shut down the system | Remove the users or groups from this policy. To prevent this policy from affecting a member of the Administrators group, be sure to keep the Administrators group. | + +> [!NOTE] +> You can also disable the power button from the security options screen using a feature called *Custom Logon*. For more information on removing the power button or disabling the physical power button, see [Custom Logon][WHW-1]. + +## Keyboard shortcuts + +The following keyboard shortcuts aren't blocked for any user account that is configured with a restricted user experience: + +- Alt + F4 +- Alt + Tab +- Alt + Shift + Tab +- Ctrl + Alt + Delete + +You can use [Keyboard Filter](/windows-hardware/customize/enterprise/keyboardfilter) to block the key combinations. Keyboard Filter settings apply to other standard accounts. + +### Accessibility shortcuts + +Assigned access doesn't change accessibility settings. Use *Keyboard Filter* to block the following key combinations that open accessibility features: + + | Key combination | Blocked behavior | + | --- | --- | + | Left Alt + Left Shift + Print Screen | Open High Contrast dialog box | + | Left Alt + Left Shift + Num Lock | Open Mouse Keys dialog box | + | WIN + U | Open the Settings app accessibility panel | + +> [!NOTE] +> If Keyboard Filter is turned ON, then some key combinations are blocked automatically without you having to explicitly block them. For more information, see [Keyboard Filter](/windows-hardware/customize/enterprise/keyboardfilter). + +You can also disable the accessibility features and other options on the lock screen with [Custom Logon][WHW-1]. For example, to remove the Accessibility option, use the following registry key: + +| Path | Name | Type | Value | +|--|--|--|--| +| `HKLM\Software\Microsoft\Windows Embedded\EmbeddedLogon\BrandingNeutral` | `BrandingNeutral` | REG_DWORD | 8 | + +### Microsoft Edge shortcuts + +To disable certain [Microsoft Edge default shortcuts](/deployedge/edge-learnmore-configurable-edge-commands), you can use the [ConfigureKeyboardShortcuts](/deployedge/microsoft-edge-policies#configurekeyboardshortcuts) policy. + +## Choose an app for a kiosk experience + +To create a kiosk experience with Assigned Access, you can choose UWP apps or Microsoft Edge. However, some applications might not provide a good user experience when used as a kiosk. + +The following guidelines help you choose an appropriate Windows app for a kiosk experience: + +- Windows apps must be provisioned or installed for the Assigned Access account before they can be selected as the Assigned Access app. [Learn how to provision and install apps](/windows/client-management/mdm/enterprise-app-management#install_your_apps) +- UWP app updates can sometimes change the Application User Model ID (AUMID) of the app. In such scenario, you must update the Assigned Access settings to execute the updated app, because Assigned Access uses the AUMID to determine the app to launch +- The app must be able to run above the lock screen. If the app can't run above the lock screen, it can't be used as a kiosk app +- Some apps can launch other apps. Assigned Access in kiosk mode prevents Windows apps from launching other apps. Avoid selecting Windows apps that are designed to launch other apps as part of their core functionality +- Microsoft Edge includes support for kiosk mode. To learn more, see [Microsoft Edge kiosk mode](/microsoft-edge/deploy/microsoft-edge-kiosk-mode-deploy) +- Don't select Windows apps that might expose information you don't want to show in your kiosk, since kiosk usually means anonymous access and locates in a public setting. For example, an app that has a file picker allows the user to gain access to files and folders on the user's system, avoid selecting these types of apps if they provide unnecessary data access +- Some apps might require more configurations before they can be used appropriately in Assigned Access. For example, Microsoft OneNote requires you to set up a Microsoft account for the Assigned Access user account before OneNote opens +- The kiosk profile is designed for public-facing kiosk devices. Use a local, nonadministrator account. If the device is connected to your organization network, using a domain or Microsoft Entra account could compromise confidential information + +When planning to deploy a kiosk or a restricted user experience, consider the following recommendations: + +- Evaluate all applications that users should use. If applications require user authentication, don't use a local or generic user account. Rather, target the group of users within the Assigned Access configuration file +- A multi-app kiosk is appropriate for devices that are shared by multiple people. When you configure a multi-app kiosk, certain policy settings that affect all nonadministrator users on the device. For a list of these policies, see [Assigned Access policy settings](policy-settings.md) + +### Develop your kiosk app + +Assigned Access uses the *Lock framework*. When an Assigned Access user signs in, the selected kiosk app is launched above the lock screen. The kiosk app is running as an *above lock* screen app. To learn more, see [best practices guidance for developing a kiosk app for assigned access](/windows-hardware/drivers/partnerapps/create-a-kiosk-app-for-assigned-access). + +## Stop errors and recovery options + +When a stop error occurs, Windows displays a blue screen with a stop error code. You can replace the standard screen with a blank screen for OS errors. For more information, see [Configure system failure and recovery options](/troubleshoot/windows-client/performance/configure-system-failure-and-recovery-options). + +## Lock screen notifications + +Consider removing notifications from the lock screen to prevent users from seeing notifications when the device is locked. Here are some options to consider: + +| Type | Path | Name/Description | +|--|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/AboveLock/`[AllowToasts](/windows/client-management/mdm/policy-csp-abovelock#abovelock-allowtoasts)| Integer. Set to `0` | +| **GPO** | Computer Configuration\Administrative Templates\System\Logon\Turn off app notifications on the lock screen | **Enabled**| + +## Troubleshooting and logs + +When testing Assigned Access, it can be useful to enable logging to help you troubleshoot issues. Logs can help you identify configuration and runtime issues. You can enable the following log: **Applications and Services Logs** > **Microsoft** > **Windows** > **AssignedAccess** > **Operational**. + +The following registry keys contain the Assigned Access configurations: + +- `HKLM\Software\Microsoft\Windows\AssignedAccessConfiguration` +- `HKLM\Software\Microsoft\Windows\AssignedAccessCsp` + +The following registry key contains the configuration for each user with an Assigned Access policy: + +- `HKCU\SOFTWARE\Microsoft\Windows\AssignedAccessConfiguration` + +For more information about troubleshooting kiosk issues, see [Troubleshoot kiosk mode issues](/troubleshoot/windows-client/shell-experience/kiosk-mode-issues-troubleshooting). + +## Next steps + +> [!div class="nextstepaction"] +> Learn how to create an XML file to configure Assigned Access: +> +> [Create an Assigned Access configuration file](configuration-file.md) + + + +[WHW-1]: /windows-hardware/customize/enterprise/custom-logon +[WHW-2]: /windows-hardware/customize/enterprise/unified-write-filter diff --git a/windows/configuration/assigned-access/shell-launcher/configuration-file.md b/windows/configuration/assigned-access/shell-launcher/configuration-file.md new file mode 100644 index 0000000000..2dba54c2c4 --- /dev/null +++ b/windows/configuration/assigned-access/shell-launcher/configuration-file.md @@ -0,0 +1,291 @@ +--- +title: Create a Shell Launcher configuration file +description: Learn how to create an XML file to configure a device with Shell Launcher. +ms.date: 02/12/2024 +ms.topic: how-to +--- + +# Create a Shell Launcher configuration file + +To configure Shell Launcher, you must create and apply a configuration XML file to your devices. The configuration file must conform to a *schema*, as defined in [Shell Launcher XML Schema Definition (XSD)](xsd.md). + +This article describes how to configure a Shell Launcher configuration file, including practical examples. + +Let's start by looking at the basic structure of the XML file. A Shell Launcher configuration file contains: + +- One or multiple `profiles`. Each `profile` defines: + - the application that replaces the standard Windows shell (`Explorer.exe`), which is executed when a user signs in + - the default action to take when the application exits, and actions when the application exits with a specific return code +- One or multiple `configs`. Each `config` associates a user account to a `profile` + +> [!NOTE] +> A profile has no effect if it's not associated to a user account. + +Here's a basic example of a Shell Launcher configuration file, with one profile and one config: + +```xml + + + + + + + + + + + + + +``` + +## Versioning + +The Shell Launcher configuration XML is versioned. The version is defined in the XML root element, and it's used to determine which schema to use to validate the XML file. The version is also used to determine which features are available for the configuration. Here's a table of the versions, aliases used in the documentation examples, and namespaces: + +| Version | Alias | Namespace | +|-|-|-| +|Windows 10|`V2`|http://schemas.microsoft.com/ShellLauncher/2019/Configuration| +|Windows 10|default|http://schemas.microsoft.com/ShellLauncher/2018/Configuration| + +To authorize a compatible configuration XML that includes version-specific elements and attributes, always include the namespace of the add-on schemas, and decorate the attributes and elements accordingly with the namespace alias. For example, to configure the kiosk application to execute in full screen, use the below example. Note the alias `V2` associated to `http://schemas.microsoft.com/ShellLauncher/2019/Configuration` namespace, and the alias is tagged on the `AppType` and `AllAppsFullScreen` properties inline. + +```xml + + + + + + + + + + + + + + +``` + +Here you can find the [Shell Launcher XML Schema Definitions (XSDs)](xsd.md). + +## Profiles + +A configuration file can contain one or more profiles. Each profile has a unique identifier `Profile Id` and, optionally, a `Name`. For example: + +```xml + + + + + +``` + +> [!TIP] +> The `Profile Id` must be unique within the XML file. You can generate a GUID with the PowerShell cmdlet `New-Guid`. + +You can define a `Defaultprofile` that is used when no other profile is associated to a user account. This ensures that every user using the device uses the same application. Example: + +```xml + + + + + +``` + +### Shell + +Each profile defines a `Shell` element, which contains details about the application to execute. The `Shell` element has the following properties: + +| Property| Description | Details | +|-|-|-| +|`Shell`| Application that is used as a Windows shell. |- For Universal Windows Platform (UWP) apps, you must provide the App User Model ID (AUMID). Learn how to [Find the Application User Model ID of an installed app](../../store/find-aumid.md).
                        - For desktop apps, specify the full path of the executable, which can contain system environment variables in the form of `%variableName%`. You can also specify any parameters that the app might require. | +|`V2:AppType`| Defines the type of application. |Allowed values are `Desktop` and `UWP`.| +|`V2:AllAppsFullScreen` | Boolean value that defines if all applications are executed in full screen. |- When set to `True`, Shell Launcher runs every app in full screen, or maximized for desktop apps.
                        - When set to `False` or not set, only the custom shell app runs in full screen; other apps launched by the user run in windowed mode.| + +Example: + +```xml + + + + + +``` + +In the next example, the Weather app is executed in full screen. + +```xml + + + + + + + + + + + +``` + +In the next example, Microsoft Edge is executed in full screen, opening a website. The website is reloaded after 2 minutes of inactivity. + +```xml + + + + + +``` + +#### ReturnCodeActions + +Shell Launcher defines four actions to handle app exits. You can customize Shell Launcher and use the actions based on different exit code. Here are the `ReturnCodeActions` enums: + +- `RestartShell` +- `RestartDevice` +- `ShutdownDevice` +- `DoNothing` + +The actions can be used as default action, or mapped to a specific exit code. Refer to [Shell Launcher](/windows-hardware/customize/enterprise/wesl-usersettingsetcustomshell) to learn how to use exit codes with Shell Launcher WMI. + +You can specify at most four custom actions mapping to four exit codes, and one default action for all other exit codes. When an app exits, and if the exit code isn't found in the custom action mapping, or there's no default action defined, nothing happens. For this reason, you should at least define `DefaultAction`. + +Example: + +```xml + + + + + + + + + + + +``` + +## Configs + +Under `Configs`, define one or more user accounts and their association with a profile. + +Individual accounts are specified using ``. + +> [!IMPORTANT] +> Before applying the Shell Launcher configuration, make sure the specified user account is available on the device, otherwise it fails. +> +> For both domain and Microsoft Entra accounts, as long as the device is Active Directory joined or Microsoft Entra joined, the account can be discovered in the domain forest or tenant that the device is joined to. For local accounts, it is required that the account exist before you configure the account for Shell Launcher. + +### Local user + +Local account can be entered as `devicename\user`, `.\user`, or just `user`. + +```xml + + + + +``` + +### Active Directory user + +Domain accounts must be entered using the format `domain\samAccountName`. + +```xml + + + + +``` + +### Microsoft Entra user + +Microsoft Entra accounts must be specified with the format: `AzureAD\{UPN}`. `AzureAD` must be provided *as is*, then follow with the Microsoft Entra user principal name (UPN). + +```xml + + + + +``` + +When the user account signs in, the associated Shell Launcher profile is applied, loading the application specified in the profile. + +### Autologon account + +With ``, Shell Launcher creates and manages a user account to automatically sign in after a device restarts. The account is a local standard user named `Kiosk`. + +Example: + +```xml + + + + + + + + + + + + + + + + + +``` + +## Example + +Here's a complete example of a Shell Launcher configuration file, with two profiles and three configs: + +```xml + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +``` diff --git a/windows/configuration/assigned-access/shell-launcher/includes/quickstart-intune.md b/windows/configuration/assigned-access/shell-launcher/includes/quickstart-intune.md new file mode 100644 index 0000000000..eb3b1a1b04 --- /dev/null +++ b/windows/configuration/assigned-access/shell-launcher/includes/quickstart-intune.md @@ -0,0 +1,13 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 02/05/2024 +ms.topic: include +--- + +```msgraph-interactive +POST https://graph.microsoft.com/beta/deviceManagement/deviceConfigurations +Content-Type: application/json + +{ "id": "00-0000-0000-0000-000000000000", "displayName": "_MSLearn_Example_Kiosk - Shell Launcher", "description": "This is a sample policy created from an article on learn.microsoft.com.", "roleScopeTagIds": [ "0" ], "@odata.type": "#microsoft.graph.windows10CustomConfiguration", "omaSettings": [ { "@odata.type": "#microsoft.graph.omaSettingString", "displayName": "ShellLauncher", "description": null, "omaUri": "./Vendor/MSFT/AssignedAccess/ShellLauncher", "secretReferenceValueId": null, "isEncrypted": true, "value": "\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n" } ], } +``` diff --git a/windows/configuration/assigned-access/shell-launcher/includes/quickstart-ps.md b/windows/configuration/assigned-access/shell-launcher/includes/quickstart-ps.md new file mode 100644 index 0000000000..c783de00f6 --- /dev/null +++ b/windows/configuration/assigned-access/shell-launcher/includes/quickstart-ps.md @@ -0,0 +1,43 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 02/05/2024 +ms.topic: include +--- + +```PowerShell +$shellLauncherConfiguration = @" + + + + + + + + + + + + + + + + + + + + + + + + +"@ + +$namespaceName="root\cimv2\mdm\dmmap" +$className="MDM_AssignedAccess" +$obj = Get-CimInstance -Namespace $namespaceName -ClassName $className +$obj.ShellLauncher = [System.Net.WebUtility]::HtmlEncode($shellLauncherConfiguration) +$obj = Set-CimInstance -CimInstance $obj +``` diff --git a/windows/configuration/assigned-access/shell-launcher/includes/quickstart-xml.md b/windows/configuration/assigned-access/shell-launcher/includes/quickstart-xml.md new file mode 100644 index 0000000000..80e9dd0bb8 --- /dev/null +++ b/windows/configuration/assigned-access/shell-launcher/includes/quickstart-xml.md @@ -0,0 +1,35 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 02/05/2024 +ms.topic: include +--- + +```xml + + + + + + + + + + + + + + + + + + + + + + + + +``` \ No newline at end of file diff --git a/windows/configuration/assigned-access/shell-launcher/index.md b/windows/configuration/assigned-access/shell-launcher/index.md new file mode 100644 index 0000000000..2b0ae488ab --- /dev/null +++ b/windows/configuration/assigned-access/shell-launcher/index.md @@ -0,0 +1,131 @@ +--- +title: What is Shell Launcher? +description: Learn how to configure devices with Shell Launcher. +ms.date: 06/18/2024 +ms.topic: overview +--- + +# What is Shell Launcher? + +Shell Launcher is a Windows feature that you can use to replace the default Windows Explorer shell (`Explorer.exe`) with a Windows desktop application or a Universal Windows Platform (UWP) app. + +Practical examples include: + +- Public browsing +- Interactive digital signage +- ATMs + +Shell Launcher controls which application the user sees as the shell after sign-in. It doesn't prevent the user from accessing other desktop applications and system components. From a custom shell, you can launch secondary views displayed on multiple monitors, or launch other apps in full screen on user's demand. + +With Shell Launcher, you can use features and methods to control access to other applications or system components. These methods include, but aren't limited to: + +- Configuration Service Provider (CSP): you can use a Mobile Device Management (MDM) solution like Microsoft Intune +- Group policy (GPO) +- [AppLocker](/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview) + +Shell Launcher is part of the [Assigned Access](../overview.md) feature, which allows you to configure kiosks or restricted user experiences. To learn about the differences between Shell Launcher and the other options offered by Assigned Access, see [Windows kiosks and restricted user experiences](../index.md). + +[!INCLUDE [shell-launcher](../../../../includes/licensing/shell-launcher.md)] + +## Limitations + +Here are some limitations to consider when using Shell Launcher: + +- Windows doesn't support setting a custom shell before the out-of-box experience (OOBE). If you do, you can't deploy the resulting image +- Shell Launcher doesn't support a custom shell with an application that launches a different process and exits. For example, you can't specify `write.exe` in Shell Launcher. Shell Launcher launches a custom shell and monitors the process to identify when the custom shell exits. `Write.exe` creates a 32-bit `wordpad.exe` process and exits. Since Shell Launcher isn't aware of the newly created `wordpad.exe` process, Shell Launcher takes action based on the exit code of `Write.exe`, such as restarting the custom shell + +## Configure a device with Shell Launcher + +The configuration of Shell Launcher is done using an XML file. The XML file is applied to the device via the [Assigned Access CSP](/windows/client-management/mdm/assignedaccess-csp#shelllauncher), using one of the following options: + +- A Mobile Device Management (MDM) solution, like Microsoft Intune +- Provisioning packages +- The MDM Bridge WMI Provider + +To learn how to configure the Shell Launcher XML file, see [Create a Shell Launcher configuration file](configuration-file.md). + +[!INCLUDE [tab-intro](../../../../includes/configure/tab-intro.md)] + +#### [:::image type="icon" source="../../images/icons/intune.svg"::: **Intune/CSP**](#tab/intune) + +You can configure devices using a [custom policy][MEM-1] with the [AssignedAccess CSP][WIN-3]. + +- **Setting:** `./Vendor/MSFT/AssignedAccess/ShellLauncher` +- **Value:** content of the XML configuration file + +Assign the policy to a group that contains as members the devices that you want to configure. + +#### [:::image type="icon" source="../../images/icons/provisioning-package.svg"::: **PPKG**](#tab/ppkg) + +[!INCLUDE [provisioning-package-1](../../../../includes/configure/provisioning-package-1.md)] + +- **Path:** `SMISettings/ShellLauncher` +- **Value:** depends on specific settings + +[!INCLUDE [provisioning-package-2](../../../../includes/configure/provisioning-package-2.md)] + +#### [:::image type="icon" source="../../images/icons/powershell.svg"::: **PowerShell**](#tab/ps) + +[!INCLUDE [powershell-wmi-bridge-1](../../../../includes/configure/powershell-wmi-bridge-1.md)] + +```PowerShell +$shellLauncherConfiguration = @" + +# content of the XML configuration file + +"@ + +$namespaceName="root\cimv2\mdm\dmmap" +$className="MDM_AssignedAccess" +$obj = Get-CimInstance -Namespace $namespaceName -ClassName $className +$obj.Configuration = [System.Net.WebUtility]::HtmlEncode($shellLauncherConfiguration) +$obj = Set-CimInstance -CimInstance $obj -ErrorVariable cimSetError -ErrorAction SilentlyContinue +if($cimSetError) { + Write-Output "An ERROR occurred. Displaying error record and attempting to retrieve error logs...`n" + Write-Error -ErrorRecord $cimSetError[0] + + $timeout = New-TimeSpan -Seconds 30 + $stopwatch = [System.Diagnostics.Stopwatch]::StartNew() + do{ + $events = Get-WinEvent -FilterHashtable $eventLogFilterHashTable -ErrorAction Ignore + } until ($events.Count -or $stopwatch.Elapsed -gt $timeout) # wait for the log to be available + + if($events.Count) { + $events | ForEach-Object { + Write-Output "$($_.TimeCreated) [$($_.LevelDisplayName.ToUpper())] $($_.Message -replace "`n|`r")" + } + } else { + Write-Warning "Timed-out attempting to retrieve event logs..." + } + + Exit 1 +} + +Write-Output "Successfully applied Shell Launcher configuration" +``` + +[!INCLUDE [powershell-wmi-bridge-2](../../../../includes/configure/powershell-wmi-bridge-2.md)] + +--- + +> [!TIP] +> For practical examples, see the [Quickstart: configure a kiosk experience with Shell Launcher](quickstart-kiosk.md). + +## User experience + +After the settings are applied, the users that are configured to use Shell Launcher will execute the custom shell after sign-in. + +Depending on your configuration, you can have a user to automatically sign in to the device. + +## Next steps + +> [!div class="nextstepaction"] +> Learn how to configure the Shell Launcher XML file: +> +> [Create a Shell Launcher configuration file](configuration-file.md) + + + +[MEM-1]: /mem/intune/configuration/custom-settings-windows-10 +[MEM-2]: /mem/intune/fundamentals/licenses#device-only-licenses +[WIN-3]: /windows/client-management/mdm/assignedaccess-csp diff --git a/windows/configuration/assigned-access/shell-launcher/quickstart-kiosk.md b/windows/configuration/assigned-access/shell-launcher/quickstart-kiosk.md new file mode 100644 index 0000000000..f217d88363 --- /dev/null +++ b/windows/configuration/assigned-access/shell-launcher/quickstart-kiosk.md @@ -0,0 +1,69 @@ +--- +title: "Quickstart: configure a kiosk experience with Shell Launcher" +description: Learn how to configure a kiosk experience with Shell Launcher, using the Assigned Access configuration service provider (CSP), Microsoft Intune, PowerShell, or group policy (GPO). +ms.topic: quickstart +ms.date: 02/05/2024 +--- + +# Quickstart: configure a kiosk experience with Shell Launcher + +This quickstart provides practical examples of how to configure a *kiosk experience* on Windows with Shell Launcher. The examples describe the steps using a mobile device management solution (MDM) like Microsoft Intune, and PowerShell. While different solutions are used, the configuration settings and results are the same. + +The examples can be modified to fit your specific requirements. For example, you can change the app used, the URL specified when opening Microsoft Edge, or change the name of the user that automatically signs in to Windows. + +## Prerequisites + +>[!div class="checklist"] +>Here's a list of requirements to complete this quickstart: +> +>- A Windows Enterprise or Education device +>- Microsoft Intune, or a non-Microsoft MDM solution, if you want to configure the settings using MDM +>- Access to the [psexec tool](/sysinternals/downloads/psexec), if you want to test the configuration using Windows PowerShell + +## Configure a kiosk device + +[!INCLUDE [tab-intro](../../../../includes/configure/tab-intro.md)] + +#### [:::image type="icon" source="../../images/icons/intune.svg"::: **Intune/CSP**](#tab/intune) + +> [!TIP] +> Use the following Graph call to automatically create a custom policy in your Microsoft Intune tenant without assignments nor scope tags. +> +> When using this call, authenticate to your tenant in the Graph Explorer window. If it's the first time using Graph Explorer, you may need to authorize the application to access your tenant or to modify the existing permissions. This graph call requires *DeviceManagementConfiguration.ReadWrite.All* permissions. + +[!INCLUDE [quickstart-intune](includes/quickstart-intune.md)] + +Assign the policy to a group that contains as members the devices that you want to configure. + +Alternatively, you can configure devices using a [custom policy][MEM-1] with the [AssignedAccess CSP][WIN-3]. + +- **Setting:** `./Vendor/MSFT/AssignedAccess/ShellLauncher` +- **Value:** + +[!INCLUDE [quickstart-xml](includes/quickstart-xml.md)] + +#### [:::image type="icon" source="../../images/icons/powershell.svg"::: **PowerShell**](#tab/ps) + +[!INCLUDE [powershell-wmi-bridge-1](../../../../includes/configure/powershell-wmi-bridge-1.md)] + +[!INCLUDE [quickstart-ps](includes/quickstart-ps.md)] + +[!INCLUDE [powershell-wmi-bridge-2](../../../../includes/configure/powershell-wmi-bridge-2.md)] + +--- + +## User experience + +After the settings are applied, reboot the device. A local user account is automatically signed in, opening Microsoft Edge. + +## Next steps + +> [!div class="nextstepaction"] +> Learn more how to create a Shell Launcher configuration file: +> +> [Create a Shell Launcher configuration file](configuration-file.md) + + + +[WIN-3]: /windows/client-management/mdm/assignedaccess-csp +[MEM-1]: /mem/intune/configuration/custom-settings-windows-10 diff --git a/windows/configuration/assigned-access/shell-launcher/toc.yml b/windows/configuration/assigned-access/shell-launcher/toc.yml new file mode 100644 index 0000000000..047a8acdb9 --- /dev/null +++ b/windows/configuration/assigned-access/shell-launcher/toc.yml @@ -0,0 +1,9 @@ +items: +- name: What is Shell Launcher? + href: index.md +- name: "Quickstart: Configure a kiosk with Shell Launcher" + href: quickstart-kiosk.md +- name: Create a Shell Launcher configuration file + href: configuration-file.md +- name: Shell Launcher XSD + href: xsd.md diff --git a/windows/configuration/assigned-access/shell-launcher/xsd.md b/windows/configuration/assigned-access/shell-launcher/xsd.md new file mode 100644 index 0000000000..ef624ae434 --- /dev/null +++ b/windows/configuration/assigned-access/shell-launcher/xsd.md @@ -0,0 +1,193 @@ +--- +title: Shell Launcher XML Schema Definition (XSD) +description: Shell Launcher XSD reference article. +ms.topic: reference +ms.date: 02/15/2024 +--- + +# Shell Launcher XML Schema Definition (XSD) + +This reference article contains the latest Shell Launcher XML schema definition (XSD) and the XSD additions for each version of Windows. + +## Shell Launcher XSD + +Here's the latest Shell Launcher XSD, introduced in Windows 11: + +```xml + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +``` + +## Windows 10, version 1903 additions + +In Windows 10, version 1903, Shell Launcher introduced the support of both UWP and desktop apps as the custom shell. + +Here's the Shell Launcher XSD for the features added in Windows 10, version 1903: + +```xml + + + + + + + + + + + + + + +``` diff --git a/windows/configuration/assigned-access/toc.yml b/windows/configuration/assigned-access/toc.yml new file mode 100644 index 0000000000..a80a14dd6a --- /dev/null +++ b/windows/configuration/assigned-access/toc.yml @@ -0,0 +1,33 @@ +items: +- name: Overview + href: index.md +- name: Assigned Access + items: + - name: What is Assigned Access? + href: overview.md + - name: Quickstarts + items: + - name: Configure a kiosk with Assigned Access + href: quickstart-kiosk.md + - name: Configure a restricted user experience with Assigned Access + href: quickstart-restricted-user-experience.md + - name: Create an Assigned Access configuration file + href: configuration-file.md + - name: Reference + items: + - name: Assigned Access XSD + href: xsd.md + - name: Assigned Access XML examples + href: examples.md + - name: Assigned Access policy settings + href: policy-settings.md +- name: Shell Launcher + href: shell-launcher/toc.yml +- name: Recommendations + href: recommendations.md +- name: Assigned Access CSP 🔗 + href: /windows/client-management/mdm/assignedaccess-csp +- name: Troubleshoot 🔗 + href: /troubleshoot/windows-client/shell-experience/kiosk-mode-issues-troubleshooting +- name: Configure Microsoft Edge kiosk mode 🔗 + href: /deployedge/microsoft-edge-configure-kiosk-mode \ No newline at end of file diff --git a/windows/configuration/assigned-access/xsd.md b/windows/configuration/assigned-access/xsd.md new file mode 100644 index 0000000000..5cd75dccbe --- /dev/null +++ b/windows/configuration/assigned-access/xsd.md @@ -0,0 +1,361 @@ +--- +title: Assigned Access XML Schema Definition (XSD) +description: Assigned Access XSD reference article. +ms.topic: reference +ms.date: 04/08/2024 +--- + +# Assigned Access XML Schema Definition (XSD) + +This reference article contains the latest Assigned Access XML schema definition (XSD) and the XSD additions for each version of Windows. + +## Assigned Access XSD + +Here's the latest Assigned Access XSD, introduced in Windows 11: + +```xml + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +``` + +## Windows 11, version 22H2 additions + +Here's the Assigned Access XSD for the features added in Windows 11: + +```xml + + + + + +``` + +## Windows 11, version 21H2 additions + +Here's the Assigned Access XSD for the features added in Windows 11, version 21H2: + +```xml + + + + + + + + + + + + +``` + +## Windows 10, version 1909 additions + +Here are the Assigned Access XSDs for the features added in Windows 10, version 1909: + +```xml + + + + + + + + + + + + + + + + + + + + + + +``` + +```xml + + + + + + + + + + + + + + + + +``` + +## Windows 10, version 1809 additions + +Here's the Assigned Access XSD for the features added in Windows 10, version 1809: + +```xml + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +``` diff --git a/windows/configuration/images/apn-add-details.PNG b/windows/configuration/cellular/images/apn-add-details.PNG similarity index 100% rename from windows/configuration/images/apn-add-details.PNG rename to windows/configuration/cellular/images/apn-add-details.PNG diff --git a/windows/configuration/images/apn-add.PNG b/windows/configuration/cellular/images/apn-add.PNG similarity index 100% rename from windows/configuration/images/apn-add.PNG rename to windows/configuration/cellular/images/apn-add.PNG diff --git a/windows/configuration/cellular/provisioning-apn.md b/windows/configuration/cellular/provisioning-apn.md new file mode 100644 index 0000000000..8fcf389cf7 --- /dev/null +++ b/windows/configuration/cellular/provisioning-apn.md @@ -0,0 +1,84 @@ +--- +title: Configure cellular settings +description: Learn how to provision cellular settings for devices with built-in modems or plug-in USB modem dongles. +ms.topic: concept-article +ms.date: 04/23/2024 +--- + +# Configure cellular settings + +This article describes how to configure cellular settings for devices that have a cellular modem using a [provisioning package](../provisioning-packages/provisioning-packages.md). After the devices are configured, users are automatically connected using the access point name (APN) defined in the provisioning package, without needing to connect manually. + +For users who work in different locations, you can configure one APN to connect when the users are at work, and a different APN when the users are traveling. + +## Prerequisites + +- Device with built-in cellular modem or plug-in USB modem dongle +- [Windows Configuration Designer](../provisioning-packages/provisioning-install-icd.md) +- APN (the address that the device uses to connect to the Internet when using the cellular data connection) + +## How to configure cellular settings in a provisioning package + +1. In Windows Configuration Designer, [start a new project](../provisioning-packages/provisioning-create-package.md) using the **Advanced provisioning** option +1. Enter a name for your project, and then select **Next** +1. Select **All Windows desktop editions**, select **Next**, and then select **Finish** +1. Go to **Runtime settings > Connections > EnterpriseAPN** +1. Enter a name for the connection, and then select **Add** + +![Example of APN connection name.](images/apn-add.png) + +1. The connection appears in the **Available customizations** pane. Select it to view the settings that you can configure for the connection + +![settings for new connection.](images/apn-add-details.png) + +1. The following table describes the settings available for the connection + + | Setting | Description | + | --- | --- | + | AlwaysOn | By default, the Connection Manager automatically attempts to connect to the APN when a connection is available. You can disable the setting. | + | APNName | Enter the name of the APN. | + | AuthType | You can select **None** (the default), or specify **Auto**, **PAP**, **CHAP**, or **MSCHAPv2** authentication. If you select PAP, CHAP, or MSCHAPv2 authentication, you must also enter a user name and password. | + | ClassId | This is a GUID that defines the APN class to the modem. This is only required when **IsAttachAPN** is **true** and the attached APN isn't only used as the Internet APN. | + | Enabled | By default, the connection is enabled. You can change this setting. | + | IccId | This is the Integrated Circuit Card ID (ICCID) associated with the cellular connection profile. | + | IPType | By default, the connection can use IPv4 and IPv6 concurrently. You can change this setting to only IPv4, only IPv6, or IPv6 with IPv4 provided by 46xlat. | + | IsAttachAPN | Specify whether this APN should be requested as part of an LTE Attach. | + | Password | If you select PAP, CHAP, or MSCHAPv2 authentication, enter a password that corresponds to the user name. | + | Roaming | Select the behavior that you want when the device is roaming. The options are:

                        -Disallowed
                        -Allowed (default)
                        -DomesticRoaming
                        -Use OnlyForDomesticRoaming
                        -UseOnlyForNonDomesticRoaming
                        -UseOnlyForRoaming | + | UserName | If you select PAP, CHAP, or MSCHAPv2 authentication, enter a user name. | + +1. After you configure the connection settings, [build the provisioning package](../provisioning-packages/provisioning-create-package.md#build-package). +1. [Apply the package to devices.](../provisioning-packages/provisioning-apply-package.md) + +## Confirm the settings + +After you apply the provisioning package, you can confirm that the settings are applied. + +1. On the configured device, open a command prompt as an administrator +1. Run the following command: + + ```cmd + netsh mbn show profiles + ``` + +1. The command lists the mobile broadband profiles. Using the **Name** for the listed mobile broadband profile, run: + + ```cmd + netsh mbn show profiles name="name" + ``` + + This command lists the details for that profile, including Access Point Name. + +Alternatively, you can also use the command: + +```cmd +netsh mbn show interface +``` + +From the results of that command, get the name of the cellular/mobile broadband interface and run: + +```cmd +netsh mbn show connection interface="name" +``` + +The result of that command shows the details for the cellular interface, including Access Point Name. diff --git a/windows/configuration/changes-to-start-policies-in-windows-10.md b/windows/configuration/changes-to-start-policies-in-windows-10.md deleted file mode 100644 index c8a911f8a2..0000000000 --- a/windows/configuration/changes-to-start-policies-in-windows-10.md +++ /dev/null @@ -1,91 +0,0 @@ ---- -title: Changes to Group Policy settings for Windows 10 Start menu (Windows 10) -description: Learn about changes to Group Policy settings for the Windows 10 Start menu. Also, learn about the new Windows 10 Start experience. -ms.reviewer: -manager: aaroncz -ms.prod: windows-client -author: lizgt2000 -ms.author: lizlong -ms.topic: whats-new -ms.localizationpriority: medium -ms.date: 08/18/2023 -ms.technology: itpro-configure ---- - -# Changes to Group Policy settings for Windows 10 Start - -**Applies to**: - -- Windows 10 - -Windows 10 has a brand new Start experience. As a result, there are changes to the Group Policy settings that you can use to manage Start. Some policy settings are new or changed, and some old Start policy settings still apply. Other Start policy settings no longer apply and are deprecated. - -## Start policy settings supported for Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education - - -These policy settings are available in **Administrative Templates\\Start Menu and Taskbar** under **User Configuration**. - -|Policy|Notes| -|--- |--- | -|Clear history of recently opened documents on exit|Documents that the user opens are tracked during the session. When the user signs off, the history of opened documents is deleted.| -|Don't allow pinning items in Jump Lists|Jump Lists are lists of recently opened items, such as files, folders, or websites, organized by the program that you use to open them. This policy prevents users from pinning items to any Jump List.| -|Don't display or track items in Jump Lists from remote locations|When this policy is applied, only items local on the computer are shown in Jump Lists.| -|Don't keep history of recently opened documents|Documents that the user opens aren't tracked during the session.| -|Prevent changes to Taskbar and Start Menu Settings|In Windows 10, this policy disables all of the settings in **Settings** > **Personalization** > **Start** and the options in dialog available via right-click Taskbar > **Properties**| -|Prevent users from customizing their Start Screen|Use this policy with a [customized Start layout](windows-10-start-layout-options-and-policies.md) to prevent users from changing it| -|Prevent users from uninstalling applications from Start|In Windows 10, this policy removes the uninstall button in the context menu. It doesn't prevent users from uninstalling the app through other entry points (for example, PowerShell)| -|Remove All Programs list from the Start menu|In Windows 10, this policy removes the **All apps** button.| -|Remove and prevent access to the Shut Down, Restart, Sleep, and Hibernate commands|This policy removes the Shut Down, Restart, Sleep, and Hibernate commands from the Start Menu, Start Menu power button, CTRL+ALT+DEL screen, and Alt+F4 Shut Down Windows menu.| -|Remove common program groups from Start Menu|As in earlier versions of Windows, this policy removes apps specified in the All Users profile from Start| -|Remove frequent programs list from the Start Menu|In Windows 10, this policy removes the top left **Most used** group of apps.| -|Remove Logoff on the Start Menu|**Logoff** has been changed to **Sign Out** in the user interface, however the functionality is the same.| -|Remove pinned programs list from the Start Menu|In Windows 10, this policy removes the bottom left group of apps (by default, only File Explorer and Settings are pinned).| -|Show "Run as different user" command on Start|This policy enables the **Run as different user** option in the right-click menu for apps.| -|Start Layout|This policy applies a specific Start layout, and it also prevents users from changing the layout. This policy can be configured in **User Configuration** or **Computer Configuration**.| -|Force Start to be either full screen size or menu size|This policy applies a specific size for Start.| - -## Deprecated Group Policy settings for Start - -The Start policy settings listed in the following table don't work on Windows 10. Most of them were deprecated in Windows 8 however a few more were deprecated in Windows 10. Deprecation in this case means that the policy setting won't work on Windows 10. The “Supported on” text for a policy setting won't list Windows 10. The policy settings are still in the Group Policy Management Console and can be used on the operating systems that they apply to. - -| Policy | When deprecated | -|----------------------------------------------------------------------------------|-----------------| -| Go to the desktop instead of Start when signing in | Windows 10 | -| List desktop apps first in the Apps view | Windows 10 | -| Pin Apps to Start when installed (User or Computer) | Windows 10 | -| Remove Default Programs link from the Start menu. | Windows 10 | -| Remove Documents icon from Start Menu | Windows 10 | -| Remove programs on Settings menu | Windows 10 | -| Remove Run menu from Start Menu | Windows 10 | -| Remove the "Undock PC" button from the Start Menu | Windows 10 | -| Search just apps from the Apps view | Windows 10 | -| Show Start on the display the user is using when they press the Windows logo key | Windows 10 | -| Show the Apps view automatically when the user goes to Start | Windows 10 | -| Add the Run command to the Start Menu | Windows 8 | -| Change Start Menu power button | Windows 8 | -| Gray unavailable Windows Installer programs Start Menu shortcuts | Windows 8 | -| Remove Downloads link from Start Menu | Windows 8 | -| Remove Favorites menu from Start Menu | Windows 8 | -| Remove Games link from Start Menu | Windows 8 | -| Remove Help menu from Start Menu | Windows 8 | -| Remove Homegroup link from Start Menu | Windows 8 | -| Remove Music icon from Start Menu | Windows 8 | -| Remove Network icon from Start Menu | Windows 8 | -| Remove Pictures icon from Start Menu | Windows 8 | -| Remove Recent Items menu from Start Menu | Windows 8 | -| Remove Recorded TV link from Start Menu | Windows 8 | -| Remove user folder link from Start Menu | Windows 8 | -| Remove Videos link from Start Menu | Windows 8 | - - - -## Related topics - -- [Manage Windows 10 Start and taskbar layout](windows-10-start-layout-options-and-policies.md) -- [Configure Windows 10 taskbar](configure-windows-10-taskbar.md) -- [Customize and export Start layout](customize-and-export-start-layout.md) -- [Add image for secondary tiles](start-secondary-tiles.md) -- [Start layout XML for desktop editions of Windows 10 (reference)](start-layout-xml-desktop.md) -- [Customize Windows 10 Start and taskbar with Group Policy](customize-windows-10-start-screens-by-using-group-policy.md) -- [Customize Windows 10 Start and taskbar with provisioning packages](customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md) -- [Customize Windows 10 Start and taskbar with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md) diff --git a/windows/configuration/configure-windows-10-taskbar.md b/windows/configuration/configure-windows-10-taskbar.md deleted file mode 100644 index 65937f4400..0000000000 --- a/windows/configuration/configure-windows-10-taskbar.md +++ /dev/null @@ -1,330 +0,0 @@ ---- -title: Configure Windows 10 taskbar -description: Administrators can pin more apps to the taskbar and remove default pinned apps from the taskbar by adding a section to a layout modification XML file. -author: lizgt2000 -ms.author: lizlong -ms.topic: how-to -ms.date: 08/18/2023 ---- - -# Configure Windows 10 taskbar - -Starting in Windows 10, version 1607, administrators can pin more apps to the taskbar and remove default pinned apps from the taskbar by adding a `` section to a layout modification XML file. This method never removes user-pinned apps from the taskbar. - -> [!NOTE] -> The only aspect of the taskbar that can currently be configured by the layout modification XML file is the layout. - -You can specify different taskbar configurations based on device locale and region. There's no limit on the number of apps that you can pin. You specify apps using the [Application User Model ID (AUMID)](./find-the-application-user-model-id-of-an-installed-app.md) or Desktop Application Link Path (the local path to the application). - -If you specify an app to be pinned that isn't provisioned for the user on the computer, the pinned icon won't appear on the taskbar. - -The order of apps in the XML file dictates the order of pinned apps on the taskbar from left to right, starting to the right of any existing apps pinned by the user. - -> [!NOTE] -> In operating systems configured to use a right-to-left language, the taskbar order will be reversed. - -The following example shows how apps will be pinned: Windows default apps to the left (blue circle), apps pinned by the user in the center (orange triangle), and apps that you pin using the XML file to the right (green square). - -![Windows left, user center, enterprise to the right.](images/taskbar-generic.png) - - -## Configure taskbar (general) - -**To configure the taskbar:** - -1. Create the XML file. - * If you're also [customizing the Start layout](customize-and-export-start-layout.md), use `Export-StartLayout` to create the XML, and then add the `` section from [the following sample](#sample-taskbar-configuration-added-to-start-layout-xml-file) to the file. - * If you're only configuring the taskbar, use [the following sample](#sample-taskbar-configuration-xml-file) to create a layout modification XML file. -2. Edit and save the XML file. You can use [AUMID](./find-the-application-user-model-id-of-an-installed-app.md) or Desktop Application Link Path to identify the apps to pin to the taskbar. - * Add `xmlns:taskbar="http://schemas.microsoft.com/Start/2014/TaskbarLayout"` to the first line of the file, before the closing \>. - * Use `` and [AUMID](./find-the-application-user-model-id-of-an-installed-app.md) to pin Universal Windows Platform apps. - * Use `` and Desktop Application Link Path to pin desktop applications. -3. Apply the layout modification XML file to devices using [Group Policy](customize-windows-10-start-screens-by-using-group-policy.md) or a [provisioning package created in Windows Imaging and Configuration Designer (Windows ICD)](customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md). - ->[!IMPORTANT] ->If you use a provisioning package or import-startlayout to configure the taskbar, your configuration will be reapplied each time the explorer.exe process restarts. If your configuration pins an app and the user then unpins that app, the user's change will be overwritten the next time the configuration is applied. To apply a taskbar configuration that allows users to make changes that will persist, apply your configuration by using Group Policy. -> ->If you use Group Policy and your configuration only contains a taskbar layout, the default Windows tile layout will be applied and cannot be changed by users. If you use Group Policy and your configuration includes taskbar and a full Start layout, users can only make changes to the taskbar. If you use Group Policy and your configuration includes taskbar and a [partial Start layout](.//customize-and-export-start-layout.md#configure-a-partial-start-layout), users can make changes to the taskbar and to tile groups not defined in the partial Start layout. - -### Tips for finding AUMID and Desktop Application Link Path - -In the layout modification XML file, you'll need to add entries for applications in the XML markup. In order to pin an application, you need either its AUMID or Desktop Application Link Path. - -The easiest way to find this data for an application is to: -1. Pin the application to the Start menu on a reference or testing PC. -2. Open Windows PowerShell and run the `Export-StartLayout` cmdlet. -3. Open the generated XML file. -4. Look for an entry corresponding to the app you pinned. -5. Look for a property labeled `AppUserModelID` or `DesktopApplicationLinkPath`. - - -### Sample taskbar configuration XML file - -```xml - - - - - - - - - - - -``` -### Sample taskbar configuration added to Start layout XML file - -```xml - - - - - - - - - - - - - - - - - - - - - - - -``` - -## Keep default apps and add your own - -The `` section will append listed apps to the taskbar by default. The following sample keeps the default apps pinned and adds pins for Paint, Microsoft Reader, and a command prompt. - -```xml - - - - - - - - - - - - -``` -**Before:** - -![default apps pinned to taskbar.](images/taskbar-default.png) - -**After:** - - ![additional apps pinned to taskbar.](images/taskbar-default-plus.png) - -## Remove default apps and add your own - -By adding `PinListPlacement="Replace"` to ``, you remove all default pinned apps; only the apps that you specify will be pinned to the taskbar. - -If you only want to remove some of the default pinned apps, you would use this method to remove all default pinned apps and then include the default app that you want to keep in your list of pinned apps. - -```xml - - - - - - - - - - - - -``` -**Before:** - -![Taskbar with default apps.](images/taskbar-default.png) - -**After:** - -![Taskbar with default apps removed.](images/taskbar-default-removed.png) - -## Remove default apps - -By adding `PinListPlacement="Replace"` to ``, you remove all default pinned apps. - - -```xml - - - - - - - - - - -``` - -## Configure taskbar by country or region - -The following example shows you how to configure taskbars by country or region. When the layout is applied to a computer, if there's no `` node with a region tag for the current region, the first `` node that has no specified region will be applied. When you specify one or more countries or regions in a `` node, the specified apps are pinned on computers configured for any of the specified countries or regions. - -```xml - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -``` - -When the preceding example XML file is applied, the resulting taskbar for computers in the US or UK: - -![taskbar for US and UK locale.](images/taskbar-region-usuk.png) - -The resulting taskbar for computers in Germany or France: - -![taskbar for DE and FR locale.](images/taskbar-region-defr.png) - -The resulting taskbar for computers in any other country region: - -![taskbar for all other regions.](images/taskbar-region-other.png) - - -> [!NOTE] -> [Look up country and region codes (use the ISO Short column)](/previous-versions/commerce-server/ee799297(v=cs.20)) - - - - -## Layout Modification Template schema definition - -```xml - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -``` - -## Related topics - -[Manage Windows 10 Start and taskbar layout](windows-10-start-layout-options-and-policies.md) - -[Customize and export Start layout](customize-and-export-start-layout.md) - -[Add image for secondary tiles](start-secondary-tiles.md) - -[Start layout XML for desktop editions of Windows 10 (reference)](start-layout-xml-desktop.md) - -[Customize Windows 10 Start and taskbar with Group Policy](customize-windows-10-start-screens-by-using-group-policy.md) - -[Customize Windows 10 Start and taskbar with provisioning packages](customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md) - -[Customize Windows 10 Start and taskbar with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md) - -[Changes to Start policies in Windows 10](changes-to-start-policies-in-windows-10.md) diff --git a/windows/configuration/cortana-at-work/cortana-at-work-feedback.md b/windows/configuration/cortana-at-work/cortana-at-work-feedback.md deleted file mode 100644 index d238ab8539..0000000000 --- a/windows/configuration/cortana-at-work/cortana-at-work-feedback.md +++ /dev/null @@ -1,27 +0,0 @@ ---- -title: Send feedback about Cortana at work back to Microsoft -description: Learn how to send feedback to Microsoft about Cortana at work so you can provide more information to help diagnose reported issues. -ms.prod: windows-client -ms.collection: tier3 -author: aczechowski -ms.localizationpriority: medium -ms.author: aaroncz -ms.date: 10/05/2017 -ms.reviewer: -manager: aaroncz -ms.technology: itpro-configure ---- - -# Send feedback about Cortana back to Microsoft - -[!INCLUDE [Deprecation of Cortana in Windows](./includes/cortana-deprecation.md)] - -To provide feedback on an individual request or response, select the item in the conversation history and then select **Give feedback**. The Feedback Hub application is launched, where you can provide more information to help diagnose reported issues. - -:::image type="content" source="../screenshot1.png" alt-text="Screenshot: Send feedback page"::: - -To provide feedback about the application in general, go to the **Settings** menu by selecting the three dots in the top left of the application, and select **Feedback**. The Feedback Hub is launched, where more information on the issue can be provided. - -:::image type="content" source="../screenshot12.png" alt-text="Screenshot: Select Feedback to go to the Feedback Hub"::: - -In order for enterprise users to provide feedback, admins must unblock the Feedback Hub in the [Azure portal](https://portal.azure.com/). Go to the **Enterprise applications section** and enable **Users can allow apps to access their data**. diff --git a/windows/configuration/cortana-at-work/cortana-at-work-o365.md b/windows/configuration/cortana-at-work/cortana-at-work-o365.md deleted file mode 100644 index 8cc906cd9f..0000000000 --- a/windows/configuration/cortana-at-work/cortana-at-work-o365.md +++ /dev/null @@ -1,60 +0,0 @@ ---- -title: Set up and test Cortana in Windows 10, versions 1909 and earlier, with Microsoft 365 in your organization -description: Learn how to connect Cortana to Office 365 so employees are notified about regular meetings and unusual events. You can even set an alarm for early meetings. -ms.prod: windows-client -ms.collection: tier3 -ms.mktglfcycl: manage -ms.sitesec: library -author: aczechowski -ms.localizationpriority: medium -ms.author: aaroncz -ms.date: 10/05/2017 -ms.reviewer: -manager: aaroncz -ms.technology: itpro-configure ---- - -# Set up and test Cortana in Windows 10, versions 1909 and earlier, with Microsoft 365 in your organization - - -[!INCLUDE [Deprecation of Cortana in Windows](./includes/cortana-deprecation.md)] - -## What can you do with in Windows 10, versions 1909 and earlier? -Your employees can use Cortana to help manage their day and be more productive by getting quick answers to common questions, setting reminders, adding tasks to their To-Do lists, and find out where their next meeting is. - -**See also:** - -[Known issues for Windows Desktop Search and Cortana in Windows 10](/troubleshoot/windows-client/shell-experience/windows-desktop-search-and-cortana-issues). - -### Before you begin -There are a few things to be aware of before you start using Cortana in Windows 10, versions 1909 and earlier. - -- **Microsoft Entra account.** Before your employees can use Cortana in your org, they must be logged in using their Microsoft Entra account through Cortana's notebook. They must also authorize Cortana to access Microsoft 365 on their behalf. - -- **Office 365 Trust Center.** Cortana in Windows 10, version 1909 and earlier, isn't a service governed by the [Online Services Terms](https://www.microsoft.com/en-us/licensing/product-licensing/products). [Learn more about how Cortana in Windows 10, versions 1909 and earlier, treats your data](https://support.microsoft.com/en-us/help/4468233/cortana-and-privacy-microsoft-privacy). - -- Windows Information Protection (WIP). If you want to secure the calendar, email, and contact info provided to Cortana on a device, you can use WIP. For more info about WIP, see [Protect your enterprise data using Windows Information Protection (WIP)](/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip). If you decide to use WIP, you must also have a management solution. This solution can be Microsoft Intune, Configuration Manager (version 1606 or later), or your current company-wide third-party mobile device management (MDM) solution. - -- **Troubleshooting tips.** If you run into issues, check out these [troubleshooting tips](/office365/troubleshoot/miscellaneous/issues-in-cortana). - -### Turn on Cortana enterprise services on employees' devices -Your employees must connect Cortana to their Microsoft 365 account to be able to use skills like email and calendar. - -#### Turn on Cortana enterprise services - -1. Select the **Cortana** search box in the taskbar, and then select the **Notebook** icon. - -2. Select **Manage Skills** , select **Manage accounts** , and under **Microsoft 365** select **Link**. The employee will be directed to sign into their Microsoft 365 account. - -3. The employee can also disconnect by selecting **Microsoft 365**, then **Unlink**. - -#### Turn off Cortana enterprise services -Cortana in Windows 10, versions 1909 and earlier can only access data in your Microsoft 365 organization when it's turned on. If you don't want Cortana to access your corporate data, you can turn it off in the Microsoft 365 admin center. - -1. Sign into the [Microsoft 365 admin center](https://admin.microsoft.com/) using your admin account. - -2. Select the app launcher icon in the upper-left and choose **Admin**. - -3. Expand **Settings** and select **Org Settings**. - -4. Select **Cortana** to toggle Cortana's access to Microsoft 365 data off. diff --git a/windows/configuration/cortana-at-work/cortana-at-work-overview.md b/windows/configuration/cortana-at-work/cortana-at-work-overview.md deleted file mode 100644 index 9bd3833b21..0000000000 --- a/windows/configuration/cortana-at-work/cortana-at-work-overview.md +++ /dev/null @@ -1,99 +0,0 @@ ---- -title: Configure Cortana in Windows 10 and Windows 11 -ms.reviewer: -manager: aaroncz -description: Cortana includes powerful configuration options specifically to optimize for unique small to medium-sized business and for enterprise environments. -ms.prod: windows-client -ms.collection: tier3 -author: aczechowski -ms.localizationpriority: medium -ms.author: aaroncz -ms.technology: itpro-configure -ms.date: 12/31/2017 -ms.topic: article ---- - -# Configure Cortana in Windows 10 and Windows 11 - -[!INCLUDE [Deprecation of Cortana in Windows](./includes/cortana-deprecation.md)] -## Who is Cortana? - -Cortana is a personal productivity assistant in Microsoft 365, helping your users achieve more with less effort and focus on what matters. The Cortana app in Windows 10 and Windows 11 helps users quickly get information across Microsoft 365, using typed or spoken queries to connect with people, check calendars, set reminders, add tasks, and more. - -:::image type="content" source="./images/screenshot1.png" alt-text="Screenshot: Cortana home page example"::: - -## Where is Cortana available for use in my organization? - -Your employees can use Cortana in the languages listed [here](https://support.microsoft.com/help/4026948/cortanas-regions-and-languages). However, most productivity skills are currently only enabled for English (United States), for users with mailboxes in the United States. - -The Cortana app in Windows 10, version 2004 requires the latest Microsoft Store update to support languages other than English (United States). - -## Required hardware and software - -Cortana requires a PC running Windows 10, version 1703 or later, and the following software to successfully run the included scenario in your organization. - ->[!NOTE] ->A microphone isn't required to use Cortana. - -| Software | Minimum version | -|---------|---------| -|Client operating system | - Windows 10, version 2004 (recommended)

                        - Windows 10, version 1703 (legacy version of Cortana)

