mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-12 13:27:23 +00:00
Merge branch 'master' of https://cpubwin.visualstudio.com/_git/it-client
This commit is contained in:
LizRoss
commit
0ac7c32cbe
@ -7647,7 +7647,7 @@
|
||||
},
|
||||
{
|
||||
"source_path": "windows/manage/manage-corporate-devices.md",
|
||||
"redirect_url": "/windows/client-management/manage-corporate-devices",
|
||||
"redirect_url": "/windows/client-management/index",
|
||||
"redirect_document_id": true
|
||||
},
|
||||
{
|
||||
|
||||
@ -9,7 +9,7 @@ ms.pagetype: surfacehub
|
||||
ms.sitesec: library
|
||||
author: jdeckerms
|
||||
ms.author: jdecker
|
||||
ms.date: 06/19/2017
|
||||
ms.date: 08/17/2017
|
||||
ms.localizationpriority: medium
|
||||
---
|
||||
|
||||
@ -24,7 +24,6 @@ The full list of accessibility settings are available to IT admins in the **Sett
|
||||
|
||||
| Accessibility feature | Default settings |
|
||||
| --------------------- | ----------------- |
|
||||
| Narrator | Off |
|
||||
| Magnifier | Off |
|
||||
| High contrast | No theme selected |
|
||||
| Closed captions | Defaults selected for Font and Background and window |
|
||||
@ -32,6 +31,17 @@ The full list of accessibility settings are available to IT admins in the **Sett
|
||||
| Mouse | Defaults selected for **Pointer size**, **Pointer color** and **Mouse keys**. |
|
||||
| Other options | Defaults selected for **Visual options** and **Touch feedback**. |
|
||||
|
||||
The accessibility feature Narrator is not available in the **Settings** app. By default, Narrator is turned off. To change the default settings for Narrator, perform the following steps using a keyboard and mouse.
|
||||
|
||||
1. Dismiss the Welcome screen.
|
||||
2. Open **Quick Actions** > **Ease of Access** from the status bar.
|
||||
|
||||
|
||||
|
||||
3. Turn Narrator on.
|
||||
4. Click **Task Switcher**.
|
||||
5. Select **Narrator Settings** from Task Switcher. You can now edit the default Narrator settings.
|
||||
|
||||
Additionally, these accessibility features and apps are returned to default settings when users press [End session](finishing-your-surface-hub-meeting.md):
|
||||
- Narrator
|
||||
- Magnifier
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: PowerShell for Surface Hub (Surface Hub)
|
||||
description: PowerShell scripts to help set up and manage your Microsoft Surface Hub .
|
||||
description: PowerShell scripts to help set up and manage your Microsoft Surface Hub.
|
||||
ms.assetid: 3EF48F63-8E4C-4D74-ACD5-461F1C653784
|
||||
keywords: PowerShell, set up Surface Hub, manage Surface Hub
|
||||
ms.prod: w10
|
||||
@ -9,7 +9,7 @@ ms.sitesec: library
|
||||
ms.pagetype: surfacehub
|
||||
author: jdeckerms
|
||||
ms.author: jdecker
|
||||
ms.date: 06/19/2017
|
||||
ms.date: 08/16/2017
|
||||
ms.localizationpriority: medium
|
||||
---
|
||||
|
||||
@ -465,7 +465,7 @@ PrintAction "Configuring password not to expire..."
|
||||
Start-Sleep -s 20
|
||||
try
|
||||
{
|
||||
Set-AdUser $mailbox.Alias -PasswordNeverExpires $true -Enabled $true
|
||||
Set-AdUser $mailbox.UserPrincipalName -PasswordNeverExpires $true -Enabled $true
|
||||
}
|
||||
catch
|
||||
{
|
||||
@ -1243,7 +1243,7 @@ if (!$fExIsOnline)
|
||||
}
|
||||
|
||||
|
||||
$strAlias = $mailbox.Alias
|
||||
$strAlias = $mailbox.UserPrincipalName
|
||||
$strDisplayName = $mailbox.DisplayName
|
||||
|
||||
$strLinkedAccount = $strLinkedDomain = $strLinkedUser = $strLinkedServer = $null
|
||||
@ -1424,7 +1424,7 @@ if ($fHasOnPrem)
|
||||
else
|
||||
{
|
||||
#AD User enabled validation
|
||||
$accountOnPrem = Get-AdUser $strAlias -properties PasswordNeverExpires -WarningAction SilentlyContinue -ErrorAction SilentlyContinue
|
||||
$accountOnPrem = Get-AdUser $mailbox.UserPrincipalName -properties PasswordNeverExpires -WarningAction SilentlyContinue -ErrorAction SilentlyContinue
|
||||
}
|
||||
$strOnPremUpn = $accountOnPrem.UserPrincipalName
|
||||
Validate -Test "There is a user account for $strOnPremUpn" -Condition ($accountOnprem -ne $null) -FailureMsg "Could not find an Active Directory account for this user"
|
||||
|
||||
@ -8,7 +8,7 @@ ms.sitesec: library
|
||||
ms.pagetype: surfacehub
|
||||
author: jdeckerms
|
||||
ms.author: jdecker
|
||||
ms.date: 06/19/2017
|
||||
ms.date: 08/17/2017
|
||||
ms.localizationpriority: medium
|
||||
---
|
||||
|
||||
@ -16,6 +16,13 @@ ms.localizationpriority: medium
|
||||
|
||||
This topic lists new and updated topics in the [Surface Hub Admin Guide]( surface-hub-administrators-guide.md).
|
||||
|
||||
## August 2017
|
||||
|
||||
New or changed topic | Description
|
||||
--- | ---
|
||||
[Accessibility](accessibility-surface-hub.md) | Added information about Narrator
|
||||
|
||||
|
||||
## July 2017
|
||||
|
||||
| New or changed topic | Description |
|
||||
|
||||
BIN
devices/surface-hub/images/ease-of-access.png
Normal file
BIN
devices/surface-hub/images/ease-of-access.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 46 KiB |
@ -127,11 +127,11 @@ Hybrid and on-premises deployments include Active Directory as part of their inf
|
||||
|
||||
### Public Key Infrastructure
|
||||
|
||||
The Windows Hello for Business deployment depends on an enterprise public key infrastructure a trust anchor for authentication. Domain controllers for hybrid and on-prem deployments need a certificate in order for Windows 10 devices to trust the domain controller is a legitimate. Deployments using the certificate trust type need an enterprise public key infrastructure and a certificate registration authority to issue authentication certificates to users. Hybrid deployments may need to issue VPN certificates to users to enable connectivity on-premises resources.
|
||||
The Windows Hello for Business deployment depends on an enterprise public key infrastructure a trust anchor for authentication. Domain controllers for hybrid and on-prem deployments need a certificate in order for Windows 10 devices to trust the domain controller as legitimate. Deployments using the certificate trust type need an enterprise public key infrastructure and a certificate registration authority to issue authentication certificates to users. Hybrid deployments may need to issue VPN certificates to users to enable connectivity on-premises resources.
|
||||
|
||||
### Cloud
|
||||
|
||||
Some deployment combinations require an Azure account and some require Azure Active Directory for user identities. These cloud requirements can may only need an Azure account while other features need an Azure Active Directory Premium subscription. The planning process identifies and differentiate the components that are needed from the those that are optional.
|
||||
Some deployment combinations require an Azure account and some require Azure Active Directory for user identities. These cloud requirements may only need an Azure account while other features need an Azure Active Directory Premium subscription. The planning process identifies and differentiate the components that are needed from the those that are optional.
|
||||
|
||||
## Planning a Deployment
|
||||
|
||||
@ -188,7 +188,7 @@ If box **1a** on your planning worksheet reads **cloud only**, write **N/A** in
|
||||
|
||||
If box **1a** on your planning worksheet reads **hybrid**, then write **Azure AD Connect** in box **1e** on your planning worksheet.
|
||||
|
||||
If box **1a** on your planning worksheet reads **on-premises**, then write **Azure MFA Server**. This deployment exclusive uses Active Directory for user information with the exception of the multifactor authentication. The on-premises Azure MFA server synchronizes a subset of the user information, such as phone number, to provide multifactor authentication while the user’s credential remain on the on-premises network.