                        For more information on the differences between Cortana in Windows 10, version 2004 and earlier versions, see [**How is my data processed by Cortana**](#how-is-my-data-processed-by-cortana) below. | -|Microsoft Entra ID | While all employees signing into Cortana need a Microsoft Entra account, a Microsoft Entra ID P1 or P2 tenant isn't required. | -|Additional policies (Group Policy and Mobile Device Management (MDM)) |There's a rich set of policies that can be used to manage various aspects of Cortana. Most of these policies will limit the abilities of Cortana but won't turn off Cortana. For example, if you turn **Speech** off, your employees won't be able to use the wake word ("Cortana") for hands-free activation or voice commands to easily ask for help. | - ->[!NOTE] ->For Windows 11, Cortana is no longer pinned to the taskbar by default. You can still pin the Cortana app to the taskbar as you would any other app. In addition, the keyboard shortcut that launched Cortana (Win+C) no longer opens Cortana. - - - -## Signing in using Microsoft Entra ID - -Your organization must have a Microsoft Entra tenant and your employees' devices must all be Microsoft Entra joined for the best Cortana experience. (Users may also sign into Cortana with a Microsoft account, but won't be able to use their enterprise email or calendar.) For info about what a Microsoft Entra tenant is, how to get your devices joined, and other Microsoft Entra maintenance info, see [Microsoft Entra documentation.](/azure/active-directory/) - -## How is my data processed by Cortana? - -Cortana's approach to integration with Microsoft 365 has changed with Windows 10, version 2004 and later. - -### Cortana in Windows 10, version 2004 and later, or Windows 11 - -Cortana enterprise services that can be accessed using Microsoft Entra ID through Cortana meet the same enterprise-level privacy, security, and compliance promises as reflected in the [Online Services Terms (OST)](https://www.microsoft.com/en-us/licensing/product-licensing/products). To learn more, see [Cortana in Microsoft 365](/microsoft-365/admin/misc/cortana-integration?view=o365-worldwide#what-data-is-processed-by-cortana-in-office-365&preserve-view=true). - -#### How does Microsoft store, retain, process, and use Customer Data in Cortana? - -The table below describes the data handling for Cortana enterprise services. - - -| Name | Description | -|---------|---------| -|**Storage** |Customer Data is stored on Microsoft servers inside the Office 365 cloud. Your data is part of your tenant. Speech audio isn't retained. | -|**Stays in Geo** |Customer Data is stored on Microsoft servers inside the Office 365 cloud in Geo. Your data is part of your tenant. | -|**Retention** |Customer Data is deleted when the account is closed by the tenant administrator or when a GDPR Data Subject Rights deletion request is made. Speech audio isn't retained. | -|**Processing and confidentiality** |Personnel engaged in the processing of Customer Data and personal data (i) will process such data only on instructions from Customer, and (ii) will be obligated to maintain the confidentiality and security of such data even after their engagement ends. | -|**Usage** |Microsoft uses Customer Data only to provide the services agreed upon, and for purposes that are compatible with those services. Machine learning to develop and improve models is one of those purposes. Machine learning is done inside the Office 365 cloud consistent with the Online Services Terms. Your data isn't used to target advertising. | - -#### How does the wake word (Cortana) work? If I enable it, is Cortana always listening? - ->[!NOTE] ->The wake word has been re-enabled in the latest version of Cortana in Windows. If you're on Windows 10, version 2004, be sure that you've updated to build 19041.329 or later to use the wake word with Cortana. For earlier builds, you can still click on the microphone button to use your voice with Cortana. - -Cortana only begins listening for commands or queries when the wake word is detected, or the microphone button has been selected. - -First, the user must enable the wake word from within Cortana settings. Once it has been enabled, a component of Windows called the [Windows Multiple Voice Assistant platform](/windows-hardware/drivers/audio/voice-activation-mva#voice-activation) will start listening for the wake word. No audio is processed by speech recognition unless two local wake word detectors and a server-side one agree with high confidence that the wake word was heard. - -The first decision is made by the Windows Multiple Voice Assistant platform using hardware optionally included in the user's PC for power savings. If the wake word is detected, Windows will show a microphone icon in the system tray indicating an assistant app is listening. - -:::image type="content" source="./images/screenshot2.png" alt-text="Screenshot: Microphone icon in the system tray indicating an assistant app is listening"::: - -At that point, the Cortana app will receive the audio, run a second, more accurate wake word detector, and optionally send it to a Microsoft cloud service where a third wake word detector will confirm. If the service doesn't confirm that the activation was valid, the audio will be discarded and deleted from any further processing or server logs. On the user's PC, the Cortana app will be silently dismissed, and no query will be shown in conversation history because the query was discarded. - -If all three wake word detectors agree, the Cortana canvas will show what speech has been recognized. - -### Cortana in Windows 10, versions 1909 and earlier - -Cortana in Windows 10, versions 1909 and earlier, isn't a service covered by the Office 365 Trust Center. [Learn more about how Cortana in Windows 10, version 1909 and earlier, treats your data](https://go.microsoft.com/fwlink/p/?LinkId=536419). - -Cortana is covered under the [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement) and [Microsoft Services Agreement](https://www.microsoft.com/servicesagreement). - -## See also - -- [What is Cortana?](https://go.microsoft.com/fwlink/p/?LinkId=746818) diff --git a/windows/configuration/cortana-at-work/cortana-at-work-policy-settings.md b/windows/configuration/cortana-at-work/cortana-at-work-policy-settings.md deleted file mode 100644 index e0881606c0..0000000000 --- a/windows/configuration/cortana-at-work/cortana-at-work-policy-settings.md +++ /dev/null @@ -1,88 +0,0 @@ ---- -title: Configure Cortana with Group Policy and MDM settings (Windows) -description: The list of Group Policy and mobile device management (MDM) policy settings that apply to Cortana at work. -ms.prod: windows-client -ms.collection: tier3 -author: aczechowski -ms.localizationpriority: medium -ms.author: aaroncz -ms.reviewer: -manager: aaroncz -ms.technology: itpro-configure -ms.date: 12/31/2017 -ms.topic: article ---- - -# Use Group Policy and mobile device management (MDM) settings to configure Cortana in your organization - -[!INCLUDE [Deprecation of Cortana in Windows](./includes/cortana-deprecation.md)] - -For specific info about how to set, manage, and use each of these MDM policies to configure Cortana in your enterprise, see the [Policy CSP](/windows/client-management/mdm/policy-configuration-service-provider). - -- **Allow Cortana** - - **Group policy**: `Computer Configuration\Administrative Templates\Windows Components\Search\Allow Cortana` - - **MDM policy CSP**: [Experience/AllowCortana](/windows/client-management/mdm/policy-csp-experience#experience-allowcortana) - - **Description**: Specifies if users can use Cortana. - - Cortana won’t work if this setting is turned off (disabled). On Windows 10, version 1809 and below, users can still do local searches, even with Cortana turned off. - -- **AllowCortanaAboveLock** - - **Group policy**: `Computer Configuration\Administrative Templates\Windows Components\Search\AllowCortanaAboveLock` - - **MDM policy CSP**: [AboveLock/AllowCortanaAboveLock](/windows/client-management/mdm/policy-csp-abovelock#abovelock-allowcortanaabovelock) - - **Description**: Specifies whether users can interact with Cortana using voice commands when the system is locked. - - This setting: - - - Doesn't apply to Windows 10, versions 2004 and later - - Doesn't apply to Windows 11 - -- **LetAppsActivateWithVoice** - - **Group policy**: `Computer Configuration\Administrative Templates\Windows Components\App Privacy\LetAppsActivateWithVoice` - - **MDM policy CSP**: [Privacy/LetAppsActivateWithVoice](/windows/client-management/mdm/policy-csp-privacy#privacy-letappsactivatewithvoice) - - **Description**: Specifies if apps, like Cortana or other voice assistants, can activate using a wake word, like “Hey Cortana”. - - This setting applies to: - - - Windows 10 versions 2004 and later - - Windows 11 - - To disable wake word activation on Windows 10 versions 1909 and earlier, disable voice commands using the [Privacy/AllowInputPersonalization CSP](/windows/client-management/mdm/policy-csp-privacy#privacy-allowinputpersonalization). - -- **LetAppsAccessMicrophone** - - **Group policy**: `Computer Configuration\Administrative Templates\Windows Components\App Privacy\LetAppsAccessMicrophone` - - **MDM policy CSP**: [Privacy/LetAppsAccessMicrophone_ForceDenyTheseApps](/windows/client-management/mdm/policy-csp-privacy#privacy-letappsaccessmicrophone-forcedenytheseapps) - - **Description**: Disables Cortana’s access to the microphone. To use this setting, enter Cortana’s Package Family Name: `Microsoft.549981C3F5F10_8wekyb3d8bbwe`. Users can still type queries to Cortana. - -- **Allow users to enable online speech recognition services** - - **Group policy**: `Computer Configuration\Administrative Templates\Control Panel\Regional and Language Options\Allow users to enable online speech recognition services` - - **MDM policy CSP**: [Privacy/AllowInputPersonalization](/windows/client-management/mdm/policy-csp-privacy#privacy-allowinputpersonalization) - - **Description**: Specifies whether users can use voice commands with Cortana in your organization. - - **Windows 10, version 1511**: Cortana won’t work if this setting is turned off (disabled). - - **Windows 10, version 1607 and later**: Non-speech aspects of Cortana will still work if this setting is turned off (disabled). - - **Windows 10, version 2004 and later**: Cortana will work, but voice input will be disabled. - -- **AllowLocation** - - **Group policy**: None - - **MDM policy CSP**: [System/AllowLocation](/windows/client-management/mdm/policy-csp-system#system-allowlocation) - - **Description**: Specifies whether to allow app access to the Location service. - - **Windows 10, version 1511**: Cortana won’t work if this setting is turned off (disabled). - - **Windows 10, version 1607 and later**: Cortana still works if this setting is turned off (disabled). - - **Windows 10, version 2004 and later**: Cortana still works if this setting is turned off (disabled). Cortana in Windows 10, versions 2004 and later, or Windows 11 don't use the Location service. - -- **AllowMicrosoftAccountConnection** - - **Group policy**: None - - **MDM policy CSP**: [Accounts/AllowMicrosoftAccountConnection](/windows/client-management/mdm/policy-csp-accounts#accounts-allowmicrosoftaccountconnection) - - **Description**: Specifies whether to allow users to sign in using a Microsoft account (MSA) from Windows apps. If you only want to allow users to sign in with their Microsoft Entra account, then disable this setting. - -- **Allow search and Cortana to use location** - - **Group policy**: `Computer Configuration\Administrative Templates\Windows Components\Search\Allow search and Cortana to use location` - - **MDM policy CSP**: [Search/AllowSearchToUseLocation](/windows/client-management/mdm/policy-csp-search#search-allowsearchtouselocation) - - **Description**: Specifies whether Cortana can use your current location during searches and for location reminders. In **Windows 10, version 2004 and later**, Cortana still works if this setting is turned off (disabled). Cortana in Windows 10, versions 2004 and later, or Windows 11, don't use the Location service. - -- **Don't search the web or display web results** - - **Group policy**: `Computer Configuration\Administrative Templates\Windows Components\Search\Don't search the web or display web results` - - **MDM policy CSP**: [Search/DoNotUseWebResults](/windows/client-management/mdm/policy-csp-search#search-donotusewebresults) - - **Description**: Specifies if search can do queries on the web, and if the web results are shown in search. - - **Windows 10 Pro edition**: This setting can’t be managed. - - **Windows 10 Enterprise edition**: Cortana won't work if this setting is turned off (disabled). - - **Windows 10, version 2004 and later**: This setting no longer impacts Cortana. diff --git a/windows/configuration/cortana-at-work/cortana-at-work-scenario-1.md b/windows/configuration/cortana-at-work/cortana-at-work-scenario-1.md deleted file mode 100644 index 28baf34fab..0000000000 --- a/windows/configuration/cortana-at-work/cortana-at-work-scenario-1.md +++ /dev/null @@ -1,38 +0,0 @@ ---- -title: Sign into Microsoft Entra ID, enable the wake word, and try a voice query -description: A test scenario walking you through signing in and managing the notebook. -ms.prod: windows-client -ms.collection: tier3 -author: aczechowski -ms.localizationpriority: medium -ms.author: aaroncz -ms.reviewer: -manager: aaroncz -ms.technology: itpro-configure -ms.date: 12/31/2017 -ms.topic: article ---- - -# Test scenario 1 – Sign into Microsoft Entra ID, enable the wake word, and try a voice query - -[!INCLUDE [Deprecation of Cortana in Windows](./includes/cortana-deprecation.md)] - ->[!NOTE] ->The wake word has been re-enabled in the latest version of Cortana in Windows. If you're on Windows 10, version 2004, be sure that you've updated to build 19041.329 or later to use the wake word with Cortana. For earlier builds, you can still click on the microphone button to use your voice with Cortana. - -1. Select the **Cortana** icon in the task bar and sign in using your Microsoft Entra account. - -2. Select the "…" menu and select **Talking to Cortana**. - -3. Toggle **Wake word** to **On** and close Cortana. - -4. Say **Cortana, what can you do?** - - When you say **Cortana**, Cortana will open in listening mode to acknowledge the wake word. - - :::image type="content" source="../screenshot4.png" alt-text="Screenshot: Cortana listening mode"::: - - Once you finish saying your query, Cortana will open with the result. - ->[!NOTE] ->If you've disabled the wake word using MDM or Group Policy, you will need to manually activate the microphone by selecting Cortana, then the mic button. diff --git a/windows/configuration/cortana-at-work/cortana-at-work-scenario-2.md b/windows/configuration/cortana-at-work/cortana-at-work-scenario-2.md deleted file mode 100644 index c107c97a64..0000000000 --- a/windows/configuration/cortana-at-work/cortana-at-work-scenario-2.md +++ /dev/null @@ -1,28 +0,0 @@ ---- -title: Perform a quick search with Cortana at work (Windows) -description: This scenario is a test scenario about how to perform a quick search with Cortana at work. -ms.prod: windows-client -ms.collection: tier3 -author: aczechowski -ms.localizationpriority: medium -ms.author: aaroncz -ms.date: 10/05/2017 -ms.reviewer: -manager: aaroncz -ms.technology: itpro-configure ---- - -# Test scenario 2 – Perform a Bing search with Cortana - -[!INCLUDE [Deprecation of Cortana in Windows](./includes/cortana-deprecation.md)] - -1. Select the **Cortana** icon in the taskbar. - -2. Type **What time is it in Hyderabad?**. - -Cortana will respond with the information from Bing. - -:::image type="content" source="../screenshot5.png" alt-text="Screenshot: Cortana showing current time in Hyderabad"::: - ->[!NOTE] ->This scenario requires Bing Answers to be enabled. To learn more, see [Set up and configure the Bing Answers feature](./set-up-and-test-cortana-in-windows-10.md#set-up-and-configure-the-bing-answers-feature). diff --git a/windows/configuration/cortana-at-work/cortana-at-work-scenario-3.md b/windows/configuration/cortana-at-work/cortana-at-work-scenario-3.md deleted file mode 100644 index 50fb4c4d32..0000000000 --- a/windows/configuration/cortana-at-work/cortana-at-work-scenario-3.md +++ /dev/null @@ -1,27 +0,0 @@ ---- -title: Set a reminder for a location with Cortana at work (Windows) -description: A test scenario about how to set a location-based reminder using Cortana at work. -ms.prod: windows-client -ms.collection: tier3 -author: aczechowski -ms.localizationpriority: medium -ms.author: aaroncz -ms.date: 10/05/2017 -ms.reviewer: -manager: aaroncz -ms.technology: itpro-configure ---- - -# Test scenario 3 - Set a reminder - -[!INCLUDE [Deprecation of Cortana in Windows](./includes/cortana-deprecation.md)] - -This scenario helps you set up, review, and edit a reminder. For example, you can remind yourself to send someone a link to a document after a meeting. - -1. Select the **Cortana** icon in the taskbar and type **Remind me to send a link to the deck at 3:05pm** and press **Enter**. - -Cortana will create a reminder in Microsoft To Do and will remind you at the appropriate time. - -:::image type="content" source="../screenshot6.png" alt-text="Screenshot: Cortana set a reminder"::: - -:::image type="content" source="../screenshot7.png" alt-text="Screenshot: Cortana showing reminder on page"::: diff --git a/windows/configuration/cortana-at-work/cortana-at-work-scenario-4.md b/windows/configuration/cortana-at-work/cortana-at-work-scenario-4.md deleted file mode 100644 index 997bd2f471..0000000000 --- a/windows/configuration/cortana-at-work/cortana-at-work-scenario-4.md +++ /dev/null @@ -1,30 +0,0 @@ ---- -title: Use Cortana at work to find your upcoming meetings (Windows) -description: A test scenario on how to use Cortana at work to find your upcoming meetings. -ms.prod: windows-client -ms.collection: tier3 -author: aczechowski -ms.localizationpriority: medium -ms.author: aaroncz -ms.date: 10/05/2017 -ms.reviewer: -manager: aaroncz -ms.technology: itpro-configure ---- - -# Test scenario 4 - Use Cortana to find free time on your calendar for your upcoming meetings. - - -[!INCLUDE [Deprecation of Cortana in Windows](./includes/cortana-deprecation.md)] - -This scenario helps you find out if a time slot is free on your calendar. - -1. Select the **Cortana** icon in the taskbar. - -2. Click on the **Cortana** icon in the taskbar, and then click in the **Search** bar. - -3. Type **Am I free at 3 PM tomorrow?** - -Cortana will respond with your availability for that time, and nearby meetings. - -:::image type="content" source="../screenshot8.png" alt-text="Screenshot: Cortana showing free time on a calendar"::: diff --git a/windows/configuration/cortana-at-work/cortana-at-work-scenario-5.md b/windows/configuration/cortana-at-work/cortana-at-work-scenario-5.md deleted file mode 100644 index 67d77779e6..0000000000 --- a/windows/configuration/cortana-at-work/cortana-at-work-scenario-5.md +++ /dev/null @@ -1,27 +0,0 @@ ---- -title: Use Cortana to send email to a coworker (Windows) -description: A test scenario about how to use Cortana at work to send email to a coworker. -ms.prod: windows-client -ms.collection: tier3 -author: aczechowski -ms.localizationpriority: medium -ms.author: aaroncz -ms.date: 10/05/2017 -ms.reviewer: -manager: aaroncz -ms.technology: itpro-configure ---- - -# Test scenario 5 - Test scenario 5 – Find out about a person - -[!INCLUDE [Deprecation of Cortana in Windows](./includes/cortana-deprecation.md)] - -Cortana can help you quickly look up information about someone or the org chart. - -1. Select the **Cortana** icon in the taskbar. - -2. Type or select the mic and say, **Who is name of person in your organization's?** - -:::image type="content" source="../screenshot9.png" alt-text="Screenshot: Cortana showing name of person in your organization"::: - -Cortana will respond with information about the person. You can select the person to see more information about them in Microsoft Search. diff --git a/windows/configuration/cortana-at-work/cortana-at-work-scenario-6.md b/windows/configuration/cortana-at-work/cortana-at-work-scenario-6.md deleted file mode 100644 index a940f6be39..0000000000 --- a/windows/configuration/cortana-at-work/cortana-at-work-scenario-6.md +++ /dev/null @@ -1,27 +0,0 @@ ---- -title: Review a reminder suggested by Cortana (Windows) -description: A test scenario on how to use Cortana with the Suggested reminders feature. -ms.prod: windows-client -ms.collection: tier3 -author: aczechowski -ms.localizationpriority: medium -ms.author: aaroncz -ms.date: 10/05/2017 -ms.reviewer: -manager: aaroncz -ms.technology: itpro-configure ---- - -# Test scenario 6 – Change your language and perform a quick search with Cortana - -[!INCLUDE [Deprecation of Cortana in Windows](./includes/cortana-deprecation.md)] - -Cortana can help employees in regions outside the US search for quick answers like currency conversions, time zone conversions, or weather in their location. - -1. Select the **Cortana** icon in the taskbar. - -2. Select the **…** menu, then select **Settings**, **Language**, then select **Español (España)**. You'll be prompted to restart the app. - -3. Once the app has restarted, type or say **Convierte 100 Euros a Dólares**. - -:::image type="content" source="../screenshot10.png" alt-text="Screenshot: Cortana showing a change your language and showing search results in Spanish"::: diff --git a/windows/configuration/cortana-at-work/cortana-at-work-scenario-7.md b/windows/configuration/cortana-at-work/cortana-at-work-scenario-7.md deleted file mode 100644 index 88e5901e0c..0000000000 --- a/windows/configuration/cortana-at-work/cortana-at-work-scenario-7.md +++ /dev/null @@ -1,38 +0,0 @@ ---- -title: Help protect data with Cortana and WIP (Windows) -description: An optional test scenario about how to use Cortana at work with Windows Information Protection (WIP). -ms.prod: windows-client -ms.collection: tier3 -author: aczechowski -ms.localizationpriority: medium -ms.author: aaroncz -ms.date: 10/05/2017 -ms.reviewer: -manager: aaroncz -ms.technology: itpro-configure ---- - -# Test scenario 7 - Use Cortana and Windows Information Protection (WIP) to help protect your organization’s data on a device - -[!INCLUDE [Deprecation of Cortana in Windows](./includes/cortana-deprecation.md)] - ->[!IMPORTANT] ->The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. - -This optional scenario helps you to protect your organization’s data on a device, based on an inspection by Cortana. - -## Use Cortana and WIP to protect your organization’s data - -1. Create and deploy a WIP policy to your organization. For information about how to do this step, see [Protect your enterprise data using Windows Information Protection (WIP)](/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip). - -2. Create a new email from a non-protected or personal mailbox, including the text _I’ll send you that presentation tomorrow_. - -3. Wait up to 2 hours to make sure everything has updated, click the **Cortana** icon in the taskbar, and then click in the **Search** bar. - - Cortana automatically pulls your commitment to sending the presentation out of your email, showing it to you. - -4. Create a new email from a protected mailbox, including the same text as above, _I’ll send you that presentation tomorrow_. - -5. Wait until everything has updated again, click the **Cortana** icon in the taskbar, and then click in the **Search** bar. - - Because it was in an WIP-protected email, the presentation info isn’t pulled out and it isn’t shown to you. diff --git a/windows/configuration/cortana-at-work/cortana-at-work-testing-scenarios.md b/windows/configuration/cortana-at-work/cortana-at-work-testing-scenarios.md deleted file mode 100644 index 9260043d11..0000000000 --- a/windows/configuration/cortana-at-work/cortana-at-work-testing-scenarios.md +++ /dev/null @@ -1,28 +0,0 @@ ---- -title: Cortana at work testing scenarios -description: Suggested testing scenarios that you can use to test Cortana in your organization. -ms.prod: windows-client -ms.collection: tier3 -author: aczechowski -ms.localizationpriority: medium -ms.author: aaroncz -ms.date: 06/28/2021 -ms.reviewer: -manager: aaroncz -ms.technology: itpro-configure ---- - -# Cortana at work testing scenarios - - -[!INCLUDE [Deprecation of Cortana in Windows](./includes/cortana-deprecation.md)] - -We've come up with a list of suggested testing scenarios that you can use to test Cortana in your organization. After you complete all the scenarios, you should be able to: - -- [Sign into Microsoft Entra ID, enable the Cortana wake word, and try a voice query](cortana-at-work-scenario-1.md) -- [Perform a Bing search with Cortana](cortana-at-work-scenario-2.md) -- [Set a reminder](cortana-at-work-scenario-3.md) -- [Use Cortana to find free time on your calendar](cortana-at-work-scenario-4.md) -- [Find out about a person](cortana-at-work-scenario-5.md) -- [Change your language and perform a quick search with Cortana](cortana-at-work-scenario-6.md) -- [Use Windows Information Protection (WIP) to secure content on a device and then try to manage your organization’s entries in the notebook](cortana-at-work-scenario-7.md) diff --git a/windows/configuration/cortana-at-work/cortana-at-work-voice-commands.md b/windows/configuration/cortana-at-work/cortana-at-work-voice-commands.md deleted file mode 100644 index 21f168168d..0000000000 --- a/windows/configuration/cortana-at-work/cortana-at-work-voice-commands.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -title: Set up and test custom voice commands in Cortana for your organization (Windows) -description: How to create voice commands that use Cortana to perform voice-enabled actions in your line-of-business (LOB) Universal Windows Platform (UWP) apps. -ms.prod: windows-client -ms.collection: tier3 -author: aczechowski -ms.localizationpriority: medium -ms.author: aaroncz -ms.date: 10/05/2017 -ms.reviewer: -manager: aaroncz -ms.technology: itpro-configure ---- - -# Set up and test custom voice commands in Cortana for your organization - -[!INCLUDE [Deprecation of Cortana in Windows](./includes/cortana-deprecation.md)] - ->[!NOTE] ->This content applies to Cortana in versions 1909 and earlier, but will not be available in future releases. - -Working with a developer, you can create voice commands that use Cortana to perform voice-enabled actions in your line-of-business (LOB) Universal Windows Platform (UWP) apps. These voice-enabled actions can reduce the time necessary to access your apps and to complete simple actions. - -## High-level process -Cortana uses a Voice Command Definition (VCD) file, aimed at an installed app, to define the actions that are to happen during certain vocal commands. A VCD file can be simple to complex, supporting anything from a single sound to a collection of more flexible, natural language sounds, all with the same intent. - -To enable voice commands in Cortana - -1. **Extend your LOB app.** Add a custom VCD file to your app package. This file defines what capabilities are available to Cortana from the app, letting you tell Cortana what vocal commands should be understood and handled by your app and how the app should start when the command is vocalized. - - Cortana can perform actions on apps in the foreground (taking focus from Cortana) or in the background (allowing Cortana to keep focus). We recommend that you decide where an action should happen, based on what your voice command is intended to do. For example, if your voice command requires employee input, it’s best for that to happen in the foreground. However, if the app only uses basic commands and doesn’t require interaction, it can happen in the background. - - - **Start Cortana with focus on your app, using specific voice-enabled statements.** [Activate a foreground app with voice commands through Cortana](/cortana/voice-commands/launch-a-foreground-app-with-voice-commands-in-cortana). - - - **Start Cortana removing focus from your app, using specific voice-enabled statements.** [Activate a background app in Cortana using voice commands](/cortana/voice-commands/launch-a-background-app-with-voice-commands-in-cortana). - -2. **Install the VCD file on employees' devices**. You can use Configuration Manager or Microsoft Intune to deploy and install the VCD file on your employees' devices, the same way you deploy and install any other package in your organization. - -## Test scenario: Use voice commands in a Microsoft Store app -While these apps aren't line-of-business apps, we've worked to make sure to implement a VCD file, allowing you to test how the functionality works with Cortana in your organization. - -**To get a Microsoft Store app** -1. Go to the Microsoft Store, scroll down to the **Collections** area, select **Show All**, and then select **Better with Cortana**. - -2. Select **Uber**, and then select **Install**. - -3. Open Uber, create an account or sign in, and then close the app. - -**To set up the app with Cortana** -1. Select on the **Cortana** search box in the taskbar, and then select the **Notebook** icon. - -2. Select on **Connected Services**, select **Uber**, and then select **Connect**. - - ![Cortana at work, showing where to connect the Uber service to Cortana.](../images/cortana-connect-uber.png) - -**To use the voice-enabled commands with Cortana** -1. Select on the **Cortana** icon in the taskbar, and then select the **Microphone** icon (to the right of the **Search** box). - -2. Say _Uber get me a taxi_. - - Cortana changes, letting you provide your trip details for Uber. - -## See also -- [Cortana for developers](/cortana/skills/) diff --git a/windows/configuration/cortana-at-work/images/screenshot1.png b/windows/configuration/cortana-at-work/images/screenshot1.png deleted file mode 100644 index ed62740e92..0000000000 Binary files a/windows/configuration/cortana-at-work/images/screenshot1.png and /dev/null differ diff --git a/windows/configuration/cortana-at-work/images/screenshot2.png b/windows/configuration/cortana-at-work/images/screenshot2.png deleted file mode 100644 index fb7995600e..0000000000 Binary files a/windows/configuration/cortana-at-work/images/screenshot2.png and /dev/null differ diff --git a/windows/configuration/cortana-at-work/includes/cortana-deprecation.md b/windows/configuration/cortana-at-work/includes/cortana-deprecation.md deleted file mode 100644 index c5ad2bd22a..0000000000 --- a/windows/configuration/cortana-at-work/includes/cortana-deprecation.md +++ /dev/null @@ -1,14 +0,0 @@ ---- -author: mestew -ms.author: mstewart -manager: aaroncz -ms.technology: itpro-updates -ms.prod: windows-client -ms.topic: include -ms.date: 06/08/2023 -ms.localizationpriority: medium ---- - - -> [!Important] -> Cortana in Windows as a standalone app is [deprecated](/windows/whats-new/deprecated-features). This change only impacts Cortana in Windows, and your productivity assistant, Cortana, will continue to be available in Outlook mobile, Teams mobile, Microsoft Teams display, and Microsoft Teams rooms. diff --git a/windows/configuration/cortana-at-work/set-up-and-test-cortana-in-windows-10.md b/windows/configuration/cortana-at-work/set-up-and-test-cortana-in-windows-10.md deleted file mode 100644 index b9fd7b9023..0000000000 --- a/windows/configuration/cortana-at-work/set-up-and-test-cortana-in-windows-10.md +++ /dev/null @@ -1,52 +0,0 @@ ---- -title: Set up and test Cortana in Windows 10, version 2004 and later -ms.reviewer: -manager: aaroncz -description: Cortana includes powerful configuration options specifically to optimize unique small to medium-sized business and enterprise environments. -ms.prod: windows-client -ms.collection: tier3 -author: aczechowski -ms.localizationpriority: medium -ms.author: aaroncz -ms.technology: itpro-configure -ms.date: 12/31/2017 -ms.topic: article ---- - -# Set up and test Cortana in Windows 10, version 2004 and later - -[!INCLUDE [Deprecation of Cortana in Windows](./includes/cortana-deprecation.md)] -## Before you begin - -- If your enterprise had previously disabled Cortana for your employees using the **Computer Configuration\Administrative Templates\Windows Components\Search\Allow Cortana** Group Policy or the **Experience\AllowCortana** MDM setting but want to enable it now that Cortana is part of Microsoft 365, you'll need to re-enable it at least for Windows 10, version 2004 and later, or Windows 11. -- **Cortana is regularly updated through the Microsoft Store.** Beginning with Windows 10, version 2004, Cortana is an appx preinstalled with Windows and is regularly updated through the Microsoft Store. To receive the latest updates to Cortana, you'll need to [enable updates through the Microsoft Store](../stop-employees-from-using-microsoft-store.md). - -## Set up and configure the Bing Answers feature -Bing Answers provides fast, authoritative results to search queries based on search terms. When the Bing Answers feature is enabled, users will be able to ask Cortana web-related questions in the Cortana in Windows app, such as "What's the current weather?" or "Who is the president of the U.S.?," and get a response, based on public results from Bing.com. - -The above experience is powered by Microsoft Bing, and Cortana sends the user queries to Bing. The use of Microsoft Bing is governed by the [Microsoft Services Agreement](https://www.microsoft.com/servicesagreement) and [Privacy Statement](https://privacy.microsoft.com/en-US/privacystatement). - -## Configure the Bing Answers feature - -Admins can configure the Cortana in Windows Bing Answers feature for their organizations. As the admin, use the following steps to change the setting for Bing Answers at the tenant/security group level. This setting is enabled by default, so that all users who have Cortana enabled will be able to receive Bing Answers. By default, the Bing Answer feature will be available to your users. - -Users can't enable or disable the Bing Answer feature individually. So, if you disable this feature at the tenant/security group level, no users in your organization or specific security group will be able to use Bing Answers in Cortana in Windows. - -Sign in to the [Office Configuration Admin tool](https://config.office.com/). - -Follow the steps [here](/deployoffice/overview-office-cloud-policy-service#steps-for-creating-a-policy-configuration) to create this policy configuration. Once completed, the policy will look as shown below: - -:::image type="content" source="../screenshot3.png" alt-text="Screenshot: Bing policy example"::: - -## How does Microsoft handle customer data for Bing Answers? - -When a user enters a search query (by speech or text), Cortana evaluates if the request is for any of our first-party compliant skills if enabled in a specific market, and does the following actions: - -1. If it is for any of the first-party compliant skills, the query is sent to that skill, and results/action are returned. - -2. If it isn't for any of the first-party compliant skills, the query is sent to Bing for a search of public results from Bing.com. Because enterprise searches might be sensitive, similar to [Microsoft Search in Bing](/MicrosoftSearch/security-for-search#microsoft-search-in-bing-protects-workplace-searches), Bing Answers in Cortana has implemented a set of trust measures, described below, that govern how the separate search of public results from Bing.com is handled. The Bing Answers in Cortana trust measures are consistent with the enhanced privacy and security measures described in [Microsoft Search in Bing](/MicrosoftSearch/security-for-search). All Bing.com search logs that pertain to Cortana traffic are disassociated from users' workplace identity. All Cortana queries issued via a work or school account are stored separately from public, non-Cortana traffic. - -Bing Answers is enabled by default for all users. However, admins can configure and change this setting for specific users and user groups in their organization. - -## How the Bing Answer policy configuration is applied -Before a query is sent to Bing for a search of public results from Bing.com, the Bing Answers service checks with the Office Cloud Policy Service to see if there are any policy configurations that pertain to the user for allowing Bing Answers to respond to questions users ask Cortana. If the user is a member of a Microsoft Entra group that is assigned that policy configuration, then the appropriate policy settings are applied and a check is made again in 10 minutes. diff --git a/windows/configuration/cortana-at-work/test-scenario-1.md b/windows/configuration/cortana-at-work/test-scenario-1.md deleted file mode 100644 index cd72adceb2..0000000000 --- a/windows/configuration/cortana-at-work/test-scenario-1.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: Test scenario 1 – Sign in with your work or school account and use Cortana to manage the notebook -description: A test scenario about how to sign in with your work or school account and use Cortana to manage the notebook. -ms.prod: windows-client -ms.collection: tier3 -author: aczechowski -ms.localizationpriority: medium -ms.author: aaroncz -ms.date: 10/05/2017 -ms.reviewer: -manager: aaroncz -ms.technology: itpro-configure ---- - -# Test scenario 1 – Sign in with your work or school account and use Cortana to manage the notebook - -[!INCLUDE [Deprecation of Cortana in Windows](./includes/cortana-deprecation.md)] - -This scenario turns on Microsoft Entra ID and lets your employee use Cortana to manage an entry in the notebook. - -## Sign in with your work or school account - -This process helps you to sign out of a Microsoft Account and to sign into a Microsoft Entra account. - -1. Click on the **Cortana** icon in the taskbar, then click the profile picture in the navigation to open Cortana settings. - -2. Click your email address. - -A dialog box appears, showing the associated account info. - -3. Click **Sign out** under your email address. - -This signs out the Microsoft account, letting you continue to add your work or school account. - -4. Open Cortana again and select the **Sign in** glyph in the left rail and follow the instructions to sign in with your work or school account. - -## Use Cortana to manage the notebook content - -This process helps you to manage the content Cortana shows in your Notebook. - -1. Select the **Cortana** icon in the taskbar, click **Notebook**, select **Manage Skills.** Scroll down and click **Weather**. - -2. In the **Weather** settings, scroll down to the **Cities you're tracking** area, and then click **Add a city**. - -3. Add **Redmond, Washington**. - -> [!IMPORTANT] -> The data created as part of these scenarios will be uploaded to Microsoft's Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. diff --git a/windows/configuration/cortana-at-work/test-scenario-2.md b/windows/configuration/cortana-at-work/test-scenario-2.md deleted file mode 100644 index f69b1c2789..0000000000 --- a/windows/configuration/cortana-at-work/test-scenario-2.md +++ /dev/null @@ -1,40 +0,0 @@ ---- -title: Test scenario 2 - Perform a quick search with Cortana at work -description: A test scenario about how to perform a quick search with Cortana at work. -ms.prod: windows-client -ms.collection: tier3 -author: aczechowski -ms.localizationpriority: medium -ms.author: aaroncz -ms.date: 10/05/2017 -ms.reviewer: -manager: aaroncz -ms.technology: itpro-configure ---- - -# Test scenario 2 – Perform a quick search with Cortana at work - -[!INCLUDE [Deprecation of Cortana in Windows](./includes/cortana-deprecation.md)] - ->[!Important] ->The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. - -This scenario helps you perform a quick search using Cortana, both by typing and through voice commands. - -## Search using Cortana - -1. Click on the Cortana icon in the taskbar, and then click in the Search bar. - -2. Type **Type Weather in New York**. - -You should see the weather in New York, New York at the top of the search results. -Insert screenshot - -## Search with Cortana, by using voice commands - -This process helps you to use Cortana at work and voice commands to perform a quick search. - -1. Click on the **Cortana** icon in the taskbar, and then click the **Microphone** icon (to the right of the Search box). - -2. Say **What's the weather in Chicago?** Cortana tells you and shows you the current weather in Chicago. -Insert screenshot diff --git a/windows/configuration/cortana-at-work/test-scenario-3.md b/windows/configuration/cortana-at-work/test-scenario-3.md deleted file mode 100644 index b57dded7f3..0000000000 --- a/windows/configuration/cortana-at-work/test-scenario-3.md +++ /dev/null @@ -1,81 +0,0 @@ ---- -title: Test scenario 3 - Set a reminder for a specific location using Cortana at work -description: A test scenario about how to set up, review, and edit a reminder based on a location. -ms.prod: windows-client -ms.collection: tier3 -author: aczechowski -ms.localizationpriority: medium -ms.author: aaroncz -ms.date: 10/05/2017 -ms.reviewer: -manager: aaroncz -ms.technology: itpro-configure ---- - -# Test scenario 3 - Set a reminder for a specific location using Cortana at work - -[!INCLUDE [Deprecation of Cortana in Windows](./includes/cortana-deprecation.md)] - ->[!Important] ->The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. - -This scenario helps you set up, review, and edit a reminder based on a location. For example, reminding yourself to grab your expense report receipts before you leave the house. - ->[!Note] ->You can set each reminder location individually as you create the reminders, or you can go into the About me screen and add both Work and Home addresses as favorites. Make sure that you use real addresses since you’ll need to go to these locations to complete your testing scenario. - -Additionally, if you’ve turned on the Meeting & reminder cards & notifications option (in the Meetings & reminders option of your Notebook), you’ll also see your pending reminders on the Cortana Home page. - -## Create a reminder for a specific location - -This process helps you to create a reminder based on a specific location. - -1. Click on the **Cortana** icon in the taskbar, click on the **Notebook** icon, and then click **Reminders**. - -2. Click the **+** sign, add a subject for your reminder, such as **Remember to file expense report receipts**, and then click **Place**. - -3. Choose **Arrive** from the drop-down box, and then type a location to associate with your reminder. For example, you can use the physical address of where you work. Just make sure you can physically get to your location, so you can test the reminder. - -4. Click **Done**. - ->[!Note] ->If you’ve never used this location before, you’ll be asked to add a name for it so it can be added to the Favorites list in Windows Maps. - -5. Choose to be reminded the Next time you arrive at the location or on a specific day of the week from the drop-down box. - -6. Take a picture of your receipts and store them locally on your device. - -7. Click **Add Photo**, click **Library**, browse to your picture, and then click **OK**. - -The photo is stored with the reminder. - -Insert screenshot 6 - -8. Review the reminder info, and then click **Remind**. - -The reminder is saved and ready to be triggered. -Insert screenshot - -## Create a reminder for a specific location by using voice commands - -This process helps you to use Cortana at work and voice commands to create a reminder for a specific location. - -1. Click on the **Cortana** icon in the taskbar, and then click the **Microphone* icon (to the right of the Search box). - -2. Say **Remind me to grab my expense report receipts before I leave home**. - -Cortana opens a new reminder task and asks if it sounds good. -insert screenshot - -3. Say **Yes** so Cortana can save the reminder. -insert screenshot - -## Edit or archive an existing reminder - -This process helps you to edit or archive and existing or completed reminder. - -1. Click on the **Cortana** icon in the taskbar, click on the **Notebook** icon, and then click **Reminders**. - -2. Click the pending reminder you want to edit. - -3. Change any text that you want to change, click **Add photo** if you want to add or replace an image, click **Delete** if you want to delete the entire reminder, click Save to save your changes, and click **Complete and move to History** if you want to save a completed reminder in your **Reminder History**. diff --git a/windows/configuration/cortana-at-work/test-scenario-4.md b/windows/configuration/cortana-at-work/test-scenario-4.md deleted file mode 100644 index 206010600b..0000000000 --- a/windows/configuration/cortana-at-work/test-scenario-4.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: Use Cortana to find your upcoming meetings at work (Windows) -description: A test scenario about how to use Cortana at work to find your upcoming meetings. -ms.prod: windows-client -ms.collection: tier3 -author: aczechowski -ms.localizationpriority: medium -ms.author: aaroncz -ms.date: 10/05/2017 -ms.reviewer: -manager: aaroncz -ms.technology: itpro-configure ---- - -# Test scenario 4 - Use Cortana to find your upcoming meetings at work - -[!INCLUDE [Deprecation of Cortana in Windows](./includes/cortana-deprecation.md)] - ->[!Important] ->The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. - -This scenario helps you search for both general upcoming meetings, and specific meetings, both manually and verbally. - ->[!Note] ->If you’ve turned on the Meeting & reminder cards & notifications option (in the Meetings & reminders option of your Notebook), you’ll also see your pending reminders on the Cortana Home page. - -## Find out about upcoming meetings - -This process helps you find your upcoming meetings. - -1. Check to make sure your work calendar is connected and synchronized with your Microsoft Entra account. - -2. Click on the **Cortana** icon in the taskbar, and then click in the **Search** bar. - -3. Type **Show me my meetings for tomorrow**. - -You’ll see all your meetings scheduled for the next day. - -Cortana at work, showing all upcoming meetings -screenshot - -## Find out about upcoming meetings by using voice commands - -This process helps you to use Cortana at work and voice commands to find your upcoming meetings. - -1. Click on the **Cortana** icon in the taskbar, and then click the **Microphone** icon (to the right of the Search box. - -2. Say **Show me what meeting I have at 3pm tomorrow**. - ->[!Important] ->Make sure that you have a meeting scheduled for the time you specify here. - -Cortana at work, showing the meeting scheduled for 3pm -screenshot diff --git a/windows/configuration/cortana-at-work/test-scenario-5.md b/windows/configuration/cortana-at-work/test-scenario-5.md deleted file mode 100644 index f8dfb7cf8e..0000000000 --- a/windows/configuration/cortana-at-work/test-scenario-5.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -title: Use Cortana to send an email to co-worker (Windows) -description: A test scenario on how to use Cortana at work to send email to a co-worker. -ms.prod: windows-client -ms.collection: tier3 -author: aczechowski -ms.localizationpriority: medium -ms.author: aaroncz -ms.date: 10/05/2017 -ms.reviewer: -manager: aaroncz -ms.technology: itpro-configure ---- - -# Test scenario 5 - Use Cortana to send an email to co-worker - -[!INCLUDE [Deprecation of Cortana in Windows](./includes/cortana-deprecation.md)] - ->[!Important] ->The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. - -This scenario helps you to send an email to a co-worker listed in your work address book, both manually and verbally. - -## Send email to a co-worker - -This process helps you to send a quick message to a co-worker from the work address book. - -1. Check to make sure your Microsoft Outlook or mail app is connected and synchronized with your Microsoft Entra account. - -2. Click on the **Cortana** icon in the taskbar, and then click in the **Search** bar. - -3. Type **Send an email to **. - -Where is the name of someone in your work address book. - -4. Type your email message subject into the **Quick message** (255 characters or less) box and your message into the **Message** (unlimited characters) box, and then click **Send**. - -Cortana at work, showing the email text -screenshot - -## Send an email to a co-worker by using voice commands - -This process helps you to use Cortana at work and voice commands to send a quick message to a co-worker from the work address book. - -1. Click on the **Cortana** icon in the taskbar, and then click the **Microphone** icon (to the right of the Search box. - -2. Say **Send an email** to . - -Where is the name of someone in your work address book. - -3. Add your email message by saying, **Hello this is a test email using Cortana at work**. - -The message is added and you’re asked if you want to **Send it**, **Add more**, or **Make changes**. - -Cortana at work, showing the email text created from verbal commands -screenshot - -4. Say **Send it**. - -The email is sent. - -Cortana at work, showing the sent email text -screenshot diff --git a/windows/configuration/cortana-at-work/test-scenario-6.md b/windows/configuration/cortana-at-work/test-scenario-6.md deleted file mode 100644 index 8915d4300d..0000000000 --- a/windows/configuration/cortana-at-work/test-scenario-6.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: Test scenario 6 - Review a reminder suggested by Cortana based on what you’ve promised in email -description: A test scenario about how to use Cortana with the Suggested reminders feature. -ms.prod: windows-client -ms.collection: tier3 -author: aczechowski -ms.localizationpriority: medium -ms.author: aaroncz -ms.date: 10/05/2017 -ms.reviewer: -manager: aaroncz -ms.technology: itpro-configure ---- - -# Test scenario 6 - Review a reminder suggested by Cortana based on what you’ve promised in email - -[!INCLUDE [Deprecation of Cortana in Windows](./includes/cortana-deprecation.md)] - ->[!Important] ->The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. For more info, see the [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement) and the [Microsoft Services Agreement](https://www.microsoft.com/servicesagreement). - -Cortana automatically finds patterns in your email, suggesting reminders based things that you said you would do so you don’t forget about them. For example, Cortana recognizes that if you include the text, I’ll get something to you by the end of the week in an email, you're making a commitment to provide something by a specific date. Cortana can now suggest that you be reminded about this event, letting you decide whether to keep it or to cancel it. - ->[!Important] ->The Suggested reminders feature is currently only available in English (en-us). - -## Use Cortana to create suggested reminders for you - -1. Make sure that you've connected Cortana to Office 365. For the steps to connect, see [Set up and test Cortana with Office 365 in your organization](./cortana-at-work-o365.md). - -2. Click on the **Cortana** search box in the taskbar, click the **Notebook** icon, and then click **Permissions**. - -3. Make sure the **Contacts**, **email**, **calendar**, and **communication history** option is turned on. - -Permissions options for Cortana at work -screenshot - -4. Click the **Notebook** icon again, click the **Suggested reminders** option, click to turn on the **All reminder suggestions cards** option, click the **Notify me when something I mentioned doing is coming up** box, and then click **Save**. - -Suggested reminders options for Cortana at work -screenshot - -5. Create and send an email to yourself (so you can see the Suggested reminder), including the text, **I’ll finish this project by end of day today**. - -6. After you get the email, click on the Cortana **Home** icon, and scroll to today’s events. - -If the reminder has a specific date or time associated with it, like end of day, Cortana notifies you at the appropriate time and puts the reminder into the Action Center. Also from the Home screen, you can view the email where you made the promise, set aside time on your calendar, officially set the reminder, or mark the reminder as completed. - -Cortana Home screen with your suggested reminder showing -screenshot diff --git a/windows/configuration/cortana-at-work/testing-scenarios-using-cortana-in-business-org.md b/windows/configuration/cortana-at-work/testing-scenarios-using-cortana-in-business-org.md deleted file mode 100644 index a7ad523655..0000000000 --- a/windows/configuration/cortana-at-work/testing-scenarios-using-cortana-in-business-org.md +++ /dev/null @@ -1,27 +0,0 @@ ---- -title: Testing scenarios using Cortana in your business or organization -description: A list of suggested testing scenarios that you can use to test Cortana in your organization. -ms.prod: windows-client -ms.collection: tier3 -author: aczechowski -ms.localizationpriority: medium -ms.author: aaroncz -ms.date: 10/05/2017 -ms.reviewer: -manager: aaroncz -ms.technology: itpro-configure ---- - -# Testing scenarios using Cortana in your business or organization - -[!INCLUDE [Deprecation of Cortana in Windows](./includes/cortana-deprecation.md)] - -We've come up with a list of suggested testing scenarios that you can use to test Cortana in your organization. After you complete all the scenarios, you should be able to: - -- [Sign in with your work or school account and use Cortana to manage the notebook](./cortana-at-work-scenario-1.md) -- [Perform a quick search with Cortana at work](./cortana-at-work-scenario-2.md) -- [Set a reminder for a specific location using Cortana at work](./cortana-at-work-scenario-3.md) -- [Use Cortana at work to find your upcoming meetings](./cortana-at-work-scenario-4.md) -- [Use Cortana to send email to a co-worker](./cortana-at-work-scenario-5.md) -- [Review a reminder suggested by Cortana based on what you've promised in email](./cortana-at-work-scenario-6.md) -- [Use Cortana and Windows Information Protection (WIP) to help protect your organization's data on a device](./cortana-at-work-scenario-7.md) diff --git a/windows/configuration/customize-and-export-start-layout.md b/windows/configuration/customize-and-export-start-layout.md deleted file mode 100644 index 2173e2ee20..0000000000 --- a/windows/configuration/customize-and-export-start-layout.md +++ /dev/null @@ -1,184 +0,0 @@ ---- -title: Customize and export Start layout -description: The easiest method for creating a customized Start layout is to set up the Start screen and export the layout. -ms.reviewer: -manager: aaroncz -ms.prod: windows-client -author: lizgt2000 -ms.author: lizlong -ms.topic: how-to -ms.localizationpriority: medium -ms.date: 08/18/2023 -ms.collection: - - tier1 -ms.technology: itpro-configure ---- - -# Customize and export Start layout - -**Applies to**: - -- Windows 10 - ->**Looking for consumer information?** See [Customize the Start menu](https://go.microsoft.com/fwlink/p/?LinkId=623630) - -The easiest method for creating a customized Start layout to apply to other Windows 10 devices is to set up the Start screen on a test computer and then export the layout. - -After you export the layout, decide whether you want to apply a *full* Start layout or a *partial* Start layout. - -When a full Start layout is applied, the users can't pin, unpin, or uninstall apps from Start. Users can view and open all apps in the **All Apps** view, but they can't pin any apps to Start. - -When [a partial Start layout](#configure-a-partial-start-layout) is applied, the contents of the specified tile groups can't be changed, but users can move those groups, and can also create and customize their own groups. - -> [!NOTE] -> Partial Start layout is only supported on Windows 10, version 1511 and later. - -You can deploy the resulting .xml file to devices using one of the following methods: - -- [Group Policy](customize-windows-10-start-screens-by-using-group-policy.md) - -- [Windows Configuration Designer provisioning package](customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md) - -- [Mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md) - -### Customize the Start screen on your test computer - -To prepare a Start layout for export, you simply customize the Start layout on a test computer. - -**To prepare a test computer** - -1. Set up a test computer on which to customize the Start layout. Your test computer should have the operating system that is installed on the users' computers (Windows 10 Pro, Enterprise, or Education). Install all apps and services that the Start layout should display. - -1. Create a new user account that you'll use to customize the Start layout. - -**To customize Start** - -1. Sign in to your test computer with the user account that you created. - -1. Customize the Start layout as you want users to see it by using the following techniques: - - - **Pin apps to Start**. From Start, type the name of the app. When the app appears in the search results, right-click the app, and then select **Pin to Start**. - - To view all apps, select **All apps** in the bottom-left corner of Start. Right-click any app, and pin or unpin it from Start. - - - **Unpin apps** that you don't want to display. To unpin an app, right-click the app, and then select **Unpin from Start**. - - - **Drag tiles** on Start to reorder or group apps. - - - **Resize tiles**. To resize tiles, right-click the tile and then select **Resize.** - - - **Create your own app groups**. Drag the apps to an empty area. To name a group, select above the group of tiles and then type the name in the **Name group** field that appears above the group. - -> [!IMPORTANT] -> In Windows 10, version 1703, if the Start layout includes tiles for apps that are not installed on the device that the layout is later applied to, the tiles for those apps will be blank. The blank tiles will persist until the next time the user signs in, at which time the blank tiles are removed. Some system events may cause the blank tiles to be removed before the next sign-in. -> -> In earlier versions of Windows 10, no tile would be pinned. - -### Export the Start layout - -When you have the Start layout that you want your users to see, use the [Export-StartLayout](/powershell/module/startlayout/export-startlayout) cmdlet in Windows PowerShell to export the Start layout to an .xml file. Start layout is located by default at C:\Users\username\AppData\Local\Microsoft\Windows\Shell\ - -> [!IMPORTANT] -> If you include secondary Microsoft Edge tiles (tiles that link to specific websites in Microsoft Edge), see [Add custom images to Microsoft Edge secondary tiles](start-secondary-tiles.md) for instructions. - -**To export the Start layout to an .xml file** - -1. While signed in with the same account that you used to customize Start, right-click Start, and select **Windows PowerShell**. - -1. On a device running Windows 10, version 1607, 1703, or 1803, at the Windows PowerShell command prompt, enter the following command: - - `Export-StartLayout -path .xml` - - On a device running Windows 10, version 1809 or higher, run the **Export-StartLayout** with the switch **-UseDesktopApplicationID**. For example: - - ```PowerShell - Export-StartLayout -UseDesktopApplicationID -Path layout.xml - ``` - - In the previous command, `-path` is a required parameter that specifies the path and file name for the export file. You can specify a local path or a UNC path (for example, \\\\FileServer01\\StartLayouts\\StartLayoutMarketing.xml). - - Use a file name of your choice—for example, StartLayoutMarketing.xml. Include the .xml file name extension. The [Export-StartLayout](/powershell/module/startlayout/export-startlayout) cmdlet doesn't append the file name extension, and the policy settings require the extension. - - Example of a layout file produced by `Export-StartLayout`: - - ```xml - - - - - - - - - - - - - - ``` - -1. (Optional) Edit the .xml file to add [a taskbar configuration](configure-windows-10-taskbar.md) or to [modify the exported layout](start-layout-xml-desktop.md). When you make changes to the exported layout, be aware that [the order of the elements in the .xml file is critical.](start-layout-xml-desktop.md#required-order) - -> [!IMPORTANT] -> If the Start layout that you export contains tiles for desktop (Win32) apps or .url links, **Export-StartLayout** will use **DesktopApplicationLinkPath** in the resulting file. Use a text or XML editor to change **DesktopApplicationLinkPath** to **DesktopApplicationID**. See [Specify Start tiles](start-layout-xml-desktop.md#specify-start-tiles) for details on using the app ID in place of the link path. - -> [!NOTE] -> All clients that the start layout applies to must have the apps and other shortcuts present on the local system in the same location as the source for the Start layout. -> -> For scripts and application tile pins to work correctly, follow these rules: -> ->* Executable files and scripts should be listed in \Program Files or wherever the installer of the app places them. -> ->* Shortcuts that will pinned to Start should be placed in \ProgramData\Microsoft\Windows\Start Menu\Programs. -> ->* If you place executable files or scripts in the \ProgramData\Microsoft\Windows\Start Menu\Programs folder, they will not pin to Start. -> ->* Start on Windows 10 does not support subfolders. We only support one folder. For example, \ProgramData\Microsoft\Windows\Start Menu\Programs\Folder. If you go any deeper than one folder, Start will compress the contents of all the subfolder to the top level. -> ->* Three additional shortcuts are pinned to the start menu after the export. These are shortcuts to %ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs, %APPDATA%\Microsoft\Windows\Start Menu\Programs, and %APPDATA%\Microsoft\Windows\Start Menu\Programs\System Tools\. - -### Configure a partial Start layout - -A partial Start layout enables you to add one or more customized tile groups to users' Start screens or menus, while still allowing users to make changes to other parts of the Start layout. All groups that you add are *locked*, meaning users can't change the contents of those tile groups, however users can change the location of those groups. Locked groups are identified with an icon, as shown in the following image. - -![locked tile group.](images/start-pinned-app.png) - -When a partial Start layout is applied for the first time, the new groups are added to the users' existing Start layouts. If an app tile is in both an existing group and in a new locked group, the duplicate app tile is removed from the existing (unlocked) group. - -When a partial Start layout is applied to a device that already has a StartLayout.xml applied, groups that were added previously are removed and the groups in the new layout are added. - -If the Start layout is applied by Group Policy or MDM, and the policy is removed, the groups remain on the devices but become unlocked. - -**To configure a partial Start screen layout** - -1. [Customize the Start layout](#customize-the-start-screen-on-your-test-computer). - -1. [Export the Start layout](#export-the-start-layout). -1. Open the layout .xml file. There is a `` element. Add `LayoutCustomizationRestrictionType="OnlySpecifiedGroups"` to the **DefaultLayoutOverride** element as follows: - - ```xml - - ``` - -1. Save the file and apply using any of the deployment methods. - -> [!NOTE] -> Office 2019 tiles might be removed from the Start menu when you upgrade Office 2019. This only occurs if Office 2019 app tiles are in a custom group in the Start menu and only contains the Office 2019 app tiles. To avoid this problem, place another app tile in the Office 2019 group prior to the upgrade. For example, add Notepad.exe or calc.exe to the group. This issue occurs because Office 2019 removes and reinstalls the apps when they are upgraded. Start removes empty groups when it detects that all apps for that group have been removed. - -## Related articles - -[Manage Windows 10 Start and taskbar layout](windows-10-start-layout-options-and-policies.md) - -[Configure Windows 10 taskbar](configure-windows-10-taskbar.md) - -[Add image for secondary tiles](start-secondary-tiles.md) - -[Start layout XML for desktop editions of Windows 10 (reference)](start-layout-xml-desktop.md) - -[Customize Windows 10 Start and taskbar with Group Policy](customize-windows-10-start-screens-by-using-group-policy.md) - -[Customize Windows 10 Start and taskbar with provisioning packages](customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md) - -[Customize Windows 10 Start and taskbar with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md) - -[Changes to Start policies in Windows 10](changes-to-start-policies-in-windows-10.md) diff --git a/windows/configuration/customize-start-menu-layout-windows-11.md b/windows/configuration/customize-start-menu-layout-windows-11.md deleted file mode 100644 index 2e959a035a..0000000000 --- a/windows/configuration/customize-start-menu-layout-windows-11.md +++ /dev/null @@ -1,174 +0,0 @@ ---- -title: Add or remove pinned apps on the Start menu in Windows 11 -description: Export Start layout to LayoutModification.json with pinned apps, and add or remove pinned apps. Use the JSON text in an MDM policy to deploy a custom Start menu layout to Windows 11 devices. -author: lizgt2000 -ms.author: lizlong -ms.reviewer: ericpapa -ms.date: 01/10/2023 -ms.topic: article ---- - -# Customize the Start menu layout on Windows 11 - -**Applies to**: - -- Windows 11 - -> **Looking for OEM information?** See [Customize the Taskbar](/windows-hardware/customize/desktop/customize-the-windows-11-taskbar) and [Customize the Start layout](/windows-hardware/customize/desktop/customize-the-windows-11-start-menu). - -Your organization can deploy a customized Start layout to your Windows 11 devices. Customizing the Start layout is common when you have similar devices used by many users, or you want to pin specific apps. - -For example, you can override the default set of apps with your own a set of pinned apps, and in the order you choose. As an administrator, use this feature to pin apps, remove default pinned apps, order the apps, and more. - -To add apps you want pinned to the Start menu, you use a JSON file. In previous Windows versions, IT administrators used an XML file to customize the Start menu. The XML file isn't available on Windows 11 and later ***unless*** [you're an OEM](/windows-hardware/customize/desktop/customize-the-windows-11-start-menu). - -This article shows you how to export an existing Start menu layout, and use the JSON in a Microsoft Intune policy. - -## Before you begin - -- When you customize the Start layout, you overwrite the entire full layout. A partial Start layout isn't available. Users can pin and unpin apps, and uninstall apps from Start. When a user signs in or Explorer restarts, Windows reapplies the MDM policy. This action restores the specified layout and doesn't retain any user changes. - - To prevent users from making any changes to the Start menu layout, see the [NoChangeStartMenu](/windows/client-management/mdm/policy-csp-admx-startmenu#admx-startmenu-nochangestartmenu) policy. - -- It's recommended to use a mobile device management (MDM) provider. MDM providers help manage your devices, and help manage apps on your devices. You can use Microsoft Intune. Intune is a family of products that include Microsoft Intune, which is a cloud service, and Configuration Manager, which is on-premises. - - In this article, we mention these services. If you're not managing your devices using an MDM provider, the following resources may help you get started: - - - [Endpoint Management at Microsoft](/mem/endpoint-manager-overview) - - [What is Microsoft Intune](/mem/intune/fundamentals/what-is-intune) and [Microsoft Intune planning guide](/mem/intune/fundamentals/intune-planning-guide) - - [What is Configuration Manager?](/mem/configmgr/core/understand/introduction) - -## Start menu features and areas - -In Windows 11, the Start menu is redesigned with a simplified set of apps that are arranged in a grid of pages. There aren't folders, groups, or different-sized app icons: - -:::image type="content" source="./images/customize-start-menu-layout-windows-11/start-menu-layout.png" alt-text="Sample start menu layout on Windows 11 devices that shows pinned apps, access to all apps, and shows recommended files."::: - -Start has the following areas: - -- **Pinned**: Shows pinned apps, or a subset of all of the apps installed on the device. You can create a list of pinned apps you want on the devices using the **ConfigureStartPins** policy. **ConfigureStartPins** overrides the entire layout, which also removes apps that are pinned by default. - - This article shows you [how to use the **ConfigureStartPins** policy](#get-the-pinnedlist-json). - -- **All apps**: Users select this option to see an alphabetical list of all the apps on the device. This section can't be customized using the JSON file. - - The [Start/HideFrequentlyUsedApps CSP](/windows/client-management/mdm/policy-csp-start#start-hidefrequentlyusedapps) exposes settings that configure the "Most used" section, which is at the top of the all apps list. - - In **Intune**, you can configure this Start menu layout feature, and more. For more information on the Start menu settings you can configure in an Intune policy, see [Windows 10/11 device settings to allow or restrict features](/mem/intune/configuration/device-restrictions-windows-10#start). - - In **Group Policy**, there are policies that include settings that control the Start menu layout. Some policies may not work as expected. Be sure to test your policies before broadly deploying them across your devices: - - - `Computer Configuration\Administrative Templates\Start Menu and Taskbar` - - `User Configuration\Administrative Templates\Start Menu and Taskbar` - -- **Recommended**: Shows recently opened files and recently installed apps. This section can only be customized in Windows 11 SE using the following policy. - - - `Computer Configuration\Administrative Templates\Start Menu and Taskbar\Remove Recommended section from Start Menu` - -## Create the JSON file - -On an existing Windows 11 device, set up your own Start layout with the pinned apps you want users to see. Then, use the [Windows PowerShell Export-StartLayout](/powershell/module/startlayout/export-startlayout) cmdlet to export the existing layout to a `LayoutModification.json` file. - -The JSON file controls the Start menu layout, and lists all the apps that are pinned. You can update the JSON file to: - -- Change the order of existing apps. The apps in the JSON file are shown on Start in the same order. -- Add more apps by entering the app ID. For more information, see [Get the pinnedList JSON](#get-the-pinnedlist-json) (in this article). - -If you're familiar with creating JSON files, you can create your own `LayoutModification.json` file. But, it's easier and faster to export the layout from an existing device. - -### Export an existing Start layout - -1. Create a folder to save the `.json` file. For example, create the `C:\Layouts` folder. -2. On a Windows 11 device, open the Windows PowerShell app. -3. Run the following cmdlet. Name the file `LayoutModification.json`. - - ```powershell - Export-StartLayout -Path "C:\Layouts\LayoutModification.json" - ``` - -### Get the pinnedList JSON - -1. Open the `LayoutModification.json` file in a JSON editor, such as Visual Studio Code or Notepad. For more information, see [edit JSON with Visual Studio Code](https://code.visualstudio.com/docs/languages/json). -2. In the file, you see the `pinnedList` section. This section includes all of the pinned apps. Copy the `pinnedList` content in the JSON file. You'll use it in the next section. - - In the following example, you see that Microsoft Edge, Microsoft Word, the Microsoft Store app, and Notepad are pinned: - - ```json - { - "pinnedList": [ - { "desktopAppId": "MSEdge" }, - { "desktopAppId": "Microsoft.Office.WINWORD.EXE.15" }, - { "packagedAppId": "Microsoft.WindowsStore_8wekyb3d8bbwe!App" }, - { "packagedAppId": "Microsoft.WindowsNotepad_8wekyb3d8bbwe!App" } - ] - } - ``` - -3. Starting with Windows 11, the **ConfigureStartPins** policy is available. This policy uses the `LayoutModification.json` file to add apps to the Pinned section. In your JSON file, you can add more apps to this section using the following keys: - - --- - | Key | Description | - | --- | --- | - | packagedAppID | Use this option for Universal Windows Platform apps. To pin a UWP app, use the app's AUMID.| - | desktopAppID | Use this option for unpackaged Win32 apps. To pin a Win32 app, use the app's AUMID. If the app doesn't have an AUMID, then enter the `desktopAppLink` instead. | - | desktopAppLink | Use this option for unpackaged Win32 apps that don't have an associated AUMID. To pin this type of app, use the path to the `.lnk` shortcut that points to the app. | - -## Use MDM to create and deploy a pinned list policy - -Now that you have the JSON syntax, you're ready to deploy your customized Start layout to devices in your organization. - -MDM providers can deploy policies to devices managed by the organization, including organization-owned devices, and personal or bring your own device (BYOD). Using an MDM provider, such as Microsoft Intune, you can deploy a policy that configures the pinned list. - -This section shows you how to create a pinned list policy in Intune. There isn't a Group Policy to create a pinned list. - -### Create a pinned list using an Intune policy - -To deploy this policy, the devices must be enrolled, and managed by your organization. For more information, see [What is device enrollment?](/mem/intune/enrollment/device-enrollment). - -1. Sign in to the [Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). -2. Select **Devices** > **Configuration profiles** > **Create profile**. -3. Enter the following properties: - - - **Platform**: Select **Windows 10 and later**. - - **Profile**: Select **Templates** > **Custom**. - -4. Select **Create**. -5. In **Basics**, enter the following properties: - - - **Name**: Enter a descriptive name for the profile. Name your profiles so you can easily identify them later. For example, a good profile name is **Win11: Custom Start layout**. - - **Description**: Enter a description for the profile. This setting is optional, and recommended. - -6. Select **Next**. -7. In **Configuration settings** > **OMA-URI**, select **Add**. Add the following properties: - - - **Name**: Enter something like **Configure Start pins**. - - **Description**: Enter a description for the row. This setting is optional, and recommended. - - **OMA-URI**: Enter `./Vendor/MSFT/Policy/Config/Start/ConfigureStartPins`. - - **Data type**: Select **String**. - - **Value**: Paste the JSON you created or updated in the previous section. For example, enter the following text: - - ```json - { - "pinnedList": [ - { "desktopAppId": "MSEdge" }, - { "desktopAppId": "Microsoft.Office.WINWORD.EXE.15" }, - { "packagedAppId": "Microsoft.WindowsStore_8wekyb3d8bbwe!App" }, - { "packagedAppId": "Microsoft.WindowsNotepad_8wekyb3d8bbwe!App" } - ] - } - ``` - - Your settings look similar to the following settings: - - :::image type="content" source="./images/customize-start-menu-layout-windows-11/endpoint-manager-admin-center-custom-oma-uri-start-layout.png" alt-text="Custom OMA-URI settings to customize Start menu layout using pinnedList"::: - -8. Select **Save** > **Next** to save your changes. -9. Configure the rest of the policy settings. For more specific information, see [Create a profile with custom settings](/mem/intune/configuration/custom-settings-configure). - -The Windows OS exposes many CSPs that apply to the Start menu. For a list, see [Supported CSP policies for Windows 11 Start menu](supported-csp-start-menu-layout-windows.md). - -### Deploy the policy using Intune - -When the policy is created, you can deploy it now, or deploy it later. Since this policy is a customized Start layout, the policy can be deployed anytime, including before users sign in the first time. - -For more information and guidance on assigning policies to devices in your organization, see [Assign user and device profiles](/mem/intune/configuration/device-profile-assign). diff --git a/windows/configuration/customize-taskbar-windows-11.md b/windows/configuration/customize-taskbar-windows-11.md deleted file mode 100644 index 72a4298b7c..0000000000 --- a/windows/configuration/customize-taskbar-windows-11.md +++ /dev/null @@ -1,247 +0,0 @@ ---- -title: Configure and customize Windows 11 taskbar -description: On Windows 11 devices, pin and unpin default apps and organization apps on the taskbar using an XML file. Deploy the taskbar XML file using Group Policy or MDM and Microsoft Intune. See what happens to the taskbar when the Windows OS client is installed or upgraded. -manager: aaroncz -ms.author: lizlong -ms.reviewer: chataylo -ms.prod: windows-client -author: lizgt2000 -ms.localizationpriority: medium -ms.collection: - - tier1 -ms.technology: itpro-configure -ms.date: 08/17/2023 -ms.topic: article ---- - -# Customize the Taskbar on Windows 11 - -**Applies to**: - -- Windows 11 - -> **Looking for OEM information?** See [Customize the Taskbar](/windows-hardware/customize/desktop/customize-the-windows-11-taskbar) and [Customize the Start layout](/windows-hardware/customize/desktop/customize-the-windows-11-start-menu). - -Your organization can deploy a customized taskbar to your Windows devices. Customizing the taskbar is common when your organization uses a common set of apps, or wants to bring attention to specific apps. You can also remove the default pinned apps. - -For example, you can override the default set of apps with your own a set of pinned apps, and in the order you choose. As an administrator, use this feature to pin apps, remove default pinned apps, order the apps, and more on the taskbar. - -To add apps you want pinned to the taskbar, you use an XML file. You can use an existing XML file, or create a new file. If you have an XML file that's used on Windows 10 devices, you can also use it on Windows 11 devices. You may have to update the App IDs. - -This article shows you how to create the XML file, add apps to the XML, and deploy the XML file. To learn how to customize the taskbar buttons, see [CSP policies to customize Windows 11 taskbar buttons](supported-csp-taskbar-windows.md#csp-policies-to-customize-windows-11-taskbar-buttons). - -## Before you begin - -- There isn't a limit on the number of apps that you can pin. In the XML file, add apps using the [Application User Model ID (AUMID)](./find-the-application-user-model-id-of-an-installed-app.md) or Desktop Application Link Path (the local path to the app). - -- There are some situations that an app pinned in your XML file won't be pinned in the taskbar. For example, if an app isn't approved or installed for a user, then the pinned icon won't show on the taskbar. - -- The order of apps in the XML file dictates the order of pinned apps on the taskbar, from left to right, and to the right of any existing apps pinned by the user. If the OS is configured to use a right-to-left language, then the taskbar order is reversed. - -- Some classic Windows applications are packaged differently than they were in previous versions of Windows, including Notepad and File Explorer. Be sure to enter the correct AppID. For more information, see [Application User Model ID (AUMID)](./find-the-application-user-model-id-of-an-installed-app.md) and [Get the AUMID and Desktop app link path](#get-the-aumid-and-desktop-app-link-path) (in this article). - -- It's recommended to use a Mobile Device Management (MDM) provider. MDM providers help manage your devices, and help manage apps on your devices. You can use Microsoft Intune. Intune is a family of products that include Microsoft Intune, which is a cloud service, and Configuration Manager, which is on-premises. - - In this article, we mention these services. If you're not managing your devices using an MDM provider, the following resources may help you get started: - - - [Endpoint Management at Microsoft](/mem/endpoint-manager-overview) - - [What is Microsoft Intune](/mem/intune/fundamentals/what-is-intune) and [Microsoft Intune planning guide](/mem/intune/fundamentals/intune-planning-guide) - - [What is Configuration Manager?](/mem/configmgr/core/understand/introduction) - -## Create the XML file - -1. In a text editor, such as Visual Studio Code, create a new XML file. To help you get started, you can copy and paste the following XML sample. The sample pins 2 apps to the taskbar - File Explorer and the Command Prompt: - - ```xml - - - - - - - - - - - - ``` - -2. In the `` node, add (or remove) the apps you want pinned. You can pin Universal Windows Platform (UWP) apps and desktop apps: - - - ``: Select this option for UWP apps. Add the [AUMID](./find-the-application-user-model-id-of-an-installed-app.md) of the UWP app. - - ``: Select this option for desktop apps. Add the Desktop Application Link Path of the desktop app. - - You can pin as many apps as you want. Just keep adding them to the list. Remember, the app order in the list is the same order the apps are shown on the taskbar. - - For more information, see [Get the AUMID and Desktop app link path](#get-the-aumid-and-desktop-app-link-path) (in this article). - -3. In the `` node, the apps you add are pinned after the default apps. If you want to remove the default apps, and only show the apps you add in the XML file, then add `PinListPlacement="Replace"`: - - - ``: Keeps the default pinned apps. After the default apps, the apps you add are pinned. - - ``: Unpins the default apps. Only the apps you add are pinned. - - If you want to remove some of the default pinned apps, then add `PinListPlacement="Replace"`. When you add your apps to ``, include the default apps you still want pinned. - -4. In the `` node, use `region=" | "` to use different taskbar configurations based on the device locale and region. - - In the following XML example, two regions are added: `US|UK` and `DE|FR`: - - ```xml - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ``` - - The taskbar applies when: - - - If the `` node has a country or region, then the apps are pinned on devices configured for that country or region. - - If the `` node doesn't have a region tag for the current region, then the first `` node with no region is applied. - -5. Save the file, and name the file so you know what it is. For example, name the file something like `TaskbarLayoutModification.xml`. Once you have the file, it's ready to be deployed to your Windows devices. - -## Use Group Policy or MDM to create and deploy a taskbar policy - -Now that you have the XML file with your customized taskbar, you're ready to deploy it to devices in your organization. You can deploy your taskbar XML file using Group Policy, or using an MDM provider, like Microsoft Intune. - -This section shows you how to deploy the XML both ways. - -### Use Group Policy to deploy your XML file - -Use the following steps to add your XML file to a group policy, and apply the policy: - -1. Open your policy editor. For example, open Group Policy Management Console (GPMC) for domain-based group policies, or open `gpedit` for local policies. -2. Go to one of the following policies: - - - `Computer Configuration\Administrative Templates\Start Menu and Taskbar\Start Layout` - - `User Configuration\Administrative Templates\Start Menu and Taskbar\Start Layout` - -3. Double-select `Start Layout` > **Enable**. Enter the fully qualified path to your XML file, including the XML file name. You can enter a local path, like `C:\StartLayouts\TaskbarLayoutModification.xml`, or a network path, like `\\Server\Share\TaskbarLayoutModification.xml`. Be sure you enter the correct file path. If using a network share, be sure to give users read access to the XML file. If the file isn't available when the user signs in, then the taskbar isn't changed. Users can't customize the taskbar when this setting is enabled. - - Your policy looks like the following policy: - - :::image type="content" source="./images/customize-taskbar-windows-11/start-layout-group-policy.png" alt-text="Add your taskbar layout XML file to the Start Layout policy on Windows devices."::: - - The `User Configuration\Administrative Templates\Start Menu and Taskbar` policy includes other settings that control the taskbar. Some policies may not work as expected. Be sure to test your policies before broadly deploying them across your devices. - -4. When you apply the policy, the taskbar includes your changes. The next time users sign in, they'll see the changes. - - For more information on using group policies, see [Implement Group Policy Objects](/training/modules/implement-group-policy-objects/). - -### Create a Microsoft Intune policy to deploy your XML file - -MDM providers can deploy policies to devices managed by the organization, including organization-owned devices, and personal or bring your own device (BYOD). Using an MDM provider, such as Microsoft Intune, you can deploy a policy that configures the pinned list. - -Use the following steps to create an Intune policy that deploys your taskbar XML file: - -1. Sign in to the [Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). - -2. Select **Devices** > **Configuration profiles** > **Create profile**. - -3. Enter the following properties: - - - **Platform**: Select **Windows 10 and later**. - - **Profile type**: Select **Templates** > **Device restrictions** > **Create**. - -4. In **Basics**, enter the following properties: - - - **Name**: Enter a descriptive name for the profile. Name your profiles so you can easily identify it later. For example, a good profile name is **Win11: Custom taskbar**. - - **Description**: Enter a description for the profile. This setting is optional, and recommended. - -5. Select **Next**. - -6. In **Configuration settings**, select **Start** > **Start menu layout**. Browse to, and select your taskbar XML file. - -7. Select **Next**, and configure the rest of the policy settings. For more specific information, see [Configure device restriction settings](/mem/intune/configuration/device-restrictions-configure). - -8. When the policy is created, you can deploy it now, or deploy it later. Since this policy is a customized taskbar, the policy can also be deployed before users sign in the first time. - - For more information and guidance on assigning policies using Microsoft Intune, see [Assign user and device profiles](/mem/intune/configuration/device-profile-assign). - -> [!NOTE] -> For third party partner MDM solutions, you may need to use an OMA-URI setting for Start layout, based on the [Policy configuration service provider (CSP)](/windows/client-management/mdm/policy-configuration-service-provider). The OMA-URI setting is `./User/Vendor/MSFT/Policy/Config/Start/StartLayout`. - -## Get the AUMID and Desktop app link path - -In the layout modification XML file, you add apps in the XML markup. To pin an app, you enter the AUMID or Desktop Application Link Path. The easiest way to find this app information is to use the [Export-StartLayout](/powershell/module/startlayout/export-startlayout) Windows PowerShell cmdlet: - -1. On an existing Windows 11 device, pin the app to the Start menu. -2. Create a folder to save an output file. For example, create the `C:\Layouts` folder. -3. Open the Windows PowerShell app, and run the following cmdlet: - - ```powershell - Export-StartLayout -Path "C:\Layouts\GetIDorPath.xml" - ``` - -4. Open the generated GetIDorPath.xml file, and look for the app you pinned. When you find the app, get the AppID or Path. Add these properties to your XML file. - -## Pin order for all apps - -On a taskbar, the following apps are typically pinned: - -- Apps pinned by the user -- Default Windows apps pinned during the OS installation, such as Microsoft Edge, File Explorer, and Microsoft Store. -- Apps pinned by your organization, such as in an unattended Windows setup. - - In an unattended Windows setup file, use the XML file you created in this article. It's not recommended to use [TaskbarLinks](/windows-hardware/customize/desktop/unattend/microsoft-windows-shell-setup-taskbarlinks). - -Apps are pinned in the following order: - -1. Windows default apps are pinned first. -2. User-pinned apps are pinned after the Windows default apps. -3. XML-pinned apps are pinned after the user-pinned apps. - -If the OS is configured to use a right-to-left language, then the taskbar order is reversed. - -## OS install and upgrade - -- On a clean install of the Windows client, if you apply a taskbar layout, the following apps are pinned to the taskbar: - - - Apps you specifically add - - Any default apps you don't remove - - After the taskbar layout is applied, users can pin more apps, change the order, and unpin apps. - -- On a Windows client upgrade, apps are already pinned to the taskbar. These apps may have been pinned by a user, by an image, or by using Windows unattended setup. For upgrades, the taskbar layout applies the following behavior: - - - If users pinned apps to the taskbar, then those pinned apps remain. New apps are pinned after the existing user-pinned apps. - - If the apps are pinned during the install or by a policy (not by a user), and the apps aren't pinned in an updated layout file, then the apps are unpinned. - - If a user didn't pin an app, and the same app is pinned in the updated layout file, then the app is pinned after any existing pinned apps. - - New apps in updated layout file are pinned after the user's pinned apps. - - After the layout is applied, users can pin more apps, change the order, and unpin apps. diff --git a/windows/configuration/customize-windows-10-start-screens-by-using-group-policy.md b/windows/configuration/customize-windows-10-start-screens-by-using-group-policy.md deleted file mode 100644 index 94641458ae..0000000000 --- a/windows/configuration/customize-windows-10-start-screens-by-using-group-policy.md +++ /dev/null @@ -1,128 +0,0 @@ ---- -title: Customize Windows 10 Start and taskbar with group policy -description: In Windows 10, you can use a Group Policy Object (GPO) to deploy a customized Start layout to users in a domain. -ms.reviewer: -manager: aaroncz -author: lizgt2000 -ms.author: lizlong -ms.date: 12/31/2017 ---- - -# Customize Windows 10 Start and taskbar with Group Policy - - -**Applies to** - -- Windows 10 - ->**Looking for consumer information?** See [Customize the Start menu](https://go.microsoft.com/fwlink/p/?LinkId=623630) - -In Windows 10 Pro, Enterprise, and Education, you can use a Group Policy Object (GPO) to deploy a customized Start and taskbar layout to users in a domain. No reimaging is required, and the layout can be updated simply by overwriting the .xml file that contains the layout. This enables you to customize Start and taskbar layouts for different departments or organizations, with minimal management overhead. - -This topic describes how to update Group Policy settings to display a customized Start and taskbar layout when the users sign in. By creating a domain-based GPO with these settings, you can deploy a customized Start and taskbar layout to users in a domain. - ->[!WARNING] ->When a full Start layout is applied with this method, the users cannot pin, unpin, or uninstall apps from Start. Users can view and open all apps in the **All Apps** view, but they cannot pin any apps to Start. When a partial Start layout is applied, the contents of the specified tile groups cannot be changed, but users can move those groups, and can also create and customize their own groups. When you apply a taskbar layout, users will still be able to pin and unpin apps, and change the order of pinned apps. - - - -**Before you begin**: [Customize and export Start layout](customize-and-export-start-layout.md) - -## Operating system requirements - - -In Windows 10, version 1607, Start and taskbar layout control using Group Policy is supported in Windows 10 Enterprise and Windows 10 Education. In Windows 10, version 1703, Start and taskbar layout control using Group Policy is also supported in Windows 10 Pro. - -The GPO can be configured from any computer on which the necessary ADMX and ADML files (StartMenu.admx and StartMenu.adml) for Windows 10 are installed. In Group Policy, ADMX files are used to define Registry-based policy settings in the Administrative Templates category. To find out how to create a central store for Administrative Templates files, see [article 929841, written for Windows Vista and still applicable](/troubleshoot/windows-server/group-policy/create-central-store-domain-controller) in the Microsoft Knowledge Base. - -## How Start layout control works - - -Three features enable Start and taskbar layout control: - -- The [Export-StartLayout](/powershell/module/startlayout/export-startlayout) cmdlet in Windows PowerShell exports a description of the current Start layout in .xml file format. - - >[!NOTE] - >To import the layout of Start to a mounted Windows image, use the [Import-StartLayout](/powershell/module/startlayout/import-startlayout) cmdlet. - -- [You can modify the Start .xml file](configure-windows-10-taskbar.md) to include `` or create an .xml file just for the taskbar configuration. - -- In Group Policy, you use the **Start Layout** settings for the **Start Menu and Taskbar** administrative template to set a Start and taskbar layout from an .xml file when the policy is applied. The Group Policy object doesn't support an empty tile layout, so the default tile layout for Windows is loaded in that case. - ->[!NOTE] ->To learn how customize Start to include your line-of-business apps when you deploy Windows 10, see [Customize the Windows 10 Start layout]( https://go.microsoft.com/fwlink/p/?LinkId=620863). - - - -## Use Group Policy to apply a customized Start layout in a domain - - -To apply the Start and taskbar layout to users in a domain, use the Group Policy Management Console (GPMC) to configure a domain-based Group Policy Object (GPO) that sets **Start Layout** policy settings in the **Start Menu and Taskbar** administrative template for users in a domain. - -The GPO applies the Start and taskbar layout at the next user sign-in. Each time the user signs in, the timestamp of the .xml file with the Start and taskbar layout is checked and if a newer version of the file is available, the settings in the latest version of the file are applied. - -The GPO can be configured from any computer on which the necessary ADMX and ADML files (StartMenu.admx and StartMenu.adml) for Windows 10 are installed. - -The .xml file with the Start and taskbar layout must be located on shared network storage that is available to the users' computers when they sign in and the users must have Read-only access to the file. If the file is not available when the first user signs in, Start and the taskbar are not customized during the session, but the user will be prevented from making changes to Start. On subsequent sign-ins, if the file is available at sign-in, the layout it contains will be applied to the user's Start and taskbar. - -For information about deploying GPOs in a domain, see [Working with Group Policy Objects](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)). - -## Use Group Policy to apply a customized Start layout on the local computer - - -You can use the Local Group Policy Editor to provide a customized Start and taskbar layout for any user who signs in on the local computer. To display the customized Start and taskbar layout for any user who signs in, configure **Start Layout** policy settings for the **Start Menu and Taskbar** administrative template. You can use the **Start Menu and Taskbar** administrative template in **User Configuration** or **Computer Configuration**. - ->[!NOTE] ->This procedure applies the policy settings on the local computer only. For information about deploying the Start and taskbar layout to users in a domain, see [Use Group Policy to deploy a customized Start layout in a domain](#bkmk-domaingpodeployment). -> ->This procedure creates a Local Group Policy that applies to all users on the computer. To configure Local Group Policy that applies to a specific user or group on the computer, see [Step-by-Step Guide to Managing Multiple Local Group Policy Objects](/previous-versions/windows/it-pro/windows-vista/cc766291(v=ws.10)). The guide was written for Windows Vista and the procedures still apply to Windows 10. - - -This procedure adds the customized Start and taskbar layout to the user configuration, which overrides any Start layout settings in the local computer configuration when a user signs in on the computer. - -**To configure Start Layout policy settings in Local Group Policy Editor** - -1. On the test computer, press the Windows key, type **gpedit**, and then select **Edit group policy (Control panel)**. - -2. Go to **User Configuration** or **Computer Configuration** > **Administrative Templates** >**Start Menu and Taskbar**. - - ![start screen layout policy settings.](images/starttemplate.jpg) - -3. Right-click **Start Layout** in the right pane, and click **Edit**. - - This opens the **Start Layout** policy settings. - - ![policy settings for start screen layout.](images/startlayoutpolicy.jpg) - -4. Enter the following settings, and then click **OK**: - - 1. Select **Enabled**. - - 2. Under **Options**, specify the path to the .xml file that contains the Start and taskbar layout. For example, type **C:\\Users\\Test01\\StartScreenMarketing.xml**. - - 3. Optionally, enter a comment to identify the Start and taskbar layout. - - > [!IMPORTANT] - > If you disable Start Layout policy settings that have been in effect and then re-enable the policy, users will not be able to make changes to Start, however the layout in the .xml file will not be reapplied unless the file has been updated. In Windows PowerShell, you can update the timestamp on a file by running the following command: - > - > `(ls ).LastWriteTime = Get-Date` - - - -## Update a customized Start layout - - -After you use Group Policy to apply a customized Start and taskbar layout on a computer or in a domain, you can update the layout simply by replacing the .xml file that is specified in the Start Layout policy settings with a file with a newer timestamp. - -## Related topics - - -- [Manage Windows 10 Start and taskbar layout](windows-10-start-layout-options-and-policies.md) -- [Configure Windows 10 taskbar](configure-windows-10-taskbar.md) -- [Customize and export Start layout](customize-and-export-start-layout.md) -- [Add image for secondary tiles](start-secondary-tiles.md) -- [Start layout XML for desktop editions of Windows 10 (reference)](start-layout-xml-desktop.md) -- [Customize Windows 10 Start and taskbar with provisioning packages](customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md) -- [Customize Windows 10 Start and taskbar with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md) -- [Changes to Start policies in Windows 10](changes-to-start-policies-in-windows-10.md) - diff --git a/windows/configuration/customize-windows-10-start-screens-by-using-mobile-device-management.md b/windows/configuration/customize-windows-10-start-screens-by-using-mobile-device-management.md deleted file mode 100644 index ebd6bb9d28..0000000000 --- a/windows/configuration/customize-windows-10-start-screens-by-using-mobile-device-management.md +++ /dev/null @@ -1,97 +0,0 @@ ---- -title: Change the Windows 10 Start and taskbar using mobile device management | Microsoft Docs -description: In Windows 10, you can use a mobile device management (MDM) policy to deploy a customized Start and taskbar layout to users. For example, use Microsoft Intune to configure the start menu layout and taskbar, and deploy the policy to your devices. -ms.reviewer: -manager: aaroncz -ms.prod: windows-client -author: lizgt2000 -ms.topic: article -ms.author: lizlong -ms.localizationpriority: medium -ms.date: 08/05/2021 -ms.technology: itpro-configure ---- - -# Customize Windows 10 Start and taskbar with mobile device management (MDM) - - -**Applies to** - -- Windows 10 - - ->**Looking for consumer information?** [Customize the Start menu](https://go.microsoft.com/fwlink/p/?LinkId=623630) - -In Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education, you can use a mobile device management (MDM) policy to deploy a customized Start and taskbar layout to users. No reimaging is required. The layout can be updated simply by overwriting the `.xml` file that contains the layout. This feature enables you to customize Start layouts for different departments or organizations, with minimal management overhead. - ->[!NOTE] ->Support for applying a customized taskbar using MDM is added in Windows 10, version 1703. - -**Before you begin**: [Customize and export Start layout](customize-and-export-start-layout.md) for desktop editions (also works for taskbar customization). - ->[!WARNING] ->When a full Start layout is applied with this method, the users cannot pin, unpin, or uninstall apps from Start. Users can view and open all apps in the **All Apps** view, but they cannot pin any apps to Start. When a partial Start layout is applied, the contents of the specified tile groups cannot be changed, but users can move those groups, and can also create and customize their own groups. - - - -## How Start layout control works - - -Two features enable Start layout control: - -- The **Export-StartLayout** cmdlet in Windows PowerShell exports a description of the current Start layout in .xml file format. - - >[!NOTE] - >To import the layout of Start to a mounted Windows image, use the [Import-StartLayout](/powershell/module/startlayout/import-startlayout) cmdlet. - - - -- In Microsoft Intune, you select the Start layout XML file and add it to a device configuration profile. - - >[!NOTE] - >Please do not include XML Prologs like \ in the Start layout XML file. The settings may not be reflected correctly. - -## Create a policy for your customized Start layout - -The following example uses Microsoft Intune to configure an MDM policy that applies a customized Start layout: - -1. Sign in to the [Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). - -2. Select **Devices** > **Configuration profiles** > **Create profile**. - -3. Enter the following properties: - - - **Platform**: Select **Windows 10 and later**. - - **Profile type**: Select **Templates** > **Device restrictions** > **Create**. - -4. In **Basics**, enter the following properties: - - - **Name**: Enter a descriptive name for the profile. Name your profiles so you can easily identify it later. For example, a good profile name is **Customize Start menu and taskbar**. - - **Description**: Enter a description for the profile. This setting is optional, but recommended. - -5. Select **Next**. - -6. In **Configuration settings**, select **Start**: - - - If you're using an XML file, select **Start menu layout**. Browse to and select your Start layout XML file. - - If you don't have an XML file, configure the others settings. For more information on these settings, see [Start settings in Microsoft Intune](/mem/intune/configuration/device-restrictions-windows-10#start). - -7. Select **Next**. -8. In **Scope tags**, select **Next**. For more information about scope tags, see [Use RBAC and scope tags for distributed IT](/mem/intune/fundamentals/scope-tags). -9. In **Assignments**, select the user or groups that will receive your profile. Select **Next**. For more information on assigning profiles, see [Assign user and device profiles](/mem/intune/configuration/device-profile-assign). -10. In **Review + create**, review your settings. When you select **Create**, your changes are saved, and the profile is assigned. The policy is also shown in the profiles list. - -> [!NOTE] -> For third party partner MDM solutions, you may need to use an OMA-URI setting for Start layout, based on the [Policy configuration service provider (CSP)](/windows/client-management/mdm/policy-configuration-service-provider). The OMA-URI setting is `./User/Vendor/MSFT/Policy/Config/Start/StartLayout`. - - -## Next steps - -- [Manage Windows 10 Start and taskbar layout](windows-10-start-layout-options-and-policies.md) -- [Configure Windows 10 taskbar](configure-windows-10-taskbar.md) -- [Customize and export Start layout](customize-and-export-start-layout.md) -- [Add image for secondary tiles](start-secondary-tiles.md) -- [Start layout XML for desktop editions of Windows 10 (reference)](start-layout-xml-desktop.md) -- [Customize Windows 10 Start and taskbar with Group Policy](customize-windows-10-start-screens-by-using-group-policy.md) -- [Customize Windows 10 Start and taskbar with provisioning packages](customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md) -- [Changes to Start policies in Windows 10](changes-to-start-policies-in-windows-10.md) diff --git a/windows/configuration/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md b/windows/configuration/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md deleted file mode 100644 index 904afc2d16..0000000000 --- a/windows/configuration/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md +++ /dev/null @@ -1,140 +0,0 @@ ---- -title: Customize Windows 10 Start and taskbar with provisioning packages (Windows 10) -description: In Windows 10, you can use a provisioning package to deploy a customized Start layout to users. -ms.reviewer: -manager: aaroncz -ms.prod: windows-client -author: lizgt2000 -ms.author: lizlong -ms.topic: article -ms.localizationpriority: medium -ms.technology: itpro-configure -ms.date: 12/31/2017 ---- - -# Customize Windows 10 Start and taskbar with provisioning packages - - -**Applies to** - -- Windows 10 - -> **Looking for consumer information?** [Customize the Start menu](https://go.microsoft.com/fwlink/p/?LinkId=623630) - -> [!NOTE] -> Currently, using provisioning packages to customize the Start menu layout is supported on Windows 10. It's not supported on Windows 11. - -In Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education, version 1703, you can use a provisioning package that you create with Windows Configuration Designer to deploy a customized Start and taskbar layout to users. No reimaging is required, and the Start and taskbar layout can be updated simply by overwriting the .xml file that contains the layout. The provisioning package can be applied to a running device. This enables you to customize Start and taskbar layouts for different departments or organizations, with minimal management overhead. - -> [!IMPORTANT] -> If you use a provisioning package to configure the taskbar, your configuration will be reapplied each time the explorer.exe process restarts. If your configuration pins an app and the user unpins that app, the user's change will be overwritten the next time the configuration is applied. To apply a taskbar configuration and allow users to make changes that will persist, apply your configuration by using Group Policy. - -**Before you begin**: [Customize and export Start layout](customize-and-export-start-layout.md) for desktop editions. - -## How Start layout control works - - -Three features enable Start and taskbar layout control: - -- The **Export-StartLayout** cmdlet in Windows PowerShell exports a description of the current Start layout in .xml file format. - - > [!NOTE] - > To import the layout of Start to a mounted Windows image, use the [Import-StartLayout](/powershell/module/startlayout/import-startlayout) cmdlet. - -- [You can modify the Start .xml file](configure-windows-10-taskbar.md) to include `` or create an .xml file just for the taskbar configuration. - -- In Windows Configuration Designer, you use the **Policies/Start/StartLayout** setting to provide the contents of the .xml file that defines the Start and taskbar layout. - - - -## Prepare the Start layout XML file - -The **Export-StartLayout** cmdlet produces an XML file. Because Windows Configuration Designer produces a customizations.xml file that contains the configuration settings, adding the Start layout section to the customizations.xml file directly would result in an XML file embedded in an XML file. Before you add the Start layout section to the customizations.xml file, you must replace the markup characters in your layout.xml with escape characters. - - -1. Copy the contents of layout.xml into an online tool that escapes characters. - -3. During the procedure to create a provisioning package, you will copy the text with the escape characters and paste it in the customizations.xml file for your project. - -## Create a provisioning package that contains a customized Start layout - - -Use the Windows Configuration Designer tool to create a provisioning package. [Learn how to install Windows Configuration Designer.](provisioning-packages/provisioning-install-icd.md) - -> [!IMPORTANT] -> When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed. - -1. Open Windows Configuration Designer (by default, %systemdrive%\\Program Files (x86)\\Windows Kits\\10\\Assessment and Deployment Kit\\Imaging and Configuration Designer\\x86\\ICD.exe). - -2. Choose **Advanced provisioning**. - -3. Name your project, and click **Next**. - -4. Choose **All Windows desktop editions** and click **Next**. - -5. On **New project**, click **Finish**. The workspace for your package opens. - -6. Expand **Runtime settings** > **Policies** > **Start**, and click **StartLayout**. - - > [!TIP] - > If **Start** is not listed, check the type of settings you selected in step 4. You must create the project using settings for **All Windows desktop editions**. - -7. Enter **layout.xml**. This value creates a placeholder in the customizations.xml file that you will replace with the contents of the layout.xml file in a later step. - -7. Save your project and close Windows Configuration Designer. - -7. In File Explorer, open the project's directory. (The default location is C:\Users\\*user name*\Documents\Windows Imaging and Configuration Designer (WICD)\\*project name*) - -7. Open the customizations.xml file in a text editor. The **<Customizations>** section will look like this: - - ![Customizations file with the placeholder text to replace highlighted.](images/customization-start.png) - -7. Replace **layout.xml** with the text from the layout.xml file, [with markup characters replaced with escape characters](#escape). - -8. Save and close the customizations.xml file. - -8. Open Windows Configuration Designer and open your project. - -8. On the **File** menu, select **Save.** - -9. On the **Export** menu, select **Provisioning package**. - -10. Change **Owner** to **IT Admin**, which will set the precedence of this provisioning package higher than provisioning packages applied to this device from other sources, and then select **Next.** - -11. Optional. In the **Provisioning package security** window, you can choose to encrypt the package and enable package signing. - - - **Enable package encryption** - If you select this option, an auto-generated password will be shown on the screen. - - - **Enable package signing** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by clicking **Browse** and choosing the certificate you want to use to sign the package. - -12. Click **Next** to specify the output location where you want the provisioning package to go when it's built. By default, Windows Imaging and Configuration Designer (ICD) uses the project folder as the output location. - - Optionally, you can click **Browse** to change the default output location. - -13. Click **Next**. - -14. Click **Build** to start building the package. The provisioning package doesn't take long to build. The project information is displayed in the build page and the progress bar indicates the build status. - - If you need to cancel the build, click **Cancel**. This cancels the current build process, closes the wizard, and takes you back to the **Customizations Page**. - -15. If your build fails, an error message will show up that includes a link to the project folder. You can scan the logs to determine what caused the error. Once you fix the issue, try building the package again. - - If your build is successful, the name of the provisioning package, output directory, and project directory will be shown. - - - If you choose, you can build the provisioning package again and pick a different path for the output package. To do this, click **Back** to change the output package name and path, and then click **Next** to start another build. - - If you are done, click **Finish** to close the wizard and go back to the **Customizations Page**. - -16. Copy the provisioning package to the target device. - -17. Double-click the ppkg file and allow it to install. - -## Related topics - -- [Manage Windows 10 Start and taskbar layout](windows-10-start-layout-options-and-policies.md) -- [Configure Windows 10 taskbar](configure-windows-10-taskbar.md) -- [Customize and export Start layout](customize-and-export-start-layout.md) -- [Add image for secondary tiles](start-secondary-tiles.md) -- [Start layout XML for desktop editions of Windows 10 (reference)](start-layout-xml-desktop.md) -- [Customize Windows 10 Start and taskbar with Group Policy](customize-windows-10-start-screens-by-using-group-policy.md) -- [Customize Windows 10 Start and taskbar with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md) -- [Changes to Start policies in Windows 10](changes-to-start-policies-in-windows-10.md) diff --git a/windows/configuration/docfx.json b/windows/configuration/docfx.json index f2f46412bc..65d0a53b09 100644 --- a/windows/configuration/docfx.json +++ b/windows/configuration/docfx.json @@ -41,12 +41,10 @@ "zone_pivot_group_filename": "resources/zone-pivot-groups.json", "breadcrumb_path": "/windows/resources/breadcrumb/toc.json", "uhfHeaderId": "MSDocsHeader-Windows", - "ms.technology": "itpro-configure", - "ms.topic": "article", - "ms.prod": "windows-client", + "ms.subservice": "itpro-configure", + "ms.service": "windows-client", "manager": "aaroncz", - "feedback_system": "GitHub", - "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", + "feedback_system": "Standard", "feedback_product_url": "https://support.microsoft.com/windows/send-feedback-to-microsoft-with-the-feedback-hub-app-f59187f8-8739-22d6-ba93-f66612949332", "_op_documentIdPathDepotMapping": { "./": { @@ -56,28 +54,89 @@ }, "titleSuffix": "Configure Windows", "contributors_to_exclude": [ - "rjagiewich", - "traya1", - "rmca14", - "claydetels19", + "dstrome2", + "rjagiewich", + "American-Dipper", + "claydetels19", "jborsecnik", - "tiburd", - "garycentric", - "beccarobins", + "v-stchambers", + "shdyas", "Stacyrch140", - "v-stsavell", - "American-Dipper" + "garycentric", + "dstrome", + "beccarobins", + "alekyaj" ], - "searchScope": ["Windows 10"] + "searchScope": [ + "Windows 10" + ] }, "fileMetadata": { - "feedback_system": { - "ue-v/**/*.*": "None", - "cortana-at-work/**/*.*": "None" + "author":{ + "accessibility//**/*.md": "paolomatarazzo", + "accessibility//**/*.yml": "paolomatarazzo", + "assigned-access//**/*.md": "paolomatarazzo", + "assigned-access//**/*.yml": "paolomatarazzo", + "cellular//**/*.md": "paolomatarazzo", + "cellular//**/*.yml": "paolomatarazzo", + "lock-screen//**/*.md": "paolomatarazzo", + "lock-screen//**/*.yml": "paolomatarazzo", + "provisioning-packages//**/*.md": "vinaypamnani-msft", + "provisioning-packages//**/*.yml": "vinaypamnani-msft", + "shared-pc//**/*.md": "paolomatarazzo", + "shared-pc//**/*.yml": "paolomatarazzo", + "start//**/*.md": "paolomatarazzo", + "start//**/*.yml": "paolomatarazzo", + "store//**/*.md": "paolomatarazzo", + "store//**/*.yml": "paolomatarazzo", + "taskbar//**/*.md": "paolomatarazzo", + "taskbar//**/*.yml": "paolomatarazzo", + "tips//**/*.md": "paolomatarazzo", + "tips//**/*.yml": "paolomatarazzo", + "wcd//**/*.md": "vinaypamnani-msft", + "wcd//**/*.yml": "vinaypamnani-msft" + }, + "ms.author":{ + "accessibility//**/*.md": "paoloma", + "accessibility//**/*.yml": "paoloma", + "assigned-access//**/*.md": "paoloma", + "assigned-access//**/*.yml": "paoloma", + "cellular//**/*.md": "paoloma", + "cellular//**/*.yml": "paoloma", + "lock-screen//**/*.md": "paoloma", + "lock-screen//**/*.yml": "paoloma", + "provisioning-packages//**/*.md": "vinpa", + "provisioning-packages//**/*.yml": "vinpa", + "shared-pc//**/*.md": "paoloma", + "shared-pc//**/*.yml": "paoloma", + "start//**/*.md": "paoloma", + "start//**/*.yml": "paoloma", + "store//**/*.md": "paoloma", + "store//**/*.yml": "paoloma", + "taskbar//**/*.md": "paoloma", + "taskbar//**/*.yml": "paoloma", + "tips//**/*.md": "paoloma", + "tips//**/*.yml": "paoloma", + "wcd//**/*.md": "vinpa", + "wcd//**/*.yml": "vinpa" + }, + "ms.reviewer": { + "kiosk//**/*.md": "sybruckm", + "start//**/*.md": "ericpapa" + }, + "ms.collection": { + "wcd//**/*.md": "must-keep" + }, + "appliesto": { + "*/**/*.md": [ + "✅ Windows 11", + "✅ Windows 10" + ], + "wcd//**/*.md": "" } }, "template": [], "dest": "win-configuration", "markdownEngineName": "markdig" } -} +} \ No newline at end of file diff --git a/windows/configuration/find-the-application-user-model-id-of-an-installed-app.md b/windows/configuration/find-the-application-user-model-id-of-an-installed-app.md deleted file mode 100644 index 5b78101494..0000000000 --- a/windows/configuration/find-the-application-user-model-id-of-an-installed-app.md +++ /dev/null @@ -1,145 +0,0 @@ ---- -title: Find the Application User Model ID of an installed app -ms.reviewer: sybruckm -description: To configure assigned access (kiosk mode), you need the Application User Model ID (AUMID) of apps installed on a device. -author: lizgt2000 -ms.author: lizlong -ms.topic: article -ms.date: 12/31/2017 ---- -# Find the Application User Model ID of an installed app - -To configure assigned access (kiosk mode), you need the Application User Model ID (AUMID) of apps installed on a device. You can find the AUMID by using Windows PowerShell, File Explorer, or the registry. - -## To find the AUMID by using Windows PowerShell - -To get the names and AUMIDs for all apps installed for the current user, open a Windows PowerShell command prompt and enter the following command: - -```powershell -Get-StartApps -``` - -To get the names and AUMIDs for Windows Store apps installed for another user, open a Windows PowerShell command prompt and enter the following commands: - -```powershell -$installedapps = Get-AppxPackage - -$aumidList = @() -foreach ($app in $installedapps) -{ - foreach ($id in (Get-AppxPackageManifest $app).package.applications.application.id) - { - $aumidList += $app.packagefamilyname + "!" + $id - } -} - -$aumidList -``` - -You can add the `-user ` or the `-allusers` parameters to the **Get-AppxPackage** cmdlet to list AUMIDs for other users. You must use an elevated Windows PowerShell prompt to use the `-user` or -`allusers` parameters. - -## To find the AUMID by using File Explorer - -To get the names and AUMIDs for all apps installed for the current user, perform the following steps: - -1. Open **Run**, enter **shell:Appsfolder**, and select **OK**. - -2. A File Explorer window opens. Press **Alt** > **View** > **Choose details**. - -3. In the **Choose Details** window, select **AppUserModelId**, and then select **OK**. (You might need to change the **View** setting from **Tiles** to **Details**.) - -![Image of the Choose Details options.](images/aumid-file-explorer.png) - -## To find the AUMID of an installed app for the current user by using the registry - -Querying the registry can only return information about Microsoft Store apps that are installed for the current user, while the Windows PowerShell query can find information for any account on the device. - -At a command prompt, type the following command: - -`reg query HKEY_CURRENT_USER\Software\Classes\ActivatableClasses\Package /s /f AppUserModelID | find "REG_SZ"` - -### Example to get AUMIDs of the installed apps for the specified user - -The following code sample creates a function in Windows PowerShell that returns an array of AUMIDs of the installed apps for the specified user. - -```powershell -function listAumids( $userAccount ) { - - if ($userAccount -eq "allusers") - { - # Find installed packages for all accounts. Must be run as an administrator in order to use this option. - $installedapps = Get-AppxPackage -allusers - } - elseif ($userAccount) - { - # Find installed packages for the specified account. Must be run as an administrator in order to use this option. - $installedapps = Get-AppxPackage -user $userAccount - } - else - { - # Find installed packages for the current account. - $installedapps = Get-AppxPackage - } - - $aumidList = @() - foreach ($app in $installedapps) - { - foreach ($id in (Get-AppxPackageManifest $app).package.applications.application.id) - { - $aumidList += $app.packagefamilyname + "!" + $id - } - } - - return $aumidList -} -``` - -The following Windows PowerShell commands demonstrate how you can call the listAumids function after you've created it. - -```powershell -# Get a list of AUMIDs for the current account: -listAumids - -# Get a list of AUMIDs for an account named "CustomerAccount": -listAumids("CustomerAccount") - -# Get a list of AUMIDs for all accounts on the device: -listAumids("allusers") -``` - -### Example to get the AUMID of any application in the Start menu - -The following code sample creates a function in Windows PowerShell that returns the AUMID of any application currently listed in the Start menu. - -```powershell -function Get-AppAUMID { -param ( -[string]$AppName -) -$Apps = (New-Object -ComObject Shell.Application).NameSpace('shell:::{4234d49b-0245-4df3-b780-3893943456e1}').Items() -if ($AppName){ - $Result = $Apps | Where-Object { $_.name -like "*$AppName*" } | Select-Object name,@{n="AUMID";e={$_.path}} - if ($Result){ - Return $Result - } - else {"Unable to locate {0}" -f $AppName} -} -else { - $Result = $Apps | Select-Object name,@{n="AUMID";e={$_.path}} - Return $Result -} -} -``` - -The following Windows PowerShell commands demonstrate how you can call the Get-AppAUMID function after you've created it. - -```powershell -# Get the AUMID for OneDrive -Get-AppAUMID -AppName OneDrive - -# Get the AUMID for Microsoft Word -Get-AppAUMID -AppName Word - -# List all apps and their AUMID in the Start menu -Get-AppAUMID -``` diff --git a/windows/configuration/guidelines-for-assigned-access-app.md b/windows/configuration/guidelines-for-assigned-access-app.md deleted file mode 100644 index 95bcd1a788..0000000000 --- a/windows/configuration/guidelines-for-assigned-access-app.md +++ /dev/null @@ -1,167 +0,0 @@ ---- -title: Guidelines for choosing an app for assigned access -description: The following guidelines may help you choose an appropriate Windows app for your assigned access experience. -author: lizgt2000 -ms.author: lizlong -ms.topic: article -ms.reviewer: sybruckm -ms.technology: itpro-configure -ms.date: 12/31/2017 ---- - -# Guidelines for choosing an app for assigned access (kiosk mode) - - -**Applies to** - -- Windows 10 -- Windows 11 - - -You can use assigned access to restrict customers at your business to using only one Windows app so your device acts like a kiosk. Administrators can use assigned access to restrict a selected user account to access a single Windows app. You can choose almost any Windows app for assigned access; however, some apps may not provide a good user experience. - -The following guidelines may help you choose an appropriate Windows app for your assigned access experience. - -## General guidelines - -- Windows apps must be provisioned or installed for the assigned access account before they can be selected as the assigned access app. [Learn how to provision and install apps](/windows/client-management/mdm/enterprise-app-management#install_your_apps). - -- Updating a Windows app can sometimes change the Application User Model ID (AUMID) of the app. If this change happens, you must update the assigned access settings to launch the updated app, because assigned access uses the AUMID to determine which app to launch. - -- Apps that are generated using the [Desktop App Converter (Desktop Bridge)](/windows/uwp/porting/desktop-to-uwp-run-desktop-app-converter) can't be used as kiosk apps. - - - - -## Guidelines for Windows apps that launch other apps - -Some Windows apps can launch other apps. Assigned access prevents Windows apps from launching other apps. - -Avoid selecting Windows apps that are designed to launch other apps as part of their core functionality. - -## Guidelines for web browsers - -Starting with Windows 10 version 1809+, Microsoft Edge includes support for kiosk mode. [Learn how to deploy Microsoft Edge kiosk mode.](/microsoft-edge/deploy/microsoft-edge-kiosk-mode-deploy) - -In Windows client, you can install the **Kiosk Browser** app from Microsoft to use as your kiosk app. For digital signage scenarios, you can configure **Kiosk Browser** to navigate to a URL and show only that content -- no navigation buttons, no address bar, etc. For kiosk scenarios, you can configure more settings, such as allowed and blocked URLs, navigation buttons, and end session buttons. For example, you could configure your kiosk to show the online catalog for your store, where customers can navigate between departments and items, but aren't allowed to go to a competitor's website. - ->[!NOTE] ->Kiosk Browser supports a single tab. If a website has links that open a new tab, those links will not work with Kiosk Browser. Kiosk Browser does not support .pdfs. -> ->Kiosk Browser can't access intranet websites. - - -**Kiosk Browser** must be downloaded for offline licensing using Microsoft Store For Business. You can deploy **Kiosk Browser** to devices running Windows 10, version 1803 (Pro, Business, Enterprise, and Education) and Windows 11. - -1. [Get **Kiosk Browser** in Microsoft Store for Business with offline license type.](/microsoft-store/acquire-apps-microsoft-store-for-business#acquire-apps) -2. [Deploy **Kiosk Browser** to kiosk devices.](/microsoft-store/distribute-offline-apps) -3. Configure policies using settings from the Policy Configuration Service Provider (CSP) for [KioskBrowser](/windows/client-management/mdm/policy-csp-kioskbrowser). These settings can be configured using your MDM service provider, or [in a provisioning package](provisioning-packages/provisioning-create-package.md). In Windows Configuration Designer, the settings are located in **Policies > KioskBrowser** when you select advanced provisioning for Windows desktop editions. - ->[!NOTE] ->If you configure the kiosk using a provisioning package, you must apply the provisioning package after the device completes the out-of-box experience (OOBE). - -### Kiosk Browser settings - -Kiosk Browser settings | Use this setting to ---- | --- -Blocked URL Exceptions | Specify URLs that people can navigate to, even though the URL is in your blocked URL list. You can use wildcards.

                        For example, if you want people to be limited to `http://contoso.com` only, you would add `.contoso.com` to blocked URL exception list and then block all other URLs. -Blocked URLs | Specify URLs that people can't navigate to. You can use wildcards.