|
||||
If box **1a** on your planning worksheet reads **on-premises**, then write **Azure MFA Server**. This deployment exclusively uses Active Directory for user information with the exception of the multifactor authentication. The on-premises Azure MFA server synchronizes a subset of the user information, such as phone number, to provide multifactor authentication while the user’s credential remain on the on-premises network.
|
||||
|
||||
### Multifactor Authentication
|
||||
|
||||
@ -204,13 +204,13 @@ If box **1a** on your planning worksheet reads **hybrid**, then you have a few o
|
||||
|
||||
You can directly use the Azure MFA cloud service for the second factor of authentication. Users contacting the service must authenticate to Azure prior to using the service.
|
||||
|
||||
If your Azure AD Connect is configured to synchronize identities (usernames only), then your users are redirected to your local on-premises federation server for authentication and then redirected back to the Azure MFA cloud service. Otherwise, your Azure AD Connect is configured to synchronize credentials (username and passwords), which enables your users to authenticate to Azure Active and use the Azure MFA cloud service. If you choose to use the Azure MFA cloud service directly, write **Azure MFA** in box **1f** on your planning worksheet.
|
||||
If your Azure AD Connect is configured to synchronize identities (usernames only), then your users are redirected to your local on-premises federation server for authentication and then redirected back to the Azure MFA cloud service. Otherwise, your Azure AD Connect is configured to synchronize credentials (username and passwords), which enables your users to authenticate to Azure Active Directory and use the Azure MFA cloud service. If you choose to use the Azure MFA cloud service directly, write **Azure MFA** in box **1f** on your planning worksheet.
|
||||
|
||||
You can configure your on-premises Windows Server 2016 AD FS role to use the Azure MFA service adapter. In this configuration, users are redirected to the on premises AD FS server (synchronizing identities only). The AD FS server uses the MFA adapter to communicate to the Azure MFA service to perform the second factor of authentication. If you choose to use AD FS with the Azure MFA cloud service adapter, write **AD FS with Azure MFA cloud adapter** in box **1f** on your planning worksheet.
|
||||
|
||||
Alternatively, you can use AD FS with an on-premises Azure MFA server adapter. Rather than AD FS communicating directly with the Azure MFA cloud service, it communicates with an on-premises AD FS server that synchronizes user information with the on-premises Active Directory. The Azure MFA server communicates with Azure MFA cloud services to perform the second factor of authentication. If you choose to use AD FS with the Azure MFA server adapter, write **AD FS with Azure MFA server adapter** in box **1f** on your planning worksheet.
|
||||
|
||||
The last option is for you to use AD FS with a third-party adapter to as the second factor of authentication. If you choose to use AD FS with a third-party MFA adapter, write **AD FS with third party** in box **1f** on your planning worksheet.
|
||||
The last option is for you to use AD FS with a third-party adapter as the second factor of authentication. If you choose to use AD FS with a third-party MFA adapter, write **AD FS with third party** in box **1f** on your planning worksheet.
|
||||
|
||||
If box **1a** on your planning worksheet reads **on-premises**, then you have two second factor authentication options. You must use Windows Server 2016 AD FS with your choice of the on-premises Azure MFA server or with a third-party MFA adapter.
|
||||
|
||||
@ -261,7 +261,7 @@ Review the trust type portion of this section if box **4d** on your planning wor
|
||||
|
||||
### Public Key Infrastructure
|
||||
|
||||
Public key infrastructure prerequisites already exist on your planning worksheet. These conditions are the minimum requirements for any hybrid our on-premises deployment. Additional conditions may be needed based on your trust type.
|
||||
Public key infrastructure prerequisites already exist in your planning worksheet. These conditions are the minimum requirements for any hybrid or on-premises deployment. Additional conditions may be needed based on your trust type.
|
||||
|
||||
If box **1a** on your planning worksheet reads **cloud only**, ignore the public key infrastructure section of your planning worksheet. Cloud only deployments do not use a public key infrastructure.
|
||||
|
||||
|
||||
@ -7,6 +7,7 @@
|
||||
## [Group Policies that apply only to Windows 10 Enterprise and Windows 10 Education](group-policies-for-enterprise-and-education-editions.md)
|
||||
## [Manage the Settings app with Group Policy](manage-settings-app-with-group-policy.md)
|
||||
## [Reset a Windows 10 Mobile device](reset-a-windows-10-mobile-device.md)
|
||||
## [Transitioning to modern management](manage-windows-10-in-your-organization-modern-management.md)
|
||||
## [Windows 10 Mobile deployment and management guide](windows-10-mobile-and-mdm.md)
|
||||
## [Windows libraries](windows-libraries.md)
|
||||
## [Mobile device management for solution providers](mdm/index.md)
|
||||
|
||||
@ -18,15 +18,15 @@ Learn about the administrative tools, tasks and best practices for managing Wind
|
||||
| Topic | Description |
|
||||
|---|---|
|
||||
|[Administrative Tools in Windows 10](administrative-tools-in-windows-10.md)| Links to documentation for tools for IT pros and advanced users in the Administrative Tools folder.|
|
||||
|[Connect to remote AADJ PCs](connect-to-remote-aadj-pc.md)| Instructions for connecting to a remote PC joined to Azure Active Directory (Azure AD)|
|
||||
|[Group policies for enterprise and education editions](group-policies-for-enterprise-and-education-editions.md)| Listing of all group policy settings that apply specifically to Windows 10 Enterprise and Education editions|
|
||||
|[Join Windows 10 Mobile to AAD](join-windows-10-mobile-to-azure-active-directory.md)| Describes the considerations and options for using Windows 10 Mobile with Azure AD in your organization.|
|
||||
|[Manage corporate devices](manage-corporate-devices.md)| Listing of resources to manage all your corporate devices running Windows 10 : desktops, laptops, tablets, and phones |
|
||||
|[Transitioning to modern ITPro management](manage-windows-10-in-your-organization-modern-management.md)| Describes modern Windows 10 ITPro management scenarios across traditional, hybrid and cloud-based enterprise needs|
|
||||
|[Mandatory user profiles](mandatory-user-profile.md)| Instructions for managing settings commonly defined in a mandatory profiles, including (but are not limited to): icons that appear on the desktop, desktop backgrounds, user preferences in Control Panel, printer selections, and more.|
|
||||
|[Create mandatory user profiles](mandatory-user-profile.md)| Instructions for managing settings commonly defined in a mandatory profiles, including (but are not limited to): icons that appear on the desktop, desktop backgrounds, user preferences in Control Panel, printer selections, and more.|
|
||||
|[Connect to remote Azure Active Directory-joined PCs](connect-to-remote-aadj-pc.md)| Instructions for connecting to a remote PC joined to Azure Active Directory (Azure AD)|
|
||||
|[Join Windows 10 Mobile to Azure AD](join-windows-10-mobile-to-azure-active-directory.md)| Describes the considerations and options for using Windows 10 Mobile with Azure AD in your organization.|
|
||||
|[New policies for Windows 10](new-policies-for-windows-10.md)| Listing of new group policy settings available in Windows 10|
|
||||
|[Group policies for enterprise and education editions](group-policies-for-enterprise-and-education-editions.md)| Listing of all group policy settings that apply specifically to Windows 10 Enterprise and Education editions|
|
||||
| [Manage the Settings app with Group Policy](manage-settings-app-with-group-policy.md) | Starting in Windows 10, version 1703, you can now manage the pages that are shown in the Settings app by using Group Policy. |
|
||||
|[Reset a Windows 10 Mobile device](reset-a-windows-10-mobile-device.md)| Instructions for resetting a Windows 10 Mobile device using either *factory* or *'wipe and persist'* reset options|
|
||||
|[Deploy Windows 10 Mobile](windows-10-mobile-and-mdm.md)| Considerations and instructions for deploying Windows 10 Mobile|
|
||||
|[Transitioning to modern ITPro management](manage-windows-10-in-your-organization-modern-management.md)| Describes modern Windows 10 ITPro management scenarios across traditional, hybrid and cloud-based enterprise needs|
|
||||
|[Windows 10 Mobile deployment and management guide](windows-10-mobile-and-mdm.md)| Considerations and instructions for deploying Windows 10 Mobile|
|
||||
|[Windows libraries](windows-libraries.md)| Considerations and instructions for managing Windows 10 libraries such as My Documents, My Pictures, and My Music.|
|
||||
|[Mobile device management for solution providers](mdm/index.md) | Procedural and reference documentation for solution providers providing mobile device management (MDM) for Windows 10 devices. |
|
||||
|[Change history for Client management](change-history-for-client-management.md) | This topic lists new and updated topics in the Client management documentation for Windows 10 and Windows 10 Mobile. |
|
||||
@ -200,6 +200,7 @@
|
||||
#### [ErrorReporting](policy-csp-errorreporting.md)
|
||||
#### [EventLogService](policy-csp-eventlogservice.md)
|
||||
#### [Experience](policy-csp-experience.md)
|
||||
#### [ExploitGuard](policy-csp-exploitguard.md)
|
||||
#### [Games](policy-csp-games.md)
|
||||
#### [InternetExplorer](policy-csp-internetexplorer.md)
|
||||
#### [Kerberos](policy-csp-kerberos.md)
|
||||
|
||||
@ -6,7 +6,7 @@ ms.topic: article
|
||||
ms.prod: w10
|
||||
ms.technology: windows
|
||||
author: nickbrower
|
||||
ms.date: 07/06/2017
|
||||
ms.date: 08/14/2017
|
||||
---
|
||||
|
||||
# BitLocker CSP
|
||||
@ -91,8 +91,38 @@ The following diagram shows the BitLocker configuration service provider in tree
|
||||
|
||||
<p style="margin-left: 20px">Data type is integer. Supported operations are Add, Get, Replace, and Delete.</p>
|
||||
|
||||
<a href="" id="encryptionmethodbydrivetype"></a>**EncryptionMethodByDriveType**
|
||||
<p style="margin-left: 20px">Allows you to set the default encrytion method for each of the different drive types. This setting is a direct mapping to the Bitlocker Group Policy "Choose drive encryption method and cipher strength (Windows 10 [Version 1511] and later)" (Policy EncryptionMethodWithXts_Name).</p>
|
||||
<a href="" id="encryptionmethodbydrivetype"></a>**EncryptionMethodByDriveType**
|
||||
<p style="margin-left: 20px">Allows you to set the default encrytion method for each of the different drive types. This setting is a direct mapping to the Bitlocker Group Policy "Choose drive encryption method and cipher strength (Windows 10 [Version 1511] and later)".</p>
|
||||
<table>
|
||||
<tr>
|
||||
<th>Home</th>
|
||||
<th>Pro</th>
|
||||
<th>Business</th>
|
||||
<th>Enterprise</th>
|
||||
<th>Education</th>
|
||||
<th>Mobile</th>
|
||||
<th>Mobile Enterprise</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
<p style="margin-left: 20px">ADMX Info:</p>
|
||||
<ul>
|
||||
<li>GP English name: *Choose drive encryption method and cipher strength (Windows 10 [Version 1511] and later)*</li>
|
||||
<li>GP name: *EncryptionMethodWithXts_Name*</li>
|
||||
<li>GP path: *Windows Components/Bitlocker Drive Encryption*</li>
|
||||
<li>GP ADMX file name: *VolumeEncryption.admx*</li>
|
||||
</ul>
|
||||
|
||||
> [!Tip]
|
||||
> For a step-by-step guide to enable ADMX-backed policies, see [Enable ADMX-backed policies in MDM](enable-admx-backed-policies-in-mdm.md). For additional information, see [Understanding ADMX-backed policies](understanding-admx-backed-policies.md).
|
||||
|
||||
<p style="margin-left: 20px">This setting allows you to configure the algorithm and cipher strength used by BitLocker Drive Encryption. This setting is applied when you turn on BitLocker. Changing the encryption method has no effect if the drive is already encrypted, or if encryption is in progress.</p>
|
||||
|
||||
@ -140,7 +170,37 @@ The following diagram shows the BitLocker configuration service provider in tree
|
||||
<p style="margin-left: 20px">Data type is string. Supported operations are Add, Get, Replace, and Delete.</p>
|
||||
|
||||
<a href="" id="systemdrivesrequirestartupauthentication"></a>**SystemDrivesRequireStartupAuthentication**
|
||||
<p style="margin-left: 20px">This setting is a direct mapping to the Bitlocker Group Policy "Require additional authentication at startup" (ConfigureAdvancedStartup_Name ).</p>
|
||||
<p style="margin-left: 20px">This setting is a direct mapping to the Bitlocker Group Policy "Require additional authentication at startup".</p>
|
||||
<table>
|
||||
<tr>
|
||||
<th>Home</th>
|
||||
<th>Pro</th>
|
||||
<th>Business</th>
|
||||
<th>Enterprise</th>
|
||||
<th>Education</th>
|
||||
<th>Mobile</th>
|
||||
<th>Mobile Enterprise</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
<p style="margin-left: 20px">ADMX Info:</p>
|
||||
<ul>
|
||||
<li>GP English name: *Require additional authentication at startup*</li>
|
||||
<li>GP name: *ConfigureAdvancedStartup_Name*</li>
|
||||
<li>GP path: *Windows Components/Bitlocker Drive Encryption/Operating System Drives*</li>
|
||||
<li>GP ADMX file name: *VolumeEncryption.admx*</li>
|
||||
</ul>
|
||||
|
||||
> [!Tip]
|
||||
> For a step-by-step guide to enable ADMX-backed policies, see [Enable ADMX-backed policies in MDM](enable-admx-backed-policies-in-mdm.md). For additional information, see [Understanding ADMX-backed policies](understanding-admx-backed-policies.md).
|
||||
|
||||
<p style="margin-left: 20px">This setting allows you to configure whether BitLocker requires additional authentication each time the computer starts and whether you are using BitLocker with or without a Trusted Platform Module (TPM). This setting is applied when you turn on BitLocker.</p>
|
||||
|
||||
@ -204,7 +264,37 @@ The following diagram shows the BitLocker configuration service provider in tree
|
||||
<p style="margin-left: 20px">Data type is string. Supported operations are Add, Get, Replace, and Delete.</p>
|
||||
|
||||
<a href="" id="systemdrivesminimumpinlength"></a>**SystemDrivesMinimumPINLength**
|
||||
<p style="margin-left: 20px">This setting is a direct mapping to the Bitlocker Group Policy "Configure minimum PIN length for startup" (GP MinimumPINLength_Name).</p>
|
||||
<p style="margin-left: 20px">This setting is a direct mapping to the Bitlocker Group Policy "Configure minimum PIN length for startup".</p>
|
||||
<table>
|
||||
<tr>
|
||||
<th>Home</th>
|
||||
<th>Pro</th>
|
||||
<th>Business</th>
|
||||
<th>Enterprise</th>
|
||||
<th>Education</th>
|
||||
<th>Mobile</th>
|
||||
<th>Mobile Enterprise</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
<p style="margin-left: 20px">ADMX Info:</p>
|
||||
<ul>
|
||||
<li>GP English name:*Configure minimum PIN length for startup*</li>
|
||||
<li>GP name: *MinimumPINLength_Name*</li>
|
||||
<li>GP path: *Windows Components/Bitlocker Drive Encryption/Operating System Drives*</li>
|
||||
<li>GP ADMX file name: *VolumeEncryption.admx*</li>
|
||||
</ul>
|
||||
|
||||
> [!Tip]
|
||||
> For a step-by-step guide to enable ADMX-backed policies, see [Enable ADMX-backed policies in MDM](enable-admx-backed-policies-in-mdm.md). For additional information, see [Understanding ADMX-backed policies](understanding-admx-backed-policies.md).