                        If you want to limit people to a specific site, add `https://*` to the blocked URL list, and then specify the site to be allowed in the blocked URL exceptions list. -Default URL | Specify the URL that Kiosk Browser will open with. **Tip!** Make sure your blocked URLs don't include your default URL. -Enable End Session Button | Show a button in Kiosk Browser that people can use to reset the browser. End Session will clear all browsing data and navigate back to the default URL. -Enable Home Button | Show a Home button in Kiosk Browser. Home will return the browser to the default URL. -Enable Navigation Buttons | Show forward and back buttons in Kiosk Browser. -Restart on Idle Time | Specify when Kiosk Browser should restart in a fresh state after an amount of idle time since the last user interaction. - -> [!IMPORTANT] -> To configure multiple URLs for **Blocked URL Exceptions** or **Blocked URLs** in Windows Configuration Designer: -> -> 1. Create the provisioning package. When ready to export, close the project in Windows Configuration Designer. -> 2. Open the customizations.xml file in the project folder (e.g C:\Users\name\Documents\Windows Imaging and Configuration Designer (WICD)\Project_18). -> 3. Insert the null character string in between each URL (e.g www.bing.com``www.contoso.com). -> 4. Save the XML file. -> 5. Open the project again in Windows Configuration Designer. -> 6. Export the package. Ensure you do not revisit the created policies under Kiosk Browser or else the null character will be removed. -> -> -> [!TIP] -> To enable the **End Session** button for Kiosk Browser in Intune, you must [create a custom OMA-URI policy](/intune/custom-settings-windows-10) with the following information: -> - OMA-URI: ./Vendor/MSFT/Policy/Config/KioskBrowser/EnableEndSessionButton -> - Data type: Integer -> - Value: 1 - - -#### Rules for URLs in Kiosk Browser settings - -Kiosk Browser filtering rules are based on the [Chromium Project](https://www.chromium.org/Home). - -URLs can include: -- A valid port value from 1 to 65,535. -- The path to the resource. -- Query parameters. - -More guidelines for URLs: - -- If a period precedes the host, the policy filters exact host matches only. -- You can't use user:pass fields. -- When both blocked URL and blocked URL exceptions apply with the same path length, the exception takes precedence. -- The policy searches wildcards (*) last. -- The optional query is a set of key-value and key-only tokens delimited by '&'. -- Key-value tokens are separated by '='. -- A query token can optionally end with a '*' to indicate prefix match. Token order is ignored during matching. - -### Examples of blocked URLs and exceptions - -The following table describes the results for different combinations of blocked URLs and blocked URL exceptions. - -Blocked URL rule | Block URL exception rule | Result ---- | --- | --- -`*` | `contoso.com`
                        `fabrikam.com` | All requests are blocked unless it's to contoso.com, fabrikam.com, or any of their subdomains. -`contoso.com` | `mail.contoso.com`
                        `.contoso.com`
                        `.www.contoso.com` | Block all requests to contoso.com, except for the main page and its mail subdomain. -`youtube.com` | `youtube.com/watch?v=v1`
                        `youtube.com/watch?v=v2` | Blocks all access to youtube.com except for the specified videos (v1 and v2). - -The following table gives examples for blocked URLs. - - -| Entry | Result | -|--------------------------|-------------------------------------------------------------------------------| -| `contoso.com` | Blocks all requests to contoso.com, www.contoso.com, and sub.www.contoso.com | -| `https://*` | Blocks all HTTPS requests to any domain. | -| `mail.contoso.com` | Blocks requests to mail.contoso.com but not to www.contoso.com or contoso.com | -| `.contoso.com` | Blocks contoso.com but not its subdomains, like subdomain.contoso.com. | -| `.www.contoso.com` | Blocks www.contoso.com but not its subdomains. | -| `*` | Blocks all requests except for URLs in the Blocked URL Exceptions list. | -| `*:8080` | Blocks all requests to port 8080. | -| `contoso.com/stuff` | Blocks all requests to contoso.com/stuff and its subdomains. | -| `192.168.1.2` | Blocks requests to 192.168.1.2. | -| `youtube.com/watch?v=V1` | Blocks YouTube video with id V1. | - -### Other browsers - - - -You can create your own web browser Windows app by using the WebView class. Learn more about developing your own web browser app: -- [Creating your own browser with HTML and JavaScript](https://blogs.windows.com/msedgedev/2015/08/27/creating-your-own-browser-with-html-and-javascript/) -- [WebView class](/uwp/api/Windows.UI.Xaml.Controls.WebView) -- [A web browser built with JavaScript as a Windows app](https://github.com/MicrosoftEdge/JSBrowser/tree/v1.0) - - - -## Secure your information - -Avoid selecting Windows apps that may expose the information you don't want to show in your kiosk, since kiosk usually means anonymous access and locates in a public setting like a shopping mall. For example, an app that has a file picker allows the user to gain access to files and folders on the user's system, avoid selecting these types of apps if they provide unnecessary data access. - -## App configuration - -Some apps may require more configurations before they can be used appropriately in assigned access. For example, Microsoft OneNote requires you to set up a Microsoft account for the assigned access user account before OneNote will open in assigned access. - -Check the guidelines published by your selected app and set up accordingly. - -## Develop your kiosk app - -Assigned access in Windows client uses the new lock framework. When an assigned access user signs in, the selected kiosk app is launched above the lock screen. The kiosk app is running as an above lock screen app. - -Follow the [best practices guidance for developing a kiosk app for assigned access](/windows-hardware/drivers/partnerapps/create-a-kiosk-app-for-assigned-access). - -## Test your assigned access experience - -The above guidelines may help you select or develop an appropriate Windows app for your assigned access experience. Once you've selected your app, we recommend that you thoroughly test the assigned access experience to ensure that your device provides a good customer experience. diff --git a/windows/configuration/images/ICD.png b/windows/configuration/images/ICD.png deleted file mode 100644 index 9cfcb845df..0000000000 Binary files a/windows/configuration/images/ICD.png and /dev/null differ diff --git a/windows/configuration/images/admx-category.PNG b/windows/configuration/images/admx-category.PNG deleted file mode 100644 index 465dd53fe3..0000000000 Binary files a/windows/configuration/images/admx-category.PNG and /dev/null differ diff --git a/windows/configuration/images/admx-policy.PNG b/windows/configuration/images/admx-policy.PNG deleted file mode 100644 index c3c7b9a088..0000000000 Binary files a/windows/configuration/images/admx-policy.PNG and /dev/null differ diff --git a/windows/configuration/images/apprule.png b/windows/configuration/images/apprule.png deleted file mode 100644 index ec5417849a..0000000000 Binary files a/windows/configuration/images/apprule.png and /dev/null differ diff --git a/windows/configuration/images/appwarning.png b/windows/configuration/images/appwarning.png deleted file mode 100644 index 877d8afebd..0000000000 Binary files a/windows/configuration/images/appwarning.png and /dev/null differ diff --git a/windows/configuration/images/aumid-file-explorer.png b/windows/configuration/images/aumid-file-explorer.png deleted file mode 100644 index 87bc7166a3..0000000000 Binary files a/windows/configuration/images/aumid-file-explorer.png and /dev/null differ diff --git a/windows/configuration/images/auto-signin.png b/windows/configuration/images/auto-signin.png deleted file mode 100644 index 260376199e..0000000000 Binary files a/windows/configuration/images/auto-signin.png and /dev/null differ diff --git a/windows/configuration/images/cortana-connect-uber.png b/windows/configuration/images/cortana-connect-uber.png deleted file mode 100644 index 724fecb5b5..0000000000 Binary files a/windows/configuration/images/cortana-connect-uber.png and /dev/null differ diff --git a/windows/configuration/images/customization-start-edge.PNG b/windows/configuration/images/customization-start-edge.PNG deleted file mode 100644 index 333833d8c0..0000000000 Binary files a/windows/configuration/images/customization-start-edge.PNG and /dev/null differ diff --git a/windows/configuration/images/customization-start.PNG b/windows/configuration/images/customization-start.PNG deleted file mode 100644 index 4942338181..0000000000 Binary files a/windows/configuration/images/customization-start.PNG and /dev/null differ diff --git a/windows/configuration/images/customize-start-menu-layout-windows-11/endpoint-manager-admin-center-custom-oma-uri-start-layout.png b/windows/configuration/images/customize-start-menu-layout-windows-11/endpoint-manager-admin-center-custom-oma-uri-start-layout.png deleted file mode 100644 index cd508b3dea..0000000000 Binary files a/windows/configuration/images/customize-start-menu-layout-windows-11/endpoint-manager-admin-center-custom-oma-uri-start-layout.png and /dev/null differ diff --git a/windows/configuration/images/customize-start-menu-layout-windows-11/start-menu-layout.png b/windows/configuration/images/customize-start-menu-layout-windows-11/start-menu-layout.png deleted file mode 100644 index ca0cbd51cc..0000000000 Binary files a/windows/configuration/images/customize-start-menu-layout-windows-11/start-menu-layout.png and /dev/null differ diff --git a/windows/configuration/images/customize-taskbar-windows-11/start-layout-group-policy.png b/windows/configuration/images/customize-taskbar-windows-11/start-layout-group-policy.png deleted file mode 100644 index 99252bd139..0000000000 Binary files a/windows/configuration/images/customize-taskbar-windows-11/start-layout-group-policy.png and /dev/null differ diff --git a/windows/configuration/images/edge-with-logo.png b/windows/configuration/images/edge-with-logo.png deleted file mode 100644 index cc3504a678..0000000000 Binary files a/windows/configuration/images/edge-with-logo.png and /dev/null differ diff --git a/windows/configuration/images/edge-without-logo.png b/windows/configuration/images/edge-without-logo.png deleted file mode 100644 index 52085a2d68..0000000000 Binary files a/windows/configuration/images/edge-without-logo.png and /dev/null differ diff --git a/windows/configuration/images/enable-assigned-access-log.png b/windows/configuration/images/enable-assigned-access-log.png deleted file mode 100644 index d16f04c43a..0000000000 Binary files a/windows/configuration/images/enable-assigned-access-log.png and /dev/null differ diff --git a/windows/configuration/images/funfacts.png b/windows/configuration/images/funfacts.png deleted file mode 100644 index 71355ec370..0000000000 Binary files a/windows/configuration/images/funfacts.png and /dev/null differ diff --git a/windows/configuration/images/genrule.png b/windows/configuration/images/genrule.png deleted file mode 100644 index 1d68f1ad0b..0000000000 Binary files a/windows/configuration/images/genrule.png and /dev/null differ diff --git a/windows/configuration/images/icons/accessibility.svg b/windows/configuration/images/icons/accessibility.svg new file mode 100644 index 0000000000..21a6b4f235 --- /dev/null +++ b/windows/configuration/images/icons/accessibility.svg @@ -0,0 +1,3 @@ + + + \ No newline at end of file diff --git a/windows/configuration/images/icons/allapps.svg b/windows/configuration/images/icons/allapps.svg new file mode 100644 index 0000000000..dbcdff6268 --- /dev/null +++ b/windows/configuration/images/icons/allapps.svg @@ -0,0 +1,3 @@ + + + diff --git a/windows/configuration/images/icons/certificate.svg b/windows/configuration/images/icons/certificate.svg new file mode 100644 index 0000000000..956bfc1e42 --- /dev/null +++ b/windows/configuration/images/icons/certificate.svg @@ -0,0 +1,3 @@ + + + diff --git a/windows/configuration/images/icons/cmd.svg b/windows/configuration/images/icons/cmd.svg new file mode 100644 index 0000000000..e712a4fff5 --- /dev/null +++ b/windows/configuration/images/icons/cmd.svg @@ -0,0 +1,9 @@ + + + + + + + + + diff --git a/windows/configuration/images/icons/control-panel.svg b/windows/configuration/images/icons/control-panel.svg new file mode 100644 index 0000000000..6eebbe9be8 --- /dev/null +++ b/windows/configuration/images/icons/control-panel.svg @@ -0,0 +1,9 @@ + + + + + + + + + diff --git a/windows/configuration/images/icons/explorer.svg b/windows/configuration/images/icons/explorer.svg new file mode 100644 index 0000000000..070605d32b --- /dev/null +++ b/windows/configuration/images/icons/explorer.svg @@ -0,0 +1,88 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/windows/configuration/images/icons/face.svg b/windows/configuration/images/icons/face.svg new file mode 100644 index 0000000000..a4fa1ca0df --- /dev/null +++ b/windows/configuration/images/icons/face.svg @@ -0,0 +1,3 @@ + + + diff --git a/windows/configuration/images/icons/fingerprint.svg b/windows/configuration/images/icons/fingerprint.svg new file mode 100644 index 0000000000..2494d65659 --- /dev/null +++ b/windows/configuration/images/icons/fingerprint.svg @@ -0,0 +1,3 @@ + + + diff --git a/windows/configuration/images/icons/folder.svg b/windows/configuration/images/icons/folder.svg new file mode 100644 index 0000000000..468edaf961 --- /dev/null +++ b/windows/configuration/images/icons/folder.svg @@ -0,0 +1,3 @@ + + + diff --git a/windows/configuration/images/icons/group-policy.svg b/windows/configuration/images/icons/group-policy.svg new file mode 100644 index 0000000000..e6ec2d2c2e --- /dev/null +++ b/windows/configuration/images/icons/group-policy.svg @@ -0,0 +1,14 @@ + + + + + + + + + + + + + + diff --git a/windows/configuration/images/icons/information.svg b/windows/configuration/images/icons/information.svg new file mode 100644 index 0000000000..4a33944103 --- /dev/null +++ b/windows/configuration/images/icons/information.svg @@ -0,0 +1,3 @@ + + + diff --git a/windows/configuration/images/icons/insider.svg b/windows/configuration/images/icons/insider.svg new file mode 100644 index 0000000000..fa002fa2a1 --- /dev/null +++ b/windows/configuration/images/icons/insider.svg @@ -0,0 +1,3 @@ + + + diff --git a/windows/configuration/images/icons/intune.svg b/windows/configuration/images/icons/intune.svg index 6e0d938aed..22148b48fb 100644 --- a/windows/configuration/images/icons/intune.svg +++ b/windows/configuration/images/icons/intune.svg @@ -1,24 +1,23 @@ - - - - - - - - - - - - - - - - Icon-intune-329 - - - - - - - - \ No newline at end of file + + + + + + + + + + + + + + + + + + + + + + + diff --git a/windows/configuration/images/icons/iris.svg b/windows/configuration/images/icons/iris.svg new file mode 100644 index 0000000000..465902e0b3 --- /dev/null +++ b/windows/configuration/images/icons/iris.svg @@ -0,0 +1,3 @@ + + + diff --git a/windows/configuration/images/icons/kiosk.svg b/windows/configuration/images/icons/kiosk.svg new file mode 100644 index 0000000000..f975677d19 --- /dev/null +++ b/windows/configuration/images/icons/kiosk.svg @@ -0,0 +1,3 @@ + + + diff --git a/windows/configuration/images/icons/lock.svg b/windows/configuration/images/icons/lock.svg new file mode 100644 index 0000000000..ccd1850fbb --- /dev/null +++ b/windows/configuration/images/icons/lock.svg @@ -0,0 +1,3 @@ + + + diff --git a/windows/configuration/images/icons/notification.svg b/windows/configuration/images/icons/notification.svg new file mode 100644 index 0000000000..0da0f9814d --- /dev/null +++ b/windows/configuration/images/icons/notification.svg @@ -0,0 +1,3 @@ + + + diff --git a/windows/configuration/images/icons/package.svg b/windows/configuration/images/icons/package.svg new file mode 100644 index 0000000000..99c1148922 --- /dev/null +++ b/windows/configuration/images/icons/package.svg @@ -0,0 +1,3 @@ + + + diff --git a/windows/configuration/images/icons/pin-code.svg b/windows/configuration/images/icons/pin-code.svg new file mode 100644 index 0000000000..a5bfdc4148 --- /dev/null +++ b/windows/configuration/images/icons/pin-code.svg @@ -0,0 +1,3 @@ + + + diff --git a/windows/configuration/images/icons/pin.svg b/windows/configuration/images/icons/pin.svg new file mode 100644 index 0000000000..64426df32c --- /dev/null +++ b/windows/configuration/images/icons/pin.svg @@ -0,0 +1,3 @@ + + + diff --git a/windows/configuration/images/icons/power.svg b/windows/configuration/images/icons/power.svg new file mode 100644 index 0000000000..e74606b72c --- /dev/null +++ b/windows/configuration/images/icons/power.svg @@ -0,0 +1,3 @@ + + + diff --git a/windows/configuration/images/icons/powershell.svg b/windows/configuration/images/icons/powershell.svg index ab2d5152ca..3d90e2ff6f 100644 --- a/windows/configuration/images/icons/powershell.svg +++ b/windows/configuration/images/icons/powershell.svg @@ -1,20 +1,9 @@ - - - - - - - - - - MsPortalFx.base.images-10 - - - - - - - - - - \ No newline at end of file + + + + + + + + + diff --git a/windows/configuration/images/icons/registry.svg b/windows/configuration/images/icons/registry.svg new file mode 100644 index 0000000000..667bce7438 --- /dev/null +++ b/windows/configuration/images/icons/registry.svg @@ -0,0 +1,9 @@ + + + + + + + + + diff --git a/windows/configuration/images/icons/rocket.svg b/windows/configuration/images/icons/rocket.svg new file mode 100644 index 0000000000..ee39fb57aa --- /dev/null +++ b/windows/configuration/images/icons/rocket.svg @@ -0,0 +1,155 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/windows/configuration/images/icons/sc.svg b/windows/configuration/images/icons/sc.svg new file mode 100644 index 0000000000..d1924ffebb --- /dev/null +++ b/windows/configuration/images/icons/sc.svg @@ -0,0 +1,3 @@ + + + diff --git a/windows/configuration/images/icons/settings-app.svg b/windows/configuration/images/icons/settings-app.svg new file mode 100644 index 0000000000..d62d13fb54 --- /dev/null +++ b/windows/configuration/images/icons/settings-app.svg @@ -0,0 +1,24 @@ + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/windows/configuration/images/icons/settings.svg b/windows/configuration/images/icons/settings.svg new file mode 100644 index 0000000000..36da6757f2 --- /dev/null +++ b/windows/configuration/images/icons/settings.svg @@ -0,0 +1,3 @@ + + + diff --git a/windows/configuration/images/icons/start.svg b/windows/configuration/images/icons/start.svg new file mode 100644 index 0000000000..a3e6c3d8e8 --- /dev/null +++ b/windows/configuration/images/icons/start.svg @@ -0,0 +1,3 @@ + + + diff --git a/windows/configuration/images/icons/subscription.svg b/windows/configuration/images/icons/subscription.svg new file mode 100644 index 0000000000..ffa73c424e --- /dev/null +++ b/windows/configuration/images/icons/subscription.svg @@ -0,0 +1,3 @@ + + + diff --git a/windows/configuration/images/icons/taskbar.svg b/windows/configuration/images/icons/taskbar.svg new file mode 100644 index 0000000000..1a5a54d980 --- /dev/null +++ b/windows/configuration/images/icons/taskbar.svg @@ -0,0 +1,3 @@ + + + diff --git a/windows/configuration/images/icons/touch.svg b/windows/configuration/images/icons/touch.svg new file mode 100644 index 0000000000..886e616e56 --- /dev/null +++ b/windows/configuration/images/icons/touch.svg @@ -0,0 +1,3 @@ + + + diff --git a/windows/configuration/images/icons/user.svg b/windows/configuration/images/icons/user.svg new file mode 100644 index 0000000000..76c0b2ce5d --- /dev/null +++ b/windows/configuration/images/icons/user.svg @@ -0,0 +1,3 @@ + + + diff --git a/windows/configuration/images/icons/vsc.svg b/windows/configuration/images/icons/vsc.svg new file mode 100644 index 0000000000..cbf23de89e --- /dev/null +++ b/windows/configuration/images/icons/vsc.svg @@ -0,0 +1,3 @@ + + + diff --git a/windows/configuration/images/kiosk-account-details.PNG b/windows/configuration/images/kiosk-account-details.PNG deleted file mode 100644 index 53c31880ea..0000000000 Binary files a/windows/configuration/images/kiosk-account-details.PNG and /dev/null differ diff --git a/windows/configuration/images/kiosk-common-details.PNG b/windows/configuration/images/kiosk-common-details.PNG deleted file mode 100644 index 5eda9b293e..0000000000 Binary files a/windows/configuration/images/kiosk-common-details.PNG and /dev/null differ diff --git a/windows/configuration/images/kiosk-desktop.PNG b/windows/configuration/images/kiosk-desktop.PNG deleted file mode 100644 index cf74c646c7..0000000000 Binary files a/windows/configuration/images/kiosk-desktop.PNG and /dev/null differ diff --git a/windows/configuration/images/kiosk-fullscreen-sm.png b/windows/configuration/images/kiosk-fullscreen-sm.png deleted file mode 100644 index b096d6837d..0000000000 Binary files a/windows/configuration/images/kiosk-fullscreen-sm.png and /dev/null differ diff --git a/windows/configuration/images/kiosk-fullscreen.PNG b/windows/configuration/images/kiosk-fullscreen.PNG deleted file mode 100644 index 37ccd4f8a4..0000000000 Binary files a/windows/configuration/images/kiosk-fullscreen.PNG and /dev/null differ diff --git a/windows/configuration/images/kiosk-settings.PNG b/windows/configuration/images/kiosk-settings.PNG deleted file mode 100644 index 51a4338371..0000000000 Binary files a/windows/configuration/images/kiosk-settings.PNG and /dev/null differ diff --git a/windows/configuration/images/kiosk-wizard.png b/windows/configuration/images/kiosk-wizard.png deleted file mode 100644 index 160e170e5c..0000000000 Binary files a/windows/configuration/images/kiosk-wizard.png and /dev/null differ diff --git a/windows/configuration/images/kiosk.png b/windows/configuration/images/kiosk.png deleted file mode 100644 index 868ea31bb1..0000000000 Binary files a/windows/configuration/images/kiosk.png and /dev/null differ diff --git a/windows/configuration/images/lockdownapps.png b/windows/configuration/images/lockdownapps.png deleted file mode 100644 index beb73e5370..0000000000 Binary files a/windows/configuration/images/lockdownapps.png and /dev/null differ diff --git a/windows/configuration/images/lockscreen.png b/windows/configuration/images/lockscreen.png deleted file mode 100644 index 68c64e15ec..0000000000 Binary files a/windows/configuration/images/lockscreen.png and /dev/null differ diff --git a/windows/configuration/images/lockscreenpolicy.png b/windows/configuration/images/lockscreenpolicy.png deleted file mode 100644 index 30b6a7ae9d..0000000000 Binary files a/windows/configuration/images/lockscreenpolicy.png and /dev/null differ diff --git a/windows/configuration/images/multiappassignedaccesssettings.png b/windows/configuration/images/multiappassignedaccesssettings.png deleted file mode 100644 index 86e2e0a451..0000000000 Binary files a/windows/configuration/images/multiappassignedaccesssettings.png and /dev/null differ diff --git a/windows/configuration/images/office-logo.png b/windows/configuration/images/office-logo.png deleted file mode 100644 index cd6d504301..0000000000 Binary files a/windows/configuration/images/office-logo.png and /dev/null differ diff --git a/windows/configuration/images/profile-config.png b/windows/configuration/images/profile-config.png deleted file mode 100644 index 24a4dad4ab..0000000000 Binary files a/windows/configuration/images/profile-config.png and /dev/null differ diff --git a/windows/configuration/images/sample-start.png b/windows/configuration/images/sample-start.png deleted file mode 100644 index 8ef9cc928c..0000000000 Binary files a/windows/configuration/images/sample-start.png and /dev/null differ diff --git a/windows/configuration/images/set-assignedaccess.png b/windows/configuration/images/set-assignedaccess.png deleted file mode 100644 index c2899361eb..0000000000 Binary files a/windows/configuration/images/set-assignedaccess.png and /dev/null differ diff --git a/windows/configuration/images/set-up-device-details.PNG b/windows/configuration/images/set-up-device-details.PNG deleted file mode 100644 index 031dac6fe6..0000000000 Binary files a/windows/configuration/images/set-up-device-details.PNG and /dev/null differ diff --git a/windows/configuration/images/set-up-network-details.PNG b/windows/configuration/images/set-up-network-details.PNG deleted file mode 100644 index 778b8497c4..0000000000 Binary files a/windows/configuration/images/set-up-network-details.PNG and /dev/null differ diff --git a/windows/configuration/images/slv2-oma-uri.png b/windows/configuration/images/slv2-oma-uri.png deleted file mode 100644 index 98ee252b63..0000000000 Binary files a/windows/configuration/images/slv2-oma-uri.png and /dev/null differ diff --git a/windows/configuration/images/spotlight.png b/windows/configuration/images/spotlight.png deleted file mode 100644 index 515269740b..0000000000 Binary files a/windows/configuration/images/spotlight.png and /dev/null differ diff --git a/windows/configuration/images/start-pinned-app.png b/windows/configuration/images/start-pinned-app.png deleted file mode 100644 index e1e4a24a00..0000000000 Binary files a/windows/configuration/images/start-pinned-app.png and /dev/null differ diff --git a/windows/configuration/images/startannotated.png b/windows/configuration/images/startannotated.png deleted file mode 100644 index 9261fd9078..0000000000 Binary files a/windows/configuration/images/startannotated.png and /dev/null differ diff --git a/windows/configuration/images/startlayoutpolicy.jpg b/windows/configuration/images/startlayoutpolicy.jpg deleted file mode 100644 index d3c8d054fe..0000000000 Binary files a/windows/configuration/images/startlayoutpolicy.jpg and /dev/null differ diff --git a/windows/configuration/images/starttemplate.jpg b/windows/configuration/images/starttemplate.jpg deleted file mode 100644 index 900eed08c5..0000000000 Binary files a/windows/configuration/images/starttemplate.jpg and /dev/null differ diff --git a/windows/configuration/images/taskbar-default-plus.png b/windows/configuration/images/taskbar-default-plus.png deleted file mode 100644 index 8afcebac09..0000000000 Binary files a/windows/configuration/images/taskbar-default-plus.png and /dev/null differ diff --git a/windows/configuration/images/taskbar-default-removed.png b/windows/configuration/images/taskbar-default-removed.png deleted file mode 100644 index b3ff924e9f..0000000000 Binary files a/windows/configuration/images/taskbar-default-removed.png and /dev/null differ diff --git a/windows/configuration/images/taskbar-default.png b/windows/configuration/images/taskbar-default.png deleted file mode 100644 index 41c6c72258..0000000000 Binary files a/windows/configuration/images/taskbar-default.png and /dev/null differ diff --git a/windows/configuration/images/taskbar-generic.png b/windows/configuration/images/taskbar-generic.png deleted file mode 100644 index 6d47a6795a..0000000000 Binary files a/windows/configuration/images/taskbar-generic.png and /dev/null differ diff --git a/windows/configuration/images/taskbar-region-defr.png b/windows/configuration/images/taskbar-region-defr.png deleted file mode 100644 index 6d707b16f4..0000000000 Binary files a/windows/configuration/images/taskbar-region-defr.png and /dev/null differ diff --git a/windows/configuration/images/taskbar-region-other.png b/windows/configuration/images/taskbar-region-other.png deleted file mode 100644 index fab367ef7a..0000000000 Binary files a/windows/configuration/images/taskbar-region-other.png and /dev/null differ diff --git a/windows/configuration/images/taskbar-region-usuk.png b/windows/configuration/images/taskbar-region-usuk.png deleted file mode 100644 index 6bba65ee81..0000000000 Binary files a/windows/configuration/images/taskbar-region-usuk.png and /dev/null differ diff --git a/windows/configuration/images/user.PNG b/windows/configuration/images/user.PNG deleted file mode 100644 index d1386d4a0d..0000000000 Binary files a/windows/configuration/images/user.PNG and /dev/null differ diff --git a/windows/configuration/images/vm-kiosk-connect.png b/windows/configuration/images/vm-kiosk-connect.png deleted file mode 100644 index 2febd9d573..0000000000 Binary files a/windows/configuration/images/vm-kiosk-connect.png and /dev/null differ diff --git a/windows/configuration/images/vm-kiosk.png b/windows/configuration/images/vm-kiosk.png deleted file mode 100644 index 59f01c1348..0000000000 Binary files a/windows/configuration/images/vm-kiosk.png and /dev/null differ diff --git a/windows/configuration/images/windows.png b/windows/configuration/images/windows.png deleted file mode 100644 index e3889eff6a..0000000000 Binary files a/windows/configuration/images/windows.png and /dev/null differ diff --git a/windows/configuration/includes/multi-app-kiosk-support-windows11.md b/windows/configuration/includes/multi-app-kiosk-support-windows11.md deleted file mode 100644 index 7f90909404..0000000000 --- a/windows/configuration/includes/multi-app-kiosk-support-windows11.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -author: aczechowski -ms.author: aaroncz -ms.date: 09/21/2021 -ms.reviewer: -manager: aaroncz -ms.prod: w10 -ms.topic: include ---- - -Currently, multi-app kiosk is only supported on Windows 10. It's not supported on Windows 11. diff --git a/windows/configuration/index.yml b/windows/configuration/index.yml index 6eff88270a..fa1a297ecf 100644 --- a/windows/configuration/index.yml +++ b/windows/configuration/index.yml @@ -1,90 +1,103 @@ ### YamlMime:Landing - -title: Configure Windows client # < 60 chars -summary: Find out how to apply custom configurations to Windows client devices. Windows provides many features and methods to help you configure or lock down specific parts of Windows client. # < 160 chars +title: Configure Windows client +summary: Learn how to apply custom configurations to Windows client devices. metadata: - title: Configure Windows client # Required; page title displayed in search results. Include the brand. < 60 chars. - description: Find out how to apply custom configurations to Windows client devices. # Required; article description that is displayed in search results. < 160 chars. - ms.topic: landing-page # Required - ms.prod: windows-client + title: Configure Windows client + description: Learn how to apply custom configurations to Windows client devices. + ms.topic: landing-page ms.collection: - tier1 - author: aczechowski - ms.author: aaroncz + author: paolomatarazzo + ms.author: paoloma manager: aaroncz - ms.date: 08/05/2021 #Required; mm/dd/yyyy format. - localization_priority: medium - + ms.date: 04/25/2024 + # linkListType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | tutorial | video | whats-new landingContent: -# Cards and links should be based on top customer tasks or top subjects -# Start card title with a verb - # Card (optional) - - title: Manage Windows client settings + + - title: Customize the appearance linkLists: - - linkListType: overview + - linkListType: how-to-guide links: - - text: Manage the Windows 10 Start and taskbar layout - url: windows-10-start-layout-options-and-policies.md - - text: Configure Windows Spotlight on the lock screen - url: windows-spotlight.md - - text: Customize the Windows 10 Start and taskbar with Group Policy - url: customize-windows-10-start-screens-by-using-group-policy.md + - text: Configure the Start menu + url: start/index.md + - text: Customize the Taskbar + url: taskbar/index.md + - text: Configure Windows spotlight + url: windows-spotlight/index.md + - text: Accessibility information for IT pros + url: accessibility/index.md + - linkListType: reference + links: + - text: Start policy settings + url: start/policy-settings.md - - # Card (optional) - - title: Configure a Windows kiosk + - title: Kiosks and restricted user experiences linkLists: - - linkListType: overview + - linkListType: concept links: - - text: Guidelines for choosing an app for assigned access - url: guidelines-for-assigned-access-app.md - - text: Set up a single-app kiosk - url: kiosk-single-app.md - - text: Set up a multi-app kiosk - url: lock-down-windows-10-to-specific-apps.md + - text: What is Assigned Access? + url: assigned-access/overview.md + - text: What is Shell Launcher? + url: assigned-access/shell-launcher/index.md + - linkListType: how-to-guide + links: + - text: Configure kiosks and restricted user experiences + url: assigned-access/index.md + - linkListType: quickstart + links: + - text: Configure a kiosk with Assigned Access + url: assigned-access/quickstart-kiosk.md + - text: Configure a kiosk with Shell Launcher + url: assigned-access/shell-launcher/quickstart-kiosk.md + - text: Configure a restricted user experience with Assigned Access + url: assigned-access/quickstart-restricted-user-experience.md + - linkListType: reference + links: + - text: Assigned Access XML Schema Definition (XSD) + url: assigned-access/xsd.md + - text: Shell Launcher XML Schema Definition (XSD) + url: assigned-access/shell-launcher/xsd.md - - # Card (optional) - - title: Windows client provisioning packages + - title: Configure shared devices linkLists: - - linkListType: overview + - linkListType: concept links: + - text: Shared devices concepts + url: /windows/configuration/shared-pc/shared-devices-concepts + - linkListType: how-to-guide + links: + - text: Configure a shared or guest Windows device + url: /windows/configuration/shared-pc/set-up-shared-or-guest-pc + - linkListType: reference + links: + - text: Shared PC technical reference + url: /windows/configuration/shared-pc/shared-pc-technical + + - title: Use provisioning packages + linkLists: + - linkListType: how-to-guide + links: + - text: Provisioning packages overview + url: provisioning-packages/provisioning-packages.md - text: Install Windows Configuration Designer url: provisioning-packages/provisioning-install-icd.md - - text: Provisioning packages for Windows 10 - url: provisioning-packages/provisioning-packages.md + - text: Create a provisioning package + url: provisioning-packages/provisioning-create-package.md + - text: Apply a provisioning package + url: provisioning-packages/provisioning-apply-package.md - # Card (optional) - title: Use Windows Configuration Designer (WCD) linkLists: - - linkListType: overview + - linkListType: reference links: - text: Windows Configuration Designer (WCD) reference url: wcd/wcd.md - - text: WCD policies reference + - text: Policies url: wcd/wcd-policies.md - - text: WCD OOBE reference - url: wcd/wcd-oobe.md - - # Card (optional) - - title: Configure Cortana in Windows client - linkLists: - - linkListType: overview - links: - - text: Configure Cortana in Windows 10 - url: cortana-at-work/cortana-at-work-overview.md - - text: Custom voice commands in Cortana - url: cortana-at-work/cortana-at-work-voice-commands.md - - # Card (optional) - - title: User Experience Virtualization (UE-V) for Windows client - linkLists: - - linkListType: overview - links: - - text: UE-V for Windows 10 overview - url: ue-v/uev-for-windows.md - - text: Get Started with UE-V - url: ue-v/uev-getting-started.md \ No newline at end of file + - text: ProvisioningCommands + url: wcd/wcd-provisioningcommands.md + - text: Accounts + url: wcd/wcd-accounts.md diff --git a/windows/configuration/kiosk-additional-reference.md b/windows/configuration/kiosk-additional-reference.md deleted file mode 100644 index 91f7ece2cf..0000000000 --- a/windows/configuration/kiosk-additional-reference.md +++ /dev/null @@ -1,36 +0,0 @@ ---- -title: More kiosk methods and reference information (Windows 10/11) -description: Find more information for configuring, validating, and troubleshooting kiosk configuration. -ms.reviewer: sybruckm -manager: aaroncz -ms.author: lizlong -ms.prod: windows-client -author: lizgt2000 -ms.localizationpriority: medium -ms.topic: reference -ms.technology: itpro-configure -ms.date: 12/31/2017 ---- - -# More kiosk methods and reference information - - -**Applies to** - -- Windows 10 Pro, Enterprise, and Education -- Windows 11 - - -## In this section - -Topic | Description ---- | --- -[Find the Application User Model ID of an installed app](find-the-application-user-model-id-of-an-installed-app.md) | This topic explains how to get the AUMID for an app. -[Validate your kiosk configuration](kiosk-validate.md) | This topic explains what to expect on a multi-app kiosk. -[Guidelines for choosing an app for assigned access (kiosk mode)](guidelines-for-assigned-access-app.md) | These guidelines will help you choose an appropriate Windows app for your assigned access experience. -[Policies enforced on kiosk devices](kiosk-policies.md) | Learn about the policies enforced on a device when you configure it as a kiosk. -[Assigned access XML reference](kiosk-xml.md) | The XML and XSD for kiosk device configuration. -[Use AppLocker to create a Windows client kiosk](lock-down-windows-10-applocker.md) | Learn how to use AppLocker to configure a Windows client kiosk device running Enterprise or Education so that users can only run a few specific apps. -[Use Shell Launcher to create a Windows client kiosk](kiosk-shelllauncher.md) | Using Shell Launcher, you can configure a kiosk device that runs a Windows application as the user interface. -[Use MDM Bridge WMI Provider to create a Windows client kiosk](kiosk-mdm-bridge.md) | Environments that use Windows Management Instrumentation (WMI) can use the MDM Bridge WMI Provider to configure the MDM_AssignedAccess class. -[Troubleshoot kiosk mode issues](/troubleshoot/windows-client/shell-experience/kiosk-mode-issues-troubleshooting) | Tips for troubleshooting multi-app kiosk configuration. \ No newline at end of file diff --git a/windows/configuration/kiosk-mdm-bridge.md b/windows/configuration/kiosk-mdm-bridge.md deleted file mode 100644 index 4b2f8a1fe8..0000000000 --- a/windows/configuration/kiosk-mdm-bridge.md +++ /dev/null @@ -1,144 +0,0 @@ ---- -title: Use MDM Bridge WMI Provider to create a Windows 10/11 kiosk (Windows 10/11) -description: Environments that use Windows Management Instrumentation (WMI) can use the MDM Bridge WMI Provider to configure the MDM_AssignedAccess class. -ms.reviewer: sybruckm -manager: aaroncz -ms.author: lizlong -ms.prod: windows-client -author: lizgt2000 -ms.localizationpriority: medium -ms.topic: article -ms.technology: itpro-configure -ms.date: 12/31/2017 ---- - -# Use MDM Bridge WMI Provider to create a Windows client kiosk - - -**Applies to** - -- Windows 10 Pro, Enterprise, and Education -- Windows 11 - -Environments that use [Windows Management Instrumentation (WMI)](/windows/win32/wmisdk/wmi-start-page) can use the [MDM Bridge WMI Provider](/windows/win32/dmwmibridgeprov/mdm-bridge-wmi-provider-portal) to configure the MDM_AssignedAccess class. For more information about using a PowerShell script to configure AssignedAccess, see [PowerShell Scripting with WMI Bridge Provider](/windows/client-management/mdm/using-powershell-scripting-with-the-wmi-bridge-provider). - -Here's an example to set AssignedAccess configuration: - -1. Download the [psexec tool](/sysinternals/downloads/psexec). -2. Run `psexec.exe -i -s cmd.exe`. -3. In the command prompt launched by psexec.exe, enter `powershell.exe` to open PowerShell. - -Step 4 is different for Windows 10 or Windows 11 - -4. Execute the following script for Windows 10: - -```xml -$nameSpaceName="root\cimv2\mdm\dmmap" -$className="MDM_AssignedAccess" -$obj = Get-CimInstance -Namespace $namespaceName -ClassName $className -Add-Type -AssemblyName System.Web -$obj.Configuration = [System.Web.HttpUtility]::HtmlEncode(@" - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ]]> - - - - - - - MultiAppKioskUser - - - - -"@) - -Set-CimInstance -CimInstance $obj -``` -4. Execute the following script for Windows 11: - - ```xml -$nameSpaceName="root\cimv2\mdm\dmmap" -$className="MDM_AssignedAccess" -$obj = Get-CimInstance -Namespace $namespaceName -ClassName $className -Add-Type -AssemblyName System.Web -$obj.Configuration = [System.Web.HttpUtility]::HtmlEncode(@" - - - - - - - - - - - - - - - - - - - - - - - - - MultiAppKioskUser - - - - -"@) - -Set-CimInstance -CimInstance $obj -``` \ No newline at end of file diff --git a/windows/configuration/kiosk-methods.md b/windows/configuration/kiosk-methods.md deleted file mode 100644 index 7dc2ae5f02..0000000000 --- a/windows/configuration/kiosk-methods.md +++ /dev/null @@ -1,120 +0,0 @@ ---- -title: Configure kiosks and digital signs on Windows 10/11 desktop editions -ms.reviewer: sybruckm -manager: aaroncz -ms.author: lizlong -description: In this article, learn about the methods for configuring kiosks and digital signs on Windows 10 or Windows 11 desktop editions. -ms.prod: windows-client -ms.localizationpriority: medium -author: lizgt2000 -ms.topic: article -ms.technology: itpro-configure -ms.date: 12/31/2017 ---- - -# Configure kiosks and digital signs on Windows desktop editions - ->[!WARNING] ->Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - -**Applies to** - -- Windows 10 -- Windows 11 - -Some desktop devices in an enterprise serve a special purpose. For example, a PC in the lobby that customers use to see your product catalog. Or, a PC displaying visual content as a digital sign. Windows client offers two different locked-down experiences for public or specialized use: - -- **A single-app kiosk**: Runs a single Universal Windows Platform (UWP) app in full screen above the lock screen. People using the kiosk can see only that app. When the kiosk account (a local standard user account) signs in, the kiosk app will launch automatically, and you can configure the kiosk account to sign in automatically as well. If the kiosk app is closed, it will automatically restart. - - A single-app kiosk is ideal for public use. Using [Shell Launcher](kiosk-shelllauncher.md), you can configure a kiosk device that runs a Windows desktop application as the user interface. The application that you specify replaces the default shell (explorer.exe) that usually runs when a user logs on. This type of single-app kiosk doesn't run above the lock screen. - - ![Illustration of a full-screen kiosk experience that runs one app on a Windows client device.](images/kiosk-fullscreen.png) - -- **A multi-app kiosk**: Runs one or more apps from the desktop. People using the kiosk see a customized Start that shows only the tiles for the apps that are allowed. With this approach, you can configure a locked-down experience for different account types. - - > [!NOTE] - > [!INCLUDE [Multi-app kiosk mode not supported on Windows 11](./includes/multi-app-kiosk-support-windows11.md)] - - A multi-app kiosk is appropriate for devices that are shared by multiple people. When you configure a multi-app kiosk, [specific policies are enforced](kiosk-policies.md) that will affect **all** non-administrator users on the device. - - ![Illustration of a kiosk Start screen that runs multiple apps on a Windows client device.](images/kiosk-desktop.png) - -Kiosk configurations are based on **Assigned Access**, a feature in Windows client that allows an administrator to manage the user's experience by limiting the application entry points exposed to the user. - -There are several kiosk configuration methods that you can choose from, depending on your answers to the following questions. - -- **Which type of app will your kiosk run?** - - ![icon that represents apps.](images/office-logo.png) - - Your kiosk can run a Universal Windows Platform (UWP) app or a Windows desktop application. For [digital signage](setup-digital-signage.md), select a digital sign player as your kiosk app. [Check out the guidelines for kiosk apps.](guidelines-for-assigned-access-app.md) - -- **Which type of kiosk do you need?** - - ![icon that represents a kiosk.](images/kiosk.png) - - If you want your kiosk to run a single app for anyone to see or use, consider a single-app kiosk that runs either a [Universal Windows Platform (UWP) app](#methods-for-a-single-app-kiosk-running-a-uwp-app) or a [Windows desktop application](#classic). For a kiosk that people can sign in to with their accounts or that runs more than one app, choose [a multi-app kiosk](#desktop). - -- **Which edition of Windows client will the kiosk run?** - - ![icon that represents Windows.](images/windows.png) - - All of the configuration methods work for Windows client Enterprise and Education; some of the methods work for Windows Pro. Kiosk mode isn't available on Windows Home. - -- **Which type of user account will be the kiosk account?** - - ![icon that represents a user account.](images/user.png) - - The kiosk account can be a local standard user account, a local administrator account, a domain account, or a Microsoft Entra account, depending on the method that you use to configure the kiosk. If you want people to sign in and authenticate on the device, you should use a multi-app kiosk configuration. The single-app kiosk configuration doesn't require people to sign in to the device, although they can sign in to the kiosk app if you select an app that has a sign-in method. - - ->[!IMPORTANT] ->Single-app kiosk mode isn't supported over a remote desktop connection. Your kiosk users must sign in on the physical device that is set up as a kiosk. - -[!INCLUDE [assigned-access-kiosk-mode](../../includes/licensing/assigned-access-kiosk-mode.md)] - -## Methods for a single-app kiosk running a UWP app - -You can use this method | For this edition | For this kiosk account type ---- | --- | --- -[Assigned access in Settings](kiosk-single-app.md#local) | Pro, Ent, Edu | Local standard user -[Assigned access cmdlets](kiosk-single-app.md#powershell) | Pro, Ent, Edu | Local standard user -[The kiosk wizard in Windows Configuration Designer](kiosk-single-app.md#wizard) | Pro (version 1709), Ent, Edu | Local standard user, Active Directory, Microsoft Entra ID -[Microsoft Intune or other mobile device management (MDM)](kiosk-single-app.md#mdm) | Pro (version 1709), Ent, Edu | Local standard user, Microsoft Entra ID -[Shell Launcher](kiosk-shelllauncher.md) v2 | Ent, Edu | Local standard user, Active Directory, Microsoft Entra ID - - - -## Methods for a single-app kiosk running a Windows desktop application - -You can use this method | For this edition | For this kiosk account type ---- | --- | --- -[The kiosk wizard in Windows Configuration Designer](kiosk-single-app.md#wizard) | Ent, Edu | Local standard user, Active Directory, Microsoft Entra ID -[Microsoft Intune or other mobile device management (MDM)](kiosk-single-app.md#mdm) | Pro (version 1709), Ent, Edu | Local standard user, Microsoft Entra ID -[Shell Launcher](kiosk-shelllauncher.md) v1 and v2 | Ent, Edu | Local standard user, Active Directory, Microsoft Entra ID - - - -## Methods for a multi-app kiosk - -You can use this method | For this edition | For this kiosk account type ---- | --- | --- -[XML in a provisioning package](lock-down-windows-10-to-specific-apps.md) | Pro, Ent, Edu | Local standard user, Active Directory, Microsoft Entra ID -[Microsoft Intune or other MDM](lock-down-windows-10-to-specific-apps.md) | Pro, Ent, Edu | Local standard user, Microsoft Entra ID -[MDM WMI Bridge Provider](kiosk-mdm-bridge.md) | Pro, Ent, Edu | Local standard user, Active Directory, Microsoft Entra ID - -## Summary of kiosk configuration methods - -Method | App type | Account type | Single-app kiosk | Multi-app kiosk ---- | --- | --- | :---: | :---: -[Assigned access in Settings](kiosk-single-app.md#local) | UWP | Local account | ✔️ | -[Assigned access cmdlets](kiosk-single-app.md#powershell) | UWP | Local account | ✔️ | -[The kiosk wizard in Windows Configuration Designer](kiosk-single-app.md#wizard) | UWP, Windows desktop app | Local standard user, Active Directory, Microsoft Entra ID | ✔️ | -[XML in a provisioning package](lock-down-windows-10-to-specific-apps.md) | UWP, Windows desktop app | Local standard user, Active Directory, Microsoft Entra ID | ✔️ | ✔️ -Microsoft Intune or other MDM [for full-screen single-app kiosk](kiosk-single-app.md#mdm) or [for multi-app kiosk with desktop](lock-down-windows-10-to-specific-apps.md) | UWP, Windows desktop app | Local standard user, Microsoft Entra ID | ✔️ | ✔️ -[Shell Launcher](kiosk-shelllauncher.md) |Windows desktop app | Local standard user, Active Directory, Microsoft Entra ID | ✔️ | -[MDM Bridge WMI Provider](kiosk-mdm-bridge.md) | UWP, Windows desktop app | Local standard user, Active Directory, Microsoft Entra ID | | ✔️ - - ->[!NOTE] ->For devices running Windows client Enterprise and Education, you can also use [Windows Defender Application Control](/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control) or [AppLocker](lock-down-windows-10-applocker.md) to lock down a device to specific apps. diff --git a/windows/configuration/kiosk-policies.md b/windows/configuration/kiosk-policies.md deleted file mode 100644 index 9e599f8790..0000000000 --- a/windows/configuration/kiosk-policies.md +++ /dev/null @@ -1,80 +0,0 @@ ---- -title: Policies enforced on kiosk devices (Windows 10/11) -description: Learn about the policies enforced on a device when you configure it as a kiosk. -ms.reviewer: sybruckm -manager: aaroncz -ms.prod: windows-client -author: lizgt2000 -ms.localizationpriority: medium -ms.author: lizlong -ms.topic: article -ms.technology: itpro-configure -ms.date: 12/31/2017 ---- - -# Policies enforced on kiosk devices - - -**Applies to** - -- Windows 10 Pro, Enterprise, and Education -- Windows 11 - - - -It isn't recommended to set policies enforced in assigned access kiosk mode to different values using other channels, as the kiosk mode has been optimized to provide a locked-down experience. - -When the assigned access kiosk configuration is applied on the device, certain policies are enforced system-wide, and will impact other users on the device. - - -## Group Policy - -The following local policies affect all **non-administrator** users on the system, regardless whether the user is configured as an assigned access user or not. These users include local users, domain users, and Microsoft Entra users. - -| Setting | Value | -| --- | --- | -Remove access to the context menus for the task bar | Enabled -Clear history of recently opened documents on exit | Enabled -Prevent users from customizing their Start Screen | Enabled -Prevent users from uninstalling applications from Start | Enabled -Remove Run menu from Start Menu | Enabled -Disable showing balloon notifications as toast | Enabled -Do not allow pinning items in Jump Lists | Enabled -Do not allow pinning programs to the Taskbar | Enabled -Do not display or track items in Jump Lists from remote locations | Enabled -Remove Notifications and Action Center | Enabled -Lock all taskbar settings | Enabled -Lock the Taskbar | Enabled -Prevent users from adding or removing toolbars | Enabled -Prevent users from resizing the taskbar | Enabled -Remove frequent programs list from the Start Menu | Enabled -Remove Pinned programs from the taskbar | Enabled -Remove the Security and Maintenance icon | Enabled -Turn off all balloon notifications | Enabled -Turn off feature advertisement balloon notifications | Enabled -Turn off toast notifications | Enabled -Remove Task Manager | Enabled -Remove Change Password option in Security Options UI | Enabled -Remove Sign Out option in Security Options UI | Enabled -Remove All Programs list from the Start Menu | Enabled – Remove and disable setting -Prevent access to drives from My Computer | Enabled - Restrict all drives - ->[!NOTE] ->When **Prevent access to drives from My Computer** is enabled, users can browse the directory structure in File Explorer, but they cannot open folders and access the contents. Also, they cannot use the **Run** dialog box or the **Map Network Drive** dialog box to view the directories on these drives. The icons representing the specified drives still appear in File Explorer, but if users double-click the icons, a message appears explaining that a setting prevents the action. This setting does not prevent users from using programs to access local and network drives. It does not prevent users from using the Disk Management snap-in to view and change drive characteristics. - - - -## MDM policy - - -Some of the MDM policies based on the [Policy configuration service provider (CSP)](/windows/client-management/mdm/policy-configuration-service-provider) affect all users on the system (that is, system-wide impact). - -Setting | Value | System-wide - --- | --- | --- -[Experience/AllowCortana](/windows/client-management/mdm/policy-csp-experience#experience-allowcortana) | 0 - Not allowed | Yes -[Start/AllowPinnedFolderSettings](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfoldersettings) | 0 - Shortcut is hidden and disables the setting in the Settings app | Yes -Start/HidePeopleBar | 1 - True (hide) | No -[Start/HideChangeAccountSettings](/windows/client-management/mdm/policy-csp-start#start-hidechangeaccountsettings) | 1 - True (hide) | Yes -[WindowsInkWorkspace/AllowWindowsInkWorkspace](/windows/client-management/mdm/policy-csp-windowsinkworkspace#windowsinkworkspace-allowwindowsinkworkspace) | 0 - Access to ink workspace is disabled and the feature is turned off | Yes -[Start/StartLayout](/windows/client-management/mdm/policy-csp-start#start-startlayout) | Configuration dependent | No -[WindowsLogon/DontDisplayNetworkSelectionUI](/windows/client-management/mdm/policy-csp-windowslogon#windowslogon-dontdisplaynetworkselectionui) | <Enabled/> | Yes diff --git a/windows/configuration/kiosk-prepare.md b/windows/configuration/kiosk-prepare.md deleted file mode 100644 index 05323a4d02..0000000000 --- a/windows/configuration/kiosk-prepare.md +++ /dev/null @@ -1,325 +0,0 @@ ---- -title: Prepare a device for kiosk configuration on Windows 10/11 | Microsoft Docs -description: Learn how to prepare a device for kiosk configuration. Also, learn about the recommended kiosk configuration changes. -ms.reviewer: sybruckm -manager: aaroncz -ms.author: lizlong -ms.prod: windows-client -author: lizgt2000 -ms.localizationpriority: medium -ms.topic: article -ms.technology: itpro-configure -ms.date: 12/31/2017 ---- - -# Prepare a device for kiosk configuration - - -**Applies to** - -- Windows 10 Pro, Enterprise, and Education -- Windows 11 - - - -## Before you begin - -- [User account control (UAC)](/windows/security/identity-protection/user-account-control/user-account-control-overview) must be turned on to enable kiosk mode. -- Kiosk mode isn't supported over a remote desktop connection. Your kiosk users must sign in on the physical device that's set up as a kiosk. -- For kiosks in public-facing environments with auto sign-in enabled, you should use a user account with the least privileges, such as a local standard user account. - - Assigned access can be configured using Windows Management Instrumentation (WMI) or configuration service provider (CSP). Assigned access runs an application using a domain user or service account, not a local account. Using a domain user or service accounts has risks, and might allow an attacker to gain access to domain resources that are accessible to any domain account. When using domain accounts with assigned access, proceed with caution. Consider the domain resources potentially exposed by using a domain account. - -- MDM providers, such as [Microsoft Intune](/mem/intune/fundamentals/what-is-intune), use the configuration service providers (CSP) exposed by the Windows OS to manage settings on devices. In this article, we mention these services. If you're not managing your devices using an MDM provider, the following resources may help you get started: - - - [Endpoint Management at Microsoft](/mem/endpoint-manager-getting-started) - - [What is Microsoft Intune](/mem/intune/fundamentals/what-is-intune) and [Microsoft Intune planning guide](/mem/intune/fundamentals/intune-planning-guide) - - [What is Configuration Manager?](/mem/configmgr/core/understand/introduction) - -## Configuration recommendations - -For a more secure kiosk experience, we recommend that you make the following configuration changes to the device before you configure it as a kiosk: - -- **Hide update notifications**. Starting with Windows 10 version 1809, you can hide notifications from showing on the devices. To enable this feature, you have the following options: - - - **Use Group policy**: `Computer Configuration\Administrative Templates\Windows Components\Windows Update\Display options for update notifications` - - - **Use an MDM provider**: This feature uses the [Update/UpdateNotificationLevel CSP](/windows/client-management/mdm/policy-csp-update#update-updatenotificationlevel). In Intune, you can use the [Windows update settings](/mem/intune/protect/windows-update-settings) to manage this feature. - - - **Use the registry**: - - 1. Open Registry Editor (regedit). - 2. Go to `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate`. - 3. Create a **New** > **DWORD (32-bit) Value**. Enter `SetUpdateNotificationLevel`, and set its value to `1`. - 4. Create a **New** > **DWORD (32-bit) Value**. Enter `UpdateNotificationLevel`. For value, you can enter: - - - `1`: Hides all notifications except restart warnings. - - `2`: Hides all notifications, including restart warnings. - -- **Enable and schedule automatic updates**. To enable this feature, you have the following options: - - - **Use Group policy**: `Computer Configuration\Administrative Templates\Windows Components\Windows Update\Configure Automatic Updates`. Select `4 - Auto download and schedule the install`. - - **Use an MDM provider**: This feature uses the [Update/AllowAutoUpdate CSP](/windows/client-management/mdm/policy-csp-update#update-allowautoupdate). Select `3 - Auto install and restart at a specified time`. In Intune, you can use the [Windows update settings](/mem/intune/protect/windows-update-settings) to manage this feature. - - You can also schedule automatic updates, including **Schedule Install Day**, **Schedule Install Time**, and **Schedule Install Week**. Installations can take between 30 minutes and 2 hours, depending on the device. Schedule updates to occur when a block of 3-4 hours is available. - -- **Enable automatic restart at the scheduled time**. To enable this feature, you have the following options: - - - **Use Group policy**: `Computer Configuration\Administrative Templates\Windows Components\Windows Update\Always automatically restart at the scheduled time`. Select `4 - Auto download and schedule the install`. - - - **Use an MDM provider**: This feature uses the [Update/ActiveHoursStart](/windows/client-management/mdm/policy-csp-update#update-activehoursstart) and [Update/ActiveHoursEnd](/windows/client-management/mdm/policy-csp-update#update-activehoursend) CSPs. In Intune, you can use the [Windows update settings](/mem/intune/protect/windows-update-settings) to manage this feature. - -- **Replace "blue screen" with blank screen for OS errors**. To enable this feature, use the Registry Editor: - - 1. Open Registry Editor (regedit). - 2. Go to `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl`. - 3. Create a **New** > **DWORD (32-bit) Value**. Enter `DisplayDisabled`, and set its value to `1`. - -- **Put device in "Tablet mode"**. If you want users to use the touch screen, without using a keyboard or mouse, then turn on tablet mode using the Settings app. If users won't interact with the kiosk, such as for a digital sign, then don't turn on this setting. - - Applies to Windows 10 only. Currently, Tablet mode isn't supported on Windows 11. - - Your options: - - - Use the **Settings** app: - 1. Open the **Settings** app. - 2. Go to **System** > **Tablet mode**. - 3. Configure the settings you want. - - - Use the **Action Center**: - 1. On your device, swipe in from the left. - 2. Select **Tablet mode**. - -- **Hide "Ease of access" feature on the sign-in screen**: To enable this feature, you have the following options: - - - **Use an MDM provider**: In Intune, you can use the [Control Panel and Settings](/mem/intune/configuration/device-restrictions-windows-10#control-panel-and-settings) to manage this feature. - - **Use the registry**: For more information, see [how to disable the Ease of Access button in the registry](/windows-hardware/customize/enterprise/complementary-features-to-custom-logon#welcome-screen). - -- **Disable the hardware power button**: To enable this feature, you have the following options: - - - **Use the Settings app**: - 1. Open the **Settings** app. - 2. Go to **System** > **Power & Sleep** > **Additional power settings** > **Choose what the power button does**. - 3. Select **Do nothing**. - 4. **Save changes**. - - - **Use Group Policy**: Your options: - - - `Computer Configuration\Administrative Templates\System\Power Management\Button Settings`: Set `Select Power Button Action on Battery` and `Select Power Button Action on Plugged In` to **Take no action**. - - `User Configuration\Administrative Templates\Start Menu and Taskbar\Remove and prevent access to the Shut Down, Restart, Sleep, and Hibernate commands`: This policy hides the buttons, but doesn't disable them. - - `Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Shut down the system`: Remove the users or groups from this policy. - - To prevent this policy from affecting a member of the Administrators group, be sure to keep the Administrators group. - - - **Use an MDM provider**: In Intune, you have some options: - - - [Settings Catalog](/mem/intune/configuration/settings-catalog): This option lists all the settings you can configure, including the administrative templates used in on-premises Group Policy. Configure the following settings: - - - `Power\Select Power Button Action on Battery`: Set to **Take no action**. - - `Power\Select Power Button Action on Plugged In`: Set to **Take no action**. - - `Start\Hide Power Button`: Set to **Enabled**. This policy hides the button, but doesn't disable it. - - - [Administrative templates](/mem/intune/configuration/administrative-templates-windows): These templates are the administrative templates used in on-premises Group Policy. Configure the following setting: - - - `\Start menu and Taskbar\Remove and prevent access to the Shut Down, Restart, Sleep, and Hibernate commands`: This policy hides the buttons, but doesn't disable them. - - When looking at settings, check the supported OS for each setting to make sure it applies. - - - [Start settings in a device configuration profile](/mem/intune/configuration/device-restrictions-windows-10#start): This option shows this setting, and all the Start menu settings you can manage. - -- **Remove the power button from the sign-in screen**. To enable this feature, you have the following options: - - - **Use Group Policy**: `Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\Shutdown: Allow system to be shut down without having to log on`. Select **Disabled**. - - - **Use MDM**: In Intune, you have the following option: - - - [Settings Catalog](/mem/intune/configuration/settings-catalog): This option lists all the settings you can configure, including the administrative templates used in on-premises Group Policy. Configure the following setting: - - - `Local Policies Security Options\Shutdown Allow System To Be Shut Down Without Having To Log On`: Set to **Disabled**. - -- **Disable the camera**: To enable this feature, you have the following options: - - - **Use the Settings app**: - 1. Open the **Settings** app. - 2. Go to **Privacy** > **Camera**. - 3. Select **Allow apps use my camera** > **Off**. - - - **Use Group Policy**: `Computer Configuration\Administrative Templates\Windows Components\Camera: Allow use of camera`: Select **Disabled**. - - - **Use an MDM provider**: This feature uses the [Policy CSP - Camera](/windows/client-management/mdm/policy-csp-camera). In Intune, you have the following options: - - - [General settings in a device configuration profile](/mem/intune/configuration/device-restrictions-windows-10#general): This option shows this setting, and more settings you can manage. - - [Settings Catalog](/mem/intune/configuration/settings-catalog): This option lists all the settings you can configure, including the administrative templates used in on-premises Group Policy. Configure the following setting: - - - `Camera\Allow camera`: Set to **Not allowed**. - -- **Turn off app notifications on the lock screen**: To enable this feature, you have the following options: - - - **Use the Settings app**: - - 1. Open the **Settings** app. - 2. Go to **System** > **Notifications & actions**. - 3. In **Show notifications on the lock screen**, select **Off**. - - - **Use Group policy**: - - `Computer Configuration\Administrative Templates\System\Logon\Turn off app notifications on the lock screen`: Select **Enabled**. - - `User Configuration\Administrative Templates\Start Menu and Taskbar\Notifications\Turn off toast notifications on the lock screen`: Select **Enabled**. - - - **Use an MDM provider**: This feature uses the [AboveLock/AllowToasts CSP](/windows/client-management/mdm/policy-csp-abovelock#abovelock-allowtoasts). In Intune, you have the following options: - - - [Locked screen experience device configuration profile](/mem/intune/configuration/device-restrictions-windows-10#locked-screen-experience): See this setting, and more settings you can manage. - - - [Administrative templates](/mem/intune/configuration/administrative-templates-windows): These templates are the administrative templates used in on-premises Group Policy. Configure the following settings: - - - `\Start Menu and Taskbar\Notifications\Turn off toast notifications on the lock screen`: Select **Enabled**. - - `\System\Logon\Turn off app notifications on the lock screen`: Select **Enabled**. - - When looking at settings, check the supported OS for each setting to make sure it applies. - - - [Settings Catalog](/mem/intune/configuration/settings-catalog): This option lists all the settings you can configure, including the administrative templates used in on-premises Group Policy. Configure the following settings: - - - `\Start Menu and Taskbar\Notifications\Turn off toast notifications on the lock screen`: Select **Enabled**. - - `\System\Logon\Turn off app notifications on the lock screen`: Select **Enabled**. - -- **Disable removable media**: To enable this feature, you have the following options: - - - **Use Group policy**: `Computer Configuration\Administrative Templates\System\Device Installation\Device Installation Restrictions`. Review the available settings that apply to your situation. - - To prevent this policy from affecting a member of the Administrators group, select `Allow administrators to override Device Installation Restriction policies` > **Enabled**. - - - **Use an MDM provider**: In Intune, you have the following options: - - - [General settings in a device configuration profile](/mem/intune/configuration/device-restrictions-windows-10#general): See the **Removable storage** setting, and more settings you can manage. - - - [Administrative templates](/mem/intune/configuration/administrative-templates-windows): These templates are the administrative templates used in on-premises Group Policy. Configure the following settings: - - - `\System\Device Installation`: There are several policies you can manage, including restrictions in `\System\Device Installation\Device Installation Restrictions`. - - To prevent this policy from affecting a member of the Administrators group, select `Allow administrators to override Device Installation Restriction policies` > **Enabled**. - - When looking at settings, check the supported OS for each setting to make sure it applies. - - - [Settings Catalog](/mem/intune/configuration/settings-catalog): This option lists all the settings you can configure, including the administrative templates used in on-premises Group Policy. Configure the following settings: - - - `\Administrative Templates\System\Device Installation`: There are several policies you can manage, including restrictions in `\System\Device Installation\Device Installation Restrictions`. - - To prevent this policy from affecting a member of the Administrators group, select `Allow administrators to override Device Installation Restriction policies` > **Enabled**. - -## Enable logging - -Logs can help you [troubleshoot issues](/troubleshoot/windows-client/shell-experience/kiosk-mode-issues-troubleshooting) kiosk issues. Logs about configuration and runtime issues can be obtained by enabling the **Applications and Services Logs\Microsoft\Windows\AssignedAccess\Operational** channel, which is disabled by default. - -:::image type="content" source="images/enable-assigned-access-log.png" alt-text="On Windows client, open Event Viewer, right-click Operational, select enable log to turn on logging to help troubleshoot."::: - -## Automatic logon - -You may also want to set up **automatic logon** for your kiosk device. When your kiosk device restarts, from an update or power outage, you can sign in the assigned access account manually. Or, you can configure the device to sign in to the assigned access account automatically. Make sure that Group Policy settings applied to the device don't prevent automatic sign in. - -> [!NOTE] -> If you are using a Windows client device restriction CSP to set "Preferred Microsoft Entra tenant domain", this will break the "User logon type" auto-login feature of the Kiosk profile. - -> [!TIP] -> If you use the [kiosk wizard in Windows Configuration Designer](kiosk-single-app.md#wizard) or [XML in a provisioning package](lock-down-windows-10-to-specific-apps.md) to configure your kiosk, you can set an account to sign in automatically in the wizard or XML. - - -**How to edit the registry to have an account sign in automatically** - -1. Open Registry Editor (regedit.exe). - - > [!NOTE] - > If you are not familiar with Registry Editor, [learn how to modify the Windows registry](/troubleshoot/windows-server/performance/windows-registry-advanced-users). - - -2. Go to - - **HKEY\_LOCAL\_MACHINE\SOFTWARE\\Microsoft\Windows NT\CurrentVersion\Winlogon** - -3. Set the values for the following keys. - - - *AutoAdminLogon*: set value as **1**. - - - *DefaultUserName*: set value as the account that you want signed in. - - - *DefaultPassword*: set value as the password for the account. - - > [!NOTE] - > If *DefaultUserName* and *DefaultPassword* aren't there, add them as **New** > **String Value**. - - - *DefaultDomainName*: set value for domain, only for domain accounts. For local accounts, don't add this key. - -4. Close Registry Editor. The next time the computer restarts, the account will sign in automatically. - -> [!TIP] -> You can also configure automatic sign-in [using the Autologon tool from Sysinternals](/sysinternals/downloads/autologon). - -> [!NOTE] -> If you are also using [Custom Logon](/windows-hardware/customize/enterprise/custom-logon) with **HideAutoLogonUI** enabled, you might experience a black screen after a password expires. We recommend that you consider [setting the password to never expire](/windows-hardware/customize/enterprise/troubleshooting-custom-logon#the-device-displays-a-black-screen-when-a-password-expiration-screen-is-displayed). - -## Interactions and interoperability - -The following table describes some features that have interoperability issues we recommend that you consider when running assigned access. - -- **Accessibility**: Assigned access doesn't change Ease of Access settings. We recommend that you use [Keyboard Filter](/windows-hardware/customize/enterprise/keyboardfilter) to block the following key combinations that bring up accessibility features: - - | Key combination | Blocked behavior | - | --- | --- | - | Left Alt + Left Shift + Print Screen | Open High Contrast dialog box. | - | Left Alt + Left Shift + Num Lock | Open Mouse Keys dialog box. | - | Windows logo key + U | Open Ease of Access Center. | - -- **Assigned access Windows PowerShell cmdlets**: In addition to using the Windows UI, you can use the Windows PowerShell cmdlets to set or clear assigned access. For more information, see [Assigned access Windows PowerShell reference](/powershell/module/assignedaccess/) - -- **Key sequences blocked by assigned access**: When in assigned access, some key combinations are blocked for assigned access users. - - Alt + F4, Alt + Shift + Tab, Alt + Tab aren't blocked by Assigned Access, it's recommended you use [Keyboard Filter](/windows-hardware/customize/enterprise/keyboardfilter) to block these key combinations. - - Ctrl + Alt + Delete is the key to break out of Assigned Access. If needed, you can use Keyboard Filter to configure a different key combination to break out of assigned access by setting BreakoutKeyScanCode as described in [WEKF_Settings](/windows-hardware/customize/enterprise/wekf-settings). - - | Key combination | Blocked behavior for assigned access users | - | --- | --- | - | Alt + Esc | Cycle through items in the reverse order from which they were opened. | - | Ctrl + Alt + Esc | Cycle through items in the reverse order from which they were opened. | - | Ctrl + Esc | Open the Start screen. | - | Ctrl + F4 | Close the window. | - | Ctrl + Shift + Esc | Open Task Manager. | - | Ctrl + Tab | Switch windows within the application currently open. | - | LaunchApp1 | Open the app that is assigned to this key. | - | LaunchApp2 | Open the app that is assigned to this key. On many Microsoft keyboards, the app is Calculator. | - | LaunchMail | Open the default mail client. | - | Windows logo key | Open the Start screen. | - - Keyboard Filter settings apply to other standard accounts. - -- **Key sequences blocked by [Keyboard Filter](/windows-hardware/customize/enterprise/keyboardfilter)**: If Keyboard Filter is turned ON, then some key combinations are blocked automatically without you having to explicitly block them. For more information, see the [Keyboard Filter](/windows-hardware/customize/enterprise/keyboardfilter). - - [Keyboard Filter](/windows-hardware/customize/enterprise/keyboardfilter) is only available on Windows client Enterprise or Education. - -- **Power button**: Customizations for the Power button complement assigned access, letting you implement features such as removing the power button from the Welcome screen. Removing the power button ensures the user can't turn off the device when it's in assigned access. - - For more information on removing the power button or disabling the physical power button, see [Custom Logon](/windows-hardware/customize/enterprise/custom-logon). - -- **Unified Write Filter (UWF)**: UWFsettings apply to all users, including users with assigned access. - - For more information, see [Unified Write Filter](/windows-hardware/customize/enterprise/unified-write-filter). - -- **WEDL_AssignedAccess class**: You can use this class to configure and manage basic lockdown features for assigned access. It's recommended to you use the Windows PowerShell cmdlets instead. - - If you need to use assigned access API, see [WEDL_AssignedAccess](/windows-hardware/customize/enterprise/wedl-assignedaccess). - -- **Welcome Screen**: Customizations for the Welcome screen let you personalize not only how the Welcome screen looks, but for how it functions. You can disable the power or language button, or remove all user interface elements. There are many options to make the Welcome screen your own. - - For more information, see [Custom Logon](/windows-hardware/customize/enterprise/custom-logon). - -## Testing your kiosk in a virtual machine (VM) - -Customers sometimes use virtual machines (VMs) to test configurations before deploying those configurations to physical devices. If you use a VM to test your single-app kiosk configuration, you need to know how to connect to the VM properly. - -A single-app kiosk configuration runs an app above the lock screen. It doesn't work when it's accessed remotely, which includes *enhanced* sessions in Hyper-V. - -When you connect to a VM configured as a single-app kiosk, you need a *basic* session rather than an enhanced session. In the following image, notice that **Enhanced session** isn't selected in the **View** menu; that means it's a basic session. - -:::image type="content" source="images/vm-kiosk.png" alt-text="Use a basic session to connect a virtual machine. In the View menu, Extended session isn't selected, which means basic is used."::: - -To connect to a VM in a basic session, don't select **Connect** in the connection dialog, as shown in the following image, but instead, select the **X** button in the upper-right corner to cancel the dialog: - -:::image type="content" source="images/vm-kiosk-connect.png" alt-text="Don't select the connect button. Use the close X in the top corner to connect to a VM in basic session."::: diff --git a/windows/configuration/kiosk-shelllauncher.md b/windows/configuration/kiosk-shelllauncher.md deleted file mode 100644 index 4bd3071b0d..0000000000 --- a/windows/configuration/kiosk-shelllauncher.md +++ /dev/null @@ -1,304 +0,0 @@ ---- -title: Use Shell Launcher to create a Windows 10/11 kiosk (Windows 10/11) -description: Shell Launcher lets you change the default shell that launches when a user signs in to a device. -ms.reviewer: sybruckm -manager: aaroncz -ms.author: lizlong -ms.prod: windows-client -author: lizgt2000 -ms.localizationpriority: medium -ms.topic: article -ms.technology: itpro-configure -ms.date: 12/31/2017 ---- - -# Use Shell Launcher to create a Windows client kiosk - - -**Applies to** -- Windows 10 Ent, Edu -- Windows 11 - -Using Shell Launcher, you can configure a device that runs an application as the user interface, replacing the default shell (explorer.exe). In **Shell Launcher v1**, available in Windows client, you can only specify a Windows desktop application as the replacement shell. In **Shell Launcher v2**, available in Windows 10 version 1809+ / Windows 11, you can also specify a UWP app as the replacement shell. To use **Shell Launcher v2** in Windows 10 version 1809, you need to install the [KB4551853](https://support.microsoft.com/help/4551853) update. - ->[!NOTE] ->Shell Launcher controls which application the user sees as the shell after sign-in. It does not prevent the user from accessing other desktop applications and system components. -> ->Methods of controlling access to other desktop applications and system components can be used in addition to using the Shell Launcher. These methods include, but are not limited to: ->- [Group Policy](https://www.microsoft.com/download/details.aspx?id=25250) - example: Prevent access to registry editing tools ->- [AppLocker](/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview) - Application control policies ->- [Mobile Device Management](/windows/client-management/mdm) - Enterprise management of device security policies - -You can apply a custom shell through Shell Launcher [by using PowerShell](#configure-a-custom-shell-using-powershell). Starting with Windows 10 version 1803+, you can also [use mobile device management (MDM)](#configure-a-custom-shell-in-mdm) to apply a custom shell through Shell Launcher. - - -## Differences between Shell Launcher v1 and Shell Launcher v2 - -Shell Launcher v1 replaces `explorer.exe`, the default shell, with `eshell.exe` which can launch a Windows desktop application. - -Shell Launcher v2 replaces `explorer.exe` with `customshellhost.exe`. This new executable file can launch a Windows desktop application or a UWP app. - -In addition to allowing you to use a UWP app for your replacement shell, Shell Launcher v2 offers additional enhancements: -- You can use a custom Windows desktop application that can then launch UWP apps, such as **Settings** and **Touch Keyboard**. -- From a custom UWP shell, you can launch secondary views and run on multiple monitors. -- The custom shell app runs in full screen, and can run other apps in full screen on user’s demand. - -For sample XML configurations for the different app combinations, see [Samples for Shell Launcher v2](https://github.com/Microsoft/Windows-iotcore-samples/tree/develop/Samples/ShellLauncherV2). - -## Requirements - ->[!WARNING] ->- Windows 10 doesn’t support setting a custom shell prior to OOBE. If you do, you won’t be able to deploy the resulting image. -> ->- Shell Launcher doesn't support a custom shell with an application that launches a different process and exits. For example, you cannot specify **write.exe** in Shell Launcher. Shell Launcher launches a custom shell and monitors the process to identify when the custom shell exits. **Write.exe** creates a 32-bit wordpad.exe process and exits. Because Shell Launcher is not aware of the newly created wordpad.exe process, Shell Launcher will take action based on the exit code of **Write.exe**, such as restarting the custom shell. - -- A domain, Microsoft Entra ID, or local user account. - -- A Windows application that is installed for that account. The app can be your own company application or a common app like Internet Explorer. - -[See the technical reference for the shell launcher component.](/windows-hardware/customize/enterprise/shell-launcher) - -## Enable Shell Launcher feature - -To set a custom shell, you first turn on the Shell Launcher feature, and then you can set your custom shell as the default using PowerShell or MDM. - -**To turn on Shell Launcher in Windows features** - -1. Go to Control Panel > **Programs and features** > **Turn Windows features on or off**. - -2. Expand **Device Lockdown**. - -2. Select **Shell Launcher** and **OK**. - -Alternatively, you can turn on Shell Launcher using Windows Configuration Designer in a provisioning package, using `SMISettings > ShellLauncher`, or you can use the Deployment Image Servicing and Management (DISM.exe) tool. - -**To turn on Shell Launcher using DISM** - -1. Open a command prompt as an administrator. -2. Enter the following command. - - ``` - Dism /online /Enable-Feature /all /FeatureName:Client-EmbeddedShellLauncher - ``` - - -## Configure a custom shell in MDM - -You can use XML and a [custom OMA-URI setting](#custom-oma-uri-setting) to configure Shell Launcher in MDM. - -### XML for Shell Launcher configuration - -The following XML sample works for **Shell Launcher v1**: - -```xml - - - - - - - - - - - - - -``` - -For **Shell Launcher v2**, you can use UWP app type for `Shell` by specifying the v2 namespace, and use `v2:AppType` to specify the type, as shown in the following example. If `v2:AppType` is not specified, it implies the shell is Win32 app. - -```xml - - - - - - - - - - - -``` - ->[!TIP] ->In the XML for Shell Launcher v2, note the **AllAppsFullScreen** attribute. When set to **True**, Shell Launcher will run every app in full screen, or maximized for desktop apps. When this attribute is set to **False** or not set, only the custom shell app runs in full screen; other apps launched by the user will run in windowed mode. - -[Get XML examples for different Shell Launcher v2 configurations.](https://github.com/Microsoft/Windows-iotcore-samples/tree/develop/Samples/ShellLauncherV2) - -### Custom OMA-URI setting - -In your MDM service, you can create a [custom OMA-URI setting](/intune/custom-settings-windows-10) to configure Shell Launcher v1 or v2. (The [XML](#xml-for-shell-launcher-configuration) that you use for your setting will determine whether you apply Shell Launcher v1 or v2.) - -The OMA-URI path is `./Device/Vendor/MSFT/AssignedAccess/ShellLauncher`. - -For the value, you can select data type `String` and paste the desired configuration file content into the value box. If you wish to upload the xml instead of pasting the content, choose data type `String (XML file)`. - -![Screenshot of custom OMA-URI settings.](images/slv2-oma-uri.png) - -After you configure the profile containing the custom Shell Launcher setting, select **All Devices** or selected groups of devices to apply the profile to. Don't assign the profile to users or user groups. - -## Configure a custom shell using PowerShell - -For scripts for Shell Launcher v2, see [Shell Launcher v2 Bridge WMI sample scripts](https://github.com/Microsoft/Windows-iotcore-samples/blob/develop/Samples/ShellLauncherV2/SampleBridgeWmiScripts/README.md). - -For Shell Launcher v1, modify the following PowerShell script as appropriate. The comments in the sample script explain the purpose of each section and tell you where you will want to change the script for your purposes. Save your script with the extension .ps1, open Windows PowerShell as administrator, and run the script on the kiosk device. - -```powershell -# Check if shell launcher license is enabled -function Check-ShellLauncherLicenseEnabled -{ - [string]$source = @" -using System; -using System.Runtime.InteropServices; - -static class CheckShellLauncherLicense -{ - const int S_OK = 0; - - public static bool IsShellLauncherLicenseEnabled() - { - int enabled = 0; - - if (NativeMethods.SLGetWindowsInformationDWORD("EmbeddedFeature-ShellLauncher-Enabled", out enabled) != S_OK) { - enabled = 0; - } - - return (enabled != 0); - } - - static class NativeMethods - { - [DllImport("Slc.dll")] - internal static extern int SLGetWindowsInformationDWORD([MarshalAs(UnmanagedType.LPWStr)]string valueName, out int value); - } - -} -"@ - - $type = Add-Type -TypeDefinition $source -PassThru - - return $type[0]::IsShellLauncherLicenseEnabled() -} - -[bool]$result = $false - -$result = Check-ShellLauncherLicenseEnabled -"`nShell Launcher license enabled is set to " + $result -if (-not($result)) -{ - "`nThis device doesn't have required license to use Shell Launcher" - exit -} - -$COMPUTER = "localhost" -$NAMESPACE = "root\standardcimv2\embedded" - -# Create a handle to the class instance so we can call the static methods. -try { - $ShellLauncherClass = [wmiclass]"\\$COMPUTER\${NAMESPACE}:WESL_UserSetting" - } catch [Exception] { - write-host $_.Exception.Message; - write-host "Make sure Shell Launcher feature is enabled" - exit - } - - -# This well-known security identifier (SID) corresponds to the BUILTIN\Administrators group. - -$Admins_SID = "S-1-5-32-544" - -# Create a function to retrieve the SID for a user account on a machine. - -function Get-UsernameSID($AccountName) { - - $NTUserObject = New-Object System.Security.Principal.NTAccount($AccountName) - $NTUserSID = $NTUserObject.Translate([System.Security.Principal.SecurityIdentifier]) - - return $NTUserSID.Value - -} - -# Get the SID for a user account named "Cashier". Rename "Cashier" to an existing account on your system to test this script. - -$Cashier_SID = Get-UsernameSID("Cashier") - -# Define actions to take when the shell program exits. - -$restart_shell = 0 -$restart_device = 1 -$shutdown_device = 2 - -# Examples. You can change these examples to use the program that you want to use as the shell. - -# This example sets the command prompt as the default shell, and restarts the device if the command prompt is closed. - -$ShellLauncherClass.SetDefaultShell("cmd.exe", $restart_device) - -# Display the default shell to verify that it was added correctly. - -$DefaultShellObject = $ShellLauncherClass.GetDefaultShell() - -"`nDefault Shell is set to " + $DefaultShellObject.Shell + " and the default action is set to " + $DefaultShellObject.defaultaction - -# Set Internet Explorer as the shell for "Cashier", and restart the machine if Internet Explorer is closed. - -$ShellLauncherClass.SetCustomShell($Cashier_SID, "c:\program files\internet explorer\iexplore.exe www.microsoft.com", ($null), ($null), $restart_shell) - -# Set Explorer as the shell for administrators. - -$ShellLauncherClass.SetCustomShell($Admins_SID, "explorer.exe") - -# View all the custom shells defined. - -"`nCurrent settings for custom shells:" -Get-WmiObject -namespace $NAMESPACE -computer $COMPUTER -class WESL_UserSetting | Select Sid, Shell, DefaultAction - -# Enable Shell Launcher - -$ShellLauncherClass.SetEnabled($TRUE) - -$IsShellLauncherEnabled = $ShellLauncherClass.IsEnabled() - -"`nEnabled is set to " + $IsShellLauncherEnabled.Enabled - -# Remove the new custom shells. - -$ShellLauncherClass.RemoveCustomShell($Admins_SID) - -$ShellLauncherClass.RemoveCustomShell($Cashier_SID) - -# Disable Shell Launcher - -$ShellLauncherClass.SetEnabled($FALSE) - -$IsShellLauncherEnabled = $ShellLauncherClass.IsEnabled() - -"`nEnabled is set to " + $IsShellLauncherEnabled.Enabled -``` - -## default action, custom action, exit code -Shell launcher defines 4 actions to handle app exits, you can customize shell launcher and use these actions based on different exit code. - -Value|Description ---- | --- -0|Restart the shell -1|Restart the device -2|Shut down the device -3|Do nothing - -These action can be used as default action, or can be mapped to a specific exit code. Refer to [Shell Launcher](/windows-hardware/customize/enterprise/wesl-usersettingsetcustomshell) to see how these codes with Shell Launcher WMI. - -To configure these action with Shell Launcher CSP, use below syntax in the shell launcher configuration xml. You can specify at most 4 custom actions mapping to 4 exit codes, and one default action for all other exit codes. When app exits and if the exit code is not found in the custom action mapping, or there is no default action defined, it will be no-op, i.e. nothing happens. So it's recommended to at least define DefaultAction. [Get XML examples for different Shell Launcher v2 configurations.](https://github.com/Microsoft/Windows-iotcore-samples/tree/develop/Samples/ShellLauncherV2) -``` xml - - - - - - - - -``` diff --git a/windows/configuration/kiosk-single-app.md b/windows/configuration/kiosk-single-app.md deleted file mode 100644 index 0218a198e2..0000000000 --- a/windows/configuration/kiosk-single-app.md +++ /dev/null @@ -1,345 +0,0 @@ ---- -title: Set up a single-app kiosk on Windows -description: A single-use device is easy to set up in Windows Pro, Enterprise, and Education editions. -ms.reviewer: sybruckm -ms.author: lizlong -author: lizgt2000 -ms.topic: article -ms.collection: - - tier1 -ms.date: 07/12/2023 ---- - - -# Set up a single-app kiosk on Windows 10/11 - - -**Applies to** - -- Windows 10 Pro, Enterprise, and Education -- Windows 11 - -A single-app kiosk uses the Assigned Access feature to run a single app above the lock screen. When the kiosk account signs in, the app is launched automatically. The person using the kiosk cannot do anything on the device outside of the kiosk app. - -![Illustration of a single-app kiosk experience.](images/kiosk-fullscreen-sm.png) - ->[!IMPORTANT] ->[User account control (UAC)](/windows/security/identity-protection/user-account-control/user-account-control-overview) must be turned on to enable kiosk mode. -> ->Kiosk mode is not supported over a remote desktop connection. Your kiosk users must sign in on the physical device that is set up as a kiosk. Apps that run in kiosk mode cannot use copy and paste. - -You have several options for configuring your single-app kiosk. - -- [Locally, in Settings](#local): The **Set up a kiosk** (previously named **Set up assigned access**) option in **Settings** is a quick and easy method to set up a single device as a kiosk for a local standard user account. - - This option supports: - - - Windows 10 Pro, Enterprise, and Education - - Windows 11 - -- [PowerShell](#powershell): You can use Windows PowerShell cmdlets to set up a single-app kiosk. First, you need to [create the user account](https://support.microsoft.com/help/4026923/windows-create-a-local-user-or-administrator-account-in-windows-10) on the device and install the kiosk app for that account. - - This option supports: - - - Windows 10 Pro, Enterprise, and Education - - Windows 11 - -- [The kiosk wizard in Windows Configuration Designer](#wizard): Windows Configuration Designer is a tool that produces a *provisioning package*. A provisioning package includes configuration settings that can be applied to one or more devices during the first-run experience (OOBE), or after OOBE is done (runtime). Using the kiosk wizard, you can also create the kiosk user account, install the kiosk app, and configure more useful settings. - - This option supports: - - - Windows 10 Pro version 1709+, Enterprise, and Education - - Windows 11 - -- [Microsoft Intune or other mobile device management (MDM) provider](#mdm): For devices managed by your organization, you can use MDM to set up a kiosk configuration. - - This option supports: - - - Windows 10 Pro version 1709+, Enterprise, and Education - - Windows 11 - -> [!TIP] -> You can also configure a kiosk account and app for single-app kiosk within [XML in a provisioning package](lock-down-windows-10-to-specific-apps.md) by using a [kiosk profile](lock-down-windows-10-to-specific-apps.md#profile). -> -> Be sure to check the [configuration recommendations](kiosk-prepare.md) before you set up your kiosk. - - - - -## Set up a kiosk in local Settings - ->App type: -> - UWP -> ->OS: -> - Windows 10 Pro, Ent, Edu -> - Windows 11 -> ->Account type: -> - Local standard user - -You can use **Settings** to quickly configure one or a few devices as a kiosk. - -When your kiosk is a local device that isn't managed by Active Directory or Microsoft Entra ID, there is a default setting that enables automatic sign-in after a restart. That means that when the device restarts, the last signed-in user will be signed in automatically. If the last signed-in user is the kiosk account, the kiosk app will be launched automatically after the device restarts. - -- If you want the kiosk account to sign in automatically, and the kiosk app launched when the device restarts, then you don't need to do anything. - -- If you don't want the kiosk account to sign in automatically when the device restarts, then you must change the default setting before you configure the device as a kiosk. Sign in with the account that you will assign as the kiosk account. Open the **Settings** app > **Accounts** > **Sign-in options**. Set the **Use my sign-in info to automatically finish setting up my device after an update or restart** setting to **Off**. After you change the setting, you can apply the kiosk configuration to the device. - - ![Screenshot of automatic sign-in setting.](images/auto-signin.png) - -### Windows 10 version 1809+ / Windows 11 - -When you set up a kiosk (also known as *assigned access*) in **Settings** for Windows client, you create the kiosk user account at the same time. To set up assigned access in PC settings: - -1. Open the **Settings** app > **Accounts**. Select **Other users** or **Family and other users**. - -2. Select **Set up a kiosk > Assigned access**, and then select **Get started**. - -3. Enter a name for the new account. - - >[!NOTE] - >If there are any local standard user accounts on the device already, the **Create an account** page will offer the option to **Choose an existing account**. - -4. Choose the app that will run when the kiosk account signs in. Only apps that can run above the lock screen will be available in the list of apps to choose from. For more information, see [Guidelines for choosing an app for assigned access](guidelines-for-assigned-access-app.md). If you select **Microsoft Edge** as the kiosk app, you configure the following options: - - - Whether Microsoft Edge should display your website full-screen (digital sign) or with some browser controls available (public browser) - - Which URL should be displayed when the kiosk accounts signs in - - When Microsoft Edge should restart after a period of inactivity (if you select to run as a public browser) - -5. Select **Close**. - -To remove assigned access, select the account tile on the **Set up a kiosk** page, and then select **Remove kiosk**. - - -### Windows 10 version 1803 and earlier - -When you set up a kiosk (also known as *assigned access*) in **Settings** for Windows 10 version 1803 and earlier, you must select an existing local standard user account. [Learn how to create a local standard user account.](https://support.microsoft.com/help/4026923/windows-create-a-local-user-or-administrator-account-in-windows-10) - -![The Set up assigned access page in Settings.](images/kiosk-settings.png) - -**To set up assigned access in PC settings** - -1. Go to **Start** > **Settings** > **Accounts** > **Other people**. - -2. Select **Set up assigned access**. - -3. Choose an account. - -4. Choose an app. Only apps that can run above the lock screen will be available in the list of apps to choose from. For more information, see [Guidelines for choosing an app for assigned access](guidelines-for-assigned-access-app.md). - -5. Close **Settings** – your choices are saved automatically, and will be applied the next time that user account signs in. - -To remove assigned access, choose **Turn off assigned access and sign out of the selected account**. - - - -## Set up a kiosk using Windows PowerShell - - ->App type: -> - UWP -> ->OS: -> - Windows 10 Pro, Ent, Edu -> - Windows 11 -> ->Account type: -> - Local standard user - -![PowerShell windows displaying Set-AssignedAccess cmdlet.](images/set-assignedaccess.png) - -You can use any of the following PowerShell cmdlets to set up assigned access on multiple devices. - -Before you run the cmdlet: - -1. Sign in as administrator. -2. [Create the user account](https://support.microsoft.com/help/4026923/windows-create-a-local-user-or-administrator-account-in-windows-10) for Assigned Access. -3. Sign in as the Assigned Access user account. -4. Install the Universal Windows app that follows the assigned access/above the lock guidelines. -5. Sign out as the Assigned Access user account. -6. Sign in as administrator. - -To open PowerShell on Windows client, search for PowerShell, and find **Windows PowerShell Desktop app** in the results. Run PowerShell as administrator. - -- **Configure assigned access by AppUserModelID and user name**: `Set-AssignedAccess -AppUserModelId -UserName ` -- **Configure assigned access by AppUserModelID and user SID**: `Set-AssignedAccess -AppUserModelId -UserSID ` -- **Configure assigned access by app name and user name**: `Set-AssignedAccess -AppName -UserName ` -- **Configure assigned access by app name and user SID**: `Set-AssignedAccess -AppName -UserSID ` - -> [!NOTE] -> To set up assigned access using `-AppName`, the user account that you enter for assigned access must have signed in at least once. - -[Learn how to get the AUMID](./find-the-application-user-model-id-of-an-installed-app.md). - -[Learn how to get the AppName](/powershell/module/assignedaccess/set-assignedaccess) (see **Parameters**). - -To remove assigned access, using PowerShell, run the following cmdlet: - -```powershell -Clear-AssignedAccess -``` - - - -## Set up a kiosk using the kiosk wizard in Windows Configuration Designer - ->App type: -> - UWP -> - Windows desktop application -> ->OS: -> - Windows 10 Pro version 1709+ for UWP only -> - Windows 10 Ent, Edu for UWP and Windows desktop applications -> - Windows 11 -> ->Account type: -> - Local standard user -> - Active Directory - -![Kiosk wizard option in Windows Configuration Designer.](images/kiosk-wizard.png) - - ->[!IMPORTANT] ->When Exchange Active Sync (EAS) password restrictions are active on the device, the autologon feature does not work. This behavior is by design. For more informations, see [How to turn on automatic logon in Windows](/troubleshoot/windows-server/user-profiles-and-logon/turn-on-automatic-logon). - -When you use the **Provision kiosk devices** wizard in Windows Configuration Designer, you can configure the kiosk to run either a Universal Windows app or a Windows desktop application. - -[Install Windows Configuration Designer](provisioning-packages/provisioning-install-icd.md), then open Windows Configuration Designer and select **Provision kiosk devices**. After you name your project, and select **Next**, configure the following settings: - -1. Enable device setup: - - :::image type="content" source="images/set-up-device-details.png" alt-text="In Windows Configuration Designer, enable device setup, enter the device name, the product key to upgrade, turn off shared use, and remove preinstalled software."::: - - If you want to enable device setup, select **Set up device**, and configure the following settings: - - - **Device name**: Required. Enter a unique 15-character name for the device. You can use variables to add unique characters to the name, such as `Contoso-%SERIAL%` and `Contoso-%RAND:5%`. - - **Enter product key**: Optional. Select a license file to upgrade Windows client to a different edition. For more information, see [the permitted upgrades](/windows/deployment/upgrade/windows-10-edition-upgrades). - - **Configure devices for shared use**: This setting optimizes Windows client for shared use scenarios, and isn't necessary for a kiosk scenario. Set this value to **No**, which may be the default. - - **Remove pre-installed software**: Optional. Select **Yes** if you want to remove preinstalled software. - -2. Set up the network: - - :::image type="content" source="images/set-up-network-details.png" alt-text="In Windows Configuration Designer, turn on wireless connectivity, enter the network SSID, and network type."::: - - If you want to enable network setup, select **Set up network**, and configure the following settings: - - - **Set up network**: To enable wireless connectivity, select **On**. - - **Network SSID**: Enter the Service Set Identifier (SSID) of the network. - - **Network type**: Select **Open** or **WPA2-Personal**. If you select **WPA2-Personal**, enter the password for the wireless network. - -3. Enable account management: - - :::image type="content" source="images/account-management-details.png" alt-text="In Windows Configuration Designer, join Active Directory, Microsoft Entra ID, or create a local admin account."::: - - If you want to enable account management, select **Account Management**, and configure the following settings: - - - **Manage organization/school accounts**: Choose how devices are enrolled. Your options: - - **Active Directory**: Enter the credentials for a least-privileged user account to join the device to the domain. - - **Microsoft Entra ID**: Before you use a Windows Configuration Designer wizard to configure bulk Microsoft Entra enrollment, [set up Microsoft Entra join in your organization](/azure/active-directory/active-directory-azureadjoin-setup). In your Microsoft Entra tenant, the **maximum number of devices per user** setting determines how many times the bulk token in the wizard can be used. - - If you select this option, enter a friendly name for the bulk token you get using the wizard. Set an expiration date for the token. The maximum is 180 days from the date you get the token. Select **Get bulk token**. In **Let's get you signed in**, enter an account that has permissions to join a device to Microsoft Entra ID, and then the password. Select **Accept** to give Windows Configuration Designer the necessary permissions. - - You must run Windows Configuration Designer on Windows client to configure Microsoft Entra enrollment using any of the wizards. - - - **Local administrator**: If you select this option, enter a user name and password. If you create a local account in the provisioning package, you must change the password using the **Settings** app every 42 days. If the password isn't changed during that period, the account might be locked out, and unable to sign in. - -4. Add applications: - - :::image type="content" source="images/add-applications-details.png" alt-text="In Windows Configuration Designer, add an application that will run in kiosk mode."::: - - To add applications to the devices, select **Add applications**. You can install multiple applications in a provisioning package, including Windows desktop applications (Win32) and Universal Windows Platform (UWP) apps. The settings in this step vary depending on the application you select. For help with the settings, see [Provision PCs with apps](provisioning-packages/provision-pcs-with-apps.md). - - > [!WARNING] - > If you select the plus button to add an application, you must enter an application for the provisioning package to validate. If you select the plus button by mistake, then: - > - > 1. In **Installer Path**, select any executable file. - > 2. When the **Cancel** button shows, select it. - > - > These steps let you complete the provisioning package without adding an application. - -5. Add certificates: - - :::image type="content" source="images/add-certificates-details.png" alt-text="In Windows Configuration Designer, add a certificate."::: - - To add a certificate to the devices, select **Add certificates**, and configure the following settings: - - - **Certificate name**: Enter a name for the certificate. - - **Certificate path**: Browse and select the certificate you want to add. - -6. Configure the kiosk account, and the kiosk mode app: - - :::image type="content" source="images/kiosk-account-details.png" alt-text="In Windows Configuration Designer, the Configure kiosk common settings button is shown when provisioning a kiosk device."::: - - To add the account that runs the app and choose the app type, select **Configure kiosk account and app**, and configure the following settings: - - - **Create a local standard user account to run the kiosk mode app**: Select **Yes** to create a local standard user account, and enter the **User name** and **Password**. This user account runs the app. If you select **No**, make sure you have an existing user account to run the kiosk app. - - **Auto sign-in**: Select **Yes** to automatically sign in the account when the device starts. **No** doesn't automatically sign in the account. If there are issues with auto sign-in after you apply the provisioning package, then check the Event Viewer logs for auto logon issues (`Applications and Services Logs\Microsoft\Windows\Authentication User Interface\Operational`). - - **Configure the kiosk mode app**: Enter the **User name** of the account that will run the kiosk mode app. In **App type**, select the type of app to run. Your options: - - **Windows desktop application**: Enter the path or filename. If the file path is in the PATH environment variable, then you can use the filename. Otherwise, the full path is required. - - **Universal Windows app**: Enter the AUMID. - -7. Configure kiosk common settings: - - :::image type="content" source="images/kiosk-common-details.png" alt-text="In Windows Configuration Designer, set tablet mode, configure the welcome and shutdown screens, and turn off the power timeout settings."::: - - To configure the tablet mode, configure welcome and shutdown screens, and set the power settings, select **Configure kiosk common settings**, and configure the following settings: - - - **Set tablet mode** - - **Customize user experience** - - **Configure power settings** - -8. Finish: - - :::image type="content" source="images/finish-details.png" alt-text="In Windows Configuration Designer, protect your package with a password."::: - - To complete the wizard, select **Finish**, and configure the following setting: - - - **Protect your package**: Select **Yes** to password protect your provisioning package. When you apply the provisioning package to a device, you must enter this password. - ->[!NOTE] ->If you want to use [the advanced editor in Windows Configuration Designer](provisioning-packages/provisioning-create-package.md#configure-settings), specify the user account and app (by AUMID) in **Runtime settings** > **AssignedAccess** > **AssignedAccessSettings** - ->[!IMPORTANT] ->When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed. - -[Learn how to apply a provisioning package.](provisioning-packages/provisioning-apply-package.md) - - - -## Set up a kiosk or digital sign using Microsoft Intune or other MDM service - ->App type: -> - UWP -> ->OS: -> - Windows 10 Pro version 1709+, Ent, Edu -> - Windows 11 -> ->Account type: -> - Local standard user -> - Microsoft Entra ID - -Microsoft Intune and other MDM services enable kiosk configuration through the [AssignedAccess configuration service provider (CSP)](/windows/client-management/mdm/assignedaccess-csp). Assigned Access has a `KioskModeApp` setting. In the `KioskModeApp` setting, you enter the user account name and the [AUMID](/windows-hardware/customize/enterprise/find-the-application-user-model-id-of-an-installed-app) for the app to run in kiosk mode. - ->[!TIP] ->A ShellLauncher node has been added to the [AssignedAccess CSP](/windows/client-management/mdm/assignedaccess-csp). - -To configure a kiosk in Microsoft Intune, see [Windows client and Windows Holographic for Business device settings to run as a dedicated kiosk using Intune](/intune/kiosk-settings). For other MDM services, see the documentation for your provider. - - - -## Sign out of assigned access - -To exit the assigned access (kiosk) app, press **Ctrl + Alt + Del**, and then sign in using another account. When you press **Ctrl + Alt + Del** to sign out of assigned access, the kiosk app will exit automatically. If you sign in again as the assigned access account or wait for the sign in screen timeout, the kiosk app relaunches. The assigned access user will remain signed in until an admin account opens **Task Manager** > **Users** and signs out the user account. - -If you press **Ctrl + Alt + Del** and do not sign in to another account, after a set time, assigned access will resume. The default time is 30 seconds, but you can change that in the following registry key: - -`HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI` - -To change the default time for assigned access to resume, add *IdleTimeOut* (DWORD) and enter the value data as milliseconds in hexadecimal. - -> [!NOTE] -> **IdleTimeOut** doesn't apply to the new Microsoft Edge kiosk mode. - -The Breakout Sequence of **Ctrl + Alt + Del** is the default, but this sequence can be configured to be a different sequence of keys. The breakout sequence uses the format **modifiers + keys**. An example breakout sequence would look something like **Shift + Alt + a**, where **Shift** and **Alt** are the modifiers and **a** is the key value. For more information, see [Microsoft Edge kiosk XML sample](/windows/configuration/kiosk-xml#microsoft-edge-kiosk-xml-sample). diff --git a/windows/configuration/kiosk-validate.md b/windows/configuration/kiosk-validate.md deleted file mode 100644 index 7ab28c7741..0000000000 --- a/windows/configuration/kiosk-validate.md +++ /dev/null @@ -1,94 +0,0 @@ ---- -title: Validate kiosk configuration (Windows 10/11) -description: In this article, learn what to expect on a multi-app kiosk in Windows 10/11 Pro, Enterprise, and Education. -ms.reviewer: sybruckm -manager: aaroncz -ms.author: lizlong -ms.prod: windows-client -author: lizgt2000 -ms.localizationpriority: medium -ms.topic: article -ms.technology: itpro-configure -ms.date: 12/31/2017 ---- - -# Validate kiosk configuration - - -**Applies to** - -- Windows 10 Pro, Enterprise, and Education -- Windows 11 - -To identify the provisioning packages applied to a device, go to **Settings** > **Accounts** > **Access work or school**, and then click **Add or remove a provisioning package**. You should see a list of packages that were applied to the device. - -Optionally, run Event Viewer (eventvwr.exe) and look through logs under **Applications and Services Logs** > **Microsoft** > **Windows** > **Provisioning-Diagnostics-Provider** > **Admin**. - -To test the kiosk, sign in with the assigned access user account you specified in the configuration to check out the multi-app experience. - ->[!NOTE] ->The kiosk configuration setting will take effect the next time the assigned access user signs in. If that user account is signed in when you apply the configuration, make sure the user signs out and signs back in to validate the experience. - -The following sections explain what to expect on a multi-app kiosk. - -### App launching and switching experience - -In the multi-app mode, to maximize the user productivity and streamline the experience, an app will be always launched in full screen when the users click the tile on the Start. The users can minimize and close the app, but cannot resize the app window. - -The users can switch apps just as they do today in Windows. They can use the Task View button, Alt + Tab hotkey, and the swipe in from the left gesture to view all the open apps in task view. They can click the Windows button to show Start, from which they can open apps, and they can switch to an opened app by clicking it on the taskbar. - -### Start changes - -When the assigned access user signs in, you should see a restricted Start experience: -- Start gets launched in full screen and prevents the end user from accessing the desktop. -- Start shows the layout aligned with what you defined in the multi-app configuration XML. -- Start prevents the end user from changing the tile layout. - - The user cannot resize, reposition, and unpin the tiles. - - The user cannot pin additional tiles on the start. -- Start hides **All Apps** list. -- Start hides all the folders on Start (including File Explorer, Settings, Documents, Downloads, Music, Pictures, Videos, HomeGroup, Network, and Personal folders). -- Only **User** and **Power** buttons are available. (You can control whether to show the **User/Power** buttons using [existing policies](/windows/client-management/mdm/policy-csp-start).) -- Start hides **Change account settings** option under **User** button. - -### Taskbar changes - -If the applied multi-app configuration enables taskbar, when the assigned access user signs in, you should see a restricted Taskbar experience: -- Disables context menu of Start button (Quick Link) -- Disables context menu of taskbar -- Prevents the end user from changing the taskbar -- Disables Cortana and Search Windows -- Hides notification icons and system icons, e.g. Action Center, People, Windows Ink Workspace -- Allows the end user to view the status of the network connection and power state, but disables the flyout of **Network/Power** to prevent end user from changing the settings - -### Blocked hotkeys - -The multi-app mode blocks the following hotkeys, which are not relevant for the lockdown experience. - -| Hotkey | Action | -| --- | --- | -| Windows logo key + A | Open Action center | -| Windows logo key + Shift + C | Open Cortana in listening mode | -| Windows logo key + D | Display and hide the desktop | -| Windows logo key + Alt + D | Display and hide the date and time on the desktop | -| Windows logo key + E | Open File Explorer | -| Windows logo key + F | Open Feedback Hub | -| Windows logo key + G | Open Game bar when a game is open | -| Windows logo key + I | Open Settings | -| Windows logo key + J | Set focus to a Windows tip when one is available. | -| Windows logo key + O | Lock device orientation | -| Windows logo key + Q | Open search | -| Windows logo key + R | Open the Run dialog box | -| Windows logo key + S | Open search | -| Windows logo key + X | Open the Quick Link menu | -| Windows logo key + comma (,) | Temporarily peek at the desktop | -| Windows logo key + Ctrl + F | Search for PCs (if you're on a network) | - - - -### Locked-down Ctrl+Alt+Del screen - -The multi-app mode removes options (e.g. **Change a password**, **Task Manager**, **Network**) in the Ctrl+Alt+Del screen to ensure the users cannot access the functionalities that are not allowed in the lockdown experience. - -### Auto-trigger touch keyboard - -In the multi-app mode, the touch keyboard will be automatically triggered when there is an input needed and no physical keyboard is attached on touch-enabled devices. You don’t need to configure any other setting to enforce this behavior. diff --git a/windows/configuration/kiosk-xml.md b/windows/configuration/kiosk-xml.md deleted file mode 100644 index d4525a15f4..0000000000 --- a/windows/configuration/kiosk-xml.md +++ /dev/null @@ -1,955 +0,0 @@ ---- -title: Assigned Access configuration kiosk XML reference (Windows 10/11) -description: Learn about the assigned access configuration (kiosk) for XML and XSD for kiosk device configuration in Windows 10/11. -ms.reviewer: sybruckm -manager: aaroncz -ms.prod: windows-client -author: lizgt2000 -ms.localizationpriority: medium -ms.author: lizlong -ms.topic: article -ms.technology: itpro-configure -ms.date: 12/31/2017 ---- - -# Assigned Access configuration (kiosk) XML reference - - -**Applies to** - -- Windows 10 -- Windows 11 - -## Full XML sample - ->[!NOTE] ->Updated for Windows 10, version 1903, 1909, and 2004. - -```xml - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ]]> - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ]]> - - - - - - - domain\account - - - - AzureAD\john@contoso.onmicrosoft.com - - - - localaccount - - - - - - - - - - - - - - - - - - - - -``` -## Kiosk only sample XML - -```xml - - - - - - - - - - singleappuser - - - - -``` - -## Auto Launch Sample XML - -This sample demonstrates that both UWP and Win32 apps can be configured to automatically launch, when assigned access account logs in. One profile can have at most one app configured for auto launch. AutoLaunchArguments are passed to the apps as is and the app needs to handle the arguments explicitly. - -```xml - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ]]> - - - - - - - - - - - - - - - - - - - - - - - - - - - ]]> - - - - - - - aauser1 - - - - aauser2 - - - - - -``` - -## Microsoft Edge Kiosk XML Sample -```xml - - - - - - - - - - - EdgeKioskUser - - - - -``` - -## Global Profile Sample XML - -Global Profile is supported on: - -- Windows 11 -- Windows 10, version 2004 and later - -Global Profile is designed for scenarios where a user doesn't have a designated profile, yet you still want the user to run in lockdown mode. It's also used as mitigation when a profile can't be determined for a user. - -This sample demonstrates that only a global profile is used, with no active user configured. Global Profile will be applied when every non-admin account signs in. - -```xml - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ]]> - - - - - - - - -``` - -Below sample shows dedicated profile and global profile mixed usage, a user would use one profile, everyone else that's non-admin will use another profile. -```xml - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ]]> - - - - - - - - - - - - - - - - - - - - - - - - - - - ]]> - - - - - - - - aauser - - - - - -``` - -## Folder Access sample xml -Starting with Windows 10 version 1809 +, folder access is locked down so that when common file dialog is opened, IT Admin can specify if the user has access to the Downloads folder, or no access to any folder at all. This restriction has been redesigned for finer granularity and easier use, and is available in Windows 10 version 2009+. - -IT Admin now can specify user access to Downloads folder, Removable drives, or no restrictions at all. Downloads and Removable Drives can be allowed at the same time. - -```xml - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ]]> - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ]]> - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ]]> - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ]]> - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ]]> - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ]]> - - - - - - - multi1 - - - - multi2 - - - - multi3 - - - - multi4 - - - - multi5 - - - - multi6 - - - - - - -``` - -## XSD for AssignedAccess configuration XML - -> [!NOTE] -> Updated for Windows 10, version 1903 and later. - -The following XML schema is for AssignedAccess Configuration up to Windows 10, version 1803 release: - -```xml - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -``` - -The following XML is the schema for new features introduced in Windows 10 1809 release: - -```xml - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -``` - -The following XML is the schema for Windows 10 version 1909+: - -```xml - - - - - - - - - - - - - - - - - - -``` - -To authorize a compatible configuration XML that includes elements and attributes from Windows 10 version 1809 or newer / Windows 11, always include the namespace of these add-on schemas, and decorate the attributes and elements accordingly with the namespace alias. - -For example, to configure the autolaunch feature that was added in Windows 10 version 1809 / Windows 11, use the following sample. Notice an alias r1809 is given to the 201810 namespace for Windows 10 version 1809 / Windows 11, and the alias is tagged on AutoLaunch and AutoLaunchArguments inline. - -```xml - - - - - - -``` diff --git a/windows/configuration/lock-down-windows-10-applocker.md b/windows/configuration/lock-down-windows-10-applocker.md deleted file mode 100644 index 0b37ec1768..0000000000 --- a/windows/configuration/lock-down-windows-10-applocker.md +++ /dev/null @@ -1,120 +0,0 @@ ---- -title: Use AppLocker to create a Windows 10 kiosk that runs multiple apps (Windows 10) -description: Learn how to use AppLocker to configure a kiosk device running Windows 10 Enterprise or Windows 10 Education so that users can only run a few specific apps. -ms.reviewer: sybruckm -manager: aaroncz -ms.prod: windows-client -author: lizgt2000 -ms.localizationpriority: medium -ms.date: 07/30/2018 -ms.author: lizlong -ms.topic: article -ms.technology: itpro-configure ---- - -# Use AppLocker to create a Windows 10 kiosk that runs multiple apps - - -**Applies to** - -- Windows 10 - -Learn how to configure a device running Windows 10 Enterprise or Windows 10 Education, version 1703 and earlier, so that users can only run a few specific apps. The result is similar to [a kiosk device](./kiosk-methods.md), but with multiple apps available. For example, you might set up a library computer so that users can search the catalog and browse the Internet, but can't run any other apps or change computer settings. - ->[!NOTE] ->For devices running Windows 10, version 1709, we recommend the [multi-app kiosk method](lock-down-windows-10-to-specific-apps.md). - -You can restrict users to a specific set of apps on a device running Windows 10 Enterprise or Windows 10 Education by using [AppLocker](/windows/device-security/applocker/applocker-overview). AppLocker rules specify which apps are allowed to run on the device. - -AppLocker rules are organized into collections based on file format. If no AppLocker rules for a specific rule collection exist, all files with that file format are allowed to run. However, when an AppLocker rule for a specific rule collection is created, only the files explicitly allowed in a rule are permitted to run. For more information, see [How AppLocker works](/windows/device-security/applocker/how-applocker-works-techref). - -This topic describes how to lock down apps on a local device. You can also use AppLocker to set rules for applications in a domain by using Group Policy. - -![install create lockdown customize.](images/lockdownapps.png) - -## Install apps - - -First, install the desired apps on the device for the target user account(s). This works for both Unified Windows Platform (UWP) apps and Windows desktop apps. For UWP apps, you must log on as that user for the app to install. For desktop apps, you can install an app for all users without logging on to the particular account. - -## Use AppLocker to set rules for apps - - -After you install the desired apps, set up AppLocker rules to only allow specific apps, and block everything else. - -1. Run Local Security Policy (secpol.msc) as an administrator. - -2. Go to **Security Settings** > **Application Control Policies** > **AppLocker**, and select **Configure rule enforcement**. - - ![configure rule enforcement.](images/apprule.png) - -3. Check **Configured** under **Executable rules**, and then click **OK**. - -4. Right-click **Executable Rules** and then click **Automatically generate rules**. - - ![automatically generate rules.](images/genrule.png) - -5. Select the folder that contains the apps that you want to permit, or select C:\\ to analyze all apps. - -6. Type a name to identify this set of rules, and then click **Next**. - -7. On the **Rule Preferences** page, click **Next**. Be patient, it might take awhile to generate the rules. - -8. On the **Review Rules** page, click **Create**. The wizard will now create a set of rules allowing the installed set of apps. - -9. Read the message and click **Yes**. - - ![default rules warning.](images/appwarning.png) - -10. (optional) If you want a rule to apply to a specific set of users, right-click on the rule and select **Properties**. Then use the dialog to choose a different user or group of users. - -11. (optional) If rules were generated for apps that should not be run, you can delete them by right-clicking on the rule and selecting **Delete**. - -12. Before AppLocker will enforce rules, the **Application Identity** service must be turned on. To force the Application Identity service to automatically start on reset, open a command prompt and run: - - ``` syntax - sc config appidsvc start=auto - ``` - -13. Restart the device. - -## Other settings to lock down - - -In addition to specifying the apps that users can run, you should also restrict some settings and functions on the device. For a more secure experience, we recommend that you make the following configuration changes to the device: - -- Remove **All apps**. - - Go to **Group Policy Editor** > **User Configuration** > **Administrative Templates\\Start Menu and Taskbar\\Remove All Programs list from the Start menu**. - -- Hide **Ease of access** feature on the logon screen. - - Go to **Control Panel** > **Ease of Access** > **Ease of Access Center**, and turn off all accessibility tools. - -- Disable the hardware power button. - - Go to **Power Options** > **Choose what the power button does**, change the setting to **Do nothing**, and then **Save changes**. - -- Disable the camera. - - Go to **Settings** > **Privacy** > **Camera**, and turn off **Let apps use my camera**. - -- Turn off app notifications on the lock screen. - - Go to **Group Policy Editor** > **Computer Configuration** > **Administrative Templates\\System\\Logon\\Turn off app notifications on the lock screen**. - -- Disable removable media. - - Go to **Group Policy Editor** > **Computer Configuration** > **Administrative Templates\\System\\Device Installation\\Device Installation Restrictions**. Review the policy settings available in **Device Installation Restrictions** for the settings applicable to your situation. - - **Note**   - To prevent this policy from affecting a member of the Administrators group, in **Device Installation Restrictions**, enable **Allow administrators to override Device Installation Restriction policies**. - - - -To learn more about locking down features, see [Customizations for Windows 10 Enterprise](/windows-hardware/customize/enterprise/enterprise-custom-portal). - -## Customize Start screen layout for the device (recommended) - - -Configure the Start menu on the device to only show tiles for the permitted apps. You will make the changes manually, export the layout to an .xml file, and then apply that file to devices to prevent users from making changes. For instructions, see [Manage Windows 10 Start layout options](windows-10-start-layout-options-and-policies.md). diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md deleted file mode 100644 index a32e707e87..0000000000 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ /dev/null @@ -1,666 +0,0 @@ ---- -title: Set up a multi-app kiosk on Windows 10 -description: Learn how to configure a kiosk device running Windows 10 so that users can only run a few specific apps. -author: lizgt2000 -ms.author: lizlong -ms.reviewer: sybruckm -ms.topic: how-to -ms.date: 11/08/2023 -appliesto: - - ✅ Windows 10 Pro - - ✅ Windows 10 Enterprise - - ✅ Windows 10 Education ---- - -# Set up a multi-app kiosk on Windows 10 devices - -> [!NOTE] -> The use of multiple monitors isn't supported for multi-app kiosk mode in Windows 10. - -A [kiosk device](./kiosk-single-app.md) typically runs a single app, and users are prevented from accessing any features or functions on the device outside of the kiosk app. In Windows 10, version 1709, the [AssignedAccess configuration service provider (CSP)](/windows/client-management/mdm/assignedaccess-csp) was expanded to make it easy for administrators to create kiosks that run more than one app. The benefit of a kiosk that runs only one or more specified apps is to provide an easy-to-understand experience for individuals by putting in front of them only the things they need to use, and removing from their view the things they don't need to access. - -The following table lists changes to multi-app kiosk in recent updates. - -| New features and improvements | In update | -| --- | ---| -| - Configure [a single-app kiosk profile](#profile) in your XML file

                        - Assign [group accounts to a config profile](#config-for-group-accounts)

                        - Configure [an account to sign in automatically](#config-for-autologon-account) | Windows 10, version 1803 | -| - Explicitly allow [some known folders when user opens file dialog box](#fileexplorernamespacerestrictions)

                        - [Automatically launch an app](#allowedapps) when the user signs in

                        - Configure a [display name for the autologon account](#config-for-autologon-account) | Windows 10, version 1809

                        **Important:** To use features released in Windows 10, version 1809, make sure that [your XML file](#create-xml-file) references `https://schemas.microsoft.com/AssignedAccess/201810/config`. | - -> [!WARNING] -> The assigned access feature is intended for corporate-owned fixed-purpose devices, like kiosks. When the multi-app assigned access configuration is applied on the device, [certain policies](kiosk-policies.md) are enforced system-wide, and will impact other users on the device. Deleting the kiosk configuration will remove the assigned access lockdown profiles associated with the users, but it cannot revert all the enforced policies (such as Start layout). A factory reset is needed to clear all the policies enforced via assigned access. - -You can configure multi-app kiosks using [Microsoft Intune](#intune) or a [provisioning package](#provision). - -> [!TIP] -> Be sure to check the [configuration recommendations](kiosk-prepare.md) before you set up your kiosk. - - - -## Configure a kiosk in Microsoft Intune - -To configure a kiosk in Microsoft Intune, see: - -- [Windows client and Windows Holographic for Business device settings to run as a dedicated kiosk using Intune](/intune/kiosk-settings) -- [Windows client device settings to run as a kiosk in Intune](/intune/kiosk-settings-windows) - - - -## Configure a kiosk using a provisioning package - -Process: - -1. [Create XML file](#create-xml-file) -2. [Add XML file to provisioning package](#add-xml) -3. [Apply provisioning package to device](#apply-ppkg) - -Watch how to use a provisioning package to configure a multi-app kiosk. - -> [!VIDEO https://www.microsoft.com/videoplayer/embed/fa125d0f-77e4-4f64-b03e-d634a4926884?autoplay=false] - -If you don't want to use a provisioning package, you can deploy the configuration XML file using [mobile device management (MDM)](#use-mdm-to-deploy-the-multi-app-configuration), or you can configure assigned access using the [MDM Bridge WMI Provider](kiosk-mdm-bridge.md). - -### Prerequisites - -- Windows Configuration Designer (Windows 10, version 1709 or later) -- The kiosk device must be running Windows 10 (S, Pro, Enterprise, or Education), version 1709 or later - -> [!NOTE] -> For devices running versions of Windows 10 earlier than version 1709, you can [create AppLocker rules](lock-down-windows-10-applocker.md) to configure a multi-app kiosk. - -### Create XML file - -Let's start by looking at the basic structure of the XML file. - -- A configuration xml can define multiple *profiles*. Each profile has a unique **Id** and defines a set of applications that are allowed to run, whether the taskbar is visible, and can include a custom Start layout. - -- A configuration xml can have multiple *config* sections. Each config section associates a non-admin user account to a default profile **Id**. - -- Multiple config sections can be associated to the same profile. - -- A profile has no effect if it's not associated to a config section. - - ![profile = app and config = account.](images/profile-config.png) - -You can start your file by pasting the following XML into an XML editor, and saving the file as *filename*.xml. Each section of this XML is explained in this article. You can see a full sample version in the [Assigned access XML reference.](kiosk-xml.md) - -```xml - - - - - - - - - - - - - - - - - - -``` - -#### Profile - -There are two types of profiles that you can specify in the XML: - -- **Lockdown profile**: Users assigned a lockdown profile will see the desktop in tablet mode with the specific apps on the Start screen. -- **Kiosk profile**: Starting with Windows 10 version 1803, this profile replaces the KioskModeApp node of the [AssignedAccess CSP](/windows/client-management/mdm/assignedaccess-csp). Users assigned a kiosk profile won't see the desktop, but only the kiosk app running in full-screen mode. - -A lockdown profile section in the XML has the following entries: - -- [**Id**](#id) - -- [**AllowedApps**](#allowedapps) - -- [**FileExplorerNamespaceRestrictions**](#fileexplorernamespacerestrictions) - -- [**StartLayout**](#startlayout) - -- [**Taskbar**](#taskbar) - -A kiosk profile in the XML has the following entries: - -- [**Id**](#id) - -- [**KioskModeApp**](#kioskmodeapp) - -##### Id - -The profile **Id** is a GUID attribute to uniquely identify the profile. You can create a GUID using a GUID generator. The GUID just needs to be unique within this XML file. - -```xml - - - -``` - -##### AllowedApps - -**AllowedApps** is a list of applications that are allowed to run. Apps can be Universal Windows Platform (UWP) apps or Windows desktop applications. Starting with Windows 10 version 1809, you can configure a single app in the **AllowedApps** list to run automatically when the assigned access user account signs in. - -- For UWP apps, you need to provide the App User Model ID (AUMID). [Learn how to get the AUMID](./find-the-application-user-model-id-of-an-installed-app.md), or [get the AUMID from the Start Layout XML](#startlayout). -- For desktop apps, you need to specify the full path of the executable, which can contain one or more system environment variables in the form of `%variableName%`. For example, `%systemroot%` or `%windir%`. -- If an app has a dependency on another app, both must be included in the allowed apps list. For example, Internet Explorer 64-bit has a dependency on Internet Explorer 32-bit, so you must allow both `"C:\Program Files\internet explorer\iexplore.exe"` and `"C:\Program Files (x86)\Internet Explorer\iexplore.exe"`. -- To configure a single app to launch automatically when the user signs in, include `rs5:AutoLaunch="true"` after the AUMID or path. You can also include arguments to be passed to the app. For an example, see [the AllowedApps sample XML](#apps-sample). - -When the multi-app kiosk configuration is applied to a device, AppLocker rules will be generated to allow the apps that are listed in the configuration. Here are the predefined assigned access AppLocker rules for **UWP apps**: - -1. Default rule is to allow all users to launch the signed package apps. -2. The package app blocklist is generated at runtime when the assigned access user signs in. Based on the installed/provisioned package apps available for the user account, assigned access generates the blocklist. This list will exclude the default allowed inbox package apps, which are critical for the system to function. It then excludes the allowed packages that enterprises defined in the assigned access configuration. If there are multiple apps within the same package, all these apps will be excluded. This blocklist will be used to prevent the user from accessing the apps that are currently available for the user but not in the allowed list. - - > [!NOTE] - > You can't manage AppLocker rules that are generated by the multi-app kiosk configuration in [MMC snap-ins](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh994629(v=ws.11)#BKMK_Using_Snapins). Avoid creating AppLocker rules that conflict with AppLocker rules that are generated by the multi-app kiosk configuration. - > - > Multi-app kiosk mode doesn't block the enterprise or the users from installing UWP apps. When a new UWP app is installed during the current assigned access user session, this app will not be in the deny list. When the user signs out and signs in again, the app will be included in the blocklist. If this is an enterprise-deployed line-of-business app and you want to allow it to run, update the assigned access configuration to include it in the allowed app list. - -Here are the predefined assigned access AppLocker rules for **desktop apps**: - -1. Default rule is to allow all users to launch the desktop programs signed with Microsoft Certificate in order for the system to boot and function. The rule also allows the admin user group to launch all desktop programs. -2. There's a predefined inbox desktop app blocklist for the assigned access user account, and this blocklist is adjusted based on the desktop app allowlist that you defined in the multi-app configuration. -3. Enterprise-defined allowed desktop apps are added in the AppLocker allowlist. - -The following example allows Groove Music, Movies & TV, Photos, Weather, Calculator, Paint, and Notepad apps to run on the device, with Notepad configured to automatically launch and create a file called `123.text` when the user signs in. - - - -```xml - - - - - - - - - - - -``` - -##### FileExplorerNamespaceRestrictions - -Starting in Windows 10 version 1809, you can explicitly allow some known folders to be accessed when the user tries to open the file dialog box in multi-app assigned access by including **FileExplorerNamespaceRestrictions** in your XML file. Currently, **Downloads** is the only folder supported. This behavior can also be set using Microsoft Intune. - -The following example shows how to allow user access to the Downloads folder in the common file dialog box. - -> [!TIP] -> To grant access to the Downloads folder through File Explorer, add "Explorer.exe" to the list of allowed apps, and pin a file explorer shortcut to the kiosk start menu. - -```xml - - - - - - ... - - - - - - - ... - - - - - -``` - -`FileExplorerNamespaceRestriction` has been extended in current Windows 10 Prerelease for finer granularity and easier use. For more information and full samples, see [Assigned access XML reference](kiosk-xml.md). By using new elements, you can configure whether a user can access the Downloads folder or removable drives, or have no restrictions at all. - -> [!NOTE] -> - `FileExplorerNamespaceRestrictions` and `AllowedNamespace:Downloads` are available in namespace `https://schemas.microsoft.com/AssignedAccess/201810/config`. -> - `AllowRemovableDrives` and `NoRestriction` are defined in a new namespace `https://schemas.microsoft.com/AssignedAccess/2020/config`. - -* When `FileExplorerNamespaceRestrictions` node isn't used, or used but left empty, the user won't be able to access any folder in a common dialog. For example, **Save As** in the Microsoft Edge browser. -* When Downloads is mentioned in allowed namespace, user will be able to access Downloads folder. -* When `AllowRemovableDrives` is used, user will be to access removable drives. -* When `NoRestriction` is used, no restriction will be applied to the dialog. -* `AllowRemovableDrives` and `AllowedNamespace:Downloads` can be used at the same time. - -##### StartLayout - -After you define the list of allowed applications, you can customize the Start layout for your kiosk experience. You can choose to pin all the allowed apps on the Start screen or just a subset, depending on whether you want the end user to directly access them on the Start screen. - -The easiest way to create a customized Start layout to apply to other Windows client devices is to set up the Start screen on a test device and then export the layout. For detailed steps, see [Customize and export Start layout](customize-and-export-start-layout.md). - -A few things to note here: - -- The test device on which you customize the Start layout should have the same OS version that is installed on the device where you plan to deploy the multi-app assigned access configuration. -- Since the multi-app assigned access experience is intended for fixed-purpose devices, to ensure the device experiences are consistent and predictable, use the *full* Start layout option instead of the *partial* Start layout. -- There are no apps pinned on the taskbar in the multi-app mode, and it's not supported to configure Taskbar layout using the `` tag in a layout modification XML as part of the assigned access configuration. -- The following example uses `DesktopApplicationLinkPath` to pin the desktop app to start. When the desktop app doesn't have a shortcut link on the target device, [learn how to provision .lnk files using Windows Configuration Designer](#lnk-files). - -The following example pins Groove Music, Movies & TV, Photos, Weather, Calculator, Paint, and Notepad apps on Start: - -```xml - - - - - - - - - - - - - - - - - - - - - - ]]> - -``` - -> [!NOTE] -> If an app isn't installed for the user, but is included in the Start layout XML, the app isn't shown on the Start screen. - -![What the Start screen looks like when the XML sample is applied.](images/sample-start.png) - -##### Taskbar - -Define whether you want to have the taskbar present in the kiosk device. For tablet-based or touch-enabled all-in-one kiosks, when you don't attach a keyboard and mouse, you can hide the taskbar as part of the multi-app experience if you want. - -The following example exposes the taskbar to the end user: - -```xml - -``` - -The following example hides the taskbar: - -```xml - -``` - -> [!NOTE] -> This is different from the **Automatically hide the taskbar** option in tablet mode, which shows the taskbar when swiping up from or moving the mouse pointer down to the bottom of the screen. Setting **ShowTaskbar** as **false** will always keep the taskbar hidden. - -##### KioskModeApp - -**KioskModeApp** is used for a [kiosk profile](#profile) only. Enter the AUMID for a single app. You can only specify one kiosk profile in the XML. - -```xml - -``` - -> [!IMPORTANT] -> The kiosk profile is designed for public-facing kiosk devices. We recommend that you use a local, non-administrator account. If the device is connected to your company network, using a domain or Microsoft Entra account could potentially compromise confidential information. - -#### Configs - -Under **Configs**, define which user account will be associated with the profile. When this user account signs in on the device, the associated assigned access profile will be enforced. This behavior includes the allowed apps, Start layout, taskbar configuration, and other local group policies or mobile device management (MDM) policies set as part of the multi-app experience. - -The full multi-app assigned access experience can only work for non-admin users. It's not supported to associate an admin user with the assigned access profile. Making this configuration in the XML file will result in unexpected or unsupported experiences when this admin user signs in. - -You can assign: - -- [A local standard user account that signs in automatically](#config-for-autologon-account) (Applies to Windows 10, version 1803 only) -- [An individual account, which can be local, domain, or Microsoft Entra ID](#config-for-individual-accounts) -- [A group account, which can be local, Active Directory (domain), or Microsoft Entra ID](#config-for-group-accounts) (Applies to Windows 10, version 1803 only). - -> [!NOTE] -> Configs that specify group accounts cannot use a kiosk profile, only a lockdown profile. If a group is configured to a kiosk profile, the CSP will reject the request. - -##### Config for AutoLogon Account - -When you use `` and the configuration is applied to a device, the specified account (managed by Assigned Access) is created on the device as a local standard user account. The specified account is signed in automatically after restart. - -The following example shows how to specify an account to sign in automatically. - -```xml - - - - - - -``` - -Starting with Windows 10 version 1809, you can configure the display name that will be shown when the user signs in. The following example shows how to create an AutoLogon Account that shows the name "Hello World". - -```xml - - - - - - -``` - -On domain-joined devices, local user accounts aren't shown on the sign-in screen by default. To show the **AutoLogonAccount** on the sign-in screen, enable the following Group Policy setting: **Computer Configuration > Administrative Templates > System > Logon > Enumerate local users on domain-joined computers**. (The corresponding MDM policy setting is [WindowsLogon/EnumerateLocalUsersOnDomainJoinedComputers in the Policy CSP](/windows/client-management/mdm/policy-csp-windowslogon#windowslogon-enumeratelocalusersondomainjoinedcomputers).) - -> [!IMPORTANT] -> When Exchange Active Sync (EAS) password restrictions are active on the device, the autologon feature does not work. This behavior is by design. For more informations, see [How to turn on automatic logon in Windows](/troubleshoot/windows-server/user-profiles-and-logon/turn-on-automatic-logon). - -##### Config for individual accounts - -Individual accounts are specified using ``. - -- Local account can be entered as `machinename\account` or `.\account` or just `account`. -- Domain account should be entered as `domain\account`. -- Microsoft Entra account must be specified in this format: `AzureAD\{email address}`. **AzureAD** must be provided _as is_, and consider it's a fixed domain name. Then follow with the Microsoft Entra ID email address. For example, `AzureAD\someone@contoso.onmicrosoft.com` - -> [!WARNING] -> Assigned access can be configured via WMI or CSP to run its applications under a domain user or service account, rather than a local account. However, use of domain user or service accounts introduces risks that an attacker subverting the assigned access application might gain access to sensitive domain resources that have been inadvertently left accessible to any domain account. We recommend that customers proceed with caution when using domain accounts with assigned access, and consider the domain resources potentially exposed by the decision to do so. - -Before applying the multi-app configuration, make sure the specified user account is available on the device, otherwise it will fail. - -> [!NOTE] -> For both domain and Microsoft Entra accounts, it's not required that target account is explicitly added to the device. As long as the device is AD-joined or Microsoft Entra joined, the account can be discovered in the domain forest or tenant that the device is joined to. For local accounts, it is required that the account exist before you configure the account for assigned access. - -```xml - - - MultiAppKioskUser - - - -``` - -##### Config for group accounts - -Group accounts are specified using ``. Nested groups aren't supported. For example, if user A is member of Group 1, Group 1 is member of Group 2, and Group 2 is used in ``, user A won't have the kiosk experience. - -- Local group: Specify the group type as **LocalGroup** and put the group name in Name attribute. Any Microsoft Entra accounts that are added to the local group won't have the kiosk settings applied. - - ```xml - - - - - ``` - -- Domain group: Both security and distribution groups are supported. Specify the group type as ActiveDirectoryGroup. Use the domain name as the prefix in the name attribute. - - ```xml - - - - - ``` - -- Microsoft Entra group: Use the group object ID from the Azure portal to uniquely identify the group in the Name attribute. You can find the object ID on the overview page for the group in **Users and groups** > **All groups**. Specify the group type as **AzureActiveDirectoryGroup**. The kiosk device must have internet connectivity when users that belong to the group sign-in. - - ```xml - - - - - ``` - - > [!NOTE] - > If a Microsoft Entra group is configured with a lockdown profile on a device, a user in the Microsoft Entra group must change their password (after the account has been created with default password on the portal) before they can sign in to this device. If the user uses the default password to sign in to the device, the user will be immediately signed out. - - - -#### [Preview] Global profile - -Global profile is available in Windows 10. If you want everyone who signs into a specific device to be assigned as an access user, even if there's no dedicated profile for that user. Alternatively, perhaps Assigned Access couldn't identify a profile for the user and you want to have a fallback profile. Global profile is designed for these scenarios. - -Usage is demonstrated below, by using the new XML namespace and specifying `GlobalProfile` from that namespace. When you configure `GlobalProfile`, a non-admin account logs in, if this user doesn't have a designated profile in Assigned Access, or Assigned Access fails to determine a profile for current user, a global profile is applied for the user. - -> [!NOTE] -> 1. `GlobalProfile` can only be a multi-app profile. -> 2. Only one `GlobalProfile` can be used in one `AssignedAccess` configuration XML. -> 3. `GlobalProfile` can be used as the only config, or it can be used along with regular user or group config. - -```xml - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ]]> - - - - - - - - -``` - -### Add XML file to provisioning package - -Before you add the XML file to a provisioning package, you can [validate your configuration XML against the XSD](kiosk-xml.md#xsd-for-assignedaccess-configuration-xml). - -Use the Windows Configuration Designer tool to create a provisioning package. [Learn how to install Windows Configuration Designer.](provisioning-packages/provisioning-install-icd.md) - -> [!IMPORTANT] -> When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed. - -1. Open Windows Configuration Designer. By default: `%systemdrive%\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86\ICD.exe`. - -2. Choose **Advanced provisioning**. - -3. Name your project, and select **Next**. - -4. Choose **All Windows desktop editions** and select **Next**. - -5. On **New project**, select **Finish**. The workspace for your package opens. - -6. Expand **Runtime settings** > **AssignedAccess** > **MultiAppAssignedAccessSettings**. - -7. In the center pane, select **Browse**. Locate and select the assigned access configuration XML file that you created. - - ![Screenshot of the MultiAppAssignedAccessSettings field in Windows Configuration Designer.](images/multiappassignedaccesssettings.png) - -8. _Optional: If you want to apply the provisioning package after device initial setup and there's an admin user already available on the kiosk device, skip this step._ Create an admin user account in **Runtime settings** > **Accounts** > **Users**. Provide a **UserName** and **Password**, and select **UserGroup** as **Administrators**. With this account, you can view the provisioning status and logs if needed. - -9. _Optional: If you already have a non-admin account on the kiosk device, skip this step._ Create a local standard user account in **Runtime settings** > **Accounts** > **Users**. Make sure the **UserName** is the same as the account that you specify in the configuration XML. Select **UserGroup** as **Standard Users**. - -10. On the **File** menu, select **Save.** - -11. On the **Export** menu, select **Provisioning package**. - -12. Change **Owner** to **IT Admin**, which will set the precedence of this provisioning package higher than provisioning packages applied to this device from other sources, and then select **Next.** - -13. Optional. In the **Provisioning package security** window, you can choose to encrypt the package and enable package signing. - - - **Enable package encryption** - If you select this option, an auto-generated password will be shown on the screen. - - - **Enable package signing** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by clicking **Browse** and choosing the certificate you want to use to sign the package. - -14. Select **Next** to specify the output location where you want the provisioning package to go when it's built. By default, Windows Imaging and Configuration Designer (ICD) uses the project folder as the output location. - - Optionally, you can select **Browse** to change the default output location. - -15. Select **Next**. - -16. Select **Build** to start building the package. The provisioning package doesn't take long to build. The project information is displayed in the build page and the progress bar indicates the build status. - - If you need to cancel the build, select **Cancel**. This action cancels the current build process, closes the wizard, and takes you back to the **Customizations Page**. - -17. If your build fails, an error message will show up that includes a link to the project folder. You can scan the logs to determine what caused the error. Once you fix the issue, try building the package again. - - If your build is successful, the name of the provisioning package, output directory, and project directory will be shown. - - - If you choose, you can build the provisioning package again and pick a different path for the output package. To do this action, select **Back** to change the output package name and path, and then select **Next** to start another build. - - If you're done, select **Finish** to close the wizard and go back to the **Customizations Page**. - -18. Copy the provisioning package to the root directory of a USB drive. - - - -### Apply provisioning package to device - -Provisioning packages can be applied to a device during initial setup (out-of-box experience or "OOBE") and after ("runtime"). For more information, see [Apply a provisioning package](./provisioning-packages/provisioning-apply-package.md). - -> [!NOTE] -> If your provisioning package doesn't include the assigned access user account creation, make sure the account you specified in the multi-app configuration XML exists on the device. - -### Use MDM to deploy the multi-app configuration - -Multi-app kiosk mode is enabled by the [AssignedAccess configuration service provider (CSP)](/windows/client-management/mdm/assignedaccess-csp). Your MDM policy can contain the assigned access configuration XML. - -If your device is enrolled with an MDM service that supports applying the assigned access configuration, you can use it to apply the setting remotely. - -The OMA-URI for multi-app policy is `./Device/Vendor/MSFT/AssignedAccess/Configuration`. - -## Considerations for Windows Mixed Reality immersive headsets - -With the advent of [mixed reality devices (video link)](https://www.youtube.com/watch?v=u0jqNioU2Lo), you might want to create a kiosk that can run mixed reality apps. - -To create a multi-app kiosk that can run mixed reality apps, you must include the following apps in the [AllowedApps list](#allowedapps): - -```xml - - - - -``` - -These apps are in addition to any mixed reality apps that you allow. - -**Before your kiosk user signs in:** An admin user must sign in to the PC, connect a mixed reality device, and complete the guided setup for the Mixed Reality Portal. The first time that the Mixed Reality Portal is set up, some files and content are downloaded. A kiosk user wouldn't have permissions to download and so their setup of the Mixed Reality Portal would fail. - -After the admin has completed setup, the kiosk account can sign in and repeat the setup. The admin user may want to complete the kiosk user setup before providing the PC to employees or customers. - -There's a difference between the mixed reality experiences for a kiosk user and other users. Typically, when a user connects a mixed reality device, they begin in the [Mixed Reality home](/windows/mixed-reality/discover/navigating-the-windows-mixed-reality-home). The Mixed Reality home is a shell that runs in "silent" mode when the PC is configured as a kiosk. When a kiosk user connects a mixed reality device, they'll see only a blank display in the device, and won't have access to the features and functionality available in the home. To run a mixed reality app, the kiosk user must launch the app from the PC Start screen. - -## Policies set by multi-app kiosk configuration - -It's not recommended to set policies enforced in assigned access multi-app mode to different values using other channels, as the multi-app mode has been optimized to provide a locked-down experience. - -When the multi-app assigned access configuration is applied on the device, certain policies are enforced system-wide, and will affect other users on the device. - -### Group policy - -The following local policies affect all **non-administrator** users on the system, regardless whether the user is configured as an assigned access user or not. This list includes local users, domain users, and Microsoft Entra users. - -| Setting | Value | -| --- | --- | -Remove access to the context menus for the task bar | Enabled -Clear history of recently opened documents on exit | Enabled -Prevent users from customizing their Start Screen | Enabled -Prevent users from uninstalling applications from Start | Enabled -Remove All Programs list from the Start menu | Enabled -Remove Run menu from Start Menu | Enabled -Disable showing balloon notifications as toast | Enabled -Do not allow pinning items in Jump Lists | Enabled -Do not allow pinning programs to the Taskbar | Enabled -Do not display or track items in Jump Lists from remote locations | Enabled -Remove Notifications and Action Center | Enabled -Lock all taskbar settings | Enabled -Lock the Taskbar | Enabled -Prevent users from adding or removing toolbars | Enabled -Prevent users from resizing the taskbar | Enabled -Remove frequent programs list from the Start Menu | Enabled -Remove 'Map Network Drive' and 'Disconnect Network Drive' | Enabled -Remove the Security and Maintenance icon | Enabled -Turn off all balloon notifications | Enabled -Turn off feature advertisement balloon notifications | Enabled -Turn off toast notifications | Enabled -Remove Task Manager | Enabled -Remove Change Password option in Security Options UI | Enabled -Remove Sign Out option in Security Options UI | Enabled -Remove All Programs list from the Start Menu | Enabled - Remove and disable setting -Prevent access to drives from My Computer | Enabled - Restrict all drivers - -> [!NOTE] -> When **Prevent access to drives from My Computer** is enabled, users can browse the directory structure in File Explorer, but they cannot open folders and access the contents. Also, they cannot use the **Run** dialog box or the **Map Network Drive** dialog box to view the directories on these drives. The icons representing the specified drives still appear in File Explorer, but if users double-click the icons, a message appears explaining that a setting prevents the action. This setting does not prevent users from using programs to access local and network drives. It does not prevent users from using the Disk Management snap-in to view and change drive characteristics. - -### MDM policy - -Some of the MDM policies based on the [Policy configuration service provider (CSP)](/windows/client-management/mdm/policy-configuration-service-provider) affect all users on the system. - -Setting | Value | System-wide - --- | --- | --- -[Experience/AllowCortana](/windows/client-management/mdm/policy-csp-experience#experience-allowcortana) | 0 - Not allowed | Yes -[Start/AllowPinnedFolderDocuments](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderdocuments) | 0 - Shortcut is hidden and disables the setting in the Settings app | Yes -[Start/AllowPinnedFolderDownloads](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderdownloads) | 0 - Shortcut is hidden and disables the setting in the Settings app | Yes -[Start/AllowPinnedFolderFileExplorer](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderfileexplorer) | 0 - Shortcut is hidden and disables the setting in the Settings app | Yes -[Start/AllowPinnedFolderHomeGroup](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderhomegroup) | 0 - Shortcut is hidden and disables the setting in the Settings app | Yes -[Start/AllowPinnedFolderMusic](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfoldermusic) | 0 - Shortcut is hidden and disables the setting in the Settings app | Yes -[Start/AllowPinnedFolderNetwork](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfoldernetwork) | 0 - Shortcut is hidden and disables the setting in the Settings app | Yes -[Start/AllowPinnedFolderPersonalFolder](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderpersonalfolder) | 0 - Shortcut is hidden and disables the setting in the Settings app | Yes -[Start/AllowPinnedFolderPictures](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderpictures) | 0 - Shortcut is hidden and disables the setting in the Settings app | Yes -[Start/AllowPinnedFolderSettings](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfoldersettings) | 0 - Shortcut is hidden and disables the setting in the Settings app | Yes -[Start/AllowPinnedFolderVideos](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfoldervideos) | 0 - Shortcut is hidden and disables the setting in the Settings app | Yes -Start/DisableContextMenus | 1 - Context menus are hidden for Start apps | No -[Start/HidePeopleBar](/windows/client-management/mdm/policy-csp-start#start-hidepeoplebar) | 1 - True (hide) | No -[Start/HideChangeAccountSettings](/windows/client-management/mdm/policy-csp-start#start-hidechangeaccountsettings) | 1 - True (hide) | Yes -[WindowsInkWorkspace/AllowWindowsInkWorkspace](/windows/client-management/mdm/policy-csp-windowsinkworkspace#windowsinkworkspace-allowwindowsinkworkspace) | 0 - Access to ink workspace is disabled and the feature is turned off | Yes -[Start/StartLayout](/windows/client-management/mdm/policy-csp-start#start-startlayout) | Configuration dependent | No -[WindowsLogon/DontDisplayNetworkSelectionUI](/windows/client-management/mdm/policy-csp-windowslogon#windowslogon-dontdisplaynetworkselectionui) | <Enabled/> | Yes - - - -## Provision .lnk files using Windows Configuration Designer - -First, create your desktop app's shortcut file by installing the app on a test device, using the default installation location. Right-click the installed application, and choose **Send to** > **Desktop (create shortcut)**. Rename the shortcut to `.lnk` - -Next, create a batch file with two commands. If the desktop app is already installed on the target device, skip the first command for MSI install. - -```PowerShell -msiexec /I ".msi" /qn /norestart -copy .lnk "%AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\.lnk" -``` - -In Windows Configuration Designer, under **ProvisioningCommands** > **DeviceContext**: - -- Under **CommandFiles**, upload your batch file, your .lnk file, and your desktop app installation file. - - > [!IMPORTANT] - > Paste the full file path to the .lnk file in the **CommandFiles** field. If you browse to and select the .lnk file, the file path will be changed to the path of the target of the .lnk. - -- Under **CommandLine**, enter `cmd /c *FileName*.bat`. - -## Other methods - -Environments that use WMI can use the [MDM Bridge WMI Provider to configure a kiosk](kiosk-mdm-bridge.md). diff --git a/windows/configuration/lock-down-windows-11-to-specific-apps.md b/windows/configuration/lock-down-windows-11-to-specific-apps.md deleted file mode 100644 index e8f41d7572..0000000000 --- a/windows/configuration/lock-down-windows-11-to-specific-apps.md +++ /dev/null @@ -1,413 +0,0 @@ ---- -title: Set up a multi-app kiosk on Windows 11 -description: Learn how to configure a kiosk device running Windows 11 so that users can only run a few specific apps. -ms.prod: windows-client -ms.technology: itpro-configure -author: lizgt2000 -ms.author: lizlong -ms.date: 05/12/2023 -manager: aaroncz -ms.reviewer: sybruckm -ms.localizationpriority: medium -ms.topic: how-to ---- -# Set up a multi-app kiosk on Windows 11 devices - -**Applies to** - -- Windows 11 Pro, Enterprise, IoT Enterprise and Education - -> [!NOTE] -> The use of multiple monitors is supported for multi-app kiosk mode in Windows 11. - -An assigned access multi-app kiosk runs one or more apps from the desktop. People using the kiosk see a customized Start that shows only the apps that are allowed. With this approach, you can configure a locked-down experience for different account types. A multi-app kiosk is appropriate for devices that are shared by multiple people. Here's a guide on how to set up a multi-app kiosk. - -> [!WARNING] -> The assigned access feature is intended for corporate-owned fixed-purpose devices, like kiosks. When the multi-app assigned access configuration is applied on the device, [certain policies](kiosk-policies.md) are enforced system-wide, and will impact other users on the device. Deleting the kiosk configuration will remove the assigned access lockdown profiles associated with the users, but it cannot revert all the enforced policies (such as Start layout). A factory reset is needed to clear all the policies enforced via assigned access. - -> [!TIP] -> Be sure to check the [configuration recommendations](kiosk-prepare.md) before you set up your kiosk. - -## Configure a Multi-App Kiosk - -See the table below for the different methods to configure a multi-app kiosk in Windows 11. - -|Configuration Method|Availability| -|--------------------|------------| -|[MDM WMI Bridge Provider](#configure-a-kiosk-using-wmi-bridge) | Available May 2023| - - - -> [!NOTE] -> For WMI Bridge/PowerShell and Provisioning package methods, you will need to create your own multi-app kiosk XML file as specified below. - -## Create the XML file - -Let's start by looking at the basic structure of the XML file. - -- A configuration xml can define multiple *profiles*. Each profile has a unique **Id** and defines a set of applications that are allowed to run, whether the taskbar is visible, and can include a custom Start layout. - -- A configuration xml can have multiple *config* sections. Each config section associates a non-admin user account to a default profile **Id**. - -- Multiple config sections can be associated to the same profile. - -- A profile has no effect if it's not associated to a config section. - -You can start your file by pasting the following XML into an XML editor, and saving the file as *filename*.xml. Each section of this XML is explained in this article. - -> [!NOTE] -> If you want to write a configuration file to be applied to both Windows 10 and Windows 11 devices, follow the [Windows 10 instructions](lock-down-windows-10-to-specific-apps.md) to add the StartLayout tag to your XML file, just above the StartPins tag. Windows will automatically ignore the sections that don't apply to the version running. - -```xml - - - - - - - - - - - - - - - - - - -``` -#### Profile - -There are two types of profiles that you can specify in the XML: - -- **Lockdown profile**: Users assigned a lockdown profile will see the desktop in tablet mode with the specific apps on the Start screen. -- **Kiosk profile**: Starting with Windows 10 version 1803, this profile replaces the KioskModeApp node of the [AssignedAccess CSP](/windows/client-management/mdm/assignedaccess-csp). Users assigned a kiosk profile won't see the desktop, but only the kiosk app running in full-screen mode. - -A lockdown profile section in the XML has the following entries: - -- [**Id**](#id) - -- [**AllowedApps**](#allowedapps) - -- [**StartPins**](#startpins) - -- [**Taskbar**](#taskbar) - -A kiosk profile in the XML has the following entries: - -- [**Id**](#id) - -- [**KioskModeApp**](#kioskmodeapp) - -##### Id - -The profile **Id** is a GUID attribute to uniquely identify the profile. You can create a GUID using a GUID generator. The GUID just needs to be unique within this XML file. - -```xml - - - -``` - -##### AllowedApps - -**AllowedApps** is a list of applications that are allowed to run. Apps can be Universal Windows Platform (UWP) apps or Windows desktop applications. Starting with Windows 10 version 1809, you can configure a single app in the **AllowedApps** list to run automatically when the assigned access user account signs in. - -- For UWP apps, you need to provide the App User Model ID (AUMID). [Learn how to get the AUMID](./find-the-application-user-model-id-of-an-installed-app.md), or [get the AUMID from the Start Layout XML](#create-the-xml-file). -- For desktop apps, you need to specify the full path of the executable, which can contain one or more system environment variables in the form of `%variableName%`. For example, `%systemroot%` or `%windir%`. -- If an app has a dependency on another app, both must be included in the allowed apps list. For example, Internet Explorer 64-bit has a dependency on Internet Explorer 32-bit, so you must allow both `"C:\Program Files\internet explorer\iexplore.exe"` and `"C:\Program Files (x86)\Internet Explorer\iexplore.exe"`. -- To configure a single app to launch automatically when the user signs in, include `rs5:AutoLaunch="true"` after the AUMID or path. You can also include arguments to be passed to the app. For an example, see [the AllowedApps sample XML](#apps-sample). - -When the multi-app kiosk configuration is applied to a device, AppLocker rules will be generated to allow the apps that are listed in the configuration. Here are the predefined assigned access AppLocker rules for **UWP apps**: - -1. Default rule is to allow all users to launch the signed package apps. -2. The package app blocklist is generated at runtime when the assigned access user signs in. Based on the installed/provisioned package apps available for the user account, assigned access generates the blocklist. This list will exclude the default allowed inbox package apps, which are critical for the system to function. It then excludes the allowed packages that enterprises defined in the assigned access configuration. If there are multiple apps within the same package, all these apps will be excluded. This blocklist will be used to prevent the user from accessing the apps that are currently available for the user but not in the allowed list. - - > [!NOTE] - > You can't manage AppLocker rules that are generated by the multi-app kiosk configuration in [MMC snap-ins](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh994629(v=ws.11)#BKMK_Using_Snapins). Avoid creating AppLocker rules that conflict with AppLocker rules that are generated by the multi-app kiosk configuration. - > Multi-app kiosk mode doesn't block the enterprise or the users from installing UWP apps. When a new UWP app is installed during the current assigned access user session, this app will not be in the deny list. When the user signs out and signs in again, the app will be included in the blocklist. If this is an enterprise-deployed line-of-business app and you want to allow it to run, update the assigned access configuration to include it in the allowed app list. - -Here are the predefined assigned access AppLocker rules for **desktop apps**: - -1. Default rule is to allow all users to launch the desktop programs signed with Microsoft Certificate in order for the system to boot and function. The rule also allows the admin user group to launch all desktop programs. -2. There's a predefined inbox desktop app blocklist for the assigned access user account, and this blocklist is adjusted based on the desktop app allowlist that you defined in the multi-app configuration. -3. Enterprise-defined allowed desktop apps are added in the AppLocker allowlist. - -The following example allows Photos, Weather, Calculator, Paint, and Notepad apps to run on the device, with Notepad configured to automatically launch and create a file called `123.text` when the user signs in. - - - -```xml - - - - - - - - - -``` - -##### StartPins - -After you define the list of allowed applications, you can customize the Start layout for your kiosk experience. The easiest way to create a customized Start layout to apply to other Windows client devices is to set up the Start screen on a test device and then export the layout. Once you've decided, you can get the JSON needed for your kiosk configuration by following the steps to [Get the pinnedList JSON](customize-and-export-start-layout.md). If you opt to do this using the PowerShell command, make sure that the system you run the command on has the same file structure as the device on which you will apply the kiosk (the path to the allowed apps must be the same). At the end of this step, you should have a JSON pinnedList that looks something like the below. - -Add your pinnedList JSON into the StartPins tag in your XML file. - -```xml - - - -``` - -> [!NOTE] -> If an app isn't installed for the user, but is included in the Start layout XML, the app isn't shown on the Start screen. - -##### Taskbar - -Define whether you want to have the taskbar present in the kiosk device. For tablet-based or touch-enabled all-in-one kiosks, when you don't attach a keyboard and mouse, you can hide the taskbar as part of the multi-app experience if you want. - -The following example exposes the taskbar to the end user: - -```xml - -``` - -The following example hides the taskbar: - -```xml - -``` - -> [!NOTE] -> This is different from the **Automatically hide the taskbar** option in tablet mode, which shows the taskbar when swiping up from or moving the mouse pointer down to the bottom of the screen. Setting **ShowTaskbar** as **false** will always keep the taskbar hidden. - -##### KioskModeApp - -**KioskModeApp** is used for a [kiosk profile](#profile) only. Enter the AUMID for a single app. You can only specify one kiosk profile in the XML. - -```xml - -``` - -> [!IMPORTANT] -> The kiosk profile is designed for public-facing kiosk devices. We recommend that you use a local, non-administrator account. If the device is connected to your company network, using a domain or Microsoft Entra account could potentially compromise confidential information. - -#### Configs - -Under **Configs**, define which user account will be associated with the profile. When this user account signs in on the device, the associated assigned access profile will be enforced. This behavior includes the allowed apps, Start layout, taskbar configuration, and other local group policies or mobile device management (MDM) policies set as part of the multi-app experience. - -The full multi-app assigned access experience can only work for non-admin users. It's not supported to associate an admin user with the assigned access profile. Making this configuration in the XML file will result in unexpected or unsupported experiences when this admin user signs in. - -You can assign: - -- [A local standard user account that signs in automatically](#config-for-autologon-account) (Applies to Windows 10, version 1803 only) -- [An individual account, which can be local, domain, or Microsoft Entra ID](#config-for-individual-accounts) -- [A group account, which can be local, Active Directory (domain), or Microsoft Entra ID](#config-for-group-accounts) (Applies to Windows 10, version 1803 only). - -> [!NOTE] -> Configs that specify group accounts cannot use a kiosk profile, only a lockdown profile. If a group is configured to a kiosk profile, the CSP will reject the request. - -##### Config for AutoLogon Account - -When you use `` and the configuration is applied to a device, the specified account (managed by Assigned Access) is created on the device as a local standard user account. The specified account is signed in automatically after restart. - -The following example shows how to specify an account to sign in automatically. - -```xml - - - - - - -``` - -Starting with Windows 10 version 1809, you can configure the display name that will be shown when the user signs in. The following example shows how to create an AutoLogon Account that shows the name "Hello World". - -```xml - - - - - - -``` - -On domain-joined devices, local user accounts aren't shown on the sign-in screen by default. To show the **AutoLogonAccount** on the sign-in screen, enable the following Group Policy setting: **Computer Configuration > Administrative Templates > System > Logon > Enumerate local users on domain-joined computers**. (The corresponding MDM policy setting is [WindowsLogon/EnumerateLocalUsersOnDomainJoinedComputers in the Policy CSP](/windows/client-management/mdm/policy-csp-windowslogon#windowslogon-enumeratelocalusersondomainjoinedcomputers).) - ->[!IMPORTANT] ->When Exchange Active Sync (EAS) password restrictions are active on the device, the autologon feature does not work. This behavior is by design. For more informations, see [How to turn on automatic logon in Windows](/troubleshoot/windows-server/user-profiles-and-logon/turn-on-automatic-logon). - -##### Config for individual accounts - -Individual accounts are specified using ``. - -- Local account can be entered as `machinename\account` or `.\account` or just `account`. -- Domain account should be entered as `domain\account`. -- Microsoft Entra account must be specified in this format: `AzureAD\{email address}`. **AzureAD** must be provided _as is_, and consider it's a fixed domain name. Then follow with the Microsoft Entra ID email address. For example, `AzureAD\someone@contoso.onmicrosoft.com` - -> [!WARNING] -> Assigned access can be configured via WMI or CSP to run its applications under a domain user or service account, rather than a local account. However, use of domain user or service accounts introduces risks that an attacker subverting the assigned access application might gain access to sensitive domain resources that have been inadvertently left accessible to any domain account. We recommend that customers proceed with caution when using domain accounts with assigned access, and consider the domain resources potentially exposed by the decision to do so. - -Before applying the multi-app configuration, make sure the specified user account is available on the device, otherwise it will fail. - -> [!NOTE] -> For both domain and Microsoft Entra accounts, it's not required that target account is explicitly added to the device. As long as the device is AD-joined or Microsoft Entra joined, the account can be discovered in the domain forest or tenant that the device is joined to. For local accounts, it is required that the account exist before you configure the account for assigned access. - -```xml - - - MultiAppKioskUser - - - -``` - -##### Config for group accounts - -Group accounts are specified using ``. Nested groups aren't supported. For example, if user A is member of Group 1, Group 1 is member of Group 2, and Group 2 is used in ``, user A won't have the kiosk experience. - -- Local group: Specify the group type as **LocalGroup** and put the group name in Name attribute. Any Microsoft Entra accounts that are added to the local group won't have the kiosk settings applied. - - ```xml - - - - - ``` - -- Domain group: Both security and distribution groups are supported. Specify the group type as ActiveDirectoryGroup. Use the domain name as the prefix in the name attribute. - - ```xml - - - - - ``` - -- Microsoft Entra group: Use the group object ID from the Azure portal to uniquely identify the group in the Name attribute. You can find the object ID on the overview page for the group in **Users and groups** > **All groups**. Specify the group type as **AzureActiveDirectoryGroup**. The kiosk device must have internet connectivity when users that belong to the group sign-in. - - ```xml - - - - - ``` - - > [!NOTE] - > If a Microsoft Entra group is configured with a lockdown profile on a device, a user in the Microsoft Entra group must change their password (after the account has been created with default password on the portal) before they can sign in to this device. If the user uses the default password to sign in to the device, the user will be immediately signed out. - - - -## Configure a kiosk using WMI Bridge - -Environments that use [Windows Management Instrumentation (WMI)](/windows/win32/wmisdk/wmi-start-page) can use the [MDM Bridge WMI Provider](/windows/win32/dmwmibridgeprov/mdm-bridge-wmi-provider-portal) to configure the MDM_AssignedAccess class. - -Here's an example of how to set AssignedAccess configuration: - -1. Download the [psexec tool](/sysinternals/downloads/psexec). -1. Using an elevated command prompt, run `psexec.exe -i -s cmd.exe`. -1. In the command prompt launched by psexec.exe, enter `powershell.exe` to open PowerShell. -1. Save the following Powershell excerpt as a PowerShell script (.ps1), replacing the placeholder "your XML here" with the [Sample Assigned Access XML](#sample-assigned-access-xml) then run the script at the Powershell prompt from the previous step. - -```powershell -$eventLogFilterHashTable = @{ - ProviderName = "Microsoft-Windows-AssignedAccess"; - StartTime = Get-Date -Millisecond 0 -} - -$namespaceName="root\cimv2\mdm\dmmap" -$className="MDM_AssignedAccess" -$obj = Get-CimInstance -Namespace $namespaceName -ClassName $className -$obj.Configuration = [System.Net.WebUtility]::HtmlEncode(@" - - - -"@) - -$obj = Set-CimInstance -CimInstance $obj -ErrorVariable cimSetError -ErrorAction SilentlyContinue -if($cimSetError) { - Write-Output "An ERROR occurred. Displaying error record and attempting to retrieve error logs...`n" - Write-Error -ErrorRecord $cimSetError[0] - - $timeout = New-TimeSpan -Seconds 30 - $stopwatch = [System.Diagnostics.Stopwatch]::StartNew() - do{ - $events = Get-WinEvent -FilterHashtable $eventLogFilterHashTable -ErrorAction Ignore - } until ($events.Count -or $stopwatch.Elapsed -gt $timeout) # wait for the log to be available - - if($events.Count) { - $events | ForEach-Object { - Write-Output "$($_.TimeCreated) [$($_.LevelDisplayName.ToUpper())] $($_.Message -replace "`n|`r")" - } - } else { - Write-Warning "Timed-out attempting to retrieve event logs..." - } - - Exit 1 -} - -Write-Output "Successfully applied Assigned Access configuration" -``` - -## Sample Assigned Access XML - -This section contains a predefined XML file which can be used as a quickstart to get familiar with the Assigned Access multi-app kiosk feature on Windows 11. - -```xml - - - - - - - - - - - - - - - - - - - - - - - MultiAppKioskUser - - - - -``` diff --git a/windows/configuration/lockdown-features-windows-10.md b/windows/configuration/lockdown-features-windows-10.md deleted file mode 100644 index 9a32f053b2..0000000000 --- a/windows/configuration/lockdown-features-windows-10.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -title: Lockdown features from Windows Embedded 8.1 Industry (Windows 10) -description: Many of the lockdown features available in Windows Embedded 8.1 Industry have been modified in some form for Windows 10. -ms.reviewer: -manager: aaroncz -ms.prod: windows-client -author: lizgt2000 -ms.author: lizlong -ms.topic: article -ms.localizationpriority: medium -ms.technology: itpro-configure -ms.date: 12/31/2017 ---- - -# Lockdown features from Windows Embedded 8.1 Industry - -**Applies to** - -- Windows 10 - -Many of the lockdown features available in Windows Embedded 8.1 Industry have been modified in some form for Windows 10. This table maps Windows Embedded Industry 8.1 features to Windows 10 Enterprise features, along with links to documentation. - -|Windows Embedded 8.1 Industry lockdown feature|Windows 10 feature|Changes| -|--- |--- |--- | -|[Hibernate Once/Resume Many (HORM)](/previous-versions/windows/embedded/dn449302(v=winembedded.82)): Quick boot to device|[HORM](/windows-hardware/customize/enterprise/hibernate-once-resume-many-horm-)|HORM is supported in Windows 10, version 1607 and later.| -|[Unified Write Filter](/previous-versions/windows/embedded/dn449332(v=winembedded.82)): protect a device's physical storage media|[Unified Write Filter](/windows-hardware/customize/enterprise/unified-write-filter)|The Unified Write Filter is continued in Windows 10.| -|[Keyboard Filter](/previous-versions/windows/embedded/dn449298(v=winembedded.82)): block hotkeys and other key combinations|[Keyboard Filter](/windows-hardware/customize/enterprise/keyboardfilter)|Keyboard filter is added in Windows 10, version 1511. As in Windows Embedded Industry 8.1, Keyboard Filter is an optional component that can be turned on via **Turn Windows Features On/Off**. Keyboard Filter (in addition to the WMI configuration previously available) will be configurable through Windows Imaging and Configuration Designer (ICD) in the SMISettings path.| -|[Shell Launcher](/previous-versions/windows/embedded/dn449423(v=winembedded.82)): launch a Windows desktop application on sign-on|[Shell Launcher](/windows-hardware/customize/enterprise/shell-launcher)|Shell Launcher continues in Windows 10. It is now configurable in Windows ICD under the **SMISettings** category.
                        Learn [how to use Shell Launcher to create a kiosk device](/windows/configuration/kiosk-single-app) that runs a Windows desktop application.| -|[Application Launcher](/previous-versions/windows/embedded/dn449251(v=winembedded.82)): launch a Universal Windows Platform (UWP) app on sign-on|[Assigned Access](/windows/client-management/mdm/assignedaccess-csp)|The Windows 8 Application Launcher has been consolidated into Assigned Access. Application Launcher enabled launching a Windows 8 app and holding focus on that app. Assigned Access offers a more robust solution for ensuring that apps retain focus.| -|[Dialog Filter](/previous-versions/windows/embedded/dn449395(v=winembedded.82)): suppress system dialogs and control which processes can run|[AppLocker](/windows/device-security/applocker/applocker-overview)|Dialog Filter has been deprecated for Windows 10. Dialog Filter provided two capabilities; the ability to control which processes were able to run, and the ability to prevent dialogs (in practice, system dialogs) from appearing.
                      • Control over which processes are able to run will now be provided by AppLocker.
                      • System dialogs in Windows 10 have been replaced with system toasts. To see more on blocking system toasts, see Toast Notification Filter below.| -|[Toast Notification Filter](/previous-versions/windows/embedded/dn449360(v=winembedded.82)): suppress toast notifications|Mobile device management (MDM) and Group Policy|Toast Notification Filter has been replaced by MDM and Group Policy settings for blocking the individual components of non-critical system toasts that may appear. For example, to prevent a toast from appearing when a USB drive is connected, ensure that USB connections have been blocked using the USB-related policies, and turn off notifications from apps.
                        Group Policy: **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Notifications**
                        MDM policy name may vary depending on your MDM service. In Microsoft Intune, use **Allow action center notifications** and a [custom OMA-URI setting](/mem/intune/configuration/custom-settings-windows-10) for **AboveLock/AllowActionCenterNotifications**.| -|[Embedded Lockdown Manager](/previous-versions/windows/embedded/dn449279(v=winembedded.82)): configure lockdown features|[Windows Imaging and Configuration Designer (ICD)](/windows/configuration/provisioning-packages/provisioning-install-icd)|The Embedded Lockdown Manager has been deprecated for Windows 10 and replaced by the Windows ICD. Windows ICD is the consolidated tool for Windows imaging and provisioning scenarios and enables configuration of all Windows settings, including the lockdown features previously configurable through Embedded Lockdown Manager.| -|[USB Filter](/previous-versions/windows/embedded/dn449350(v=winembedded.82)): restrict USB devices and peripherals on system|MDM and Group Policy|The USB Filter driver has been replaced by MDM and Group Policy settings for blocking the connection of USB devices.