|
||||
|
||||
<p style="margin-left: 20px">This setting allows you to configure a minimum length for a Trusted Platform Module (TPM) startup PIN. This setting is applied when you turn on BitLocker. The startup PIN must have a minimum length of 6 digits and can have a maximum length of 20 digits.</p>
|
||||
|
||||
@ -239,6 +329,36 @@ The following diagram shows the BitLocker configuration service provider in tree
|
||||
|
||||
<a href="" id="systemdrivesrecoverymessage"></a>**SystemDrivesRecoveryMessage**
|
||||
<p style="margin-left: 20px">This setting is a direct mapping to the Bitlocker Group Policy "Configure pre-boot recovery message and URL" (PrebootRecoveryInfo_Name).</p>
|
||||
<table>
|
||||
<tr>
|
||||
<th>Home</th>
|
||||
<th>Pro</th>
|
||||
<th>Business</th>
|
||||
<th>Enterprise</th>
|
||||
<th>Education</th>
|
||||
<th>Mobile</th>
|
||||
<th>Mobile Enterprise</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
<p style="margin-left: 20px">ADMX Info:</p>
|
||||
<ul>
|
||||
<li>GP English name: *Configure pre-boot recovery message and URL*</li>
|
||||
<li>GP name: *PrebootRecoveryInfo_Name*</li>
|
||||
<li>GP path: *Windows Components/Bitlocker Drive Encryption/Operating System Drives*</li>
|
||||
<li>GP ADMX file name: *VolumeEncryption.admx*</li>
|
||||
</ul>
|
||||
|
||||
> [!Tip]
|
||||
> For a step-by-step guide to enable ADMX-backed policies, see [Enable ADMX-backed policies in MDM](enable-admx-backed-policies-in-mdm.md). For additional information, see [Understanding ADMX-backed policies](understanding-admx-backed-policies.md).
|
||||
|
||||
<p style="margin-left: 20px">This setting lets you configure the entire recovery message or replace the existing URL that are displayed on the pre-boot key recovery screen when the OS drive is locked.
|
||||
</p>
|
||||
@ -290,6 +410,36 @@ The following diagram shows the BitLocker configuration service provider in tree
|
||||
|
||||
<a href="" id="systemdrivesrecoveryoptions"></a>**SystemDrivesRecoveryOptions**
|
||||
<p style="margin-left: 20px">This setting is a direct mapping to the Bitlocker Group Policy "Choose how BitLocker-protected operating system drives can be recovered" (OSRecoveryUsage_Name).</p>
|
||||
<table>
|
||||
<tr>
|
||||
<th>Home</th>
|
||||
<th>Pro</th>
|
||||
<th>Business</th>
|
||||
<th>Enterprise</th>
|
||||
<th>Education</th>
|
||||
<th>Mobile</th>
|
||||
<th>Mobile Enterprise</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
<p style="margin-left: 20px">ADMX Info:</p>
|
||||
<ul>
|
||||
<li>GP English name: *Choose how BitLocker-protected operating system drives can be recovered*</li>
|
||||
<li>GP name: *OSRecoveryUsage_Name*</li>
|
||||
<li>GP path: *Windows Components/Bitlocker Drive Encryption/Operating System Drives*</li>
|
||||
<li>GP ADMX file name: *VolumeEncryption.admx*</li>
|
||||
</ul>
|
||||
|
||||
> [!Tip]
|
||||
> For a step-by-step guide to enable ADMX-backed policies, see [Enable ADMX-backed policies in MDM](enable-admx-backed-policies-in-mdm.md). For additional information, see [Understanding ADMX-backed policies](understanding-admx-backed-policies.md).
|
||||
|
||||
<p style="margin-left: 20px">This setting allows you to control how BitLocker-protected operating system drives are recovered in the absence of the required startup key information. This setting is applied when you turn on BitLocker.</p>
|
||||
|
||||
@ -357,7 +507,37 @@ The following diagram shows the BitLocker configuration service provider in tree
|
||||
<p style="margin-left: 20px">Data type is string. Supported operations are Add, Get, Replace, and Delete.</p>
|
||||
|
||||
<a href="" id="fixeddrivesrecoveryoptions"></a>**FixedDrivesRecoveryOptions**
|
||||
<p style="margin-left: 20px">This setting is a direct mapping to the Bitlocker Group Policy "Choose how BitLocker-protected fixed drives can be recovered" (FDVRecoveryUsage_Name).</p>
|
||||
<p style="margin-left: 20px">This setting is a direct mapping to the Bitlocker Group Policy "Choose how BitLocker-protected fixed drives can be recovered" ().</p>
|
||||
<table>
|
||||
<tr>
|
||||
<th>Home</th>
|
||||
<th>Pro</th>
|
||||
<th>Business</th>
|
||||
<th>Enterprise</th>
|
||||
<th>Education</th>
|
||||
<th>Mobile</th>
|
||||
<th>Mobile Enterprise</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
<p style="margin-left: 20px">ADMX Info:</p>
|
||||
<ul>
|
||||
<li>GP English name: *Choose how BitLocker-protected fixed drives can be recovered*</li>
|
||||
<li>GP name: *FDVRecoveryUsage_Name*</li>
|
||||
<li>GP path: *Windows Components/Bitlocker Drive Encryption/Fixed Drives*</li>
|
||||
<li>GP ADMX file name: *VolumeEncryption.admx*</li>
|
||||
</ul>
|
||||
|
||||
> [!Tip]
|
||||
> For a step-by-step guide to enable ADMX-backed policies, see [Enable ADMX-backed policies in MDM](enable-admx-backed-policies-in-mdm.md). For additional information, see [Understanding ADMX-backed policies](understanding-admx-backed-policies.md).
|
||||
|
||||
<p style="margin-left: 20px">This setting allows you to control how BitLocker-protected fixed data drives are recovered in the absence of the required credentials. This setting is applied when you turn on BitLocker.</p>
|
||||
|
||||
@ -427,6 +607,36 @@ The following diagram shows the BitLocker configuration service provider in tree
|
||||
|
||||
<a href="" id="fixeddrivesrequireencryption"></a>**FixedDrivesRequireEncryption**
|
||||
<p style="margin-left: 20px">This setting is a direct mapping to the Bitlocker Group Policy "Deny write access to fixed drives not protected by BitLocker" (FDVDenyWriteAccess_Name).</p>
|
||||
<table>
|
||||
<tr>
|
||||
<th>Home</th>
|
||||
<th>Pro</th>
|
||||
<th>Business</th>
|
||||
<th>Enterprise</th>
|
||||
<th>Education</th>
|
||||
<th>Mobile</th>
|
||||
<th>Mobile Enterprise</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
<p style="margin-left: 20px">ADMX Info:</p>
|
||||
<ul>
|
||||
<li>GP English name: *Deny write access to fixed drives not protected by BitLocker*</li>
|
||||
<li>GP name: *FDVDenyWriteAccess_Name*</li>
|
||||
<li>GP path: *Windows Components/Bitlocker Drive Encryption/Fixed Drives*</li>
|
||||
<li>GP ADMX file name: *VolumeEncryption.admx*</li>
|
||||
</ul>
|
||||
|
||||
> [!Tip]
|
||||
> For a step-by-step guide to enable ADMX-backed policies, see [Enable ADMX-backed policies in MDM](enable-admx-backed-policies-in-mdm.md). For additional information, see [Understanding ADMX-backed policies](understanding-admx-backed-policies.md).
|
||||
|
||||
<p style="margin-left: 20px">This setting determines whether BitLocker protection is required for fixed data drives to be writable on a computer.</p>
|
||||
|
||||
@ -459,6 +669,36 @@ The following diagram shows the BitLocker configuration service provider in tree
|
||||
|
||||
<a href="" id="removabledrivesrequireencryption"></a>**RemovableDrivesRequireEncryption**
|
||||
<p style="margin-left: 20px">This setting is a direct mapping to the Bitlocker Group Policy "Deny write access to removable drives not protected by BitLocker" (RDVDenyWriteAccess_Name).</p>
|
||||
<table>
|
||||
<tr>
|
||||
<th>Home</th>
|
||||
<th>Pro</th>
|
||||
<th>Business</th>
|
||||
<th>Enterprise</th>
|
||||
<th>Education</th>
|
||||
<th>Mobile</th>
|
||||
<th>Mobile Enterprise</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
<p style="margin-left: 20px">ADMX Info:</p>
|
||||
<ul>
|
||||
<li>GP English name: *Deny write access to removable drives not protected by BitLocker*</li>
|
||||
<li>GP name: *RDVDenyWriteAccess_Name*</li>
|
||||
<li>GP path: *Windows Components/Bitlocker Drive Encryption/Removeable Drives*</li>
|
||||
<li>GP ADMX file name: *VolumeEncryption.admx*</li>
|
||||
</ul>
|
||||
|
||||
> [!Tip]
|
||||
> For a step-by-step guide to enable ADMX-backed policies, see [Enable ADMX-backed policies in MDM](enable-admx-backed-policies-in-mdm.md). For additional information, see [Understanding ADMX-backed policies](understanding-admx-backed-policies.md).