                        Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **Device Installation** > **Device Installation Restrictions**
                        MDM policy name may vary depending on your MDM service. In Microsoft Intune, use **Removable storage**.| -|[Assigned Access](/previous-versions/windows/embedded/dn449303(v=winembedded.82)): launch a UWP app on sign-in and lock access to system|[Assigned Access](/windows/client-management/mdm/assignedaccess-csp)|Assigned Access has undergone significant improvement for Windows 10. In Windows 8.1, Assigned Access blocked system hotkeys and edge gestures, and non-critical system notifications, but it also applied some of these limitations to other accounts on the device.
                        In Windows 10, Assigned Access no longer affects accounts other than the one being locked down. Assigned Access now restricts access to other apps or system components by locking the device when the selected user account logs in and launching the designated app above the lock screen, ensuring that no unintended functionality can be accessed.

                        Learn [how to use Assigned Access to create a kiosk device](/windows/configuration/kiosk-single-app) that runs a Universal Windows app.| -|[Gesture Filter](/previous-versions/windows/embedded/dn449374(v=winembedded.82)): block swipes from top, left, and right edges of screen|MDM and Group Policy|In Windows 8.1, gestures provided the ability to close an app, to switch apps, and to reach the Charms. In Windows 10, Charms have been removed. In Windows 10, version 1607, you can block swipes using the [Allow edge swipe](/windows/client-management/mdm/policy-configuration-service-provider#LockDown_AllowEdgeSwipe) policy.| -|[Custom Logon](/previous-versions/windows/embedded/dn449309(v=winembedded.82)): suppress Windows UI elements during Windows sign-on, sign-off, and shutdown|[Embedded Logon](/windows-hardware/customize/desktop/unattend/microsoft-windows-embedded-embeddedlogon)|No changes. Applies only to Windows 10 Enterprise and Windows 10 Education.| -|[Unbranded Boot](/previous-versions/windows/embedded/dn449249(v=winembedded.82)): custom brand a device by removing or replacing Windows boot UI elements|[Unbranded Boot](/windows-hardware/customize/enterprise/unbranded-boot)|No changes. Applies only to Windows 10 Enterprise and Windows 10 Education.| diff --git a/windows/configuration/manage-tips-and-suggestions.md b/windows/configuration/manage-tips-and-suggestions.md deleted file mode 100644 index c4f9b5a850..0000000000 --- a/windows/configuration/manage-tips-and-suggestions.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: Manage Windows 10 and Microsoft Store tips, fun facts, and suggestions (Windows 10) -description: Windows 10 provides organizations with various options to manage user experiences to provide a consistent and predictable experience for employees. -ms.prod: windows-client -author: lizgt2000 -ms.author: lizlong -ms.topic: article -ms.localizationpriority: medium -ms.date: 09/20/2017 -ms.reviewer: -manager: aaroncz -ms.technology: itpro-configure ---- - -# Manage Windows 10 and Microsoft Store tips, "fun facts", and suggestions - - -**Applies to** - -- Windows 10 - - -Since its inception, Windows 10 has included a number of user experience features that provide useful tips, "fun facts", and suggestions as you use Windows, as well as app suggestions from the Microsoft Store. These features are designed to help people get the most out of their Windows 10 experience by, for example, sharing new features, providing more details on the features they use, or sharing content available in the Microsoft Store. Examples of such user experiences include: - -* **Windows Spotlight on the lock screen**. Daily updated images on the lock screen that can include additional facts and tips in “hotspots” that are revealed on hover. - -* **Start menu app suggestions**. App suggestions in Start that recommend productivity tool or utilities from the Microsoft Store. - -* **Additional apps on Start**. Additional apps pre-installed on the Start screen which can enhance the user’s experience. - -* **Windows tips**. Contextual tips that appear based on specific user actions to reveal related Windows features or help users complete a scenario. - -* **Microsoft account notifications**. For users who have a connected Microsoft account, toast notifications about their account like parental control notifications or subscription expiration. - ->[!TIP] -> On all Windows desktop editions, users can directly enable and disable Windows 10 tips, "fun facts", and suggestions and Microsoft Store suggestions. For example, users are able to select personal photos for the lock screen as opposed to the images provided by Microsoft, or turn off tips, "fun facts", or suggestions as they use Windows. - -Windows 10 provides organizations the ability to centrally manage the type of content provided by these features through Group Policy or mobile device management (MDM). The following table describes how administrators can manage suggestions and tips in Windows 10 commercial and education editions. - -## Options available to manage Windows 10 tips and "fun facts" and Microsoft Store suggestions - -| Windows 10 edition | Disable |Show Microsoft apps only | Show Microsoft and popular third-party apps | -| --- | --- | --- | --- | -| Windows 10 Pro | No | Yes | Yes (default) | -| Windows 10 Enterprise | Yes | Yes | Yes (default) | -| Windows 10 Pro Education | Yes (default) | Yes | No (setting cannot be changed) | -| Windows 10 Education | Yes (default) | Yes | No (setting cannot be changed) | - -[Learn more about policy settings for Windows Spotlight.](windows-spotlight.md) - -## Related topics - -- [Manage Windows 10 Start layout](windows-10-start-layout-options-and-policies.md) -- [Cortana integration in your business or enterprise](cortana-at-work/cortana-at-work-overview.md) -- [Windows spotlight on the lock screen](windows-spotlight.md) -- [Windows 10 editions for education customers](/education/windows/windows-editions-for-education-customers) - - -  - -  diff --git a/windows/configuration/provisioning-apn.md b/windows/configuration/provisioning-apn.md deleted file mode 100644 index 4600c0eaf2..0000000000 --- a/windows/configuration/provisioning-apn.md +++ /dev/null @@ -1,116 +0,0 @@ ---- -title: Configure cellular settings for tablets and PCs (Windows 10) -description: Enterprises can provision cellular settings for tablets and PC with built-in cellular modems or plug-in USB modem dongles. -ms.reviewer: -manager: aaroncz -ms.prod: windows-client -author: lizgt2000 -ms.author: lizlong -ms.topic: article -ms.localizationpriority: medium -ms.date: 04/13/2018 -ms.technology: itpro-configure ---- - -# Configure cellular settings for tablets and PCs - - -**Applies to** - -- Windows 10 - ->**Looking for consumer information?** See [Cellular settings in Windows 10](https://support.microsoft.com/help/10739/windows-10-cellular-settings) - -Enterprises can configure cellular settings for tablets and PC that have built-in cellular modems or plug-in USB modem dongles and apply the settings in a [provisioning package](provisioning-packages/provisioning-packages.md). After the devices are configured, users are automatically connected using the access point name (APN) defined by the enterprise without needing to manually connect. - -For users who work in different locations, you can configure one APN to connect when the users are at work and a different APN when the users are traveling. - - -## Prerequisites - -- Windows 10, version 1703, desktop editions (Home, Pro, Enterprise, Education) - -- Tablet or PC with built-in cellular modem or plug-in USB modem dongle - -- [Windows Configuration Designer](provisioning-packages/provisioning-install-icd.md) - -- APN (the address that your PC uses to connect to the Internet when using the cellular data connection) - - >[!NOTE] - >You can get the APN from your mobile operator. - -## How to configure cellular settings in a provisioning package - -1. In Windows Configuration Designer, [start a new project](provisioning-packages/provisioning-create-package.md) using the **Advanced provisioning** option. - -2. Enter a name for your project, and then click **Next**. - -3. Select **All Windows desktop editions**, click **Next**, and then click **Finish**. - -4. Go to **Runtime settings > Connections > EnterpriseAPN**. - -5. Enter a name for the connection, and then click **Add**. - - ![Example of APN connection name.](images/apn-add.png) - -6. The connection appears in the **Available customizations** pane. Select it to view the settings that you can configure for the connection. - - ![settings for new connection.](images/apn-add-details.png) - -7. The following table describes the settings available for the connection. - - | Setting | Description | - | --- | --- | - | AlwaysOn | By default, the Connection Manager will automatically attempt to connect to the APN when a connection is available. You can disable this setting. | - | APNName | Enter the name of the APN. | - | AuthType | You can select **None** (the default), or specify **Auto**, **PAP**, **CHAP**, or **MSCHAPv2** authentication. If you select PAP, CHAP, or MSCHAPv2 authentication, you must also enter a user name and password. | - | ClassId | This is a GUID that defines the APN class to the modem. This is only required when **IsAttachAPN** is **true** and the attach APN is not only used as the Internet APN. | - | Enabled | By default, the connection is enabled. You can change this setting. | - | IccId | This is the Integrated Circuit Card ID (ICCID) associated with the cellular connection profile. | - | IPType | By default, the connection can use IPv4 and IPv6 concurrently. You can change this setting to only IPv4, only IPv6, or IPv6 with IPv4 provided by 46xlat. | - | IsAttachAPN | Specify whether this APN should be requested as part of an LTE Attach. | - | Password | If you select PAP, CHAP, or MSCHAPv2 authentication, enter a password that corresponds to the user name. | - | Roaming | Select the behavior that you want when the device is roaming. The options are:

                        -Disallowed
                        -Allowed (default)
                        -DomesticRoaming
                        -Use OnlyForDomesticRoaming
                        -UseOnlyForNonDomesticRoaming
                        -UseOnlyForRoaming | - | UserName | If you select PAP, CHAP, or MSCHAPv2 authentication, enter a user name. | - -8. After you configure the connection settings, [build the provisioning package](provisioning-packages/provisioning-create-package.md#build-package). - -9. [Apply the package to devices.](provisioning-packages/provisioning-apply-package.md) - - -## Confirm the settings - -After you apply the provisioning package, you can confirm that the settings have been applied. - -1. On the configured device, open a command prompt as an administrator. - -2. Run the following command: - - ``` - netsh mbn show profiles - ``` - -3. The command will list the mobile broadband profiles. Using the "Name" for the listed mobile broadband profile, run: - - ``` - netsh mbn show profiles name="name" - ``` - - This command will list details for that profile, including Access Point Name. - - -Alternatively, you can also use the command: - -``` -netsh mbn show interface -``` - -From the results of that command, get the name of the cellular/mobile broadband interface and run: - -``` -netsh mbn show connection interface="name" -``` - -The result of that command will show details for the cellular interface, including Access Point Name. - - diff --git a/windows/configuration/provisioning-packages/diagnose-provisioning-packages.md b/windows/configuration/provisioning-packages/diagnose-provisioning-packages.md index e5fbf3eb4f..dc6121f2d9 100644 --- a/windows/configuration/provisioning-packages/diagnose-provisioning-packages.md +++ b/windows/configuration/provisioning-packages/diagnose-provisioning-packages.md @@ -1,13 +1,8 @@ --- title: Diagnose Provisioning Packages description: Diagnose general failures in provisioning. -manager: aaroncz -ms.author: lizlong -ms.topic: article -ms.prod: windows-client -ms.technology: itpro-manage -author: lizgt2000 -ms.date: 01/18/2023 +ms.topic: troubleshooting +ms.date: 07/09/2024 --- # Diagnose Provisioning Packages @@ -16,22 +11,20 @@ This article helps diagnose common issues with applying provisioning packages. Y ## Unable to apply power settings -When applying a provisioning package (PPKG) containing power settings, elevated permissions are required. Because elevated permissions are required, power settings applied using the user context after the [initial setup](/windows/configuration/provisioning-packages/provisioning-apply-package#after-initial-setup) results in the error `STATUS_PRIVILEGE_NOT_HELD (HRESULT=0xc0000061)` because an incorrect security context was used. +When you apply a provisioning package (PPKG) containing power settings, elevated permissions are required. Because elevated permissions are required, power settings applied using the user context after the [initial setup](/windows/configuration/provisioning-packages/provisioning-apply-package#after-initial-setup) results in the error `STATUS_PRIVILEGE_NOT_HELD (HRESULT=0xc0000061)` because an incorrect security context was used. To apply the power settings successfully with the [correct security context](/windows/win32/services/localsystem-account), place the PPKG in `%WINDIR%/Provisioning/Packages` directory, and reboot the device. For more information, see [Configure power settings](/windows-hardware/customize/power-settings/configure-power-settings). - - ## Unable to perform bulk enrollment in Microsoft Entra ID -When [enrolling devices into Microsoft Entra ID using provisioning packages](https://techcommunity.microsoft.com/t5/intune-customer-success/bulk-join-a-windows-device-to-azure-ad-and-microsoft-endpoint/ba-p/2381400), the bulk token request is rejected, if the user requesting a bulk token isn't authorized to grant application consent. For more information, see [Configure how users consent to applications](/azure/active-directory/manage-apps/configure-user-consent). +When you [enroll devices into Microsoft Entra ID using provisioning packages](https://techcommunity.microsoft.com/t5/intune-customer-success/bulk-join-a-windows-device-to-azure-ad-and-microsoft-endpoint/ba-p/2381400), the bulk token request is rejected, if the user requesting a bulk token isn't authorized to grant application consent. For more information, see [Configure how users consent to applications](/azure/active-directory/manage-apps/configure-user-consent). > [!NOTE] > When obtaining the bulk token, you should select "No, sign in to this app only" when prompted for authentication. If you select "OK" instead without also selecting "Allow my organization to manage my device", the bulk token request might be rejected. ## Unable to apply a multivariant provisioning package -When applying a [multivariant package](/windows/configuration/provisioning-packages/provisioning-multivariant), it might be difficult to diagnose why a certain target didn't get applied. There may have been improperly authored conditions that didn't evaluate as expected. +When you apply a [multivariant package](/windows/configuration/provisioning-packages/provisioning-multivariant), it might be difficult to diagnose why a certain target didn't get applied. There may be improperly authored conditions that didn't evaluate as expected. Starting in Windows 11, version 22H2, [MdmDiagnosticsTool](/windows/client-management/diagnose-mdm-failures-in-windows-10) includes multivariant condition values to diagnose problems with multivariant packages to determine why the package wasn't applied. diff --git a/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers.md b/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers.md index e6fe7659b1..9c82d0c44c 100644 --- a/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers.md +++ b/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers.md @@ -1,25 +1,13 @@ --- -title: Configuration service providers for IT pros (Windows 10/11) +title: Configuration service providers for IT pros description: Describes how IT pros and system administrators can use configuration service providers (CSPs) to configure devices. -ms.reviewer: gkomatsu -manager: aaroncz -ms.prod: windows-client -author: lizgt2000 -ms.author: lizlong -ms.topic: article -ms.localizationpriority: medium -ms.technology: itpro-configure -ms.date: 12/31/2017 +ms.topic: how-to +ms.date: 07/09/2024 --- # Configuration service providers for IT pros -**Applies to** - -- Windows 10 -- Windows 11 - -This article explains how IT pros and system administrators can take advantage of many settings available through configuration service providers (CSPs) to configure devices running Windows client in their organizations. CSPs expose device configuration settings in Windows client. The CSPs are used by mobile device management (MDM) service providers and are documented in the [Hardware Dev Center](/windows/client-management/mdm/configuration-service-provider-reference). +This article explains how IT pros and system administrators can take advantage of many settings available through configuration service providers (CSPs) to configure devices running Windows client in their organizations. CSPs expose device configuration settings in Windows client. The CSPs are used by mobile device management (MDM) service providers and are documented in the [Configuration Service Provider reference](/windows/client-management/mdm/configuration-service-provider-reference). ## What is a CSP? @@ -27,19 +15,15 @@ In the client operating system, a CSP is the interface between configuration set On the Windows client platform, the management approach for desktop uses CSPs to configure and manage all devices running Windows client. -Each CSP provides access to specific settings. For example, the [Wi-Fi CSP](/windows/client-management/mdm/wifi-csp) contains the settings to create a Wi-Fi profile. - -CSPs are behind many of the management tasks and policies for Windows client, both in Microsoft Intune and in non-Microsoft MDM service providers. For example, in Intune, the policy to allow search suggestions in the Microsoft Edge address bar uses **Browser/AllowSearchSuggestionsinAddressBar** in the [Policy CSP](/windows/client-management/mdm/policy-configuration-service-provider). - -:::image type="content" source="../images/policytocsp.png" alt-text="How intune maps to CSP"::: +Each CSP provides access to specific settings. For example, the [Wi-Fi CSP](/windows/client-management/mdm/wifi-csp) contains the settings to create a Wi-Fi profile. CSPs are behind many of the management tasks and policies for Windows client, both in Microsoft Intune and in non-Microsoft MDM service providers. CSPs receive configuration policies in the XML-based Synchronization Markup Language (SyncML) format, pushed from an MDM-compliant management server, such as Microsoft Intune. Traditional enterprise management systems, such as Microsoft Configuration Manager, can also target CSPs, by using a client-side Windows Management Instrumentation (WMI)-to-CSP Bridge. -### Synchronization Markup Language (SyncML) +## Synchronization Markup Language (SyncML) The Open Mobile Alliance Device Management (OMA-DM) protocol uses the XML-based SyncML for data exchange between compliant servers and clients. SyncML offers an open standard to use as an alternative to vendor-specific management solutions (such as WMI). The value for enterprises adopting industry standard management protocols is that it allows the management of a broader set of vendor devices using a single platform (such as Microsoft Intune). Device policies, including VPN connection profiles, are delivered to client devices formatted as in SyncML. The target CSP reads this information and applies the necessary configurations. -### The WMI-to-CSP Bridge +## The WMI-to-CSP Bridge The WMI-to-CSP Bridge is a component allowing configuration of Windows client CSPs using scripts and traditional enterprise management software, such as Configuration Manager using WMI. The bridge is responsible for reading WMI commands and through a component called the common device configurator pass them to a CSP for application on the device. @@ -49,138 +33,20 @@ The WMI-to-CSP Bridge is a component allowing configuration of Windows client CS Generally, enterprises rely on Group Policy or MDM to configure and manage devices. For devices running Windows, MDM services use CSPs to configure your devices. -In addition, you may have unmanaged devices, or a large number of devices that you want to configure before enrolling them in management. You may also want to apply custom settings that aren't available through your MDM service. The [CSP documentation](#bkmk-csp-doc) can help you understand the settings that can be configured or queried. You can also learn about all of the available configuration settings. +In addition, you may have unmanaged devices, or a large number of devices that you want to configure before enrolling them in management. You may also want to apply custom settings that aren't available through your MDM service. The [CSP documentation](/windows/client-management/mdm/configuration-service-provider-reference) can help you understand the settings that can be configured or queried. You can also learn about all of the available configuration settings. -### CSPs in Windows Configuration Designer +## CSPs in Windows Configuration Designer -You can use Windows Configuration Designer to create [provisioning packages](./provisioning-packages.md) to apply settings to devices during the out-of-box-experience (OOBE), and after the devices are set up. You can also use provisioning packages to configure a device's connectivity and enroll the device in MDM. Many of the runtime settings in Windows Configuration Designer are based on CSPs. +You can use Windows Configuration Designer to create [provisioning packages](provisioning-packages.md) to apply settings to devices during the out-of-box-experience (OOBE), and after the devices are set up. You can also use provisioning packages to configure a device's connectivity and enroll the device in MDM. Many of the runtime settings in Windows Configuration Designer are based on CSPs. -Many settings in Windows Configuration Designer will display documentation for that setting in the center pane, and will include a reference to the CSP if the setting uses one, as shown in the following image. +Many settings in Windows Configuration Designer display documentation for that setting in the center pane, and include a reference to the CSP if the setting uses one. -:::image type="content" source="../images/cspinicd.png" alt-text="In Windows Configuration Designer, how help content appears in ICD."::: +:::image type="content" source="images/cspinicd.png" alt-text="In Windows Configuration Designer, how help content appears in ICD."::: [Provisioning packages in Windows client](provisioning-packages.md) explains how to use the Windows Configuration Designer tool to create a runtime provisioning package. -### CSPs in MDM +## CSPs in MDM -Most, if not all, CSPs are surfaced through your MDM service. If you see a CSP that provides a capability that you want to make use of and cannot find that capability in your MDM service, contact your MDM provider for assistance. It might be named differently than you expected. You can see the CSPs supported by MDM in the [Configuration service provider reference](/windows/client-management/mdm/configuration-service-provider-reference). +Most, if not all, CSPs are surfaced through your MDM service. If you see a CSP that provides a capability that you want to make use of and can't find that capability in your MDM service, contact your MDM provider for assistance. It might be named differently than you expected. You can see the CSPs supported by MDM in the [Configuration service provider reference](/windows/client-management/mdm/configuration-service-provider-reference). -When a CSP is available but is not explicitly included in your MDM solution, you may be able to make use of the CSP by using OMA-URI settings. In Intune, for example, you can use [custom policy settings](/mem/intune/configuration/custom-settings-configure) to deploy settings. Intune documents [a partial list of settings](/mem/intune/configuration/custom-settings-windows-10) that you can enter in the **OMA-URI Settings** section of a custom policy, if your MDM service provides that extension. You'll notice that the list doesn't explain the meanings of the allowed and default values, so use the [CSP reference documentation](/windows/client-management/mdm/configuration-service-provider-reference) to locate that information. - -### CSPs in Lockdown XML - -## How do you use the CSP documentation? - -All CSPs are documented in the [Configuration service provider reference](/windows/client-management/mdm/configuration-service-provider-reference). - -The [CSP reference](/windows/client-management/mdm/configuration-service-provider-reference) tells you which CSPs are supported on each edition of Windows, and links to the documentation for each individual CSP. - -:::image type="content" source="../images/csptable.png" alt-text="The CSP reference shows the supported Windows editions"::: - -The documentation for each CSP follows the same structure. After an introduction that explains the purpose of the CSP, a diagram shows the parts of the CSP in tree format. - -The full path to a specific configuration setting is represented by its Open Mobile Alliance - Uniform Resource Identifier (OMA-URI). The URI is relative to the devices’ root node (MSFT, for example). Features supported by a particular CSP can be set by addressing the complete OMA-URI path. - -The following example shows the diagram for the [AssignedAccess CSP](/windows/client-management/mdm/assignedaccess-csp). The diagram maps to the XML for that CSP. Notice the different shapes in the diagram: rounded elements are nodes, and rectangular elements are settings or policies for which a value must be supplied. - -:::image type="content" source="../images/provisioning-csp-assignedaccess.png" alt-text="The CSP reference shows the assigned access CSP tree."::: - -The element in the tree diagram after the root node tells you the name of the CSP. Knowing this structure, you would recognize in XML the parts of the URI path for that CSP and, if you saw it in XML, you would know which CSP reference to look up. For example, in the following OMS-URI path for the kiosk mode app settings, you can see that it uses the [AssignedAccess CSP](/windows/client-management/mdm/assignedaccess-csp). - -```XML -./Vendor/MSFT/AssignedAccess/KioskModeApp -``` - -When an element in the diagram uses _italic_ font, it indicates a placeholder for specific information, such as the tenant ID in the following example. - -:::image type="content" source="../images/csp-placeholder.png" alt-text="The placeholder in the CSP tree"::: - -After the diagram, the documentation describes each element. For each policy or setting, the valid values are listed. - -For example, in the [AssignedAccess CSP](/windows/client-management/mdm/assignedaccess-csp), the setting is **KioskModeApp**. The documentation tells you that the value for **KioskModeApp** is a JSON string that contains the user account name and Application User Model ID (AUMID) of the Kiosk mode app. - -The documentation for most CSPs will also include an XML example. - -## CSP examples - -CSPs provide access to many settings useful to enterprises. This section introduces the CSPs that an enterprise might find useful. - -- [Policy CSP](/windows/client-management/mdm/policy-configuration-service-provider) - - The Policy CSP enables the enterprise to configure policies on Windows client. Some of these policy settings can also be applied using Group Policy, and the CSP documentation lists the equivalent Group Policy settings. - - Some of the settings available in the Policy CSP include the following: - - - **Accounts**, such as whether a non-Microsoft account can be added to the device. - - **Application management**, such as whether only Microsoft Store apps are allowed. - - **Bluetooth**, such as the services allowed to use it. - - **Browser**, such as restricting InPrivate browsing. - - **Connectivity**, such as whether the device can be connected to a computer by USB. - - **Defender** (for desktop only), such as day and time to scan. - - **Device lock**, such as the type of PIN or password required to unlock the device. - - **Experience**, such as allowing Cortana. - - **Security**, such as whether provisioning packages are allowed. - - **Settings**, such as enabling the user to change VPN settings. - - **Start**, such as applying a standard Start layout. - - **System**, such as allowing the user to reset the device. - - **Text input**, such as allowing the device to send anonymized user text input data samples to Microsoft. - - **Update**, such as whether the device can use Microsoft Update, Windows Server Update Services (WSUS), or Microsoft Store. - - **WiFi**, such as whether Internet sharing is enabled. - -Here is a list of CSPs supported on Windows 10 Enterprise: - -- [ActiveSync CSP](/windows/client-management/mdm/activesync-csp) -- [Application CSP](/windows/client-management/mdm/application-csp) -- [AppLocker CSP](/windows/client-management/mdm/applocker-csp) -- [AssignedAccess CSP](/windows/client-management/mdm/assignedaccess-csp) -- [Bootstrap CSP](/windows/client-management/mdm/bootstrap-csp) -- [BrowserFavorite CSP](/windows/client-management/mdm/browserfavorite-csp) -- [CellularSettings CSP](/windows/client-management/mdm/cellularsettings-csp) -- [CertificateStore CSP](/windows/client-management/mdm/certificatestore-csp) -- [ClientCertificateInstall CSP](/windows/client-management/mdm/clientcertificateinstall-csp) -- [CM\_CellularEntries CSP](/windows/client-management/mdm/cm-cellularentries-csp) -- [CM\_ProxyEntries CSP](/windows/client-management/mdm/cm-proxyentries-csp) -- [CMPolicy CSP](/windows/client-management/mdm/cmpolicy-csp) -- [Defender CSP](/windows/client-management/mdm/defender-csp) -- [DevDetail CSP](/windows/client-management/mdm/devdetail-csp) -- [DeviceInstanceService CSP](/windows/client-management/mdm/deviceinstanceservice-csp) -- [DeviceLock CSP](/windows/client-management/mdm/devicelock-csp) -- [DeviceStatus CSP](/windows/client-management/mdm/devicestatus-csp) -- [DevInfo CSP](/windows/client-management/mdm/devinfo-csp) -- [DiagnosticLog CSP](/windows/client-management/mdm/diagnosticlog-csp) -- [DMAcc CSP](/windows/client-management/mdm/dmacc-csp) -- [DMClient CSP](/windows/client-management/mdm/dmclient-csp) -- [Email2 CSP](/windows/client-management/mdm/email2-csp) -- [EnterpriseAPN CSP](/windows/client-management/mdm/enterpriseapn-csp) -- [EnterpriseAssignedAccess CSP](/windows/client-management/mdm/enterpriseassignedaccess-csp) -- [EnterpriseDesktopAppManagement CSP](/windows/client-management/mdm/enterprisedesktopappmanagement-csp) -- [EnterpriseExt CSP](/windows/client-management/mdm/enterpriseext-csp) -- [EnterpriseModernAppManagement CSP](/windows/client-management/mdm/enterprisemodernappmanagement-csp) -- [FileSystem CSP](/windows/client-management/mdm/filesystem-csp) -- [HealthAttestation CSP](/windows/client-management/mdm/healthattestation-csp) -- [HotSpot CSP](/windows/client-management/mdm/hotspot-csp) -- [Maps CSP](/windows/client-management/mdm/maps-csp) -- [NAP CSP](/windows/client-management/mdm/filesystem-csp) -- [NAPDEF CSP](/windows/client-management/mdm/napdef-csp) -- [NodeCache CSP](https://go.microsoft.com/fwlink/p/?LinkId=723265) -- [PassportForWork CSP](/windows/client-management/mdm/passportforwork-csp) -- [Policy CSP](/windows/client-management/mdm/policy-configuration-service-provider) -- [PolicyManager CSP](https://go.microsoft.com/fwlink/p/?LinkId=723418) -- [Provisioning CSP](/windows/client-management/mdm/provisioning-csp) -- [Proxy CSP](https://go.microsoft.com/fwlink/p/?LinkId=723372) -- [PXLOGICAL CSP](/windows/client-management/mdm/pxlogical-csp) -- [Registry CSP](/windows/client-management/mdm/registry-csp) -- [RemoteFind CSP](/windows/client-management/mdm/remotefind-csp) -- [RemoteWipe CSP](/windows/client-management/mdm/remotewipe-csp) -- [Reporting CSP](/windows/client-management/mdm/reporting-csp) -- [RootCATrustedCertificates CSP](/windows/client-management/mdm/rootcacertificates-csp) -- [SecurityPolicy CSP](/windows/client-management/mdm/securitypolicy-csp) -- [Storage CSP](/windows/client-management/mdm/storage-csp) -- [SUPL CSP](/windows/client-management/mdm/supl-csp) -- [UnifiedWriteFilter CSP](/windows/client-management/mdm/unifiedwritefilter-csp) -- [Update CSP](/windows/client-management/mdm/update-csp) -- [VPN CSP](/windows/client-management/mdm/vpn-csp) -- [VPNv2 CSP](/windows/client-management/mdm/vpnv2-csp) -- [Wi-Fi CSP](/windows/client-management/mdm/wifi-csp) -- [WindowsLicensing CSP](/windows/client-management/mdm/windowslicensing-csp) -- [WindowsSecurityAuditing CSP](/windows/client-management/mdm/windowssecurityauditing-csp) +When a CSP is available but isn't explicitly included in your MDM solution, you may be able to make use of the CSP by using OMA-URI settings. In Intune, for example, you can use [custom policy settings](/mem/intune/configuration/custom-settings-configure) to deploy settings. Intune documents [a partial list of settings](/mem/intune/configuration/custom-settings-windows-10) that you can enter in the **OMA-URI Settings** section of a custom policy, if your MDM service provides that extension. You'll notice that the list doesn't explain the meanings of the allowed and default values, so use the [CSP reference documentation](/windows/client-management/mdm/configuration-service-provider-reference) to locate that information. diff --git a/windows/configuration/provisioning-packages/images/ICD.png b/windows/configuration/provisioning-packages/images/ICD.png new file mode 100644 index 0000000000..c5525201f1 Binary files /dev/null and b/windows/configuration/provisioning-packages/images/ICD.png differ diff --git a/windows/configuration/images/account-management-details.PNG b/windows/configuration/provisioning-packages/images/account-management-details.PNG similarity index 100% rename from windows/configuration/images/account-management-details.PNG rename to windows/configuration/provisioning-packages/images/account-management-details.PNG diff --git a/windows/configuration/images/add-applications-details.PNG b/windows/configuration/provisioning-packages/images/add-applications-details.PNG similarity index 100% rename from windows/configuration/images/add-applications-details.PNG rename to windows/configuration/provisioning-packages/images/add-applications-details.PNG diff --git a/windows/configuration/images/add-certificates-details.PNG b/windows/configuration/provisioning-packages/images/add-certificates-details.PNG similarity index 100% rename from windows/configuration/images/add-certificates-details.PNG rename to windows/configuration/provisioning-packages/images/add-certificates-details.PNG diff --git a/windows/configuration/images/csp-placeholder.png b/windows/configuration/provisioning-packages/images/csp-placeholder.png similarity index 100% rename from windows/configuration/images/csp-placeholder.png rename to windows/configuration/provisioning-packages/images/csp-placeholder.png diff --git a/windows/configuration/images/cspinicd.png b/windows/configuration/provisioning-packages/images/cspinicd.png similarity index 100% rename from windows/configuration/images/cspinicd.png rename to windows/configuration/provisioning-packages/images/cspinicd.png diff --git a/windows/configuration/images/csptable.png b/windows/configuration/provisioning-packages/images/csptable.png similarity index 100% rename from windows/configuration/images/csptable.png rename to windows/configuration/provisioning-packages/images/csptable.png diff --git a/windows/configuration/images/finish-details.png b/windows/configuration/provisioning-packages/images/finish-details.png similarity index 100% rename from windows/configuration/images/finish-details.png rename to windows/configuration/provisioning-packages/images/finish-details.png diff --git a/windows/configuration/images/icd-create-options-1703.PNG b/windows/configuration/provisioning-packages/images/icd-create-options-1703.PNG similarity index 100% rename from windows/configuration/images/icd-create-options-1703.PNG rename to windows/configuration/provisioning-packages/images/icd-create-options-1703.PNG diff --git a/windows/configuration/images/icd-desktop-1703.PNG b/windows/configuration/provisioning-packages/images/icd-desktop-1703.PNG similarity index 100% rename from windows/configuration/images/icd-desktop-1703.PNG rename to windows/configuration/provisioning-packages/images/icd-desktop-1703.PNG diff --git a/windows/configuration/images/icd-export-menu.png b/windows/configuration/provisioning-packages/images/icd-export-menu.png similarity index 100% rename from windows/configuration/images/icd-export-menu.png rename to windows/configuration/provisioning-packages/images/icd-export-menu.png diff --git a/windows/configuration/images/icd-multi-target-true.png b/windows/configuration/provisioning-packages/images/icd-multi-target-true.png similarity index 100% rename from windows/configuration/images/icd-multi-target-true.png rename to windows/configuration/provisioning-packages/images/icd-multi-target-true.png diff --git a/windows/configuration/images/icd-multi-targetstate-true.png b/windows/configuration/provisioning-packages/images/icd-multi-targetstate-true.png similarity index 100% rename from windows/configuration/images/icd-multi-targetstate-true.png rename to windows/configuration/provisioning-packages/images/icd-multi-targetstate-true.png diff --git a/windows/configuration/images/icd-runtime.PNG b/windows/configuration/provisioning-packages/images/icd-runtime.PNG similarity index 100% rename from windows/configuration/images/icd-runtime.PNG rename to windows/configuration/provisioning-packages/images/icd-runtime.PNG diff --git a/windows/configuration/images/icd-script1.png b/windows/configuration/provisioning-packages/images/icd-script1.png similarity index 100% rename from windows/configuration/images/icd-script1.png rename to windows/configuration/provisioning-packages/images/icd-script1.png diff --git a/windows/configuration/images/icd-script2.png b/windows/configuration/provisioning-packages/images/icd-script2.png similarity index 100% rename from windows/configuration/images/icd-script2.png rename to windows/configuration/provisioning-packages/images/icd-script2.png diff --git a/windows/configuration/images/icd-setting-help.PNG b/windows/configuration/provisioning-packages/images/icd-setting-help.PNG similarity index 100% rename from windows/configuration/images/icd-setting-help.PNG rename to windows/configuration/provisioning-packages/images/icd-setting-help.PNG diff --git a/windows/configuration/images/icd-simple-edit.png b/windows/configuration/provisioning-packages/images/icd-simple-edit.png similarity index 100% rename from windows/configuration/images/icd-simple-edit.png rename to windows/configuration/provisioning-packages/images/icd-simple-edit.png diff --git a/windows/configuration/images/icd-step1.PNG b/windows/configuration/provisioning-packages/images/icd-step1.PNG similarity index 100% rename from windows/configuration/images/icd-step1.PNG rename to windows/configuration/provisioning-packages/images/icd-step1.PNG diff --git a/windows/configuration/images/icd-step2.PNG b/windows/configuration/provisioning-packages/images/icd-step2.PNG similarity index 100% rename from windows/configuration/images/icd-step2.PNG rename to windows/configuration/provisioning-packages/images/icd-step2.PNG diff --git a/windows/configuration/images/icd-step3.PNG b/windows/configuration/provisioning-packages/images/icd-step3.PNG similarity index 100% rename from windows/configuration/images/icd-step3.PNG rename to windows/configuration/provisioning-packages/images/icd-step3.PNG diff --git a/windows/configuration/images/icd-step4.PNG b/windows/configuration/provisioning-packages/images/icd-step4.PNG similarity index 100% rename from windows/configuration/images/icd-step4.PNG rename to windows/configuration/provisioning-packages/images/icd-step4.PNG diff --git a/windows/configuration/images/icd-step5.PNG b/windows/configuration/provisioning-packages/images/icd-step5.PNG similarity index 100% rename from windows/configuration/images/icd-step5.PNG rename to windows/configuration/provisioning-packages/images/icd-step5.PNG diff --git a/windows/configuration/images/icd-switch.PNG b/windows/configuration/provisioning-packages/images/icd-switch.PNG similarity index 100% rename from windows/configuration/images/icd-switch.PNG rename to windows/configuration/provisioning-packages/images/icd-switch.PNG diff --git a/windows/configuration/images/multi-target.png b/windows/configuration/provisioning-packages/images/multi-target.png similarity index 100% rename from windows/configuration/images/multi-target.png rename to windows/configuration/provisioning-packages/images/multi-target.png diff --git a/windows/configuration/images/oobe.png b/windows/configuration/provisioning-packages/images/oobe.png similarity index 100% rename from windows/configuration/images/oobe.png rename to windows/configuration/provisioning-packages/images/oobe.png diff --git a/windows/configuration/images/policytocsp.png b/windows/configuration/provisioning-packages/images/policytocsp.png similarity index 100% rename from windows/configuration/images/policytocsp.png rename to windows/configuration/provisioning-packages/images/policytocsp.png diff --git a/windows/configuration/images/provisioning-csp-assignedaccess.png b/windows/configuration/provisioning-packages/images/provisioning-csp-assignedaccess.png similarity index 100% rename from windows/configuration/images/provisioning-csp-assignedaccess.png rename to windows/configuration/provisioning-packages/images/provisioning-csp-assignedaccess.png diff --git a/windows/configuration/images/provisioning-oobe-choice.png b/windows/configuration/provisioning-packages/images/provisioning-oobe-choice.png similarity index 100% rename from windows/configuration/images/provisioning-oobe-choice.png rename to windows/configuration/provisioning-packages/images/provisioning-oobe-choice.png diff --git a/windows/configuration/images/provisioning-oobe-choose-package.png b/windows/configuration/provisioning-packages/images/provisioning-oobe-choose-package.png similarity index 100% rename from windows/configuration/images/provisioning-oobe-choose-package.png rename to windows/configuration/provisioning-packages/images/provisioning-oobe-choose-package.png diff --git a/windows/configuration/images/provisioning-oobe-installing.png b/windows/configuration/provisioning-packages/images/provisioning-oobe-installing.png similarity index 100% rename from windows/configuration/images/provisioning-oobe-installing.png rename to windows/configuration/provisioning-packages/images/provisioning-oobe-installing.png diff --git a/windows/configuration/images/provisioning-runtime-UAC.png b/windows/configuration/provisioning-packages/images/provisioning-runtime-UAC.png similarity index 100% rename from windows/configuration/images/provisioning-runtime-UAC.png rename to windows/configuration/provisioning-packages/images/provisioning-runtime-UAC.png diff --git a/windows/configuration/images/provisioning-runtime-add-package.png b/windows/configuration/provisioning-packages/images/provisioning-runtime-add-package.png similarity index 100% rename from windows/configuration/images/provisioning-runtime-add-package.png rename to windows/configuration/provisioning-packages/images/provisioning-runtime-add-package.png diff --git a/windows/configuration/images/provisioning-runtime-choose-package.png b/windows/configuration/provisioning-packages/images/provisioning-runtime-choose-package.png similarity index 100% rename from windows/configuration/images/provisioning-runtime-choose-package.png rename to windows/configuration/provisioning-packages/images/provisioning-runtime-choose-package.png diff --git a/windows/configuration/images/provisioning-runtime-click-to-install.png b/windows/configuration/provisioning-packages/images/provisioning-runtime-click-to-install.png similarity index 100% rename from windows/configuration/images/provisioning-runtime-click-to-install.png rename to windows/configuration/provisioning-packages/images/provisioning-runtime-click-to-install.png diff --git a/windows/configuration/images/provisioning-runtime-manage-packages.png b/windows/configuration/provisioning-packages/images/provisioning-runtime-manage-packages.png similarity index 100% rename from windows/configuration/images/provisioning-runtime-manage-packages.png rename to windows/configuration/provisioning-packages/images/provisioning-runtime-manage-packages.png diff --git a/windows/configuration/images/provisioning-runtime-trust.png b/windows/configuration/provisioning-packages/images/provisioning-runtime-trust.png similarity index 100% rename from windows/configuration/images/provisioning-runtime-trust.png rename to windows/configuration/provisioning-packages/images/provisioning-runtime-trust.png diff --git a/windows/configuration/images/set-up-device-details-desktop.PNG b/windows/configuration/provisioning-packages/images/set-up-device-details-desktop.PNG similarity index 100% rename from windows/configuration/images/set-up-device-details-desktop.PNG rename to windows/configuration/provisioning-packages/images/set-up-device-details-desktop.PNG diff --git a/windows/configuration/images/set-up-network-details-desktop.PNG b/windows/configuration/provisioning-packages/images/set-up-network-details-desktop.PNG similarity index 100% rename from windows/configuration/images/set-up-network-details-desktop.PNG rename to windows/configuration/provisioning-packages/images/set-up-network-details-desktop.PNG diff --git a/windows/configuration/images/wcd-app-commands.PNG b/windows/configuration/provisioning-packages/images/wcd-app-commands.PNG similarity index 100% rename from windows/configuration/images/wcd-app-commands.PNG rename to windows/configuration/provisioning-packages/images/wcd-app-commands.PNG diff --git a/windows/configuration/images/wcd-app-name.PNG b/windows/configuration/provisioning-packages/images/wcd-app-name.PNG similarity index 100% rename from windows/configuration/images/wcd-app-name.PNG rename to windows/configuration/provisioning-packages/images/wcd-app-name.PNG diff --git a/windows/configuration/provisioning-packages/provision-pcs-for-initial-deployment.md b/windows/configuration/provisioning-packages/provision-pcs-for-initial-deployment.md index 46ddabb9da..80c1a38048 100644 --- a/windows/configuration/provisioning-packages/provision-pcs-for-initial-deployment.md +++ b/windows/configuration/provisioning-packages/provision-pcs-for-initial-deployment.md @@ -1,77 +1,47 @@ --- -title: Provision PCs with common settings (Windows 10/11) -description: Create a provisioning package to apply common settings to a PC running Windows 10. -ms.reviewer: gkomatsu -manager: aaroncz -ms.prod: windows-client -author: lizgt2000 -ms.author: lizlong -ms.topic: article -ms.localizationpriority: medium -ms.technology: itpro-configure -ms.date: 12/31/2017 +title: Create a provisioning package (desktop wizard) +description: Create a provisioning package to apply common settings to a PC running Windows. +ms.topic: how-to +ms.date: 07/09/2024 --- -# Provision PCs with common settings for initial deployment (desktop wizard) +# Create a provisioning package (desktop wizard) +This article explains how to create and apply a provisioning package that contains common enterprise settings to a device running all desktop editions of Windows client except Home. You can apply a provisioning package on a USB drive to off-the-shelf devices during setup, making it fast and easy to configure new devices. -**Applies to** +The following wizard options provide a simple interface for configuring common settings for desktop and kiosk devices: -- Windows 10 -- Windows 11 +- [Instructions for the desktop wizard](#start-a-new-project) +- [Instructions for the kiosk wizard](../assigned-access/overview.md) +- [Instructions for the HoloLens wizard](/hololens/hololens-provisioning#provisioning-package-hololens-wizard) +- [Instructions for the Surface Hub wizard](/surface-hub/provisioning-packages-for-surface-hub) -This topic explains how to create and apply a provisioning package that contains common enterprise settings to a device running all desktop editions of Windows client except Home. - -You can apply a provisioning package on a USB drive to off-the-shelf devices during setup, making it fast and easy to configure new devices. - -## Advantages -- You can configure new devices without reimaging. - -- Works on desktop devices. - -- No network connectivity required. - -- Simple to apply. - -[Learn more about the benefits and uses of provisioning packages.](provisioning-packages.md) - -## What does the desktop wizard do? - -The desktop wizard helps you configure the following settings in a provisioning package: +In this example, we use the **Provision desktop devices** option which helps you configure the following settings in a provisioning package: - Set device name - Upgrade product edition - Configure the device for shared use -- Remove pre-installed software -- Configure Wi-Fi network -- Enroll device in Active Directory or Microsoft Entra ID -- Create local administrator account +- Remove preinstalled software +- Configure Wi-Fi network +- Enroll device in Active Directory or Microsoft Entra ID +- Create local administrator account - Add applications and certificates ->[!WARNING] ->You must run Windows Configuration Designer on Windows client to configure Microsoft Entra enrollment using any of the wizards. +> [IMPORTANT] +> You must run Windows Configuration Designer on Windows client to configure Microsoft Entra enrollment using any of the wizards. -Provisioning packages can include management instructions and policies, installation of specific apps, customization of network connections and policies, and more. +## Start a new project -> [!TIP] -> Use the desktop wizard to create a package with the common settings, then switch to the advanced editor to add other settings, apps, policies, etc. -> -> :::image type="content" source="../images/icd-simple-edit.png" alt-text="In the desktop wizard, open the advanced editor."::: +1. Open Windows Configuration Designer: From either the Start menu or Start menu search, type **Windows Configuration Designer**, and then select the **Windows Configuration Designer** shortcut. -## Create the provisioning package +1. Select **Provision desktop devices**. -Use the Windows Configuration Designer tool to create a provisioning package. [Learn how to install Windows Configuration Designer.](provisioning-install-icd.md) + :::image type="content" source="images/icd-create-options-1703.png" alt-text="In Windows Configuration Designer, see the ICD start options."::: -1. Open Windows Configuration Designer (by default, %windir%\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86\ICD.exe). +1. Name your project and select **Finish**. The pages for desktop provisioning walk you through the following steps. -2. Click **Provision desktop devices**. + :::image type="content" source="images/icd-desktop-1703.png" alt-text="In Windows Configuration Designer, select Finish, and see the ICD desktop provisioning."::: - :::image type="content" source="../images/icd-create-options-1703.png" alt-text="In Windows Configuration Designer, see the ICD start options."::: - -3. Name your project and click **Finish**. The pages for desktop provisioning will walk you through the following steps. - - :::image type="content" source="../images/icd-desktop-1703.png" alt-text="In Windows Configuration Designer, select Finish, and see the ICD desktop provisioning."::: - > [!IMPORTANT] > When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed. @@ -79,7 +49,7 @@ Use the Windows Configuration Designer tool to create a provisioning package. [L 1. Enable device setup: - :::image type="content" source="../images/set-up-device-details-desktop.png" alt-text="In Windows Configuration Designer, enable device setup, enter the device name, the product key to upgrade, turn off shared use, and remove preinstalled software."::: + :::image type="content" source="images/set-up-device-details-desktop.png" alt-text="In Windows Configuration Designer, enable device setup, enter the device name, the product key to upgrade, turn off shared use, and remove preinstalled software."::: If you want to enable device setup, select **Set up device**, and configure the following settings: @@ -88,68 +58,64 @@ Use the Windows Configuration Designer tool to create a provisioning package. [L - **Configure devices for shared use**: Select **Yes** or **No** to optimize the Windows client for shared use scenarios. - **Remove pre-installed software**: Optional. Select **Yes** if you want to remove preinstalled software. -2. Set up the network: + > [!NOTE] + > To target devices running versions earlier than Windows 10, version 2004, ComputerName customization must be defined from the setting path: `Accounts/ComputerAccount/ComputerName` from the advanced editor. The default path from the simple editor uses a new CSP that isn't available on older systems. - :::image type="content" source="../images/set-up-network-details-desktop.png" alt-text="In Windows Configuration Designer, turn on wireless connectivity, enter the network SSID, and network type."::: +1. Set up the network: + + :::image type="content" source="images/set-up-network-details-desktop.png" alt-text="In Windows Configuration Designer, turn on wireless connectivity, enter the network SSID, and network type."::: If you want to enable network setup, select **Set up network**, and configure the following settings: - **Set up network**: To enable wireless connectivity, select **On**. - - **Network SSID**: Enter the Service Set IDentifier (SSID) of the network. + - **Network SSID**: Enter the Service Set Identifier (SSID) of the network. - **Network type**: Select **Open** or **WPA2-Personal**. If you select **WPA2-Personal**, enter the password for the wireless network. -3. Enable account management: +1. Enable account management: - :::image type="content" source="../images/account-management-details.png" alt-text="In Windows Configuration Designer, join Active Directory, Microsoft Entra ID, or create a local admin account."::: + :::image type="content" source="images/account-management-details.png" alt-text="In Windows Configuration Designer, join Active Directory, Microsoft Entra ID, or create a local admin account."::: If you want to enable account management, select **Account Management**, and configure the following settings: - **Manage organization/school accounts**: Choose how devices are enrolled. Your options: + - **Active Directory**: Enter the credentials for a least-privileged user account to join the device to the domain. - **Microsoft Entra ID**: Before you use a Windows Configuration Designer wizard to configure bulk Microsoft Entra enrollment, [set up Microsoft Entra join in your organization](/azure/active-directory/active-directory-azureadjoin-setup). In your Microsoft Entra tenant, the **maximum number of devices per user** setting determines how many times the bulk token in the wizard can be used. - If you select this option, enter a friendly name for the bulk token you get using the wizard. Set an expiration date for the token. The maximum is 180 days from the date you get the token. Select **Get bulk token**. In **Let's get you signed in**, enter an account that has permissions to join a device to Microsoft Entra ID, and then the password. Select **Accept** to give Windows Configuration Designer the necessary permissions. + If you select this option, enter a friendly name for the bulk token retrieved using the wizard. Set an expiration date for the token. The maximum is 180 days from the date you get the token. Select **Get bulk token**. In **Let's get you signed in**, enter an account that has permissions to join a device to Microsoft Entra ID, and then the password. Select **Accept** to give Windows Configuration Designer the necessary permissions. You must run Windows Configuration Designer on Windows client to configure Microsoft Entra enrollment using any of the wizards. - **Local administrator**: If you select this option, enter a user name and password. If you create a local account in the provisioning package, you must change the password using the **Settings** app every 42 days. If the password isn't changed during that period, the account might be locked out, and unable to sign in. -4. Add applications: +1. Add applications: - :::image type="content" source="../images/add-applications-details.png" alt-text="In Windows Configuration Designer, add an application."::: + :::image type="content" source="images/add-applications-details.png" alt-text="In Windows Configuration Designer, add an application."::: To add applications to the devices, select **Add applications**. You can install multiple applications, including Windows desktop applications (Win32) and Universal Windows Platform (UWP) apps. The settings in this step vary depending on the application you select. For help with the settings, see [Provision PCs with apps](provision-pcs-with-apps.md). -5. Add certificates: +1. Add certificates: - :::image type="content" source="../images/add-certificates-details.png" alt-text="In Windows Configuration Designer, add a certificate."::: + :::image type="content" source="images/add-certificates-details.png" alt-text="In Windows Configuration Designer, add a certificate."::: To add a certificate to the devices, select **Add certificates**, and configure the following settings: - **Certificate name**: Enter a name for the certificate. - **Certificate path**: Browse and select the certificate you want to add. -6. Finish: +1. Finish: - :::image type="content" source="../images/finish-details.png" alt-text="In Windows Configuration Designer, protect your package with a password."::: + :::image type="content" source="images/finish-details.png" alt-text="In Windows Configuration Designer, protect your package with a password."::: To complete the wizard, select **Finish**, and configure the following setting: - **Protect your package**: Select **Yes** or **No** to password protect your provisioning package. When you apply the provisioning package to a device, you must enter this password. -After you're done, click **Create**. It only takes a few seconds. When the package is built, the location where the package is stored is displayed as a hyperlink at the bottom of the page. +After you're done, select **Create**. It only takes a few seconds. When the package is built, the location where the package is stored is displayed as a hyperlink at the bottom of the page. - **Next step**: [How to apply a provisioning package](provisioning-apply-package.md) +## Next steps -## Related articles - -- [Provisioning packages for Windows client](provisioning-packages.md) -- [How provisioning works in Windows client](provisioning-how-it-works.md) -- [Install Windows Configuration Designer](provisioning-install-icd.md) -- [Create a provisioning package](provisioning-create-package.md) -- [Apply a provisioning package](provisioning-apply-package.md) -- [Settings changed when you uninstall a provisioning package](provisioning-uninstall-package.md) -- [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md) -- [PowerShell cmdlets for provisioning Windows client (reference)](provisioning-powershell.md) -- [Windows Configuration Designer command-line interface (reference)](provisioning-command-line.md) -- [Create a provisioning package with multivariant settings](provisioning-multivariant.md) +> [!div class="nextstepaction"] +> Learn more about applying a provisioning package: +> +> [Apply a provisioning package](provisioning-apply-package.md) diff --git a/windows/configuration/provisioning-packages/provision-pcs-with-apps.md b/windows/configuration/provisioning-packages/provision-pcs-with-apps.md index 8efef893cd..3ffeaa9b73 100644 --- a/windows/configuration/provisioning-packages/provision-pcs-with-apps.md +++ b/windows/configuration/provisioning-packages/provision-pcs-with-apps.md @@ -1,196 +1,135 @@ --- -title: Provision PCs with apps (Windows 10/11) +title: Provision PCs with apps description: Learn how to install multiple Universal Windows Platform (UWP) apps and Windows desktop applications (Win32) in a provisioning package. -ms.prod: windows-client -author: lizgt2000 -ms.localizationpriority: medium -ms.author: lizlong -ms.topic: article -ms.reviewer: gkomatsu -manager: aaroncz -ms.technology: itpro-configure -ms.date: 12/31/2017 +ms.topic: how-to +ms.date: 07/09/2024 --- -# Provision PCs with apps - - -**Applies to** - -- Windows 10 -- Windows 11 - +# Provision PCs with apps You can install multiple Universal Windows Platform (UWP) apps and Windows desktop applications (Win32) in a provisioning package. This article explains the various settings in [Windows Configuration Designer](provisioning-install-icd.md) for app install. -When you add an app in a Windows Configuration Designer wizard, the appropriate settings are displayed based on the app that you select. For instructions on adding an app using the advanced editor in Windows Configuration Designer, see [Add an app using advanced editor](#adv). +When you add an app in a Windows Configuration Designer wizard, the appropriate settings are displayed based on the app that you select. For instructions on adding an app using the advanced editor in Windows Configuration Designer, see [Add an app using advanced editor](#add-a-windows-desktop-application-using-advanced-editor). ->[!IMPORTANT] ->If you plan to use Intune to manage your devices, we recommend using Intune to install Microsoft 365 Apps for enterprise 2016 apps (Access, Excel, OneDrive for Business, OneNote, Outlook, PowerPoint, Publisher, Skype for Business, Word, Project Desktop Client, and Visio Pro for Microsoft 365 Apps for enterprise). Apps that are installed using a provisioning package cannot be managed or modified using Intune. [Learn how to assign Microsoft 365 Apps for enterprise 2016 apps using Microsoft Intune.](/intune/apps-add-office365) +> [!IMPORTANT] +> If you plan to use Intune to manage your devices, we recommend using Intune to install Microsoft 365 Apps for enterprise. Apps that are installed using a provisioning package cannot be managed or modified using Intune. [Learn how to add Microsoft 365 Apps to Windows devices with Microsoft Intune.](/intune/apps-add-office365) ## Settings for UWP apps -- **License Path**: Specify the license file if it is an app from the Microsoft Store. This is optional if you have a certificate for the app. - -- **Package family name**: Specify the package family name if you don’t specify a license. This field will be autopopulated after you specify a license. - -- **Required appx dependencies**: Specify the appx dependency packages that are required for the installation of the app +- **License Path**: Specify the license file if it's an app from the Microsoft Store. This is optional if you have a certificate for the app. +- **Package family name**: Specify the package family name if you don't specify a license. This field will be autopopulated after you specify a license. +- **Required appx dependencies**: Specify the appx dependency packages that are required for the installation of the app ## Settings for Windows desktop applications ### MSI installer +- **Command line arguments**: Optionally, append more command arguments. The silent flag is appended for you. Example: PROPERTY=VALUE +- **Continue installations after failure**: Optionally, specify if you want to continue installing more apps if this app fails to install +- **Restart required**: Optionally, specify if you want to reboot after a successful install of this app +- **Required win32 app dependencies**: Optionally, specify more files that are required for the installation of the app. For installers that have multiple file dependencies or have directory structures, [create a cab file of the assets](provisioning-script-to-install-app.md#cab-the-application-assets). The installation script should [include expansion of the .cab file](provisioning-script-to-install-app.md#extract-from-a-cab-example). + > [!NOTE] > You can find more information about command-line options for Msiexec.exe [here](/windows/win32/msi/command-line-options). -- **Command line arguments**: Optionally, append more command arguments. The silent flag is appended for you. Example: PROPERTY=VALUE - -- **Continue installations after failure**: Optionally, specify if you want to continue installing more apps if this app fails to install - -- **Restart required**: Optionally, specify if you want to reboot after a successful install of this app - -- **Required win32 app dependencies**: Optionally, specify more files that are required for the installation of the app. For installers that have multiple file dependencies or have directory structures, [create a cab file of the assets](provisioning-script-to-install-app.md#cab-the-application-assets). The installation script should [include expansion of the .cab file](provisioning-script-to-install-app.md#cab-extract). - ### Exe or other installer -- **Command line arguments**: Append the command line arguments with a silent flag (required). Optionally, append more flags +- **Command line arguments**: Append the command line arguments with a silent flag (required). Optionally, append more flags +- **Return Codes**: Specify the return codes for success and success with restart (0 and 3010 by default respectively) Any return code that isn't listed is interpreted as failure. The text boxes are space delimited. +- **Continue installations after failure**: Optionally, specify if you want to continue installing more apps if this app fails to install +- **Restart required**: Optionally, specify if you want to reboot after a successful install of this app +- **Required win32 app dependencies**: Optionally, specify more files that are required for the installation of the app. For installers that have multiple file dependencies or have directory structures, [create a cab file of the assets](provisioning-script-to-install-app.md#cab-the-application-assets). The installation script should [include expansion of the .cab file](provisioning-script-to-install-app.md#extract-from-a-cab-example). -- **Return Codes**: Specify the return codes for success and success with restart (0 and 3010 by default respectively) Any return code that is not listed will be interpreted as failure. The text boxes are space delimited. +## Add a Windows desktop application using advanced editor -- **Continue installations after failure**: Optionally, specify if you want to continue installing more apps if this app fails to install +1. In the **Available customizations** pane, go to **Runtime settings** > **ProvisioningCommands** > **PrimaryContext** > **Command**. -- **Restart required**: Optionally, specify if you want to reboot after a successful install of this app +1. Enter a name for the first app, and then select **Add**. -- **Required win32 app dependencies**: Optionally, specify more files that are required for the installation of the app. For installers that have multiple file dependencies or have directory structures, [create a cab file of the assets](provisioning-script-to-install-app.md#cab-the-application-assets). The installation script should [include expansion of the .cab file](provisioning-script-to-install-app.md#cab-extract). + ![enter name for first app.](images/wcd-app-name.png) +1. Configure the settings for the appropriate installer type. - + ![enter settings for first app.](images/wcd-app-commands.png) -## Add a Windows desktop application using advanced editor in Windows Configuration Designer +## Add a universal app to your package using advanced editor +Universal apps that you can distribute in the provisioning package can be line-of-business (LOB) apps developed by your organization, Microsoft Store for Business apps that you acquire with [offline licensing](/microsoft-store/acquire-apps-windows-store-for-business), or non-Microsoft apps. This procedure assumes you're distributing apps from the Microsoft Store for Business. For other apps, obtain the necessary information (such as the package family name) from the app developer. -1. In the **Available customizations** pane, go to **Runtime settings** > **ProvisioningCommands** > **PrimaryContext** > **Command**. - -2. Enter a name for the first app, and then select **Add**. - - ![enter name for first app.](../images/wcd-app-name.png) - -3. Configure the settings for the appropriate installer type. - - ![enter settings for first app.](../images/wcd-app-commands.png) - -## Add a universal app to your package - -Universal apps that you can distribute in the provisioning package can be line-of-business (LOB) apps developed by your organization, Microsoft Store for Business apps that you acquire with [offline licensing](/microsoft-store/acquire-apps-windows-store-for-business), or third-party apps. This procedure will assume you are distributing apps from the Microsoft Store for Business. For other apps, obtain the necessary information (such as the package family name) from the app developer. - -1. In the **Available customizations** pane, go to **Runtime settings** > **UniversalAppInstall**. - -2. For **DeviceContextApp**, specify the **PackageFamilyName** for the app. In Microsoft Store for Business, the package family name is listed in the **Package details** section of the download page. - -3. For **ApplicationFile**, select **Browse** to find and select the target app (either an \*.appx or \*.appxbundle). - -4. For **DependencyAppxFiles**, select **Browse** to find and add any dependencies for the app. In Microsoft Store for Business, any dependencies for the app are listed in the **Required frameworks** section of the download page. - - -5. For **DeviceContextAppLicense**, enter the **LicenseProductID**. - - - In Microsoft Store for Business, generate the unencoded license for the app on the app's download page. - +1. In the **Available customizations** pane, go to **Runtime settings** > **UniversalAppInstall**. +1. For **DeviceContextApp**, specify the **PackageFamilyName** for the app. In Microsoft Store for Business, the package family name is listed in the **Package details** section of the download page. +1. For **ApplicationFile**, select **Browse** to find and select the target app (either an \*.appx or \*.appxbundle). +1. For **DependencyAppxFiles**, select **Browse** to find and add any dependencies for the app. In Microsoft Store for Business, any dependencies for the app are listed in the **Required frameworks** section of the download page. +1. For **DeviceContextAppLicense**, enter the **LicenseProductID**. + - In Microsoft Store for Business, generate the unencoded license for the app on the app's download page. - Open the license file and search for **LicenseID=** to get the GUID, enter the GUID in the **LicenseProductID** field and select **Add**. - -6. In the **Available customizations** pane, select the **LicenseProductId** that you just added. - -7. For **LicenseInstall**, select **Browse**, navigate to the license file that you renamed *\*.**ms-windows-store-license**, and select the license file. +1. In the **Available customizations** pane, select the **LicenseProductId** that you just added. +1. For **LicenseInstall**, select **Browse**, navigate to the license file that you renamed *\*.**ms-windows-store-license**, and select the license file. [Learn more about distributing offline apps from the Microsoft Store for Business.](/microsoft-store/distribute-offline-apps) -> [!NOTE] +> [!IMPORTANT] > Removing a provisioning package will not remove any apps installed by device context in that provisioning package. - - ## Add a certificate to your package -1. In the **Available customizations** pane, go to **Runtime settings** > **Certificates** > **ClientCertificates**. +1. In the **Available customizations** pane, go to **Runtime settings** > **Certificates** > **ClientCertificates**. +1. Enter a **CertificateName** and then select **Add**. +1. Enter the **CertificatePassword**. +1. For **CertificatePath**, browse and select the certificate to be used. +1. Set **ExportCertificate** to **False**. +1. For **KeyLocation**, select **Software only**. -2. Enter a **CertificateName** and then select **Add**. - -2. Enter the **CertificatePassword**. - -3. For **CertificatePath**, browse and select the certificate to be used. - -4. Set **ExportCertificate** to **False**. - -5. For **KeyLocation**, select **Software only**. - - -## Add other settings to your package +## Add other settings to your package For details about the settings you can customize in provisioning packages, see [Windows Provisioning settings reference]( https://go.microsoft.com/fwlink/p/?LinkId=619012). ## Build your package -1. When you are done configuring the provisioning package, on the **File** menu, select **Save**. +1. After you configure the provisioning package, on the **File** menu, select **Save**. -2. Read the warning that project files may contain sensitive information, and select **OK**. +1. Read the warning that project files may contain sensitive information, and select **OK**. - When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location, and delete the project files when they're no longer needed. + When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files aren't encrypted. Store the project files in a secure location, and delete the project files when they're no longer needed. -3. On the **Export** menu, select **Provisioning package**. +1. On the **Export** menu, select **Provisioning package**. -4. Change **Owner** to **IT Admin**, which will set the precedence of this provisioning package higher than provisioning packages applied to this device from other sources, and then select **Next.** +1. Change **Owner** to **IT Admin**, which sets the precedence of this provisioning package higher than provisioning packages applied to this device from other sources, and then select **Next.** -5. Set a value for **Package Version**. +1. Set a value for **Package Version**. > [!TIP] > You can make changes to existing packages and change the version number to update previously applied packages. -6. Optional. In the **Provisioning package security** window, you can choose to encrypt the package and enable package signing. +1. Optional. In the **Provisioning package security** window, you can choose to encrypt the package and enable package signing. - - **Enable package encryption** - If you select this option, an auto-generated password will be shown on the screen. - - - **Enable package signing** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by selecting **Select...** and choosing the certificate you want to use to sign the package. + - **Enable package encryption** - If you select this option, an autogenerated password is shown on the screen. + - **Enable package signing** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by selecting **Select...** and choosing the certificate you want to use to sign the package. > [!TIP] - > We recommend that you include a trusted provisioning certificate in your provisioning package. When the package is applied to a device, the certificate is added to the system store. Any package signed with that certificate can be applied silently. + > We recommend that you include a trusted provisioning certificate in your provisioning package. When the package is applied to a device, the certificate is added to the system store. Any package signed with that certificate can be applied silently. -7. Select **Next** to specify the output location where you want the provisioning package to go once it's built. By default, Windows ICD uses the project folder as the output location.

                        - Optionally, you can select **Browse** to change the default output location. +1. Select **Next** to specify the output location where you want the provisioning package to go once it's built. By default, Windows ICD uses the project folder as the output location. Optionally, you can select **Browse** to change the default output location. -8. Select **Next**. +1. Select **Next**. -9. Select **Build** to start building the package. The project information is displayed in the build page and the progress bar indicates the build status.

                        - If you need to cancel the build, select **Cancel**. This cancels the current build process, closes the wizard, and takes you back to the **Customizations Page**. +1. Select **Build** to start building the package. The project information is displayed in the build page and the progress bar indicates the build status. If you need to cancel the build, select **Cancel**. This cancels the current build process, closes the wizard, and takes you back to the **Customizations Page**. -10. If your build fails, an error message will show up that includes a link to the project folder. You can scan the logs to determine what caused the error. Once you fix the issue, try building the package again.

                        - If your build is successful, the name of the provisioning package, output directory, and project directory will be shown. +1. If your build fails, an error message shows up that includes a link to the project folder. You can scan the logs to determine what caused the error. Once you fix the issue, try building the package again. If your build is successful, the name of the provisioning package, output directory, and project directory is shown. - - If you choose, you can build the provisioning package again and pick a different path for the output package. To do this, select **Back** to change the output package name and path, and then select **Next** to start another build. - - - If you are done, select **Finish** to close the wizard and go back to the **Customizations Page**. + - If you choose, you can build the provisioning package again and pick a different path for the output package. To do this, select **Back** to change the output package name and path, and then select **Next** to start another build. + - If you're done, select **Finish** to close the wizard and go back to the **Customizations Page**. -11. Select the **output location** link to go to the location of the package. You can provide that .ppkg to others through any of the following methods: +1. Select the **output location** link to go to the location of the package. You can provide that .ppkg to others through any of the following methods: - - Shared network folder + - Shared network folder + - SharePoint site + - Removable media (USB/SD) + - Email - - SharePoint site +## Next steps - - Removable media (USB/SD) - - - Email - -**Next step**: [How to apply a provisioning package](provisioning-apply-package.md) - -## Related articles - -- [Provisioning packages for Windows client](provisioning-packages.md) -- [How provisioning works in Windows client](provisioning-how-it-works.md) -- [Install Windows Configuration Designer](provisioning-install-icd.md) -- [Create a provisioning package](provisioning-create-package.md) -- [Apply a provisioning package](provisioning-apply-package.md) -- [Settings changed when you uninstall a provisioning package](provisioning-uninstall-package.md) -- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md) -- [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md) -- [PowerShell cmdlets for provisioning Windows client (reference)](provisioning-powershell.md) -- [Windows Configuration Designer command-line interface (reference)](provisioning-command-line.md) -- [Create a provisioning package with multivariant settings](provisioning-multivariant.md) +> [!div class="nextstepaction"] +> Learn more about applying a provisioning package: +> +> [Apply a provisioning package](provisioning-apply-package.md) diff --git a/windows/configuration/provisioning-packages/provisioning-apply-package.md b/windows/configuration/provisioning-packages/provisioning-apply-package.md index 400e2a7863..a5e44cee63 100644 --- a/windows/configuration/provisioning-packages/provisioning-apply-package.md +++ b/windows/configuration/provisioning-packages/provisioning-apply-package.md @@ -1,85 +1,70 @@ --- -title: Apply a provisioning package (Windows 10/11) +title: Apply a provisioning package description: Provisioning packages can be applied to a device during initial setup (OOBE) and after (runtime). -ms.prod: windows-client -author: lizgt2000 -ms.author: lizlong -ms.topic: article -ms.localizationpriority: medium -ms.reviewer: gkomatsu -manager: aaroncz -ms.technology: itpro-configure -ms.date: 12/31/2017 +ms.topic: how-to +ms.date: 07/09/2024 --- # Apply a provisioning package - -**Applies to** - -- Windows 10 -- Windows 11 - Provisioning packages can be applied to a device during initial setup (out-of-box experience or "OOBE") and after ("runtime"). > [!NOTE] > > - Applying a provisioning package to a desktop device requires administrator privileges on the device. > - You can interrupt a long-running provisioning process by pressing ESC. - -> [!TIP] -> In addition to the following methods, you can use the PowerShell cmdlet [Install-ProvisioningPackage](/powershell/module/provisioning/Install-ProvisioningPackage) with `-LogsDirectoryPath` to get logs for the operation. +> - In addition to the following methods, you can use the PowerShell cmdlet [Install-ProvisioningPackage](/powershell/module/provisioning/Install-ProvisioningPackage) with `-LogsDirectoryPath` to get logs for the operation. ## During initial setup To apply a provisioning package from a USB drive during initial setup: -1. Start with a device on the initial setup screen. If the device has gone past this screen, reset the device to start over. To reset, go to **Settings** > **System** > [**Recovery**](ms-settings:recovery) > **Reset this PC**. +1. Start with a device on the initial setup screen. If the device goes past this screen, reset the device to start over. To reset, go to **Settings** > **System** > [**Recovery**](ms-settings:recovery) > **Reset this PC**. - :::image type="content" source="../images/oobe.png" alt-text="The first screen when setting up a new PC."::: + :::image type="content" source="images/oobe.png" alt-text="The first screen when setting up a new PC."::: -2. Insert the USB drive. If nothing happens when you insert the USB drive, press the Windows key five times. +1. Insert the USB drive. If nothing happens when you insert the USB drive, press the Windows key five times. - - If there is only one provisioning package on the USB drive, the provisioning package is applied. See step 5. - - If there is more than one provisioning package on the USB drive, Windows setup will recognize the drive and ask how you want to provision the device. Select **Install provisioning package** and select **Next**. + - If there's only one provisioning package on the USB drive, the provisioning package is applied. See step 5. + - If there's more than one provisioning package on the USB drive, Windows setup recognizes the drive and asks how you want to provision the device. Select **Install provisioning package** and select **Next**. - :::image type="content" source="../images/provisioning-oobe-choice.png" alt-text="What would you like to do?"::: + :::image type="content" source="images/provisioning-oobe-choice.png" alt-text="What would you like to do?"::: -3. Select the provisioning package (`.ppkg`) that you want to apply, and select **Yes**. +1. Select the provisioning package (`.ppkg`) that you want to apply, and select **Yes**. - :::image type="content" source="../images/provisioning-oobe-choose-package.png" alt-text="Choose a package."::: + :::image type="content" source="images/provisioning-oobe-choose-package.png" alt-text="Choose a package."::: -4. The selected provisioning package will install and apply to the device. +1. The selected provisioning package is applied to the device. - :::image type="content" source="../images/provisioning-oobe-installing.png" alt-text="Setting up your PC."::: + :::image type="content" source="images/provisioning-oobe-installing.png" alt-text="Setting up your PC."::: -5. Wait for the device to load and begin applying the provisioning package. Once you see "You can remove your removable media now!" you can remove your USB drive. Windows will continue provisioning the device. +1. Wait for the device to load and begin applying the provisioning package. After you see "You can remove your removable media now!" you can remove your USB drive. Windows continues to provision the device. ## After initial setup -Provisioning packages can be applied after initial setup through Windows settings or by simply double-clicking a provisioning package. +Provisioning packages can be applied after initial setup through Windows settings or by double-clicking a provisioning package. ### Windows Settings 1. Insert the USB drive, then navigate to **Settings** > **Accounts** > [**Access work or school**](ms-settings:workplace) > **Add or remove a provisioning package** > **Add a package**. - :::image type="content" source="../images/provisioning-runtime-manage-packages.png" alt-text="Add or remove a provisioning package."::: + :::image type="content" source="images/provisioning-runtime-manage-packages.png" alt-text="Add or remove a provisioning package."::: -2. Choose the method you want to use, such as **Removable Media**. +1. Choose the method you want to use, such as **Removable Media**. - :::image type="content" source="../images/provisioning-runtime-choose-package.png" alt-text="Choose a method."::: + :::image type="content" source="images/provisioning-runtime-choose-package.png" alt-text="Choose a method."::: -3. Select the provisioning package (`.ppkg`) that you want to apply, and select **Add**. +1. Select the provisioning package (`.ppkg`) that you want to apply, and select **Add**. - :::image type="content" source="../images/provisioning-runtime-add-package.png" alt-text="Select and add a package."::: + :::image type="content" source="images/provisioning-runtime-add-package.png" alt-text="Select and add a package."::: -4. Provisioning packages require administrator privileges as they can modify system policies and run scripts at the system level. Ensure you trust the package you are installing before accepting the UAC prompt. Select **Yes**. +1. Provisioning packages require administrator privileges as they can modify system policies and run scripts at the system level. Ensure you trust the package you're installing before accepting the User Account Control (UAC) prompt. Select **Yes**. - :::image type="content" source="../images/provisioning-runtime-UAC.png" alt-text="Do you want to allow changes to your device?"::: + :::image type="content" source="images/provisioning-runtime-UAC.png" alt-text="Do you want to allow changes to your device?"::: -5. The provisioning runtime will ask if the package is from a source you trust. Verify that you are applying the correct package and that it is trusted. Select **Yes, add it**. +1. The provisioning runtime asks if the package is from a source you trust. Verify that you're applying the correct package and that it's trusted. Select **Yes, add it**. - :::image type="content" source="../images/provisioning-runtime-trust.png" alt-text="Do you trust this package?"::: + :::image type="content" source="images/provisioning-runtime-trust.png" alt-text="Do you trust this package?"::: ### Apply Directly @@ -87,25 +72,12 @@ To apply a provisioning package directly, such as from a USB drive, folder, netw 1. Navigate to the provisioning package and double-click it to begin the installation. - :::image type="content" source="../images/provisioning-runtime-click-to-install.png" alt-text="Double-click package to being installation."::: + :::image type="content" source="images/provisioning-runtime-click-to-install.png" alt-text="Double-click package to being installation."::: -2. Provisioning packages require administrator privileges as they can modify system policies and run scripts at the system level. Ensure you trust the package you are installing before accepting the UAC prompt. Select **Yes**. +1. Provisioning packages require administrator privileges as they can modify system policies and run scripts at the system level. Ensure you trust the package you're installing before accepting the UAC prompt. Select **Yes**. - :::image type="content" source="../images/provisioning-runtime-UAC.png" alt-text="Do you want to allow changes to your device?"::: + :::image type="content" source="images/provisioning-runtime-UAC.png" alt-text="Do you want to allow changes to your device?"::: -3. The provisioning runtime will ask if the package is from a source you trust. Verify that you are applying the correct package and that it is trusted. Select **Yes, add it**. +1. The provisioning runtime asks if the package is from a source you trust. Verify that you're applying the correct package and that it's trusted. Select **Yes, add it**. - :::image type="content" source="../images/provisioning-runtime-trust.png" alt-text="Do you trust this package?"::: - -## Related articles - -- [Provisioning packages for Windows client](provisioning-packages.md) -- [How provisioning works in Windows client](provisioning-how-it-works.md) -- [Install Windows Configuration Designer](provisioning-install-icd.md) -- [Create a provisioning package](provisioning-create-package.md) -- [Settings changed when you uninstall a provisioning package](provisioning-uninstall-package.md) -- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md) -- [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md) -- [PowerShell cmdlets for provisioning Windows client (reference)](provisioning-powershell.md) -- [Windows Configuration Designer command-line interface (reference)](provisioning-command-line.md) -- [Create a provisioning package with multivariant settings](provisioning-multivariant.md) + :::image type="content" source="images/provisioning-runtime-trust.png" alt-text="Do you trust this package?"::: diff --git a/windows/configuration/provisioning-packages/provisioning-command-line.md b/windows/configuration/provisioning-packages/provisioning-command-line.md index 05e6a1da83..5ff3a5cf1d 100644 --- a/windows/configuration/provisioning-packages/provisioning-command-line.md +++ b/windows/configuration/provisioning-packages/provisioning-command-line.md @@ -1,37 +1,22 @@ --- -title: Windows Configuration Designer command-line interface (Windows 10/11) -description: Learn more about the ICD syntax, switches, and arguments that you can use in the Windows Configuration Designer command-line interface for Windows10/11 client devices. -ms.prod: windows-client -author: lizgt2000 -ms.author: lizlong -ms.topic: article -ms.localizationpriority: medium -ms.reviewer: gkomatsu -manager: aaroncz -ms.technology: itpro-configure -ms.date: 12/31/2017 +title: Windows Configuration Designer command line interface +description: Learn more about the ICD syntax, switches, and arguments that you can use in the Windows Configuration Designer command line interface for Windows devices. +ms.topic: how-to +ms.date: 07/09/2024 --- -# Windows Configuration Designer command-line interface (reference) +# Windows Configuration Designer command line interface - -**Applies to** - -- Windows 10 -- Windows 11 - -You can use the Windows Configuration Designer command-line interface (CLI) to automate the building of provisioning packages. +You can use the Windows Configuration Designer command line interface (CLI) to automate the building of provisioning packages. - IT pros can use the Windows Configuration Designer CLI to require less retooling of existing processes. You must run the Windows Configuration Designer CLI from a command window with administrator privileges. - -- You must use the Windows Configuration Designer CLI and edit the customizations.xml sources to create a provisioning package with multivariant support. You need the customizations.xml file as one of the inputs to the Windows Configuration Designer CLI to build a provisioning package. For more information, see [Create a provisioning package with multivariant settings](provisioning-multivariant.md). - - +- You must use the Windows Configuration Designer CLI and edit the customizations.xml sources to create a provisioning package with multivariant support. You need the customizations.xml file as one of the inputs to the Windows Configuration Designer CLI to build a provisioning package. For more information, see [Create a provisioning package with multivariant settings](provisioning-multivariant.md). ## Syntax ``` cmd -icd.exe /Build-ProvisioningPackage /CustomizationXML: /PackagePath: +icd.exe /Build-ProvisioningPackage /CustomizationXML: /PackagePath: + [/StoreFile:] [/MSPackageRoot:] [/OEMInputXML:] [/ProductName:] [/Variables::] [[+|-]Encrypted] [[+|-]Overwrite] [/?] ``` @@ -41,23 +26,9 @@ icd.exe /Build-ProvisioningPackage /CustomizationXML: /PackagePath: | Switch | Required? | Arguments | | --- | --- | --- | | /CustomizationXML | No | Specifies the path to a Windows provisioning XML file that contains the customization assets and settings. For more information, see Windows provisioning answer file. | -| /PackagePath | Yes | Specifies the path and the package name where the built provisioning package will be saved. | -| /StoreFile | No


                        See Important note. | For partners using a settings store other than the default store(s) used by Windows Configuration Designer, use this parameter to specify the path to one or more comma-separated Windows settings store file. By default, if you don't specify a settings store file, the settings store that's common to all Windows editions will be loaded by Windows Configuration Designer.


                        **Important** If you use this parameter, you must not use /MSPackageRoot or /OEMInputXML. | +| /PackagePath | Yes | Specifies the path and the package name where the built provisioning package is saved. | +| /StoreFile | No


                        See Important note. | For partners using a settings store other than the default store(s) used by Windows Configuration Designer, use this parameter to specify the path to one or more comma-separated Windows settings store file. By default, if you don't specify a settings store file, the settings store that's common to all Windows editions is loaded by Windows Configuration Designer.


                        **Important** If you use this parameter, you must not use /MSPackageRoot or /OEMInputXML. | | /Variables | No | Specifies a semicolon separated `` and `` macro pair. The format for the argument must be `=`. | -| Encrypted | No | Denotes whether the provisioning package should be built with encryption. Windows Configuration Designer autogenerates the decryption password and includes this information in the output.


                        Precede with `+` for encryption, or `-` for no encryption. The default is no encryption. | -| Overwrite | No | Denotes whether to overwrite an existing provisioning package.


                        Precede with + to overwrite an existing package or - if you don't want to overwrite an existing package. The default is false (don't overwrite). | +| Encrypted | No | Denotes whether the provisioning package should be built with encryption. Windows Configuration Designer autogenerates the decryption password and includes this information in the output.

                        Precede with `+` for encryption, or `-` for no encryption. The default is no encryption. | +| Overwrite | No | Denotes whether to overwrite an existing provisioning package.

                        Precede with + to overwrite an existing package or - if you don't want to overwrite an existing package. The default is false (don't overwrite). | | /? | No | Lists the switches and their descriptions for the command-line tool or for certain commands. | - -## Related articles - -- [Provisioning packages for Windows client](provisioning-packages.md) -- [How provisioning works in Windows client](provisioning-how-it-works.md) -- [Install Windows Configuration Designer](provisioning-install-icd.md) -- [Create a provisioning package](provisioning-create-package.md) -- [Apply a provisioning package](provisioning-apply-package.md) -- [Settings changed when you uninstall a provisioning package](provisioning-uninstall-package.md) -- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md) -- [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md) -- [PowerShell cmdlets for provisioning Windows client (reference)](provisioning-powershell.md) -- [Create a provisioning package with multivariant settings](provisioning-multivariant.md) -  diff --git a/windows/configuration/provisioning-packages/provisioning-create-package.md b/windows/configuration/provisioning-packages/provisioning-create-package.md index 62d2d239ae..b239dfb3d5 100644 --- a/windows/configuration/provisioning-packages/provisioning-create-package.md +++ b/windows/configuration/provisioning-packages/provisioning-create-package.md @@ -1,29 +1,14 @@ --- -title: Create a provisioning package (Windows 10/11) -description: Learn how to create a provisioning package for Windows 10/11, which lets you quickly configure a device without having to install a new image. -ms.prod: windows-client -author: lizgt2000 -ms.author: lizlong -ms.topic: article -ms.localizationpriority: medium -ms.reviewer: gkomatsu -manager: aaroncz -ms.technology: itpro-configure -ms.date: 12/31/2017 +title: Create a provisioning package (advanced) +description: Learn how to create a provisioning package for Windows, which lets you quickly configure a device without having to install a new image. +ms.topic: how-to +ms.date: 07/09/2024 --- -# Create a provisioning package - - -**Applies to** - -- Windows 10 -- Windows 11 +# Create a provisioning package (advanced) You can use Windows Configuration Designer to create a provisioning package (`.ppkg`) that contains customization settings, and then apply the provisioning package to a device running Windows client. ->[Learn how to install Windows Configuration Designer.](provisioning-install-icd.md) - > [!TIP] > We recommend creating a local admin account when you develop and test your provisioning package. We also recommend using a *least privileged* domain user account to join devices to the Active Directory domain. @@ -31,136 +16,111 @@ You can use Windows Configuration Designer to create a provisioning package (`.p 1. Open Windows Configuration Designer: From either the Start menu or Start menu search, type **Windows Configuration Designer**, and then select the **Windows Configuration Designer** shortcut. -2. Select your desired option on the **Start** page, which offers multiple options for creating a provisioning package, as shown in the following image: +1. Select **Advanced provisioning** on the start page, which offers multiple options for creating a provisioning package, as shown in the following image: - ![Configuration Designer wizards.](../images/icd-create-options-1703.png) + ![Configuration Designer wizards.](images/icd-create-options-1703.png) - - The following wizard options provide a simple interface for configuring common settings for desktop and kiosk devices: + > [!TIP] + > You can start a project in the simple wizard editor and then switch the project to the advanced editor. + > + > ![Switch to advanced editor.](images/icd-switch.png) - - [Instructions for the desktop wizard](provision-pcs-for-initial-deployment.md) - - [Instructions for the kiosk wizard](../kiosk-single-app.md#wizard) - - [Instructions for HoloLens wizard](/hololens/hololens-provisioning) - - [Instructions for Surface Hub wizard](/surface-hub/provisioning-packages-for-surface-hub) - - Wizards are also available for creating provisioning packages for Microsoft Surface Hub and Microsoft HoloLens devices. For a summary of the settings available in the desktop and kiosk devices, see [What you can configure using Configuration Designer wizards](provisioning-packages.md#configuration-designer-wizards). - - >[!NOTE] - >To target devices running versions earlier than Windows 10, version 2004, ComputerName customization must be defined from the setting path: `Accounts/ComputerAccount/ComputerName` from the advanced editor. The default path from the simple editor uses a new CSP that isn't available on older systems. - - - The **Advanced provisioning** option opens a new project with all the runtime settings available. (The rest of this procedure uses advanced provisioning.) - - >[!TIP] - > You can start a project in the simple wizard editor and then switch the project to the advanced editor. - > - > ![Switch to advanced editor.](../images/icd-switch.png) - -3. Enter a name for your project, and then select **Next**. - -4. Select the settings you want to configure, based on the type of device, and then select **Next**. The following table describes the options. +1. Enter a name for your project, and then select **Next**. +1. Select the settings you want to configure, based on the type of device, and then select **Next**. The following table describes the options. | Windows edition | Settings available for customization | Provisioning package can apply to | |---|---|---| - | All Windows editions | Common settings | All Windows client devices | + | All Windows editions | Common settings | All Windows client devices | | All Windows desktop editions | Common settings and settings specific to desktop devices | All Windows client desktop editions (Home, Pro, Enterprise, Pro Education, Enterprise Education) | | Windows 10 IoT Core | Common settings and settings specific to Windows 10 IoT Core | All Windows 10 IoT Core devices | | Windows 10 Holographic | Common settings and settings specific to Windows 10 Holographic | [Microsoft HoloLens](/hololens/hololens-provisioning) | | Common to Windows 10 Team edition | Common settings and settings specific to Windows 10 Team | [Microsoft Surface Hub](/surface-hub/provisioning-packages-for-surface-hub) | - -5. On the **Import a provisioning package (optional)** page, you can select **Finish** to create your project, or browse to and select an existing provisioning package to import to your project, and then select **Finish**. +1. On the **Import a provisioning package (optional)** page, you can select **Finish** to create your project, or browse to and select an existing provisioning package to import to your project, and then select **Finish**. >[!TIP] >**Import a provisioning package** can make it easier to create different provisioning packages that all have certain settings in common. For example, you could create a provisioning package that includes the settings for your organization's network. Then, import that package into other packages that you create so you don't have to reconfigure those common settings repeatedly. -6. In the **Available customizations** pane, you can now configure settings for the package. +1. In the **Available customizations** pane, you can now configure settings for the package. ## Configure settings For an advanced provisioning project, Windows Configuration Designer opens the **Available customizations** pane. The example in the following image is based on **All Windows desktop editions** settings. -![What the ICD interface looks like.](../images/icd-runtime.png) +![What the ICD interface looks like.](images/icd-runtime.png) -The settings in Windows Configuration Designer are based on Windows client configuration service providers (CSPs). To learn more about CSPs, see [Introduction to configuration service providers (CSPs) for IT pros](./how-it-pros-can-use-configuration-service-providers.md). +The settings in Windows Configuration Designer are based on Windows client configuration service providers (CSPs). To learn more about CSPs, see [Introduction to configuration service providers (CSPs) for IT pros](how-it-pros-can-use-configuration-service-providers.md). + +> [!NOTE] +> To target devices running versions earlier than Windows 10, version 2004, ComputerName customization must be defined from the setting path: `Accounts/ComputerAccount/ComputerName` from the advanced editor. The default path from the simple editor uses a new CSP that isn't available on older systems. The process for configuring settings is similar for all settings. The following table shows an example. 1. Expand a category: - :::image type="content" source="../images/icd-step1.png" alt-text="In Windows Configuration Designer, expand the Certificates category."::: + :::image type="content" source="images/icd-step1.png" alt-text="In Windows Configuration Designer, expand the Certificates category."::: -2. Select a setting: +1. Select a setting: - :::image type="content" source="../images/icd-step2.png" alt-text="In Windows Configuration Designer, select ClientCertificates."::: + :::image type="content" source="images/icd-step2.png" alt-text="In Windows Configuration Designer, select ClientCertificates."::: -3. Enter a value for the setting. Select **Add** if the button is displayed: +1. Enter a value for the setting. Select **Add** if the button is displayed: - :::image type="content" source="../images/icd-step3.png" alt-text="In Windows Configuration Designer, enter a name for the certificate."::: + :::image type="content" source="images/icd-step3.png" alt-text="In Windows Configuration Designer, enter a name for the certificate."::: -4. Some settings, such as this example, require additional information. In **Available customizations**, select the value you just created, and more settings are displayed: +1. Some settings, such as this example, require additional information. In **Available customizations**, select the value you created, and more settings are displayed: - :::image type="content" source="../images/icd-step4.png" alt-text="In Windows Configuration Designer, additional settings for client certificate are available."::: + :::image type="content" source="images/icd-step4.png" alt-text="In Windows Configuration Designer, additional settings for client certificate are available."::: -5. When the setting is configured, it is displayed in the **Selected customizations** pane: +1. When the setting is configured, it's displayed in the **Selected customizations** pane: - :::image type="content" source="../images/icd-step5.png" alt-text="In Windows Configuration Designer, the selected customizations pane shows your settings."::: + :::image type="content" source="images/icd-step5.png" alt-text="In Windows Configuration Designer, the selected customizations pane shows your settings."::: For details on each specific setting, see [Windows Provisioning settings reference](../wcd/wcd.md). The reference article for a setting is also displayed in Windows Configuration Designer when you select the setting, as shown in the following image. -![Windows Configuration Designer opens the reference topic when you select a setting.](../images/icd-setting-help.png) - +![Windows Configuration Designer opens the reference topic when you select a setting.](images/icd-setting-help.png) ## Build package -1. After you're done configuring your customizations, select **Export**, and then select **Provisioning Package**. +1. After you configure your customizations, select **Export**, and then select **Provisioning Package**. - ![Export on top bar.](../images/icd-export-menu.png) + ![Export on top bar.](images/icd-export-menu.png) -2. In the **Describe the provisioning package** window, enter the following information, and then select **Next**: - - **Name** - This field is pre-populated with the project name. You can change this value by entering a different name in the **Name** field. - - **Version (in Major.Minor format** - Optional. You can change the default package version by specifying a new value in the **Version** field. +1. In the **Describe the provisioning package** window, enter the following information, and then select **Next**: + + - **Name** - This field is prepopulated with the project name. You can change this value by entering a different name in the **Name** field. + - **Version (in Major.Minor format** - Optional. You can change the default package version by specifying a new value in the **Version** field. - **Owner** - Select **IT Admin**. For more information, see [Precedence for provisioning packages](provisioning-how-it-works.md#precedence-for-provisioning-packages). - **Rank (between 0-99)** - Optional. You can select a value between 0 and 99, inclusive. The default package rank is 0. -3. In the **Select security details for the provisioning package** window, you can select to encrypt and/or sign a provisioning package with a selected certificate, and then select **Next**. Both selections are optional: +1. In the **Select security details for the provisioning package** window, you can select to encrypt and/or sign a provisioning package with a selected certificate, and then select **Next**. Both selections are optional: - - **Encrypt package** - If you select this option, an autogenerated password will be shown on the screen. - - **Sign package** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by selecting **Select** and choosing the certificate you want to use to sign the package. + - **Encrypt package** - If you select this option, an autogenerated password is shown on the screen. + - **Sign package** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by selecting **Select** and choosing the certificate you want to use to sign the package. - >[!NOTE] - >You should only configure provisioning package security when the package is used for device provisioning and when the package has content with sensitive security data, such as certificates or credentials that should be prevented from being compromised. When applying an encrypted and/or signed provisioning package, either during OOBE or through the setting UI, the package can be decrypted, and if signed, be trusted without explicit user consent. An IT administrator can set policy on a user device to restrict the removal of required packages from the device, or the provisioning of potentially harmful packages on the device. - > - >If a provisioning package is signed by a trusted provisioner, it can be installed on a device without a prompt for user consent. In order to enable trusted provider certificates, you must set the **TrustedProvisioners** setting prior to installing the trusted provisioning package. This is the only way to install a package without user consent. To provide additional security, you can also set **RequireProvisioningPackageSignature**, which prevents users from installing provisioning packages that are not signed by a trusted provisioner. + > [!NOTE] + > You should only configure provisioning package security when the package is used for device provisioning and when the package has content with sensitive security data, such as certificates or credentials that should be prevented from being compromised. When applying an encrypted and/or signed provisioning package, either during OOBE or through the setting UI, the package can be decrypted, and if signed, be trusted without explicit user consent. An IT administrator can set policy on a user device to restrict the removal of required packages from the device, or the provisioning of potentially harmful packages on the device. + > + > If a provisioning package is signed by a trusted provisioner, it can be installed on a device without a prompt for user consent. In order to enable trusted provider certificates, you must set the **TrustedProvisioners** setting prior to installing the trusted provisioning package. This is the only way to install a package without user consent. To provide additional security, you can also set **RequireProvisioningPackageSignature**, which prevents users from installing provisioning packages that are not signed by a trusted provisioner. -4. In the **Select where to save the provisioning package** window, specify the output location where you want the provisioning package to go once it's built, and then select **Next**. By default, Windows Configuration Designer uses the project folder as the output location. +1. In the **Select where to save the provisioning package** window, specify the output location where you want the provisioning package to go once it's built, and then select **Next**. By default, Windows Configuration Designer uses the project folder as the output location. -5. In the **Build the provisioning package** window, select **Build**. The provisioning package doesn't take long to build. The project information is displayed in the build page and the progress bar indicates the build status. +1. In the **Build the provisioning package** window, select **Build**. The provisioning package doesn't take long to build. The project information is displayed in the build page and the progress bar indicates the build status. If you need to cancel the build, select **Cancel**. This cancels the current build process, closes the wizard, and takes you back to the **Customizations** page. -6. If your build fails, an error message will appear that includes a link to the project folder. You can scan the logs to determine what caused the error. Once you fix the issue, try building the package again. +1. If your build fails, an error message appears that includes a link to the project folder. You can scan the logs to determine what caused the error. Once you fix the issue, try building the package again. - If your build is successful, the name of the provisioning package, output directory, and project directory will be shown. + If your build is successful, the name of the provisioning package, output directory, and project directory is shown. If you choose, you can build the provisioning package again and pick a different path for the output package. To do this, select **Back** to change the output package name and path, and then select **Next** to start another build. -7. When you are done, select **Finish** to close the wizard and go back to the **Customizations** page. +1. When you're done, select **Finish** to close the wizard and go back to the **Customizations** page. -**Next step**: [How to apply a provisioning package](provisioning-apply-package.md) +## Next steps -## Learn more - -- [How to bulk-enroll devices with On-premises Mobile Device Management in Microsoft Configuration Manager](/configmgr/mdm/deploy-use/bulk-enroll-devices-on-premises-mdm) - -## Related articles - -- [Provisioning packages for Windows client](provisioning-packages.md) -- [How provisioning works in Windows client](provisioning-how-it-works.md) -- [Install Windows Configuration Designer](provisioning-install-icd.md) -- [Apply a provisioning package](provisioning-apply-package.md) -- [Settings changed when you uninstall a provisioning package](provisioning-uninstall-package.md) -- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md) -- [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md) -- [PowerShell cmdlets for provisioning Windows client (reference)](provisioning-powershell.md) -- [Windows Configuration Designer command-line interface (reference)](provisioning-command-line.md) -- [Create a provisioning package with multivariant settings](provisioning-multivariant.md) +> [!div class="nextstepaction"] +> Learn more about applying a provisioning package: +> +> [Apply a provisioning package](provisioning-apply-package.md) \ No newline at end of file diff --git a/windows/configuration/provisioning-packages/provisioning-how-it-works.md b/windows/configuration/provisioning-packages/provisioning-how-it-works.md index 4f93bfc292..ec61311214 100644 --- a/windows/configuration/provisioning-packages/provisioning-how-it-works.md +++ b/windows/configuration/provisioning-packages/provisioning-how-it-works.md @@ -1,26 +1,13 @@ --- -title: How provisioning works in Windows 10/11 +title: How provisioning works in Windows description: Learn more about how provisioning package work on Windows client devices. A provisioning package (.ppkg) is a container for a collection of configuration settings. -ms.prod: windows-client -author: lizgt2000 -ms.author: lizlong -ms.topic: article -ms.localizationpriority: medium -ms.reviewer: gkomatsu -manager: aaroncz -ms.technology: itpro-configure -ms.date: 12/31/2017 +ms.topic: conceptual +ms.date: 07/09/2024 --- # How provisioning works in Windows - -**Applies to** - -- Windows 10 -- Windows 11 - -Provisioning packages in Windows client provide IT administrators with a simplified way to apply configuration settings to Windows client devices. Windows Configuration Designer is a tool that makes it easy to create a provisioning package. Windows Configuration Designer can be installed from Microsoft Store. +Provisioning packages in Windows client provide IT administrators with a simplified way to apply configuration settings to Windows client devices. Windows Configuration Designer is a tool that makes it easy to create a provisioning package. Windows Configuration Designer can be installed from the Microsoft Store. ## Provisioning packages @@ -28,47 +15,42 @@ A provisioning package contains specific configurations/settings and assets that To enable adding multiple sets of settings or configurations, the configuration data used by the provisioning engine is built out of multiple configuration sources that consist of separate provisioning packages. Each provisioning package contains the provisioning data from a different source. -A provisioning package (.ppkg) is a container for a collection of configuration settings. The package has the following format: +A provisioning package (.ppkg) is a container for a collection of configuration settings. The package has the following format: -- Package metadata – The metadata contains basic information about the package such as package name, description, version, ranking, and so on. +- Package metadata - The metadata contains basic information about the package such as package name, description, version, ranking, and so on. -- XML descriptors – Each descriptor defines a customization asset or configuration setting included in the package. +- XML descriptors - Each descriptor defines a customization asset or configuration setting included in the package. -- Asset payloads – The payloads of a customization asset or a configuration setting associated with an app or data asset. +- Asset payloads - The payloads of a customization asset or a configuration setting associated with an app or data asset. -You can use provisioning packages for runtime device provisioning by accessing the package on a removable media attached to the device, through near field communication (NFC), or by downloading from a remote source location. +You can use provisioning packages for runtime device provisioning by accessing the package on a removable media attached to the device, through near field communication (NFC), or by downloading from a remote source location. ## Precedence for provisioning packages When multiple provisioning packages are available for device provisioning, the combination of package owner type and package rank level defined in the package manifest is used to resolve setting conflicts. The pre-defined package owner types are listed below in the order of lowest to highest owner type precedence: -1. Microsoft +1. Microsoft +1. Silicon Vendor +1. OEM +1. System Integrator +1. Mobile Operator +1. IT Admin -2. Silicon Vendor +The valid value range of package rank level is 0 to 99. -3. OEM - -4. System Integrator - -5. Mobile Operator - -6. IT Admin - -The valid value range of package rank level is 0 to 99. - -When setting conflicts are encountered, the final values provisioned on the device are determined by the owner type precedence and the rank level of the packages containing the settings. For packages with the same owner type, the package rank level determines the package from which the setting values get provisioned on the device. +When setting conflicts are encountered, the final values provisioned on the device are determined by the owner type precedence and the rank level of the packages containing the settings. For packages with the same owner type, the package rank level determines the package from which the setting values get provisioned on the device. ## Windows provisioning XML -Windows provisioning XML is the framework that allows Microsoft and OEM components to declare end-user configurable settings and the on-device infrastructure for applying the settings with minimal work by the component owner. +Windows provisioning XML is the framework that allows Microsoft and OEM components to declare end-user configurable settings and the on-device infrastructure for applying the settings with minimal work by the component owner. Settings for each component can be declared within that component's package manifest file. These declarations are turned into settings schema that are used by Windows Configuration Designer to expose the potential settings to users to create customizations in the image or in provisioning packages. Windows Configuration Designer translates the user configuration, which is declared through Windows provisioning answer file(s), into the on-device provisioning format. -When the provisioning engine selects a configuration, the Windows provisioning XML is contained within the selected provisioning data and is passed through the configuration manager and then to the [Windows provisioning CSP](/windows/client-management/mdm/provisioning-csp). The Windows provisioning CSP then takes and applies the provisioning to the proper location for the actual component to use. +When the provisioning engine selects a configuration, the Windows provisioning XML is contained within the selected provisioning data and is passed through the configuration manager and then to the [Windows provisioning CSP](/windows/client-management/mdm/provisioning-csp). The Windows provisioning CSP then takes and applies the provisioning to the proper location for the actual component to use. ## Provisioning engine -The provisioning engine is the core component for managing provisioning and configuration at runtime in a device running Windows 10/11. +The provisioning engine is the core component for managing provisioning and configuration at runtime in a device running Windows 10/11. The provisioning engine provides the following functionality: @@ -81,22 +63,23 @@ The provisioning engine provides the following functionality: ## Configuration manager -The configuration manager provides the unified way of managing Windows 10/11 devices. Configuration is mainly done through the Open Mobile Alliance (OMA) Device Management (DM) and Client Provisioning (CP) protocols. The configuration manager handles and parses these protocol requests from different channels and passes them down to [Configuration Service Providers (CSPs)](/windows/client-management/mdm/configuration-service-provider-reference) to perform the specific management requests and settings. +The configuration manager provides the unified way of managing Windows 10/11 devices. Configuration is mainly done through the Open Mobile Alliance (OMA) Device Management (DM) and Client Provisioning (CP) protocols. The configuration manager handles and parses these protocol requests from different channels and passes them down to [Configuration Service Providers (CSPs)](/windows/client-management/mdm/configuration-service-provider-reference) to perform the specific management requests and settings. -The provisioning engine relies on configuration manager for all of the actual processing and application of a chosen configuration. The provisioning engine determines the stage of provisioning and, based on a set of keys, determines the set of configuration to send to the configuration manager. The configuration manager in turn parses and calls into the CSPs for the setting to be applied. +The provisioning engine relies on configuration manager for all of the actual processing and application of a chosen configuration. The provisioning engine determines the stage of provisioning and, based on a set of keys, determines the set of configuration to send to the configuration manager. The configuration manager in turn parses and calls into the CSPs for the setting to be applied. -Underneath the configuration manager are the CSPs. Each section of configuration translates to a particular CSP to handle interpreting into an action on the device. Each CSP translates the instructions in the configuration and calls into the appropriate APIs and components to perform the requested provisioning actions. +Underneath the configuration manager are the CSPs. Each section of configuration translates to a particular CSP to handle interpreting into an action on the device. Each CSP translates the instructions in the configuration and calls into the appropriate APIs and components to perform the requested provisioning actions. ## Policy and resource manager -The policy, resource, and context manager components manage the enrollment and unenrollment of devices into enterprise environments. The enrollment process into an enterprise is essentially the provisioning of configuration and device management policies that the enterprise wants to enforce on the device. This is usually done through the explicit signing up of the device to an enterprise's device management server over a network connection. This provides the user with the ability to access the enterprise's resources through the device and the enterprise with a means to manage and control access and manage and control the device itself. +The policy, resource, and context manager components manage the enrollment and unenrollment of devices into enterprise environments. The enrollment process into an enterprise is essentially the provisioning of configuration and device management policies that the enterprise wants to enforce on the device. This is usually done through the explicit signing up of the device to an enterprise's device management server over a network connection. This provides the user with the ability to access the enterprise's resources through the device and the enterprise with a means to manage and control access and manage and control the device itself. + +The key differences between enterprise enrollment and the configuration performed by the provisioning engine are: -The key differences between enterprise enrollment and the configuration performed by the provisioning engine are: - Enrollment enforces a limited and controlled set of policies on the device that the user may not have full control over. The provisioning engine exposes a larger set of settings that configure more aspects of the device and are generally user adjustable. - The policy manager manages policy settings from multiple entities and performs a selection of the setting based on priority of the entities. The provisioning engine applies the settings and does not offer a means of prioritizing settings from different sources. The more specific provisioning is the last one applied and the one that is used. - Individual policy settings applied from different enrollment entities are stored so they can be removed later during unenrollment. This enables the user to remove enterprise policy and return the device to a state without the enterprise restrictions and any sensitive data. The provisioning engine does not maintain individual provisioning settings or a means to roll back all applied settings. -In Windows 10, the application of policy and enrollment through provisioning is required to support cases where an enterprise or educational institution does not have a DM server for full device management. The provisioning engine supports provisioning enrollment and policy through its configuration and integrates with the existing policy and resource manager components directly or through the configuration manager. +In Windows 10, the application of policy and enrollment through provisioning is required to support cases where an enterprise or educational institution does not have a DM server for full device management. The provisioning engine supports provisioning enrollment and policy through its configuration and integrates with the existing policy and resource manager components directly or through the configuration manager. ## Triggers and stages @@ -111,21 +94,21 @@ When a trigger occurs, provisioning is initiated for a particular provisioning s ## Device provisioning during OOBE -The provisioning engine always applies provisioning packages persisted in the `C:\Recovery\Customizations` folder on the OS partition. When the provisioning engine applies provisioning packages in the `%ProgramData%\Microsoft\Provisioning` folder, certain runtime setting applications, such as the setting to install and configure Windows apps, may be extended past the OOBE pass and continually be processed in the background when the device gets to the desktop. Settings for configuring policies and certain crucial system configurations are always be completed before the first point at which they must take effect. +The provisioning engine always applies provisioning packages persisted in the `C:\Recovery\Customizations` folder on the OS partition. When the provisioning engine applies provisioning packages in the `%ProgramData%\Microsoft\Provisioning` folder, certain runtime setting applications, such as the setting to install and configure Windows apps, may be extended past the OOBE pass and continually be processed in the background when the device gets to the desktop. Settings for configuring policies and certain crucial system configurations are always be completed before the first point at which they must take effect. -Device users can apply a provisioning package from a remote source when the device first boots to OOBE. The device provisioning during OOBE is only triggered after the language, locale, time zone, and other settings on the first OOBE UI page are configured. When device provisioning is triggered, the provisioning UI is displayed in the OOBE page. The provisioning UI allows users to select a provisioning package acquired from a remote source, such as through NFC or a removable media. +Device users can apply a provisioning package from a remote source when the device first boots to OOBE. The device provisioning during OOBE is only triggered after the language, locale, time zone, and other settings on the first OOBE UI page are configured. When device provisioning is triggered, the provisioning UI is displayed in the OOBE page. The provisioning UI allows users to select a provisioning package acquired from a remote source, such as through NFC or a removable media. The following table shows how device provisioning can be initiated when a user first boots to OOBE. - | Package delivery | Initiation method | Supported device | | --- | --- | --- | | Removable media - USB drive or SD card
                        (Packages must be placed at media root) | Five fast taps on the Windows key to launch the provisioning UI |All Windows devices | | From an administrator device through machine-to-machine NFC or NFC tag
                        (The administrator device must run an app that can transfer the package over NFC) | Five fast taps on the Windows key to launch the provisioning UI | Windows IoT Core devices | - -The provisioning engine always copies the acquired provisioning packages to the `%ProgramData%\Microsoft\Provisioning` folder before processing them during OOBE. The provisioning engine always applies provisioning packages embedded in the installed Windows image during Windows Setup OOBE pass regardless of whether the package is signed and trusted. When the provisioning engine applies an encrypted provisioning package on an end-user device during OOBE, users must first provide a valid password to decrypt the package. The provisioning engine also checks whether a provisioning package is signed and trusted; if it's not, the user must provide consent before the package is applied to the device. -When the provisioning engine applies provisioning packages during OOBE, it applies only the runtime settings from the package to the device. Runtime settings can be system-wide configuration settings, including security policy, Windows app install/uninstall, network configuration, bootstrapping MDM enrollment, provisioning of file assets, account and domain configuration, Windows edition upgrade, and more. The provisioning engine also checks for the configuration settings on the device, such as region/locale or SIM card, and applies the multivariant settings with matching condition(s). + +The provisioning engine always copies the acquired provisioning packages to the `%ProgramData%\Microsoft\Provisioning` folder before processing them during OOBE. The provisioning engine always applies provisioning packages embedded in the installed Windows image during Windows Setup OOBE pass regardless of whether the package is signed and trusted. When the provisioning engine applies an encrypted provisioning package on an end-user device during OOBE, users must first provide a valid password to decrypt the package. The provisioning engine also checks whether a provisioning package is signed and trusted; if it's not, the user must provide consent before the package is applied to the device. + +When the provisioning engine applies provisioning packages during OOBE, it applies only the runtime settings from the package to the device. Runtime settings can be system-wide configuration settings, including security policy, Windows app install/uninstall, network configuration, bootstrapping MDM enrollment, provisioning of file assets, account and domain configuration, Windows edition upgrade, and more. The provisioning engine also checks for the configuration settings on the device, such as region/locale or SIM card, and applies the multivariant settings with matching condition(s). ## Device provisioning at runtime @@ -141,17 +124,4 @@ When applying provisioning packages from a removable media attached to the devic When applying multiple provisioning packages to a device, the provisioning engine resolves settings with conflicting configuration values from different packages by evaluating the package ranking using the combination of package owner type and package rank level defined in the package metadata. A configuration setting applied from a provisioning package with the highest package ranking will be the final value applied to the device. -After a stand-alone provisioning package is applied to the device, the package is persisted in the `%ProgramData%\Microsoft\Provisioning` folder on the device. Provisioning packages can be removed by an administrator by using the **Add or remove a provisioning package** available under **Settings** > **Accounts** > **Access work or school**. - -## Related articles - -- [Provisioning packages for Windows client](provisioning-packages.md) -- [Install Windows Configuration Designer](provisioning-install-icd.md) -- [Create a provisioning package](provisioning-create-package.md) -- [Apply a provisioning package](provisioning-apply-package.md) -- [Settings changed when you uninstall a provisioning package](provisioning-uninstall-package.md) -- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md) -- [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md) -- [PowerShell cmdlets for provisioning Windows client (reference)](provisioning-powershell.md) -- [Windows Configuration Designer command-line interface (reference)](provisioning-command-line.md) -- [Create a provisioning package with multivariant settings](provisioning-multivariant.md) +After a stand-alone provisioning package is applied to the device, the package is persisted in the `%ProgramData%\Microsoft\Provisioning` folder on the device. Provisioning packages can be removed by an administrator by using the **Add or remove a provisioning package** available under **Settings** > **Accounts** > **Access work or school**. diff --git a/windows/configuration/provisioning-packages/provisioning-install-icd.md b/windows/configuration/provisioning-packages/provisioning-install-icd.md index 2f6782646c..3b4fddb9b4 100644 --- a/windows/configuration/provisioning-packages/provisioning-install-icd.md +++ b/windows/configuration/provisioning-packages/provisioning-install-icd.md @@ -1,23 +1,17 @@ --- title: Install Windows Configuration Designer -description: Learn how to install and use Windows Configuration Designer so you can easily configure devices running Windows 10/11. -author: lizgt2000 -ms.author: lizlong -ms.topic: article +description: Learn how to install and use Windows Configuration Designer so you can easily configure devices running Windows. +ms.topic: how-to ms.reviewer: kevinsheehan -ms.date: 12/31/2017 +ms.date: 07/09/2024 --- -# Install Windows Configuration Designer, and learn about any limitations - - -**Applies to** - -- Windows 10 -- Windows 11 +# Install Windows Configuration Designer Use the Windows Configuration Designer tool to create provisioning packages to easily configure devices running Windows client. Windows Configuration Designer is primarily used by IT departments for business and educational institutions who need to provision bring-your-own-device (BYOD) and business-supplied devices. +On devices running Windows client, you can install [the Windows Configuration Designer app](https://www.microsoft.com/store/apps/9nblggh4tx22) from the Microsoft Store. + ## Supported platforms Windows Configuration Designer can create provisioning packages for Windows client desktop, including Windows IoT Core, Microsoft Surface Hub, and Microsoft HoloLens. You can run Windows Configuration Designer on the following operating systems: @@ -26,31 +20,22 @@ Windows Configuration Designer can create provisioning packages for Windows clie - Windows 11 - Windows 10 - x86 and amd64 -- Windows 8.1 Update - x86 and amd64 -- Windows 8.1 - x86 and amd64 -- Windows 8 - x86 and amd64 -- Windows 7 - x86 and amd64 **Server OS**: +- Windows Server 2022 +- Windows Server 2019 - Windows Server 2016 -- Windows Server 2012 R2 Update -- Windows Server 2012 R2 -- Windows Server 2012 -- Windows Server 2008 R2 ->[!WARNING] ->You must run Windows Configuration Designer on Windows client to configure Microsoft Entra enrollment using any of the wizards. - -## Install Windows Configuration Designer - -On devices running Windows client, you can install [the Windows Configuration Designer app](https://www.microsoft.com/store/apps/9nblggh4tx22) from the Microsoft Store. +> [!WARNING] +> You must run Windows Configuration Designer on Windows client to configure Microsoft Entra enrollment using any of the wizards. ## Current Windows Configuration Designer limitations -- When running Windows Configuration Designer on Windows releases earlier than Windows 10, version 2004 you might need to enable TLS 1.2, especially if using Bulk Enrollment Tokens. You may see the error message in the `icd.log` file: `Error: AADSTS1002016: You are using TLS version 1.0, 1.1 and/or 3DES cipher which are deprecated to improve the security posture of Azure AD` For more information, see [Enable TLS 1.2 on client or server operating systems](/troubleshoot/azure/active-directory/enable-support-tls-environment#enable-tls-12-on-client-or-server-operating-systems-). - -- Windows Configuration Designer doesn't work properly when the Group Policy setting **Policies** > **Administrative Templates** > **Windows Components** > **Internet Explorer** > **Security Zones: Use only machine settings** is enabled. When this policy is set, each step will display oversized buttons that fill the **Windows Configuration Designer** window. Additionally, the various options and descriptions that are normally to the right of the buttons won't be displayed because the buttons take up all of the space in the **Windows Configuration Designer** window. To resolve the problem, run Windows Configuration Designer on a device that doesn't have this policy enabled. +- When running Windows Configuration Designer on Windows releases earlier than Windows 10, version 2004 you might need to enable TLS 1.2, especially if using Bulk Enrollment Tokens. You may see the error message in the `icd.log` file: `Error: AADSTS1002016: You are using TLS version 1.0, 1.1 and/or 3DES cipher which are deprecated to improve the security posture of Azure AD` For more information, see [Enable TLS 1.2 on client or server operating systems](/troubleshoot/azure/active-directory/enable-support-tls-environment#enable-tls-12-on-client-or-server-operating-systems-). + + +- Windows Configuration Designer doesn't work properly when the Group Policy setting **Policies** > **Administrative Templates** > **Windows Components** > **Internet Explorer** > **Security Zones: Use only machine settings** is enabled. When this policy is set, each step displays oversized buttons that fill the **Windows Configuration Designer** window. Additionally, the various options and descriptions that are normally to the right of the buttons aren't displayed because the buttons take up all of the space in the **Windows Configuration Designer** window. To resolve the problem, run Windows Configuration Designer on a device that doesn't have this policy enabled. - You can only run one instance of Windows Configuration Designer on your computer at a time. @@ -63,8 +48,8 @@ On devices running Windows client, you can install [the Windows Configuration De - To enable the simplified authoring jscripts to work on a server SKU running Windows Configuration Designer, you must enable **Allow websites to prompt for information using scripted windows**: 1. Open Internet Explorer. - 2. Go to **Settings** > **Internet Options** > **Security** > **Custom level**. - 3. Select **Allow websites to prompt for information using scripted windows** > **Enable**. + 1. Go to **Settings** > **Internet Options** > **Security** > **Custom level**. + 1. Select **Allow websites to prompt for information using scripted windows** > **Enable**. - If you copy a Windows Configuration Designer project from one PC to another PC, then: @@ -75,17 +60,10 @@ On devices running Windows client, you can install [the Windows Configuration De - **Recommended**: Before starting, copy all source files to the PC running Windows Configuration Designer. Don't use external sources, like network shares or removable drives. Using local files reduces the risk of interrupting the build process from a network issue, or from disconnecting the USB device. -**Next step**: [How to create a provisioning package](provisioning-create-package.md) +## Next steps -## Related articles - -- [Provisioning packages for Windows client](provisioning-packages.md) -- [How provisioning works in Windows client](provisioning-how-it-works.md) -- [Create a provisioning package](provisioning-create-package.md) -- [Apply a provisioning package](provisioning-apply-package.md) -- [Settings changed when you uninstall a provisioning package](provisioning-uninstall-package.md) -- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md) -- [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md) -- [PowerShell cmdlets for provisioning Windows client (reference)](provisioning-powershell.md) -- [Windows Configuration Designer command-line interface (reference)](provisioning-command-line.md) -- [Create a provisioning package with multivariant settings](provisioning-multivariant.md) +> [!div class="nextstepaction"] +> Learn more about creating a provisioning package: +> +> [Create a provisioning package (desktop wizard)](provision-pcs-for-initial-deployment.md) +> [Create a provisioning package (advanced)](provisioning-create-package.md) diff --git a/windows/configuration/provisioning-packages/provisioning-multivariant.md b/windows/configuration/provisioning-packages/provisioning-multivariant.md index f6bda1fbba..01be2943f7 100644 --- a/windows/configuration/provisioning-packages/provisioning-multivariant.md +++ b/windows/configuration/provisioning-packages/provisioning-multivariant.md @@ -1,56 +1,40 @@ --- -title: Create a provisioning package with multivariant settings (Windows 10/11) +title: Create a provisioning package with multivariant settings description: Create a provisioning package with multivariant settings to customize the provisioned settings for defined conditions. -ms.prod: windows-client -author: lizgt2000 -ms.topic: article -ms.localizationpriority: medium -ms.reviewer: gkomatsu -manager: aaroncz -ms.author: lizlong -ms.technology: itpro-configure -ms.date: 12/31/2017 +ms.topic: how-to +ms.date: 07/09/2024 --- # Create a provisioning package with multivariant settings - -**Applies to** - -- Windows 10 -- Windows 11 - - -In your organization, you might have different configuration requirements for devices that you manage. You can create separate provisioning packages for each group of devices in your organization that have different requirements. Or, you can create a multivariant provisioning package, a single provisioning package that can work for multiple conditions. For example, in a single provisioning package, you can define one set of customization settings that will apply to devices set up for French and a different set of customization settings for devices set up for Japanese. +In your organization, you might have different configuration requirements for devices that you manage. You can create separate provisioning packages for each group of devices in your organization that have different requirements. Or, you can create a multivariant provisioning package, a single provisioning package that can work for multiple conditions. For example, in a single provisioning package, you can define one set of customization settings that apply to devices set up for French and a different set of customization settings for devices set up for Japanese. To provision multivariant settings, you use Windows Configuration Designer to create a provisioning package that contains all of the customization settings that you want to apply to any of your devices. Next, you manually edit the .XML file for that project to define each set of devices (a **Target**). For each **Target**, you specify at least one **Condition** with a value, which identifies the devices to receive the configuration. Finally, for each **Target**, you provide the customization settings to be applied to those devices. Let's begin by learning how to define a **Target**. - -## Define a target +## Target In the XML file, you provide an **Id**, or friendly name, for each **Target**. Each **Target** is defined by at least one **TargetState** which contains at least one **Condition**. A **Condition** element defines the matching type between the condition and the specified value. -A **Target** can have more than one **TargetState**, and a **TargetState** can have more than one **Condition**. +A **Target** can have more than one **TargetState**, and a **TargetState** can have more than one **Condition**. -![Target with multiple target states and conditions.](../images/multi-target.png) +![Target with multiple target states and conditions.](images/multi-target.png) The following information describes the logic for the target definition: - When all **Condition** elements are TRUE, **TargetState** is TRUE: - :::image type="content" source="../images/icd-multi-targetstate-true.png" alt-text="Target state is true when all conditions are true."::: + :::image type="content" source="images/icd-multi-targetstate-true.png" alt-text="Target state is true when all conditions are true."::: - If any of the **TargetState** elements is TRUE, **Target** is TRUE, and the **ID** can be used for setting customizations: - :::image type="content" source="../images/icd-multi-target-true.png" alt-text="Target is true if any target state is true"::: + :::image type="content" source="images/icd-multi-target-true.png" alt-text="Target is true if any target state is true"::: ### Conditions The following table shows the conditions supported in Windows client provisioning for a **TargetState**: - | Condition Name | Condition priority | Windows client for desktop editions | Value type | Value description | | --- | --- | --- | --- | --- | | MNC | P0 | Supported | Digit string | Use to target settings based on the Mobile Network Code (MNC) value. | @@ -59,9 +43,9 @@ The following table shows the conditions supported in Windows client provisionin | PNN | P0 | Supported | String | Use to target settings based on public land mobile network (PLMN) Network Name value. | | GID1 | P0 | Supported | Digit string | Use to target settings based on the Group Identifier (level 1) value. | | ICCID | P0 | Supported | Digit string | Use to target settings based on the Integrated Circuit Card Identifier (ICCID) value. | -| Roaming | P0 | N/A | Boolean | Use to specify roaming. Set the value to **1** (roaming) or **0** (non-roaming). | -| UICC | P0 | N/A | Enumeration | Use to specify the Universal Integrated Circuit Card (UICC) state. Set the value to one of the following:


                        - 0 - Empty
                        - 1 - Ready
                        - 2 - Locked | -| UICCSLOT | P0 | N/A | Digit string | Use to specify the UICC slot. Set the value one of the following:


                        - 0 - Slot 0
                        - 1 - Slot 1 | +| Roaming | P0 | N/A | Boolean | Use to specify roaming. Set the value to **1** (roaming) or **0** (nonroaming). | +| UICC | P0 | N/A | Enumeration | Use to specify the Universal Integrated Circuit Card (UICC) state. Set the value to one of these values:
                        0 - Empty
                        1 - Ready
                        2 - Locked | +| UICCSLOT | P0 | N/A | Digit string | Use to specify the UICC slot. Set the value one of these values:
                        0 - Slot 0
                        1 - Slot 1 | | ProcessorType | P1 | Supported | String | Use to target settings based on the processor type. | | ProcessorName | P1 | Supported | String | Use to target settings based on the processor name. | | AoAc ("Always On, Always Connected") | P1 | Supported | Boolean | Set the value to **0** (false) or **1** (true). If this condition is TRUE, the system supports the S0 low power idle model. | @@ -69,22 +53,20 @@ The following table shows the conditions supported in Windows client provisionin | SocIdentifier | P1 | Supported | String | Use to target settings based on the Soc Identifier. Available since 25301 OS build version. | | Architecture | P1 | Supported | String | Matches the PROCESSOR_ARCHITECTURE environment variable. | | Server | P1 | Supported | Boolean | Set the value to **0** (false) or **1** (true) to identify a server. | -| Region | P1 | Supported | Enumeration | Use to target settings based on country/region, using the 2-digit alpha ISO code per [ISO 3166-1 alpha-2](https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2). | -| Lang | P1 | Supported | Enumeration | Use to target settings based on language code, using the 2-digit [ISO 639 alpha-2 code](https://en.wikipedia.org/wiki/ISO_639). | - +| Region | P1 | Supported | Enumeration | Use to target settings based on region, using the two digit alpha ISO code per [ISO 3166-1 alpha-2](https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2). | +| Lang | P1 | Supported | Enumeration | Use to target settings based on language code, using the two digit [ISO 639 alpha-2 code](https://en.wikipedia.org/wiki/ISO_639). | The matching types supported in Windows client are: -| Matching type | Syntax | Example | -| --- | --- | --- | -| Straight match | Matching type is specified as-is | <Condition Name="ProcessorName" Value="Barton" /> | -| Regular expression (Regex) match | Matching type is prefixed by "Pattern:" | <Condition Name="ProcessorName" Value="Pattern:.*Celeron.*" /> | -| Numeric range match | Matching type is prefixed by "!Range:" | <Condition Name="MNC" Value="!Range:400, 550" /> | - +| Matching type | Syntax | Example | +|-----------------------------------|-------------------------------------------|------------------------------------------------------------------------| +| Straight match | Matching type is specified as-is | `<Condition Name="ProcessorName" Value="Barton" />` | +| Regular expressions (Regex) match | Matching type is prefixed with `Pattern:` | `<Condition Name="ProcessorName" Value="Pattern:.*Celeron.*" />` | +| Numeric range match | Matching type is prefixed with `!Range:` | `<Condition Name="MNC" Value="!Range:400, 550" />` | ### TargetState priorities -You can define more than one **TargetState** within a provisioning package to apply settings to devices that match device conditions. When the provisioning engine evaluates each **TargetState**, more than one **TargetState** may fit current device conditions. To determine the order in which the settings are applied, the system assigns a priority to every **TargetState**. +You can define more than one **TargetState** within a provisioning package to apply settings to devices that match device conditions. When the provisioning engine evaluates each **TargetState**, more than one **TargetState** may fit current device conditions. To determine the order in which the settings are applied, the system assigns a priority to every **TargetState**. A setting that matches a **TargetState** with a lower priority is applied before the setting that matches a **TargetState** with a higher priority. This means that a setting for the **TargetState** with the higher priority can overwrite a setting for the **TargetState** with the lower priority. @@ -93,29 +75,19 @@ Settings that match more than one **TargetState** with equal priority are applie The **TargetState** priority is assigned based on the condition's priority (see the [Conditions table](#conditions) for priorities). The priority evaluation rules are as followed: 1. A **TargetState** with P0 conditions is higher than a **TargetState** without P0 conditions. - -2. A **TargetState** with both P0 and P1 conditions is higher than a **TargetState** with only P0 conditions. - -2. A **TargetState** with a greater number of matched P0 conditions is higher than **TargetState** with fewer matched P0 conditions, regardless of the number of P1 conditions matched. - -2. If the number of P0 conditions matched are equivalent, then the **TargetState** with the most matched P1 conditions has higher priority. - -3. If both P0 and P1 conditions are equally matched, then the **TargetState** with the greatest total number of matched conditions has highest priority. - - +1. A **TargetState** with both P0 and P1 conditions is higher than a **TargetState** with only P0 conditions. +1. A **TargetState** with a greater number of matched P0 conditions is higher than **TargetState** with fewer matched P0 conditions, regardless of the number of P1 conditions matched. +1. If the number of P0 conditions matched is equivalent, then the **TargetState** with the most matched P1 conditions has higher priority. +1. If both P0 and P1 conditions are equally matched, then the **TargetState** with the greatest total number of matched conditions has highest priority. ## Create a provisioning package with multivariant settings Follow these steps to create a provisioning package with multivariant capabilities. - 1. Build a provisioning package and configure the customizations you want to apply during certain conditions. For more information, see [Create a provisioning package](provisioning-create-package.md). - -2. After you've [configured the settings](provisioning-create-package.md#configure-settings), save the project. - -3. Open the project folder and copy the customizations.xml file to any local location. - -4. Use an XML or text editor to open the customizations.xml file. +1. After you [configure the settings](provisioning-create-package.md#configure-settings), save the project. +1. Open the project folder and copy the customizations.xml file to any local location. +1. Use an XML or text editor to open the customizations.xml file. The customizations.xml file holds the package metadata (including the package owner and rank) and the settings that you configured when you created your provisioning package. The **Customizations** node of the file contains a **Common** section, which contains the customization settings. @@ -145,13 +117,14 @@ Follow these steps to create a provisioning package with multivariant capabiliti - + + ``` -5. Edit the customizations.xml file to create a **Targets** section to describe the conditions that will handle your multivariant settings. +1. Edit the customizations.xml file to create a **Targets** section to describe the conditions that handle your multivariant settings. + + The following example shows the customizations.xml, which is modified to include several conditions including **ProcessorName**, **ProcessorType**, **MCC**, and **MNC**. - The following example shows the customizations.xml, which has been modified to include several conditions including **ProcessorName**, **ProcessorType**, **MCC**, and **MNC**. - ```XML @@ -194,23 +167,22 @@ Follow these steps to create a provisioning package with multivariant capabiliti - + + ``` -6. In the customizations.xml file, create a **Variant** section for the settings you need to customize. To do this: +1. In the customizations.xml file, create a **Variant** section for the settings you need to customize. To do this: a. Define a child **TargetRefs** element. - - b. Within the **TargetRefs** element, define a **TargetRef** element. You can define multiple **TargetRef** elements for each **Id** that you need to apply to customized settings. - + b. Within the **TargetRefs** element, define a **TargetRef** element. You can define multiple **TargetRef** elements for each **Id** that you need to apply to customized settings. c. Move compliant settings from the **Common** section to the **Variant** section. If any of the **TargetRef** elements matches the **Target**, all settings in the **Variant** are applied. - >[!NOTE] - >You can define multiple **Variant** sections. Settings that reside in the **Common** section are applied unconditionally on every triggering event. + > [!NOTE] + > You can define multiple **Variant** sections. Settings that reside in the **Common** section are applied unconditionally on every triggering event. - The following example shows the customizations.xml updated to include a **Variant** section and the moved settings that will be applied if the conditions for the variant are met. + The following example shows the customizations.xml updated to include a **Variant** section and the moved settings that are applied if the conditions for the variant are met. ```XML @@ -262,27 +234,23 @@ Follow these steps to create a provisioning package with multivariant capabiliti - + ``` -7. Save the updated customizations.xml file and note the path to this updated file. You will need the path as one of the values for the next step. +1. Save the updated customizations.xml file and note the path to this updated file. You'll need the path as one of the values for the next step. - -8. Use the [Windows Configuration Designer command-line interface](provisioning-command-line.md) to create a provisioning package using the updated customizations.xml. +1. Use the [Windows Configuration Designer command-line interface](provisioning-command-line.md) to create a provisioning package using the updated customizations.xml. For example: ``` icd.exe /Build-ProvisioningPackage /CustomizationXML:"C:\CustomProject\customizations.xml" /PackagePath:"C:\CustomProject\output.ppkg" /StoreFile:C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86\Microsoft-Common-Provisioning.dat" ``` - -In this example, the **StoreFile** corresponds to the location of the settings store that will be used to create the package for the required Windows edition. +In this example, the **StoreFile** corresponds to the location of the settings store that is used to create the package for the required Windows edition. ->[!NOTE] ->The provisioning package created during this step will contain the multivariant settings. You can use this package either as a standalone package that you can apply to a Windows device or use it as the base when starting another project. - - +> [!NOTE] +> The provisioning package created during this step contains the multivariant settings. You can use this package either as a standalone package that you can apply to a Windows device or use it as the base when starting another project. ## Events that trigger provisioning @@ -290,25 +258,11 @@ When you install the multivariant provisioning package on a Windows client devic The following events trigger provisioning on Windows client devices: -| Event | Windows client for desktop editions | -| --- | --- | -| System boot | Supported | -| Operating system update | Planned | -| Package installation during device first run experience | Supported | -| Detection of SIM presence or update | Supported | -| Package installation at runtime | Supported | -| Roaming detected | Not supported | - -## Related articles - -- [Provisioning packages for Windows client](provisioning-packages.md) -- [How provisioning works in Windows client](provisioning-how-it-works.md) -- [Install Windows Configuration Designer](provisioning-install-icd.md) -- [Create a provisioning package](provisioning-create-package.md) -- [Apply a provisioning package](provisioning-apply-package.md) -- [Settings changed when you uninstall a provisioning package](provisioning-uninstall-package.md) -- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md) -- [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md) -- [PowerShell cmdlets for provisioning Windows client (reference)](provisioning-powershell.md) -- [Windows Configuration Designer command-line interface (reference)](provisioning-command-line.md) - +| Event | Windows client for desktop editions | +|---------------------------------------------------------|-------------------------------------| +| System boot | Supported | +| Operating system update | Planned | +| Package installation during device first run experience | Supported | +| Detection of SIM presence or update | Supported | +| Package installation at runtime | Supported | +| Roaming detected | Not supported | diff --git a/windows/configuration/provisioning-packages/provisioning-packages.md b/windows/configuration/provisioning-packages/provisioning-packages.md index aed5ec0d4a..a226b877f3 100644 --- a/windows/configuration/provisioning-packages/provisioning-packages.md +++ b/windows/configuration/provisioning-packages/provisioning-packages.md @@ -1,87 +1,86 @@ --- title: Provisioning packages overview -description: With Windows 10 and Windows 11, you can create provisioning packages that let you quickly and efficiently configure a device without having to install a new image. Learn about what provisioning packages, are and what they do. +description: With Windows, you can create provisioning packages that let you quickly and efficiently configure a device without having to install a new image. Learn about what provisioning packages are and what they do. ms.reviewer: kevinsheehan -author: lizgt2000 -ms.author: lizlong -ms.topic: article -ms.date: 12/31/2017 +ms.topic: conceptual +ms.date: 07/08/2024 --- # Provisioning packages for Windows -**Applies to** - -- Windows 10 -- Windows 11 - -Windows provisioning makes it easy for IT administrators to configure end-user devices without imaging. When you use Windows provisioning, an IT administrator can easily specify the desired configuration and settings required to enroll the devices into management. Then, apply that configuration to target devices in a matter of minutes. It's best suited for small- to medium-sized businesses with deployments that range from tens to a few hundred computers. +Windows provisioning makes it easy for IT administrators to configure end-user devices without imaging. When you use Windows provisioning, an IT administrator can easily specify the desired configuration and settings required to enroll the devices into management. Then, apply that configuration to target devices in a matter of minutes. It's best suited for small- to medium-sized businesses with deployments that range from tens to a few hundred computers. A provisioning package (.ppkg) is a container for a collection of configuration settings. With Windows client, you can create provisioning packages that let you quickly and efficiently configure a device without having to install a new image. -Provisioning packages are simple enough that with a short set of written instructions, a student, or non-technical employee can use them to configure their device. It can result in a significant reduction in the time required to configure multiple devices in your organization. +Provisioning packages are simple enough that with a short set of written instructions, a student, or nontechnical users can use them to configure their device. It can result in a significant reduction in the time required to configure multiple devices in your organization. - -Windows Configuration Designer is available as an [app in the Microsoft Store](https://www.microsoft.com/store/apps/9nblggh4tx22). - - - - - - - - - - +Windows Configuration Designer is available as an [app in the Microsoft Store](https://www.microsoft.com/store/apps/9nblggh4tx22). ## Benefits of provisioning packages Provisioning packages let you: - Quickly configure a new device without going through the process of installing a new image. - - Save time by configuring multiple devices using one provisioning package. - -- Quickly configure employee-owned devices in an organization without a mobile device management (MDM) infrastructure. - +- Quickly configure user-owned devices in an organization without a mobile device management (MDM) infrastructure. - Set up a device without the device having network connectivity. Provisioning packages can be: - Installed using removable media such as an SD card or USB flash drive. - - Attached to an email. - - Downloaded from a network share. - - Deployed in NFC tags or barcodes. +## Provisioning scenarios + +WCD supports the following scenarios for IT administrators: + +- **Simple provisioning** - Enables IT administrators to define a desired configuration in WCD and then apply that configuration on target devices. The simple provisioning wizard makes the entire process quick and easy by guiding an IT administrator through common configuration settings in a step-by-step manner. + + [Learn how to use simple provisioning to configure Windows computers.](provision-pcs-for-initial-deployment.md) + +- **Advanced provisioning (deployment of classic (Win32) and Universal Windows Platform (UWP) apps, and certificates)** - Allows an IT administrator to use WCD to open provisioning packages in the advanced settings editor and include apps for deployment on end-user devices. + +- **Mobile device enrollment into management** - Enables IT administrators to purchase off-the-shelf retail Windows devices and enroll them into mobile device management (MDM) before handing them to end users in the organization. IT administrators can use WCD to specify the management endpoint and apply the configuration on target devices by connecting them to a Windows PC (tethered deployment) or through an SD card. Supported management end-points include: + + - Microsoft Intune (certificate-based enrollment) + - AirWatch (password-string based enrollment) + - MobileIron (password-string based enrollment) + - Other MDMs (cert-based enrollment) + +> [!NOTE] +> The Provision school devices wizard is removed from Windows Configuration Designer. Instead, use the [Setup School PCs app](https://www.microsoft.com/store/p/set-up-school-pcs/9nblggh4ls40) from the Microsoft Store. + +:::image type="content" source="images/icd.png" alt-text="Configuration Designer options"::: + ## What you can configure -### Configuration Designer wizards +Windows Configuration Designer provides the following simple provisioning scenarios: + +- [Instructions for the desktop wizard](provision-pcs-for-initial-deployment.md) +- [Instructions for the kiosk wizard](../assigned-access/overview.md) +- [Instructions for the HoloLens wizard](/hololens/hololens-provisioning#provisioning-package-hololens-wizard) +- [Instructions for the Surface Hub wizard](/surface-hub/provisioning-packages-for-surface-hub) The following table describes settings that you can configure using the wizards in Windows Configuration Designer to create provisioning packages. | Step | Description | Desktop wizard | Kiosk wizard | HoloLens wizard | | --- | --- | --- | --- | --- | -| Set up device | Assign device name, enter product key to upgrade Windows, configure shared use, remove pre-installed software | ✔️ | ✔️ | ✔️ | -| Set up network | Connect to a Wi-Fi network | ✔️ | ✔️ | ✔️ | -| Account management | Enroll device in Active Directory, enroll device in Microsoft Entra ID, or create a local administrator account | ✔️ | ✔️ | ✔️ | -| Bulk Enrollment in Microsoft Entra ID | Enroll device in Microsoft Entra ID using Bulk Token

                        [Set up Microsoft Entra join in your organization](/azure/active-directory/active-directory-azureadjoin-setup), before you use Windows Configuration Designer wizard to configure bulk Microsoft Entra enrollment. | ✔️ | ✔️ | ✔️ | -| Add applications | Install applications using the provisioning package. | ✔️ | ✔️ | ❌ | -| Add certificates | Include a certificate file in the provisioning package. | ✔️ | ✔️ | ✔️ | -| Configure kiosk account and app | Create local account to run the kiosk mode app, specify the app to run in kiosk mode | ❌ | ✔️ | ❌ | -| Configure kiosk common settings | Set tablet mode, configure welcome and shutdown screens, turn off timeout settings | ❌ | ✔️ | ❌ | -| Developer Setup | Enable Developer Mode | ❌ | ❌ | ✔️ | +| Set up device | Assign device name, enter product key to upgrade Windows, configure shared use, remove preinstalled software | ✅ | ✅ | ✅ | +| Set up network | Connect to a Wi-Fi network | ✅ | ✅ | ✅ | +| Account management | Enroll device in Active Directory, enroll device in Microsoft Entra ID, or create a local administrator account | ✅ | ✅ | ✅ | +| Bulk Enrollment in Microsoft Entra ID | Enroll device in Microsoft Entra ID using Bulk Token

                        [Set up Microsoft Entra join in your organization](/azure/active-directory/active-directory-azureadjoin-setup), before you use Windows Configuration Designer wizard to configure bulk Microsoft Entra enrollment. | ✅ | ✅ | ✅ | +| Add applications | Install applications using the provisioning package. | ✅ | ✅ | ❌ | +| Add certificates | Include a certificate file in the provisioning package. | ✅ | ✅ | ✅ | +| Configure kiosk account and app | Create local account to run the kiosk mode app, specify the app to run in kiosk mode | ❌ | ✅ | ❌ | +| Configure kiosk common settings | Set tablet mode, configure welcome and shutdown screens, turn off timeout settings | ❌ | ✅ | ❌ | +| Developer Setup | Enable Developer Mode | ❌ | ❌ | ✅ | -- [Instructions for the desktop wizard](provision-pcs-for-initial-deployment.md) -- [Instructions for the kiosk wizard](../kiosk-single-app.md#wizard) -- [Instructions for the HoloLens wizard](/hololens/hololens-provisioning#wizard) +> [!TIP] +> After you start a project using a Windows Configuration Designer wizard, you can switch to the advanced editor to configure additional settings in the provisioning package. ->[!NOTE] ->After you start a project using a Windows Configuration Designer wizard, you can switch to the advanced editor to configure additional settings in the provisioning package. - -### Configuration Designer advanced editor +## Configuration Designer advanced editor The following table provides some examples of settings that you can configure using the Windows Configuration Designer advanced editor to create provisioning packages. @@ -89,7 +88,7 @@ The following table provides some examples of settings that you can configure us |---|---| | Bulk Active Directory join and device name | Join devices to Active Directory domain and assign device names using hardware-specific serial numbers or random characters | | Applications | Windows apps, line-of-business applications | -| Bulk enrollment into MDM | Automatic enrollment into a third-party MDM service

                        Using a provisioning package for auto-enrollment to Microsoft Intune isn't supported. To enroll devices, use the Configuration Manager console. | +| Bulk enrollment into MDM | Automatic enrollment into a third-party MDM service

                        Using a provisioning package for autoenrollment to Microsoft Intune isn't supported. To enroll devices, use the Configuration Manager console. | | Certificates | Root certification authority (CA), client certificates | | Connectivity profiles | Wi-Fi, proxy settings, Email | | Enterprise policies | Security restrictions (password, device lock, camera, and so on), encryption, update settings | @@ -99,33 +98,6 @@ The following table provides some examples of settings that you can configure us For details about the settings you can customize in provisioning packages, see [Windows Provisioning settings reference]( https://go.microsoft.com/fwlink/p/?LinkId=619012). - - - - - -WCD, simplified common provisioning scenarios. - -:::image type="content" source="../images/icd.png" alt-text="Configuration Designer options"::: - -WCD supports the following scenarios for IT administrators: - -* **Simple provisioning** – Enables IT administrators to define a desired configuration in WCD and then apply that configuration on target devices. The simple provisioning wizard makes the entire process quick and easy by guiding an IT administrator through common configuration settings in a step-by-step manner. - - [Learn how to use simple provisioning to configure Windows computers.](provision-pcs-for-initial-deployment.md) - -* **Advanced provisioning (deployment of classic (Win32) and Universal Windows Platform (UWP) apps, and certificates)** – Allows an IT administrator to use WCD to open provisioning packages in the advanced settings editor and include apps for deployment on end-user devices. - -* **Mobile device enrollment into management** - Enables IT administrators to purchase off-the-shelf retail Windows devices and enroll them into mobile device management (MDM) before handing them to end users in the organization. IT administrators can use WCD to specify the management endpoint and apply the configuration on target devices by connecting them to a Windows PC (tethered deployment) or through an SD card. Supported management end-points include: - - - Microsoft Intune (certificate-based enrollment) - - AirWatch (password-string based enrollment) - - MobileIron (password-string based enrollment) - - Other MDMs (cert-based enrollment) - - - - ## Related articles - [How provisioning works in Windows client](provisioning-how-it-works.md) diff --git a/windows/configuration/provisioning-packages/provisioning-powershell.md b/windows/configuration/provisioning-packages/provisioning-powershell.md index 074f0168f1..d8292d3413 100644 --- a/windows/configuration/provisioning-packages/provisioning-powershell.md +++ b/windows/configuration/provisioning-packages/provisioning-powershell.md @@ -1,29 +1,14 @@ --- -title: PowerShell cmdlets for provisioning Windows 10/11 (Windows 10/11) -description: Learn more about the Windows PowerShell cmdlets that you can use with Provisioning packages on Windows10/11 client desktop devices. -ms.prod: windows-client -author: lizgt2000 -ms.author: lizlong -ms.topic: article -ms.localizationpriority: medium -ms.reviewer: gkomatsu -manager: aaroncz -ms.technology: itpro-configure -ms.date: 12/31/2017 +title: PowerShell cmdlets for provisioning packages in Windows +description: Learn more about the Windows PowerShell cmdlets that you can use with Provisioning packages on Windows devices. +ms.topic: conceptual +ms.date: 07/09/2024 --- -# PowerShell cmdlets for provisioning Windows client (reference) - - -**Applies to** - -- Windows 10 -- Windows 11 +# PowerShell cmdlets for provisioning Windows client Windows client includes Provisioning PowerShell cmdlets. These cmdlets make it easy to script the following functions. -## cmdlets - - **Add-ProvisioningPackage**: Applies a provisioning package. Syntax: @@ -59,7 +44,7 @@ Windows client includes Provisioning PowerShell cmdlets. These cmdlets make it e - `Install-TrustedProvisioningCertificate ` -- **Get-TrustedProvisioningCertificate**: Lists all installed trusted provisioning certificates. Use this cmdlet to get the certificate thumbprint to use with the `Uninstall-TrustedProvisioningCertificate` cmdlet. +- **Get-TrustedProvisioningCertificate**: Lists all installed trusted provisioning certificates. Use this cmdlet to get the certificate thumbprint to use with the `Uninstall-TrustedProvisioningCertificate` cmdlet. Syntax: @@ -71,31 +56,15 @@ Windows client includes Provisioning PowerShell cmdlets. These cmdlets make it e - `Uninstall-TrustedProvisioningCertificate ` ->[!NOTE] +> [!NOTE] > You can use Get-Help to get usage help on any command. For example: `Get-Help Add-ProvisioningPackage` -Trace logs are captured when using cmdlets. The following logs are available in the logs folder after the cmdlet completes: +Trace logs are captured when using cmdlets. The following logs are available in the logs folder after the cmdlet completes: - ProvTrace.<timestamp>.ETL - ETL trace file, unfiltered - ProvTrace.<timestamp>.XML - ETL trace file converted into raw trace events, unfiltered - ProvTrace.<timestamp>.TXT - TEXT file containing trace output formatted for easy reading, filtered to only show events logged by providers in the WPRP file - ProvLogReport.<timestamp>.XLS - Excel file containing trace output, filtered to only show events logged by providers in WPRP file - - ->[!NOTE] ->When applying provisioning packages using Powershell cmdlets, the default behavior is to suppress the prompt that appears when applying an unsigned provisioning package. This is by design so that provisioning packages can be applied as part of existing scripts. - - -## Related articles - -- [How provisioning works in Windows client](provisioning-how-it-works.md) -- [Install Windows Configuration Designer](provisioning-install-icd.md) -- [Create a provisioning package](provisioning-create-package.md) -- [Apply a provisioning package](provisioning-apply-package.md) -- [Settings changed when you uninstall a provisioning package](provisioning-uninstall-package.md) -- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md) -- [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md) -- [Windows Configuration Designer command-line interface (reference)](provisioning-command-line.md) -- [Create a provisioning package with multivariant settings](provisioning-multivariant.md) - +> [!NOTE] +> When applying provisioning packages using Powershell cmdlets, the default behavior is to suppress the prompt that appears when applying an unsigned provisioning package. This is by design so that provisioning packages can be applied as part of existing scripts. diff --git a/windows/configuration/provisioning-packages/provisioning-script-to-install-app.md b/windows/configuration/provisioning-packages/provisioning-script-to-install-app.md index e766825729..970ed67763 100644 --- a/windows/configuration/provisioning-packages/provisioning-script-to-install-app.md +++ b/windows/configuration/provisioning-packages/provisioning-script-to-install-app.md @@ -1,32 +1,19 @@ --- -title: Use a script to install a desktop app in provisioning packages (Windows 10/11) -description: With Windows 10/11, you can create provisioning packages that let you quickly and efficiently configure a device without having to install a new image. -ms.prod: windows-client -author: lizgt2000 -ms.author: lizlong -ms.topic: article -ms.localizationpriority: medium -ms.reviewer: gkomatsu -manager: aaroncz -ms.technology: itpro-configure -ms.date: 12/31/2017 +title: Use a script to install a desktop app in provisioning packages +description: With Windows, you can create provisioning packages that let you quickly and efficiently configure a device without having to install a new image. +ms.topic: how-to +ms.date: 07/09/2024 --- # Use a script to install a desktop app in provisioning packages - -**Applies to** - -- Windows 10 -- Windows 11 - This walkthrough describes how to include scripts in a Windows client provisioning package to install Win32 applications. Scripted operations other than installing apps can also be performed. However, some care is needed to avoid unintended behavior during script execution (see [Remarks](#remarks) below). ## Assemble the application assets -1. On the device where you’re authoring the package, place all of your assets in a known location. Each asset must have a unique filename, because all files will be copied to the same temp directory on the device. It’s common for many apps to have an installer called ‘install.exe’ or similar, and there may be name overlap because of that. To fix this, you can use the technique described in the next step to include a complete directory structure that is then expanded into the temp directory on the device. The most common use for this would be to include a subdirectory for each application. +1. On the device where you're authoring the package, place all of your assets in a known location. Each asset must have a unique filename, because all files will be copied to the same temp directory on the device. It's common for many apps to have an installer called 'install.exe' or similar, and there may be name overlap because of that. To fix this, you can use the technique described in the next step to include a complete directory structure that is then expanded into the temp directory on the device. The most common use for this would be to include a subdirectory for each application. -2. If you need to include a directory structure of files, you will need to cab the assets for easy inclusion in the provisioning packages. +1. If you need to include a directory structure of files, you'll need to cab the assets for easy inclusion in the provisioning packages. ## Cab the application assets @@ -34,53 +21,31 @@ This walkthrough describes how to include scripts in a Windows client provisioni ```ddf ;*** MSDN Sample Source Code MakeCAB Directive file example - ; - .OPTION EXPLICIT ; Generate errors on variable typos - .set DiskDirectoryTemplate=CDROM ; All cabinets go in a single directory - .Set MaxDiskFileCount=1000; Limit file count per cabinet, so that - ; scanning is not too slow - .Set FolderSizeThreshold=200000 ; Aim for ~200K per folder - .Set CompressionType=MSZIP - ;** All files are compressed in cabinet files - .Set Cabinet=on - .Set Compress=on - ;------------------------------------------------------------------- - ;** CabinetNameTemplate = name of cab - ;** DiskDirectory1 = output directory where cab will be created - ;------------------------------------------------------------------- - .Set CabinetNameTemplate=tt.cab - .Set DiskDirectory1=. - ;------------------------------------------------------------------- - ; Replace with actual files you want to package - ;------------------------------------------------------------------- - - - - ;*** + ;*** ``` -2. Use makecab to create the cab files. +1. Use makecab to create the cab files. ```makecab Makecab -f @@ -90,20 +55,20 @@ This walkthrough describes how to include scripts in a Windows client provisioni Create a script to perform whatever work is needed to install the application(s). The following examples are provided to help get started authoring the orchestrator script that will execute the required installers. In practice, the orchestrator script may reference many more assets than those in these examples. -You don’t need to create an orchestrator script. You can have one command line per app. If necessary, you can create a script that logs the output per app, as mentioned below (rather than one orchestrator script for the entire provisioning package). +You don't need to create an orchestrator script. You can have one command line per app. If necessary, you can create a script that logs the output per app, as mentioned below (rather than one orchestrator script for the entire provisioning package). ->[!NOTE] ->All actions performed by the script must happen silently, showing no UI and requiring no user interaction. +> [!NOTE] > ->The scripts will be run on the device in system context. +> - All actions performed by the script must happen silently, showing no UI and requiring no user interaction. +> - The scripts will be run on the device in system context. -### Debugging example +### Debugging example -Granular logging is not built in, so the logging must be built into the script itself. Here is an example script that logs ‘Hello World’ to a logfile. When run on the device, the logfile will be available after provisioning is completed. As you will see in the following examples, it’s recommended that you log each action that your script performs. +Granular logging isn't built in, so the logging must be built into the script itself. Here's an example script that logs `Hello World` to a logfile. When run on the device, the logfile will be available after provisioning is completed. As you'll see in the following examples, it's recommended that you log each action that your script performs. ```log set LOGFILE=%SystemDrive%\HelloWorld.log -echo Hello, World >> %LOGFILE% +echo Hello, World >> %LOGFILE% ``` ### .exe example @@ -140,8 +105,6 @@ PsExec.exe -accepteula -i -s cmd.exe /c 'powershell.exe my_powershell_script.ps1 echo result: %ERRORLEVEL% >> %LOGFILE% ``` - - ### Extract from a .CAB example This example script shows expansion of a .cab from the provisioning commands script, and installation of the expanded setup.exe @@ -160,17 +123,15 @@ echo result: %ERRORLEVEL% >> %LOGFILE% Your provisioning package can include multiple **CommandFiles**. -You are allowed one **CommandLine** per provisioning package. The batch files shown above are orchestrator scripts that manage the installation and call any other scripts included in the provisioning package. The orchestrator script is what should be invoked from the **CommandLine** specified in the package. - -Here’s a table describing this relationship, using the PowerShell example from above: - +You're allowed one **CommandLine** per provisioning package. The batch files shown above are orchestrator scripts that manage the installation and call any other scripts included in the provisioning package. The orchestrator script is what should be invoked from the **CommandLine** specified in the package. +Here's a table describing this relationship, using the PowerShell example from above: |ICD Setting | Value | Description | | --- | --- | --- | | ProvisioningCommands/DeviceContext/CommandLine | cmd /c PowerShell_Example.bat | The command line needed to invoke the orchestrator script. | | ProvisioningCommands/DeviceContext/CommandFiles | PowerShell_Example.bat | The single orchestrator script referenced by the command line that handles calling into the required installers or performing any other actions such as expanding cab files. This script must do the required logging. | -| ProvisioningCommands/DeviceContext/CommandFiles | my_powershell_script.ps1 | Other assets referenced by the orchestrator script. In this example, there is only one, but there could be many assets referenced here. One common use case is using the orchestrator to call a series of install.exe or setup.exe installers to install several applications. Each of those installers must be included as an asset here. | +| ProvisioningCommands/DeviceContext/CommandFiles | my_powershell_script.ps1 | Other assets referenced by the orchestrator script. In this example, there's only one, but there could be many assets referenced here. One common use case is using the orchestrator to call a series of install.exe or setup.exe installers to install several applications. Each of those installers must be included as an asset here. | ### Add script to provisioning package @@ -184,52 +145,45 @@ cmd /c InstallMyApp.bat In Windows Configuration Designer, this looks like: -![Command line in Selected customizations.](../images/icd-script1.png) +![Command line in Selected customizations.](images/icd-script1.png) You also need to add the relevant assets for that command line including the orchestrator script and any other assets it references such as installers or .cab files. In Windows Configuration Designer, that is done by adding files under the `ProvisioningCommands/DeviceContext/CommandFiles` setting. -![Command files in Selected customizations.](../images/icd-script2.png) - -When you are done, [build the package](provisioning-create-package.md#build-package). - +![Command files in Selected customizations.](images/icd-script2.png) +When you're done, [build the package](provisioning-create-package.md#build-package). ### Remarks -1. No user interaction or console output is supported via ProvisioningCommands. All work needs to be silent. If your script attempts to do any of the following it will cause undefined behavior, and could put the device in an unrecoverable state if executed during setup or the Out of Box Experience: - a. Echo to console - b. Display anything on the screen - c. Prompt the user with a dialog or install wizard -2. When applied at first boot, provisioning runs early in the boot sequence and before a user context has been established; care must be taken to only include installers that can run at this time. Other installers can be provisioned via a management tool. -3. If the device is put into an unrecoverable state because of a bad script, you can reset it using [recovery options in Windows client](https://support.microsoft.com/help/12415/windows-10-recovery-options). -4. The CommandFile assets are deployed on the device to a temporary folder unique to each package. +1. No user interaction or console output is supported via ProvisioningCommands. All work needs to be silent. If your script attempts to do any of the following it causes undefined behavior, and could put the device in an unrecoverable state if executed during setup or the Out of Box Experience: + + 1. Echo to console + 1. Display anything on the screen + 1. Prompt the user with a dialog or install wizard + +1. When applied at first boot, provisioning runs early in the boot sequence and before a user context has been established; care must be taken to only include installers that can run at this time. Other installers can be provisioned via a management tool. +1. If the device is put into an unrecoverable state because of a bad script, you can reset it using [recovery options in Windows client](https://support.microsoft.com/help/12415/windows-10-recovery-options). +1. The CommandFile assets are deployed on the device to a temporary folder unique to each package. 1. For packages added during the out of box experience, this is usually in `%WINDIR%\system32\config\systemprofile\appdata\local\Temp\ProvisioningPkgTmp\<{PackageIdGuid}>\Commands\0` The `0` after `Commands\` refers to the installation order and indicates the first app to be installed. The number will increment for each app in the package. - 2. For packages added by double-clicking on an already deployed device, this will be in the temp folder for the user executing the provisioning package: `%TMP%\ProvisioningPkgTmp\<{PackageIdGuid}>\Commands\0` + 1. For packages added by double-clicking on an already deployed device, this will be in the temp folder for the user executing the provisioning package: `%TMP%\ProvisioningPkgTmp\<{PackageIdGuid}>\Commands\0` -5. The command line will be executed with the directory the CommandFiles were deployed to as the working directory. This means you do not need to specific the full path to assets in the command line or from within any script. -6. The runtime provisioning component will attempt to run the scripts from the provisioning package at the earliest point possible, depending on the stage when the PPKG was added. For example, if the package was added during the Out-of-Box Experience, it will be run immediately after the package is applied, while the out of box experience is still happening. This is before the user account configuration options are presented to the user. A spinning progress dialog will appear and “please wait” will be displayed on the screen. +1. The command line will be executed with the directory the CommandFiles were deployed to as the working directory. This means you do not need to specific the full path to assets in the command line or from within any script. +1. The runtime provisioning component will attempt to run the scripts from the provisioning package at the earliest point possible, depending on the stage when the PPKG was added. For example, if the package was added during the Out-of-Box Experience, it will be run immediately after the package is applied, while the out of box experience is still happening. This is before the user account configuration options are presented to the user. A spinning progress dialog will appear and "please wait" will be displayed on the screen. - >[!NOTE] - >There is a timeout of 30 minutes for the provisioning process at this point. All scripts and installs need to complete within this time. -7. The scripts are executed in the background as the rest of provisioning continues to run. For packages added on existing systems using the double-click to install, there is no notification that provisioning or script execution has completed + > [!NOTE] + > There is a timeout of 30 minutes for the provisioning process at this point. All scripts and installs need to complete within this time. -## Related articles - -- [Provisioning packages for Windows client](provisioning-packages.md) -- [How provisioning works in Windows client](provisioning-how-it-works.md) -- [Install Windows Configuration Designer](provisioning-install-icd.md) -- [Create a provisioning package](provisioning-create-package.md) -- [Apply a provisioning package](provisioning-apply-package.md) -- [Settings changed when you uninstall a provisioning package](provisioning-uninstall-package.md) -- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md) -- [Windows Configuration Designer command-line interface (reference)](provisioning-command-line.md) -- [PowerShell cmdlets for provisioning Windows client (reference)](provisioning-powershell.md) -- [Create a provisioning package with multivariant settings](provisioning-multivariant.md) +1. The scripts are executed in the background as the rest of provisioning continues to run. For packages added on existing systems using the double-click to install, there's no notification that provisioning or script execution has completed +## Next steps +> [!div class="nextstepaction"] +> Learn more about applying a provisioning package: +> +> [Apply a provisioning package](provisioning-apply-package.md) \ No newline at end of file diff --git a/windows/configuration/provisioning-packages/provisioning-uninstall-package.md b/windows/configuration/provisioning-packages/provisioning-uninstall-package.md index 1ae2f42140..a4f68379ee 100644 --- a/windows/configuration/provisioning-packages/provisioning-uninstall-package.md +++ b/windows/configuration/provisioning-packages/provisioning-uninstall-package.md @@ -1,90 +1,57 @@ --- -title: Uninstall a provisioning package - reverted settings (Windows 10/11) -description: This article lists the settings that are reverted when you uninstall a provisioning package on Windows 10/11 desktop client devices. -ms.prod: windows-client -author: lizgt2000 -ms.author: lizlong -ms.topic: article -ms.localizationpriority: medium -ms.reviewer: gkomatsu -manager: aaroncz -ms.technology: itpro-configure -ms.date: 12/31/2017 +title: Settings changed when you uninstall a provisioning package +description: This article lists the settings that are reverted when you uninstall a provisioning package on Windows desktop client devices. +ms.topic: conceptual +ms.date: 07/09/2024 --- # Settings changed when you uninstall a provisioning package +When you uninstall a provisioning package, only certain settings are revertible. This article lists the settings that are reverted when you uninstall a provisioning package. As an administrator, you can uninstall by using the **Add or remove a package for work or school** option available under **Settings** > **Accounts** > **Access work or school**. -**Applies to** +When a provisioning package is uninstalled, some of its settings are reverted, which means the value for the setting is changed to the next available or default value. Not all settings, however, are revertible. -- Windows 10 -- Windows 11 - -When you uninstall a provisioning package, only certain settings are revertible. This article lists the settings that are reverted when you uninstall a provisioning package. - - -As an administrator, you can uninstall by using the **Add or remove a package for work or school** option available under **Settings** > **Accounts** > **Access work or school**. - -When a provisioning package is uninstalled, some of its settings are reverted, which means the value for the setting is changed to the next available or default value. Not all settings, however, are revertible. - -Only settings in the following lists are revertible. +> [!IMPORTANT] +> Only settings in the following lists are revertible. ## Registry-based settings -The registry-based settings that are revertible when a provisioning package is uninstalled all fall under these categories, which you can find in the Windows Configuration Designer. - +The registry-based settings that are revertible when a provisioning package is uninstalled all fall under these categories, which you can find in the Windows Configuration Designer. - [Wi-Fi Sense](../wcd/wcd-connectivityprofiles.md#wifisense) - [CountryAndRegion](../wcd/wcd-countryandregion.md) -- DeviceManagement / PGList/ LogicalProxyName -- UniversalAppInstall / LaunchAppAtLogin +- [DeviceManagement / PGList / LogicalProxyName](../wcd/wcd-devicemanagement.md#pglist) +- [UniversalAppInstall](../wcd/wcd-universalappinstall.md) / LaunchAppAtLogin - [Power](/previous-versions//dn953704(v=vs.85)) -- [TabletMode](../wcd/wcd-tabletmode.md) -- [Maps](../wcd/wcd-maps.md) +- [TabletMode](../wcd/wcd-tabletmode.md) +- [Maps](../wcd/wcd-maps.md) - [Browser](../wcd/wcd-browser.md) -- [DeviceFormFactor](../wcd/wcd-deviceformfactor.md) -- [USBErrorsOEMOverride](/previous-versions/windows/hardware/previsioning-framework/mt769908(v=vs.85)) -- [WeakCharger](../wcd/wcd-weakcharger.md) - - +- [DeviceFormFactor](../wcd/wcd-deviceformfactor.md) +- [USBErrorsOEMOverride](/previous-versions/windows/hardware/previsioning-framework/mt769908(v=vs.85)) +- [WeakCharger](../wcd/wcd-weakcharger.md) ## CSP-based settings -Here is the list of revertible settings based on configuration service providers (CSPs). +Here's the list of revertible settings based on configuration service providers (CSPs). -[ActiveSync CSP](/windows/client-management/mdm/activesync-csp) -[AppLocker CSP](/windows/client-management/mdm/applocker-csp) -[BrowserFavorite CSP](/windows/client-management/mdm/browserfavorite-csp) -[CertificateStore CSP](/windows/client-management/mdm/certificatestore-csp) -[ClientCertificateInstall CSP](/windows/client-management/mdm/clientcertificateinstall-csp) -[RootCATrustedCertificates CSP](/windows/client-management/mdm/rootcacertificates-csp) -[CM_CellularEntries CSP](/windows/client-management/mdm/cm-cellularentries-csp) -[CM_ProxyEntries CSP](/windows/client-management/mdm/cm-proxyentries-csp) -[CMPolicy CSP](/windows/client-management/mdm/cmpolicy-csp) -[CMPolicyEnterprise CSP](/windows/client-management/mdm/cmpolicyenterprise-csp) -[EMAIL2 CSP](/windows/client-management/mdm/email2-csp) -[EnterpriseAPN CSP](/windows/client-management/mdm/enterpriseapn-csp) -[EnterpriseDesktopAppManagement CSP](/windows/client-management/mdm/enterprisedesktopappmanagement-csp) -[EnterpriseModernAppManagement CSP](/windows/client-management/mdm/enterprisemodernappmanagement-csp) -[NAP CSP](/windows/client-management/mdm/nap-csp) -[PassportForWork CSP](/windows/client-management/mdm/passportforwork-csp) -[Provisioning CSP](/windows/client-management/mdm/provisioning-csp) -[SecureAssessment CSP](/windows/client-management/mdm/secureassessment-csp) -[VPN CSP](/windows/client-management/mdm/vpn-csp) -[VPNv2 CSP](/windows/client-management/mdm/vpnv2-csp) -[WiFi CSP](/windows/client-management/mdm/wifi-csp) - - - -## Related articles - -- [Provisioning packages for Windows client](provisioning-packages.md) -- [How provisioning works in Windows client](provisioning-how-it-works.md) -- [Install Windows Configuration Designer](provisioning-install-icd.md) -- [Create a provisioning package](provisioning-create-package.md) -- [Apply a provisioning package](provisioning-apply-package.md) -- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md) -- [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md) -- [PowerShell cmdlets for provisioning Windows client (reference)](provisioning-powershell.md) -- [Windows Configuration Designer command-line interface (reference)](provisioning-command-line.md) -- [Create a provisioning package with multivariant settings](provisioning-multivariant.md) +- [ActiveSync CSP](/windows/client-management/mdm/activesync-csp) +- [AppLocker CSP](/windows/client-management/mdm/applocker-csp) +- [BrowserFavorite CSP](/windows/client-management/mdm/browserfavorite-csp) +- [CertificateStore CSP](/windows/client-management/mdm/certificatestore-csp) +- [ClientCertificateInstall CSP](/windows/client-management/mdm/clientcertificateinstall-csp) +- [RootCATrustedCertificates CSP](/windows/client-management/mdm/rootcacertificates-csp) +- [CM_CellularEntries CSP](/windows/client-management/mdm/cm-cellularentries-csp) +- [CM_ProxyEntries CSP](/windows/client-management/mdm/cm-proxyentries-csp) +- [CMPolicy CSP](/windows/client-management/mdm/cmpolicy-csp) +- [CMPolicyEnterprise CSP](/windows/client-management/mdm/cmpolicyenterprise-csp) +- [EMAIL2 CSP](/windows/client-management/mdm/email2-csp) +- [EnterpriseAPN CSP](/windows/client-management/mdm/enterpriseapn-csp) +- [EnterpriseDesktopAppManagement CSP](/windows/client-management/mdm/enterprisedesktopappmanagement-csp) +- [EnterpriseModernAppManagement CSP](/windows/client-management/mdm/enterprisemodernappmanagement-csp) +- [NAP CSP](/windows/client-management/mdm/nap-csp) +- [PassportForWork CSP](/windows/client-management/mdm/passportforwork-csp) +- [Provisioning CSP](/windows/client-management/mdm/provisioning-csp) +- [SecureAssessment CSP](/windows/client-management/mdm/secureassessment-csp) +- [VPN CSP](/windows/client-management/mdm/vpn-csp) +- [VPNv2 CSP](/windows/client-management/mdm/vpnv2-csp) +- [WiFi CSP](/windows/client-management/mdm/wifi-csp) diff --git a/windows/configuration/provisioning-packages/toc.yml b/windows/configuration/provisioning-packages/toc.yml new file mode 100644 index 0000000000..2e5266898d --- /dev/null +++ b/windows/configuration/provisioning-packages/toc.yml @@ -0,0 +1,35 @@ +items: + - name: Overview + href: provisioning-packages.md + - name: How provisioning works + href: provisioning-how-it-works.md + - name: Quickstarts + items: + - name: Install Windows Configuration Designer + href: provisioning-install-icd.md + - name: Create a provisioning package (desktop wizard) + href: provision-pcs-for-initial-deployment.md + - name: Create a provisioning package (advanced) + href: provisioning-create-package.md + - name: Apply a provisioning package + href: provisioning-apply-package.md + - name: Provision apps + items: + - name: Provision apps + href: provision-pcs-with-apps.md + - name: Use a script to install a desktop app + href: provisioning-script-to-install-app.md + - name: Create a provisioning package with multivariant settings + href: provisioning-multivariant.md + - name: Diagnose provisioning packages + href: diagnose-provisioning-packages.md + - name: Settings changed when you uninstall a provisioning package + href: provisioning-uninstall-package.md + - name: Reference + items: + - name: Introduction to configuration service providers (CSPs) + href: how-it-pros-can-use-configuration-service-providers.md + - name: Windows Configuration Designer command-line interface + href: provisioning-command-line.md + - name: PowerShell cmdlets for provisioning Windows client + href: provisioning-powershell.md \ No newline at end of file diff --git a/windows/configuration/screenshot1.png b/windows/configuration/screenshot1.png deleted file mode 100644 index ed62740e92..0000000000 Binary files a/windows/configuration/screenshot1.png and /dev/null differ diff --git a/windows/configuration/screenshot10.png b/windows/configuration/screenshot10.png deleted file mode 100644 index 5cb1567235..0000000000 Binary files a/windows/configuration/screenshot10.png and /dev/null differ diff --git a/windows/configuration/screenshot12.png b/windows/configuration/screenshot12.png deleted file mode 100644 index cd85d80c7e..0000000000 Binary files a/windows/configuration/screenshot12.png and /dev/null differ diff --git a/windows/configuration/screenshot3.png b/windows/configuration/screenshot3.png deleted file mode 100644 index 07e01661c5..0000000000 Binary files a/windows/configuration/screenshot3.png and /dev/null differ diff --git a/windows/configuration/screenshot4.png b/windows/configuration/screenshot4.png deleted file mode 100644 index ab1f083c71..0000000000 Binary files a/windows/configuration/screenshot4.png and /dev/null differ diff --git a/windows/configuration/screenshot5.png b/windows/configuration/screenshot5.png deleted file mode 100644 index 0ec6fda3a7..0000000000 Binary files a/windows/configuration/screenshot5.png and /dev/null differ diff --git a/windows/configuration/screenshot6.png b/windows/configuration/screenshot6.png deleted file mode 100644 index 2f3284ee77..0000000000 Binary files a/windows/configuration/screenshot6.png and /dev/null differ diff --git a/windows/configuration/screenshot7.png b/windows/configuration/screenshot7.png deleted file mode 100644 index e3d80a3ac9..0000000000 Binary files a/windows/configuration/screenshot7.png and /dev/null differ diff --git a/windows/configuration/screenshot8.png b/windows/configuration/screenshot8.png deleted file mode 100644 index f85eaffdff..0000000000 Binary files a/windows/configuration/screenshot8.png and /dev/null differ diff --git a/windows/configuration/screenshot9.png b/windows/configuration/screenshot9.png deleted file mode 100644 index f617991a63..0000000000 Binary files a/windows/configuration/screenshot9.png and /dev/null differ diff --git a/windows/configuration/setup-digital-signage.md b/windows/configuration/setup-digital-signage.md deleted file mode 100644 index b5761ada29..0000000000 --- a/windows/configuration/setup-digital-signage.md +++ /dev/null @@ -1,77 +0,0 @@ ---- -title: Set up digital signs on Windows 10/11 -description: A single-use device such as a digital sign is easy to set up in Windows 10 and Windows 11 (Pro, Enterprise, and Education). -ms.reviewer: sybruckm -manager: aaroncz -ms.author: lizlong -ms.prod: windows-client -author: lizgt2000 -ms.localizationpriority: medium -ms.date: 09/20/2021 -ms.topic: article -ms.technology: itpro-configure ---- - -# Set up digital signs on Windows 10/11 - -**Applies to** - -- Windows 10 Pro, Enterprise, and Education -- Windows 11 - -Digital signage can be a useful and exciting business tool. Use digital signs to showcase your products and services, to display testimonials, or to advertise promotions and campaigns. A digital sign can be a static display, such as a building directory or menu, or it can be dynamic, such as repeating videos or a social media feed. - -For digital signage, simply select a digital sign player as your kiosk app. You can also use [Microsoft Edge in kiosk mode](/microsoft-edge/deploy/microsoft-edge-kiosk-mode-deploy) or the Kiosk Browser app, and configure it to show your online content. - ->[!TIP] ->Kiosk Browser can also be used in [single-app kiosks](kiosk-single-app.md) and [multi-app kiosk](lock-down-windows-10-to-specific-apps.md) as a web browser. For more information, see [Guidelines for web browsers](guidelines-for-assigned-access-app.md#guidelines-for-web-browsers). - -Kiosk Browser must be downloaded for offline licensing using Microsoft Store for Business. You can deploy Kiosk Browser to devices running Windows 11, and Windows 10 version 1803+. - ->[!NOTE] ->If you haven't set up your Microsoft Store for Business yet, check out [the prerequisites](/microsoft-store/prerequisites-microsoft-store-for-business) and then [sign up](/microsoft-store/sign-up-microsoft-store-for-business). - -This procedure explains how to configure digital signage using Kiosk Browser on a device running Windows client that has already been set up (completed the first-run experience). - -1. [Get **Kiosk Browser** in Microsoft Store for Business with offline, unencoded license type.](/microsoft-store/acquire-apps-microsoft-store-for-business#acquire-apps) -2. [Download the **Kiosk Browser** package, license file, and all required frameworks.](/microsoft-store/distribute-offline-apps#download-an-offline-licensed-app) -2. [Install Windows Configuration Designer.](~/provisioning-packages/provisioning-install-icd.md) -3. Open Windows Configuration Designer and select **Provision kiosk devices**. -4. Enter a friendly name for the project, and select **Finish**. -5. On **Set up device**, select **Disabled**, and select **Next**. -6. On **Set up network**, enable network setup: - - Toggle **On** wireless network connectivity. - - Enter the SSID, the network type (**Open** or **WPA2-Personal**), and (if **WPA2-Personal**) the password for the wireless network. -7. On **Account management**, select **Disabled**, and select **Next**. -8. On **Add applications**, select **Add an application**: - - For **Application name**, enter `Kiosk Browser`. - - For **Installer path**, browse to and select the AppxBundle that you downloaded from Microsoft Store for Business. After you select the package, additional fields are displayed. - - For **License file path**, browse to and select the XML license file that you downloaded from Microsoft Store for Business. - - The **Package family name** is populated automatically. - - Select **Next**. -9. On **Add certificates**, select **Next**. -10. On **Configure kiosk account and app**, toggle **Yes** to create a local user account for your digital signage: - - Enter a user name and password, and toggle **Auto sign-in** to **Yes**. - - Under **Configure the kiosk mode app**, enter the user name for the account that you're creating. - - For **App type**, select **Universal Windows App**. - - In **Enter the AUMID for the app**, enter `Microsoft.KioskBrowser_8wekyb3d8bbwe!App`. -11. In the bottom left corner of Windows Configuration Designer, select **Switch to advanced editor**. -12. Go to **Runtime settings** > **Policies** > **KioskBrowser**. Let's assume that the URL for your digital signage content is contoso.com/menu: - - In **BlockedUrlExceptions**, enter `https://www.contoso.com/menu`. - - In **BlockedUrl**, enter `*`. - - In **DefaultUrl**, enter `https://www.contoso.com/menu`. - - Set **EnableEndSessionButton**, **EnableHomeButton**, and **EnableNavigationButtons** to **No**. - - >[!TIP] - >For more information on kiosk browser settings, see [Guidelines for web browsers](guidelines-for-assigned-access-app.md#guidelines-for-web-browsers). - -13. On the **File** menu, select **Save**, and select **OK** in the **Keep your info secure** dialog box. -14. On the **Export** menu, select **Provisioning package**. -15. Change the **Owner** to **IT Admin**, and select **Next**. -16. On **Select security details for the provisioning package**, select **Next**. -17. On **Select where to save the provisioning package**, select **Next**. -18. On **Build the provisioning package**, select **Build**. -19. On the **All done!** screen, click the **Output location**. -20. Copy the .ppkg file to a USB drive. -21. Attach the USB drive to the device that you want to use for your digital sign. -22. Go to **Settings** > **Accounts** > **Access work or school** > **Add or remove a provisioning package** > **Add a package**, and select the package on the USB drive. diff --git a/windows/configuration/images/shared-pc-intune.png b/windows/configuration/shared-pc/images/shared-pc-intune.png similarity index 100% rename from windows/configuration/images/shared-pc-intune.png rename to windows/configuration/shared-pc/images/shared-pc-intune.png diff --git a/windows/configuration/images/shared-pc-wcd.png b/windows/configuration/shared-pc/images/shared-pc-wcd.png similarity index 100% rename from windows/configuration/images/shared-pc-wcd.png rename to windows/configuration/shared-pc/images/shared-pc-wcd.png diff --git a/windows/configuration/images/sharedpc-guest-win11.png b/windows/configuration/shared-pc/images/sharedpc-guest-win11.png similarity index 100% rename from windows/configuration/images/sharedpc-guest-win11.png rename to windows/configuration/shared-pc/images/sharedpc-guest-win11.png diff --git a/windows/configuration/images/sharedpc-kiosk-win11se.png b/windows/configuration/shared-pc/images/sharedpc-kiosk-win11se.png similarity index 100% rename from windows/configuration/images/sharedpc-kiosk-win11se.png rename to windows/configuration/shared-pc/images/sharedpc-kiosk-win11se.png diff --git a/windows/configuration/set-up-shared-or-guest-pc.md b/windows/configuration/shared-pc/set-up-shared-or-guest-pc.md similarity index 92% rename from windows/configuration/set-up-shared-or-guest-pc.md rename to windows/configuration/shared-pc/set-up-shared-or-guest-pc.md index 37d205a15f..7513c63f7b 100644 --- a/windows/configuration/set-up-shared-or-guest-pc.md +++ b/windows/configuration/shared-pc/set-up-shared-or-guest-pc.md @@ -1,19 +1,11 @@ --- -title: Set up a shared or guest Windows device +title: Configure a shared or guest Windows device description: Description of how to configured Shared PC mode, which is a Windows feature that optimizes devices for shared use scenarios. ms.date: 11/08/2023 -ms.prod: windows-client -ms.technology: itpro-configure ms.topic: how-to -author: paolomatarazzo -ms.author: paoloma -appliesto: - - ✅ Windows 10 - - ✅ Windows 11 - - ✅ Windows 11 SE --- -# Set up a shared or guest Windows device +# Configure a shared or guest Windows device **Shared PC** offers options to facilitate the management and optimization of shared devices. The customizations offered by Shared PC are listed in the following table. @@ -33,17 +25,19 @@ Shared PC can be configured using the following methods: Follow the instructions below to configure your devices, selecting the option that best suits your needs. -#### [:::image type="icon" source="images/icons/intune.svg"::: **Intune**](#tab/intune) +#### [:::image type="icon" source="../images/icons/intune.svg"::: **Intune**](#tab/intune) + + To configure devices using Microsoft Intune, [create a **Settings catalog** policy][MEM-2], and use the settings listed under the category **`Shared PC`**: -:::image type="content" source="./images/shared-pc-intune.png" alt-text="Screenshot that shows the Shared PC policies in the Intune settings catalog." lightbox="./images/shared-pc-intune.png" border="True"::: +:::image type="content" source="images/shared-pc-intune.png" alt-text="Screenshot that shows the Shared PC policies in the Intune settings catalog." lightbox="images/shared-pc-intune.png" border="True"::: Assign the policy to a security group that contains as members the devices or users that you want to configure. Alternatively, you can configure devices using a [custom policy][MEM-1] with the [SharedPC CSP][WIN-3]. -#### [:::image type="icon" source="images/icons/provisioning-package.svg"::: **PPKG**](#tab/ppkg) +#### [:::image type="icon" source="../images/icons/provisioning-package.svg"::: **PPKG**](#tab/ppkg) To configure devices using a provisioning package, [create a provisioning package][WIN-1] using WCD, and use the settings listed under the category **`SharedPC`**: @@ -53,7 +47,7 @@ For a list and description of CSP settings exposed in Windows Configuration Desi Follow the steps in [Apply a provisioning package][WIN-2] to apply the package that you created. -#### [:::image type="icon" source="images/icons/powershell.svg"::: **PowerShell**](#tab/powershell) +#### [:::image type="icon" source="../images/icons/powershell.svg"::: **PowerShell**](#tab/powershell) To configure devices using a PowerShell script, you can use the [MDM Bridge WMI Provider][WIN-6]. @@ -111,8 +105,10 @@ For more information, see [Using PowerShell scripting with the WMI Bridge Provid $adminName = "LocalAdmin" $adminPass = 'Pa$$word123' invoke-expression "net user /add $adminName $adminPass" - $user = New-Object System.Security.Principal.NTAccount($adminName) - $sid = $user.Translate([System.Security.Principal.SecurityIdentifier]) + $user = New-Object System.Security.Principal.NTAccount($adminName) + + $sid = $user.Translate([System.Security.Principal.SecurityIdentifier]) + $sid = $sid.Value; New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\SharedPC\Exemptions\$sid" -Force ``` @@ -120,6 +116,7 @@ For more information, see [Using PowerShell scripting with the WMI Bridge Provid ## Troubleshooting Shared PC To troubleshoot Shared PC, you can use the following tools: + - Check the log `C:\Windows\SharedPCSetup.log` - Check the registry keys under `HKLM\Software\Microsoft\Windows\CurrentVersion\SharedPC` - `AccountManagement` key contains settings on how profiles are managed @@ -131,7 +128,7 @@ To troubleshoot Shared PC, you can use the following tools: - For a list of settings exposed by the SharedPC configuration service provider, see [SharedPC CSP][WIN-3]. - For a list of settings exposed by Windows Configuration Designer, see [SharedPC CSP][WIN-4]. ------------ + [WIN-1]: /windows/configuration/provisioning-packages/provisioning-create-package [WIN-2]: /windows/configuration/provisioning-packages/provisioning-apply-package diff --git a/windows/configuration/shared-devices-concepts.md b/windows/configuration/shared-pc/shared-devices-concepts.md similarity index 95% rename from windows/configuration/shared-devices-concepts.md rename to windows/configuration/shared-pc/shared-devices-concepts.md index 2fdab61b30..fdb4b3ed52 100644 --- a/windows/configuration/shared-devices-concepts.md +++ b/windows/configuration/shared-pc/shared-devices-concepts.md @@ -1,14 +1,8 @@ --- title: Manage multi-user and guest Windows devices description: options to optimize Windows devices used in shared scenarios, such touchdown spaces in an enterprise, temporary customer use in retail or shared devices in a school. -ms.date: 11/08/2023 +ms.date: 02/06/2024 ms.topic: concept-article -author: paolomatarazzo -ms.author: paoloma -appliesto: - - ✅ Windows 10 - - ✅ Windows 11 - - ✅ Windows 11 SE --- # Manage multi-user and guest Windows devices with Shared PC diff --git a/windows/configuration/shared-pc-technical.md b/windows/configuration/shared-pc/shared-pc-technical.md similarity index 90% rename from windows/configuration/shared-pc-technical.md rename to windows/configuration/shared-pc/shared-pc-technical.md index 652336403e..62edc9d451 100644 --- a/windows/configuration/shared-pc-technical.md +++ b/windows/configuration/shared-pc/shared-pc-technical.md @@ -1,14 +1,8 @@ --- title: Shared PC technical reference description: List of policies and settings applied by the Shared PC options. -ms.date: 11/08/2023 +ms.date: 02/06/2024 ms.topic: reference -author: paolomatarazzo -ms.author: paoloma -appliesto: - - ✅ Windows 10 - - ✅ Windows 11 - - ✅ Windows 11 SE --- # Shared PC technical reference @@ -50,8 +44,8 @@ When enabling Shared PC mode, the following settings in the local GPO are config | Windows Components/Windows Hello for Business/Use Windows Hello for Business | Disabled | | Windows Components/Windows Logon Options/Sign-in and lock last interactive user automatically after a restart | Disabled | -| Extra registry setting | Status | -|-------------------------------------------------------------------------------------------------------------------|----------| +| Extra registry setting | Status | +|--|--| | Software\Policies\Microsoft\PassportForWork\Remote\Enabled (Phone sign-in/Use phone sign-in) | 0 | | Software\Policies\Microsoft\Windows\PreviewBuilds\AllowBuildPreview () | 0 | @@ -69,7 +63,7 @@ By enabling SetEDUPolicy, the following settings in the local GPO are configured By enabling SetPowerPolicies, the following settings in the local GPO are configured: -| Policy setting | Status| +| Policy setting | Status | |--|--| | System/Power Management/Button Settings/Select the lid switch action (on battery) | Enabled > Sleep | | System/Power Management/Button Settings/Select the lid switch action (plugged in) | Enabled > Sleep | @@ -89,17 +83,17 @@ By enabling SetPowerPolicies, the following settings in the local GPO are config By enabling MaintenanceStartTime, the following settings in the local GPO are configured: -| Policy setting | Status| -|--------------------------------------------------------------------------------------|--------------------------------| +| Policy setting | Status | +|--|--| | Windows Components/Maintenance Scheduler/Automatic Maintenance Activation Boundary | 2000-01-01T00:00:00 (midnight) | -| Windows Components/Maintenance Scheduler/Automatic Maintenance Random Delay | Enabled PT2H (2 hours) | -| Windows Components/Maintenance Scheduler/Automatic Maintenance WakeUp Policy | Enabled | +| Windows Components/Maintenance Scheduler/Automatic Maintenance Random Delay | Enabled PT2H (2 hours) | +| Windows Components/Maintenance Scheduler/Automatic Maintenance WakeUp Policy | Enabled | ## SignInOnResume By enabling SignInOnResume, the following settings in the local GPO are configured: -| Policy setting | Status| +| Policy setting | Status | |--|--| | System/Logon/Allow users to select when a password is required when resuming from connected standby | Disabled | | System/Power Management/Sleep Settings/Require a password when a computer wakes (on battery) | Enabled | @@ -111,13 +105,13 @@ By enabling Enableaccountmanager, the following schedule task is turned on: `\Mi ## Shared PC APIs and app behavior -Applications can take advantage of Shared PC mode with the following three APIs: +Applications can take advantage of Shared PC mode with the following three APIs: -- [**IsEnabled**][API-1] - This API informs applications when the device is configured for shared use scenarios. For example, an app might only download content on demand on a device in shared PC mode, or might skip first run experiences. -- [**ShouldAvoidLocalStorage**][API-2] - This API informs applications when the PC has been configured to not allow the user to save to the local storage of the PC. Instead, only cloud save locations should be offered by the app or saved automatically by the app. -- [**IsEducationEnvironment**][API-3] - This API informs applications when the PC is used in an education environment. Apps may want to handle diagnostic data differently or hide advertising functionality. +- [**IsEnabled**][API-1] - This API informs applications when the device is configured for shared use scenarios. For example, an app might only download content on demand on a device in shared PC mode, or might skip first run experiences +- [**ShouldAvoidLocalStorage**][API-2] - This API informs applications when the PC has been configured to not allow the user to save to the local storage of the PC. Instead, only cloud save locations should be offered by the app or saved automatically by the app +- [**IsEducationEnvironment**][API-3] - This API informs applications when the PC is used in an education environment. Apps may want to handle diagnostic data differently or hide advertising functionality ------------ + [API-1]: /uwp/api/windows.system.profile.sharedmodesettings.isenabled [API-2]: /uwp/api/windows.system.profile.sharedmodesettings.shouldavoidlocalstorage diff --git a/windows/configuration/shared-pc/toc.yml b/windows/configuration/shared-pc/toc.yml new file mode 100644 index 0000000000..87e0ba65f6 --- /dev/null +++ b/windows/configuration/shared-pc/toc.yml @@ -0,0 +1,7 @@ +items: +- name: Shared devices concepts + href: shared-devices-concepts.md +- name: Configure shared devices with Shared PC + href: set-up-shared-or-guest-pc.md +- name: Shared PC technical reference + href: shared-pc-technical.md \ No newline at end of file diff --git a/windows/configuration/start-layout-xml-desktop.md b/windows/configuration/start-layout-xml-desktop.md deleted file mode 100644 index be361db92b..0000000000 --- a/windows/configuration/start-layout-xml-desktop.md +++ /dev/null @@ -1,534 +0,0 @@ ---- -title: Start layout XML for desktop editions of Windows 10 (Windows 10) -description: This article describes the options for customizing Start layout in LayoutModification.xml for Windows 10 desktop editions. -ms.prod: windows-client -author: lizgt2000 -ms.author: lizlong -ms.topic: article -ms.date: 10/02/2018 -ms.reviewer: -manager: aaroncz -ms.localizationpriority: medium -ms.technology: itpro-configure ---- - -# Start layout XML for desktop editions of Windows 10 (reference) - - -**Applies to** - -- Windows 10 - ->**Looking for consumer information?** See [Customize the Start menu](https://go.microsoft.com/fwlink/p/?LinkId=623630) - -On Windows 10 for desktop editions, the customized Start works by: - -- Windows 10 checks the chosen base default layout, such as the desktop edition and whether Cortana is supported for the country/region. - -- Windows 10 reads the LayoutModification.xml file and allows groups to be appended to Start. The groups have the following constraints: - - Two groups that are six columns wide, or equivalent to the width of three medium tiles. - - Two medium-sized tile rows in height. Windows 10 ignores any tiles that are pinned beyond the second row. - - No limit to the number of apps that can be pinned. There's a theoretical limit of 24 tiles per group (four small tiles per medium square x 3 columns x 2 rows). - ->[!NOTE] ->To use the layout modification XML to configure Start with roaming user profiles, see [Deploying Roaming User Profiles](/windows-server/storage/folder-redirection/deploy-roaming-user-profiles#step-7-optionally-specify-a-start-layout-for-windows-10-pcs). - - - -## LayoutModification XML - -IT admins can provision the Start layout using a LayoutModification.xml file. This file supports several mechanisms to modify or replace the default Start layout and its tiles. The easiest method for creating a LayoutModification.xml file is by using the Export-StartLayout cmdlet; see [Customize and export Start layout](customize-and-export-start-layout.md) for instructions. - -### Required order - -The XML schema for `LayoutModification.xml` requires the following order for tags directly under the LayoutModificationTemplate node: - -1. LayoutOptions -1. DefaultLayoutOverride -1. RequiredStartGroupsCollection -1. AppendDownloadOfficeTile –OR– AppendOfficeSuite (only one Office option can be used at a time) -1. AppendOfficeSuiteChoice -1. TopMFUApps -1. CustomTaskbarLayoutCollection -1. InkWorkspaceTopApps -1. StartLayoutCollection - -Comments are not supported in the `LayoutModification.xml` file. - - -### Supported elements and attributes - ->[!NOTE] ->To make sure the Start layout XML parser processes your file correctly, follow these guidelines when working with your LayoutModification.xml file: ->- Do not leave spaces or white lines in between each element. ->- Do not add comments inside the StartLayout node or any of its children elements. ->- Do not add multiple rows of comments. - -The following table lists the supported elements and attributes for the LayoutModification.xml file. -> [!NOTE] -> RequiredStartGroupsCollection and AppendGroup syntax only apply when the Import-StartLayout method is used for building and deploying Windows images. - -| Element | Attributes | Description | -| --- | --- | --- | -| LayoutModificationTemplate | xmlns
                        xmlns:defaultlayout
                        xmlns:start
                        Version | Use to describe the changes to the default Start layout | -| [LayoutOptions](#layoutoptions)

                        Parent:
                        LayoutModificationTemplate | StartTileGroupsColumnCount
                        FullScreenStart | Use to specify:
                        - Whether to use full screen Start on the desktop
                        - The number of tile columns in the Start menu | -| RequiredStartGroupsCollection

                        Parent:
                        LayoutModificationTemplate | n/a | Use to contain collection of RequiredStartGroups | -| [RequiredStartGroups](#requiredstartgroups)

                        Parent:
                        RequiredStartGroupsCollection | Region | Use to contain the AppendGroup tags, which represent groups that can be appended to the default Start layout | -| [AppendGroup](#appendgroup)

                        Parent:
                        RequiredStartGroups | Name | Use to specify the tiles that need to be appended to the default Start layout | -| [start:Tile](#specify-start-tiles)

                        Parent:
                        AppendGroup | AppUserModelID
                        Size
                        Row
                        Column | Use to specify any of the following:
                        - A Universal Windows app
                        - A Windows 8 or Windows 8.1 app

                        Note that AppUserModelID is case-sensitive. | -| start:Folder

                        Parent:
                        start:Group | Name (in Windows 10, version 1809 and later only)
                        Size
                        Row
                        Column
                        LocalizedNameResourcetag | Use to specify a folder of icons; can include [Tile](#start-tile), [SecondaryTile](#start-secondarytile), and [DesktopApplicationTile](#start-desktopapplicationtile). | -| start:DesktopApplicationTile

                        Parent:
                        AppendGroup | DesktopApplicationID
                        DesktopApplicationLinkPath
                        Size
                        Row
                        Column | Use to specify any of the following:
                        - A Windows desktop application with a known AppUserModelID
                        - An application in a known folder with a link in a legacy Start Menu folder
                        - A Windows desktop application link in a legacy Start Menu folder
                        - A Web link tile with an associated `.url` file that is in a legacy Start Menu folder | -| start:SecondaryTile

                        Parent:
                        AppendGroup | AppUserModelID
                        TileID
                        Arguments
                        DisplayName
                        Square150x150LogoUri
                        ShowNameOnSquare150x150Logo
                        ShowNameOnWide310x150Logo
                        Wide310x150LogoUri
                        BackgroundColor
                        ForegroundText
                        IsSuggestedApp
                        Size
                        Row
                        Column | Use to pin a Web link through a Microsoft Edge secondary tile. Note that AppUserModelID is case-sensitive. | -| TopMFUApps

                        Parent:
                        LayoutModificationTemplate | n/a | Use to add up to three default apps to the frequently used apps section in the system area.