|
||||
|
||||
<p style="margin-left: 20px">This setting configures whether BitLocker protection is required for a computer to be able to write data to a removable data drive.</p>
|
||||
|
||||
@ -500,6 +740,31 @@ The following diagram shows the BitLocker configuration service provider in tree
|
||||
</Replace>
|
||||
```
|
||||
|
||||
<a href="" id="allowwarningforotherdiskencryption"></a>**AllowWarningForOtherDiskEncryption**
|
||||
|
||||
<p style="margin-left: 20px">Allows the Admin to disable the warning prompt for other disk encryption on the user machines.</p>
|
||||
|
||||
<p style="margin-left: 20px">The following list shows the supported values:</p>
|
||||
|
||||
- 0 – Disables the warning prompt.
|
||||
- 1 (default) – Warning prompt allowed.
|
||||
|
||||
<p style="margin-left: 20px">Admin should set the value to 0 to disable the warning. If you want to disable this policy use the following SyncML:</p>
|
||||
|
||||
``` syntax
|
||||
<Replace>
|
||||
<CmdID>110</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./Device/Vendor/MSFT/BitLocker/AllowWarningForOtherDiskEncryption</LocURI>
|
||||
</Target>
|
||||
<Meta>
|
||||
<Format xmlns="syncml:metinf">int</Format>
|
||||
</Meta>
|
||||
<Data>0</Data>
|
||||
</Item>
|
||||
</Replace>
|
||||
```
|
||||
|
||||
### SyncML example
|
||||
|
||||
@ -664,29 +929,3 @@ The following example is provided to show proper format and should not be taken
|
||||
</SyncBody>
|
||||
</SyncML>
|
||||
```
|
||||
|
||||
<a href="" id="allowwarningforotherdiskencryption"></a>**AllowWarningForOtherDiskEncryption**
|
||||
|
||||
<p style="margin-left: 20px">Allows the Admin to disable the warning prompt for other disk encryption on the user machines.</p>
|
||||
|
||||
<p style="margin-left: 20px">The following list shows the supported values:</p>
|
||||
|
||||
- 0 – Disables the warning prompt.
|
||||
- 1 (default) – Warning prompt allowed.
|
||||
|
||||
<p style="margin-left: 20px">Admin should set the value to 0 to disable the warning. If you want to disable this policy use the following SyncML:</p>
|
||||
|
||||
``` syntax
|
||||
<Replace>
|
||||
<CmdID>110</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./Device/Vendor/MSFT/BitLocker/AllowWarningForOtherDiskEncryption</LocURI>
|
||||
</Target>
|
||||
<Meta>
|
||||
<Format xmlns="syncml:metinf">int</Format>
|
||||
</Meta>
|
||||
<Data>0</Data>
|
||||
</Item>
|
||||
</Replace>
|
||||
```
|
||||
@ -10,7 +10,7 @@ ms.topic: article
|
||||
ms.prod: w10
|
||||
ms.technology: windows
|
||||
author: nickbrower
|
||||
ms.date: 08/11/2017
|
||||
ms.date: 08/14/2017
|
||||
---
|
||||
|
||||
# What's new in MDM enrollment and management
|
||||
@ -982,6 +982,7 @@ For details about Microsoft mobile device management protocols for Windows 10 s
|
||||
<li>DeviceGuard/EnableVirtualizationBasedSecurity</li>
|
||||
<li>DeviceGuard/RequirePlatformSecurityFeatures</li>
|
||||
<li>DeviceGuard/LsaCfgFlags</li>
|
||||
<li>ExploitGuard/ExploitProtectionSettings</li>
|
||||
<li>LocalPoliciesSecurityOptions/Accounts_BlockMicrosoftAccounts</li>
|
||||
<li>LocalPoliciesSecurityOptions/Accounts_EnableAdministratorAccountStatus</li>
|
||||
<li>LocalPoliciesSecurityOptions/Accounts_EnableGuestAccountStatus</li>
|
||||
@ -1364,10 +1365,15 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware
|
||||
<li> Provider/_ProviderID_/EnrollmentInfo</li>
|
||||
</ul>
|
||||
</td></tr>
|
||||
<tr class="odd">
|
||||
<td style="vertical-align:top">[BitLocker CSP](bitlocker-csp.md)</td>
|
||||
<td style="vertical-align:top">Added information to the ADMX-backed policies.
|
||||
</td></tr>
|
||||
<tr class="even">
|
||||
<td style="vertical-align:top">[Policy CSP](policy-configuration-service-provider.md)</td>
|
||||
<td style="vertical-align:top"><p>Added the following new policies for Windows 10, version 1709:</p>
|
||||
<ul>
|
||||
<li>ExploitGuard/ExploitProtectionSettings</li>
|
||||
<li>LocalPoliciesSecurityOptions/Accounts_BlockMicrosoftAccounts</li>
|
||||
<li>LocalPoliciesSecurityOptions/Accounts_EnableAdministratorAccountStatus</li>
|
||||
<li>LocalPoliciesSecurityOptions/Accounts_EnableGuestAccountStatus</li>
|
||||
@ -1394,6 +1400,7 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware
|
||||
<li>LocalPoliciesSecurityOptions/UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations</li>
|
||||
</ul>
|
||||
<p>Changed the name of new policy to CredentialProviders/DisableAutomaticReDeploymentCredentials from CredentialProviders/EnableWindowsAutoPilotResetCredentials.</p>
|
||||
<p>Added links to the additional [ADMX-backed BitLocker policies](policy-csp-bitlocker.md).</p>
|
||||
</td></tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
@ -7,7 +7,7 @@ ms.topic: article
|
||||
ms.prod: w10
|
||||
ms.technology: windows
|
||||
author: nickbrower
|
||||
ms.date: 08/04/2017
|
||||
ms.date: 08/14/2017
|
||||
---
|
||||
|
||||
# Policy CSP
|
||||
@ -338,6 +338,30 @@ The following diagram shows the Policy configuration service provider in tree fo
|
||||
<dd>
|
||||
<a href="./policy-csp-bitlocker.md#bitlocker-encryptionmethod" id="bitlocker-encryptionmethod">Bitlocker/EncryptionMethod</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./bitlocker-csp.md#encryptionmethodbydrivetype" id="encryptionmethodbydrivetype">BitLocker/EncryptionMethodByDriveType</a> in BitLocker CSP
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./bitlocker-csp.md#fixeddrivesrecoveryoptions" id="fixeddrivesrecoveryoptions">BitLocker/FixedDrivesRecoveryOptions</a> in BitLocker CSP
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./bitlocker-csp.md#fixeddrivesrequireencryption" id="fixeddrivesrequireencryption">BitLocker/FixedDrivesRequireEncryption</a> in BitLocker CSP
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./bitlocker-csp.md#removabledrivesrequireencryption" id="removabledrivesrequireencryption">BitLocker/RemovableDrivesRequireEncryption</a> in BitLocker CSP
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./bitlocker-csp.md#systemdrivesminimumpinlength" id="systemdrivesminimumpinlength">BitLocker/SystemDrivesMinimumPINLength</a> in BitLocker CSP
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./bitlocker-csp.md#systemdrivesrecoverymessage" id="systemdrivesrecoverymessage">BitLocker/SystemDrivesRecoveryMessage</a> in BitLocker CSP
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./bitlocker-csp.md#systemdrivesrecoveryoptions" id="systemdrivesrecoveryoptions">BitLocker/SystemDrivesRecoveryOptions</a> in BitLocker CSP
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./bitlocker-csp.md#systemdrivesrequirestartupauthentication" id="systemdrivesrequirestartupauthentication">BitLocker/SystemDrivesRequireStartupAuthentication</a> in BitLocker CSP
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
### Bluetooth policies
|
||||
@ -978,6 +1002,14 @@ The following diagram shows the Policy configuration service provider in tree fo
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
### ExploitGuard policies
|
||||
|
||||
<dl>
|
||||
<dd>
|
||||
<a href="./policy-csp-exploitguard.md#exploitguard-exploitprotectionsettings" id="exploitguard-exploitprotectionsettings">ExploitGuard/ExploitProtectionSettings</a>