                        **Note**: Only applies to versions of Windows 10 earlier than version 1709. In Windows 10, version 1709, you can no longer pin apps to the Most Frequently Used apps list in Start. | -| Tile

                        Parent:
                        TopMFUApps | AppUserModelID | Use with the TopMFUApps tags to specify an app with a known AppUserModelID.

                        **Note**: Only applies to versions of Windows 10 earlier than version 1709. In Windows 10, version 1709, you can no longer pin apps to the Most Frequently Used apps list in Start. | -| DesktopApplicationTile

                        Parent:
                        TopMFUApps | LinkFilePath | Use with the TopMFUApps tags to specify an app without a known AppUserModelID.

                        **Note**: Only applies to versions of Windows 10 earlier than version 1709. In Windows 10, version 1709, you can no longer pin apps to the Most Frequently Used apps list in Start. | -| AppendOfficeSuite

                        Parent:
                        LayoutModificationTemplate | n/a | Use to add the in-box installed Office suite to Start. For more information, see [Customize the Office suite of tiles](/windows-hardware/customize/desktop/customize-start-layout#customize-the-office-suite-of-tiles).

                        Don't use this tag with AppendDownloadOfficeTile. | -| AppendDownloadOfficeTile

                        Parent:
                        LayoutModificationTemplate | n/a | Use to add a specific **Download Office** tile to a specific location in Start

                        Do not use this tag with AppendOfficeSuite | - -### LayoutOptions - -New devices running Windows 10 for desktop editions will default to a Start menu with two columns of tiles unless boot to tablet mode is enabled. Devices with screens that are under 10" have boot to tablet mode enabled by default. For these devices, users see the full screen Start on the desktop. You can adjust the following features: - -- Boot to tablet mode can be set on or off. -- Set full screen Start on desktop to on or off. - To do this, add the LayoutOptions element in your LayoutModification.xml file and set the FullScreenStart attribute to true or false. -- Specify the number of columns in the Start menu to 1 or 2. - To do this, add the LayoutOptions element in your LayoutModification.xml file and set the StartTileGroupsColumnCount attribute to 1 or 2. - -The following example shows how to use the LayoutOptions element to specify full screen Start on the desktop and to use one column in the Start menu: - -```XML - - - -``` - -For devices being upgraded to Windows 10 for desktop editions: - -- Devices being upgraded from Windows 7 will default to a Start menu with one column. -- Devices being upgraded from Windows 8.1 or Windows 8.1 Upgrade will default to a Start menu with two columns. - -### RequiredStartGroups - -The **RequiredStartGroups** tag contains **AppendGroup** tags that represent groups that you can append to the default Start layout. - ->[!IMPORTANT] ->For Windows 10 for desktop editions, you can add a maximum of two (2) **AppendGroup** tags per **RequiredStartGroups** tag. - -You can also assign regions to the append groups in the **RequiredStartGroups** tag's using the optional **Region** attribute or you can use the multivariant capabilities in Windows provisioning. If you're using the **Region** attribute, you must use a two-letter country code to specify the country/region that the append group(s) apply to. To specify more than one country/region, use a pipe ("|") delimiter as shown in the following example: - -```XML - -``` - -If the country/region setting for the Windows device matches a **RequiredStartGroups**, then the tiles laid out within the **RequiredStartGroups** is applied to Start. - -If you specify a region-agnostic **RequiredStartGroups** (or one without the optional Region attribute), then the region-agnostic **RequiredStartGroups** is applied to Start. - -### AppendGroup - -**AppendGroup** tags specify a group of tiles that will be appended to Start. There is a maximum of two **AppendGroup** tags allowed per **RequiredStartGroups** tag. - -For Windows 10 for desktop editions, AppendGroup tags contain start:Tile, start:DesktopApplicationTile, or start:SecondaryTile tags. - -You can specify any number of tiles in an **AppendGroup**, but you can't specify a tile with a **Row** attribute greater than 4. The Start layout doesn't support overlapping tiles. - -### Specify Start tiles - -To pin tiles to Start, partners must use the right tile depending on what you want to pin. - -#### Tile size and coordinates - -All tile types require a size (**Size**) and coordinates (**Row** and **Column**) attributes regardless of the tile type that you use when prepinning items to Start. - -The following table describes the attributes that you must use to specify the size and location for the tile. - -| Attribute | Description | -| --- | --- | -| Size | Determines how large the tile will be.

                        - 1x1 - small tile
                        - 2x2 - medium tile
                        - 4x2 - wide tile
                        - 4x4 - large tile | -| Row | Specifies the row where the tile will appear. | -| Column | Specifies the column where the tile will appear. | - -For example, a tile with Size="2x2", Row="2", and Column="2" results in a tile located at (2,2) where (0,0) is the top-left corner of a group. - - -#### start:Tile - -You can use the **start:Tile** tag to pin any of the following apps to Start: - -- A Universal Windows app -- A Windows 8 app or Windows 8.1 app - -To specify any one of these apps, you must set the **AppUserModelID** attribute to the application user model ID that's associated with the corresponding app. - ->[!IMPORTANT] ->**AppUserModelID** (AUMID) is case-sensitive. - -The following example shows how to pin the Microsoft Edge Universal Windows app: - - ```XML - - ``` - - -#### start:DesktopApplicationTile - -You can use the **start:DesktopApplicationTile** tag to pin a Windows desktop application to Start. There are two ways you can specify a Windows desktop application: - -- Use a path to a shortcut link (.lnk file) to a Windows desktop application. - - >[!NOTE] - >In Start layouts for Windows 10, version 1703, you should use **DesktopApplicationID** rather than **DesktopApplicationLinkPath** if you are using Group Policy or MDM to apply the start layout and the application was installed after the user's first sign-in. - - To pin a Windows desktop application through this method, you must first add the .lnk file in the specified location when the device first boots. - - The following example shows how to pin the Command Prompt: - - ```XML - - ``` - - You must set the **DesktopApplicationLinkPath** attribute to the .lnk file that points to the Windows desktop application. The path also supports environment variables. - - If you are pointing to a third-party Windows desktop application and the layout is being applied before the first boot, you must put the .lnk file in a legacy Start Menu directory before first boot; for example, "%APPDATA%\Microsoft\Windows\Start Menu\Programs\" or the all users profile "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\". - -- Use the application's application user model ID, if this is known. If the Windows desktop application doesn't have one, use the shortcut link option. - - - You can use the [Get-StartApps cmdlet](/powershell/module/startlayout/get-startapps) on a PC that has the application pinned to Start to obtain the app ID. - - To pin a Windows desktop application through this method, you must set the **DesktopApplicationID** attribute to the application user model ID that's associated with the corresponding app. - - The following example shows how to pin the File Explorer Windows desktop application: - - ```XML - - ``` - - -You can also use the **start:DesktopApplicationTile** tag as one of the methods for pinning a Web link to Start. The other method is to use a Microsoft Edge secondary tile. - -To pin a legacy `.url` shortcut to Start, you must create a `.url` file (right-click on the desktop, select **New** > **Shortcut**, and then type a Web URL). You must add this `.url` file in a legacy Start Menu directory before first boot; for example, `%APPDATA%\Microsoft\Windows\Start Menu\Programs\` or the all users profile `%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\`. - -The following example shows how to create a tile of the Web site's URL, which you can treat similarly to a Windows desktop application tile: - -```XML - -``` - ->[!NOTE] ->In Windows 10, version 1703, **Export-StartLayout** will use **DesktopApplicationLinkPath** for the .url shortcut. You must change **DesktopApplicationLinkPath** to **DesktopApplicationID** and provide the URL. - - -#### start:SecondaryTile - -You can use the **start:SecondaryTile** tag to pin a Web link through a Microsoft Edge secondary tile. This method doesn't require any additional action compared to the method of using legacy `.url` shortcuts (through the start:DesktopApplicationTile tag). - -The following example shows how to create a tile of the Web site's URL using the Microsoft Edge secondary tile: - -```XML - -``` - -The following table describes the other attributes that you can use with the **start:SecondaryTile** tag in addition to **Size**, **Row**, and **Column**. - -| Attribute | Required/optional | Description | -| --- | --- | --- | -| AppUserModelID | Required | Must point to Microsoft Edge. Note that AppUserModelID is case-sensitive. | -| TileID | Required | Must uniquely identify your Web site tile. | -| Arguments | Required | Must contain the URL of your Web site. | -| DisplayName | Required | Must specify the text that you want users to see. | -| Square150x150LogoUri | Required | Specifies the logo to use on the 2x2 tile. | -| Wide310x150LogoUri | Optional | Specifies the logo to use on the 4x2 tile. | -| ShowNameOnSquare150x150Logo | Optional | Specifies whether the display name is shown on the 2x2 tile. The values you can use for this attribute are true or false. | -| ShowNameOnWide310x150Logo | Optional | Specifies whether the display name is shown on the 4x2 tile. The values you can use for this attribute are true or false. | -| BackgroundColor | Optional | Specifies the color of the tile. You can specify the value in ARGB hexadecimal (for example, #FF112233) or specify "transparent". | -| ForegroundText | Optional | Specifies the color of the foreground text. Set the value to either "light" or "dark". | - -Secondary Microsoft Edge tiles have the same size and location behavior as a Universal Windows app, Windows 8 app, or Windows 8.1 app. - -#### TopMFUApps - ->[!NOTE] ->Only applies to versions of Windows 10 earlier than version 1709. In Windows 10, version 1709, you can no longer pin apps to the Most Frequently Used apps list in Start. - -You can use the **TopMFUApps** tag to add up to 3 default apps to the frequently used apps section in the system area, which delivers system-driven lists to the user including important or frequently accessed system locations and recently installed apps. - -You can use this tag to add: - -- Apps with an **AppUserModelID** attribute - This includes Windows desktop applications that have a known application user model ID. Use a **Tile** tag with the **AppUserModelID** attribute set to the app's application user model ID. -- Apps without a **AppUserModelID** attribute - For these apps, you must create a .lnk file that points to the installed app and place the .lnk file in the `%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs` directory. Use a **DesktopApplicationTile** tag with the **LinkFilePath** attribute set to the .lnk file name and path. - -The following example shows how to modify your LayoutModification.xml file to add both kinds of apps to the system area in Start: - - ```XML - - - - - - - -``` - -#### AppendOfficeSuite - -You can use the **AppendOfficeSuite** tag to add the in-box installed Office suite of apps to Start. - ->[!NOTE] ->The OEM must have installed Office for this tag to work. - -The following example shows how to add the **AppendOfficeSuite** tag to your LayoutModification.xml file to append the full Universal Office suite to Start: - -```XML - - - -``` - -#### AppendOfficeSuiteChoice - -This tag is added in Windows 10, version 1803. You have two options in this tag: - -- `` -- `` - -Use `Choice=DesktopBridgeSubscription` on devices running Windows 10, version 1803, that have Office 365 preinstalled. This will set the heading of the Office suite of tiles to **Office 365**, to highlight the Office 365 apps that you've made available on the device. - -Use `Choice=DesktopBridge` on devices running versions of Windows 10 earlier than version 1803, and on devices shipping with [perpetual licenses for Office](/archive/blogs/ausoemteam/choosing-the-right-office-version-for-your-customers). This will set the heading of the Office suite of tiles to **Create**. - -For more information, see [Customize the Office suite of tiles](/windows-hardware/customize/desktop/customize-start-layout#customize-the-office-suite-of-tiles). - - -#### AppendDownloadOfficeTile - -You can use the **AppendDownloadOfficeTile** tag to append the Office trial installer to Start. This tag adds the **Download Office** tile to Start and the download tile will appear at the bottom right-hand side of the second group. - ->[!NOTE] ->The OEM must have installed the Office trial installer for this tag to work. - -The following example shows how to add the **AppendDownloadOfficeTile** tag to your LayoutModification.xml file: - -```XML - - - -``` - -## Sample LayoutModification.xml - -The following sample LayoutModification.xml shows how you can configure the Start layout for devices running Windows 10 for desktop editions: - -```XML - - - - - - - - - - - - - - - - - - - - - - -``` - -## Use Windows Provisioning multivariant support - -The Windows Provisioning multivariant capability allows you to declare target conditions that, when met, supply specific customizations for each variant condition. For Start customization, you can create specific layouts for each variant that you have. To do this, you must create a separate LayoutModification.xml file for each variant that you want to support and then include these in your provisioning package. For more information on how to do this, see [Create a provisioning package with multivariant settings](./provisioning-packages/provisioning-multivariant.md). - -The provisioning engine chooses the right customization file based on the target conditions that were met, adds the file in the location that's specified for the setting, and then uses the specific file to customize Start. To differentiate between layouts, you can add modifiers to the LayoutModification.xml filename such as "LayoutCustomization1". Regardless of the modifier that you use, the provisioning engine will always output "LayoutCustomization.xml" so that the operating system has a consistent file name to query against. - -For example, if you want to ensure that there's a specific layout for a certain condition, you can: -1. Create a specific layout customization file and then name it LayoutCustomization1.xml. -2. Include the file as part of your provisioning package. -3. Create your multivariant target and reference the XML file within the target condition in the main customization XML file. - -The following example shows what the overall customization file might look like with multivariant support for Start: - -```XML - - - - {6aaa4dfa-00d7-4aaa-8adf-73c6a7e2501e} - My Provisioning Package - 1.0 - OEM - 50 - - - - - - - - - - - - - - - - - 1 - 1 - 1 - - - 1 - - - - - - - - - c:\users\\appdata\local\Microsoft\Windows\Shell\LayoutCustomization1.XML - - 1 - - - - - - -``` - -When the condition is met, the provisioning engine takes the XML file and places it in the location that the operating system has set and then the Start subsystem reads the file and applies the specific customized layout. - -You must repeat this process for all variants that you want to support so that each variant can have a distinct layout for each of the conditions and targets that need to be supported. For example, if you add a **Language** condition, you can create a Start layout that has its own localized group. - -## Add the LayoutModification.xml file to the device - -Once you have created your LayoutModification.xml file to customize devices that will run Windows 10 for desktop editions, you can use Windows ICD methods to add the XML file to the device. - -1. In the **Available customizations** pane, expand **Runtime settings**, select **Start** > Select the **StartLayout** setting. -2. In the middle pane, click **Browse** to open File Explorer. -3. In the File Explorer window, navigate to the location where you saved your LayoutModification.xml file. -4. Select the file and then click **Open**. - -This should set the value of **StartLayout**. The setting appears in the **Selected customizations** pane. - ->[!NOTE] ->There is currently no way to add the .url and .lnk files through Windows ICD. - -Once you have created the LayoutModification.xml file and it is present in the device, the system overrides the base default layout and any Unattend settings used to customize Start. - - -## Related topics - -- [Manage Windows 10 Start and taskbar layout](windows-10-start-layout-options-and-policies.md) -- [Configure Windows 10 taskbar](configure-windows-10-taskbar.md) -- [Customize and export Start layout](customize-and-export-start-layout.md) -- [Add image for secondary tiles](start-secondary-tiles.md) -- [Customize Windows 10 Start and taskbar with Group Policy](customize-windows-10-start-screens-by-using-group-policy.md) -- [Customize Windows 10 Start and taskbar with provisioning packages](customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md) -- [Customize Windows 10 Start and taskbar with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md) -- [Changes to Start policies in Windows 10](changes-to-start-policies-in-windows-10.md) diff --git a/windows/configuration/start-secondary-tiles.md b/windows/configuration/start-secondary-tiles.md deleted file mode 100644 index 7600808ed5..0000000000 --- a/windows/configuration/start-secondary-tiles.md +++ /dev/null @@ -1,227 +0,0 @@ ---- -title: Add image for secondary Microsoft Edge tiles (Windows 10) -description: Add app tiles on Windows 10 that's a secondary tile. -ms.prod: windows-client -ms.localizationpriority: medium -author: lizgt2000 -ms.author: lizlong -ms.topic: article -ms.reviewer: -manager: aaroncz -ms.technology: itpro-configure -ms.date: 12/31/2017 ---- - -# Add image for secondary Microsoft Edge tiles - -**Applies to** - -- Windows 10 - -App tiles are the Start screen tiles that represent and launch an app. A tile that allows a user to go to a specific location in an app is a *secondary tile*. Some examples of secondary tiles include: - -- Weather updates for a specific city in a weather app -- A summary of upcoming events in a calendar app -- Status and updates from an important contact in a social app -- A website in Microsoft Edge - -In a Start layout for Windows 10, version 1703, you can include secondary tiles for Microsoft Edge that display a custom image, rather than a tile with the standard Microsoft Edge logo. - -Suppose that the [Start layout that you export](customize-and-export-start-layout.md) had two secondary tiles, such as in the following image: - -![tile for MSN and for a SharePoint site.](images/edge-with-logo.png) - -In prior versions of Windows 10, when you applied the Start layout to a device, the tiles would display as shown in the following image: - -![tile for MSN and for a SharePoint site with no logos.](images/edge-without-logo.png) - -In Windows 10, version 1703, by using the PowerShell cmdlet `export-StartLayoutEdgeAssets` and the policy setting `ImportEdgeAssets`, the tiles will now display the same as they did on the device from which you exported the Start layout. - -![tile for MSN and for a SharePoint site.](images/edge-with-logo.png) - -**Example of secondary tiles in XML generated by Export-StartLayout** - -```xml - -``` - - - -## Export Start layout and assets - -1. Follow the instructions in [Customize and export Start layout](customize-and-export-start-layout.md#customize-the-start-screen-on-your-test-computer) to customize the Start screen on your test computer. -2. Open Windows PowerShell as an administrator and enter the following command: - - ```powershell - Export-StartLayout -path .xml - ``` - - In the previous command, `-path` is a required parameter that specifies the path and file name for the export file. You can specify a local path or a UNC path (for example, \\\\FileServer01\\StartLayouts\\StartLayoutMarketing.xml). - - Use a file name of your choice—for example, StartLayoutMarketing.xml. Include the .xml file name extension. The [Export-StartLayout](/powershell/module/startlayout/export-startlayout) cmdlet doesn't append the file name extension, and the policy settings require the extension. - -3. If you’d like to change the image for a secondary tile to your own custom image, open the layout.xml file, and look for the images that the tile references. - - For example, your layout.xml contains `Square150x150LogoUri="ms-appdata:///local/PinnedTiles/21581260870/hires.png" Wide310x150LogoUri="ms-appx:///"` - - Open `C:\Users\\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\21581260870\` and replace those images with your customized images. - -4. In Windows PowerShell, enter the following command: - - ```powershell - Export-StartLayoutEdgeAssets assets.xml - ``` - -## Configure policy settings - -You can apply the customized Start layout with images for secondary tiles by using [mobile device management](customize-windows-10-start-screens-by-using-mobile-device-management.md) or [a provisioning package](customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md). However, because you're including the images for secondary tiles, you must configure another setting to import the Edge assets. - -### Using MDM - -In Microsoft Intune, you create a device restrictions policy to apply to device group. For other MDM solutions, you may need to use an OMA-URI setting for Start layout, based on the [Policy configuration service provider (CSP)](/windows/client-management/mdm/policy-configuration-service-provider). The OMA-URI setting is `./User/Vendor/MSFT/Policy/Config/Start/StartLayout`. - -1. Sign in to the [Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). -2. Select **Devices** > **Configuration profiles** > **Create profile**. -3. Enter the following properties: - - - **Platform**: Select **Windows 10 and later**. - - **Profile**: Select **Templates** > **Device restrictions**. - -4. Select **Create**. -5. In **Basics**, enter the following properties: - - - **Name**: Enter a descriptive name for the policy. Name your policies so you can easily identify them later. - - **Description**: Enter a description for the policy. This setting is optional, but recommended. - -6. Select **Next**. - -7. In **Configuration settings**, select **Start**. Configure the following properties: - - - **Start menu layout**: Browse to, and select your Start layout XML file. - - **Pin websites to tiles in Start menu**: Browse to, and select your assets XML file. - - There are more Start menu settings you can configure. For more information on these settings, see [Start settings in Intune](/intune/device-restrictions-windows-10#start) - -8. Select **Next**. -9. In **Scope tags** (optional), assign a tag to filter the profile to specific IT groups, such as `US-NC IT Team` or `JohnGlenn_ITDepartment`. For more information about scope tags, see [Use RBAC and scope tags for distributed IT](/mem/intune/fundamentals/scope-tags). - - Select **Next**. - -10. In **Assignments**, select the users or groups that will receive your profile. For more information on assigning profiles, see [Assign user and device profiles](/mem/intune/configuration/device-profile-assign). - - Select **Next**. - -11. In **Review + create**, review your settings. When you select **Create**, your changes are saved, and the profile is assigned. The policy is also shown in the profiles list. - -### Using a provisioning package - -#### Prepare the Start layout and Edge assets XML files - -The **export-StartLayout** and **export-StartLayoutEdgeAssets** cmdlets produce XML files. Because Windows Configuration Designer produces a customizations.xml file that contains the configuration settings, adding the Start layout and Edge assets sections to the customizations.xml file directly would result in an XML file embedded in an XML file. Before you add the Start layout and Edge assets sections to the customizations.xml file, you must replace the markup characters in your layout.xml with escape characters. - - -1. Copy the contents of layout.xml into an online tool that escapes characters. - -2. Copy the contents of assets.xml into an online tool that escapes characters. - -3. When you create a provisioning package, you'll copy the text with the escape characters and paste it in the customizations.xml file for your project. - -#### Create a provisioning package that contains a customized Start layout - - -Use the Windows Configuration Designer tool to create a provisioning package. [Learn how to install Windows Configuration Designer.](provisioning-packages/provisioning-install-icd.md) - ->[!IMPORTANT] ->When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed. - -1. Open Windows Configuration Designer (by default, %systemdrive%\\Program Files (x86)\\Windows Kits\\10\\Assessment and Deployment Kit\\Imaging and Configuration Designer\\x86\\ICD.exe). - -2. Choose **Advanced provisioning**. - -3. Name your project, and select **Next**. - -4. Choose **All Windows desktop editions** and select **Next**. - -5. On **New project**, select **Finish**. The workspace for your package opens. - -6. Expand **Runtime settings** > **Policies** > **Start**, and select **StartLayout**. - - >[!TIP] - >If **Start** is not listed, check the type of settings you selected in step 4. You must create the project using settings for **All Windows desktop editions**. - -7. Enter **layout.xml**. This value creates a placeholder in the customizations.xml file that you'll replace with the contents of the layout.xml file in a later step. - -8. In the **Available customizations** pane, select **ImportEdgeAssets**. - -9. Enter **assets.xml**. This value creates a placeholder in the customizations.xml file that you'll replace with the contents of the assets.xml file in a later step. - -10. Save your project and close Windows Configuration Designer. - -11. In File Explorer, open the project's directory. (The default location is C:\Users\\*user name*\Documents\Windows Imaging and Configuration Designer (WICD)\\*project name*) - -12. Open the customizations.xml file in a text editor. The **<Customizations>** section will look like this: - - ![Customizations file with the placeholder text to replace highlighted.](images/customization-start-edge.png) - -13. Replace **layout.xml** with the text from the layout.xml file, [with markup characters replaced with escape characters](#escape). - -14. Replace **assets.xml** with the text from the assets.xml file, [with markup characters replaced with escape characters](#escape). - -15. Save and close the customizations.xml file. - -16. Open Windows Configuration Designer and open your project. - -17. On the **File** menu, select **Save.** - -18. On the **Export** menu, select **Provisioning package**. - -19. Change **Owner** to **IT Admin**, which will set the precedence of this provisioning package higher than provisioning packages applied to this device from other sources, and then select **Next.** - -20. Optional. In the **Provisioning package security** window, you can choose to encrypt the package and enable package signing. - - - **Enable package encryption** - If you select this option, an auto-generated password will be shown on the screen. - - - **Enable package signing** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by clicking **Select...** and choosing the certificate you want to use to sign the package. - -21. Select **Next** to specify the output location where you want the provisioning package to go when it's built. By default, Windows Imaging and Configuration Designer (ICD) uses the project folder as the output location. - - Optionally, you can select **Browse** to change the default output location. - -22. Select **Next**. - -23. Select **Build** to start building the package. The provisioning package doesn't take long to build. The project information is displayed in the build page and the progress bar indicates the build status. - - If you need to cancel the build, select **Cancel**. It cancels the current build process, closes the wizard, and takes you back to the **Customizations Page**. - -24. If your build fails, an error message will show up that includes a link to the project folder. You can scan the logs to determine what caused the error. Once you fix the issue, try building the package again. - - If your build is successful, the name of the provisioning package, output directory, and project directory will be shown. - - - If you choose, you can build the provisioning package again and pick a different path for the output package. To change the path, select **Back** to change the output package name and path, and then select **Next** to start another build. - - If you're done, select **Finish** to close the wizard and go back to the **Customizations Page**. - -25. Copy the provisioning package to the target device. - -26. Double-click the ppkg file and allow it to install. - -## Related articles - -- [Manage Windows 10 Start and taskbar layout](windows-10-start-layout-options-and-policies.md) -- [Configure Windows 10 taskbar](configure-windows-10-taskbar.md) -- [Customize and export Start layout](customize-and-export-start-layout.md) -- [Start layout XML for desktop editions of Windows 10 (reference)](start-layout-xml-desktop.md) -- [Customize Windows 10 Start and taskbar with Group Policy](customize-windows-10-start-screens-by-using-group-policy.md) -- [Customize Windows 10 Start and taskbar with provisioning packages](customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md) -- [Customize Windows 10 Start and taskbar with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md) -- [Changes to Start policies in Windows 10](changes-to-start-policies-in-windows-10.md) - diff --git a/windows/configuration/start/images/windows-10-partial-layout.png b/windows/configuration/start/images/windows-10-partial-layout.png new file mode 100644 index 0000000000..4650cc42cf Binary files /dev/null and b/windows/configuration/start/images/windows-10-partial-layout.png differ diff --git a/windows/configuration/start/images/windows-10-secondary-tile.png b/windows/configuration/start/images/windows-10-secondary-tile.png new file mode 100644 index 0000000000..01e25ef3bc Binary files /dev/null and b/windows/configuration/start/images/windows-10-secondary-tile.png differ diff --git a/windows/configuration/start/images/windows-10-settings.png b/windows/configuration/start/images/windows-10-settings.png new file mode 100644 index 0000000000..496c2a62c2 Binary files /dev/null and b/windows/configuration/start/images/windows-10-settings.png differ diff --git a/windows/configuration/start/images/windows-10.png b/windows/configuration/start/images/windows-10.png new file mode 100644 index 0000000000..98db149a77 Binary files /dev/null and b/windows/configuration/start/images/windows-10.png differ diff --git a/windows/configuration/start/images/windows-11-secondary-tile.png b/windows/configuration/start/images/windows-11-secondary-tile.png new file mode 100644 index 0000000000..7e7600dcc3 Binary files /dev/null and b/windows/configuration/start/images/windows-11-secondary-tile.png differ diff --git a/windows/configuration/start/images/windows-11-settings.png b/windows/configuration/start/images/windows-11-settings.png new file mode 100644 index 0000000000..18150b3ff8 Binary files /dev/null and b/windows/configuration/start/images/windows-11-settings.png differ diff --git a/windows/configuration/start/images/windows-11.png b/windows/configuration/start/images/windows-11.png new file mode 100644 index 0000000000..32925b625e Binary files /dev/null and b/windows/configuration/start/images/windows-11.png differ diff --git a/windows/configuration/start/includes/allow-pinned-folder-documents.md b/windows/configuration/start/includes/allow-pinned-folder-documents.md new file mode 100644 index 0000000000..85de1af61c --- /dev/null +++ b/windows/configuration/start/includes/allow-pinned-folder-documents.md @@ -0,0 +1,18 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Allow pinned folder Documents + +This policy controls the visibility of the Documents shortcut on the *Pinned folder* section of the Start menu: + +- When enabled, the Documents shortcut is displayed in the Pinned folder section of the Start menu +- When disabled, the Documents shortcut is not displayed in the Pinned folder section of the Start menu + +| | Path | +|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Start/`[AllowPinnedFolderDocuments](/windows/client-management/mdm/policy-csp-start#allowpinnedfolderdocuments) | +| **GPO** | Not available. | diff --git a/windows/configuration/start/includes/allow-pinned-folder-downloads.md b/windows/configuration/start/includes/allow-pinned-folder-downloads.md new file mode 100644 index 0000000000..b10fa9128e --- /dev/null +++ b/windows/configuration/start/includes/allow-pinned-folder-downloads.md @@ -0,0 +1,18 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Allow pinned folder Downloads + +This policy controls the visibility of the Downloads shortcut on the *Pinned folder* section of the Start menu: + +- When enabled, the Downloads shortcut is displayed in the Pinned folder section of the Start menu +- When disabled, the Downloads shortcut is not displayed in the Pinned folder section of the Start menu + +| | Path | +|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Start/`[AllowPinnedFolderDownloads](/windows/client-management/mdm/policy-csp-start#allowpinnedfolderdownloads) | +| **GPO** | Not available. | diff --git a/windows/configuration/start/includes/allow-pinned-folder-file-explorer.md b/windows/configuration/start/includes/allow-pinned-folder-file-explorer.md new file mode 100644 index 0000000000..2c0fb926a3 --- /dev/null +++ b/windows/configuration/start/includes/allow-pinned-folder-file-explorer.md @@ -0,0 +1,18 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Allow pinned folder File Explorer + +This policy controls the visibility of the File Explorer shortcut on the *Pinned folder* section of the Start menu: + +- When enabled, the File Explorer shortcut is displayed in the Pinned folder section of the Start menu +- When disabled, the File Explorer shortcut is not displayed in the Pinned folder section of the Start menu + +| | Path | +|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Start/`[AllowPinnedFolderFileExplorer](/windows/client-management/mdm/policy-csp-start#allowpinnedfolderfileexplorer) | +| **GPO** | Not available. | diff --git a/windows/configuration/start/includes/allow-pinned-folder-home-group.md b/windows/configuration/start/includes/allow-pinned-folder-home-group.md new file mode 100644 index 0000000000..933eb328aa --- /dev/null +++ b/windows/configuration/start/includes/allow-pinned-folder-home-group.md @@ -0,0 +1,18 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Allow pinned folder Home Group + +This policy controls the visibility of the Home Group shortcut on the *Pinned folder* section of the Start menu: + +- When enabled, the Home Group shortcut is displayed in the Pinned folder section of the Start menu +- When disabled, the Home Group shortcut is not displayed in the Pinned folder section of the Start menu + +| | Path | +|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Start/`[AllowPinnedFolderHomeGroup](/windows/client-management/mdm/policy-csp-start#allowpinnedfolderhomegroup) | +| **GPO** | Not available. | diff --git a/windows/configuration/start/includes/allow-pinned-folder-music.md b/windows/configuration/start/includes/allow-pinned-folder-music.md new file mode 100644 index 0000000000..b70d8557ba --- /dev/null +++ b/windows/configuration/start/includes/allow-pinned-folder-music.md @@ -0,0 +1,18 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Allow pinned folder Music + +This policy controls the visibility of the Music shortcut on the *Pinned folder* section of the Start menu: + +- When enabled, the Music shortcut is displayed in the Pinned folder section of the Start menu +- When disabled, the Music shortcut is not displayed in the Pinned folder section of the Start menu + +| | Path | +|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Start/`[AllowPinnedFolderMusic](/windows/client-management/mdm/policy-csp-start#allowpinnedfoldermusic) | +| **GPO** | Not available. | diff --git a/windows/configuration/start/includes/allow-pinned-folder-network.md b/windows/configuration/start/includes/allow-pinned-folder-network.md new file mode 100644 index 0000000000..b9e3defc32 --- /dev/null +++ b/windows/configuration/start/includes/allow-pinned-folder-network.md @@ -0,0 +1,18 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Allow pinned folder Network + +This policy controls the visibility of the Network shortcut on the *Pinned folder* section of the Start menu: + +- When enabled, the Network shortcut is displayed in the Pinned folder section of the Start menu +- When disabled, the Network shortcut is not displayed in the Pinned folder section of the Start menu + +| | Path | +|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Start/`[AllowPinnedFolderNetword](/windows/client-management/mdm/policy-csp-start#allowpinnedfoldernetwork) | +| **GPO** | Not available. | diff --git a/windows/configuration/start/includes/allow-pinned-folder-personal-folder.md b/windows/configuration/start/includes/allow-pinned-folder-personal-folder.md new file mode 100644 index 0000000000..c80c7e6a09 --- /dev/null +++ b/windows/configuration/start/includes/allow-pinned-folder-personal-folder.md @@ -0,0 +1,18 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Allow pinned folder Personal Folder + +This policy controls the visibility of the Personal Folder shortcut on the *Pinned folder* section of the Start menu: + +- When enabled, the Personal Folder shortcut is displayed in the Pinned folder section of the Start menu +- When disabled, the Personal Folder shortcut is not displayed in the Pinned folder section of the Start menu + +| | Path | +|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Start/`[AllowPinnedFolderPersonalFolder](/windows/client-management/mdm/policy-csp-start#allowpinnedfolderpersonalfolder) | +| **GPO** | Not available. | diff --git a/windows/configuration/start/includes/allow-pinned-folder-pictures.md b/windows/configuration/start/includes/allow-pinned-folder-pictures.md new file mode 100644 index 0000000000..07c10b8014 --- /dev/null +++ b/windows/configuration/start/includes/allow-pinned-folder-pictures.md @@ -0,0 +1,18 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Allow pinned folder Pictures + +This policy controls the visibility of the Pictures shortcut on the *Pinned folder* section of the Start menu: + +- When enabled, the Pictures shortcut is displayed in the Pinned folder section of the Start menu +- When disabled, the Pictures shortcut is not displayed in the Pinned folder section of the Start menu + +| | Path | +|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Start/`[AllowPinnedFolderPictures](/windows/client-management/mdm/policy-csp-start#allowpinnedfolderpictures) | +| **GPO** | Not available. | diff --git a/windows/configuration/start/includes/allow-pinned-folder-settings.md b/windows/configuration/start/includes/allow-pinned-folder-settings.md new file mode 100644 index 0000000000..0cf19f323f --- /dev/null +++ b/windows/configuration/start/includes/allow-pinned-folder-settings.md @@ -0,0 +1,18 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Allow pinned folder Settings + +This policy controls the visibility of the Settings shortcut on the *Pinned folder* section of the Start menu: + +- When enabled, the Settings shortcut is displayed in the Pinned folder section of the Start menu +- When disabled, the Settings shortcut is not displayed in the Pinned folder section of the Start menu + +| | Path | +|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Start/`[AllowPinnedFolderSettings](/windows/client-management/mdm/policy-csp-start#allowpinnedfoldersettings) | +| **GPO** | Not available. | diff --git a/windows/configuration/start/includes/allow-pinned-folder-videos.md b/windows/configuration/start/includes/allow-pinned-folder-videos.md new file mode 100644 index 0000000000..0d8ccdca7c --- /dev/null +++ b/windows/configuration/start/includes/allow-pinned-folder-videos.md @@ -0,0 +1,18 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Allow pinned folder Videos + +This policy controls the visibility of the Videos shortcut on the *Pinned folder* section of the Start menu: + +- When enabled, the Videos shortcut is displayed in the Pinned folder section of the Start menu +- When disabled, the Videos shortcut is not displayed in the Pinned folder section of the Start menu + +| | Path | +|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Start/`[AllowPinnedFolderVideos](/windows/client-management/mdm/policy-csp-start#allowpinnedfoldervideos) | +| **GPO** | Not available. | diff --git a/windows/configuration/start/includes/clear-history-of-recently-opened-documents-on-exit.md b/windows/configuration/start/includes/clear-history-of-recently-opened-documents-on-exit.md new file mode 100644 index 0000000000..a81f028057 --- /dev/null +++ b/windows/configuration/start/includes/clear-history-of-recently-opened-documents-on-exit.md @@ -0,0 +1,23 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Clear history of recently opened documents on exit + +If you enable this policy setting, shortcuts to recently used files are deleted when the user signs out: + +- The **Recent Items** section on the Start menu is cleared +- Recently and frequently used items in the jump lists of programs in the Start menu and Taskbar are cleared + +If you disable or don't configure this policy setting, the system retains document shortcuts. When a user signs in, the **Recent Items** menu and the jump lists appear as when the user logged off. + +> [!NOTE] +> The system saves document shortcuts in the user profile in the System-drive\Users\User-name\Recent folder. + +| | Path | +|--|--| +| **CSP** | Not available. | +| **GPO** | **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Clear history of recently opened documents on exit** | diff --git a/windows/configuration/start/includes/clear-the-recent-programs-list-for-new-users.md b/windows/configuration/start/includes/clear-the-recent-programs-list-for-new-users.md new file mode 100644 index 0000000000..cb6caaaf10 --- /dev/null +++ b/windows/configuration/start/includes/clear-the-recent-programs-list-for-new-users.md @@ -0,0 +1,15 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Clear the recent programs list for new users + +If you enable this policy setting, the recent programs list in the start menu is empty for each new user. If you disable or don't configure this policy setting, the start menu *recent programs list* is prepopulated with programs for each new user. + +| | Path | +|--|--| +| **CSP** | Not available. | +| **GPO** | **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Clear the recent programs list for new users** | diff --git a/windows/configuration/start/includes/clear-tile-notifications-during-log-on.md b/windows/configuration/start/includes/clear-tile-notifications-during-log-on.md new file mode 100644 index 0000000000..59c2b07132 --- /dev/null +++ b/windows/configuration/start/includes/clear-tile-notifications-during-log-on.md @@ -0,0 +1,15 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Clear tile notifications during log on + +If you enable this policy setting, the system deletes tile notifications when the user signs on. As a result, the tiles in the Start menu always show their default content when a user signs in. Any cached versions of the notifications are cleared when the user signs in. If you disable or don't configure this setting, the system retains notifications, and when a user signs in, the tiles appear just as they did when the user signed out, including the history of previous notifications for each tile. This policy setting doesn't prevent new notifications from appearing. + +| | Path | +|--|--| +| **CSP** | ./Device/Vendor/MSFT/[Setting]() | +| **GPO** | **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** | diff --git a/windows/configuration/start/includes/configure-start-layout.md b/windows/configuration/start/includes/configure-start-layout.md new file mode 100644 index 0000000000..fca0c5315d --- /dev/null +++ b/windows/configuration/start/includes/configure-start-layout.md @@ -0,0 +1,17 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Configure Start layout + +This policy setting lets you specify the Start layout for users, preventing them from changing its configuration. The Start layout you specify must be stored in an XML file that was generated by the `Export-StartLayout` PowerShell cmdlet. To use this setting, you must first manually configure a device's Start layout to the desired look and feel. Then, run the `Export-StartLayout` PowerShell cmdlet on that same device. The cmdlet generates an XML file representing the layout you configured. Once the XML file is generated and moved to the desired file path, use the fully qualified path and name of the XML file. You can use a local path, or a UNC path. If the specified file isn't available when the user signs in, the layout isn't changed. Users can't customize the Start layout while this setting is enabled. If you disable this setting or don't configure it, the Start screen layout isn't changed and users can customize it. + +| | Path | +|--|--| +| **CSP** | [Configure start layout](/windows/client-management/mdm/policy-csp-start#startlayout) | +| **GPO** | **Computer Configuration** > **Administrative Templates** > **Start Menu and Taskbar**

                        **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** | + +For more information, see [Customize the Start layout](../layout.md). diff --git a/windows/configuration/start/includes/configure-start-pins.md b/windows/configuration/start/includes/configure-start-pins.md new file mode 100644 index 0000000000..9f24b17c31 --- /dev/null +++ b/windows/configuration/start/includes/configure-start-pins.md @@ -0,0 +1,19 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 10/30/2023 +ms.topic: include +--- + +### Configure Start pins + +This policy setting lets you specify a new list of pinned apps to override the default/current list of pinned apps in the Windows Start menu. + +The policy setting accepts a JSON file that contains the list of items to pin, and their order. + +| | Path | +|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Start/`[ConfigureStartPins](/windows/client-management/mdm/policy-csp-start#configurestartpins)

                        `./User/Vendor/MSFT/Policy/Config/Start/`[ConfigureStartPins](/windows/client-management/mdm/policy-csp-start#configurestartpins)| +| **GPO** | Not available | + +For more information, see [Customize the Start layout](../layout.md). diff --git a/windows/configuration/start/includes/disable-context-menus.md b/windows/configuration/start/includes/disable-context-menus.md new file mode 100644 index 0000000000..e502478b6f --- /dev/null +++ b/windows/configuration/start/includes/disable-context-menus.md @@ -0,0 +1,15 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Disable context menus + +With this policy setting you can prevent users from opening the context menus in the Start menu. If you enable this policy, then invocations of context menus within the Start menu is ignored. + +| | Path | +|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Start/`[DisableContextMenus](/windows/client-management/mdm/policy-csp-start#disablecontextmenus)

                        `./User/Vendor/MSFT/Policy/Config/Start/`[DisableContextMenus](/windows/client-management/mdm/policy-csp-start#disablecontextmenus)| +| **GPO** | **Computer Configuration** > **Administrative Templates** > **Start Menu and Taskbar**

                        **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Disable context menus in the Start Menu** | diff --git a/windows/configuration/start/includes/disable-search.md b/windows/configuration/start/includes/disable-search.md new file mode 100644 index 0000000000..5de3b6fa11 --- /dev/null +++ b/windows/configuration/start/includes/disable-search.md @@ -0,0 +1,16 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Disable search + +When you enable this policy setting, the Search UI and all its entry points are disabled, such as keyboard shortcuts, touchpad gestures, and type-to-search in the Start menu. The Start menu's search box and Search Taskbar buttons are hidden. If you disable or don't configure this policy setting, users can open the Search UI and its different entry points are available. + + +| | Path | +|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Search/`[DisableSearch](/windows/client-management/mdm/policy-csp-search#disablesearch)| +| **GPO** | **Computer Configuration** > **Windows Components** > **Search** > **Fully disable Search UI** | diff --git a/windows/configuration/start/includes/do-not-use-the-search-based-method-when-resolving-shell-shortcuts.md b/windows/configuration/start/includes/do-not-use-the-search-based-method-when-resolving-shell-shortcuts.md new file mode 100644 index 0000000000..55a74cc190 --- /dev/null +++ b/windows/configuration/start/includes/do-not-use-the-search-based-method-when-resolving-shell-shortcuts.md @@ -0,0 +1,15 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Don't use the search-based method when resolving shell shortcuts + +This policy setting prevents the system from conducting a comprehensive search of the target drive to resolve a shortcut. If you enable this policy setting, the system doesn't conduct the final drive search. It just displays a message explaining that the file isn't found. If you disable or don't configure this policy setting, by default, when the system can't find the target file for a shortcut (.lnk), it searches all paths associated with the shortcut. If the target file is located on an NTFS partition, the system then uses the target's file ID to find a path. If the resulting path isn't correct, it conducts a comprehensive search of the target drive in an attempt to find the file. Note: This policy setting only applies to target files on NTFS partitions. FAT partitions don't have this ID tracking and search capability. + +| | Path | +|--|--| +| **CSP** | ./Device/Vendor/MSFT/[Setting]() | +| **GPO** | **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Do not use the search-based method when resolving shell shortcuts** | diff --git a/windows/configuration/start/includes/do-not-use-the-tracking-based-method-when-resolving-shell-shortcuts.md b/windows/configuration/start/includes/do-not-use-the-tracking-based-method-when-resolving-shell-shortcuts.md new file mode 100644 index 0000000000..a877effc15 --- /dev/null +++ b/windows/configuration/start/includes/do-not-use-the-tracking-based-method-when-resolving-shell-shortcuts.md @@ -0,0 +1,15 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Don't use the tracking-based method when resolving shell shortcuts + +This policy setting prevents the system from using NTFS tracking features to resolve a shortcut. If you enable this policy setting, the system doesn't try to locate the file by using its file ID. It skips this step and begins a comprehensive search of the drive specified in the target path. If you disable or don't configure this policy setting, by default, when the system can't find the target file for a shortcut (.lnk), it searches all paths associated with the shortcut. If the target file is located on an NTFS partition, the system then uses the target's file ID to find a path. If the resulting path isn't correct, it conducts a comprehensive search of the target drive in an attempt to find the file. Note: This policy setting only applies to target files on NTFS partitions. FAT partitions don't have this ID tracking and search capability. + +| | Path | +|--|--| +| **CSP** | ./Device/Vendor/MSFT/[Setting]() | +| **GPO** | **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Do not use the tracking-based method when resolving shell shortcuts** | diff --git a/windows/configuration/start/includes/example-assets.md b/windows/configuration/start/includes/example-assets.md new file mode 100644 index 0000000000..1a9db2bdb8 --- /dev/null +++ b/windows/configuration/start/includes/example-assets.md @@ -0,0 +1,21 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 03/13/2024 +ms.topic: include +--- + +Example of the output of the PowerShell cmdlet `Export-StartLayoutEdgeAssets`: + +```xml + + + + Base64 encoded value of the logo + + + + Base64 encoded value of the logo + + +``` \ No newline at end of file diff --git a/windows/configuration/start/includes/example-secondary-tiles.md b/windows/configuration/start/includes/example-secondary-tiles.md new file mode 100644 index 0000000000..1f1a7197b5 --- /dev/null +++ b/windows/configuration/start/includes/example-secondary-tiles.md @@ -0,0 +1,24 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 03/13/2024 +ms.topic: include +--- + +Example of secondary tiles in XML generated by the PowerShell cmdlet `Export-StartLayout`: + +```xml + +``` diff --git a/windows/configuration/start/includes/example-start-layout.md b/windows/configuration/start/includes/example-start-layout.md new file mode 100644 index 0000000000..94957b8fa9 --- /dev/null +++ b/windows/configuration/start/includes/example-start-layout.md @@ -0,0 +1,57 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 03/13/2024 +ms.topic: include +--- + +::: zone pivot="windows-10" + +```xml + + + + + + + + + + + + + + + + + + + + + + +``` + +::: zone-end + +::: zone pivot="windows-11" + +```json +{ + "pinnedList": [ + {"desktopAppLink": "%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Edge.lnk" }, + { "packagedAppId": "windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel" }, + { "desktopAppLink": "%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\File Explorer.lnk" }, + { "desktopAppLink": "%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" }, + { "packagedAppId": "Microsoft.WindowsTerminal_8wekyb3d8bbwe!App" }, + { "packagedAppId": "Microsoft.Paint_8wekyb3d8bbwe!App" }, + { "packagedAppId": "Microsoft.Windows.Photos_8wekyb3d8bbwe!App" }, + { "packagedAppId": "MicrosoftCorporationII.QuickAssist_8wekyb3d8bbwe!App" }, + { "packagedAppId": "Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe!App" }, + { "packagedAppId": "Microsoft.SecHealthUI_8wekyb3d8bbwe!SecHealthUI" }, + { "packagedAppId": "Microsoft.OutlookForWindows_8wekyb3d8bbwe!Microsoft.OutlookforWindows"} + ] +} +``` + +::: zone-end diff --git a/windows/configuration/start/includes/force-start-size.md b/windows/configuration/start/includes/force-start-size.md new file mode 100644 index 0000000000..2f1dda1496 --- /dev/null +++ b/windows/configuration/start/includes/force-start-size.md @@ -0,0 +1,15 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Force Start size + +If you enable this policy and set it to Start menu or full screen Start, Start is set to that size and users can't change the size of Start in Settings. If you disable or don't configure this policy setting, Windows automatically selects the size based on hardware form factor and users can change the size of Start in Settings. + +| | Path | +|--|--| +| **CSP** | `./User/Vendor/MSFT/Policy/Config/Start/`[ForceStartSize](/windows/client-management/mdm/policy-csp-start#forcestartsize)

                        `./Device/Vendor/MSFT/Policy/Config/Start/`[ForceStartSize](/windows/client-management/mdm/policy-csp-start#forcestartsize) | +| **GPO** | **Computer Configuration** > **Administrative Templates** > **Start Menu and Taskbar**

                        **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Force Start to be either full screen size or menu size** | diff --git a/windows/configuration/start/includes/hide-app-list.md b/windows/configuration/start/includes/hide-app-list.md new file mode 100644 index 0000000000..6185e19f8f --- /dev/null +++ b/windows/configuration/start/includes/hide-app-list.md @@ -0,0 +1,20 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Hide app list + +If you enable this setting, the Start Menu will either collapse or remove the all apps list from the Start menu: + +- **Collapse** doesn't display the app list next to the pinned tiles in Start. An **All apps** button is displayed on Start to open the all apps list. This is equivalent to setting the **Show app list in Start** in Settings to **Off** +- **Collapse and disable setting** is the same as the collapse option and disable the **Show app list in Start menu** in Settings, so users can't turn it to On +- **Remove and disable setting** removes the all apps list from Start and disable the **Show app list in Start menu** in Settings, so users can't turn it to On +- If you disable or don't configure this setting, the all apps list is visible by default, and the user can change **Show app list in Start** in Settings + +| | Path | +|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Start/`[HideAppList](/windows/client-management/mdm/policy-csp-start#hideapplist)

                        `./User/Vendor/MSFT/Policy/Config/Start/`[HideAppList](/windows/client-management/mdm/policy-csp-start#hideapplist) | +| **GPO** | **Computer Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Remove All Programs list from the Start menu**

                        **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Remove All Programs list from the Start menu** | diff --git a/windows/configuration/start/includes/hide-change-account-settings.md b/windows/configuration/start/includes/hide-change-account-settings.md new file mode 100644 index 0000000000..4e0e563b3e --- /dev/null +++ b/windows/configuration/start/includes/hide-change-account-settings.md @@ -0,0 +1,13 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 10/30/2023 +ms.topic: include +--- + +### Hide change account settings + +| | Path | +|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Start/`[HideChangeAccountSettings](/windows/client-management/mdm/policy-csp-start#hidechangeaccountsettings)| +| **GPO** | Not available. | diff --git a/windows/configuration/start/includes/hide-frequently-used-apps.md b/windows/configuration/start/includes/hide-frequently-used-apps.md new file mode 100644 index 0000000000..65ff38d497 --- /dev/null +++ b/windows/configuration/start/includes/hide-frequently-used-apps.md @@ -0,0 +1,17 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Hide frequently used apps + +If you enable this setting, the frequently used programs list is removed from the Start menu. + +If you disable this setting or don't configure it, the frequently used programs list remains on the simple Start menu. + +| | Path | +|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Start/`[HideFrequentlyUsedApps](/windows/client-management/mdm/policy-csp-start#hidefrequentlyusedapps)

                        `./User/Vendor/MSFT/Policy/Config/Start/`[HideFrequentlyUsedApps](/windows/client-management/mdm/policy-csp-start#hidefrequentlyusedapps) | +| **GPO** | **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Remove frequent programs from the Start Menu** | diff --git a/windows/configuration/start/includes/hide-hibernate.md b/windows/configuration/start/includes/hide-hibernate.md new file mode 100644 index 0000000000..e7b39cbb1d --- /dev/null +++ b/windows/configuration/start/includes/hide-hibernate.md @@ -0,0 +1,13 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Hide Hibernate + +| | Path | +|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Start/`[HideHibernate](/windows/client-management/mdm/policy-csp-start#hidehibernate) | +| **GPO** | Not available. | diff --git a/windows/configuration/start/includes/hide-lock.md b/windows/configuration/start/includes/hide-lock.md new file mode 100644 index 0000000000..e43dff0cfa --- /dev/null +++ b/windows/configuration/start/includes/hide-lock.md @@ -0,0 +1,13 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Hide Lock + +| | Path | +|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Start/`[HideSignOut](/windows/client-management/mdm/policy-csp-start#hidelock) | +| **GPO** | Not available. | diff --git a/windows/configuration/start/includes/hide-most-used-lists.md b/windows/configuration/start/includes/hide-most-used-lists.md new file mode 100644 index 0000000000..e6f6eb2231 --- /dev/null +++ b/windows/configuration/start/includes/hide-most-used-lists.md @@ -0,0 +1,23 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Hide most used lists + +If you enable this policy setting, you can configure Start menu to show or hide the list of user's most used apps, regardless of user settings: + +- Selecting **Show** forces the *Most used* list in the Start menu, and users can't change to hide it using the Settings app +- Selecting **Hide** disables the *Most used* list, and users can't change to show it using the Settings app +- Selecting **Not Configured**, allow users to turn on or off the display of **Most used** list using the Settings app. This is default behavior. + +> [!NOTE] +> +> This policy setting has the precedence over the *Hide frequently used apps* policy setting. + +| | Path | +|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Start/`[ShowOrHideMostUsedApps](/windows/client-management/mdm/policy-csp-start#showorhidemostusedapps)

                        `./User/Vendor/MSFT/Policy/Config/Start/`[ShowOrHideMostUsedApps](/windows/client-management/mdm/policy-csp-start#showorhidemostusedapps)| +| **GPO** | **Computer Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Show or hide "Most used" list from Start menu**

                        **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Show or hide "Most used" list from Start menu** | diff --git a/windows/configuration/start/includes/hide-power-button.md b/windows/configuration/start/includes/hide-power-button.md new file mode 100644 index 0000000000..2c5fb58ca9 --- /dev/null +++ b/windows/configuration/start/includes/hide-power-button.md @@ -0,0 +1,17 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Hide Power button + +| | Path | +|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Start/`[HidePowerButton](/windows/client-management/mdm/policy-csp-start#hidepowerbutton) | +| **GPO** | Not available. | + +hiderestart +hideshutdown +hidesleep \ No newline at end of file diff --git a/windows/configuration/start/includes/hide-recent-jumplists.md b/windows/configuration/start/includes/hide-recent-jumplists.md new file mode 100644 index 0000000000..6e9a6b15ac --- /dev/null +++ b/windows/configuration/start/includes/hide-recent-jumplists.md @@ -0,0 +1,25 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Hide recent jumplists + +Prevents the operating system and installed programs from creating and displaying shortcuts to recently opened documents. + +- If you enable this setting: + - The system and apps don't create shortcuts to documents opened + - The system empties the Recent Items menu on the Start menu, and apps don't display shortcuts at the bottom of the File menu + - The Jump Lists in the Start Menu and Taskbar don't show lists of recently or frequently used files, folders, or websites +If you disable or don't configure this setting + - The system stores and displays shortcuts to recently and frequently used files, folders, and websites + +If you enable this setting but don't enable the "Remove Recent Items menu from Start Menu" setting, the Recent Items menu appears on the Start menu, but it's empty. If you enable this setting, but then later disable it or set it to *Not Configured*, the document shortcuts saved before the setting was enabled reappear in the Recent Items menu and program File menus, and Jump Lists. This setting doesn't hide or prevent the user from pinning files, folders, or websites to the Jump Lists. This setting doesn't hide document shortcuts displayed in the Open dialog box. + +| | Path | +|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Start/`[HideRecentJumplists](/windows/client-management/mdm/policy-csp-start#hiderecentjumplists)

                        `./User/Vendor/MSFT/Policy/Config/Start/`[HideRecentJumplists](/windows/client-management/mdm/policy-csp-start#hiderecentjumplists) | +| **GPO** | **Computer Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Do not keep history of recently opened documents**

                        **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Do not keep history of recently opened documents**| + diff --git a/windows/configuration/start/includes/hide-recently-added-apps.md b/windows/configuration/start/includes/hide-recently-added-apps.md new file mode 100644 index 0000000000..43c642e888 --- /dev/null +++ b/windows/configuration/start/includes/hide-recently-added-apps.md @@ -0,0 +1,17 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Hide recently added apps + +With this policy setting, you can prevent the Start menu from displaying a list of recently installed applications. + +If you enable this policy, the Start menu doesn't display the **Recently added** list. The corresponding setting is also disabled in Settings. + +| | Path | +|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Start/`[HideRecentlyAddedApps](/windows/client-management/mdm/policy-csp-start#hiderecentlyaddedapps)

                        `./User/Vendor/MSFT/Policy/Config/Start/`[HideRecentlyAddedApps](/windows/client-management/mdm/policy-csp-start#hiderecentlyaddedapps) | +| **GPO** | **Computer Configuration** > **Administrative Templates** > **Start Menu and Taskbar**

                        **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Remove "Recently added" list from Start Menu** | diff --git a/windows/configuration/start/includes/hide-recommended-personalized-sites.md b/windows/configuration/start/includes/hide-recommended-personalized-sites.md new file mode 100644 index 0000000000..899e17d18a --- /dev/null +++ b/windows/configuration/start/includes/hide-recommended-personalized-sites.md @@ -0,0 +1,15 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Hide recommended personalized sites + +Remove Personalized Website Recommendations from the Recommended section in the Start Menu. + +| | Path | +|--|--| +| **CSP** | `./User/Vendor/MSFT/Policy/Config/Start/`[HideRecommendedPersonalizedSites](/windows/client-management/mdm/policy-csp-start#hiderecommendedpersonalizedsites)

                        `./Device/Vendor/MSFT/Policy/Config/Start/`[HideRecommendedPersonalizedSites](/windows/client-management/mdm/policy-csp-start#hiderecommendedpersonalizedsites) | +| **GPO** | **Computer Configuration** > **Administrative Templates** > **Start Menu and Taskbar**

                        **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Remove Personalized Website Recommendations from the Recommended section in the Start Menu**| \ No newline at end of file diff --git a/windows/configuration/start/includes/hide-recommended-section.md b/windows/configuration/start/includes/hide-recommended-section.md new file mode 100644 index 0000000000..0331a54e2e --- /dev/null +++ b/windows/configuration/start/includes/hide-recommended-section.md @@ -0,0 +1,15 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Hide recommended section + +This policy setting prevents the Start menu from displaying a list of recommended applications and files. If you enable this policy setting, the Start menu doesn't show the section containing a list of recommended files and apps. + +| | Path | +|--|--| +| **CSP** | `./User/Vendor/MSFT/Policy/Config/Start/`[HideRecommendedSection](/windows/client-management/mdm/policy-csp-start#hiderecommendedsection)

                        `./Device/Vendor/MSFT/Policy/Config/Start/`[HideRecommendedSection](/windows/client-management/mdm/policy-csp-start#hiderecommendedsection) | +| **GPO** | **Computer Configuration** > **Administrative Templates** > **Start Menu and Taskbar**

                        **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Remove Recommended section from Start Menu** | diff --git a/windows/configuration/start/includes/hide-restart.md b/windows/configuration/start/includes/hide-restart.md new file mode 100644 index 0000000000..b62480ae4b --- /dev/null +++ b/windows/configuration/start/includes/hide-restart.md @@ -0,0 +1,16 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Hide Restart + +| | Path | +|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Start/`[HideRestart](/windows/client-management/mdm/policy-csp-start#hiderestart) | +| **GPO** | Not available. | + +hideshutdown +hidesleep \ No newline at end of file diff --git a/windows/configuration/start/includes/hide-shut-down.md b/windows/configuration/start/includes/hide-shut-down.md new file mode 100644 index 0000000000..ff8957dcf0 --- /dev/null +++ b/windows/configuration/start/includes/hide-shut-down.md @@ -0,0 +1,13 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Hide Shut down + +| | Path | +|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Start/`[HideShutDown](/windows/client-management/mdm/policy-csp-start#hideshutdown) | +| **GPO** | Not available. | diff --git a/windows/configuration/start/includes/hide-signout.md b/windows/configuration/start/includes/hide-signout.md new file mode 100644 index 0000000000..9a6ef3d422 --- /dev/null +++ b/windows/configuration/start/includes/hide-signout.md @@ -0,0 +1,22 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Hide Sign out + +With this policy setting you can remove the **Sign out** item from the Start menu and prevents users from restoring it: + +- If you enable this policy setting, the **Sign out** item doesn't appear in the Start menu +- If you disable or don't configure this policy setting, users can use the **Sign out** item in the Start menu + +> [!NOTE] +> +> This policy setting affects the Start menu only. It doesn't affect the **Sign out** item on the Windows Security dialog box that appears when you press CTRL+ALT+DEL, and it doesn't prevent users from using other methods to sign out. + +| | Path | +|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Start/`[HideSignOut](/windows/client-management/mdm/policy-csp-start#hidesignout) | +| **GPO** | **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Remove Logoff on the Start Menu** | diff --git a/windows/configuration/start/includes/hide-sleep.md b/windows/configuration/start/includes/hide-sleep.md new file mode 100644 index 0000000000..dd866139e3 --- /dev/null +++ b/windows/configuration/start/includes/hide-sleep.md @@ -0,0 +1,13 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Hide Sleep + +| | Path | +|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Start/`[HideSleep](/windows/client-management/mdm/policy-csp-start#hidesleep) | +| **GPO** | Not available. | diff --git a/windows/configuration/start/includes/hide-switch-account.md b/windows/configuration/start/includes/hide-switch-account.md new file mode 100644 index 0000000000..5bbe1c5e7a --- /dev/null +++ b/windows/configuration/start/includes/hide-switch-account.md @@ -0,0 +1,13 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Hide Switch account + +| | Path | +|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Start/`[HideSwitchAccount](/windows/client-management/mdm/policy-csp-start#hideswitchaccount) | +| **GPO** | Not available. | diff --git a/windows/configuration/start/includes/hide-user-tile.md b/windows/configuration/start/includes/hide-user-tile.md new file mode 100644 index 0000000000..18e35f9e1f --- /dev/null +++ b/windows/configuration/start/includes/hide-user-tile.md @@ -0,0 +1,13 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 10/30/2023 +ms.topic: include +--- + +### Hide User tile + +| | Path | +|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Start/`[HideUserTile](/windows/client-management/mdm/policy-csp-start#hideusertile)| +| **GPO** | Not available. | diff --git a/windows/configuration/start/includes/import-edge-assets.md b/windows/configuration/start/includes/import-edge-assets.md new file mode 100644 index 0000000000..c74bd471b5 --- /dev/null +++ b/windows/configuration/start/includes/import-edge-assets.md @@ -0,0 +1,13 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 10/30/2023 +ms.topic: include +--- + +### Import Edge assets + +| | Path | +|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Start/`[ImportEdgeAssets](/windows/client-management/mdm/policy-csp-start#importedgeassets)| +| **GPO** | Not available | diff --git a/windows/configuration/start/includes/prevent-changes-to-taskbar-and-start-menu-settings.md b/windows/configuration/start/includes/prevent-changes-to-taskbar-and-start-menu-settings.md new file mode 100644 index 0000000000..59b825838b --- /dev/null +++ b/windows/configuration/start/includes/prevent-changes-to-taskbar-and-start-menu-settings.md @@ -0,0 +1,18 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Prevent changes to Taskbar and Start Menu settings + +With this policy setting you can prevent changes to Taskbar and Start menu settings: + +- If you enable this policy setting, users can't change the Taskbar or Start properties +- If you disable or don't configure this policy setting, the Taskbar and Start Menu items are available from Settings on the Start menu + +| | Path | +|--|--| +| **CSP** | Not available. | +| **GPO** | **Computer Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Prevent changes to Taskbar and Start Menu Settings**

                        **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Prevent changes to Taskbar and Start Menu Settings**| diff --git a/windows/configuration/start/includes/prevent-users-from-customizing-their-start.md b/windows/configuration/start/includes/prevent-users-from-customizing-their-start.md new file mode 100644 index 0000000000..eeeaae273e --- /dev/null +++ b/windows/configuration/start/includes/prevent-users-from-customizing-their-start.md @@ -0,0 +1,18 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Prevent users from customizing their Start + +With this policy setting you can prevent users from changing their Start menu layout: + +- If you enable this setting, users can't pin/unpin a Start menu element, and rearrange elements +- If you disable or don't configure this setting, users can pin/unpin elements, and rearrange elements + +| | Path | +|--|--| +| **CSP** | Not available. | +| **GPO** | **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Prevent users from customizing their Start**| diff --git a/windows/configuration/start/includes/prevent-users-from-uninstalling-applications-from-start.md b/windows/configuration/start/includes/prevent-users-from-uninstalling-applications-from-start.md new file mode 100644 index 0000000000..53add991f5 --- /dev/null +++ b/windows/configuration/start/includes/prevent-users-from-uninstalling-applications-from-start.md @@ -0,0 +1,15 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Prevent users from uninstalling applications from Start + +If you enable this setting, users can't uninstall apps from Start. If you disable this setting or don't configure it, users can access the uninstall command from Start. + +| | Path | +|--|--| +| **CSP** | Not available. | +| **GPO** | **Computer Configuration** > **Administrative Templates** > **Start Menu and Taskbar**

                        **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Prevent users from uninstalling applications from Start**| diff --git a/windows/configuration/start/includes/remove-and-prevent-access-to-the-shut-down-restart-sleep-and-hibernate-commands.md b/windows/configuration/start/includes/remove-and-prevent-access-to-the-shut-down-restart-sleep-and-hibernate-commands.md new file mode 100644 index 0000000000..324fe427b0 --- /dev/null +++ b/windows/configuration/start/includes/remove-and-prevent-access-to-the-shut-down-restart-sleep-and-hibernate-commands.md @@ -0,0 +1,18 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Remove and prevent access to the Shut Down, Restart, Sleep, and Hibernate commands + +With this policy setting, you can prevent users from performing the following commands from the Windows security screen, the sign in screen, and the Start menu: Shut Down, Restart, Sleep, and Hibernate. This policy setting doesn't prevent users from running Windows-based programs that perform these functions: + +- If you enable this policy setting, the shutdown, restart, sleep, and hibernate commands are removed from the Start menu. The Power button is also removed from the Windows Security screen, which appears when you press CTRL+ALT+DELETE, and from the sign in screen +- If you disable or don't configure this policy setting, the Power button and the Shut Down, Restart, Sleep, and Hibernate commands are available on the Start menu. The Power button on the Windows Security and sign in screens is also available + +| | Path | +|--|--| +| **CSP** | Not available | +| **GPO** | **Computer Configuration** > **Administrative Templates** > **Start Menu and Taskbar**

                        **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Remove and prevent access to the Shut Down, Restart, Sleep, and Hibernate commands** | diff --git a/windows/configuration/start/includes/remove-common-program-groups.md b/windows/configuration/start/includes/remove-common-program-groups.md new file mode 100644 index 0000000000..3c0479536c --- /dev/null +++ b/windows/configuration/start/includes/remove-common-program-groups.md @@ -0,0 +1,15 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Remove common program groups + +This policy setting removes items in the *All Users* profile from the Programs menu on the Start menu. By default, the Programs menu contains items from the *All Users* profile and items from the user's profile. If you enable this setting, only items in the user's profile appear in the Programs menu. + +| | Path | +|--|--| +| **CSP** | Not available. | +| **GPO** | **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Remove common program groups from Start Menu** | diff --git a/windows/configuration/start/includes/show-run-as-different-user-command.md b/windows/configuration/start/includes/show-run-as-different-user-command.md new file mode 100644 index 0000000000..edd8c3f2c4 --- /dev/null +++ b/windows/configuration/start/includes/show-run-as-different-user-command.md @@ -0,0 +1,18 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Show *Run as different user* command + +With this policy setting, you can hide the *Run as different user* command on the Start application bar. If you enable it, users can access the **Run as different user** command from Start. If you disable or don't configure this setting, users can't access the **Run as different user** command from Start for any applications. + +> [!NOTE] +> This setting doesn't prevent users from using other methods, such as the SHIFT right-click menu on application's jumplists in the taskbar to issue the *Run as different user* command. + +| | Path | +|--|--| +| **CSP** | Not available | +| **GPO** | **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Show "Run as different user" command on Start** | diff --git a/windows/configuration/start/index.md b/windows/configuration/start/index.md new file mode 100644 index 0000000000..0627e33663 --- /dev/null +++ b/windows/configuration/start/index.md @@ -0,0 +1,87 @@ +--- +title: Configure the Start menu +description: Learn how to configure the Windows Start menu to provide quick access to the tools and applications that users need most. +ms.topic: overview +ms.date: 04/10/2024 +zone_pivot_groups: windows-versions-11-10 +ms.collection: +- essentials-manage +appliesto: +--- + +# Configure the Start menu + +The Windows Start menu is a pivotal element in the Windows operating system, serving as a central hub for launching applications and managing tasks. For organizations, the ability to configure the Start menu's behavior through policy settings can be highly beneficial, particularly in environments where certain roles or functions necessitate tailored access to applications and tools. + +For instance, in kiosk settings, organizations can configure the Start menu to limit access to a single application or a specific set of applications, ensuring that the kiosk serves its intended purpose without allowing for unnecessary or potentially disruptive interactions. This is useful in public spaces or in scenarios where devices are intended for a single function, such as information stands or check-in counters. + +Frontline workers, who often operate in fast-paced and dynamic environments, can benefit from a Start menu that is configured to provide quick access to the tools and applications they need most. This streamlined approach can enhance productivity and reduce the time spent navigating through unnecessary options. + +In educational settings, students can benefit from a Start menu that is customized to provide access to educational tools and resources while restricting distractions. By configuring policy settings, educational institutions can create a focused and conducive learning environment. + +## Start structure + +The Start menu structure consists five main areas, which you can configure to meet your organization's needs. These areas are as follows: + +:::row::: +:::column span="2"::: +::: zone pivot="windows-10" +1. **Start layout**: contains the arrangement of tiles that link to applications, folders, websites, or files +1. **All apps**: contains an alphabetical list of all installed applications. The list can include dynamic sections, such as *Most used* and *Recently added* +1. **Account**: contains links to change user account settings, sign out, lock the device, or switch user +1. **Pinned folders**: contains a customizable list of folders for quick access +1. **Power**: contains links to power options, such as shutdown, restart, and sleep +::: zone-end +::: zone pivot="windows-11" +1. **Start layout**: the *Pinned* section contains the arrangement of pins that link to applications, folders, websites, or files. The *Recommended* section is designed to enhance user productivity by providing quick access to frequently used apps, documents, or websites +1. **All apps**: contains an alphabetical list of all installed applications. The list can include dynamic sections, such as *Most used* and *Recently added* +1. **Account**: contains links to change user account settings, sign out, lock the device, or switch user +1. **Pinned folders**: contains a customizable list of folders for quick access +1. **Power**: contains links to power options, such as shutdown, restart, and sleep +::: zone-end +:::column-end::: +:::column span="2"::: +::: zone pivot="windows-10" + :::image type="content" source="./images/windows-10-settings.png" alt-text="Sample start menu layout with its components highlighted." border="false" lightbox="./images/windows-10-settings.png"::: +::: zone-end +::: zone pivot="windows-11" + :::image type="content" source="./images/windows-11-settings.png" alt-text="Sample start menu layout with its components highlighted." border="false" lightbox="./images/windows-11-settings.png"::: +::: zone-end + :::column-end::: +:::row-end::: + +## Configuration options + +There are several options to configure the Windows Start menu. + +If you need to configure a device for a single user, you can pin/unpin applications to Start and rearrange them. Start can be further customized from Settings. Go to **Settings** > **Personalization** > **[Start](ms-settings:personalization-start)**. + +For advanced customizations and when you need to configure multiple devices, you can use one of the following options: + +- Configuration Service Provider (CSP): commonly used for devices managed by a Mobile Device Management (MDM) solution, like Microsoft Intune. CSPs can also be configured with [provisioning packages](../provisioning-packages/how-it-pros-can-use-configuration-service-providers.md#csps-in-windows-configuration-designer), which are used at deployment time or for unmanaged devices. To configure Start, use the [Start Policy CSP][WIN-1] +- Group policy (GPO): used for devices that are Active Directory joined or Microsoft Entra hybrid joined, and not managed by a device management solution. Group policy can also be used for devices that aren't joined to an Active Directory domain, using the local group policy editor + +> [!NOTE] +> While many of the Start menu policy settings can be configured using both CSP and GPO, there are some settings that are only available using the Start Policy CSP. To learn about the available policy settings to configure the Start menu via CSP and GPO, see [Start menu policy settings](policy-settings.md). + +::: zone pivot="windows-10" +The configuration of the Start layout requires the use of an XML file that specifies the layout. To learn more about how to create and apply an XML file to configure the Start layout, see [Customize the Start layout](layout.md). +::: zone-end + +::: zone pivot="windows-11" +The configuration of the Start layout requires the use of a JSON file that specifies the layout. To learn more about how to create and apply a JSON file to configure the Start layout, see [Customize the Start layout](layout.md). + +> [!IMPORTANT] +> The JSON file can be applied to devices using the [Start policy CSP][WIN-1] only. It's not possible to apply the JSON file using group policy. +::: zone-end + +## Next steps + +In the next sections, you can learn more about the options available to configure Start menu settings using the Configuration Service Provider (CSP) and Group Policy (GPO): + +- [Customize the Start layout](layout.md) +- [Start menu policy settings](policy-settings.md) + + + +[WIN-1]: /windows/client-management/mdm/policy-csp-start \ No newline at end of file diff --git a/windows/configuration/start/layout.md b/windows/configuration/start/layout.md new file mode 100644 index 0000000000..30baa389a1 --- /dev/null +++ b/windows/configuration/start/layout.md @@ -0,0 +1,651 @@ +--- +title: Customize the Start layout +description: Learn how to customize the Windows Start layout, export its configuration, and deploy the customization to other devices. +ms.topic: how-to +ms.date: 04/10/2024 +zone_pivot_groups: windows-versions-11-10 +appliesto: +--- + +# Customize the Start layout + +Implementing a customized Start layout across your organization's devices empowers administrators with direct control over the Start menu configuration. With this capability, you can specify a tailored set of pinned applications, arranged according to preference. Utilize this feature to strategically pin desired apps, eliminate default pinned apps, and organize the application display to align with operational requirements. + +This article describes how to customize the Start layout, export its configuration, and deploy the customization to other devices. + +> [!NOTE] +> If you are looking for OEM information, see the article [Customize the Start layout](/windows-hardware/customize/desktop/customize-the-windows-11-start-menu). + +## Customization process + +To customize the Windows Start layout and deploy its configuration to other devices, follow these steps: + +1. Configure the Start layout to meet your requirements from a reference device +1. Export the Start layout configuration to a configuration file +1. Deploy the configuration file using one of the available options + +> [!TIP] +> While you can create your own configuration file, it's easier and faster to export the layout from an existing device. + +### Customize the Start layout on a reference device + +To prepare a Start layout for export, customize the Start layout on a reference device. To prepare a reference device: + +1. Set up a device on which to customize the Start layout, which should have the operating system that is installed on the users' devices +1. Install all apps and services that the Start layout should display +1. Create a new user account that you use to customize the Start layout + +To customize Start: + +::: zone pivot="windows-10" + +1. Sign in to the reference device with the user account that you created +1. Customize the Start layout as you want users to see it by using the following techniques: + + - **Pin apps to Start**. From Start, type the name of the app. When the app appears in the search results, right-click the app and select **Pin to Start** + To view all apps, select **All apps**. Right-click any app, and pin or unpin it from Start + - **Unpin apps** that you don't want to display. To unpin an app, right-click the app, and then select **Unpin from Start** + - **Drag existing apps** on Start to reorder or group them + - **Resize tiles**. To resize tiles, right-click the tile and then select **Resize** + - **Create your own app groups**. Drag the apps to an empty area. To name a group, select above the group of tiles and then type the name in the **Name group** field that appears above the group + +> [!IMPORTANT] +> If the Start layout includes tiles for apps that are not installed on the target device, the tiles for those apps will be blank. The blank tiles persist until the next time the user signs in, at which time the blank tiles are removed. + +::: zone-end + +::: zone pivot="windows-11" + +1. Sign in to the reference device with the user account that you created +1. Customize the **Pinned** section of the Start layout as you want users to see it by using the following techniques: + + - **Pin apps to Start**. From Start, type the name of the app. When the app appears in the search results, right-click the app and select **Pin to Start** + To view all apps, select **All apps**. Right-click any app, and pin or unpin it from Start + - **Unpin apps** that you don't want to display. To unpin an app, right-click the app, and then select **Unpin from Start** + - **Drag existing apps** on Start to reorder them + +> [!IMPORTANT] +> If the Start layout includes pins for apps that aren't installed on the target device, the pins for those apps aren't created until the apps are installed. + +::: zone-end + +### Export the Start layout configuration + +Once the Start layout is configured to meet your requirements, use the Windows PowerShell [Export-StartLayout][PS-1] cmdlet to export the existing layout to a configuration file. + +::: zone pivot="windows-10" +The exported customization consists of an XML file containing a list of tiles that define the Start layout. + +> [!NOTE] +> You can find the default Start layout template in `%LOCALAPPDATA%\Microsoft\windows\Shell\DefaultLayouts.xml`. + +To export the Start layout to an XML file: + +1. While signed in with the same account that you used to customize Start, create a folder to save the `.xml` file. For example, create the `C:\Layouts` folder +1. Open Windows PowerShell +1. Run the following cmdlet: + + ```powershell + Export-StartLayout -UseDesktopApplicationID -Path "C:\Layouts\LayoutModification.xml" + ``` + +1. (Optional) Edit the XML file to add [a taskbar configuration](../taskbar/configure.md) or to make any modifications to the Start layout + +::: zone-end + +::: zone pivot="windows-11" + +The exported customization consists of a JSON file containing a list of pins that define the Start layout. + +To export the Start layout to a JSON file: + +1. While signed in with the same account that you used to customize Start, create a folder to save the `.json` file. For example, create the `C:\Layouts` folder +1. Open Windows PowerShell +1. Run the following cmdlet: + + ```powershell + Export-StartLayout -Path "C:\Layouts\LayoutModification.json" + ``` + +::: zone-end + +### Start layout example + +Here you can find an example of Start layout that you can use as a reference: + +[!INCLUDE [example-start-layout](includes/example-start-layout.md)] + +### Change the configuration file + +::: zone pivot="windows-10" + +> [!CAUTION] +> When you make changes to the exported layout, be aware that the XML file must adhere to an [XML schema definition (XSD)](xsd.md). +> +> The XML file requires the following order for tags directly under the `LayoutModificationTemplate` node: +> +> 1. `LayoutOptions` +> 1. `DefaultLayoutOverride` +> 1. `RequiredStartGroupsCollection` +> 1. `AppendDownloadOfficeTile` - OR - `AppendOfficeSuite` (only one Office option can be used at a time) +> 1. `AppendOfficeSuiteChoice` +> 1. `TopMFUApps` +> 1. `CustomTaskbarLayoutCollection` +> 1. `InkWorkspaceTopApps` +> 1. `StartLayoutCollection` +> +> Comments are not supported in the `LayoutModification.xml` file. + +> [!NOTE] +> `RequiredStartGroupsCollection` and `AppendGroup` syntax only apply when the `Import-StartLayout` method is used for building and deploying Windows images. + +You can edit the XML file to make any modifications to the Start layout. For example, you can include `` to include the Taskbar customization. + +If the Start layout that you export contains tiles for desktop apps or URL links, `Export-StartLayout` uses `DesktopApplicationLinkPath` in the resulting file. Use a text or XML editor to change `DesktopApplicationLinkPath` to `DesktopApplicationID`. + +For scripts and application tile pins to work correctly, follow these rules: + +- Executable files and scripts should be listed in `%ProgramFiles%` or wherever the installer of the app places them +- Shortcuts that pin to Start should be placed in `%ProgramData%\Microsoft\Windows\Start Menu\Programs` +- If you place executable files or scripts in the `%ProgramData%\Microsoft\Windows\Start Menu\Programs` folder, they don't pin to Start + +> [!NOTE] +> All devices that you apply the Start layout to, must have the apps and other shortcuts present on the local system in the same location as the source for the Start layout. + +After you export the layout, decide whether you want to apply a *full* Start layout or a *partial* Start layout: + +- When a full Start layout is applied, the users can't pin, unpin, or uninstall apps from Start. Users can view and open all apps in the **All Apps** view, but they can't pin any apps to Start +- When a partial Start layout is applied, the contents of the specified tile groups can't be changed, but users can move those groups, and can also create and customize their own groups + +### Supported elements and attributes + +| Element | Description | +|--|--| +| `LayoutModificationTemplate` | Use to describe the changes to the default Start layout | +| [LayoutOptions](#layoutoptions) | Use to specify:
                        - Whether to use full screen Start on the desktop
                        - The number of tile columns in the Start menu | +| `RequiredStartGroupsCollection` | Use to contain collection of `RequiredStartGroups` | +| [RequiredStartGroups](#requiredstartgroups) | Use to contain the `AppendGroup` tags, which represent groups that can be appended to the default Start layout | +| [AppendGroup](#appendgroup) | Use to specify the tiles that need to be appended to the default Start layout | +| [start:Tile](#specify-start-tiles) | Use to specify a UWP app | +| `start:Folder`| Use to specify a folder of icons; can include [Tile](#starttile), [SecondaryTile](#startsecondarytile), and [DesktopApplicationTile](#startdesktopapplicationtile) | +| [start:DesktopApplicationTile](#startdesktopapplicationtile) | Use to specify any of the following:
                        - A Windows desktop application with a known AppUserModelID
                        - An application in a known folder with a link in a legacy Start Menu folder
                        - A Windows desktop application link in a legacy Start Menu folder
                        - A Web link tile with an associated `.url` file that is in a legacy Start Menu folder | +| [start:SecondaryTile](#startsecondarytile) | Use to pin a Web link through a Microsoft Edge secondary tile | +| [AppendOfficeSuite](#appendofficesuite) | Use to add the in-box installed Office suite to Start. For more information, see [Customize the Office suite of tiles](/windows-hardware/customize/desktop/customize-start-layout#customize-the-office-suite-of-tiles).

                        Don't use this tag with `AppendDownloadOfficeTile` | +| [AppendDownloadOfficeTile](#appenddownloadofficetile) | Use to add a specific **Download Office** tile to a specific location in Start

                        Do not use this tag with `AppendOfficeSuite` | + +#### LayoutOptions + +New devices running Windows 10 for desktop editions default to a Start menu with two columns of tiles unless boot to tablet mode is enabled. Devices with screens that are under 10" have boot to tablet mode enabled by default. For these devices, users see the full screen Start on the desktop. You can adjust the following features: + +- Boot to tablet mode can be set on or off +- Set full screen Start on desktop to on or off + To do this, add the `LayoutOptions` element in your LayoutModification.xml file and set the FullScreenStart attribute to true or false +- Specify the number of columns in the Start menu to 1 or 2 + To do this, add the `LayoutOptions` element in your LayoutModification.xml file and set the StartTileGroupsColumnCount attribute to 1 or 2 + +The following example shows how to use the `LayoutOptions` element to specify full screen Start on the desktop and to use one column in the Start menu: + +```xml + +``` + +#### RequiredStartGroups + +The `RequiredStartGroups` tag contains `AppendGroup` tags that represent groups that you can append to the default Start layout. + +The groups have the following constraints: + +- Two groups that are six columns wide, or equivalent to the width of three medium tiles +- Two medium-sized tile rows in height. Windows ignores any tiles that are pinned beyond the second row +- No limit to the number of apps that can be pinned. There's a theoretical limit of 24 tiles per group (four small tiles per medium square x three columns x two rows) + +>[!IMPORTANT] +>You can add a maximum of two `AppendGroup` tags per `RequiredStartGroups` tag. + +You can also assign regions to the append groups in the `RequiredStartGroups` tag's using the optional `Region` attribute or you can use the multivariant capabilities in Windows provisioning. If you're using the `Region` attribute, you must use a two-letter country code to specify the country/region that the append group(s) apply to. To specify more than one country/region, use a pipe (`|`) delimiter as shown in the following example: + +```XML + +``` + +- If the country/region setting for the Windows device matches a `RequiredStartGroups`, then the tiles laid out within the `RequiredStartGroups` is applied to Start +- If you specify a region-agnostic `RequiredStartGroups` (or one without the optional Region attribute), then the region-agnostic `RequiredStartGroups` is applied to Start + +#### AppendGroup + +`AppendGroup` tags specify a group of tiles to append to Start. There's a maximum of two `AppendGroup` tags allowed per `RequiredStartGroups` tag. + +For Windows 10 for desktop editions, AppendGroup tags contain `start:Tile`, `start:DesktopApplicationTile`, or `start:SecondaryTile` tags. + +You can specify any number of tiles in an `AppendGroup`, but you can't specify a tile with a `Row` attribute greater than one. The Start layout doesn't support overlapping tiles. + +#### Specify Start tiles + +To pin tiles to Start, partners must use the right tile depending on what you want to pin. + +#### Tile size and coordinates + +All tile types require a size (`Size`) and coordinates (`Row` and `Column`) attributes, regardless of the tile type that you use when prepinning items to Start. + +The following table describes the attributes that you must use to specify the size and location for the tile. + +| Attribute | Description | +| --- | --- | +| `Size` | Determines how large the tile is.

                        - 1x1 - small tile
                        - 2x2 - medium tile
                        - 4x2 - wide tile
                        - 4x4 - large tile | +| `Row` | Specifies the row where the tile appears. | +| `Column` | Specifies the column where the tile appears. | + +For example, a tile with `Size="2x2"`, `Row="2"`, and `Column="2"` results in a tile located at (2,2) where (0,0) is the top-left corner of a group. + +#### start:Tile + +You can use the `start:Tile` tag to pin a UWP app to Start. You must set the `AppUserModelID` attribute to the application user model ID (AUMID) of the corresponding app. + +#### start:DesktopApplicationTile + +You can use the `start:DesktopApplicationTile` tag to pin a Windows desktop application to Start. There are two ways you can specify a Windows desktop application: + +- Use a path to a shortcut link (.lnk file) to a Windows desktop application. + + >[!NOTE] + >Use `DesktopApplicationID` rather than `DesktopApplicationLinkPath` if the application is installed after the user's first sign-in. + + To pin a Windows desktop application through this method, you must first add the `.lnk` file in the specified location when the device first boots. + + The following example shows how to pin the Command Prompt: + + ```XML + + ``` + + You must set the `DesktopApplicationLinkPath` attribute to the .lnk file that points to the Windows desktop application. The path also supports environment variables. + + If you're pointing to a third-party Windows desktop application and the layout is being applied before the first boot, you must put the `.lnk` file in a legacy Start Menu directory before first boot. For example, `%APPDATA%\Microsoft\Windows\Start Menu\Programs\` or the all users profile `%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\`. + +- Use the AUMID, if this is known. If the Windows desktop application doesn't have one, use the shortcut link option. + +Learn how to [Find the Application User Model ID of an installed app](../store/find-aumid.md). + + The following example shows how to pin the File Explorer Windows desktop application: + + ```XML + + ``` + +You can also use the `start:DesktopApplicationTile` tag as one of the methods for pinning a Web link to Start. The other method is to use a Microsoft Edge secondary tile. + +To pin a legacy `.url` shortcut to Start, you must create a `.url` file (right-click on the desktop, select **New** > **Shortcut**, and then type a Web URL). You must add this `.url` file in a legacy Start Menu directory before first boot; for example, `%APPDATA%\Microsoft\Windows\Start Menu\Programs\` or the all users profile `%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\`. + +The following example shows how to create a tile of the Web site's URL, which you can treat similarly to a Windows desktop application tile: + +```XML + +``` + +>[!NOTE] +>`Export-StartLayout` uses `DesktopApplicationLinkPath` for the .url shortcut. You must change `DesktopApplicationLinkPath` to `DesktopApplicationID` and provide the URL. + +#### start:SecondaryTile + +You can use the `start:SecondaryTile` tag to pin a web link through a Microsoft Edge secondary tile. This method doesn't require more actions compared to the method of using legacy `.url` shortcuts (through the `start:DesktopApplicationTile` tag). + +The following example shows how to create a tile of the Web site's URL using the Microsoft Edge secondary tile: + +```XML + +``` + +The following table describes the other attributes that you can use with the `start:SecondaryTile` tag in addition to `Size`, `Row`, and `Column`. + +| Attribute | Required/optional | Description | +| --- | --- | --- | +| `AppUserModelID` | Required | Must point to Microsoft Edge. | +| `TileID` | Required | Must uniquely identify your Web site tile. | +| `Arguments` | Required | Must contain the URL of your Web site. | +| `DisplayName` | Required | Must specify the text that you want users to see. | +| `Square150x150LogoUri` | Required | Specifies the logo to use on the 2x2 tile. | +| `Wide310x150LogoUri` | Optional | Specifies the logo to use on the 4x2 tile. | +| `ShowNameOnSquare150x150Logo` | Optional | Specifies whether the display name is shown on the 2x2 tile. The values you can use for this attribute are true or false. | +| `ShowNameOnWide310x150Logo` | Optional | Specifies whether the display name is shown on the 4x2 tile. The values you can use for this attribute are true or false. | +| `BackgroundColor` | Optional | Specifies the color of the tile. You can specify the value in ARGB hexadecimal (for example, `#FF112233`) or specify `transparent`. | +| `ForegroundText` | Optional | Specifies the color of the foreground text. Set the value to either `light` or `dark`. | + +Secondary Microsoft Edge tiles have the same size and location behavior as a Universal Windows app, Windows 8 app, or Windows 8.1 app. + +#### AppendOfficeSuite + +You can use the `AppendOfficeSuite` tag to add the in-box installed Office suite of apps to Start. + +>[!NOTE] +>The OEM must have installed Office for this tag to work. + +The following example shows how to add the `AppendOfficeSuite` tag to your `LayoutModification.xml` file to append the Office suite to Start: + +```XML + + + +``` + +#### AppendOfficeSuiteChoice + +You have two options in this tag: + +- `` +- `` + +Use `Choice=DesktopBridgeSubscription` on devices that have Office 365 preinstalled. This sets the heading of the Office suite of tiles to `Office 365`, to highlight the Office 365 apps that you've made available on the device. + +Use `Choice=DesktopBridge` on devices shipping with [perpetual licenses for Office](/archive/blogs/ausoemteam/choosing-the-right-office-version-for-your-customers). This sets the heading of the Office suite of tiles to **Create**. + +For more information, see [Customize the Office suite of tiles](/windows-hardware/customize/desktop/customize-start-layout#customize-the-office-suite-of-tiles). + +#### AppendDownloadOfficeTile + +You can use the `AppendDownloadOfficeTile` tag to append the Office trial installer to Start. This tag adds the **Download Office** tile to Start and the download tile will appear at the bottom right-hand side of the second group. + +>[!NOTE] +>The OEM must have installed the Office trial installer for this tag to work. + +The following example shows how to add the `AppendDownloadOfficeTile` tag to your LayoutModification.xml file: + +```XML + + + +``` + +#### Configure a partial Start layout + +:::row::: +:::column span="2"::: + +A partial Start layout enables you to add one or more customized tile groups to users' Start screens or menus, while still allowing users to make changes to other parts of the Start layout. All groups that you add are *locked*, meaning users can't change the contents of those tile groups, however users can change the location of those groups. Locked groups are identified with an icon, as shown in the following image. + +:::column-end::: +:::column span="2"::: + +:::image type="content" source="images/windows-10-partial-layout.png" alt-text="Screenshot of the Windows 10 Start menu with partial layout." lightbox="images/windows-10-partial-layout.png"::: + +:::column-end::: +:::row-end::: + +When a partial Start layout is applied for the first time, the new groups are added to the users' existing Start layouts. If an app tile is in both an existing group and in a new locked group, the duplicate app tile is removed from the existing (unlocked) group. + +If you apply a partial Start layout to a device with an existing Start layout applied, groups that were added previously are removed, and the groups in the new layout are added. + +> [!NOTE] +> If you remove the policy setting, the groups remain on the devices but become unlocked. + +To configure a partial Start screen layout, modify the `` element as follows: + +```xml + +``` + +::: zone-end + +::: zone pivot="windows-11" + +You can edit the JSON file to make any modifications to the **Pinned** section of the Start layout. For example, you can change the order of the pinned elements, or add new apps. + +1. Open the `LayoutModification.json` file in a JSON editor, such as Visual Studio Code or Notepad +1. The `pinnedList` section includes all the pins that are applied to the Start layout + +You can add more apps to the section using the following keys: + +| Key | Description | +|--|--| +| `packagedAppID` | Used for Universal Windows Platform (UWP) apps. To pin a UWP app, use the app's AUMID. | +| `desktopAppID` | Used for desktop apps. To pin a desktop app, use the app's AUMID. If the app doesn't have an AUMID, use the `desktopAppLink` instead. | +| `desktopAppLink` | Used for desktop apps that don't have an associated AUMID. To pin this type of app, use the path to the `.lnk` shortcut that points to the app. | + +::: zone-end + +Learn how to [Find the Application User Model ID of an installed app](../store/find-aumid.md). + +### Deploy the Start layout configuration + +[!INCLUDE [tab-intro](../../../includes/configure/tab-intro.md)] + +::: zone pivot="windows-10" + +#### [:::image type="icon" source="../images/icons/intune.svg"::: **Intune/CSP**](#tab/intune-10) + +To configure devices with Microsoft Intune, [create a Settings catalog policy](/mem/intune/configuration/settings-catalog) and use one of the following settings: + +| Category | Setting name | Value | +|--|--|--| +| **Start** | Start Layout | Content of the XML file| +| **Start** | Start Layout (User) | Content of the XML file| + +[!INCLUDE [intune-settings-catalog-2](../../../includes/configure/intune-settings-catalog-2.md)] + +Alternatively, you can configure devices using a [custom policy][MEM-1] with the [Start CSP][WIN-1]. Use one of the following settings: + +| Setting | +|--| +| - **OMA-URI:** `./User/Vendor/MSFT/Policy/Config/Start/`[StartLayout](/windows/client-management/mdm/policy-csp-Start#startlayout)
                        - **String:**
                        - **Value:** content of the XML file | +| - **OMA-URI:** `./Device/Vendor/MSFT/Policy/Config/Start/`[StartLayout](/windows/client-management/mdm/policy-csp-Start#startlayout)
                        - **Data type:**
                        - **Value:** content of the XML file | + +[!INCLUDE [intune-custom-settings-2](../../../includes/configure/intune-custom-settings-2.md)] + +#### [:::image type="icon" source="../images/icons/provisioning-package.svg"::: **PPKG**](#tab/ppkg-10) + +[!INCLUDE [provisioning-package-1](../../../includes/configure/provisioning-package-1.md)] + +- **Path:** `Policies/Start/StartLayout` +- **Value:** content of the XML file + +> [!NOTE] +> The content of the file must be entered as a single line in the `Value` field. Use a text editor to remove any line breaks from the XML file, usually with a function called *join lines*. + +[!INCLUDE [provisioning-package-2](../../../includes/configure/provisioning-package-2.md)] + +### Use Windows Provisioning multivariant support + +The Windows Provisioning multivariant capability allows you to declare target conditions that, when met, supply specific customizations for each variant condition. For Start customization, you can create specific layouts for each variant that you have. To do this, you must create a separate LayoutModification.xml file for each variant that you want to support and then include these in your provisioning package. For more information on how to do this, see [Create a provisioning package with multivariant settings](../provisioning-packages/provisioning-multivariant.md). + +The provisioning engine chooses the right customization file based on the target conditions that were met, adds the file in the location that's specified for the setting, and then uses the specific file to customize Start. To differentiate between layouts, you can add modifiers to the LayoutModification.xml filename such as "LayoutCustomization1". Regardless of the modifier that you use, the provisioning engine will always output "LayoutCustomization.xml" so that the operating system has a consistent file name to query against. + +For example, if you want to ensure that there's a specific layout for a certain condition, you can: + +1. Create a specific layout customization file and then name it LayoutCustomization1.xml +1. Include the file as part of your provisioning package +1. Create your multivariant target and reference the XML file within the target condition in the main customization XML file + +The following example shows what the overall customization file might look like with multivariant support for Start: + +```XML + + + + {6aaa4dfa-00d7-4aaa-8adf-73c6a7e2501e} + My Provisioning Package + 1.0 + OEM + 50 + + + + + + + + + + + + + + + + + 1 + 1 + 1 + + + 1 + + + + + + + + + c:\users\\appdata\local\Microsoft\Windows\Shell\LayoutCustomization1.XML + + 1 + + + + + + +``` + +When the condition is met, the provisioning engine takes the XML file and places it in the location that the operating system has set and then the Start subsystem reads the file and applies the specific customized layout. + +You must repeat this process for all variants that you want to support so that each variant can have a distinct layout for each of the conditions and targets that need to be supported. For example, if you add a `Language` condition, you can create a Start layout that has its own localized group. + +#### [:::image type="icon" source="../images/icons/group-policy.svg"::: **GPO**](#tab/gpo) + +To configure a device with group policy, use the [Local Group Policy Editor](/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc731745(v=ws.10)). To configure multiple devices joined to Active Directory, [create or edit](/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc754740(v=ws.11)) a group policy object (GPO) and use one of the following settings: + +| Group policy path | Group policy setting | Value | +| - | - | - | +|**Computer Configuration** > **Administrative Templates** > **Start Menu and Taskbar**| Start Layout | Path to the XML file | +|**User Configuration** > **Administrative Templates** > **Start Menu and Taskbar**| Start Layout | Path to the XML file | + +[!INCLUDE [gpo-settings-2](../../../includes/configure/gpo-settings-2.md)] + +The GPO applies the Start and taskbar layout at the next user sign-in. Each time the user signs in, the timestamp of the .xml file with the Start and taskbar layout is checked and if a newer version of the file is available, the settings in the latest version of the file are applied. + +--- + +>[!NOTE] +>You can apply a Start layout to a mounted Windows image, with the PowerShell [Import-StartLayout](/powershell/module/startlayout/import-startlayout) cmdlet. +>Don't include XML Prologs like \ in the Start layout XML file. + +::: zone-end + +::: zone pivot="windows-11" + +> [!IMPORTANT] +> The JSON file can be applied to devices using the [Start policy CSP][WIN-1] only. It's not possible to apply the JSON file using group policy. + +#### [:::image type="icon" source="../images/icons/intune.svg"::: **Intune/CSP**](#tab/intune-11) + +To configure devices with Microsoft Intune, [create a Settings catalog policy](/mem/intune/configuration/settings-catalog) and use one of the following settings: + +| Category | Setting name | Value | +|--|--|--| +| **Start** | Configure Start Pins | Content of the JSON file| +| **Start** | Configure Start Pins (User) | Content of the JSON file| + +[!INCLUDE [intune-settings-catalog-2](../../../includes/configure/intune-settings-catalog-2.md)] + +Alternatively, you can configure devices using a [custom policy][MEM-1] with the [Start CSP][WIN-1]. Use one of the following settings: + +| Setting | +|--| +| - **OMA-URI:** `./User/Vendor/MSFT/Policy/Config/Start/`[ConfigureStartPins](/windows/client-management/mdm/policy-csp-Start#configurestartpins)
                        - **String:**
                        - **Value:** content of the JSON file | +| - **OMA-URI:** `./Device/Vendor/MSFT/Policy/Config/Start/`[ConfigureStartPins](/windows/client-management/mdm/policy-csp-Start#configurestartpins)
                        - **Data type:**
                        - **Value:** content of the JSON file | + +[!INCLUDE [intune-custom-settings-2](../../../includes/configure/intune-custom-settings-2.md)] + +#### [:::image type="icon" source="../images/icons/provisioning-package.svg"::: **PPKG**](#tab/ppkg-11) + +[!INCLUDE [provisioning-package-1](../../../includes/configure/provisioning-package-1.md)] + +- **Path:** `Policies/Start/ConfigureStartPins` +- **Value:** content of the JSON file + +> [!NOTE] +> The content of the file must be entered as a single line in the `Value` field. Use a text editor to remove any line breaks from the JSON file, usually with a function called *join lines*. + +[!INCLUDE [provisioning-package-2](../../../includes/configure/provisioning-package-2.md)] + +--- + +::: zone-end + +## User experience + +:::row::: +:::column span="2"::: + +After the settings are applied, sign in to the device. The Start layout that you configured is applied to the Start menu. + +::: zone pivot="windows-10" + +When a full Start layout is applied with policy settings, users can't pin, unpin, or uninstall apps from Start. Users can view and open all apps in the **All Apps** view, but they can't change the Start layout. When you apply a partial Start layout, the content of the specified tile groups can't be changed, but users can move the groups, and can create and customize their own groups. + +::: zone-end + +::: zone pivot="windows-11" + +When you configure the Start layout with policy settings, you overwrite the entire layout. Users can change the order of the pinned elements, pin, or unpin items. When a user signs in again, the Start layout specified in the policy setting is reapplied, without retaining any user changes. + +::: zone-end + +:::column-end::: +:::column span="2"::: +::: zone pivot="windows-10" + :::image type="content" source="images/windows-10.png" alt-text="Screenshot of the Windows 10 Start menu." border="false" lightbox="images/windows-10.png"::: +::: zone-end + +::: zone pivot="windows-11" + :::image type="content" source="images/windows-11.png" alt-text="Screenshot of the Windows 11 Start menu." border="false" lightbox="images/windows-11.png"::: +::: zone-end + +:::column-end::: +:::row-end::: + +## Next steps + +- To learn more about the policy settings available to configure the Start menu using the Configuration Service Provider (CSP) and Group Policy (GPO), see [Start menu policy settings](policy-settings.md). +- To learn how to configure the taskbar, see [Configure the Windows taskbar](../taskbar/index.md). + + + +[MEM-1]: /mem/intune/configuration/custom-settings-windows-10 +[PS-1]: /powershell/module/startlayout/export-startlayout +[WIN-1]: /windows/client-management/mdm/policy-csp-start diff --git a/windows/configuration/start/policy-settings.md b/windows/configuration/start/policy-settings.md new file mode 100644 index 0000000000..9dd5437ffc --- /dev/null +++ b/windows/configuration/start/policy-settings.md @@ -0,0 +1,194 @@ +--- +title: Start policy settings +description: Learn about the policy settings to configure the Windows Start menu. +ms.topic: reference +ms.date: 04/10/2024 +appliesto: +zone_pivot_groups: windows-versions-11-10 +--- + +# Start menu policy settings + +This reference article outlines the policy settings available for customizing the Start menu experience, using Configuration Service Provider (CSP) or group policy (GPO). For information about how to configure these settings, see [Configure the Start menu](index.md). + +The settings are categorized and presented in alphabetical order to facilitate navigation and configuration. + +:::row::: +:::column span="2"::: + +1. **Start layout**: settings to control the Start menu appearance and its behavior +1. **All apps options**: settings to control the All apps list +1. **Account options**: settings to control the options exposed when selecting the user account icon +1. **Pinned folders**: settings to control the folders pinned for quick access +1. **Power options**: settings to control the options exposed when selecting the power button + +:::column-end::: +:::column span="2"::: +::: zone pivot="windows-10" + :::image type="content" source="./images/windows-10-settings.png" alt-text="Sample start menu layout with its components highlighted." border="false" lightbox="./images/windows-10-settings.png"::: +::: zone-end + +::: zone pivot="windows-11" + :::image type="content" source="./images/windows-11-settings.png" alt-text="Sample start menu layout with its components highlighted." border="false" lightbox="./images/windows-11-settings.png"::: +::: zone-end + + :::column-end::: +:::row-end::: + +Select one of the tabs to see the list of available settings: + +#### [:::image type="icon" source="../images/icons/start.svg"::: **Layout**](#tab/start) + +::: zone pivot="windows-11" +|Policy name| CSP | GPO | +|-|-|-| +|[Configure Start pins](#configure-start-pins)|✅|❌| +|[Disable context menus](#disable-context-menus)|✅|✅| +|[Disable search](#disable-search)|✅|✅| +|[Don't use the search-based method when resolving shell shortcuts](#dont-use-the-search-based-method-when-resolving-shell-shortcuts)|❌|✅| +|[Don't use the tracking-based method when resolving shell shortcuts](#dont-use-the-tracking-based-method-when-resolving-shell-shortcuts)|❌|✅| +|[Prevent changes to Taskbar and Start Menu Settings](#prevent-changes-to-taskbar-and-start-menu-settings)|❌|✅| +|[Prevent users from customizing their Start](#prevent-users-from-customizing-their-start)|❌|✅| +|[Prevent users from uninstalling applications from Start](#prevent-users-from-uninstalling-applications-from-start)|❌|✅| +|[Remove common program groups](#remove-common-program-groups)|❌|✅| +|[Show **Run as different user** command](#show-run-as-different-user-command)|❌|✅| + +### Recommended section + +|Policy name| CSP | GPO | +|-|-|-| +|[Clear history of recently opened documents on exit](#clear-history-of-recently-opened-documents-on-exit)|❌|✅| +|[Hide recently added apps](#hide-recently-added-apps)|✅|✅| +|[Hide recent jumplists](#hide-recent-jumplists)|✅|✅| +|[Hide recommended personalized sites](#hide-recommended-personalized-sites)|✅|✅| +|[Hide recommended section](#hide-recommended-section)|✅|✅| + +::: zone-end + +::: zone pivot="windows-10" +|Policy name| CSP | GPO | +|-|-|-| +|[Clear history of recently opened documents on exit](#clear-history-of-recently-opened-documents-on-exit)|❌|✅| +|[Clear tile notifications during log on](#clear-tile-notifications-during-log-on)|❌|✅| +|[Configure Start layout](#configure-start-layout)|✅|✅| +|[Disable context menus](#disable-context-menus)|✅|✅| +|[Don't use the search-based method when resolving shell shortcuts](#dont-use-the-search-based-method-when-resolving-shell-shortcuts)|❌|✅| +|[Don't use the tracking-based method when resolving shell shortcuts](#dont-use-the-tracking-based-method-when-resolving-shell-shortcuts)|❌|✅| +|[Force Start size](#force-start-size)|✅|✅| +|[Hide recently added apps](#hide-recently-added-apps)|✅|✅| +|[Import Edge assets](#import-edge-assets)|✅|❌| +|[Prevent changes to Taskbar and Start Menu Settings](#prevent-changes-to-taskbar-and-start-menu-settings)|❌|✅| +|[Prevent users from customizing their Start](#prevent-users-from-customizing-their-start)|❌|✅| +|[Prevent users from uninstalling applications from Start](#prevent-users-from-uninstalling-applications-from-start)|❌|✅| +|[Remove common program groups](#remove-common-program-groups)|❌|✅| +|[Show **Run as different user** command](#show-run-as-different-user-command)|❌|✅| +::: zone-end + +[!INCLUDE [clear-history-of-recently-opened-documents-on-exit](includes/clear-history-of-recently-opened-documents-on-exit.md)] +::: zone pivot="windows-10" +[!INCLUDE [clear-tile-notifications-during-log-on](includes/clear-tile-notifications-during-log-on.md)] +[!INCLUDE [configure-start-layout](includes/configure-start-layout.md)] +::: zone-end +::: zone pivot="windows-11" +[!INCLUDE [configure-start-pins](includes/configure-start-pins.md)] +::: zone-end +[!INCLUDE [disable-context-menus](includes/disable-context-menus.md)] +::: zone pivot="windows-11" +[!INCLUDE [disable-search](includes/disable-search.md)] +::: zone-end +[!INCLUDE [do-not-use-the-search-based-method-when-resolving-shell-shortcuts](includes/do-not-use-the-search-based-method-when-resolving-shell-shortcuts.md)] +[!INCLUDE [do-not-use-the-tracking-based-method-when-resolving-shell-shortcuts](includes/do-not-use-the-tracking-based-method-when-resolving-shell-shortcuts.md)] +::: zone pivot="windows-10" +[!INCLUDE [force-start-size](includes/force-start-size.md)] +::: zone-end +[!INCLUDE [hide-recently-added-apps](includes/hide-recently-added-apps.md)] +[!INCLUDE [hide-recent-jumplists](includes/hide-recent-jumplists.md)] +::: zone pivot="windows-11" +[!INCLUDE [hide-recommended-personalized-sites](includes/hide-recommended-personalized-sites.md)] +[!INCLUDE [hide-recommended-section](includes/hide-recommended-section.md)] +::: zone-end +::: zone pivot="windows-10" +[!INCLUDE [import-edge-assets](includes/import-edge-assets.md)] +::: zone-end +[!INCLUDE [prevent-changes-to-taskbar-and-start-menu-settings](includes/prevent-changes-to-taskbar-and-start-menu-settings.md)] +[!INCLUDE [prevent-users-from-customizing-their-start](includes/prevent-users-from-customizing-their-start.md)] +[!INCLUDE [prevent-users-from-uninstalling-applications-from-start](includes/prevent-users-from-uninstalling-applications-from-start.md)] +[!INCLUDE [remove-common-program-groups](includes/remove-common-program-groups.md)] +[!INCLUDE [show-run-as-different-user-command](includes/show-run-as-different-user-command.md)] + +#### [:::image type="icon" source="../images/icons/allapps.svg"::: **All apps**](#tab/allapps) + +|Policy name| CSP | GPO | +|-|-|-| +|[Clear the recent programs list for new users](#clear-the-recent-programs-list-for-new-users)|❌|✅| +|[Hide app list](#hide-app-list)|✅|✅| +|[Hide frequently used apps](#hide-frequently-used-apps)|✅|✅| +|[Hide most used lists](#hide-most-used-lists)|✅|✅| + +[!INCLUDE [clear-the-recent-programs-list-for-new-users](includes/clear-the-recent-programs-list-for-new-users.md)] +[!INCLUDE [hide-app-list](includes/hide-app-list.md)] +[!INCLUDE [hide-frequently-used-apps](includes/hide-frequently-used-apps.md)] +[!INCLUDE [hide-most-used-lists](includes/hide-most-used-lists.md)] + +#### [:::image type="icon" source="../images/icons/user.svg"::: **Account options**](#tab/user) + +|Policy name| CSP | GPO | +|-|-|-| +|[Hide **Change account settings**](#hide-change-account-settings)|✅|❌| +|[Hide **Lock**](#hide-lock)|✅|❌| +|[Hide **Sign out**](#hide-sign-out)|✅|✅| +|[Hide **Switch account**](#hide-switch-account)|✅|❌| +|[Hide user tile](#hide-user-tile)|✅|❌| + +[!INCLUDE [hide-change-account-settings](includes/hide-change-account-settings.md)] +[!INCLUDE [hide-lock](includes/hide-lock.md)] +[!INCLUDE [hide-signout](includes/hide-signout.md)] +[!INCLUDE [hide-switch-user](includes/hide-switch-account.md)] +[!INCLUDE [hide-switch-user](includes/hide-user-tile.md)] + +#### [:::image type="icon" source="../images/icons/folder.svg"::: **Pinned folders**](#tab/folders) + +|Policy name| CSP | GPO | +|-|-|-| +|[Allow pinned folder Documents](#allow-pinned-folder-documents)|✅|❌| +|[Allow pinned folder Downloads](#allow-pinned-folder-downloads)|✅|❌| +|[Allow pinned folder File Explorer](#allow-pinned-folder-file-explorer)|✅|❌| +|[Allow pinned folder Home Group](#allow-pinned-folder-home-group)|✅|❌| +|[Allow pinned folder Music](#allow-pinned-folder-music)|✅|❌| +|[Allow pinned folder Network](#allow-pinned-folder-network)|✅|❌| +|[Allow pinned folder Personal Folder](#allow-pinned-folder-personal-folder)|✅|❌| +|[Allow pinned folder Pictures](#allow-pinned-folder-pictures)|✅|❌| +|[Allow pinned folder Settings](#allow-pinned-folder-settings)|✅|❌| +|[Allow pinned folder Videos](#allow-pinned-folder-videos)|✅|❌| + +[!INCLUDE [allow-pinned-folder-documents](includes/allow-pinned-folder-documents.md)] +[!INCLUDE [allow-pinned-folder-downloads](includes/allow-pinned-folder-downloads.md)] +[!INCLUDE [allow-pinned-folder-file-explorer](includes/allow-pinned-folder-file-explorer.md)] +[!INCLUDE [allow-pinned-folder-home-group](includes/allow-pinned-folder-home-group.md)] +[!INCLUDE [allow-pinned-folder-music](includes/allow-pinned-folder-music.md)] +[!INCLUDE [allow-pinned-folder-network](includes/allow-pinned-folder-network.md)] +[!INCLUDE [allow-pinned-folder-personal-folder](includes/allow-pinned-folder-personal-folder.md)] +[!INCLUDE [allow-pinned-folder-pictures](includes/allow-pinned-folder-pictures.md)] +[!INCLUDE [allow-pinned-folder-settings](includes/allow-pinned-folder-settings.md)] +[!INCLUDE [allow-pinned-folder-videos](includes/allow-pinned-folder-videos.md)] + +#### [:::image type="icon" source="../images/icons/power.svg"::: **Power options**](#tab/power) + +|Policy name| CSP | GPO | +|-|-|-| +|[Hide **Hibernate** ](#hide-hibernate)|✅|❌| +|[Hide **Power** button](#hide-power-button)|✅|❌| +|[Hide **Restart**](#hide-restart)|✅|❌| +|[Hide **Shut down**](#hide-shut-down)|✅|❌| +|[Hide **Sleep**](#hide-sleep)|✅|❌| +|[Remove and prevent access to the shut down restart sleep and hibernate commands](#remove-and-prevent-access-to-the-shut-down-restart-sleep-and-hibernate-commands)|❌|✅| + +[!INCLUDE [hide-hibernate](includes/hide-hibernate.md)] +[!INCLUDE [hide-power-button](includes/hide-power-button.md)] +[!INCLUDE [hide-restart](includes/hide-restart.md)] +[!INCLUDE [hide-shut-down](includes/hide-shut-down.md)] +[!INCLUDE [hide-sleep](includes/hide-sleep.md)] + +[!INCLUDE [remove-and-prevent-access-to-the-shut-down-restart-sleep-and-hibernate-commands](includes/remove-and-prevent-access-to-the-shut-down-restart-sleep-and-hibernate-commands.md)] + +--- diff --git a/windows/configuration/start/toc.yml b/windows/configuration/start/toc.yml new file mode 100644 index 0000000000..13f6bda470 --- /dev/null +++ b/windows/configuration/start/toc.yml @@ -0,0 +1,12 @@ +items: +- name: Overview + href: index.md + displayName: Configure the Start menu +- name: Customize the Start layout + href: layout.md +- name: Policy settings + href: policy-settings.md +- name: XML schema definition (XSD) + href: xsd.md +- name: Troubleshoot Start menu errors 🔗 + href: /troubleshoot/windows-client/shell-experience/troubleshoot-start-menu-errors diff --git a/windows/configuration/start/xsd.md b/windows/configuration/start/xsd.md new file mode 100644 index 0000000000..714f0aa70f --- /dev/null +++ b/windows/configuration/start/xsd.md @@ -0,0 +1,432 @@ +--- +title: Start XML Schema Definition (XSD) +description: Start XSD reference article. +ms.topic: reference +ms.date: 04/10/2024 +appliesto: +- ✅ Windows 10 +--- + +# Start XML Schema Definition (XSD) + +This reference article contains the Start XML schema definition (XSD). + +## StartLayout + +```xml + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +``` + +## LayoutModification + +```xml + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +``` + +## FullDefaultLayout + +```xml + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +``` diff --git a/windows/configuration/stop-employees-from-using-microsoft-store.md b/windows/configuration/stop-employees-from-using-microsoft-store.md deleted file mode 100644 index 416187989e..0000000000 --- a/windows/configuration/stop-employees-from-using-microsoft-store.md +++ /dev/null @@ -1,116 +0,0 @@ ---- -title: Configure access to Microsoft Store -description: Learn how to configure access to Microsoft Store for client computers and mobile devices in your organization. -author: lizgt2000 -ms.author: lizlong -ms.topic: conceptual -ms.date: 11/29/2022 ---- - -# Configure access to Microsoft Store - -**Applies to:** - -- Windows 10 - -> [!TIP] -> For more info about the features and functionality that are supported in each edition of Windows, see [Compare Windows 10 Editions](https://www.microsoft.com/WindowsForBusiness/Compare). - -IT pros can configure access to Microsoft Store for client computers in their organization. For some organizations, business policies require blocking access to Microsoft Store. - -> [!IMPORTANT] -> All executable code including Microsoft Store applications should have an update and maintenance plan. Organizations that use Microsoft Store applications should ensure that the applications can be updated through the Microsoft Store over the internet, through the [Private Store](/microsoft-store/distribute-apps-from-your-private-store), or [distributed offline](/microsoft-store/distribute-offline-apps) to keep the applications up to date. - -## Options to configure access to Microsoft Store - -You can use either AppLocker or Group Policy to configure access to Microsoft Store. For Windows 10, configuring access to Microsoft Store is only supported on Windows 10 Enterprise edition. - -## Block Microsoft Store using AppLocker - -Applies to: Windows 10 Enterprise, Windows 10 Education - -AppLocker provides policy-based access control management for applications. You can block access to Microsoft Store app with AppLocker by creating a rule for packaged apps. You'll give the name of the Microsoft Store app as the packaged app that you want to block from client computers. - -For more information on AppLocker, see [What is AppLocker?](/windows/device-security/applocker/what-is-applocker) For more information on creating an AppLocker rule for app packages, see [Create a rule for packaged apps](/windows/device-security/applocker/create-a-rule-for-packaged-apps). - -**To block Microsoft Store using AppLocker:** - -1. Enter **`secpol`** in the search bar to find and start AppLocker. - -2. In the console tree of the snap-in, select **Application Control Policies**, select **AppLocker**, and then select **Packaged app Rules**. - -3. On the **Action** menu, or by right-clicking on **Packaged app Rules**, select **Create New Rule**. - -4. On **Before You Begin**, select **Next**. - -5. On **Permissions**, select the action (allow or deny) and the user or group that the rule should apply to, and then select **Next**. - -6. On **Publisher**, you can select **Use an installed app package as a reference**, and then select **Select**. - -7. On **Select applications**, find and select **Store** under **Applications** column, and then select **OK**. Select **Next**. - - [Create a rule for packaged apps](/windows/device-security/applocker/create-a-rule-for-packaged-apps) has more information on reference options and setting the scope on packaged app rules. - -8. Optional: On **Exceptions**, specify conditions by which to exclude files from being affected by the rule. Conditions allow you to add exceptions based on the same rule reference and rule scope as you set before. Select **Next**. - -## Block Microsoft Store using configuration service provider - -Applies to: Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education - -If you have Windows 10 devices in your organization that are managed using a mobile device management (MDM) system, such as Microsoft Intune, you can block access to Microsoft Store app using the following configuration service providers (CSPs): - -- [Policy CSP](/windows/client-management/mdm/policy-configuration-service-provider) -- [AppLocker CSP](/windows/client-management/mdm/applocker-csp) - -For more information, see [Configure an MDM provider](/microsoft-store/configure-mdm-provider-microsoft-store-for-business). - -For more information on the rules available via AppLocker on the different supported operating systems, see [Operating system requirements](/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-to-use-applocker#operating-system-requirements). - -> [!IMPORTANT] -> If you block access to the Store using CSP, you need to also configure [AllowAppStoreAutoUpdate](/windows/client-management/mdm/policy-csp-applicationmanagement#applicationmanagement-allowappstoreautoupdate) to enable in-box store apps to update while still blocking access to the store. - -## Block Microsoft Store using Group Policy - -Applies to: Windows 10 Enterprise, Windows 10 Education - -> [!NOTE] -> Not supported on Windows 10 Pro, starting with version 1511. For more info, see [Knowledge Base article #3135657](/troubleshoot/windows-client/group-policy/cannot-disable-microsoft-store). - -You can also use Group Policy to manage access to Microsoft Store. - -**To block Microsoft Store using Group Policy:** - -1. Enter **`gpedit`** in the search bar to find and start Group Policy Editor. - -2. In the console tree of the snap-in, select **Computer Configuration**, select **Administrative Templates**, select **Windows Components**, and then select **Store**. - -3. In the Setting pane, select **Turn off the Store application**, and then select **Edit policy setting**. - -4. On the **Turn off the Store application** setting page, select **Enabled**, and then select **OK**. - -> [!IMPORTANT] -> When you enable the policy to **Turn off the Store application**, it turns off app updates from the Microsoft Store. To allow store apps to update, disable the policy to **Turn off automatic download and install of Updates**. This policy is found under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Store**. This configuration allows in-box store apps to update while still blocking access to the store. - -## Show private store only using Group Policy - -Applies to Windows 10 Enterprise, Windows 10 Education - -If you're using Microsoft Store for Business and you want employees to only see apps you're managing in your private store, you can use Group Policy to show only the private store. Microsoft Store app will still be available, but employees can't view or purchase apps. Employees can view and install apps that the admin has added to your organization's private store. - -**To show private store only in Microsoft Store app:** - -1. Enter **`gpedit`** in the search bar, and then select **Edit group policy (Control panel)** to find and start Group Policy Editor. - -2. In the console tree of the snap-in, go to **User Configuration** or **Computer Configuration** > **Administrative Templates** > **Windows Components**, and then select **Store**. - -3. Right-click **Only display the private store within the Microsoft Store app** in the right pane, and select **Edit**. - - The **Only display the private store within the Microsoft Store app** policy settings will open. - -4. On the **Only display the private store within the Microsoft Store app** setting page, select **Enabled**, and then select **OK**. - -## Related articles - -[Distribute apps using your private store](/microsoft-store/distribute-apps-from-your-private-store) - -[Manage access to private store](/microsoft-store/manage-access-to-private-store) diff --git a/windows/configuration/store/find-aumid.md b/windows/configuration/store/find-aumid.md new file mode 100644 index 0000000000..2e19c3355e --- /dev/null +++ b/windows/configuration/store/find-aumid.md @@ -0,0 +1,114 @@ +--- +title: Find the Application User Model ID of an installed app +description: Learn how to find the Application User Model ID (AUMID) of the applications installed on a Windows device. +ms.topic: how-to +ms.date: 02/06/2024 +--- + +# Find the Application User Model ID of an installed app + +Windows uses Application User Model Id (AUMID, also known as AppId) values to identify and differentiate applications for switching, launching, telemetry, and other functions.\ +AUMID are unique to each installed application, and independent of the installation path or the application's display name. + +To configure Assigned Access, which is the Configuration Service Provider (CSP) used to create a kiosk or dedicated device, you must use the AUMID of the apps installed on a device. This article describes how to find the AUMID of an installed application. + +## How to find the AUMID + +You can find an application's AUMID by using Windows PowerShell, File Explorer, or the registry. + +Follow the instructions to retrieve AUMIDs, selecting the tool of your choice. + +# [:::image type="icon" source="../images/icons/powershell.svg"::: **PowerShell**](#tab/ps) + +To get the names and AUMIDs for all apps that appear in the Start menu, open a Windows PowerShell command prompt and enter the following command: + +```powershell +Get-StartApps +``` + +>[!NOTE] +>Applications that are not listed in the Start menu will not appear in the output of the **Get-StartApps** cmdlet. + +To get the names and AUMIDs for Microsoft Store apps installed for the current user, open a Windows PowerShell command prompt and enter the following commands: + +```powershell +$installedapps = Get-AppxPackage + +$aumidList = @() +foreach ($app in $installedapps) +{ + foreach ($id in (Get-AppxPackageManifest $app).package.applications.application.id) + { + $aumidList += $app.packagefamilyname + "!" + $id + } +} + +$aumidList +``` + +> [!NOTE] +> You can add the `-user ` or the `-allusers` parameters to the `Get-AppxPackage` cmdlet to list AUMIDs for other users. You must use an elevated Windows PowerShell prompt to use the `-user` or -`allusers` parameters. + +### Example to get AUMIDs of the installed apps for the specified user + +The following code sample creates a function in Windows PowerShell that returns an array of AUMIDs of the installed apps for the specified user. + +### Example to get the AUMID of any application in the Start menu + +The following code sample creates a function in Windows PowerShell that returns the AUMID of any application currently listed in the Start menu. + +```powershell +function Get-AppAUMID { +param ( +[string]$AppName +) +$Apps = (New-Object -ComObject Shell.Application).NameSpace('shell:::{4234d49b-0245-4df3-b780-3893943456e1}').Items() +if ($AppName){ + $Result = $Apps | Where-Object { $_.name -like "*$AppName*" } | Select-Object name,@{n="AUMID";e={$_.path}} + if ($Result){ + Return $Result + } + else {"Unable to locate {0}" -f $AppName} +} +else { + $Result = $Apps | Select-Object name,@{n="AUMID";e={$_.path}} + Return $Result +} +} +``` + +The following Windows PowerShell commands demonstrate how you can call the Get-AppAUMID function after you've created it. + +```powershell +# Get the AUMID for OneDrive +Get-AppAUMID -AppName OneDrive + +# Get the AUMID for Microsoft Word +Get-AppAUMID -AppName Word + +# List all apps and their AUMID in the Start menu +Get-AppAUMID +``` + +# [:::image type="icon" source="../images/icons/explorer.svg"::: **Explorer**](#tab/explorer) + +To get the names and AUMIDs for all apps installed for the current user, perform the following steps: + +1. Select **Start** > **Run**, enter `shell:Appsfolder`, and select **OK** +1. A File Explorer window opens. Press Alt+V > **Choose details** +1. In the **Choose Details** window, select **AppUserModelId**, and then select **OK**. (You might need to c +1. Change the **View** setting from **Tiles** to **Details** + +:::image type="content" source="images/aumid-file-explorer.png" alt-text="Screenshot of the File Explorer showing the AUMID details." border="false"::: + +# [:::image type="icon" source="../images/icons/registry.svg"::: **Registry**](#tab/registry) + +Querying the registry can only return information about Microsoft Store apps that are installed for the current user, while the Windows PowerShell query can find information for any account on the device. + +At a command prompt, type the following command: + +```cmd +reg query HKEY_CURRENT_USER\Software\Classes\ActivatableClasses\Package /s /f AppUserModelID | find "REG_SZ" +``` + +--- diff --git a/windows/configuration/store/images/aumid-file-explorer.png b/windows/configuration/store/images/aumid-file-explorer.png new file mode 100644 index 0000000000..0361cd9bfe Binary files /dev/null and b/windows/configuration/store/images/aumid-file-explorer.png differ diff --git a/windows/configuration/store/images/store-blocked.png b/windows/configuration/store/images/store-blocked.png new file mode 100644 index 0000000000..c45c074f34 Binary files /dev/null and b/windows/configuration/store/images/store-blocked.png differ diff --git a/windows/configuration/store/index.md b/windows/configuration/store/index.md new file mode 100644 index 0000000000..09c92aea0f --- /dev/null +++ b/windows/configuration/store/index.md @@ -0,0 +1,66 @@ +--- +title: Configure access to the Microsoft Store app +description: Learn how to configure access to the Microsoft Store app. +ms.topic: how-to +ms.date: 03/13/2024 +--- + +# Configure access to the Microsoft Store app + +Microsoft Store is a digital distribution platform that provides a way for users to install applications on Windows devices. For some organizations, business policies require blocking access to Microsoft Store. + +This article describes how to configure access to the Microsoft Store app in your organization. + +## Prevent access to the Microsoft Store app + +You can use configuration service provider (CSP) or group policy (GPO) settings to configure access to the Microsoft Store app. The CSP configuration is available to Windows Enterprise and Education editions only. + +[!INCLUDE [tab-intro](../../../includes/configure/tab-intro.md)] + +#### [:::image type="icon" source="../images/icons/intune.svg" border="false"::: **Intune/CSP**](#tab/intune) + +[!INCLUDE [intune-settings-catalog-1](../../../includes/configure/intune-settings-catalog-1.md)] + +| Category | Setting name | Value | +|--|--|--| +| **Administrative Templates > Windows Components > Store** | Turn off the Store application| **Enabled**| + +[!INCLUDE [intune-settings-catalog-2](../../../includes/configure/intune-settings-catalog-2.md)] + +Alternatively, you can configure devices using a [custom policy][INT-1] with the [Policy CSP][CSP-1]. + +| Setting | +|--| +|- **OMA-URI:** `./Device/Vendor/MSFT/Policy/Config/ADMX_WindowsStore/RemoveWindowsStore_2`
                        - **Data type:** string
                        - **Value:** ``| + +#### [:::image type="icon" source="../images/icons/group-policy.svg" border="false"::: **GPO**](#tab/gpo) + +[!INCLUDE [gpo-settings-1](../../../includes/configure/gpo-settings-1.md)] + +| Group policy path | Group policy setting | Value | +| - | - | - | +| **Computer Configuration\Administrative Templates\Windows Components\Store** | Turn off the Store application| **Enabled**| + +[!INCLUDE [gpo-settings-2](../../../includes/configure/gpo-settings-2.md)] + +--- + +## User experience + +When you turn off the Microsoft Store application, users get the following message when they open it: + +:::image type="content" source="images/store-blocked.png" alt-text="Screenshot of the Microsoft Store app blocked access." border="false"::: + +## Considerations + +Here are some considerations when you prevent access to the Microsoft Store app: + +- Microsoft Store applications keep updating automatically, by default +- Users might still be able to install applications using Windows Package Manager (winget), or other methods, if they don't need to acquire the package from Microsoft Store +- Devices managed by Microsoft Intune can still install applications sourced from Microsoft Store, even if you block access to the Microsoft Store app. To learn more, see [Add Microsoft Store apps to Microsoft Intune][INT-2] + + + +[CSP-1]: /windows/client-management/mdm/policy-csp-admx-windowsstore +[INT-1]: /mem/intune/configuration/settings-catalog +[INT-2]: /mem/intune/apps/store-apps-microsoft diff --git a/windows/configuration/store/toc.yml b/windows/configuration/store/toc.yml new file mode 100644 index 0000000000..1be495bbbe --- /dev/null +++ b/windows/configuration/store/toc.yml @@ -0,0 +1,5 @@ +items: + - name: Configure access to Microsoft Store + href: index.md + - name: Find the AUMID of an installed app + href: find-aumid.md \ No newline at end of file diff --git a/windows/configuration/supported-csp-start-menu-layout-windows.md b/windows/configuration/supported-csp-start-menu-layout-windows.md deleted file mode 100644 index d079399d4b..0000000000 --- a/windows/configuration/supported-csp-start-menu-layout-windows.md +++ /dev/null @@ -1,79 +0,0 @@ ---- -title: Supported CSP policies to customize Start menu on Windows 11 | Microsoft Docs -description: See a list of the Policy CSP - Start items that are supported on Windows 11 to customize the Start menu. -manager: aaroncz -ms.author: lizlong -ms.reviewer: ericpapa -ms.prod: windows-client -author: lizgt2000 -ms.localizationpriority: medium -ms.technology: itpro-configure -ms.date: 12/31/2017 -ms.topic: article ---- - -# Supported configuration service provider (CSP) policies for Windows 11 Start menu - -**Applies to**: - -- Windows 11 -- Windows 11, version 22H2 - -The Windows OS exposes CSPs that are used by MDM providers, like [Microsoft Intune](/mem/intune/fundamentals/what-is-intune). In an MDM policy, these CSPs are settings that you configure in a policy. When the policy is ready, you deploy the policy to your devices. - -This article lists the CSPs that are available to customize the Start menu for Windows 11 devices. Windows 11 uses the [Policy CSP - Start](/windows/client-management/mdm/policy-csp-start). For more general information, see [Configuration service provider (CSP) reference](/windows/client-management/mdm/configuration-service-provider-reference). - -For information on customizing the Start menu layout using policy, see [Customize the Start menu layout on Windows 11](customize-start-menu-layout-windows-11.md). - -## Existing Windows CSP policies that Windows 11 supports - -- [Start/AllowPinnedFolderDocuments](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderdocuments) -- [Start/AllowPinnedFolderDownloads](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderfileexplorer) -- [Start/AllowPinnedFolderFileExplorer](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderhomegroup) -- [Start/AllowPinnedFolderHomeGroup](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderhomegroup) -- [Start/AllowPinnedFolderMusic](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfoldermusic) -- [Start/AllowPinnedFolderNetwork](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfoldernetwork) -- [Start/AllowPinnedFolderPersonalFolder](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderpersonalfolder) -- [Start/AllowPinnedFolderPictures](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderpictures) -- [Start/AllowPinnedFolderSettings](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfoldersettings) -- [Start/AllowPinnedFolderVideos](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfoldervideos) -- [Start/HideChangeAccountSettings](/windows/client-management/mdm/policy-csp-start#start-hidechangeaccountsettings) -- [Start/HideHibernate](/windows/client-management/mdm/policy-csp-start#start-hidehibernate) -- [Start/HideLock](/windows/client-management/mdm/policy-csp-start#start-hidelock) -- [Start/HidePowerButton](/windows/client-management/mdm/policy-csp-start#start-hidepowerbutton) -- [Start/HideRestart](/windows/client-management/mdm/policy-csp-start#start-hiderestart) -- [Start/HideShutDown](/windows/client-management/mdm/policy-csp-start#start-hideshutdown) -- [Start/HideSignOut](/windows/client-management/mdm/policy-csp-start#start-hidesignout) -- [Start/HideSleep](/windows/client-management/mdm/policy-csp-start#start-hidesleep) -- [Start/HideSwitchAccount](/windows/client-management/mdm/policy-csp-start#start-hideswitchaccount) -- [Start/HideUserTile](/windows/client-management/mdm/policy-csp-start#start-hideusertile) -- [Start/HideRecentJumplists](/windows/client-management/mdm/policy-csp-start#start-hiderecentjumplists) -- [Start/NoPinningToTaskbar](/windows/client-management/mdm/policy-csp-start#start-nopinningtotaskbar) -- **Start/ShowOrHideMostUsedApps**: New policy starting with Windows 11. This policy enforces always showing Most Used Apps, or always hiding Most Used Apps in the Start menu. If you use this policy, the [Start/HideFrequentlyUsedApps](/windows/client-management/mdm/policy-csp-start#start-hidefrequentlyusedapps) policy is ignored. - - The [Start/HideFrequentlyUsedApps](/windows/client-management/mdm/policy-csp-start#start-hidefrequentlyusedapps) policy enforces hiding Most Used Apps on the Start menu. You can't use this policy to enforce always showing Most Used Apps on the Start menu. - -**The following policies are supported starting with Windows 11, version 22H2:** - -- [Start/HideAppList](/windows/client-management/mdm/policy-csp-start#start-hideapplist) -- [Start/DisableContextMenus](/windows/client-management/mdm/policy-csp-start#start-disablecontextmenus) -## Existing CSP policies that Windows 11 doesn't support - -- [Start/StartLayout](/windows/client-management/mdm/policy-csp-start#start-startlayout) - - Group policy: `User Configuration\Administrative Templates\Start Menu and Taskbar\Start Layout` - -- [Start/HideRecentlyAddedApps](/windows/client-management/mdm/policy-csp-start#start-hiderecentlyaddedapps) - - Group policy: `Computer Configuration\Administrative Templates\Start Menu and Taskbar\Remove "Recently added" list from Start Menu` - -> [!NOTE] -> The following two policies are supported starting in Windows 11, version 22H2 - -- [Start/HideAppList](/windows/client-management/mdm/policy-csp-start#start-hideapplist) - - Group policy: - - `Computer Configuration\Administrative Templates\Start Menu and Taskbar\Remove All Programs list from the Start menu` - - `User Configuration\Administrative Templates\Start Menu and Taskbar\Remove All Programs list from the Start menu` - -- [Start/DisableContextMenus](/windows/client-management/mdm/policy-csp-start#start-disablecontextmenus) - - Group policy: - - `Computer Configuration\Administrative Templates\Start Menu and Taskbar\Disable context menus in the Start Menu` - - `User Configuration\Administrative Templates\Start Menu and Taskbar\Disable context menus in the Start Menu` diff --git a/windows/configuration/supported-csp-taskbar-windows.md b/windows/configuration/supported-csp-taskbar-windows.md deleted file mode 100644 index a24ff5885a..0000000000 --- a/windows/configuration/supported-csp-taskbar-windows.md +++ /dev/null @@ -1,82 +0,0 @@ ---- -title: Supported CSP policies to customize the Taskbar on Windows 11 | Microsoft Docs -description: See a list of the Policy CSP - Start items that are supported on Windows 11 to customize the Taskbar. -manager: aaroncz -ms.author: lizlong -ms.reviewer: chataylo -ms.prod: windows-client -author: lizgt2000 -ms.localizationpriority: medium -ms.technology: itpro-configure -ms.date: 12/31/2017 -ms.topic: article ---- - -# Supported configuration service provider (CSP) policies for Windows 11 taskbar - -**Applies to**: - -- Windows 11 - -The Windows OS exposes CSPs that are used by MDM providers, like [Microsoft Intune](/mem/intune/fundamentals/what-is-intune). In an MDM policy, these CSPs are settings that you configure. When the policy is ready, you deploy the policy to your devices. This article lists the CSPs that are available to customize the Taskbar for Windows 11 devices. - -For more general information, see [Configuration service provider (CSP) reference](/windows/client-management/mdm/configuration-service-provider-reference). - -## CSP policies to customize Windows 11 taskbar buttons - -- [Search/ConfigureSearchOnTaskbarMode](/windows/client-management/mdm/policy-csp-search#configuresearchontaskbarmode) - - Group policy: `Computer Configuration\Administrative Templates\Windows Components\Search\Configures search on the taskbar` - - Local setting: Settings > Personalization > Taskbar > Search - -- [Start/HideTaskViewButton](/windows/client-management/mdm/policy-csp-start#hidetaskviewbutton) - - Group policy: `Computer and User Configuration\Administrative Templates\Start Menu and Taskbar\Hide the TaskView button` - - Local setting: Settings > Personalization > Taskbar > Task view - -- [NewsAndInterests/AllowNewsAndInterests](/windows/client-management/mdm/policy-csp-newsandinterests#allownewsandinterests) - - Group policy: `Computer Configuration\Administrative Templates\Windows Components\Widgets\Allow widgets` - - Local setting: Settings > Personalization > Taskbar > Widgets - -- [Experience/ConfigureChatIcon](/windows/client-management/mdm/policy-csp-experience#configurechaticonvisibilityonthetaskbar) - - Group policy: `Computer Configuration\Administrative Templates\Windows Components\Chat\Configure the Chat icon setting` - - Local setting: Settings > Personalization > Taskbar > Chat - -## Existing CSP policies that Windows 11 taskbar supports - -- [Start/HideRecentJumplists](/windows/client-management/mdm/policy-csp-start#hiderecentjumplists) - - Group policy: `User Configuration\Administrative Templates\Start Menu and Taskbar\Do not keep history of recently opened documents` - - Local setting: Settings > Personalization > Start > Show recently opened items in Jump Lists on Start or the taskbar - -- [Start/NoPinningToTaskbar](/windows/client-management/mdm/policy-csp-start#nopinningtotaskbar) - - Group policy: `User Configuration\Administrative Templates\Start Menu and Taskbar\Do not allow pinning programs to the Taskbar` - - Local setting: None - -## Existing CSP policies that Windows 11 doesn't support - -The following list includes some of the CSP policies that aren't supported on Windows 11: - -- [ADMX_Taskbar/TaskbarLockAll](/windows/client-management/mdm/policy-csp-admx-taskbar#taskbarlockall) - - Group policy: `User Configuration\Administrative Templates\Start Menu and Taskbar\Lock all taskbar settings` - -- [ADMX_Taskbar/TaskbarNoAddRemoveToolbar](/windows/client-management/mdm/policy-csp-admx-taskbar#taskbarnoaddremovetoolbar) - - Group policy: `User Configuration\Administrative Templates\Start Menu and Taskbar\Prevent users from adding or removing toolbars` - -- [ADMX_Taskbar/TaskbarNoDragToolbar](/windows/client-management/mdm/policy-csp-admx-taskbar#taskbarnodragtoolbar) - - Group policy: `User Configuration\Administrative Templates\Start Menu and Taskbar\Prevent users from rearranging toolbars` - -- [ADMX_Taskbar/TaskbarNoRedock](/windows/client-management/mdm/policy-csp-admx-taskbar#taskbarnoredock) - - Group policy: `User Configuration\Administrative Templates\Start Menu and Taskbar\Prevent users from moving taskbar to another screen dock location` - -- [ADMX_Taskbar/TaskbarNoResize](/windows/client-management/mdm/policy-csp-admx-taskbar#taskbarnoresize) - - Group policy: `User Configuration\Administrative Templates\Start Menu and Taskbar\Prevent users from resizing the taskbar` - -- [ADMX_StartMenu/NoToolbarsOnTaskbar](/windows/client-management/mdm/policy-csp-admx-startmenu#notoolbarsontaskbar) - - Group policy: `User Configuration\Administrative Templates\Start Menu and Taskbar\Do not display any custom toolbars in the taskbar` - -- [ADMX_StartMenu/NoTaskGrouping](/windows/client-management/mdm/policy-csp-admx-startmenu#notaskgrouping) - - Group policy: `User Configuration\Administrative Templates\Start Menu and Taskbar\Prevent grouping of taskbar items` - -- [ADMX_StartMenu/QuickLaunchEnabled](/windows/client-management/mdm/policy-csp-admx-startmenu#quicklaunchenabled) - - Group policy: `User Configuration\Administrative Templates\Start Menu and Taskbar\Show QuickLaunch on Taskbar` - -- [Start/HidePeopleBar](/windows/client-management/mdm/policy-csp-start#hidepeoplebar) - - Group policy: `User Configuration\Administrative Templates\Start Menu and Taskbar\Remove the People Bar from the taskbar` diff --git a/windows/configuration/taskbar/images/pin-add-10.png b/windows/configuration/taskbar/images/pin-add-10.png new file mode 100644 index 0000000000..398028ee4b Binary files /dev/null and b/windows/configuration/taskbar/images/pin-add-10.png differ diff --git a/windows/configuration/taskbar/images/pin-add-11.png b/windows/configuration/taskbar/images/pin-add-11.png new file mode 100644 index 0000000000..867f27af43 Binary files /dev/null and b/windows/configuration/taskbar/images/pin-add-11.png differ diff --git a/windows/configuration/taskbar/images/pin-layout-10.png b/windows/configuration/taskbar/images/pin-layout-10.png new file mode 100644 index 0000000000..463655d37e Binary files /dev/null and b/windows/configuration/taskbar/images/pin-layout-10.png differ diff --git a/windows/configuration/taskbar/images/pin-layout-11.png b/windows/configuration/taskbar/images/pin-layout-11.png new file mode 100644 index 0000000000..5df7a8bfda Binary files /dev/null and b/windows/configuration/taskbar/images/pin-layout-11.png differ diff --git a/windows/configuration/taskbar/images/pin-remove-10.png b/windows/configuration/taskbar/images/pin-remove-10.png new file mode 100644 index 0000000000..7d8671887b Binary files /dev/null and b/windows/configuration/taskbar/images/pin-remove-10.png differ diff --git a/windows/configuration/taskbar/images/pin-remove-11.png b/windows/configuration/taskbar/images/pin-remove-11.png new file mode 100644 index 0000000000..736d4b2d11 Binary files /dev/null and b/windows/configuration/taskbar/images/pin-remove-11.png differ diff --git a/windows/configuration/taskbar/images/pin-replace-10.png b/windows/configuration/taskbar/images/pin-replace-10.png new file mode 100644 index 0000000000..31b1bfd98a Binary files /dev/null and b/windows/configuration/taskbar/images/pin-replace-10.png differ diff --git a/windows/configuration/taskbar/images/pin-replace-11.png b/windows/configuration/taskbar/images/pin-replace-11.png new file mode 100644 index 0000000000..f758d145be Binary files /dev/null and b/windows/configuration/taskbar/images/pin-replace-11.png differ diff --git a/windows/configuration/taskbar/images/taskbar-10.png b/windows/configuration/taskbar/images/taskbar-10.png new file mode 100644 index 0000000000..d99c1dd15d Binary files /dev/null and b/windows/configuration/taskbar/images/taskbar-10.png differ diff --git a/windows/configuration/taskbar/images/taskbar-11.png b/windows/configuration/taskbar/images/taskbar-11.png new file mode 100644 index 0000000000..0e24fb2679 Binary files /dev/null and b/windows/configuration/taskbar/images/taskbar-11.png differ diff --git a/windows/configuration/taskbar/images/taskbar-sections-10.png b/windows/configuration/taskbar/images/taskbar-sections-10.png new file mode 100644 index 0000000000..eec49c3d24 Binary files /dev/null and b/windows/configuration/taskbar/images/taskbar-sections-10.png differ diff --git a/windows/configuration/taskbar/images/taskbar-sections-11.png b/windows/configuration/taskbar/images/taskbar-sections-11.png new file mode 100644 index 0000000000..68e6ce31c5 Binary files /dev/null and b/windows/configuration/taskbar/images/taskbar-sections-11.png differ diff --git a/windows/configuration/taskbar/includes/allow-widgets.md b/windows/configuration/taskbar/includes/allow-widgets.md new file mode 100644 index 0000000000..7033aec825 --- /dev/null +++ b/windows/configuration/taskbar/includes/allow-widgets.md @@ -0,0 +1,18 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/11/2024 +ms.topic: include +--- + +### Allow widgets + +This policy specifies whether the widgets feature is allowed on the device. + +- Widgets are turned on by default, unless you change this in your settings +- If you turn on this policy setting, widgets are enabled automatically, unless you turn it off in your settings + +| | Path | +|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/NewsAndInterests/`[AllowNewsAndInterests](/windows/client-management/mdm/policy-csp-newsandinterests#allownewsandinterests) | +| **GPO** | - **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Widgets** | diff --git a/windows/configuration/taskbar/includes/configure-start-layout.md b/windows/configuration/taskbar/includes/configure-start-layout.md new file mode 100644 index 0000000000..ce75e3d6df --- /dev/null +++ b/windows/configuration/taskbar/includes/configure-start-layout.md @@ -0,0 +1,19 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Configure Start layout + + + +This policy setting lets you specify the applications pinned to the taskbar. The layout that you specify has an XML format. + +| | Path | +|--|--| +| **CSP** | - `./Device/Vendor/MSFT/Policy/Config/Start/StartLayout`/[Configure start layout](/windows/client-management/mdm/policy-csp-start#startlayout)
                        - `./User/Vendor/MSFT/Policy/Config/Start/StartLayout`/[Configure start layout](/windows/client-management/mdm/policy-csp-start#startlayout) | +| **GPO** | - **Computer Configuration** > **Administrative Templates** > **Start Menu and Taskbar**
                        - **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** | + +For more information, see [Customize the taskbar pinned applications](../pinned-apps.md). diff --git a/windows/configuration/taskbar/includes/configures-search-on-the-taskbar.md b/windows/configuration/taskbar/includes/configures-search-on-the-taskbar.md new file mode 100644 index 0000000000..5e009d1125 --- /dev/null +++ b/windows/configuration/taskbar/includes/configures-search-on-the-taskbar.md @@ -0,0 +1,21 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/11/2024 +ms.topic: include +--- + +### Configures search on the taskbar + +This policy setting allows you to configure search on the taskbar. + +- If you enable this policy setting and set it to **hide**, search on taskbar is hidden by default. Users can't change it in Settings +- If you enable this policy setting and set it to **search icon only**, the search icon is displayed on the taskbar by default. Users can't change it in Settings +- If you enable this policy setting and set it to **search icon and label**, the search icon and label are displayed on the taskbar by default. Users can't change it in Settings +- If you enable this policy setting and set it to **search box**, the search box is displayed on the taskbar by default. Users can't change it in Settings +- If you disable or don't configure this policy setting, search on taskbar is configured according to the defaults for your Windows edition. Users can change search on taskbar in Settings + +| | Path | +|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Search/`[ConfigureSearchOnTaskbarMode](/windows/client-management/mdm/policy-csp-search#configuresearchontaskbarmode) | +| **GPO** | - **Computer Configuration** > **Windows Components** > **Search** | diff --git a/windows/configuration/taskbar/includes/disable-editing-quick-settings.md b/windows/configuration/taskbar/includes/disable-editing-quick-settings.md new file mode 100644 index 0000000000..e57bff141e --- /dev/null +++ b/windows/configuration/taskbar/includes/disable-editing-quick-settings.md @@ -0,0 +1,16 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 03/18/2024 +ms.topic: include +--- + +### Disable editing Quick Settings + +- If you enable this policy setting, users can't modify Quick Settings +- If you disable or don't configure this policy setting, users can edit Quick Settings + +| | Path | +|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Start/`[DisableEditingQuickSettings](/windows/client-management/mdm/policy-csp-start#disableeditingquicksettings)| +| **GPO** | - **Computer Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Disable editing quick settings** | diff --git a/windows/configuration/taskbar/includes/do-not-allow-pinning-items-in-jump-lists.md b/windows/configuration/taskbar/includes/do-not-allow-pinning-items-in-jump-lists.md new file mode 100644 index 0000000000..9813a70d10 --- /dev/null +++ b/windows/configuration/taskbar/includes/do-not-allow-pinning-items-in-jump-lists.md @@ -0,0 +1,18 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/11/2024 +ms.topic: include +--- + +### Do not allow pinning items in Jump Lists + +With this policy setting you control the pinning of items in Jump Lists. + +- If you enable this policy setting, users can't pin files, folders, websites, or other items to their Jump Lists in the Start Menu and Taskbar. Users can't unpin existing items pinned to their Jump Lists. Existing items already pinned to their Jump Lists continue to show +- If you disable or don't configure this policy setting, users can pin files, folders, websites, and other items to a program's Jump List so that the items are always present in this menu + +| | Path | +|--|--| +| **CSP** | Not available. | +| **GPO** | - **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** | diff --git a/windows/configuration/taskbar/includes/do-not-allow-pinning-programs-to-the-taskbar.md b/windows/configuration/taskbar/includes/do-not-allow-pinning-programs-to-the-taskbar.md new file mode 100644 index 0000000000..8017676f8c --- /dev/null +++ b/windows/configuration/taskbar/includes/do-not-allow-pinning-programs-to-the-taskbar.md @@ -0,0 +1,18 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/11/2024 +ms.topic: include +--- + +### Do not allow pinning programs to the Taskbar + +This policy setting allows you to control pinning programs to the Taskbar. + +- If you enable this policy setting, users can't change the programs currently pinned to the Taskbar. If any programs are already pinned to the Taskbar, these programs continue to show in the Taskbar. However, users can't unpin these programs already pinned to the Taskbar, and they can't pin new programs to the Taskbar +- If you disable or don't configure this policy setting, users can change the programs currently pinned to the Taskbar + +| | Path | +|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Start/`[NoPinningToTaskbar](/windows/client-management/mdm/policy-csp-start#nopinningtotaskbar) | +| **GPO** | - **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** | diff --git a/windows/configuration/taskbar/includes/do-not-allow-pinning-store-app-to-the-taskbar.md b/windows/configuration/taskbar/includes/do-not-allow-pinning-store-app-to-the-taskbar.md new file mode 100644 index 0000000000..bdfd18c8cc --- /dev/null +++ b/windows/configuration/taskbar/includes/do-not-allow-pinning-store-app-to-the-taskbar.md @@ -0,0 +1,18 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/11/2024 +ms.topic: include +--- + +### Do not allow pinning Store app to the Taskbar + +This policy setting allows you to control pinning the Store app to the Taskbar. + +- If you enable this policy setting, users can't pin the Store app to the Taskbar. If the Store app is already pinned to the Taskbar, it will be removed from the Taskbar on next sign in +- If you disable or don't configure this policy setting, users can pin the Store app to the Taskbar + +| | Path | +|--|--| +| **CSP** | Not available. | +| **GPO** | - **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** | diff --git a/windows/configuration/taskbar/includes/do-not-allow-taskbars-on-more-than-one-display.md b/windows/configuration/taskbar/includes/do-not-allow-taskbars-on-more-than-one-display.md new file mode 100644 index 0000000000..4d42fdee7d --- /dev/null +++ b/windows/configuration/taskbar/includes/do-not-allow-taskbars-on-more-than-one-display.md @@ -0,0 +1,15 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/11/2024 +ms.topic: include +--- + +### Do not allow taskbars on more than one display + +This policy setting allows you to prevent taskbars from being displayed on more than one monitor. If you enable this policy setting, users aren't able to show taskbars on more than one display. The multiple display section is not enabled in the taskbar properties dialog. If you disable or don't configure this policy setting, users can show taskbars on more than one display. + +| | Path | +|--|--| +| **CSP** | Not available. | +| **GPO** | - **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** | diff --git a/windows/configuration/taskbar/includes/do-not-display-or-track-items-in-jump-lists-from-remote-locations.md b/windows/configuration/taskbar/includes/do-not-display-or-track-items-in-jump-lists-from-remote-locations.md new file mode 100644 index 0000000000..a91be73b37 --- /dev/null +++ b/windows/configuration/taskbar/includes/do-not-display-or-track-items-in-jump-lists-from-remote-locations.md @@ -0,0 +1,21 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/11/2024 +ms.topic: include +--- + +### Do not display or track items in Jump Lists from remote locations + +This policy setting allows you to control displaying or tracking items in Jump Lists from remote locations. The Start Menu and Taskbar display Jump Lists off of programs. These menus include files, folders, websites, and other relevant items for that program. This helps users more easily reopen their most important documents and other tasks. + +- If you enable this policy setting, the Start Menu and Taskbar only track the files that the user opens locally on this computer. Files that the user opens over the network from remote computers aren't tracked or shown in the Jump Lists. Use this setting to reduce network traffic, particularly over slow network connections +- If you disable or don't configure this policy setting, all files that the user opens appear in the menus, including files located remotely on another computer + +> [!NOTE] +> This setting doesn't prevent Windows from displaying remote files that the user has explicitly pinned to the Jump Lists. + +| | Path | +|--|--| +| **CSP** | Not available. | +| **GPO** | - **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** | diff --git a/windows/configuration/taskbar/includes/example-add-pins.md b/windows/configuration/taskbar/includes/example-add-pins.md new file mode 100644 index 0000000000..06a78334f7 --- /dev/null +++ b/windows/configuration/taskbar/includes/example-add-pins.md @@ -0,0 +1,27 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 03/13/2024 +ms.topic: include +--- + +```xml + + + + + + + + + + + + + +``` diff --git a/windows/configuration/taskbar/includes/example-region.md b/windows/configuration/taskbar/includes/example-region.md new file mode 100644 index 0000000000..7c3c8f4eba --- /dev/null +++ b/windows/configuration/taskbar/includes/example-region.md @@ -0,0 +1,43 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 03/13/2024 +ms.topic: include +--- + +```xml + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +``` diff --git a/windows/configuration/taskbar/includes/example-remove-pins.md b/windows/configuration/taskbar/includes/example-remove-pins.md new file mode 100644 index 0000000000..e2f95fc832 --- /dev/null +++ b/windows/configuration/taskbar/includes/example-remove-pins.md @@ -0,0 +1,24 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 03/13/2024 +ms.topic: include +--- + +```xml + + + + + + + + + + +``` diff --git a/windows/configuration/taskbar/includes/example-replace-pins.md b/windows/configuration/taskbar/includes/example-replace-pins.md new file mode 100644 index 0000000000..ccd014ee99 --- /dev/null +++ b/windows/configuration/taskbar/includes/example-replace-pins.md @@ -0,0 +1,27 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 03/13/2024 +ms.topic: include +--- + +```xml + + + + + + + + + + + + + +``` diff --git a/windows/configuration/taskbar/includes/example.md b/windows/configuration/taskbar/includes/example.md new file mode 100644 index 0000000000..4a31f71fce --- /dev/null +++ b/windows/configuration/taskbar/includes/example.md @@ -0,0 +1,53 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 03/13/2024 +ms.topic: include +--- + +```xml + + + + + + + + + +``` + +::: zone pivot="windows-10" + +### Sample taskbar configuration added to Start layout XML file + +If you configure the Start layout using policy settings, you can modify the existing XML file by adding the taskbar customizations to it. Here's an example of a Start layout XML file that includes the `CustomTaskbarLayoutCollection` node. + +```xml + + + + + + + + + + + + + + + + + + + +``` + +::: zone-end diff --git a/windows/configuration/taskbar/includes/hide-recent-jumplists.md b/windows/configuration/taskbar/includes/hide-recent-jumplists.md new file mode 100644 index 0000000000..8e4ad2a207 --- /dev/null +++ b/windows/configuration/taskbar/includes/hide-recent-jumplists.md @@ -0,0 +1,23 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/12/2024 +ms.topic: include +--- + +### Hide recent jumplists + +Prevents the operating system and installed programs from creating and displaying shortcuts to recently opened documents. + +- If you enable this setting: + - The system and apps don't create shortcuts to documents opened + - The system empties the Recent Items menu on the Start menu, and apps don't display shortcuts at the bottom of the File menu + - The Jump Lists in the Start Menu and Taskbar don't show lists of recently or frequently used files, folders, or websites +- If you disable or don't configure this setting, the system stores and displays shortcuts to recently and frequently used files, folders, and websites +- If you enable this setting but don't enable the **Remove Recent Items menu from Start Menu** setting, the Recent Items menu appears on the Start menu, but it's empty. +- If you enable this setting, but then later disable it or set it to **Not Configured**, the document shortcuts saved before the setting was enabled reappear in the Recent Items menu and program File menus, and Jump Lists. This setting doesn't hide or prevent the user from pinning files, folders, or websites to the Jump Lists. This setting doesn't hide document shortcuts displayed in the Open dialog box + +| | Path | +|--|--| +| **CSP** | - `./Device/Vendor/MSFT/Policy/Config/Start/`[HideRecentJumplists](/windows/client-management/mdm/policy-csp-start#hiderecentjumplists)
                        - `./User/Vendor/MSFT/Policy/Config/Start/`[HideRecentJumplists](/windows/client-management/mdm/policy-csp-start#hiderecentjumplists) | +| **GPO** | - **Computer Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **don't keep history of recently opened documents**
                        - **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **don't keep history of recently opened documents**| diff --git a/windows/configuration/taskbar/includes/hide-the-notification-area.md b/windows/configuration/taskbar/includes/hide-the-notification-area.md new file mode 100644 index 0000000000..f7f8b3f04d --- /dev/null +++ b/windows/configuration/taskbar/includes/hide-the-notification-area.md @@ -0,0 +1,15 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/11/2024 +ms.topic: include +--- + +### Hide the notification area + +This setting affects the notification area (previously called the "system tray") on the taskbar. Description: The notification area is located at the far right end of the task bar and includes the icons for current notifications and the system clock. If this setting is enabled, the user?s entire notification area, including the notification icons, is hidden. The taskbar displays only the Start button, taskbar buttons, custom toolbars (if any), and the system clock. If this setting is disabled or isn't configured, the notification area is shown in the user's taskbar. Note: Enabling this setting overrides the "Turn off notification area cleanup" setting, because if the notification area is hidden, there's no need to clean up the icons. + +| | Path | +|--|--| +| **CSP** | Not available. | +| **GPO** | - **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** | diff --git a/windows/configuration/taskbar/includes/hide-the-taskview-button.md b/windows/configuration/taskbar/includes/hide-the-taskview-button.md new file mode 100644 index 0000000000..567f130a95 --- /dev/null +++ b/windows/configuration/taskbar/includes/hide-the-taskview-button.md @@ -0,0 +1,15 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/11/2024 +ms.topic: include +--- + +### Hide the TaskView button + +This policy setting allows you to hide the TaskView button. If you enable this policy setting, the TaskView button is hidden and the Settings toggle disabled. + +| | Path | +|--|--| +| **CSP** |- `./Device/Vendor/MSFT/Policy/Config/Start/`[HideTaskViewButton](/windows/client-management/mdm/policy-csp-start#hidetaskviewbutton)
                        - `./User/Vendor/MSFT/Policy/Config/Start/`[HideTaskViewButton](/windows/client-management/mdm/policy-csp-start#hidetaskviewbutton) | +| **GPO** |- **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar**
                        - **Computer Configuration** > **Administrative Templates** > **Start Menu and Taskbar** | diff --git a/windows/configuration/taskbar/includes/lock-all-taskbar-settings.md b/windows/configuration/taskbar/includes/lock-all-taskbar-settings.md new file mode 100644 index 0000000000..981e828059 --- /dev/null +++ b/windows/configuration/taskbar/includes/lock-all-taskbar-settings.md @@ -0,0 +1,18 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/11/2024 +ms.topic: include +--- + +### Lock all taskbar settings + +With this policy setting you lock all taskbar settings. + +- If you enable this policy setting, the user can't access the taskbar control panel. The user can't resize, move, or rearrange toolbars on their taskbar +- If you disable or don't configure this policy setting, the user can set any taskbar setting that isn't prevented by another policy setting + +| | Path | +|--|--| +| **CSP** | Not available. | +| **GPO** | - **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** | diff --git a/windows/configuration/taskbar/includes/lock-the-taskbar.md b/windows/configuration/taskbar/includes/lock-the-taskbar.md new file mode 100644 index 0000000000..93986d5626 --- /dev/null +++ b/windows/configuration/taskbar/includes/lock-the-taskbar.md @@ -0,0 +1,15 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/11/2024 +ms.topic: include +--- + +### Lock the Taskbar + +This setting affects the taskbar, which is used to switch between running applications. The taskbar includes the Start button, list of currently running tasks, and the notification area. By default, the taskbar is located at the bottom of the screen, but it can be dragged to any side of the screen. When it's locked, it can't be moved or resized. If you enable this setting, it prevents the user from moving or resizing the taskbar. While the taskbar is locked, autohide and other taskbar options are still available in Taskbar properties. If you disable this setting or don't configure it, the user can configure the taskbar position. Note: Enabling this setting also locks the QuickLaunch bar and any other toolbars that the user has on their taskbar. The toolbar's position is locked, and the user can't show and hide various toolbars using the taskbar context menu. + +| | Path | +|--|--| +| **CSP** | Not available. | +| **GPO** | - **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** | diff --git a/windows/configuration/taskbar/includes/prevent-changes-to-taskbar-and-start-menu-settings.md b/windows/configuration/taskbar/includes/prevent-changes-to-taskbar-and-start-menu-settings.md new file mode 100644 index 0000000000..07b9780bb7 --- /dev/null +++ b/windows/configuration/taskbar/includes/prevent-changes-to-taskbar-and-start-menu-settings.md @@ -0,0 +1,18 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/11/2024 +ms.topic: include +--- + +### Prevent changes to Taskbar and Start Menu Settings + +With this policy setting you prevent changes to taskbar and Start settings. + +- If you enable this policy setting, the user can't open the Taskbar properties dialog box. If the user right-clicks the taskbar and then selects Properties, a message appears explaining that a setting prevents the action +- If you disable or don't configure this policy setting, the Taskbar and Start menu items are available from Settings on the Start menu + +| | Path | +|--|--| +| **CSP** | Not available. | +| **GPO** | - **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar**
                        - **Computer Configuration** > **Administrative Templates** > **Start Menu and Taskbar** | diff --git a/windows/configuration/taskbar/includes/prevent-grouping-of-taskbar-items.md b/windows/configuration/taskbar/includes/prevent-grouping-of-taskbar-items.md new file mode 100644 index 0000000000..8fdaf1d499 --- /dev/null +++ b/windows/configuration/taskbar/includes/prevent-grouping-of-taskbar-items.md @@ -0,0 +1,18 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/11/2024 +ms.topic: include +--- + +### Prevent grouping of taskbar items + +Taskbar grouping consolidates similar applications when there's no room on the taskbar. It kicks in when the user's taskbar is full. + +- If you enable this policy setting, it prevents the taskbar from grouping items that share the same program name. By default, this setting is always enabled +- If you disable or don't configure it, items on the taskbar that share the same program are grouped together. The users have the option to disable grouping if they choose + +| | Path | +|--|--| +| **CSP** | Not available. | +| **GPO** | - **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** | diff --git a/windows/configuration/taskbar/includes/prevent-users-from-adding-or-removing-toolbars.md b/windows/configuration/taskbar/includes/prevent-users-from-adding-or-removing-toolbars.md new file mode 100644 index 0000000000..bfd489e4ba --- /dev/null +++ b/windows/configuration/taskbar/includes/prevent-users-from-adding-or-removing-toolbars.md @@ -0,0 +1,18 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/11/2024 +ms.topic: include +--- + +### Prevent users from adding or removing toolbars + +With this policy setting you prevent users from adding or removing toolbars. + +- If you enable this policy setting, the user isn't allowed to add or remove any toolbars to the taskbar. Applications can't add toolbars either +- If you disable or don't configure this policy setting, the users and applications can add toolbars to the taskbar + +| | Path | +|--|--| +| **CSP** | Not available. | +| **GPO** | - **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** | diff --git a/windows/configuration/taskbar/includes/prevent-users-from-moving-taskbar-to-another-screen-dock-location.md b/windows/configuration/taskbar/includes/prevent-users-from-moving-taskbar-to-another-screen-dock-location.md new file mode 100644 index 0000000000..34d6cbff58 --- /dev/null +++ b/windows/configuration/taskbar/includes/prevent-users-from-moving-taskbar-to-another-screen-dock-location.md @@ -0,0 +1,18 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/11/2024 +ms.topic: include +--- + +### Prevent users from moving taskbar to another screen dock location + +With this policy setting you prevent users from moving taskbar to another screen dock location. + +- If you enable this policy setting, users can't drag their taskbar to another area of the monitor(s) +- If you disable or don't configure this policy setting, users can drag their taskbar to another area of the monitor, unless prevented by another policy setting + +| | Path | +|--|--| +| **CSP** | Not available. | +| **GPO** | - **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** | diff --git a/windows/configuration/taskbar/includes/prevent-users-from-rearranging-toolbars.md b/windows/configuration/taskbar/includes/prevent-users-from-rearranging-toolbars.md new file mode 100644 index 0000000000..801b804b91 --- /dev/null +++ b/windows/configuration/taskbar/includes/prevent-users-from-rearranging-toolbars.md @@ -0,0 +1,18 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/11/2024 +ms.topic: include +--- + +### Prevent users from rearranging toolbars + +With this policy setting you prevent users from rearranging toolbars. + +- If you enable this policy setting, users can't drag or drop toolbars to the taskbar +- If you disable or don't configure this policy setting, users can rearrange the toolbars on the taskbar + +| | Path | +|--|--| +| **CSP** | Not available. | +| **GPO** | - **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** | diff --git a/windows/configuration/taskbar/includes/prevent-users-from-resizing-the-taskbar.md b/windows/configuration/taskbar/includes/prevent-users-from-resizing-the-taskbar.md new file mode 100644 index 0000000000..8796175a15 --- /dev/null +++ b/windows/configuration/taskbar/includes/prevent-users-from-resizing-the-taskbar.md @@ -0,0 +1,18 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/11/2024 +ms.topic: include +--- + +### Prevent users from resizing the taskbar + +With this policy setting you prevent users from resizing the taskbar. + +- If you enable this policy setting, users can't resize their taskbar +- If you disable or don't configure this policy setting, users can resize their taskbar, unless prevented by another setting + +| | Path | +|--|--| +| **CSP** | Not available. | +| **GPO** | - **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** | diff --git a/windows/configuration/taskbar/includes/remove-access-to-the-context-menus-for-the-taskbar.md b/windows/configuration/taskbar/includes/remove-access-to-the-context-menus-for-the-taskbar.md new file mode 100644 index 0000000000..a79bd60c89 --- /dev/null +++ b/windows/configuration/taskbar/includes/remove-access-to-the-context-menus-for-the-taskbar.md @@ -0,0 +1,20 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/11/2024 +ms.topic: include +--- + +### Remove access to the context menus for the taskbar + +With this policy setting you can remove access to the context menus for the taskbar. + +- If you enable this policy setting, the menus that appear when you right-click the taskbar and items on the taskbar are hidden. For example the Start button, the clock, and the taskbar buttons. +- If you disable or don't configure this policy setting, the context menus for the taskbar are available + +This policy setting doesn't prevent users from using other methods to issue the commands that appear on these menus. + +| | Path | +|--|--| +| **CSP** | Not available. | +| **GPO** | - **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar**
                        - **Computer Configuration** > **Administrative Templates** > **Start Menu and Taskbar** | diff --git a/windows/configuration/taskbar/includes/remove-clock-from-the-system-notification-area.md b/windows/configuration/taskbar/includes/remove-clock-from-the-system-notification-area.md new file mode 100644 index 0000000000..ee455afcd7 --- /dev/null +++ b/windows/configuration/taskbar/includes/remove-clock-from-the-system-notification-area.md @@ -0,0 +1,16 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/11/2024 +ms.topic: include +--- + +### Remove Clock from the system notification area + +- If you enable this policy setting, the clock isn't displayed in the system notification area +- If you disable or don't configure this policy setting, the default behavior accur, and the clock appears in the notification area + +| | Path | +|--|--| +| **CSP** | Not available. | +| **GPO** | - **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** | diff --git a/windows/configuration/taskbar/includes/remove-notifications-and-action-center.md b/windows/configuration/taskbar/includes/remove-notifications-and-action-center.md new file mode 100644 index 0000000000..d141649c74 --- /dev/null +++ b/windows/configuration/taskbar/includes/remove-notifications-and-action-center.md @@ -0,0 +1,20 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/11/2024 +ms.topic: include +--- + +### Remove Notifications and Action Center + +This policy setting removes *Notifications* and *Action Center* from the notification area on the taskbar. + +The notification area is located at the far right end of the taskbar, and includes icons for current notifications and the system clock. + +- If this setting is enabled, Notifications and Action Center aren't displayed in the notification area. The user can read notifications when they appear, but they can't review any notifications they miss +- If you disable or don't configure this policy setting, Notification and Security and Maintenance are displayed on the taskbar + +| | Path | +|--|--| +| **CSP** | Not available. | +| **GPO** | - **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** | diff --git a/windows/configuration/taskbar/includes/remove-pinned-programs-from-the-taskbar.md b/windows/configuration/taskbar/includes/remove-pinned-programs-from-the-taskbar.md new file mode 100644 index 0000000000..901e8f2402 --- /dev/null +++ b/windows/configuration/taskbar/includes/remove-pinned-programs-from-the-taskbar.md @@ -0,0 +1,18 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/11/2024 +ms.topic: include +--- + +### Remove pinned programs from the Taskbar + +This policy setting allows you to remove pinned programs from the taskbar. + +- If you enable this policy setting, pinned programs are removed from the taskbar. Users can't pin programs to the taskbar +- If you disable or don't configure this policy setting, users can pin programs so that the program shortcuts stay on the taskbar + +| | Path | +|--|--| +| **CSP** | Not available. | +| **GPO** | - **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar**
                        - **Computer Configuration** > **Administrative Templates** > **Start Menu and Taskbar** | diff --git a/windows/configuration/taskbar/includes/remove-quick-settings.md b/windows/configuration/taskbar/includes/remove-quick-settings.md new file mode 100644 index 0000000000..58e2e01069 --- /dev/null +++ b/windows/configuration/taskbar/includes/remove-quick-settings.md @@ -0,0 +1,20 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/11/2024 +ms.topic: include +--- + +### Remove Quick Settings + +This policy setting removes Quick Settings from the bottom right area on the taskbar. The Quick Settings area is located at the left of the clock in the taskbar and includes icons for current network and volume. + +If this setting is enabled, Quick Settings isn't displayed in the Quick Settings area. + +> [!NOTE] +> A reboot is required for this policy setting to take effect. + +| | Path | +|--|--| +| **CSP** | `./User/Vendor/MSFT/Policy/Config/Start/`[DisableControlCenter](/windows/client-management/mdm/policy-csp-start#disablecontrolcenter) | +| **GPO** | - **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** | diff --git a/windows/configuration/taskbar/includes/remove-the-battery-meter.md b/windows/configuration/taskbar/includes/remove-the-battery-meter.md new file mode 100644 index 0000000000..5eac19f260 --- /dev/null +++ b/windows/configuration/taskbar/includes/remove-the-battery-meter.md @@ -0,0 +1,18 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/11/2024 +ms.topic: include +--- + +### Remove the battery meter + +With this policy setting you can remove the battery meter from the system control area. + +- If you enable this policy setting, the battery meter isn't displayed in the system notification area +- If you disable or don't configure this policy setting, the battery meter is displayed in the system notification area + +| | Path | +|--|--| +| **CSP** | Not available. | +| **GPO** | - **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** | diff --git a/windows/configuration/taskbar/includes/remove-the-meet-now-icon.md b/windows/configuration/taskbar/includes/remove-the-meet-now-icon.md new file mode 100644 index 0000000000..e0ed92dcbb --- /dev/null +++ b/windows/configuration/taskbar/includes/remove-the-meet-now-icon.md @@ -0,0 +1,18 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/11/2024 +ms.topic: include +--- + +### Remove the Meet Now icon + +With this policy setting allows you can remove the Meet Now icon from the system control area. + +- If you enable this policy setting, the Meet Now icon isn't displayed in the system notification area +- If you disable or don't configure this policy setting, the Meet Now icon is displayed in the system notification area + +| | Path | +|--|--| +| **CSP** | Not available. | +| **GPO** | - **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** | diff --git a/windows/configuration/taskbar/includes/remove-the-networking-icon.md b/windows/configuration/taskbar/includes/remove-the-networking-icon.md new file mode 100644 index 0000000000..18f8a0d6ba --- /dev/null +++ b/windows/configuration/taskbar/includes/remove-the-networking-icon.md @@ -0,0 +1,18 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/11/2024 +ms.topic: include +--- + +### Remove the networking icon + +With this policy setting you can remove the networking icon from the system control area. + +- If you enable this policy setting, the networking icon isn't displayed in the system notification area +- If you disable or don't configure this policy setting, the networking icon is displayed in the system notification area + +| | Path | +|--|--| +| **CSP** | Not available. | +| **GPO** | - **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** | diff --git a/windows/configuration/taskbar/includes/remove-the-people-bar-from-the-taskbar.md b/windows/configuration/taskbar/includes/remove-the-people-bar-from-the-taskbar.md new file mode 100644 index 0000000000..9a07b3ea06 --- /dev/null +++ b/windows/configuration/taskbar/includes/remove-the-people-bar-from-the-taskbar.md @@ -0,0 +1,15 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/11/2024 +ms.topic: include +--- + +### Remove the People Bar from the taskbar + +With this policy allows you can remove the People Bar from the taskbar and disables the My People experience. If you enable this policy setting, the people icon is removed from the taskbar, the corresponding settings toggle is removed from the taskbar settings page, and users can't pin people to the taskbar. + +| | Path | +|--|--| +| **CSP** | `./User/Vendor/MSFT/Policy/Config/Start/`[HidePeopleBar](/windows/client-management/mdm/policy-csp-start#hidepeoplebar) | +| **GPO** | - **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** | diff --git a/windows/configuration/taskbar/includes/remove-the-volume-control-icon.md b/windows/configuration/taskbar/includes/remove-the-volume-control-icon.md new file mode 100644 index 0000000000..b1c847e81c --- /dev/null +++ b/windows/configuration/taskbar/includes/remove-the-volume-control-icon.md @@ -0,0 +1,18 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/11/2024 +ms.topic: include +--- + +### Remove the volume control icon + +With this policy setting you can remove the volume control icon from the system control area. + +- If you enable this policy setting, the volume control icon isn't displayed in the system notification area +- If you disable or don't configure this policy setting, the volume control icon is displayed in the system notification area + +| | Path | +|--|--| +| **CSP** | Not available. | +| **GPO** | - **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** | diff --git a/windows/configuration/taskbar/includes/show-additional-calendar.md b/windows/configuration/taskbar/includes/show-additional-calendar.md new file mode 100644 index 0000000000..8198012d72 --- /dev/null +++ b/windows/configuration/taskbar/includes/show-additional-calendar.md @@ -0,0 +1,22 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/11/2024 +ms.topic: include +--- + +### Show additional calendar + +By default, the calendar is set according to the locale of the operating system, and users can show an additional calendar. + +- For `zh-CN` and `zh-SG` locales, an additional calendar shows the lunar month and date and holiday names in Simplified Chinese (Lunar) by default +- For `zh-TW`, `zh-HK`, and `zh-MO` locales, an additional calendar shows the lunar month and date and holiday names in Traditional Chinese (Lunar) by default + +- If you enable this policy setting, users can show an additional calendar in either Simplified Chinese (Lunar) or Traditional Chinese (Lunar), regardless of the locale +- If you disable this policy setting, users can't show an additional calendar, regardless of the locale +- If you don't configure this policy setting, the calendar will be set according to the default logic + +| | Path | +|--|--| +| **CSP** | Not available. | +| **GPO** | - **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** | diff --git a/windows/configuration/taskbar/includes/simplify-quick-settings-layout.md b/windows/configuration/taskbar/includes/simplify-quick-settings-layout.md new file mode 100644 index 0000000000..bce9e7ab7d --- /dev/null +++ b/windows/configuration/taskbar/includes/simplify-quick-settings-layout.md @@ -0,0 +1,16 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/11/2024 +ms.topic: include +--- + +### Simplify Quick Settings Layout + +- If you enable this policy, Quick Settings is reduced to only having the Wi-Fi, Bluetooth, Accessibility, and VPN buttons. The brightness slider, volume slider, and battery indicator and link to the Settings app +- If you disable or don't configure this policy setting, the regular Quick Settings layout appears whenever Quick Settings is invoked + +| | Path | +|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Start/`[SimplifyQuickSettings](/windows/client-management/mdm/policy-csp-start#simplifyquicksettings) | +| **GPO** | - **Computer Configuration** > **Administrative Templates** > **Start Menu and Taskbar** | diff --git a/windows/configuration/taskbar/includes/turn-off-automatic-promotion-of-notification-icons-to-the-taskbar.md b/windows/configuration/taskbar/includes/turn-off-automatic-promotion-of-notification-icons-to-the-taskbar.md new file mode 100644 index 0000000000..9642aecd96 --- /dev/null +++ b/windows/configuration/taskbar/includes/turn-off-automatic-promotion-of-notification-icons-to-the-taskbar.md @@ -0,0 +1,18 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/11/2024 +ms.topic: include +--- + +### Turn off automatic promotion of notification icons to the taskbar + +With this policy setting you can turn off automatic promotion of notification icons to the taskbar. + +- If you enable this policy setting, newly added notification icons aren't temporarily promoted to the Taskbar. Users can still configure icons to be shown or hidden in the Notification Control Panel. +- If you disable or don't configure this policy setting, newly added notification icons are temporarily promoted to the Taskbar + +| | Path | +|--|--| +| **CSP** | Not available. | +| **GPO** | - **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** | diff --git a/windows/configuration/taskbar/includes/turn-off-notification-area-cleanup.md b/windows/configuration/taskbar/includes/turn-off-notification-area-cleanup.md new file mode 100644 index 0000000000..6150f80740 --- /dev/null +++ b/windows/configuration/taskbar/includes/turn-off-notification-area-cleanup.md @@ -0,0 +1,21 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/11/2024 +ms.topic: include +--- + +### Turn off notification area cleanup + +This setting affects the notification area, also called the *system tray*. The notification area is located in the task bar, generally at the bottom of the screen, and it includes the clock and current notifications. + +This setting determines whether the items are always expanded or always collapsed. By default, notifications are collapsed. The notification cleanup `<<` icon can be referred to as the *notification chevron*. + +- If you enable this setting, the system notification area expands to show all of the notifications that use this area +- If you disable this setting, the system notification area always collapses notifications +- If you don't configure it, the user can choose if they want notifications collapsed or expanded + +| | Path | +|--|--| +| **CSP** | Not available. | +| **GPO** | - **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** | diff --git a/windows/configuration/taskbar/index.md b/windows/configuration/taskbar/index.md new file mode 100644 index 0000000000..6ef2fe06f6 --- /dev/null +++ b/windows/configuration/taskbar/index.md @@ -0,0 +1,105 @@ +--- +title: Configure the Windows taskbar +description: Learn how to configure the Windows taskbar to provide quick access to the tools and applications that users need most. +ms.topic: how-to +ms.date: 04/17/2024 +ms.collection: +- essentials-manage +appliesto: +zone_pivot_groups: windows-versions-11-10 +--- + +# Configure the Windows taskbar + +The Windows taskbar is an essential component of the Windows operating system. The taskbar acts as a versatile platform for multitasking and quick access to applications and system notifications. For organizations, the ability to customize the taskbar's layout and features through policy settings is invaluable, especially in scenarios where specific roles or functions require streamlined access to certain tools and programs. + +::: zone pivot="windows-11" + +:::image type="content" source="images/taskbar-11.png" alt-text="Screenshot of the Windows 11 taskbar." border="false" lightbox="./images/taskbar-11.png"::: + +::: zone-end + +::: zone pivot="windows-10" + +:::image type="content" source="images/taskbar-10.png" alt-text="Screenshot of the Windows 10 taskbar." border="false" lightbox="./images/taskbar-10.png"::: + +::: zone-end + +For example, students can benefit from a customized taskbar that can provide access to educational tools and resources, minimizing distractions and optimizing the learning environment. + +Frontline workers, who often operate in fast-paced and dynamic settings, can benefit from a taskbar that is configured to provide immediate access to the most critical applications and functions they need. The taskbar customization can streamline workflows and enhance productivity by reducing the time spent navigating through unnecessary applications or menus. + +Kiosks, which are designed for public use, can also take advantage of taskbar customization to offer a simplified and focused interface. This can help users quickly find the information or services they're looking for, which is useful in environments like retail, information centers, or public service areas. + +Overall, the ability to customize the Windows taskbar using policy settings enables organizations to create a more controlled, efficient, and user-friendly computing environment tailored to the specific needs of different user groups. + +## Taskbar structure + +The Windows taskbar consists of several key components that can be customized to meet the needs of different scenarios. + +::: zone pivot="windows-11" + +Let's review the components of the Windows taskbar by dividing it into three areas: + +1. The *left area* contains Widgets, which provide personalized news, weather, and other information +1. The *center area* contains: + 1. Start menu + 1. Search + 1. Task view + 1. Pinned and running apps +1. The *right area* contains: + 1. The system tray, which displays icons like the pen menu, touch keyboard, virtual touchpad, and any application icons that are running in the background like OneDrive, Teams, or antivirus software + 1. Quick actions + 1. Calendar + 1. Notifications + +:::image type="content" source="images/taskbar-sections-11.png" alt-text="Screenshot of the Windows 11 taskbar with the three areas highlighted." border="false" lightbox="./images/taskbar-sections-11.png"::: + +::: zone-end + +::: zone pivot="windows-10" + +Let's review the components of the Windows taskbar by dividing it into two areas: + +1. The *left area* contains: + - Start menu + - Search + - Cortana + - Task view + - Pinned and running apps + +1. The *right area* contains: + - People + - News and interests + - The system tray, which displays icons like the pen menu, touch keyboard, virtual touchpad, power, network, volume, and any application icons that are running in the background like OneDrive, Teams, or antivirus software + - Calendar + - Notifications and actions + +:::image type="content" source="images/taskbar-sections-10.png" alt-text="Screenshot of the Windows 11 taskbar with the two areas highlighted." border="false" lightbox="./images/taskbar-sections-10.png"::: + +::: zone-end + +## Configuration options + +There are several options to configure the Windows taskbar. + +If you need to configure a device for a single user, you can pin/unpin applications to the taskbar and rearrange them. The taskbar can be further customized from Settings. Go to **Settings** > **Personalization** > **[Taskbar](ms-settings:taskbar)**. + +For advanced customizations and when you need to configure multiple devices, you can use one of the following options: + +- Configuration Service Provider (CSP): commonly used for devices managed by a Mobile Device Management (MDM) solution, like Microsoft Intune. CSPs can also be configured with [provisioning packages](../provisioning-packages/how-it-pros-can-use-configuration-service-providers.md#csps-in-windows-configuration-designer), which are used at deployment time or for unmanaged devices. To configure the taskbar, use the [Start Policy CSP][WIN-1] +- Group policy (GPO): used for devices that are Active Directory joined or Microsoft Entra hybrid joined, and not managed by a device management solution. Group policy can also be used for devices that aren't joined to an Active Directory domain, using the local group policy editor + +> [!NOTE] +> While many of the taskbar policy settings can be configured using both CSP and GPO, there are some settings that are exclusive to one or the other. To learn about the available policy settings to configure the Start menu via CSP and GPO, see [Taskbar policy settings](policy-settings.md). + +## Next steps + +In the next sections, you can learn more about the options available to configure Start menu settings using the Configuration Service Provider (CSP) and Group Policy (GPO): + +- [Taskbar policy settings](policy-settings.md) +- [Configure the taskbar pinned applications](pinned-apps.md) + + + +[WIN-1]: /windows/client-management/mdm/policy-csp-start diff --git a/windows/configuration/taskbar/pinned-apps.md b/windows/configuration/taskbar/pinned-apps.md new file mode 100644 index 0000000000..f7cbe59725 --- /dev/null +++ b/windows/configuration/taskbar/pinned-apps.md @@ -0,0 +1,237 @@ +--- +title: Configure the applications pinned to the taskbar +description: Learn how to configure the applications pinned to the Windows taskbar. +ms.topic: how-to +ms.date: 04/17/2024 +appliesto: +zone_pivot_groups: windows-versions-11-10 +--- + +# Configure the applications pinned to the taskbar + +The configuration of the applications pinned to the taskbar is done with the use of an XML file. This article describes how to create and deploy the XML configuration file. + +> [!NOTE] +> If you are looking for OEM information, see the article [Customize the Taskbar](/windows-hardware/customize/desktop/customize-the-windows-11-taskbar). + +To learn about all the policy settings to customize the taskbar layout and configure the taskbar behaviors, see [Taskbar policy settings](policy-settings.md). + +## Before you begin + +Here are some considerations before you start configuring the taskbar pinned applications: + +- There's no limit to the number of apps that you can pin +- In the XML file, add apps using the Application User Model ID (AUMID), the Desktop Application ID, or the Desktop Application Link Path +- Some classic Windows applications are packaged differently than they were in previous versions of Windows, including Notepad and File Explorer. Make sure to enter the correct Application ID. To learn more, see [Find the Application User Model ID of an installed app](../store/find-aumid.md) +- If you specify an app to be pinned that isn't provisioned for the user on the device, the pinned icon doesn't appear on the taskbar +- The order of applications in the XML file dictates the order of pinned apps on the taskbar, from left to right. If the OS is configured to use a right-to-left language, then the taskbar order is reversed +- Applications can be pinned using the following methods: + - Default Windows apps, pinned during the OS installation. For example: Microsoft Edge, File Explorer, and Store. These applications are pinned first (blue square) + - Pinned manually by the user. These applications are usually pinned next to the default pinned apps (red circle) + - Pinned via policy settings. These applications are pinned after the apps pinned manually by the user (green triangle) + +::: zone pivot="windows-10" + +:::image type="content" source="images/pin-layout-10.png" border="false" lightbox="images/pin-layout-10.png" alt-text="Screenshot of the taskbar with Windows default pinned apps, user pinned apps, and policy-pinned apps."::: + +::: zone-end + +::: zone pivot="windows-11" + +:::image type="content" source="images/pin-layout-11.png" border="false" lightbox="images/pin-layout-11.png" alt-text="Screenshot of the taskbar with Windows default pinned apps, user pinned apps, and policy-pinned apps."::: + +::: zone-end + +## Configuration steps + +The following steps describe how to configure the taskbar pinned applications using policy settings: + +1. Create the XML file. You can start with the [XML example](#taskbar-layout-example) +1. Edit the XML file to meet your requirements and save it +1. Deploy the XML file to devices using configuration service provider (CSP), provisioning packages (PPKG), or group policy (GPO) + +>[!IMPORTANT] +>If you use a provisioning package or `import-startlayout` to configure the taskbar, your configuration will be reapplied each time the `explorer.exe` process restarts. If your configuration pins an app and the user then unpins that app, the user's change will be overwritten the next time the configuration is applied. To apply a taskbar configuration that allows users to make changes that will persist, apply your configuration by using CSP or GPO. + +::: zone pivot="windows-10" + +>[!NOTE] +>If you use GPO and your configuration only contains a taskbar layout, the default Windows tile layout will be applied and cannot be changed by users. If you use GPO and your configuration includes taskbar and a full Start layout, users can only make changes to the taskbar. If you use Group Policy and your configuration includes taskbar and a partial Start layout, users can make changes to the taskbar and to tile groups not defined in the partial Start layout. +> +> For more information, see [Configure the Start menu](../start/index.md). + +::: zone-end + +## Taskbar layout example + +Here you can find an example of taskbar layout that you can use as a reference: + +[!INCLUDE [example](includes/example.md)] + +### Modify the configuration file + +> [!CAUTION] +> When you make changes to the XML file, be aware that the XML format must adhere to an [XML schema definition (XSD)](xsd.md). + +You can change the apps pinned to the taskbar by modifying the `` node. + +1. In the `` node, add (or remove) the apps you want pinned. You can pin Universal Windows Platform (UWP) apps and desktop apps: + - ``: Select this option for UWP apps. Add the *AUMID* of the UWP app + - ``: Select this option for desktop apps. Add the *Desktop Application ID* or the *Desktop Application Link Path* of the desktop app +1. In the `` node, the apps you add are pinned after the default apps. If you want to remove the default apps, and only show the apps you add in the XML file, then add `PinListPlacement="Replace"`: + - ``: Keeps the default pinned apps. After the default apps, the apps you add are pinned + - ``: Unpins the default apps. Only the apps you add are pinned. If you want to remove some of the default pinned apps, then add `PinListPlacement="Replace"`. When you add your apps to ``, include the default apps you still want pinned +1. In the `` node, use `region=" | "` to use different taskbar configurations based on the device locale and region +1. Save the file + +For practical examples of how to add, remove, or replace pinned apps, see the following sections: + +- [Add pins](#example-add-pins) +- [Remove default pins](#example-remove-pins) +- [Replace default pins](#example-replace-pins) +- [Configure the taskbar by country or region](#example-configure-the-taskbar-by-country-or-region) + +#### Example: add pins + +The `` section appends the listed apps to the taskbar by default. The following sample keeps the default apps pinned and adds pins for Paint, Microsoft Reader, and a command prompt. + +[!INCLUDE [example-add-pins](includes/example-add-pins.md)] + +**Before and after:** + +::: zone pivot="windows-11" +:::image type="content" source="images/pin-add-11.png" alt-text="Screenshot of the Windows 11 taskbar, before and after adding pins." border="false" lightbox="./images/pin-add-11.png"::: +::: zone-end + +::: zone pivot="windows-10" +:::image type="content" source="images/pin-add-10.png" alt-text="Screenshot of the Windows 10 taskbar, before and after adding pins." border="false" lightbox="./images/pin-add-10.png"::: +::: zone-end + +#### Example: remove pins + +To remove all pins, add `PinListPlacement="Replace"` to ``. + +[!INCLUDE [example-remove-pins](includes/example-remove-pins.md)] + +**Before and after:** + +::: zone pivot="windows-11" +:::image type="content" source="images/pin-remove-11.png" alt-text="Screenshot of the Windows 11 taskbar, before and after removing pins." border="false" lightbox="images/pin-remove-11.png"::: +::: zone-end + +::: zone pivot="windows-10" +:::image type="content" source="images/pin-remove-10.png" alt-text="Screenshot of the Windows 10 taskbar, before and after removing pins." border="false" lightbox="images/pin-remove-10.png"::: +::: zone-end + +#### Example: replace pins + +To replace all default pins and add your own pins, add `PinListPlacement="Replace"` to ``. Then, add the pins that you want to `TaskbarPinList`. + +[!INCLUDE [example-replace-pins](includes/example-replace-pins.md)] + +**Before and after:** + +::: zone pivot="windows-11" +:::image type="content" source="images/pin-replace-11.png" alt-text="Screenshot of the Windows 11 taskbar, before and after replacing pins." border="false" lightbox="images/pin-replace-11.png"::: +::: zone-end + +::: zone pivot="windows-10" +:::image type="content" source="images/pin-replace-10.png" alt-text="Screenshot of the Windows 10 taskbar, before and after replacing pins." border="false" lightbox="images/pin-replace-10.png"::: +::: zone-end + +#### Example: configure the taskbar by country or region + +In the following XML example, two regions are added: `US|UK` and `DE|FR|IT`: + +[!INCLUDE [example](includes/example-region.md)] + +- If the `` node has region matching the one configured on the device, then the configuration applies +- If the `` node doesn't have a region matching the one configured on the device, then the first `` node without region applies + +> [!NOTE] +> [Look up country and region codes (use the ISO Short column)](/previous-versions/commerce-server/ee799297(v=cs.20)) + +## Deploy the taskbar configuration + +[!INCLUDE [tab-intro](../../../includes/configure/tab-intro.md)] + +#### [:::image type="icon" source="../images/icons/intune.svg"::: **Intune/CSP**](#tab/intune) + +To configure devices with Microsoft Intune, [create a Settings catalog policy](/mem/intune/configuration/settings-catalog) and use one of the following settings: + +| Category | Setting name | Value | +|--|--|--| +| **Start** | Start Layout | Content of the XML file| +| **Start** | Start Layout (User) | Content of the XML file| + +[!INCLUDE [intune-settings-catalog-2](../../../includes/configure/intune-settings-catalog-2.md)] + +Alternatively, you can configure devices using a [custom policy][MEM-1] with the [Start CSP][WIN-1]. Use one of the following settings: + +| Setting | +|--| +| - **OMA-URI:** `./User/Vendor/MSFT/Policy/Config/Start/`[StartLayout](/windows/client-management/mdm/policy-csp-Start#startlayout)
                        - **String:**
                        - **Value:** content of the XML file | +| - **OMA-URI:** `./Device/Vendor/MSFT/Policy/Config/Start/`[StartLayout](/windows/client-management/mdm/policy-csp-Start#startlayout)
                        - **Data type:**