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
### Games policies
|
||||
|
||||
<dl>
|
||||
|
||||
@ -58,6 +58,33 @@ ms.date: 08/09/2017
|
||||
- 6 - XTS-AES 128-bit (Desktop only)
|
||||
- 7 - XTS-AES 256-bit (Desktop only)
|
||||
|
||||
<p style="margin-left: 20px">You can find the following policies in BitLocker CSP:
|
||||
<dl>
|
||||
<dd>
|
||||
<a href="./bitlocker-csp.md#encryptionmethodbydrivetype" id="encryptionmethodbydrivetype">BitLocker/EncryptionMethodByDriveType</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./bitlocker-csp.md#fixeddrivesrecoveryoptions" id="fixeddrivesrecoveryoptions">BitLocker/FixedDrivesRecoveryOptions</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./bitlocker-csp.md#fixeddrivesrequireencryption" id="fixeddrivesrequireencryption">BitLocker/FixedDrivesRequireEncryption</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./bitlocker-csp.md#removabledrivesrequireencryption" id="removabledrivesrequireencryption">BitLocker/RemovableDrivesRequireEncryption</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./bitlocker-csp.md#systemdrivesminimumpinlength" id="systemdrivesminimumpinlength">BitLocker/SystemDrivesMinimumPINLength</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./bitlocker-csp.md#systemdrivesrecoverymessage" id="systemdrivesrecoverymessage">BitLocker/SystemDrivesRecoveryMessage</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./bitlocker-csp.md#systemdrivesrecoveryoptions" id="systemdrivesrecoveryoptions">BitLocker/SystemDrivesRecoveryOptions</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./bitlocker-csp.md#systemdrivesrequirestartupauthentication" id="systemdrivesrequirestartupauthentication">BitLocker/SystemDrivesRequireStartupAuthentication</a>
|
||||
</dd>
|
||||
</dl>
|
||||
<!--EndDescription-->
|
||||
<!--EndPolicy-->
|
||||
<hr/>
|
||||
@ -68,5 +95,4 @@ Footnote:
|
||||
- 2 - Added in Windows 10, version 1703.
|
||||
- 3 - Added in Windows 10, version 1709.
|
||||
|
||||
<!--EndPolicies-->
|
||||
|
||||
<!--EndPolicies-->
|
||||
58
windows/client-management/mdm/policy-csp-exploitguard.md
Normal file
58
windows/client-management/mdm/policy-csp-exploitguard.md
Normal file
@ -0,0 +1,58 @@
|
||||
---
|
||||
title: Policy CSP - ExploitGuard
|
||||
description: Policy CSP - ExploitGuard
|
||||
ms.author: maricia
|
||||
ms.topic: article
|
||||
ms.prod: w10
|
||||
ms.technology: windows
|
||||
author: nickbrower
|
||||
ms.date: 08/11/2017
|
||||
---
|
||||
|
||||
# Policy CSP - ExploitGuard
|
||||
|
||||
> [!WARNING]
|
||||
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
|
||||
|
||||
<!--StartPolicy-->
|
||||
<a href="" id="exploitguard-exploitprotectionsettings"></a>**ExploitGuard/ExploitProtectionSettings**
|
||||
|
||||
<!--StartSKU-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Home</th>
|
||||
<th>Pro</th>
|
||||
<th>Business</th>
|
||||
<th>Enterprise</th>
|
||||
<th>Education</th>
|
||||
<th>Mobile</th>
|
||||
<th>Mobile Enterprise</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<!--EndSKU-->
|
||||
<!--StartDescription-->
|
||||
<p style="margin-left: 20px">Enables the IT admin to push out a configuration representing the desired system and application mitigation options to all the devices in the organization. The configuration is represented by an XML.
|
||||
|
||||
<p style="margin-left: 20px">The system settings require a reboot; the application settings do not require a reboot.
|
||||
|
||||
<!--EndDescription-->
|
||||
<!--EndPolicy-->
|
||||
<hr/>
|
||||
|
||||
Footnote:
|
||||
|
||||
- 1 - Added in Windows 10, version 1607.
|
||||
- 2 - Added in Windows 10, version 1703.
|
||||
- 3 - Added in Windows 10, version 1709.
|
||||
|
||||
<!--EndPolicies-->
|
||||
@ -33,6 +33,8 @@ See the following topics in this guide for detailed information about configurin
|
||||
- [Get started with Update Compliance](update-compliance-get-started.md): How to add Update Compliance to your environment.
|
||||
- [Using Update Compliance](update-compliance-using.md): How to begin using Update Compliance.
|
||||
|
||||
<iframe width="560" height="315" align="center" src="https://www.youtube.com/embed/1cmF5c_R8I4" frameborder="0" allowfullscreen></iframe>
|
||||
|
||||
An overview of the processes used by the Update Compliance solution is provided below.
|
||||
|
||||
## Update Compliance architecture
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: TPM Group Policy settings (Windows 10)
|
||||
description: This topic for the IT professional describes the Trusted Platform Module (TPM) Services that can be controlled centrally by using Group Policy settings.
|
||||
description: This topic describes the Trusted Platform Module (TPM) Services that can be controlled centrally by using Group Policy settings.
|
||||
ms.assetid: 54ff1c1e-a210-4074-a44e-58fee26e4dbd
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
@ -15,22 +15,15 @@ author: brianlic-msft
|
||||
- Windows 10
|
||||
- Windows Server 2016
|
||||
|
||||
This topic for the IT professional describes the Trusted Platform Module (TPM) Services that can be controlled centrally by using Group Policy settings.
|
||||
This topic describes the Trusted Platform Module (TPM) Services that can be controlled centrally by using Group Policy settings.
|
||||
|
||||
The TPM Services Group Policy settings are located at:
|
||||
The Group Policy settings for TPM services are located at:
|
||||
|
||||
**Computer Configuration\\Administrative Templates\\System\\Trusted Platform Module Services\\**
|
||||
|
||||
### Configure the system to use legacy Dictionary Attack Prevention Parameters setting for TPM 2.0
|
||||
The following Group Policy settings were introduced in Window 10:
|
||||
|
||||
Introduced in Windows 10, version 1703, this policy setting configures the TPM to use the Dictionary Attack Prevention Parameters (lockout threshold and recovery time) to the values that were used for Windows 10 Version 1607 and below. Setting this policy will take effect only if: a) the TPM was originally prepared using a version of Windows after Windows 10 Version 1607, and b) the System has a TPM 2.0.
|
||||
|
||||
Note that enabling this policy will only take effect after the TPM maintenance task runs (which typically happens after a system restart). Once this policy has been enabled on a system and has taken effect (after a system restart), disabling it will have no impact and the system's TPM will remain configured using the legacy Dictionary Attack Prevention parameters, regardless of the value of this group policy. The only way for the disabled setting of this policy to take effect on a system where it was once enabled is to:
|
||||
a) disable it from group policy and b) clear the TPM on the system.
|
||||
|
||||
**The following Group Policy settings were introduced in Window 10:**
|
||||
|
||||
### Configure the list of blocked TPM commands
|
||||
## Configure the list of blocked TPM commands
|
||||
|
||||
This policy setting allows you to manage the Group Policy list of Trusted Platform Module (TPM) commands that are blocked by Windows.
|
||||
|
||||
@ -48,7 +41,7 @@ For information how to enforce or ignore the default and local lists of blocked
|
||||
|
||||
- [Ignore the local list of blocked TPM commands](#ignore-the-local-list-of-blocked-tpm-commands)
|
||||
|
||||
### Ignore the default list of blocked TPM commands
|
||||
## Ignore the default list of blocked TPM commands
|
||||
|
||||
This policy setting allows you to enforce or ignore the computer's default list of blocked Trusted Platform Module (TPM) commands.
|
||||
|
||||
@ -58,7 +51,7 @@ If you enable this policy setting, the Windows operating system will ignore the
|
||||
|
||||
If you disable or do not configure this policy setting, Windows will block the TPM commands in the default list, in addition to the commands that are specified by Group Policy and the local list of blocked TPM commands.
|
||||
|
||||
### Ignore the local list of blocked TPM commands
|
||||
## Ignore the local list of blocked TPM commands
|
||||
|
||||
This policy setting allows you to enforce or ignore the computer's local list of blocked Trusted Platform Module (TPM) commands.
|
||||
|
||||
@ -68,7 +61,7 @@ If you enable this policy setting, the Windows operating system will ignore the
|
||||
|
||||
If you disable or do not configure this policy setting, Windows will block the TPM commands in the local list, in addition to the commands that are specified in Group Policy and the default list of blocked TPM commands.
|
||||
|
||||
### Configure the level of TPM owner authorization information available to the operating system
|
||||
## Configure the level of TPM owner authorization information available to the operating system
|
||||
|
||||
This policy setting configures how much of the TPM owner authorization information is stored in the registry of the local computer. Depending on the amount of TPM owner authorization information that is stored locally, the Windows operating system and TPM-based applications can perform certain actions in the TPM that require TPM owner authorization without requiring the user to enter the TPM owner password.
|
||||
|
||||
@ -106,7 +99,7 @@ If you enable this policy setting, the Windows operating system will store the T
|
||||
If you disable or do not configure this policy setting, and the **Turn on TPM backup to Active Directory Domain Services** policy setting is also disabled or not configured, the default setting is to store the full TPM authorization value in the local registry. If this policy is disabled or not
|
||||
configured, and the **Turn on TPM backup to Active Directory Domain Services** policy setting is enabled, only the administrative delegation and the user delegation blobs are stored in the local registry.
|
||||
|
||||
### Standard User Lockout Duration
|
||||
## Standard User Lockout Duration
|
||||
|
||||
This policy setting allows you to manage the duration in minutes for counting standard user authorization failures for Trusted Platform Module (TPM) commands requiring authorization. An authorization failure occurs each time a standard user sends a command to the TPM and receives an error response that indicates an authorization failure occurred. Authorization failures that are older than the duration you set are ignored. If the number of TPM commands with an authorization failure within the lockout duration equals a threshold, a standard user is prevented from sending commands that require
|
||||
authorization to the TPM.
|
||||
@ -125,7 +118,7 @@ An administrator with the TPM owner password can fully reset the TPM's hardware
|
||||
|
||||
If you do not configure this policy setting, a default value of 480 minutes (8 hours) is used.
|
||||
|
||||
### Standard User Individual Lockout Threshold
|
||||
## Standard User Individual Lockout Threshold
|
||||
|
||||
This policy setting allows you to manage the maximum number of authorization failures for each standard user for the Trusted Platform Module (TPM). This value is the maximum number of authorization failures that each standard user can have before the user is not allowed to send commands that require authorization to the TPM. If the number of authorization failures for the user within the duration that is set for the **Standard User Lockout Duration** policy setting equals this value, the standard user is prevented from sending commands that require authorization to the Trusted Platform Module (TPM).
|
||||
|
||||
@ -137,7 +130,7 @@ An administrator with the TPM owner password can fully reset the TPM's hardware
|
||||
|
||||
If you do not configure this policy setting, a default value of 4 is used. A value of zero means that the operating system will not allow standard users to send commands to the TPM, which might cause an authorization failure.
|
||||
|
||||
### Standard User Total Lockout Threshold
|
||||
## Standard User Total Lockout Threshold
|
||||
|
||||
This policy setting allows you to manage the maximum number of authorization failures for all standard users for the Trusted Platform Module (TPM). If the total number of authorization failures for all standard users within the duration that is set for the **Standard User Lockout Duration** policy equals this value, all standard users are prevented from sending commands that require authorization to the Trusted Platform Module (TPM).
|
||||
|
||||
@ -156,6 +149,21 @@ If you enable this policy setting, TPM owner information will be automatically a
|
||||
|
||||
If you disable or do not configure this policy setting, TPM owner information will not be backed up to AD DS.
|
||||
|
||||
## Configure the system to use legacy Dictionary Attack Prevention Parameters setting for TPM 2.0
|
||||
|
||||
Introduced in Windows 10, version 1703, this policy setting configures the TPM to use the Dictionary Attack Prevention Parameters (lockout threshold and recovery time) to the values that were used for Windows 10 Version 1607 and below.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> Setting this policy will take effect only if:
|
||||
- The TPM was originally prepared using a version of Windows after Windows 10 Version 1607
|
||||
- The system has a TPM 2.0.
|
||||
|
||||
> [!NOTE]
|
||||
> Enabling this policy will only take effect after the TPM maintenance task runs (which typically happens after a system restart). Once this policy has been enabled on a system and has taken effect (after a system restart), disabling it will have no impact and the system's TPM will remain configured using the legacy Dictionary Attack Prevention parameters, regardless of the value of this group policy. The only ways for the disabled setting of this policy to take effect on a system where it was once enabled are to either:
|
||||
> - Disable it from group policy
|
||||
> - Clear the TPM on the system
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Trusted Platform Module](trusted-platform-module-top-node.md) (list of topics)
|
||||
|
||||
@ -8,10 +8,13 @@ ms.mktglfcycl: deploy
|
||||
ms.pagetype: security
|
||||
ms.sitesec: library
|
||||
author: eross-msft
|
||||
ms.author: lizross
|
||||
ms.date: 08/14/2017
|
||||
ms.localizationpriority: high
|
||||
---
|
||||
|
||||
# Block untrusted fonts in an enterprise
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- Windows 10
|
||||
@ -46,19 +49,44 @@ After you turn this feature on, your employees might experience reduced function
|
||||
- Using desktop Office to look at documents with embedded fonts. In this situation, content shows up using a default font picked by Office.
|
||||
|
||||
## Turn on and use the Blocking Untrusted Fonts feature
|
||||
Use Group Policy or the registry to turn this feature on, off, or to use audit mode.
|
||||
|
||||
**To turn on and use the Blocking Untrusted Fonts feature through Group Policy**
|
||||
1. Open the Group Policy editor (gpedit.msc) and go to `Computer Configuration\Administrative Templates\System\Mitigation Options\Untrusted Font Blocking`.
|
||||
|
||||
2. Click **Enabled** to turn the feature on, and then click one of the following **Migitation Options**:
|
||||
|
||||
- **Block untrusted fonts and log events.** Turns the feature on, blocking untrusted fonts and logging installation attempts to the event log.
|
||||
|
||||
- **Do not block untrusted fonts.** Turns the feature on, but doesn't block untrusted fonts nor does it log installation attempts to the event log.
|
||||
|
||||
- **Log events without blocking untrusted fonts**. Turns the feature on, logging installation attempts to the event log, but not blocking untrusted fonts.
|
||||
|
||||
3. Click **OK**.
|
||||
|
||||
**To turn on and use the Blocking Untrusted Fonts feature through the registry**
|
||||
To turn this feature on, off, or to use audit mode:
|
||||
|
||||
1. Open the registry editor (regedit.exe) and go to `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel\`.
|
||||
|
||||
2. If the **MitigationOptions** key isn't there, right-click and add a new **QWORD (64-bit) Value**, renaming it to **MitigationOptions**.
|
||||
|
||||
3. Update the **Value data** of the **MitigationOptions** key, making sure you keep your existing value, like in the important note below:
|
||||
3. Right click on the **MitigationOptions** key, and then click **Modify**.
|
||||
|
||||
The **Edit QWORD (64-bit) Value** box opens.