                        - **Value:** content of the XML file | + +[!INCLUDE [intune-custom-settings-2](../../../includes/configure/intune-custom-settings-2.md)] + +#### [:::image type="icon" source="../images/icons/provisioning-package.svg"::: **PPKG**](#tab/ppkg) + +[!INCLUDE [provisioning-package-1](../../../includes/configure/provisioning-package-1.md)] + +- **Path:** `Policies/Start/StartLayout` +- **Value:** content of the XML file + +> [!NOTE] +> The content of the file must be entered as a single line in the `Value` field. Use a text editor to remove any line breaks from the XML file, usually with a function called *join lines*. + +[!INCLUDE [provisioning-package-2](../../../includes/configure/provisioning-package-2.md)] + +#### [:::image type="icon" source="../images/icons/group-policy.svg"::: **GPO**](#tab/gpo) + +To configure a device with group policy, use the [Local Group Policy Editor](/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc731745(v=ws.10)). To configure multiple devices joined to Active Directory, [create or edit](/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc754740(v=ws.11)) a group policy object (GPO) and use one of the following settings: + +| Group policy path | Group policy setting | Value | +| - | - | - | +|**Computer Configuration** > **Administrative Templates** > **Start Menu and Taskbar**| Start Layout | Path to the XML file | +|**User Configuration** > **Administrative Templates** > **Start Menu and Taskbar**| Start Layout | Path to the XML file | + +[!INCLUDE [gpo-settings-2](../../../includes/configure/gpo-settings-2.md)] + +The GPO applies the Start and taskbar layout at the next user sign-in. Each time the user signs in, the timestamp of the .xml file with the Start and taskbar layout is checked and if a newer version of the file is available, the settings in the latest version of the file are applied. + +--- + +## User experience + +After the taskbar layout is applied, the users must sign out and sign in again to see the new layout. Unless prohibited via policy settings, users can pin more apps, change the order, and unpin apps from the taskbar. + +### OS install and upgrade experience + +On a clean install of Windows, if you apply a taskbar layout, the following apps are pinned to the taskbar: + +- Any default apps you don't remove +- Apps that you specifically pin in the XML file + +On a Windows OS upgrade, apps are already pinned to the taskbar. The taskbar layout applies the following logic: + +- If users pinned apps to the taskbar, then those pinned apps remain. New apps are pinned after the existing user-pinned apps +- If the apps are pinned during the install or by a policy (not by a user), and the apps aren't pinned in an updated layout file, then the apps are unpinned +- If a user didn't pin an app, and the same app is pinned in the updated layout file, then the app is pinned after any existing pinned apps +- New apps in updated layout file are pinned after the user's pinned apps + +If you apply the taskbar configuration to a clean install or an update, users can still: + +- Pin more apps +- Change the order of pinned apps +- Unpin any app + +## Next steps + +Learn more about the options available to configure Start menu settings using the Configuration Service Provider (CSP) and Group Policy (GPO): + +- [Taskbar policy settings](policy-settings.md) + +--- +[WIN-1]: /windows/client-management/mdm/policy-csp-start +[MEM-1]: /mem/intune/configuration/custom-settings-windows-10 diff --git a/windows/configuration/taskbar/policy-settings.md b/windows/configuration/taskbar/policy-settings.md new file mode 100644 index 0000000000..72ca73538b --- /dev/null +++ b/windows/configuration/taskbar/policy-settings.md @@ -0,0 +1,182 @@ +--- +title: Taskbar policy settings +description: Learn about the policy settings to configure the Windows taskbar. +ms.topic: reference +ms.date: 04/17/2024 +appliesto: +zone_pivot_groups: windows-versions-11-10 +--- + +# Taskbar policy settings + +This reference article outlines the policy settings available for customizing the Windows taskbar, using Configuration Service Provider (CSP) or group policy (GPO). For information about how to configure these settings, see [Configure the Windows taskbar](index.md). + +The settings are categorized and presented in alphabetical order to facilitate navigation and configuration. + +1. **Taskbar layout**: settings to control the taskbar layout and appearance +1. **Taskbar behaviors**: settings to control the taskbar behaviors and the users' allowed actions + +Select one of the tabs to see the list of available settings: + +#### [:::image type="icon" source="../images/icons/taskbar.svg"::: **Taskbar layout**](#tab/taskbar) + +::: zone pivot="windows-11" + +|Setting Name|CSP|GPO| +|-|-|-| +|[Allow widgets](#allow-widgets)|✅|✅| +|[Configure Start layout](#configure-start-layout)|✅|✅| +|[Configures search on the taskbar](#configures-search-on-the-taskbar)|✅|✅| +|[Do not display or track items in Jump Lists from remote locations](#do-not-display-or-track-items-in-jump-lists-from-remote-locations)|❌|✅| +|[Hide recent jumplists](#hide-recent-jumplists)|✅|✅| +|[Hide the TaskView button](#hide-the-taskview-button)|✅|✅| +|[Remove Clock from the system notification area](#remove-clock-from-the-system-notification-area)|❌|✅| +|[Remove Notifications and Action Center](#remove-notifications-and-action-center)|❌|✅| +|[Remove pinned programs from the Taskbar](#remove-pinned-programs-from-the-taskbar)|❌|✅| +|[Remove Quick Settings](#remove-quick-settings)|✅|✅| +|[Show additional calendar](#show-additional-calendar)|❌|✅| +|[Simplify Quick Settings Layout](#simplify-quick-settings-layout)|✅|✅| +|[Turn off automatic promotion of notification icons to the taskbar](#turn-off-automatic-promotion-of-notification-icons-to-the-taskbar)|❌|✅| + +::: zone-end + +::: zone pivot="windows-10" + +|Setting Name|CSP|GPO| +|-|-|-| +|[Allow widgets](#allow-widgets)|✅|✅| +|[Configure Start layout](#configure-start-layout)|✅|✅| +|[Configures search on the taskbar](#configures-search-on-the-taskbar)|✅|✅| +|[Do not display or track items in Jump Lists from remote locations](#do-not-display-or-track-items-in-jump-lists-from-remote-locations)|❌|✅| +|[Hide recent jumplists](#hide-recent-jumplists)|✅|✅| +|[Hide the notification area](#hide-the-notification-area)|❌|✅| +|[Remove Clock from the system notification area](#remove-clock-from-the-system-notification-area)|❌|✅| +|[Remove Notifications and Action Center](#remove-notifications-and-action-center)|❌|✅| +|[Remove pinned programs from the Taskbar](#remove-pinned-programs-from-the-taskbar)|❌|✅| +|[Remove the battery meter](#remove-the-battery-meter)|❌|✅| +|[Remove the Meet Now icon](#remove-the-meet-now-icon)|❌|✅| +|[Remove the networking icon](#remove-the-networking-icon)|❌|✅| +|[Remove the People Bar from the taskbar](#remove-the-people-bar-from-the-taskbar)|✅|✅| +|[Remove the volume control icon](#remove-the-volume-control-icon)|❌|✅| +|[Show additional calendar](#show-additional-calendar)|❌|✅| +|[Turn off automatic promotion of notification icons to the taskbar](#turn-off-automatic-promotion-of-notification-icons-to-the-taskbar)|❌|✅| +|[Turn off notification area cleanup](#turn-off-notification-area-cleanup)|❌|✅| + +::: zone-end + +[!INCLUDE [allow-widgets](includes/allow-widgets.md)] +[!INCLUDE [configure-start-layout](includes/configure-start-layout.md)] +[!INCLUDE [configures-search-on-the-taskbar](includes/configures-search-on-the-taskbar.md)] +[!INCLUDE [do-not-display-or-track-items-in-jump-lists-from-remote-locations](includes/do-not-display-or-track-items-in-jump-lists-from-remote-locations.md)] + +::: zone pivot="windows-10" +[!INCLUDE [hide-the-notification-area](includes/hide-the-notification-area.md)] +::: zone-end + +[!INCLUDE [hide-recent-jumplists](includes/hide-recent-jumplists.md)] + +::: zone pivot="windows-11" +[!INCLUDE [hide-the-taskview-button](includes/hide-the-taskview-button.md)] +::: zone-end + +[!INCLUDE [remove-clock-from-the-system-notification-area](includes/remove-clock-from-the-system-notification-area.md)] +[!INCLUDE [remove-notifications-and-action-center](includes/remove-notifications-and-action-center.md)] +[!INCLUDE [remove-pinned-programs-from-the-taskbar](includes/remove-pinned-programs-from-the-taskbar.md)] + +::: zone pivot="windows-11" +[!INCLUDE [remove-quick-settings](includes/remove-quick-settings.md)] +::: zone-end + +::: zone pivot="windows-10" +[!INCLUDE [remove-the-battery-meter](includes/remove-the-battery-meter.md)] +[!INCLUDE [remove-the-meet-now-icon](includes/remove-the-meet-now-icon.md)] +[!INCLUDE [remove-the-networking-icon](includes/remove-the-networking-icon.md)] +[!INCLUDE [remove-the-people-bar-from-the-taskbar](includes/remove-the-people-bar-from-the-taskbar.md)] +[!INCLUDE [remove-the-volume-control-icon](includes/remove-the-volume-control-icon.md)] +::: zone-end + +[!INCLUDE [show-additional-calendar](includes/show-additional-calendar.md)] + +::: zone pivot="windows-11" +[!INCLUDE [simplify-quick-settings-layout](includes/simplify-quick-settings-layout.md)] +::: zone-end + +[!INCLUDE [turn-off-automatic-promotion-of-notification-icons-to-the-taskbar](includes/turn-off-automatic-promotion-of-notification-icons-to-the-taskbar.md)] + +::: zone pivot="windows-10" +[!INCLUDE [turn-off-notification-area-cleanup](includes/turn-off-notification-area-cleanup.md)] +::: zone-end + +#### [:::image type="icon" source="../images/icons/touch.svg"::: **Taskbar behaviors**](#tab/actions) + +::: zone pivot="windows-11" + +|Setting Name|CSP|GPO| +|-|-|-| +|[Disable editing Quick Settings](#disable-editing-quick-settings)|✅|✅| +|[Do not allow pinning items in Jump Lists](#do-not-allow-pinning-items-in-jump-lists)|❌|✅| +|[Do not allow pinning programs to the Taskbar](#do-not-allow-pinning-programs-to-the-taskbar)|✅|✅| +|[Do not allow pinning Store app to the Taskbar](#do-not-allow-pinning-store-app-to-the-taskbar)|❌|✅| +|[Do not allow taskbars on more than one display](#do-not-allow-taskbars-on-more-than-one-display)|❌|✅| +|[Prevent changes to Taskbar and Start Menu Settings](#prevent-changes-to-taskbar-and-start-menu-settings)|❌|✅| +|[Prevent grouping of taskbar items](#prevent-grouping-of-taskbar-items)|❌|✅| +|[Remove access to the context menus for the taskbar](#remove-access-to-the-context-menus-for-the-taskbar)|❌|✅| + +::: zone-end + +::: zone pivot="windows-10" + +|Setting Name|CSP|GPO| +|-|-|-| +|[Do not allow pinning items in Jump Lists](#do-not-allow-pinning-items-in-jump-lists)|❌|✅| +|[Do not allow pinning programs to the Taskbar](#do-not-allow-pinning-programs-to-the-taskbar)|✅|✅| +|[Do not allow pinning Store app to the Taskbar](#do-not-allow-pinning-store-app-to-the-taskbar)|❌|✅| +|[Lock all taskbar settings](#lock-all-taskbar-settings)|❌|✅| +|[Lock the Taskbar](#lock-the-taskbar)|❌|✅| +|[Prevent changes to Taskbar and Start Menu Settings](#prevent-changes-to-taskbar-and-start-menu-settings)|❌|✅| +|[Prevent grouping of taskbar items](#prevent-grouping-of-taskbar-items)|❌|✅| +|[Prevent users from adding or removing toolbars](#prevent-users-from-adding-or-removing-toolbars)|❌|✅| +|[Prevent users from moving taskbar to another screen dock location](#prevent-users-from-moving-taskbar-to-another-screen-dock-location)|❌|✅| +|[Prevent users from rearranging toolbars](#prevent-users-from-rearranging-toolbars)|❌|✅| +|[Prevent users from resizing the taskbar](#prevent-users-from-resizing-the-taskbar)|❌|✅| +|[Remove access to the context menus for the taskbar](#remove-access-to-the-context-menus-for-the-taskbar)|❌|✅| +|[Turn off notification area cleanup](#turn-off-notification-area-cleanup)|❌|✅| + +::: zone-end + +::: zone pivot="windows-11" +[!INCLUDE [disable-editing-quick-settings](includes/disable-editing-quick-settings.md)] +::: zone-end + +[!INCLUDE [do-not-allow-pinning-items-in-jump-lists](includes/do-not-allow-pinning-items-in-jump-lists.md)] +[!INCLUDE [do-not-allow-pinning-programs-to-the-taskbar](includes/do-not-allow-pinning-programs-to-the-taskbar.md)] +[!INCLUDE [do-not-allow-pinning-store-app-to-the-taskbar](includes/do-not-allow-pinning-store-app-to-the-taskbar.md)] +[!INCLUDE [do-not-allow-taskbars-on-more-than-one-display](includes/do-not-allow-taskbars-on-more-than-one-display.md)] + +::: zone pivot="windows-10" +[!INCLUDE [lock-all-taskbar-settings](includes/lock-all-taskbar-settings.md)] +[!INCLUDE [lock-the-taskbar](includes/lock-the-taskbar.md)] +::: zone-end + +[!INCLUDE [prevent-changes-to-taskbar-and-start-menu-settings](includes/prevent-changes-to-taskbar-and-start-menu-settings.md)] +[!INCLUDE [prevent-grouping-of-taskbar-items](includes/prevent-grouping-of-taskbar-items.md)] + +::: zone pivot="windows-10" +[!INCLUDE [prevent-users-from-adding-or-removing-toolbars](includes/prevent-users-from-adding-or-removing-toolbars.md)] +[!INCLUDE [prevent-users-from-moving-taskbar-to-another-screen-dock-location](includes/prevent-users-from-moving-taskbar-to-another-screen-dock-location.md)] +[!INCLUDE [prevent-users-from-rearranging-toolbars](includes/prevent-users-from-rearranging-toolbars.md)] +[!INCLUDE [prevent-users-from-resizing-the-taskbar](includes/prevent-users-from-resizing-the-taskbar.md)] +::: zone-end + +[!INCLUDE [remove-access-to-the-context-menus-for-the-taskbar](includes/remove-access-to-the-context-menus-for-the-taskbar.md)] +[!INCLUDE [turn-off-automatic-promotion-of-notification-icons-to-the-taskbar](includes/turn-off-automatic-promotion-of-notification-icons-to-the-taskbar.md)] + +::: zone pivot="windows-10" +[!INCLUDE [turn-off-notification-area-cleanup](includes/turn-off-notification-area-cleanup.md)] +::: zone-end + +--- + +## Next steps + +The configuration of pinned applications to the taskbar requires the use of an XML file that specifies their pinning order. To learn more about how to create and apply an XML file to configure pinned applications, see [Configure the taskbar pinned applications](pinned-apps.md). diff --git a/windows/configuration/taskbar/toc.yml b/windows/configuration/taskbar/toc.yml new file mode 100644 index 0000000000..a20dbfb893 --- /dev/null +++ b/windows/configuration/taskbar/toc.yml @@ -0,0 +1,10 @@ +items: +- name: Overview + href: index.md + displayName: Configure the Windows taskbar +- name: Policy settings + href: policy-settings.md +- name: Configure the pinned applications + href: pinned-apps.md +- name: XML schema definition (XSD) + href: xsd.md \ No newline at end of file diff --git a/windows/configuration/taskbar/xsd.md b/windows/configuration/taskbar/xsd.md new file mode 100644 index 0000000000..c6d5ded3aa --- /dev/null +++ b/windows/configuration/taskbar/xsd.md @@ -0,0 +1,61 @@ +--- +title: Taskbar XML Schema Definition (XSD) +description: Taskbar XSD reference article. +ms.topic: reference +ms.date: 02/15/2024 +--- + +# Taskbar XML Schema Definition (XSD) + +This reference article contains the Taskbar XML schema definition (XSD). + +## TaskbarLayout + +```xml + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +``` diff --git a/windows/configuration/toc.yml b/windows/configuration/toc.yml new file mode 100644 index 0000000000..45b8217fab --- /dev/null +++ b/windows/configuration/toc.yml @@ -0,0 +1,23 @@ +items: +- name: Configure Windows client + href: index.yml +- name: Accessibility information for IT Pros + href: accessibility/index.md +- name: Start + href: start/toc.yml +- name: Taskbar + href: taskbar/toc.yml +- name: Windows spotlight + href: windows-spotlight/index.md +- name: Microsoft Store + href: store/toc.yml +- name: Cellular settings + href: cellular/provisioning-apn.md +- name: Kiosks and restricted user experiences + href: assigned-access/toc.yml +- name: Multi-user and guest devices + href: shared-pc/toc.yml +- name: Provisioning packages + href: provisioning-packages/toc.yml +- name: Windows Configuration Designer + href: wcd/toc.yml diff --git a/windows/configuration/ue-v/images/uev-adk-select-uev-feature.png b/windows/configuration/ue-v/images/uev-adk-select-uev-feature.png deleted file mode 100644 index 1556f115c0..0000000000 Binary files a/windows/configuration/ue-v/images/uev-adk-select-uev-feature.png and /dev/null differ diff --git a/windows/configuration/ue-v/images/uev-archdiagram.png b/windows/configuration/ue-v/images/uev-archdiagram.png deleted file mode 100644 index eae098e666..0000000000 Binary files a/windows/configuration/ue-v/images/uev-archdiagram.png and /dev/null differ diff --git a/windows/configuration/ue-v/images/uev-checklist-box.gif b/windows/configuration/ue-v/images/uev-checklist-box.gif deleted file mode 100644 index 8af13c51d1..0000000000 Binary files a/windows/configuration/ue-v/images/uev-checklist-box.gif and /dev/null differ diff --git a/windows/configuration/ue-v/images/uev-deployment-preparation.png b/windows/configuration/ue-v/images/uev-deployment-preparation.png deleted file mode 100644 index b665a0bfea..0000000000 Binary files a/windows/configuration/ue-v/images/uev-deployment-preparation.png and /dev/null differ diff --git a/windows/configuration/ue-v/images/uev-generator-process.png b/windows/configuration/ue-v/images/uev-generator-process.png deleted file mode 100644 index e16cedd0a7..0000000000 Binary files a/windows/configuration/ue-v/images/uev-generator-process.png and /dev/null differ diff --git a/windows/configuration/ue-v/uev-administering-uev-with-windows-powershell-and-wmi.md b/windows/configuration/ue-v/uev-administering-uev-with-windows-powershell-and-wmi.md deleted file mode 100644 index 9c048c2cf5..0000000000 --- a/windows/configuration/ue-v/uev-administering-uev-with-windows-powershell-and-wmi.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: Administering UE-V with Windows PowerShell and WMI -description: Learn how User Experience Virtualization (UE-V) provides Windows PowerShell cmdlets to help administrators perform various UE-V tasks. -author: aczechowski -ms.prod: windows-client -ms.collection: - - tier3 - - must-keep -ms.date: 04/19/2017 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.topic: article -ms.technology: itpro-configure ---- - -# Administering UE-V with Windows PowerShell and WMI - -**Applies to** -- Windows 10, version 1607 - -User Experience Virtualization (UE-V) provides Windows PowerShell cmdlets to help administrators perform various UE-V tasks. The following sections provide more information about using Windows PowerShell in UE-V. - -> **Note**  Administering UE-V with Windows PowerShell requires PowerShell 3.0 or higher. For a complete list of UE-V cmdlets, see [User Experience Virtualization in Windows PowerShell](/powershell/module/uev/). - -## Managing the UE-V service and packages by using Windows PowerShell and WMI - -You can use Windows PowerShell and Windows Management Instrumentation (WMI) to manage UE-V service configuration and synchronization behavior. The following topic describes how to manage configuration and synchronization. - -[Managing the UE-V Service and Packages with Windows PowerShell and WMI](uev-managing-uev-agent-and-packages-with-windows-powershell-and-wmi.md) - -## Managing UE-V settings location templates by using Windows PowerShell and WMI - - -After you create and deploy UE-V settings location templates, you can manage those templates by using Windows PowerShell or WMI. The following topic describes how to manage the settings location templates by using Windows PowerShell and WMI. - -[Managing UE-V Settings Location Templates Using Windows PowerShell and WMI](uev-managing-settings-location-templates-using-windows-powershell-and-wmi.md) - - - - - -## Related topics - -- [Administering UE-V](uev-administering-uev.md) - -- [User Experience Virtualization in Windows PowerShell](/powershell/module/uev/) diff --git a/windows/configuration/ue-v/uev-administering-uev.md b/windows/configuration/ue-v/uev-administering-uev.md deleted file mode 100644 index 627039a508..0000000000 --- a/windows/configuration/ue-v/uev-administering-uev.md +++ /dev/null @@ -1,81 +0,0 @@ ---- -title: Administering UE-V -description: Learn how to perform administrative tasks for User Experience Virtualization (UE-V). These tasks include configuring the UE-V service and recovering lost settings. -author: aczechowski -ms.prod: windows-client -ms.collection: - - tier3 - - must-keep -ms.date: 04/19/2017 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.topic: article -ms.technology: itpro-configure ---- - -# Administering UE-V - -**Applies to** -- Windows 10, version 1607 - -After you finish deploying User Experience Virtualization (UE-V), you'll perform ongoing administrative tasks, such as managing the configuration of the UE-V service and recovering lost settings. These tasks are explained in the following sections. - -## Managing UE-V configurations - - -In the course of the UE-V lifecycle, you'll manage the configuration of the UE-V service and also manage storage locations for resources such as settings package files. - -[Manage Configurations for UE-V](uev-manage-configurations.md) - -## Working with custom UE-V templates and the UE-V template generator - - -This topic explains how to use the UE-V template generator and manage custom settings location templates. - -[Working with Custom UE-V Templates and the UE-V Template Generator](uev-working-with-custom-templates-and-the-uev-generator.md) - -## Back up and restore application and Windows settings that are synchronized with UE-V - - -Windows Management Instrumentation (WMI) and Windows PowerShell features of UE-V allow you to restore settings packages. By using WMI and Windows PowerShell commands, you can restore application and Windows settings to their original state and restore other settings when a user adopts a new device. - -[Manage Administrative Backup and Restore in UE-V](uev-manage-administrative-backup-and-restore.md) - -## Changing the frequency of UE-V scheduled tasks - - -You can configure the scheduled tasks that manage when UE-V checks for new or updated settings or for updated custom settings location templates in the settings template catalog. - -[Changing the Frequency of UE-V Scheduled Tasks](uev-changing-the-frequency-of-scheduled-tasks.md) - -## Migrating UE-V settings packages - - -You can relocate the user settings packages either when they migrate to a new server or for backup purposes. - -[Migrating UE-V Settings Packages](uev-migrating-settings-packages.md) - -## Using UE-V with Application Virtualization applications - - -You can use UE-V with Microsoft Application Virtualization (App-V) to share settings between virtual applications and installed applications across multiple computers. - -[Using UE-V with Application Virtualization Applications](uev-using-uev-with-application-virtualization-applications.md) - -## Other resources for this feature - - -- [User Experience Virtualization for Windows overview](uev-for-windows.md) - -- [Get Started with UE-V](uev-getting-started.md) - -- [Prepare a UE-V Deployment](uev-prepare-for-deployment.md) - -- [Troubleshooting UE-V](uev-troubleshooting.md) - -- [Technical Reference for UE-V](uev-technical-reference.md) - - - - diff --git a/windows/configuration/ue-v/uev-application-template-schema-reference.md b/windows/configuration/ue-v/uev-application-template-schema-reference.md deleted file mode 100644 index 21e3edd00d..0000000000 --- a/windows/configuration/ue-v/uev-application-template-schema-reference.md +++ /dev/null @@ -1,804 +0,0 @@ ---- -title: Application Template Schema Reference for UE-V -description: Learn details about the XML structure of the UE-V settings location templates and learn how to edit these files. -author: aczechowski -ms.prod: windows-client -ms.collection: - - tier3 - - must-keep -ms.date: 04/19/2017 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.topic: article -ms.technology: itpro-configure ---- - -# Application Template Schema Reference for UE-V - -**Applies to** -- Windows 10, version 1607 - -User Experience Virtualization (UE-V) uses XML settings location templates to define the desktop application settings and Windows settings that are captured and applied by UE-V. UE-V includes a set of default settings location templates. You can also create custom settings location templates with the UE-V template generator. - -An advanced user can customize the XML file for a settings location template. This topic details the XML structure of the UE-V settings location templates and provides guidance for editing these files. - -## UE-V Application Template Schema Reference - - -This section details the XML structure of the UE-V settings location template and provides guidance for editing this file. - -### In This Section - -- [XML Declaration and Encoding Attribute](#xml21) - -- [Namespace and Root Element](#namespace21) - -- [Data types](#data21) - -- [Name Element](#name21) - -- [ID Element](#id21) - -- [Version Element](#version21) - -- [Author Element](#author21) - -- [Processes and Process Element](#processes21) - -- [Application Element](#application21) - -- [Common Element](#common21) - -- [SettingsLocationTemplate Element](#settingslocationtemplate21) - -- [Appendix: SettingsLocationTemplate.xsd](#appendix21) - -### XML Declaration and Encoding Attribute - -**Mandatory: True** - -**Type: String** - -The XML declaration must specify the XML version 1.0 attribute (<?xml version="1.0">). Settings location templates created by the UE-V template generator are saved in UTF-8 encoding, although the encoding isn't explicitly specified. We recommend that you include the encoding="UTF-8" attribute in this element as a best practice. All templates included with the product specify this tag as well (see the documents in %ProgramFiles%\\Microsoft User Experience Virtualization\\Templates for reference). For example: - -`` - -### Namespace and Root Element - -**Mandatory: True** - -**Type: String** - -UE-V uses the `https://schemas.microsoft.com/UserExperienceVirtualization/2012/SettingsLocationTemplate` namespace for all applications. SettingsLocationTemplate is the root element and contains all other elements. Reference SettingsLocationTemplate in all templates using this tag: - -```xml - -``` - -### Data types - -These data types are the ones for the UE-V application template schema. - -**GUID** -GUID describes a standard globally unique identifier regular expression in the form "\\{\[a-fA-F0-9\]{8}-\[a-fA-F0-9\]{4}-\[a-fA-F0-9\]{4}-\[a-fA-F0-9\]{4}-\[a-fA-F0-9\]{12}\\}". This GUID is used in the Filesetting\\Root\\KnownFolder element to verify the formatting of well-known folders. - -**FilenameString** -FilenameString refers to the file name of a process to be monitored. Its values are restricted by the regex \[^\\\\\\?\\\*\\|<>/:\]+, (that is, they may not contain backslash characters, asterisk or question mark wild-card characters, the pipe character, the greater than or less than sign, forward slash, or colon characters). - -**IDString** -IDString refers to the ID value of Application elements, SettingsLocationTemplate, and Common elements (used to describe application suites that share common settings). It's restricted by the same regex as FilenameString (\[^\\\\\\?\\\*\\|<>/:\]+). - -**TemplateVersion** -TemplateVersion is an integer value used to describe the revision of the settings location template. Its value may range from 0 to 2147483647. - -**Empty** -Empty refers to a null value. This data type is used in Process\\ShellProcess to indicate that there's no process to monitor. This value shouldn't be used in any application templates. - -**Author** -The Author data type is a complex type that identifies the author of a template. It contains two child elements: **Name** and **Email**. Within the Author data type, the Name element is mandatory while the Email element is optional. This type is described in more detail under the SettingsLocationTemplate element. - -**Range** -Range defines an integer class consisting of two child elements: **Minimum** and **Maximum**. This data type is implemented in the ProcessVersion data type. If specified, both Minimum and Maximum values must be included. - -**ProcessVersion** -ProcessVersion defines a type with four child elements: **Major**, **Minor**, **Build**, and **Patch**. This data type is used by the Process element to populate its ProductVersion and FileVersion values. The data for this type is a Range value. The Major child element is mandatory and the others are optional. - -**Architecture** -Architecture enumerates two possible values: **Win32** and **Win64**. These values are used to specify process architecture. - -**Process** -The Process data type is a container used to describe processes to be monitored by UE-V. It contains six child elements: **Filename**, **Architecture**, **ProductName**, **FileDescription**, **ProductVersion**, and **FileVersion**. This table details each element's respective data type: - -|Element|Data Type|Mandatory| -|--- |--- |--- | -|Filename|FilenameString|True| -|Architecture|Architecture|False| -|ProductName|String|False| -|FileDescription|String|False| -|ProductVersion|ProcessVersion|False| -|FileVersion|ProcessVersion|False| - -**Processes** -The Processes data type represents a container for a collection of one or more Process elements. Two child elements are supported in the Processes sequence type: **Process** and **ShellProcess**. Process is an element of type Process and ShellProcess is of data type Empty. At least one item must be identified in the sequence. - -**Path** -Path is consumed by RegistrySetting and FileSetting to refer to registry and file paths. This element supports two optional attributes: **Recursive** and **DeleteIfNotFound**. Both values are set to default="False". - -Recursive indicates that the path and all subfolders are included for file settings or that all child registry keys are included for registry settings. In both cases, all items at the current level are included in the data captured. For a FileSettings object, all files within the specified folder are included in the data captured by UE-V but folders aren't included. For registry paths, all values in the current path are captured but child registry keys aren't captured. In both cases, care should be taken to avoid capturing large data sets or large numbers of items. - -The DeleteIfNotFound attribute removes the setting from the user’s settings storage path data. This removal may be desirable in cases where removing these settings from the package will save a large amount of disk space on the settings storage path file server. - -**FileMask** -FileMask specifies only certain file types for the folder that is defined by Path. For example, Path might be `C:\users\username\files` and FileMask could be `*.txt` to include only text files. - -**RegistrySetting** -RegistrySetting represents a container for registry keys and values and the associated desired behavior on the part of the UE-V service. Four child elements are defined within this type: **Path**, **Name**, **Exclude**, and a sequence of the values **Path** and **Name**. - -**FileSetting** -FileSetting contains parameters associated with files and files paths. Four child elements are defined: **Root**, **Path**, **FileMask**, and **Exclude**. Root is mandatory and the others are optional. - -**Settings** -Settings is a container for all the settings that apply to a particular template. It contains instances of the Registry, File, SystemParameter, and CustomAction settings described earlier. In addition, it can also contain the following child elements with behaviors described: - -|Element|Description| -|--- |--- | -|Asynchronous|Asynchronous settings packages are applied without blocking the application startup so that the application start proceeds while the settings are still being applied. This element is useful for settings that can be applied asynchronously, such as those settings get/set through an API, like SystemParameterSetting.| -|PreventOverlappingSynchronization|By default, UE-V only saves settings for an application when the last instance of an application using the template is closed. When this element is set to ‘false’, UE-V exports the settings even if other instances of an application are running. Suited templates – those templates that include a Common element section– that are shipped with UE-V use this flag to enable shared settings to always export on application close, while preventing application-specific settings from exporting until the last instance is closed.| -|AlwaysApplySettings|This parameter forces an imported settings package to be applied even if there are no differences between the package and the current state of the application. This parameter should be used only in special cases since it can slow down settings import.| - -### Name Element - -**Mandatory: True** - -**Type: String** - -Name specifies a unique name for the settings location template. This name is used for display purposes when referencing the template in WMI, PowerShell, Event Viewer and debug logs. In general, avoid referencing version information, as this referencing can be objected from the ProductVersion element. For example, specify `My Application` rather than `My Application 1.1`. - -> [!NOTE] -> UE-V does not reference external DTDs, so it's not possible to use named entities in a settings location template. For example, do not use ® to refer to the registered trade mark sign ®. Instead, use canonical numbered references to include these types of special characters, for example, &\#174 for the ® character. This rule applies to all string values in this document. - -See for a complete list of character entities. UTF-8-encoded documents may include the Unicode characters directly. Saving templates through the UE-V template generator converts character entities to their Unicode representations automatically. - - - -### ID Element - -**Mandatory: True** - -**Type: String** - -ID populates a unique identifier for a particular template. This tag becomes the primary identifier that the UE-V service uses to reference the template at runtime (for example, see the output of the Get-UevTemplate and Get-UevTemplateProgram PowerShell cmdlets). By convention, this tag shouldn't contain any spaces, which simplifies scripting. Version numbers of applications should be specified in this element to allow for easy identification of the template, such as `MicrosoftOffice2016Win64`. - -### Version Element - -**Mandatory: True** - -**Type: Integer** - -**Minimum Value: 0** - -**Maximum Value: 2147483647** - -Version identifies the version of the settings location template for administrative tracking of changes. The UE-V template generator automatically increments this number by one each time the template is saved. Notice that this field must be a whole number integer; fractional values, such as `2.5` aren't allowed. - -> [!TIP] -> You can save notes about version changes using XML comment tags ``, for example: - -```xml - -4 -``` - -> [!IMPORTANT] -> This value is queried to determine if a new version of a template should be applied to an existing template in these instances: - -- When the scheduled Template Auto Update task executes - -- When the Update-UevTemplate PowerShell cmdlet is executed - -- When the microsoft\\uev:SettingsLocationTemplate Update method is called through WMI - - - -### Author Element - -**Mandatory: False** - -**Type: String** - -Author identifies the creator of the settings location template. Two optional child elements are supported: **Name** and **Email**. Both attributes are optional, but, if the Email child element is specified, it must be accompanied by the Name element. Author refers to the full name of the contact for the settings location template, and email should refer to an email address for the author. We recommend that you include this information in templates published publicly. - -### Processes and Process Element - -**Mandatory: True** - -**Type: Element** - -Processes contain at least one `` element, which in turn contains the following child elements: **Filename**, **Architecture**, **ProductName**, **FileDescription**, **ProductVersion**, and **FileVersion**. The Filename child element is mandatory and the others are optional. A fully populated element contains tags similar to this example: - -```xml - - MyApplication.exe - Win64 - MyApplication - MyApplication.exe - - - - - - - - - - - - - -``` - -### Filename - -**Mandatory: True** - -**Type: String** - -Filename refers to the actual file name of the executable as it appears in the file system. This element specifies the primary criterion that UE-V uses to evaluate whether a template applies to a process or not. This element must be specified in the settings location template XML. - -Valid filenames must not match the regular expression \[^\\\\\\?\\\*\\|<>/:\]+, that is, they may not contain backslash characters, asterisk or question mark wild-card characters, the pipe character, the greater than or less than sign, forward slash, or colon (the \\ ? \* | < > / or : characters.). - -> [!TIP] -> To test a string against this regex, use a PowerShell command window and substitute your executable's name for **YourFileName**: - -`"YourFileName.exe" -match "[\\\?\*\|<>/:]+"` - -A value of **True** indicates that the string contains illegal characters. Here are some examples of illegal values: - -- \\\\server\\share\\program.exe - -- Program\*.exe - -- Pro?ram.exe - -- Program<1>.exe - -> [!NOTE] -> The UE-V template generator encodes the greater than and less than characters as > and < respectively. - - - -In rare circumstances, the FileName value won't necessarily include the .exe extension, but it should be specified as part of the value. For example, `MyApplication.exe` should be specified instead of `MyApplication`. The second example won't apply the template to the process if the actual name of the executable file is “MyApplication.exe”. - -### Architecture - -**Mandatory: False** - -**Type: Architecture (String)** - -Architecture refers to the processor architecture for which the target executable was compiled. Valid values are Win32 for 32-bit applications or Win64 for 64-bit applications. If present, this tag limits the applicability of the settings location template to a particular application architecture. For an example of this applicability restriction, compare the %ProgramFiles%\\Microsoft User Experience Virtualization\\templates\\ MicrosoftOffice2016Win32.xml and MicrosoftOffice2016Win64.xml files included with UE-V. This applicability restriction is useful when relative paths change between different versions of an executable or if settings have been added or removed when moving from one processor architecture to another. - -If this element is absent, the settings location template ignores the process’ architecture and applies to both 32-bit and 64-bit processes if the file name and other attributes apply. - -> [!NOTE] -> UE-V does not support ARM processors in this version. - - - -### ProductName - -**Mandatory: False** - -**Type: String** - -ProductName is an optional element used to identify a product for administrative purposes or reporting. ProductName differs from Filename in that there are no regular expression restrictions on its value. This flexibility allows for more easily understood descriptions of a process where the executable name may not be obvious. For example: - -```xml - - MyApplication.exe - My Application 6.x by Contoso.com - - - - -``` - -### FileDescription - -**Mandatory: False** - -**Type: String** - -FileDescription is an optional tag that allows for an administrative description of the executable file. This tag is a free text field and can be useful in distinguishing multiple executables within a software package where there's a need to identify the function of the executable. - -For example, in a suited application, it might be useful to provide reminders about the function of two executables (MyApplication.exe and MyApplicationHelper.exe), as shown here: - -```xml - - - - MyApplication.exe - My Application Main Engine - - - - - - MyApplicationHelper.exe - My Application Background Process Executable - - - - - -``` - -### ProductVersion - -**Mandatory: False** - -**Type: String** - -ProductVersion refers to the major and minor product versions of a file, as well as a build and patch level. ProductVersion is an optional element, but if specified, it must contain at least the Major child element. The value must express a range in the form Minimum="X" Maximum="Y" where X and Y are integers. The Minimum and Maximum values can be identical. - -The product and file version elements may be left unspecified. Doing so makes the template "version agnostic", meaning that the template will apply to all versions of the specified executable. - -**Example 1:** - -Product version: 1.0 specified in the UE-V template generator produces the following XML: - -```xml - - - - -``` - -**Example 2:** - -File version: 5.0.2.1000 specified in the UE-V template generator produces the following XML: - -```xml - - - - - - -``` - -**Incorrect Example 1 - incomplete range:** - -Only the Minimum attribute is present. Maximum must be included in a range as well. - -```xml - - - -``` - -**Incorrect Example 2 - Minor specified without Major element:** - -Only the Minor element is present. Major must be included as well. - -```xml - - - -``` - -### FileVersion - -**Mandatory: False** - -**Type: String** - -FileVersion differentiates between the release version of a published application and the internal build details of a component executable. For most of the commercial applications, these numbers are identical. Where they vary, the product version of a file indicates a generic version identification of a file, while file version indicates a specific build of a file (as in the example of a hotfix or update). This file version uniquely identifies files without breaking detection logic. - -To determine the product version and file version of a particular executable, right-click on the file in Windows Explorer, select Properties, then click on the Details tab. - -Including a FileVersion element for an application allows for more granular fine-tuning detection logic, but isn't necessary for most applications. The ProductVersion element settings are checked first, and then FileVersion is checked. The more restrictive setting will apply. - -The child elements and syntax rules for FileVersion are identical to those elements and rules of ProductVersion. - -```xml - - MSACCESS.EXE - Win32 - - - - - - - - - -``` - -### Application Element - -Application is a container for settings that apply to a particular application. It's a collection of the following fields/types. - -|Field/Type|Description| -|--- |--- | -|Name|Specifies a unique name for the settings location template. This name is used for display purposes when referencing the template in WMI, PowerShell, Event Viewer and debug logs. For more information, see [Name](#name21).| -|ID|Populates a unique identifier for a particular template. This tag becomes the primary identifier that the UE-V service uses to reference the template at runtime. For more information, see [ID](#id21).| -|Description|An optional description of the template.| -|LocalizedNames|An optional name displayed in the UI, localized by a language locale.| -|LocalizedDescriptions|An optional template description localized by a language locale.| -|Version|Identifies the version of the settings location template for administrative tracking of changes. For more information, see [Version](#version21).| -|DeferToMSAccount|Controls whether this template is enabled in conjunction with a Microsoft account or not. If MSA syncing is enabled for a user on a machine, then this template will automatically be disabled.| -|DeferToOffice365|Similar to MSA, this type controls whether this template is enabled in conjunction with Office365. If Office 365 is being used to sync settings, this template will automatically be disabled.| -|FixedProfile|Specifies that this template can only be associated with the profile specified within this element, and can't be changed via WMI or PowerShell.| -|Processes|A container for a collection of one or more Process elements. For more information, see [Processes](#processes21).| -|Settings|A container for all the settings that apply to a particular template. It contains instances of the Registry, File, SystemParameter, and CustomAction settings. For more information, see **Settings** in [Data types](#data21)".| - - -### Common Element - -Common is similar to an Application element, but it's always associated with two or more Application elements. The Common section represents the set of settings that are shared between those Application instances. It's a collection of the following fields/types. - -|Field/Type|Description| -|--- |--- | -|Name|Specifies a unique name for the settings location template. This name is used for display purposes when referencing the template in WMI, PowerShell, Event Viewer and debug logs. For more information, see [Name](#name21).| -|ID|Populates a unique identifier for a particular template. This tag becomes the primary identifier that the UE-V service uses to reference the template at runtime. For more information, see [ID](#id21).| -|Description|An optional description of the template.| -|LocalizedNames|An optional name displayed in the UI, localized by a language locale.| -|LocalizedDescriptions|An optional template description localized by a language locale.| -|Version|Identifies the version of the settings location template for administrative tracking of changes. For more information, see [Version](#version21).| -|DeferToMSAccount|Controls whether this template is enabled in conjunction with a Microsoft account or not. If MSA syncing is enabled for a user on a machine, then this template will automatically be disabled.| -|DeferToOffice365|Similar to MSA, this type controls whether this template is enabled in conjunction with Office365. If Office 365 is being used to sync settings, this template will automatically be disabled.| -|FixedProfile|Specifies that this template can only be associated with the profile specified within this element, and can't be changed via WMI or PowerShell.| -|Settings|A container for all the settings that apply to a particular template. It contains instances of the Registry, File, SystemParameter, and CustomAction settings. For more information, see **Settings** in [Data types](#data21).| - -### SettingsLocationTemplate Element - -This element defines the settings for a single application or a suite of applications. - -|Field/Type|Description| -|--- |--- | -|Name|Specifies a unique name for the settings location template. This type is used for display purposes when referencing the template in WMI, PowerShell, Event Viewer and debug logs. For more information, see [Name](#name21).| -|ID|Populates a unique identifier for a particular template. This tag becomes the primary identifier that the UE-V service uses to reference the template at runtime. For more information, see [ID](#id21).| -|Description|An optional description of the template.| -|LocalizedNames|An optional name displayed in the UI, localized by a language locale.| -|LocalizedDescriptions|An optional template description localized by a language locale.| - - -### Appendix: SettingsLocationTemplate.xsd - -Here's the SettingsLocationTemplate.xsd file showing its elements, child elements, attributes, and parameters: - -```xml - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -``` - - - - - -## Related topics - -[Working with Custom UE-V Templates and the UE-V Template Generator](uev-working-with-custom-templates-and-the-uev-generator.md) - -[Technical Reference for UE-V](uev-technical-reference.md) diff --git a/windows/configuration/ue-v/uev-changing-the-frequency-of-scheduled-tasks.md b/windows/configuration/ue-v/uev-changing-the-frequency-of-scheduled-tasks.md deleted file mode 100644 index 0104526a2b..0000000000 --- a/windows/configuration/ue-v/uev-changing-the-frequency-of-scheduled-tasks.md +++ /dev/null @@ -1,138 +0,0 @@ ---- -title: Changing the Frequency of UE-V Scheduled Tasks -description: Learn how to create a script that uses the Schtasks.exe command-line options so you can change the frequency of UE-V scheduled tasks. -author: aczechowski -ms.prod: windows-client -ms.collection: - - tier3 - - must-keep -ms.date: 04/19/2017 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.topic: article -ms.technology: itpro-configure ---- - -# Changing the Frequency of UE-V Scheduled Tasks - -**Applies to** -- Windows 10, version 1607 - -When the User Experience Virtualization (UE-V) service is enabled, it creates the following scheduled tasks: - -- [Monitor Application Settings](#monitor-application-settings) - -- [Sync Controller Application](#sync-controller-application) - -- [Synchronize Settings at Logoff](#synchronize-settings-at-logoff) - -- [Template Auto Update](#template-auto-update) - -> [!NOTE] -> These tasks must remain enabled, because UE-V cannot function without them. - -These scheduled tasks aren't configurable with the UE-V tools. Administrators who want to change the scheduled task for these items can create a script that uses the Schtasks.exe command-line options. - -For more information about Schtasks.exe, see [Schtasks](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc725744(v=ws.11)). - -## UE-V Scheduled Tasks - -The following scheduled tasks are included in UE-V with sample scheduled task configuration commands. - -### Monitor Application Settings - -The **Monitor Application Settings** task is used to synchronize settings for Windows apps. It's runs at sign in but is delayed by 30 seconds to not affect the logon detrimentally. The Monitor Application Status task runs the UevAppMonitor.exe file, which is located in the UE-V Agent installation directory. - -|Task name|Default event| -|--- |--- | -|\Microsoft\UE-V\Monitor Application Status|Sign in| - -### Sync Controller Application - -The **Sync Controller Application** task is used to start the Sync Controller to synchronize settings from the computer to the settings storage location. By default, the task runs every 30 minutes. At that time, local settings are synchronized to the settings storage location, and updated settings on the settings storage location are synchronized to the computer. The Sync Controller application runs the Microsoft.Uev.SyncController.exe, which is located in the UE-V Agent installation directory. - -|Task name|Default event| -|--- |--- | -|\Microsoft\UE-V\Sync Controller Application|Sign in, and every 30 minutes thereafter| - -For example, the following command configures the agent to synchronize settings every 15 minutes instead of the default 30 minutes. - -```console -Schtasks /change /tn “Microsoft\UE-V\Sync Controller Application” /ri 15 -``` - -### Synchronize Settings at Logoff - -The **Synchronize Settings at Logoff** task is used to start an application at sign in that controls the synchronization of applications at sign out for UE-V. The Synchronize Settings at Logoff task runs the Microsoft.Uev.SyncController.exe file, which is located in the UE-V Agent installation directory. - -|Task name|Default event| -|--- |--- | -|\Microsoft\UE-V\Synchronize Settings at Logoff|Sign in| - -### Template Auto Update - -The **Template Auto Update** task checks the settings template catalog for new, updated, or removed templates. This task only runs if the SettingsTemplateCatalog is configured. The **Template Auto Update** task runs the ApplySettingsCatalog.exe file, which is located in the UE-V Agent installation directory. - -|Task name|Default event| -|--- |--- | -|\Microsoft\UE-V\Template Auto Update|System startup and at 3:30 AM every day, at a random time within a 1-hour window| - - -**Example:** The following command configures the UE-V service to check the settings template catalog store every hour. - -```console -schtasks /change /tn "Microsoft\UE-V\Template Auto Update" /ri 60 -``` - - -## UE-V Scheduled Task Details - -The following chart provides additional information about scheduled tasks for UE-V 2: - -|Task Name (file name)|Default Frequency|Power Toggle|Idle Only|Network Connection|Description| -|--- |--- |--- |--- |--- |--- | -|**Monitor Application Settings** (UevAppMonitor.exe)|Starts 30 seconds after sign in and continues until sign out.|No|Yes|N/A|Synchronizes settings for Windows (AppX) apps.| -|**Sync Controller Application** (Microsoft.Uev.SyncController.exe)|At sign in and every 30 min thereafter.|Yes|Yes|Only if Network is connected|Starts the Sync Controller that synchronizes local settings with the settings storage location.| -|**Synchronize Settings at Logoff** (Microsoft.Uev.SyncController.exe)|Runs at sign in and then waits for sign out to Synchronize settings.|No|Yes|N/A|Start an application at sign in that controls the synchronization of applications at sign out.| -|**Template Auto Update** (ApplySettingsCatalog.exe)|Runs at initial sign in and at 3:30 AM every day thereafter.|Yes|No|N/A|Checks the settings template catalog for new, updated, or removed templates. This task only runs if SettingsTemplateCatalog is configured.| - -**Legend** - -- **Power Toggle** – Task Scheduler will optimize power consumption when not connected to AC power. The task might stop running if the computer switches to battery power. - -- **Idle Only** – The task will stop running if the computer ceases to be idle. By default the task won't restart when the computer is idle again. Instead the task will begin again on the next task trigger. - -- **Network Connection** – Tasks marked “Yes” only run if the computer has a network connection available. Tasks marked “N/A” run regardless of network connectivity. - -### How to Manage Scheduled Tasks - -To find Scheduled Tasks, perform the following steps: - -1. Open “Schedule Tasks” on the user computer. - -2. Navigate to: Task Scheduler -> Task Scheduler Library -> Microsoft -> UE-V - -3. Select the scheduled task you wish to manage and configure in the details pane. - -### Additional information - -The following additional information applies to UE-V scheduled tasks: - -- All task sequence programs are located in the UE-V Agent installation folder, `%programFiles%\Microsoft User Experience Virtualization\Agent\[architecture]\`, by default. - -- The Sync Controller Application Scheduled task is the crucial component when the UE-V SyncMethod is set to “SyncProvider” (UE-V default configuration). This scheduled task keeps the SettingsSToragePath synchronized with the locally cached versions of the settings package files. If users complain that settings don't synchronize often enough, then you can reduce the scheduled task setting to as little as 1 minute.  You can also increase the 30-min default to a higher amount if necessary. - -- You don't need to disable the Template Auto Update scheduled task if you use another method to keep the clients’ templates in sync (that is, Group Policy or Configuration Manager Baselines). Leaving the SettingsTemplateCatalog property value blank prevents UE-V from checking the settings catalog for custom templates. This scheduled task runs ApplySettingsCatalog.exe and will essentially return immediately. - -- The Monitor Application Settings scheduled task will update Windows app (AppX) settings in real time, based on Windows app program setting triggers built into each app. - - - - - -## Related topics - -[Administering UE-V](uev-administering-uev.md) - -[Deploy UE-V for Custom Applications](uev-deploy-uev-for-custom-applications.md) diff --git a/windows/configuration/ue-v/uev-configuring-uev-with-group-policy-objects.md b/windows/configuration/ue-v/uev-configuring-uev-with-group-policy-objects.md deleted file mode 100644 index 44e725599f..0000000000 --- a/windows/configuration/ue-v/uev-configuring-uev-with-group-policy-objects.md +++ /dev/null @@ -1,90 +0,0 @@ ---- -title: Configuring UE-V with Group Policy Objects -description: In this article, learn how to configure User Experience Virtualization (UE-V) with Group Policy objects. -author: aczechowski -ms.prod: windows-client -ms.collection: - - tier3 - - must-keep -ms.date: 04/19/2017 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.topic: article -ms.technology: itpro-configure ---- - -# Configuring UE-V with Group Policy Objects - -**Applies to** -- Windows 10, version 1607 - -Some User Experience Virtualization (UE-V) Group Policy settings can be defined for computers, and other Group Policy settings can be defined for users. The Group Policy administrative templates for these settings are included in Windows 10, version 1607. - - -The following policy settings can be configured for UE-V. - -**Group Policy settings** - -|Group Policy setting name|Target|Group Policy setting description|Configuration options| -|--- |--- |--- |--- | -|Do not use the sync provider|Computers and Users|By using this Group Policy setting, you can configure whether UE-V uses the sync provider feature. This policy setting also lets you enable notification to appear when the import of user settings is delayed.|Enable this setting to configure the UE-V service not to use the sync provider.| -|First Use Notification|Computers Only|This Group Policy setting enables a notification in the notification area that appears when the UE-V service runs for the first time.|The default is enabled.| -|Synchronize Windows settings|Computers and Users|This Group Policy setting configures the synchronization of Windows settings.|Select which Windows settings synchronize between computers.
                        By default, Windows themes, desktop settings, and Ease of Access settings synchronize settings between computers of the same operating system version.| -|Settings package size warning threshold|Computers and Users|This Group Policy setting lets you configure the UE-V service to report when a settings package file size reaches a defined threshold.|Specify the preferred threshold for settings package sizes in kilobytes (KB).
                        By default, the UE-V service does not have a package file size threshold.| -|Settings storage path|Computers and Users|This Group Policy setting configures where the user settings are to be stored.|Enter a Universal Naming Convention (UNC) path and variables such as \Server\SettingsShare%username%.| -|Settings template catalog path|Computers Only|This Group Policy setting configures where custom settings location templates are stored. This policy setting also configures whether the catalog is to be used to replace the default Microsoft templates that are installed with the UE-V service.|Enter a Universal Naming Convention (UNC) path such as \Server\TemplateShare or a folder location on the computer.
                        Select the check box to replace the default Microsoft templates.| -|Sync settings over metered connections|Computers and Users|This Group Policy setting defines whether UE-V synchronizes settings over metered connections.|By default, the UE-V service does not synchronize settings over a metered connection.| -|Sync settings over metered connections even when roaming|Computers and Users|This Group Policy setting defines whether UE-V synchronizes settings over metered connections outside of the home provider network, for example, when the data connection is in roaming mode.|By default, UE-V does not synchronize settings over a metered connection when it is in roaming mode.| -|Synchronization timeout|Computers and Users|This Group Policy setting configures the number of milliseconds that the computer waits before a time-out when it retrieves user settings from the remote settings location. If the remote storage location is unavailable, and the user does not use the sync provider, the application start is delayed by this many milliseconds.|Specify the preferred synchronization time-out in milliseconds. The default value is 2000 milliseconds.| -|Tray Icon|Computers Only|This Group Policy setting enables the User Experience Virtualization (UE-V) tray icon.|This setting only has an effect for UE-V 2.x and earlier. It has no effect for UE-V in Windows 10, version 1607.| -|Use User Experience Virtualization (UE-V)|Computers and Users|This Group Policy setting lets you enable or disable User Experience Virtualization (UE-V).|This setting only has an effect for UE-V 2.x and earlier. For UE-V in Windows 10, version 1607, use the **Enable UE-V** setting.| -|Enable UE-V|Computers and Users|This policy setting allows you to enable or disable User Experience Virtualization (UE-V) feature. Reboot is needed for enable to take effect.|This setting only has an effect for UE-V in Windows 10, version 1607. For UE-V 2.x and earlier, choose the **Use User Experience Virtualization (UE-V)** setting.| - ->[!NOTE] ->In addition, Group Policy settings are available for many desktop applications and Windows apps. You can use these settings to enable or disable settings synchronization for specific applications. - -**Windows App Group Policy settings** - -|Group Policy setting name|Target|Group Policy setting description|Configuration options| -|--- |--- |--- |--- | -|Do not synchronize Windows Apps|Computers and Users|This Group Policy setting defines whether the UE-V service synchronizes settings for Windows apps.|The default is to synchronize Windows apps.| -|Windows App List|Computer and User|This setting lists the family package names of the Windows apps and states expressly whether UE-V synchronizes that app’s settings.|You can use this setting to specify that settings of an app are never synchronized by UE-V, even if the settings of all other Windows apps are synchronized.| -|Sync Unlisted Windows Apps|Computer and User|This Group Policy setting defines the default settings sync behavior of the UE-V service for Windows apps that are not explicitly listed in the Windows app list.|By default, the UE-V service only synchronizes settings of those Windows apps that are included in the Windows app list.| - -For more information about synchronizing Windows apps, see [Windows App List](uev-managing-settings-location-templates-using-windows-powershell-and-wmi.md#win8applist). - -**To configure computer-targeted Group Policy settings** - -1. Use the Group Policy Management Console (GPMC) or the Advanced Group Policy Management (AGPM) on the computer that acts as a domain controller to manage Group Policy settings for UE-V computers. Navigate to **Computer configuration**, select **Policies**, select **Administrative Templates**, click **Windows Components**, and then select **Microsoft User Experience Virtualization**. - -2. Select the Group Policy setting to be edited. - -**To configure user-targeted Group Policy settings** - -1. Use the Group Policy Management Console (GPMC) or the Advanced Group Policy Management (AGPM) tool in Microsoft Desktop Optimization Pack (MDOP) on the domain controller computer to manage Group Policy settings for UE-V. Navigate to **User configuration**, select **Policies**, select **Administrative Templates**, click **Windows Components**, and then select **Microsoft User Experience Virtualization**. - -2. Select the edited Group Policy setting. - -The UE-V service uses the following order of precedence to determine synchronization. - -**Order of precedence for UE-V settings** - -1. User-targeted settings that are managed by Group Policy settings - These configuration settings are stored in the registry key by Group Policy under `HKEY_CURRENT_USER\Software\Policies\Microsoft\Uev\Agent\Configuration`. - -2. Computer-targeted settings that are managed by Group Policy settings - These configuration settings are stored in the registry key by Group Policy under `HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Uev\Agent\Configuration`. - -3. Configuration settings that are defined by the current user by using Windows PowerShell or Windows management Instrumentation (WMI) - These configuration settings are stored by the UE-V service under this registry location: `HKEY_CURRENT_USER\Software\Microsoft\Uev\Agent\Configuration`. - -4. Configuration settings that are defined for the computer by using Windows PowerShell or WMI. These configuration settings are stored by the UE-V service under this registry location: `HKEY_LOCAL_MACHINE\Software\Microsoft\Uev\Agent\Configuration`. - - - - - -## Related topics - - -[Administering UE-V](uev-administering-uev.md) - -[Manage Configurations for UE-V](uev-manage-configurations.md) diff --git a/windows/configuration/ue-v/uev-configuring-uev-with-system-center-configuration-manager.md b/windows/configuration/ue-v/uev-configuring-uev-with-system-center-configuration-manager.md deleted file mode 100644 index 30bf50f542..0000000000 --- a/windows/configuration/ue-v/uev-configuring-uev-with-system-center-configuration-manager.md +++ /dev/null @@ -1,195 +0,0 @@ ---- -title: Configuring UE-V with Microsoft Configuration Manager -description: Learn how to configure User Experience Virtualization (UE-V) with Microsoft Configuration Manager. -author: aczechowski -ms.prod: windows-client -ms.collection: - - tier3 - - must-keep -ms.date: 04/19/2017 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.topic: article -ms.technology: itpro-configure ---- - -# Configuring UE-V with Microsoft Configuration Manager - -**Applies to** -- Windows 10, version 1607 - -After you deploy User Experience Virtualization (UE-V) and its required features, you can start to configure it to meet your organization's need. The UE-V Configuration Pack provides a way for administrators to use the Compliance Settings feature of Microsoft Configuration Manager to apply consistent configurations across sites where UE-V and Configuration Manager are installed. - -## UE-V Configuration Pack supported features - -The UE-V Configuration Pack includes tools to: - -- Create or update UE-V settings location template distribution baselines - - - Define UE-V templates to be registered or unregistered - - - Update UE-V template configuration items and baselines as templates are added or updated - - - Distribute and register UE-V templates using standard Configuration Item remediation - -- Create or update a UE-V Agent policy configuration item to set or clear these settings - - |Configuration|Setting|Description| - |--- |--- |--- | - |Max package size|Enable/disable Windows app sync|Wait for sync on application start| - |Setting import delay|Sync unlisted Windows apps|Wait for sync on sign in| - |Settings import notification|IT contact URL|Wait for sync timeout| - |Settings storage path|IT contact descriptive text|Settings template catalog path| - |Sync enablement|Tray icon enabled|Start/Stop UE-V agent service| - |Sync method|First use notification|Define which Windows apps will roam settings| - |Sync timeout||| - -- Verify compliance by confirming that UE-V is running. - -## Generate a UE-V service policy configuration item - - -All UE-V service policy and configuration is distributed through a single configuration item that is generated using the UevAgentPolicyGenerator.exe tool. This tool reads the desired configuration from an XML configuration file and creates a CI containing the discovery and remediation settings needed to bring the machine into compliance. - -The UE-V service policy configuration item CAB file is created using the UevTemplateBaselineGenerator.exe command line tool, which has these parameters: - -- Site <site code> - -- PolicyName <name> Optional: Defaults to “UE-V Agent Policy” if not present - -- PolicyDescription <description> Optional: A description is provided if not present - -- CabFilePath <full path to configuration item .CAB file> - -- ConfigurationFile <full path to agent configuration XML file> - -> [!NOTE] -> It might be necessary to change the PowerShell execution policy to allow these scripts to run in your environment. Perform these steps in the Configuration Manager console: - -1. Select **Administration > Client Settings > Properties** - -2. In the **User Agent** tab, set the **PowerShell Execution Policy** to **Bypass** - - -**Create the first UE-V policy configuration item** - -1. Copy the default settings configuration file from the UE-V Config Pack installation directory to a location visible to your ConfigMgr Admin Console: - - ```cmd - C:\Program Files (x86)\Windows Kits\10\Microsoft User Experience Virtualization\Management\AgentConfiguration.xml - ``` - - The default configuration file contains five sections: - - **Computer Policy** - All UE-V machine level settings. The DesiredState attribute can be - - - **Set** to have the value assigned in the registry - - - **Clear** to remove the setting - - - **Unmanaged** to have the configuration item left at its current state - - Don't remove lines from this section. Instead, set the DesiredState to ‘Unmanaged’ if you don't want Configuration Manager to alter current or default values. - - **CurrentComputerUserPolicy** - All UE-V user level settings. These entries override the machine settings for a user. The DesiredState attribute can be - - - **Set** to have the value assigned in the registry - - - **Clear** to remove the setting - - - **Unmanaged** to have the configuration item left at its current state - - Don't remove lines from this section. Instead, set the DesiredState to ‘Unmanaged’ if you don't want Configuration Manager to alter current or default values. - - **Services** - Entries in this section control service operation. The default configuration file contains a single entry for the UevAgentService. The DesiredState attribute can be set to **Running** or **Stopped**. - - **Windows8AppsComputerPolicy** - All machine level Windows app synchronization settings. Each PackageFamilyName listed in this section can be assigned a DesiredState of - - - **Enabled** to have settings roam - - - **Disabled** to prevent settings from roaming - - - **Cleared** to have the entry removed from UE-V control - - More lines can be added to this section based on the list of installed Windows apps that can be viewed using the PowerShell cmdlet GetAppxPackage. - - **Windows8AppsCurrentComputerUserPolicy** - Identical to the Windows8AppsComputerPolicy with settings that override machine settings for an individual user. - -2. Edit the configuration file by changing the desired state and value fields. - -3. Run this command on a machine running the ConfigMgr Admin Console: - - ```cmd - C:\Program Files (x86)\Microsoft User Experience Virtualization\ConfigPack\UevAgentPolicyGenerator.exe -Site ABC -CabFilePath "C:\MyCabFiles\UevPolicyItem.cab" -ConfigurationFile "c:\AgentConfiguration.xml" - ``` - -4. Import the CAB file using ConfigMgr console or PowerShell Import-CMConfigurationItem - -**Update a UE-V Policy Configuration Item** - -1. Edit the configuration file by changing the desired state and value fields. - -2. Run the command from Step 3 in [Create the First UE-V Policy Configuration Item](#create). If you changed the name with the PolicyName parameter, make sure you enter the same name. - -3. Reimport the CAB file. The version in ConfigMgr will be updated. - -## Generate a UE-V Template Baseline - -UE-V templates are distributed using a baseline containing multiple configuration items. Each configuration item contains the discovery and remediation scripts needed to install one UE-V template. The actual UE-V template is embedded within the remediation script for distribution using standard Configuration Item functionality. - -The UE-V template baseline is created using the UevTemplateBaselineGenerator.exe command line tool, which has these parameters: - -- Site <site code> - -- BaselineName <name> (Optional: defaults to “UE-V Template Distribution Baseline” if not present) - -- BaselineDescription <description> (Optional: a description is provided if not present) - -- TemplateFolder <UE-V template folder> - -- Register <comma separated template file list> - -- Unregister <comma separated template list> - -- CabFilePath <Full path to baseline CAB file to generate> - -The result is a baseline CAB file that is ready for import into Configuration Manager. If at a future date, you update or add a template, you can rerun the command using the same baseline name. Importing the CAB results in CI version updates on the changed templates. - -### Create the First UE-V Template Baseline - -1. Create a “master” set of UE-V templates in a stable folder location visible to the machine running your ConfigMgr Admin Console. As templates are added or updated, this folder is where they're pulled for distribution. The initial list of templates can be copied from a machine with UE-V installed. The default template location is C:\\Program Files\\Microsoft User Experience Virtualization\\Templates. - -2. Create a text.bat file where you can add the template generator command. This step is optional, but will make regeneration simpler if you save the command parameters. - -3. Add the command and parameters to the .bat file that will generate the baseline. The following example creates a baseline that distributes Notepad and Calculator: - - ```cmd - C:\Program Files (x86)\Microsoft User Experience Virtualization\ConfigPack\UevTemplateBaselineGenerator.exe -Site "ABC" -TemplateFolder "C:\ProductionUevTemplates" -Register "MicrosoftNotepad.xml, MicrosoftCalculator.xml" -CabFilePath "C:\MyCabFiles\UevTemplateBaseline.cab" - ``` - -4. Run the .bat file to create UevTemplateBaseline.cab ready for import into Configuration Manager. - -### Update a UE-V Template Baseline - -The template generator uses the template version to determine if a template should be updated. If you make a template change and update the version, the baseline generator compares the template in your master folder with the template contained in the CI on the ConfigMgr server. If a difference is found, the generated baseline and modified CI versions are updated. - -To distribute a new Notepad template, you would perform these steps: - -1. Update the template and template version located in the <Version> element of the template. - -2. Copy the template to your master template directory. - -3. Run the command in the .bat file that you created in Step 3 in [Create the First UE-V Template Baseline](#create2). - -4. Import the generated CAB file into ConfigMgr using the console or PowerShell Import-CMBaseline. - -## Related articles - - -[Manage Configurations for UE-V](uev-manage-configurations.md) diff --git a/windows/configuration/ue-v/uev-deploy-required-features.md b/windows/configuration/ue-v/uev-deploy-required-features.md deleted file mode 100644 index 1ab8b30874..0000000000 --- a/windows/configuration/ue-v/uev-deploy-required-features.md +++ /dev/null @@ -1,168 +0,0 @@ ---- -title: Deploy required UE-V features -description: Learn how to install and configure User Experience Virtualization (UE-V) features, for example, a network share that stores and retrieves user settings. -author: aczechowski -ms.prod: windows-client -ms.collection: - - tier3 - - must-keep -ms.date: 04/19/2017 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.topic: article -ms.technology: itpro-configure ---- - -# Deploy required UE-V features - -**Applies to** -- Windows 10, version 1607 - -To get up and running with User Experience Virtualization (UE-V), install and configure the following features. - -- [Deploy a settings storage location](#deploy-a-ue-v-settings-storage-location) that is accessible to end users. - - This feature is a standard network share that stores and retrieves user settings. - -- [Choose the configuration method for UE-V](#choose-the-configuration-method-for-ue-v) - - You can deploy and configure UE-V with common management tools including group policy, Configuration Manager, or Windows Management Infrastructure and PowerShell. - -- [Enable the UE-V service](#enable-the-ue-v-service) on user devices. - - With Windows 10, version 1607, UE-V is installed automatically. You need to enable the UE-V service on each user device you want to include in your UE-V environment. - -The articles in this section describe how to deploy these features. - -## Deploy a UE-V Settings Storage Location - -UE-V requires a location in which to store user settings in settings package files. You can configure this settings storage location in one of these ways: - -- Create your own settings storage location - -- Use existing Active Directory for your settings storage location - -> **Note**   As a matter of [performance and capacity planning](uev-prepare-for-deployment.md#performance-and-capacity-planning) and to reduce problems with network latency, create settings storage locations on the same local networks where the users’ devices reside. We recommend 20 MB of disk space per user for the settings storage location. - -### Create a UE-V Settings Storage Location - -Before you define the settings storage location, you must create a root directory with read/write permissions for users who store settings on the share. The UE-V service creates user-specific folders under this root directory. - -The settings storage location is defined by setting the SettingsStoragePath configuration option, which you can configure by using one of these methods: - -- Through [Group Policy](uev-configuring-uev-with-group-policy-objects.md) settings - -- With the [Configuration Manager Pack](uev-configuring-uev-with-system-center-configuration-manager.md) for UE-V - -- With [Windows PowerShell or Windows Management Instrumentation (WMI)](uev-administering-uev-with-windows-powershell-and-wmi.md) - - The path must be in a universal naming convention (UNC) path of the server and share. For example, **\\\\Server\\Settingsshare\\**. This configuration option supports the use of variables to enable specific synchronization scenarios. For example, you can use the %username%\\%computername% variables to preserve the end user settings experience in these scenarios: - -- End users that use multiple physical devices in your enterprise - -- Enterprise computers that are used by multiple end users - -The UE-V service dynamically creates a user-specific settings storage path, with a hidden system folder named **SettingsPackages**, based on the configuration setting of **SettingsStoragePath**. The service reads and writes settings to this location as defined by the registered UE-V settings location templates. - -**UE-V settings are determined by a "Last write wins" rule:** If the settings storage location is the same for a user with multiple managed computers, one UE-V service reads and writes to the settings location independently of services running on other computers. The last written settings and values are the ones applied when the service next reads from the settings storage location. - -**Deploy the settings storage location:** Follow these steps to define the settings storage location rather than using your existing Active Directory agent. You should limit access to the settings storage share to those users that require it, as shown in the tables below. - -**To deploy the UE-V network share** - -1. Create a new security group for UE-V users. - -2. Create a new folder on the centrally located computer that stores the UE-V settings packages, and then grant UE-V users access with group permissions to the folder. The administrator who supports UE-V must have permissions to this shared folder. - -3. Set the following share-level Server Message Block (SMB) permissions for the settings storage location folder. - - | **User account** | **Recommended permissions** | - |------------------------------|-----------------------------| - | Everyone | No permissions | - | Security group of UE-V users | Full control | - -4. Set the following NTFS file system permissions for the settings storage location folder. - - | **User account** | **Recommended permissions** | **Folder** | - |------------------------------|---------------------------------------------------|---------------------------| - | Creator/owner | Full control | Subfolders and files only | - | Security group of UE-V users | List folder/read data, create folders/append data | This folder only | - -With this configuration, the UE-V service creates and secures a Settingspackage folder while it runs in the context of the user, and grants each user permission to create folders for settings storage. Users receive full control to their Settingspackage folder while other users can't access it. - -**Note** -If you create the settings storage share on a computer running a Windows Server operating system, configure UE-V to verify that either the local Administrators group or the current user is the owner of the folder where settings packages are stored. To enable this extra security, specify this setting in the Windows Server Registry Editor: - -1. Add a **REG\_DWORD** registry key named **"RepositoryOwnerCheckEnabled"** to **HKEY\_LOCAL\_MACHINE\\Software\\Microsoft\\UEV\\Agent\\Configuration**. - -2. Set the registry key value to *1*. - -### Use Active Directory with UE-V - -The UE-V service uses Active Directory (AD) by default if you don’t define a settings storage location. In these cases, the UE-V service dynamically creates the settings storage folder under the root of the AD home directory of each user. However, if a custom directory setting is configured in AD, then that directory is used instead. - -## Choose the Configuration Method for UE-V - -You’ll need to decide which configuration method you'll use to manage UE-V after deployment since this configuration method is the one you'll use to deploy the UE-V Agent. Typically, this configuration method is the one that you already use in your environment, such as Windows PowerShell or Configuration Manager. - -You can configure UE-V before, during, or after you enable the UE-V service on user devices, depending on the configuration method that you use. - -- [**Group Policy**](uev-configuring-uev-with-group-policy-objects.md) You can use your existing Group Policy infrastructure to configure UE-V before or after you enable the UE-V service. The UE-V Group Policy ADMX template enables the central management of common UE-V service configuration options and includes settings to configure UE-V synchronization. - - >**Note** Starting with Windows 10, version 1607, UE-V ADMX templates are installed automatically. - - Group Policy ADMX templates configure the synchronization settings for the UE-V service and enable the central management of common UE-V service configuration settings by using an existing Group Policy infrastructure. - - Supported operating systems for the domain controller that deploys the Group Policy Objects include: - - Windows Server 2012 and Windows Server 2012 R2 - -- [**Configuration Manager**](uev-configuring-uev-with-system-center-configuration-manager.md) The UE-V Configuration Pack lets you use the Compliance Settings feature of Microsoft Configuration Manager to apply consistent configurations across sites where UE-V and Configuration Manager are installed. - -- [**Windows PowerShell and WMI**](uev-administering-uev-with-windows-powershell-and-wmi.md) You can use scripted commands for Windows PowerShell and Windows Management Instrumentation (WMI) to modify the configuration of the UE-V service. - ->**Note** -Registry modification can result in data loss, or the computer becomes unresponsive. We recommend that you use other configuration methods. - -## Enable the UE-V service - -The UE-V service is the client-side component that captures user-personalized application and Windows settings and saves them in settings packages. Settings packages are built, locally stored, and copied to the settings storage location. - -Before enabling the UE-V service, you need to register the UE-V templates for first time use. In a PowerShell window, type **register-<TemplateName>** where **TemplateName** is the name of the UE-V template you want to register, and press ENTER. - ->**Note** -With Windows 10, version 1607, you must register UE-V templates for all inbox and custom templates. This provides flexibility for only deploying the required templates. - -With Windows 10, version 1607 and later, the UE-V service is installed on user devices. Enable the service to start using UE-V. You can enable the service with the Group Policy editor or with Windows PowerShell. - -**To enable the UE-V service with Group Policy** - -1. Open the device’s **Group Policy Editor**. - -2. Navigate to **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Microsoft** **User Experience Virtualization**. - -3. Run **Enable UEV**. - -4. Restart the device. - -**To enable the UE-V service with Windows PowerShell** - -1. In a PowerShell window, type **Enable-UEV** and press ENTER. - -2. Restart the device. - -3. In a PowerShell window, type **Get-UEVStatus** and press ENTER to verify that the UE-V service was successfully enabled. - - - - - -## Related articles - -[Prepare a UE-V deployment](uev-prepare-for-deployment.md) - -[Deploy UE-V for use with custom applications](uev-deploy-uev-for-custom-applications.md) - -[Upgrade to UE-V for Windows 10](uev-upgrade-uev-from-previous-releases.md) - diff --git a/windows/configuration/ue-v/uev-deploy-uev-for-custom-applications.md b/windows/configuration/ue-v/uev-deploy-uev-for-custom-applications.md deleted file mode 100644 index 65523c41b0..0000000000 --- a/windows/configuration/ue-v/uev-deploy-uev-for-custom-applications.md +++ /dev/null @@ -1,257 +0,0 @@ ---- -title: Use UE-V with custom applications -description: Use User Experience Virtualization (UE-V) to create your own custom settings location templates with the UE-V template generator. -author: aczechowski -ms.prod: windows-client -ms.collection: - - tier3 - - must-keep -ms.date: 04/19/2017 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.topic: article -ms.technology: itpro-configure ---- - -# Use UE-V with custom applications - -**Applies to** -- Windows 10, version 1607 - -User Experience Virtualization (UE-V) uses XML files called ***settings location templates*** to monitor and synchronize application settings and Windows settings between user devices. By default, some settings location templates are included in UE-V. However, if you want to synchronize settings for desktop applications other than those settings included in the default templates, you can create your own custom settings location templates with the UE-V template generator. - -After you’ve reviewed [Prepare a UE-V Deployment](uev-prepare-for-deployment.md) and decided that you want to synchronize settings for custom applications (for example, third-party, line-of-business), you’ll need to deploy the features of UE-V described in this topic. - -To start, here are the main steps required to synchronize settings for custom applications: - -- [Install the UE-V template generator](#install-the-uev-template-generator) - - Use the UEV template generator to create custom XML settings location templates. - -- [Configure a UE-V settings template catalog](#deploy-a-settings-template-catalog) - - You can define this path where custom settings location templates are stored. - -- [Create custom settings location templates](#create-custom-settings-location-templates) - - These custom templates let users sync settings for custom applications. - -- [Deploy the custom settings location templates](#deploy-the-custom-settings-location-templates) - - After you test the custom template to ensure that settings are synced correctly, you can deploy these templates in one of these ways: - - - With your existing electronic software distribution solution, such as Configuration Manager - - - With Group Policy preferences - - - With a UE-V settings template catalog - ->**Note** -Templates that are deployed with electronic software distribution methods or Group Policy must be registered with UE-V Windows Management Instrumentation (WMI) or Windows PowerShell. - -## Prepare to deploy UE-V for custom applications - -Before you start deploying the UE-V features that handle custom applications, review the following important information. - -### The UE-V template generator - -Use the UE-V template generator to monitor, discover, and capture the locations where Win32 applications store settings. The template generator doesn't create settings location templates for the following types of applications: - -- Virtualized applications - -- Applications that are offered through Terminal Services - -- Java applications - -- Windows applications - ->**Note** -UE-V settings location templates can't be created from virtualized applications or Terminal Services applications. However, settings that are synchronized by using the templates can be applied to those applications. To create templates that support Virtual Desktop Infrastructure (VDI) and Terminal Services applications, open a version of the Windows Installer (.msi) package of the application by using the UE-V template generator. For more information about synchronizing settings for virtual applications, see [Using UE-V with virtual applications](uev-using-uev-with-application-virtualization-applications.md). - -**Excluded Locations:** The discovery process excludes locations that commonly store application software files that don't synchronize settings well between user computers or computing environments. By default, these files are excluded: - -- HKEY\_CURRENT\_USER registry keys and files to which the signed-in user can't write values - -- HKEY\_CURRENT\_USER registry keys and files that are associated with the core functionality of the Windows operating system - -- All registry keys that are located in the HKEY\_LOCAL\_MACHINE hive - -- Files that are located in Program Files directories - -- Files that are located in Users \\ \[User name\] \\ AppData \\ LocalLow - -- Windows operating system files that are located in %Systemroot% - -If registry keys and files that are stored in excluded locations are required to synchronize application settings, you can manually add the locations to the settings location template during the template creation process. - -### Replace the default Microsoft templates - -A default group of settings location templates for common Microsoft applications and Windows settings is included with Windows 10, version 1607. If you customize these templates, or create settings location templates to synchronize settings for custom applications, the UE-V service can be configured to use a settings template catalog to store the templates. In this case, you'll need to include the default templates with the custom templates in the settings template catalog. - ->**Important** -After you enable the UE-V service, you’ll need to register the settings location templates using the `Register-UevTemplate` cmdlet in Windows PowerShell. - -When you use Group Policy to configure the settings template catalog path, you can choose to replace the default Microsoft templates. If you configure the policy settings to replace the default Microsoft templates, all of the default Microsoft templates that are installed with Windows 10, version 1607 are deleted and only the templates that are located in the settings template catalog are used. - -**Note** -If there are customized templates in the settings template catalog that use the same ID as the default Microsoft templates, the Microsoft templates are ignored. - -You can replace the default templates by using the UE-V Windows PowerShell features. To replace the default Microsoft template with Windows PowerShell, unregister all of the default Microsoft templates, and then register the customized templates. - -Old settings packages remain in the settings storage location even if you deploy new settings location templates for an application. These packages aren't read by the UE-V service, but neither are they automatically deleted. - -### Install the UEV template generator - -Use the UE-V template generator to create custom settings location templates that you can then distribute to user devices. You can also use the template generator to edit an existing template or validate a template that was created with another XML editor. - -The UE-V template generator is included in the Windows Assessment and Deployment Kit (ADK) for Windows 10. - -Install the UE-V template generator on a computer that you can use to create a custom settings location template. This computer should have the applications installed for which custom settings location templates need to be generated. - ->**Important** -UE-V for Windows 10, version 1607 includes a new template generator. If you are upgrading from an existing UE-V installation, you’ll need to use the new generator to create settings location templates. Templates created with previous versions of the UE-V template generator will continue to work. - -**To install the UE-V template generator** - -1. Go to [Download the Windows ADK](https://developer.microsoft.com/en-us/windows/hardware/windows-assessment-deployment-kit) to access the ADK. - -2. Select the **Get Windows ADK for Windows 10** button on this page to start the ADK installer. On the window pictured below, select **Microsoft User Experience Virtualization (UE-V) Template Generator** and then select Install. - - - -![Selecting UE-V features in ADK.](images/uev-adk-select-uev-feature.png) - -3. To open the generator, select **Microsoft Application Virtualization Generator** from the **Start** menu. - -4. See [Working with Custom UE-V Templates and the UE-V Template Generator](uev-working-with-custom-templates-and-the-uev-generator.md) for information about how to use the template generator. - -### Deploy a settings template catalog - -The UE-V settings template catalog is a folder path on UE-V computers or a Server Message Block (SMB) network share that stores all the custom settings location templates. The UE-V service checks this location one time each day and updates its synchronization behavior, based on the templates in this folder. - -The UE-V service checks this folder for templates that were added, updated, or removed. It registers new and changed templates and unregisters removed templates. By default, templates are registered and unregistered one time per day at 3:30 A.M. local time by the Task Scheduler and at system startup. To customize the frequency of this scheduled task, see [Changing the frequency of UE-V scheduled tasks](uev-changing-the-frequency-of-scheduled-tasks.md). - -You can configure the settings template catalog path with command-line options, Group Policy, WMI, or Windows PowerShell. Templates stored at the settings template catalog path are automatically registered and unregistered by a scheduled task. - -**To configure the settings template catalog for UE-V** - -1. Create a new folder on the computer that stores the UE-V settings template catalog. - -2. Set the following share-level (SMB) permissions for the settings template catalog folder. - - | **User account** | **Recommended permissions** | - |------------------|------------------------------| - | Everyone | No Permissions | - | Domain Computers | Read Permission Levels | - | Administrators | Read/Write Permission Levels | - -3. Set the following NTFS file system permissions for the settings template catalog folder. - - | **User account** | **Recommended permissions** | **Apply to** | - |------------------|-------------------------------|-----------------------------------| - | Creator/Owner | Full Control | This Folder, Subfolders and Files | - | Domain Computers | List Folder Contents and Read | This Folder, Subfolders and Files | - | Everyone | No Permissions | No Permissions | - | Administrators | Full Control | This Folder, Subfolders and Files | - -4. Click **OK** to close the dialog boxes. - -At a minimum, the network share must grant permissions for the Domain Computers group. In addition, grant access permissions for the network share folder to administrators who are to manage the stored templates. - -### Create custom settings location templates - -Use the UE-V template generator to create settings location templates for line-of-business applications or other custom applications. After you create the template for an application, deploy it to computers to synchronize settings for that application. - -**To create a UE-V settings location template with the UE-V template generator** - -1. Click **Start** > **All Programs** > **Microsoft User Experience Virtualization** > **Microsoft User Experience Virtualization template generator**. - -2. Click **Create a settings location template**. - -3. Specify the application. Browse to the file path of the application (.exe) or the application shortcut (.lnk) for which you want to create a settings location template. Specify the command-line arguments, if any, and working directory, if any. - -4. Click **Next** to continue. - - >**Note** Before the application is started, the system displays a prompt for **User Account Control**. Permission is required to monitor the registry and file locations that the application uses to store settings. - -5. After the application starts, close the application. The UE-V template generator records the locations where the application stores its settings. - -6. After the process is completed, click **Next** to continue. - -7. Review and select the appropriate registry settings locations and settings file locations to synchronize for this application. The list includes the following two categories for settings locations: - - - **Standard**: Application settings that are stored in the registry under the HKEY\_CURRENT\_USER keys or in the file folders under \\ **Users** \\ \[User name\] \\ **AppData** \\ **Roaming**. The UE-V template generator includes these settings by default. - - - **Nonstandard**: Application settings that are stored outside the locations are specified in the best practices for settings data storage (optional). These include files and folders under **Users** \\ \[User name\] \\ **AppData** \\ **Local**. Review these locations to determine whether to include them in the settings location template. Select the locations check boxes to include them. - -8. Click **Next** to continue. - -9. Review and edit any **Properties**, **Registry** locations, and **Files** locations for the settings location template. - - - Edit the following properties on the **Properties** tab: - - - **Application Name**: The application name that is written in the description of the program files properties. - - - **Program name**: The name of the program that is taken from the program file properties. This name usually has the .exe file name extension. - - - **Product version**: The product version number of the .exe file of the application. This property, in conjunction with the **File version**, helps determine which applications are targeted by the settings location template. This property accepts a major version number. If this property is empty, the settings location template applies to all versions of the product. - - - **File version**: The file version number of the .exe file of the application. This property, in conjunction with the **Product version**, helps determine which applications are targeted by the settings location template. This property accepts a major version number. If this property is empty, the settings location template applies to all versions of the program. - - - **template author name** (optional): The name of the settings location template author. - - - **template author email** (optional): The email address of the settings location template author. - - - The **Registry** tab lists the **Key** and **Scope** of the registry locations that are included in the settings location template. Edit the registry locations by using the **Tasks** drop-down menu. Tasks enable you to add new keys, edit the name or scope of existing keys, delete keys, and browse the registry where the keys are located. Use the **All Settings** scope to include all the registry settings under the specified key. Use the **All Settings and Subkeys** to include all the registry settings under the specified key, subkeys, and subkey settings. - - - The **Files** tab lists the file path and file mask of the file locations that are included in the settings location template. Edit the file locations by use of the **Tasks** drop-down menu. Tasks for file locations enable you to add new files or folder locations, edit the scope of existing files or folders, delete files or folders, and open the selected location in Windows Explorer. Leave the file mask empty to include all files in the specified folder. - -10. Click **Create**, and then click **Save** to save the settings location template on the computer. - -11. Click **Close** to close the settings template wizard. Exit the UE-V template generator application. - -12. After you've created the settings location template for an application, test the template. Deploy the template in a lab environment before you put it into production in the enterprise. - -See [Application template schema reference for UE-V](uev-application-template-schema-reference.md) for details about the XML structure of the UE-V settings location template and for guidance about editing these files. - -### Deploy the Custom Settings Location templates - -After you create a settings location template with the UE-V template generator, you should test it to ensure that the application settings are synchronized correctly. You can then safely deploy the settings location template to user devices in the enterprise. - -You can deploy settings location templates using of these methods: - -- An electronic software distribution (ESD) system such as Microsoft Configuration Manager - -- Group Policy preferences - -- A UE-V settings template catalog - -Templates that are deployed by using an ESD system or Group Policy objects must be registered using UE-V Windows Management Instrumentation (WMI) or Windows PowerShell. Templates that are stored in the settings template catalog location are automatically registered by the UE-V service. - -**To deploy UE-V settings location templates with a settings template catalog path** - -1. Browse to the network share folder that you defined as the settings template catalog. - -2. Add, remove, or update settings location templates in the settings template catalog to reflect the UE-V service template configuration that you want for UE-V computers. - - >**Note** - Templates on computers are updated daily. The update is based on changes to the settings template catalog. - -3. To manually update templates on a computer that runs the UE-V service, open an elevated command prompt, and browse to **Program Files\\Microsoft User Experience Virtualization \\ Agent \\ <x86 or x64 >**, and then run **ApplySettingstemplateCatalog.exe**. - - >**Note** - This program runs automatically during computer startup and daily at 3:30 A. M. to gather any new templates that were recently added to the catalog. - - - - - -## Related topics - -- [Prepare a UE-V Deployment](uev-prepare-for-deployment.md) - -- [Deploy Required UE-V Features](uev-deploy-required-features.md) - diff --git a/windows/configuration/ue-v/uev-for-windows.md b/windows/configuration/ue-v/uev-for-windows.md deleted file mode 100644 index c8732241c7..0000000000 --- a/windows/configuration/ue-v/uev-for-windows.md +++ /dev/null @@ -1,104 +0,0 @@ ---- -title: User Experience Virtualization for Windows 10, version 1607 -description: Overview of User Experience Virtualization for Windows 10, version 1607 -author: aczechowski -ms.prod: windows-client -ms.collection: - - tier3 - - must-keep -ms.date: 05/02/2017 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.topic: article -ms.technology: itpro-configure ---- - -# User Experience Virtualization (UE-V) for Windows 10 overview - -**Applies to** -- Windows 10, version 1607 - -Many users customize their settings for Windows and for specific applications. Customizable Windows settings include Microsoft Store appearance, language, background picture, font size, and accent colors. Customizable application settings include language, appearance, behavior, and user interface options. - -With User Experience Virtualization (UE-V), you can capture user-customized Windows and application settings and store them on a centrally managed network file share. When users log on, their personalized settings are applied to their work session, regardless of which device or virtual desktop infrastructure (VDI) sessions they log on to. - -**With UE-V you can…** - -- Specify which application and Windows settings synchronize across user devices - -- Deliver the settings anytime and anywhere users work throughout the enterprise - -- Create custom templates for your third-party or line-of-business applications - -- Recover settings after hardware replacement or upgrade, or after re-imaging a virtual machine to its initial state - -With the release of Windows 10, version 1607, UE-V is included with the Windows 10 for Enterprise edition. If you are new to Windows 10 and UE-V or upgrading from a previous version of UE-V, you’ll need to download, activate, and install server- and client-side components to start synchronizing user-customized settings across devices. - -## Components of UE-V - -The diagram below illustrates how UE-V components work together to synchronize user settings. - -UE-V architecture, with server share, desktop, and UE-V service - - - -| **Component** | **Function** | -|--------------------------|------------------| -| **UE-V service** | Enabled on every device that needs to synchronize settings, the **UE-V service** monitors registered applications and Windows for any settings changes, then synchronizes those settings between devices. | -| **Settings packages** | Application settings and Windows settings are stored in **settings packages** created by the UE-V service. Settings packages are built, locally stored, and copied to the settings storage location.
                        The setting values for **desktop applications** are stored when the user closes the application.
                        Values for **Windows settings** are stored when the user logs off, when the computer is locked, or when the user disconnects remotely from a computer.
                        The sync provider determines when the application or operating system settings are read from the **Settings Packages** and synchronized. | -| **Settings storage location** | This is a standard network share that your users can access. The UE-V service verifies the location and creates a hidden system folder in which to store and retrieve user settings. | -| **Settings location templates** | UE-V uses XML files as settings location templates to monitor and synchronize desktop application settings and Windows desktop settings between user computers. By default, some settings location templates are included in UE-V. You can also create, edit, or validate custom settings location templates by [managing settings synchronization for custom applications](#manage-settings-synchronization-for-custom-applications).
                        **Note**  Settings location templates are not required for Windows applications. | -| **Universal Windows applications list** | Settings for Windows applications are captured and applied dynamically. The app developer specifies the settings that are synchronized for each app. UE-V determines which Windows applications are enabled for settings synchronization using a managed list of applications. By default, this list includes most Windows applications.
                        You can add or remove applications in the Windows app list by following the procedures in [Managing UE-V Settings Location Templates Using Windows PowerShell and WMI](uev-managing-settings-location-templates-using-windows-powershell-and-wmi.md). | - -## Manage settings synchronization for custom applications - -Use these UE-V components to create and manage custom templates for your third-party or line-of-business applications. - -| Component | Description | -|-------------------------------|---------------| -| **UE-V template generator** | Use the **UE-V template generator** to create custom settings location templates that you can then distribute to user computers. The UE-V template generator also lets you edit an existing template or validate a template that was created with a different XML editor.
                        With the Windows 10, version 1607 release, the UE-V template generator is installed with the [Windows Assessment and Deployment kit for Windows 10, version 1607](https://developer.microsoft.com/en-us/windows/hardware/windows-assessment-deployment-kit) (Windows ADK).
                        If you are upgrading from an existing UE-V installation, you’ll need to use the new generator to create new settings location templates. Application templates created with previous versions of the UE-V template generator are still supported, however. | -| **Settings template catalog** | The **settings template catalog** is a folder path on UE-V computers or a Server Message Block (SMB) network share that stores the custom settings location templates. The UE-V service checks this location once a day, retrieves new or updated templates, and updates its synchronization behavior.
                        If you use only the UE-V default settings location templates, then a settings template catalog is unnecessary. For more information about settings deployment catalogs, see [Deploy a UE-V settings template catalog](uev-deploy-uev-for-custom-applications.md).| - - - -![UE-V template generator process.](images/uev-generator-process.png) - -## Settings synchronized by default - -UE-V synchronizes settings for these applications by default. For a complete list and more detailed information, see [Settings that are automatically synchronized in a UE-V deployment](uev-prepare-for-deployment.md). - -- Microsoft Office 2016, 2013, and 2010 - -- Internet Explorer 11 and 10 - -- Many Windows applications, such as Xbox - -- Many Windows desktop applications, such as Notepad - -- Many Windows settings, such as desktop background or wallpaper - ->**Note** -You can also [customize UE-V to synchronize settings](uev-deploy-uev-for-custom-applications.md) for applications other than those synchronized by default. - -## Other resources for this feature - -- [Get Started with UE-V for Windows 10](uev-getting-started.md) - -- [UE-V for Windows 10 Release Notes](uev-release-notes-1607.md) - -- [Prepare to deploy UE-V for Windows 10](uev-prepare-for-deployment.md) - -- [Upgrade to UE-V for Windows 10](uev-upgrade-uev-from-previous-releases.md) - -- [Administer UE-V for Windows 10](uev-administering-uev.md) - -- [Technical Reference for UE-V for Windows 10](uev-technical-reference.md) - - - -For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). diff --git a/windows/configuration/ue-v/uev-getting-started.md b/windows/configuration/ue-v/uev-getting-started.md deleted file mode 100644 index 7bf8cae820..0000000000 --- a/windows/configuration/ue-v/uev-getting-started.md +++ /dev/null @@ -1,174 +0,0 @@ ---- -title: Get Started with UE-V -description: Use the steps in this article to deploy User Experience Virtualization (UE-V) for the first time in a test environment. -author: aczechowski -ms.prod: windows-client -ms.collection: - - tier3 - - must-keep -ms.date: 03/08/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.technology: itpro-configure ---- - -# Get Started with UE-V - -**Applies to** -- Windows 10, version 1607 - ->[!NOTE] ->This documentation is for the most recent version of UE-V. If you're looking for information about UE-V 2.x, which was included in the Microsoft Desktop Optimization Pack (MDOP), see [Get Started with UE-V 2.x](/microsoft-desktop-optimization-pack/uev-v2/get-started-with-ue-v-2x-new-uevv2). - -Follow the steps in this topic to deploy User Experience Virtualization (UE-V) for the first time in a test environment. Evaluate UE-V to determine whether it’s the right solution to manage user settings across multiple devices within your enterprise. - ->[!NOTE] ->The information in this section is explained in greater detail throughout the rest of the documentation. If you’ve already determined that UE-V is the right solution and you don’t need to further evaluate it, see [Prepare a UE-V deployment](uev-prepare-for-deployment.md). - -The standard installation of UE-V synchronizes the default Microsoft Windows and Office settings and many Windows applications settings. For best results, ensure that your test environment includes two or more user computers that share network access. - -- [Step 1: Confirm prerequisites](#step-1-confirm-prerequisites). Review the supported configurations in this section to verify that your environment is able to run UE-V. - -- [Step 2: Deploy the settings storage location](#step-2-deploy-the-settings-storage-location). Explains how to deploy a settings storage location. All UE-V deployments require a location to store settings packages that contain the synchronized setting values. - -- [Step 3: Enable and configure the UE-V service](#step-3-enable-and-configure-the-ue-v-service-on-user-devices). Explains how to enable to UE-V service on user devices and configure the storage path. To synchronize settings using UE-V, devices must have the UE-V service enabled and running. - -- [Step 4: Test Your UE-V evaluation deployment](#step-4-test-your-ue-v-evaluation-deployment). Run a few tests on two computers with the UE-V service enabled to see how UE-V works and if it meets your organization’s needs. - -- Step 5: Deploy UE-V for custom applications (optional). If you want to evaluate how your third-party and line-of-business applications work with UE-V, follow the steps in [Use UE-V with custom applications](uev-deploy-uev-for-custom-applications.md). Following this link takes you to another topic. Use your browser’s **Back** button to return to this topic. - -## Step 1: Confirm prerequisites - -Before you proceed, ensure that your environment meets the following requirements for running UE-V. - -| **Operating system** | **Edition** | **Service pack** | **System architecture** | **Windows PowerShell** | **Microsoft .NET Framework** | -|-------------------------|-------------|------------------|-------------------------|----------------------------------|------------------------------| -| Windows 10, version 1607 | Windows 10 Enterprise | NA | 32-bit or 64-bit | Windows PowerShell 3.0 or higher | .NET Framework 4 or higher | -| Windows 8 and Windows 8.1 | Enterprise or Pro | None | 32-bit or 64-bit | Windows PowerShell 3.0 or higher | .NET Framework 4.5 | -| Windows Server 2012 or Windows Server 2012 R2 | Standard or Datacenter | None | 64-bit | Windows PowerShell 3.0 or higher | .NET Framework 4.5 | - -## Step 2: Deploy the settings storage location - -You’ll need to deploy a settings storage location, a standard network share where user settings are stored in a settings package file. When you create the settings storage share, you should limit access to users that require it. For more information, see [Deploy a UE-V Settings Storage Location](uev-deploy-required-features.md#deploy-a-ue-v-settings-storage-location). - -**Create a network share** - -1. Create a new security group and add UE-V users to the group. - -2. Create a new folder on the centrally located computer that stores the UE-V settings packages, and then grant the UE-V users access with group permissions to the folder. The administrator who supports UE-V must have permissions to this shared folder. - -3. Assign UE-V users permission to create a directory when they connect. Grant full permission to all subdirectories of that directory, but block access to anything above. - -4. Set the following share-level Server Message Block (SMB) permissions for the settings storage location folder. - - | **User account** | **Recommended permissions** | - |------------------------------|-----------------------------| - | Everyone | No permissions | - | Security group of UE-V users | Full control | - -5. Set the following NTFS file system permissions for the settings storage location folder. - - | **User account** | **Recommended permissions** | **Folder** | - |------------------------------|---------------------------------------------------|---------------------------| - | Creator/owner | Full control | Subfolders and files only | - | Security group of UE-V users | List folder/read data, create folders/append data | This folder only | - -**Security Note**  If you create the settings storage share on a computer running a Windows Server operating system, configure UE-V to verify that either the local Administrators group or the current user is the owner of the folder where settings packages are stored. To enable this additional security, specify this setting in the Windows Server Registry Editor: - -1. Add a **REG\_DWORD** registry key named **"RepositoryOwnerCheckEnabled"** to **HKEY\_LOCAL\_MACHINE\\Software\\Microsoft\\UEV\\Agent\\Configuration**. - -2. Set the registry key value to *1*. - -## Step 3: Enable and configure the UE-V service on user devices - -For evaluation purposes, enable the service on at least two devices that belong to the same user in your test environment. - -The UE-V service is the client-side component that captures user-personalized application and Windows settings and saves them in settings packages. Settings packages are built, locally stored, and copied to the settings storage location. - -Before enabling the UE-V service, you'll need to register the UE-V templates for first use. In a PowerShell window, type `Register-UevTemplate [TemplateName]` where **TemplateName** is the name of the UE-V template you want to register, and press ENTER. For instance, to register all built-in UE-V templates, use the following PowerShell Command: -`Get-childItem c:\programdata\Microsoft\UEV\InboxTemplates\*.xml|% {Register-UevTemplate $_.Fullname}` - -A storage path must be configured on the client-side to tell where the personalized settings are stored. - -**To set the storage path for UE-V with Group Policy** - -1. Open the device’s **Group Policy Editor**. - -2. Navigate to **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Microsoft** **User Experience Virtualization**. - -3. Double click **Settings storage path**. - -4. Select **Enabled**, fill in the **Settings storage path**, and click **OK**. - - - Ensure that the storage path ends with **%username%** to ensure that each user gets a unique folder. - -**To set the storage path for UE-V with PowerShell** - -1. In a PowerShell window, type **Set-uevConfiguration -SettingsStoragePath [StoragePath]** where **[StoragePath]** is the path to the location created in step 2 followed by **\%username%**. - - - Ensure that the storage path ends with **%username%** to ensure that each user gets a unique folder. - -With Windows 10, version 1607 and later, the UE-V service is installed on user devices when the operating system is installed. Enable the service to start using UE-V. You can enable the service with the Group Policy editor or with Windows PowerShell. - -**To enable the UE-V service with Group Policy** - -1. Open the device’s **Group Policy Editor**. - -2. Navigate to **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Microsoft** **User Experience Virtualization**. - -3. Double click **Use User Experience Virtualization (UE-V)**. - -4. Select **Enabled** and click **OK**. - -5. Restart the device. - -**To enable the UE-V service with Windows PowerShell** - -1. In a PowerShell window, type **Enable-UEV** and press ENTER. - -2. Restart the device. - -3. In a PowerShell window, type **Get-UEVStatus** and press ENTER to verify that the UE-V service was successfully enabled. - -## Step 4: Test your UE-V evaluation deployment - -You’re ready to run a few tests on your UE-V evaluation deployment to see how UE-V works. - -1. On the first device (Computer A), make one or more of these changes: - - - Open Windows Desktop and move the taskbar to a different location in the window. - - - Change the default fonts. - - - Open Notepad and set format -> word wrap **on**. - - - Change the behavior of any Windows application, as detailed in [Managing UE-V settings location templates using Windows PowerShell and WMI](uev-managing-settings-location-templates-using-windows-powershell-and-wmi.md). - - - Disable Microsoft Account settings synchronization and roaming profiles. - -2. Log off Computer A. Settings are saved in a UE-V settings package when users lock, logoff, exit an application, or when the sync provider runs (every 30 minutes by default). - -3. Log in to the second device (Computer B) as the same user as Computer A. - -4. Open Windows Desktop and verify that the taskbar location matches that of Computer A. Verify that the default fonts match and that NotePad is set to **word wrap on**. Also verify the change you made to any Windows applications. - -5. You can change the settings in Computer B back to the original Computer A settings. Then log off Computer B and log in to Computer A to verify the changes. - - - -For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). - -## Other resources for this feature - -- [User Experience Virtualization overview](uev-for-windows.md) - -- [Prepare a UE-V Deployment](uev-prepare-for-deployment.md) - -- [Upgrade to UE-V for Windows 10](uev-upgrade-uev-from-previous-releases.md) - -- [Administering UE-V](uev-administering-uev.md) - -- [Troubleshooting UE-V](uev-troubleshooting.md) - -- [Technical Reference for UE-V](uev-technical-reference.md) diff --git a/windows/configuration/ue-v/uev-manage-administrative-backup-and-restore.md b/windows/configuration/ue-v/uev-manage-administrative-backup-and-restore.md deleted file mode 100644 index ec137a5b65..0000000000 --- a/windows/configuration/ue-v/uev-manage-administrative-backup-and-restore.md +++ /dev/null @@ -1,136 +0,0 @@ ---- -title: Manage Administrative Backup and Restore in UE-V -description: Learn how an administrator of User Experience Virtualization (UE-V) can back up and restore application and Windows settings to their original state. -author: aczechowski -ms.prod: windows-client -ms.collection: - - tier3 - - must-keep -ms.date: 04/19/2017 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.topic: article -ms.technology: itpro-configure ---- - -# Manage Administrative Backup and Restore in UE-V - -**Applies to** -- Windows 10, version 1607 - -As an administrator of User Experience Virtualization (UE-V), you can restore application and Windows settings to their original state. You can also restore more settings when a user adopts a new device. - -## Restore Settings in UE-V when a User Adopts a New Device - - -To restore settings when a user adopts a new device, you can put a settings location template in a **backup** or **roam (default)** profile using the Set-UevTemplateProfile PowerShell cmdlet. This setup lets computer settings sync to the new computer, in addition to user settings. Templates assigned to the backup profile are backed up for that device and configured on a per-device basis. To back up settings for a template, use the following cmdlet in Windows PowerShell: - -```powershell -Set-UevTemplateProfile -ID -Profile -``` - -- <TemplateID> is the UE-V Template ID - -- <backup> can either be Backup or Roaming - -When a user’s device is being replaced, UE-V automatically restores settings if the user’s domain, username, and device name all match. All synchronized and any backup data is restored on the device automatically. - -You can also use the Windows PowerShell cmdlet, Restore-UevBackup, to restore settings from a different device. To clone the settings packages for the new device, use the following cmdlet in Windows PowerShell: - -```powershell -Restore-UevBackup -ComputerName -``` - -where <ComputerName> is the computer name of the device. - -Templates such as the Office 2013 template that include many applications can either all be included in the roamed (default) or backed up profile. Individual apps in a template suite follow the group. Office 2013 in-box templates include both roaming and backup-only settings. Backup-only settings can't be included in a roaming profile. - -As part of the Backup/Restore feature, UE-V added **last known good (LKG)** to the options for rolling back to settings. In this release, you can roll back to either the original settings or LKG settings. The LKG settings let users roll back to an intermediate and stable point ahead of the pre-UE-V state of the settings. - -### How to Backup/Restore Templates with UE-V - -Here are the key backup and restore components of UE-V: - -- Template profiles - -- Settings packages location within the Settings Storage Location template - -- Backup trigger - -- How settings are restored - -**Template Profiles** - -A UE-V template profile is defined when the template is registered on the device or post registration through the PowerShell/WMI configuration utility. The profile types include: - -- Roaming (default) - -- Backup - -- BackupOnly - -All templates are included in the roaming profile when registered unless otherwise specified. These templates synchronize settings to all UE-V enabled devices with the corresponding template enabled. - -Templates can be added to the Backup Profile with PowerShell or WMI using the Set-UevTemplateProfile cmdlet. Templates in the Backup Profile back up these settings to the Settings Storage Location in a special Device name directory. Specified settings are backed up to this location. - -Templates designated BackupOnly include settings specific to that device that shouldn't be synchronized unless explicitly restored. These settings are stored in the same device-specific settings package location on the settings storage location as the Backedup Settings. These templates have a special identifier embedded in the template that specifies they should be part of this profile. - -**Settings packages location within the Settings Storage Location template** - -Roaming Profile settings are stored on the settings storage location. Templates assigned to the Backup or the BackupOnly profile store their settings to the Settings Storage Location in a special Device name directory. Each device with templates in these profiles has its own device name. UE-V doesn't clean up these directories. - -**Backup trigger** - -Backup is triggered by the same events that trigger a UE-V synchronization. - -**How settings are restored** - -Restoring a user’s device restores the currently registered Template’s settings from another device’s backup folder and all synchronized settings to the current machine. Settings are restored in these two ways: - -- **Automatic restore** - - If the user’s UE-V settings storage path, domain, and Computer name match the current user then all of the settings for that user are synchronized, with only the latest settings applied. If a user signs in to a new device for the first time and these criteria are met, the settings data is applied to that device. - - **Note** - Accessibility and Windows Desktop settings require the user to sign in again to Windows to be applied. - - - -- **Manual Restore** - - If you want to assist users by restoring a device during a refresh, you can choose to use the Restore-UevBackup cmdlet. This command ensures that the user’s current settings become the current state on the Settings Storage Location. - -## Restore Application and Windows Settings to Original State - - -WMI and Windows PowerShell commands let you restore application and Windows settings to the settings values that were on the computer the first time that the application started after the UE-V service was enabled. This restoring action is performed on a per-application or Windows settings basis. The settings are restored the next time that the application runs, or the settings are restored when the user signs in to the operating system. - -**To restore application settings and Windows settings with Windows PowerShell for UE-V** - -1. Open the Windows PowerShell window. - -2. Enter the following Windows PowerShell cmdlet to restore the application settings and Windows settings. - - |**Windows PowerShell cmdlet**|**Description**| - |--- |--- | - |`Restore-UevUserSetting -` |Restores the user settings for an application or restores a group of Windows settings.| - -**To restore application settings and Windows settings with WMI** - -1. Open a Windows PowerShell window. - -2. Enter the following WMI command to restore application settings and Windows settings. - - |**WMI command**|**Description**| - |--- |--- | - |`Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class UserSettings -Name RestoreByTemplateId -ArgumentList `|Restores the user settings for an application or restores a group of Windows settings.| - ->[!NOTE] ->UE-V doesn't provide a settings rollback for Windows apps. - -## Related topics - -[Administering UE-V with Windows PowerShell and WMI](uev-administering-uev-with-windows-powershell-and-wmi.md) - -[Administering UE-V](uev-administering-uev.md) diff --git a/windows/configuration/ue-v/uev-manage-configurations.md b/windows/configuration/ue-v/uev-manage-configurations.md deleted file mode 100644 index 419e2f3379..0000000000 --- a/windows/configuration/ue-v/uev-manage-configurations.md +++ /dev/null @@ -1,74 +0,0 @@ ---- -title: Manage Configurations for UE-V -description: Learn to manage the configuration of the User Experience Virtualization (UE-V) service and also learn to manage storage locations for UE-V resources. -author: aczechowski -ms.prod: windows-client -ms.collection: - - tier3 - - must-keep -ms.date: 04/19/2017 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.topic: article -ms.technology: itpro-configure ---- - -# Manage Configurations for UE-V - -**Applies to** -- Windows 10, version 1607 - -In the course of the User Experience Virtualization (UE-V) lifecycle, you have to manage the configuration of the UE-V service and also manage storage locations for resources such as settings package files. The following topics provide guidance for managing these UE-V resources. - -## Configuring UE-V by using Group Policy Objects - -You can use Group Policy Objects to modify the settings that define how UE-V synchronizes settings on computers. - -[Configuring UE-V with Group Policy Objects](uev-configuring-uev-with-group-policy-objects.md) - -## Configuring UE-V with Microsoft Configuration Manager - -You can use Microsoft Endpoint Configuration Manager to manage the UE-V service by using the UE-V Configuration Pack. - -[Configuring UE-V with Microsoft Configuration Manager](uev-configuring-uev-with-system-center-configuration-manager.md) - -## Administering UE-V with PowerShell and WMI - -UE-V provides Windows PowerShell cmdlets, which can help administrators perform various UE-V tasks. - -[Administering UE-V with Windows PowerShell and WMI](uev-administering-uev-with-windows-powershell-and-wmi.md) - -## Examples of configuration settings for UE-V - -Here are some examples of UE-V configuration settings: - -- **Settings Storage Path:** Specifies the location of the file share that stores the UE-V settings. - -- **Settings Template Catalog Path:** Specifies the Universal Naming Convention (UNC) path that defines the location that was checked for new settings location templates. - -- **Register Microsoft Templates:** Specifies whether the default Microsoft templates should be registered during installation. - -- **Synchronization Method:** Specifies whether UE-V uses the sync provider or "none". The "SyncProvider" supports computers that are disconnected from the network. "None" applies when the computer is always connected to the network. For more information about the Sync Method, see [Sync Methods for UE-V](uev-sync-methods.md). - -- **Synchronization Timeout:** Specifies the number of milliseconds that the computer waits before time-out when it retrieves the user settings from the settings storage location. - -- **Synchronization Enable:** Specifies whether the UE-V settings synchronization is enabled or disabled. - -- **Maximum Package Size:** Specifies a settings package file threshold size in bytes at which the UE-V service reports a warning. - -- **Don’t Sync Windows App Settings:** Specifies that UE-V should not synchronize Windows apps. - -- **Enable/Disable First Use Notification:** Specifies whether UE-V displays a dialog box the first time that the UE-V service runs on a user’s computer. - - - - - -## Related topics - -[Administering UE-V](uev-administering-uev.md) - -[Deploy Required UE-V Features](uev-deploy-required-features.md) - -[Use UE-V with custom applications](uev-deploy-uev-for-custom-applications.md) diff --git a/windows/configuration/ue-v/uev-managing-settings-location-templates-using-windows-powershell-and-wmi.md b/windows/configuration/ue-v/uev-managing-settings-location-templates-using-windows-powershell-and-wmi.md deleted file mode 100644 index fd0c9e9aac..0000000000 --- a/windows/configuration/ue-v/uev-managing-settings-location-templates-using-windows-powershell-and-wmi.md +++ /dev/null @@ -1,186 +0,0 @@ ---- -title: Managing UE-V Settings Location Templates Using Windows PowerShell and WMI -description: Managing UE-V Settings Location Templates Using Windows PowerShell and WMI -author: aczechowski -ms.prod: windows-client -ms.collection: - - tier3 - - must-keep -ms.date: 04/19/2017 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.topic: article -ms.technology: itpro-configure ---- - -# Managing UE-V Settings Location Templates Using Windows PowerShell and WMI - -**Applies to** -- Windows 10, version 1607 - -User Experience Virtualization (UE-V) uses XML settings location templates to define the settings that User Experience Virtualization captures and applies. UE-V includes a set of standard settings location templates. It also includes the UE-V template generator tool that enables you to create custom settings location templates. After you create and deploy settings location templates, you can manage those templates by using Windows PowerShell and the Windows Management Instrumentation (WMI). - -> [!NOTE] -> For a complete list of UE-V cmdlets, see [User Experience Virtualization in Windows PowerShell](/powershell/module/uev/). - -## Manage UE-V settings location templates by using Windows PowerShell - -The WMI and Windows PowerShell features of UE-V include the ability to enable, disable, register, update, and unregister settings location templates. By using these features, you can automate the process of registering, updating, or unregistering templates with the UE-V service. You can also manually register templates by using WMI and Windows PowerShell commands. By using these features in conjunction with an electronic software distribution solution, Group Policy, or another automated deployment method such as a script, you can further automate that process. - -You must have administrator permissions to update, register, or unregister a settings location template. Administrator permissions are not required to enable, disable, or list templates. - -**To manage settings location templates by using Windows PowerShell** - -1. Use an account with administrator rights to open a Windows PowerShell command prompt. - -2. Use the following Windows PowerShell cmdlets to register and manage the UE-V settings location templates. - - |Windows PowerShell command|Description| - |--- |--- | - |`Get-UevTemplate`|Lists all the settings location templates that are registered on the computer.| - |`Get-UevTemplate -Application `|Lists all the settings location templates that are registered on the computer where the application name or template name contains.| - |`Get-UevTemplate -TemplateID `|Lists all the settings location templates that are registered on the computer where the template ID contains.| - |`Get-UevTemplate [-ApplicationOrTemplateID] `|Lists all the settings location templates that are registered on the computer where the application or template name, or template ID contains.| - |`Get-UevTemplateProgram [-ID]