|
||||
|
||||
4. Make sure the **Base** option is **Hexadecimal**, and then update the **Value data**, making sure you keep your existing value, like in the important note below:
|
||||
|
||||
- **To turn this feature on.** Type **1000000000000**.
|
||||
- **To turn this feature off.** Type **2000000000000**.
|
||||
- **To audit with this feature.** Type **3000000000000**.<p>**Important**<br>Your existing **MitigationOptions** values should be saved during your update. For example, if the current value is *1000*, your updated value should be *1000000001000*.
|
||||
|
||||
4. Restart your computer.
|
||||
- **To turn this feature off.** Type **2000000000000**.
|
||||
|
||||
- **To audit with this feature.** Type **3000000000000**.
|
||||
|
||||
>[!Important]
|
||||
>Your existing **MitigationOptions** values should be saved during your update. For example, if the current value is *1000*, your updated value should be *1000000001000*.
|
||||
|
||||
4. Restart your computer.
|
||||
|
||||
## View the event log
|
||||
After you turn this feature on, or start using Audit mode, you can look at your event logs for details.
|
||||
@ -68,27 +96,33 @@ After you turn this feature on, or start using Audit mode, you can look at your
|
||||
1. Open the event viewer (eventvwr.exe) and go to **Application and Service Logs/Microsoft/Windows/Win32k/Operational**.
|
||||
|
||||
2. Scroll down to **EventID: 260** and review the relevant events.
|
||||
<p>
|
||||
**Event Example 1 - MS Word**<br>
|
||||
WINWORD.EXE attempted loading a font that is restricted by font loading policy.<br>
|
||||
FontType: Memory<br>
|
||||
FontPath:<br>
|
||||
Blocked: true<p>
|
||||
**Note**<br>Because the **FontType** is *Memory*, there’s no associated **FontPath.**
|
||||
<p>
|
||||
**Event Example 2 - Winlogon**<br>
|
||||
Winlogon.exe attempted loading a font that is restricted by font loading policy.<br>
|
||||
FontType: File<br>
|
||||
FontPath: `\??\C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\EQUATION\MTEXTRA.TTF`<br>
|
||||
Blocked: true<p>
|
||||
**Note**<br>Because the **FontType** is *File*, there’s also an associated **FontPath.**
|
||||
<p>
|
||||
**Event Example 3 - Internet Explorer running in Audit mode**<br>
|
||||
Iexplore.exe attempted loading a font that is restricted by font loading policy.<br>
|
||||
FontType: Memory<br>
|
||||
FontPath:<br>
|
||||
Blocked: false<p>
|
||||
**Note**<br>In Audit mode, the problem is recorded, but the font isn’t blocked.
|
||||
|
||||
**Event Example 1 - MS Word**<br>
|
||||
WINWORD.EXE attempted loading a font that is restricted by font-loading policy.<br>
|
||||
FontType: Memory<br>
|
||||
FontPath:<br>
|
||||
Blocked: true
|
||||
|
||||
>[!NOTE]
|
||||
>Because the **FontType** is *Memory*, there’s no associated **FontPath**.
|
||||
|
||||
**Event Example 2 - Winlogon**<br>
|
||||
Winlogon.exe attempted loading a font that is restricted by font-loading policy.<br>
|
||||
FontType: File<br>
|
||||
FontPath: `\??\C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\EQUATION\MTEXTRA.TTF`<br>
|
||||
Blocked: true
|
||||
|
||||
>[!NOTE]
|
||||
>Because the **FontType** is *File*, there’s also an associated **FontPath**.
|
||||
|
||||
**Event Example 3 - Internet Explorer running in Audit mode**<br>
|
||||
Iexplore.exe attempted loading a font that is restricted by font-loading policy.<br>
|
||||
FontType: Memory<br>
|
||||
FontPath:<br>
|
||||
Blocked: false
|
||||
|
||||
>[!NOTE]
|
||||
>In Audit mode, the problem is recorded, but the font isn’t blocked.
|
||||
|
||||
## Fix apps having problems because of blocked fonts
|
||||
Your company may still need apps that are having problems because of blocked fonts, so we suggest that you first run this feature in Audit mode to determine which fonts are causing the problems.
|
||||
@ -101,12 +135,14 @@ After you figure out the problematic fonts, you can try to fix your apps in 2 wa
|
||||
|
||||
**To fix your apps by excluding processes**
|
||||
|
||||
1. On each computer with the app installed, open regedit.exe and go to `HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\<process_image_name>`. Like, if you want to exclude Microsoft Word processes, you’d use `HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Winword.exe`.
|
||||
1. On each computer with the app installed, open regedit.exe and go to `HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\<process_image_name>`.<br><br>For example, if you want to exclude Microsoft Word processes, you’d use `HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Winword.exe`.
|
||||
|
||||
2. Add any additional processes that need to be excluded here, and then turn the Blocking untrusted fonts feature on, using steps 2 and 3 in [Turn on and use the Blocking Untrusted Fonts feature](#turn-on-and-use-the-blocking-untrusted-fonts-feature).
|
||||
2. Add any additional processes that need to be excluded here, and then turn the Blocking untrusted fonts feature on, using the steps in the [Turn on and use the Blocking Untrusted Fonts feature](#turn-on-and-use-the-blocking-untrusted-fonts-feature) section of this topic.
|
||||
|
||||
|
||||
## Related content
|
||||
|
||||
- [Dropping the “Untrusted Font Blocking” setting](https://blogs.technet.microsoft.com/secguide/2017/06/15/dropping-the-untrusted-font-blocking-setting/)
|
||||
|
||||
|
||||
|
||||
|
||||
@ -82,8 +82,8 @@ If a proxy or firewall is blocking all traffic by default and allowing only spec
|
||||
|
||||
Service location | .Microsoft.com DNS record
|
||||
:---|:---
|
||||
US |```*.blob.core.windows.net``` <br>```crl.microsoft.com```<br> ```us.vortex-win.data.microsoft.com```<br> ```winatp-gw-cus.microsoft.com``` <br> ```winatp-gw-eus.microsoft.com```
|
||||
Europe |```*.blob.core.windows.net```<br>```crl.microsoft.com```<br> ```eu.vortex-win.data.microsoft.com```<br>```winatp-gw-neu.microsoft.com```<br> ```winatp-gw-weu.microsoft.com```<br>
|
||||
US |```*.blob.core.windows.net``` <br>```crl.microsoft.com```<br> ```ctldl.windowsupdate.com```<br> ```us.vortex-win.data.microsoft.com```<br> ```winatp-gw-cus.microsoft.com``` <br> ```winatp-gw-eus.microsoft.com```
|
||||
Europe |```*.blob.core.windows.net```<br>```crl.microsoft.com```<br>```ctldl.windowsupdate.com```<br> ```eu.vortex-win.data.microsoft.com```<br>```winatp-gw-neu.microsoft.com```<br> ```winatp-gw-weu.microsoft.com```<br>
|
||||
|
||||
If a proxy or firewall is blocking anonymous traffic, as Windows Defender ATP sensor is connecting from system context, make sure anonymous traffic is permitted in the above listed URLs.
|
||||
|
||||
|
||||
@ -26,9 +26,9 @@ The **Machines list** shows a list of the machines in your network, the domain o
|
||||
|
||||
Use the Machines list in these main scenarios:
|
||||
|
||||
- **During onboarding**</br>
|
||||
- **During onboarding**<br>
|
||||
During the onboarding process, the **Machines list** is gradually populated with endpoints as they begin to report sensor data. Use this view to track your onboarded endpoints as they come online. Sort and filter by time of last report, **Active malware category**, or **Sensor health state**, or download the complete endpoint list as a CSV file for offline analysis.
|
||||
- **Day-to-day work**
|
||||
- **Day-to-day work** <br>
|
||||
The **Machines list** enables easy identification of machines most at risk in a glance. High-risk machines have the greatest number and highest-severity alerts; **Sensor health state** provides another dimension to rank machines. Sorting machines by **Active alerts**, and then by **Sensor health state** helps identify the most vulnerable machines and take action on them.
|
||||
|
||||
## Sort, filter, and download the list of machines from the Machines list
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user