From a4baee6cbcebacac045409c8d15f3fabb088976e Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 29 Aug 2019 14:44:42 -0700 Subject: [PATCH 01/49] updates to indicators --- .openpublishing.redirection.json | 7 +++ windows/security/threat-protection/TOC.md | 1 - .../manage-indicators.md | 56 ++++++++++++++++++- .../post-ti-indicator.md | 4 ++ 4 files changed, 65 insertions(+), 3 deletions(-) diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index 16a10bcb81..97a456c86d 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -631,6 +631,11 @@ "redirect_document_id": true }, { +"source_path": "windows/security/threat-protection/microsoft-defender-atp/manage-automation-allowed-blocked-list.md", +"redirect_url": "windows/security/threat-protection/microsoft-defender-atp/manage-indicators", +"redirect_document_id": false +}, +{ "source_path": "windows/security/threat-protection/device-guard/optional-create-a-code-signing-certificate-for-windows-defender-application-control.md", "redirect_url": "/windows/security/threat-protection/windows-defender-application-control/create-code-signing-cert-for-windows-defender-application-control", "redirect_document_id": true @@ -15314,3 +15319,5 @@ } ] } + + diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index 03328a26ed..a245fe1b42 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -501,7 +501,6 @@ #### [Rules]() ##### [Manage suppression rules](microsoft-defender-atp/manage-suppression-rules.md) -##### [Manage automation allowed/blocked lists](microsoft-defender-atp/manage-automation-allowed-blocked-list.md) ##### [Manage indicators](microsoft-defender-atp/manage-indicators.md) ##### [Manage automation file uploads](microsoft-defender-atp/manage-automation-file-uploads.md) ##### [Manage automation folder exclusions](microsoft-defender-atp/manage-automation-folder-exclusions.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md index a5f617c624..48bfb2d7e7 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md @@ -16,6 +16,7 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article +ROBOTS: NOINDEX --- # Manage indicators @@ -25,8 +26,32 @@ ms.topic: article >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-automationexclusionlist-abovefoldlink) +Indicator of compromise (IoCs) matching is an essential feature in every endpoint protection solution. This capability is available in Microsoft Defender ATP and gives SecOps the ability to set a list of indicators for detection and for blocking (prevention and response). + + Create indicators that define the detection, prevention, and exclusion of entities. You can define the action to be taken as well as the duration for when to apply the action as well as the scope of the machine group to apply it to. +Currently supported sources are the cloud detection engine of Microsoft Defender ATP, the automated investigation and remediation engine, and the endpoint prevention engine (Windows Defender AV). + +**Cloud detection engine**
+The cloud detection engine of Microsoft Defender ATP regularly scans collected data and tries to match the indicators you set. When there is a match, action will be taken according to the settings you specified for the IoC. + +**Endpoint prevention engine**
+The same list of indicators is honored by the prevention agent. Meaning, if Windows Defender AV is the primary AV configured, the matched indicators will be treated according to the settings. For example, if the action is "Alert and Block", Windows Defender AV will prevent file executions (block and remediate) and a corresponding alert will be raised. On the other hand, if the Action is set to "Allow", Windows Defender AV will not detect nor block the file from being run. + +>![NOTE] +>-There is a propagation time of several minutes before the blocking policy for a new hash is applied. +>- Trusted signed files will be treated differently. Microsoft Defender ATP is optimized to handle malicious files. Trying to block trusted signed files, in some cases, may have performance implications. + + +**Automated investigation and remediation engine** +The automated investigation and remediation behave the same. If an indicator is set to "Allow", Automated investigation and remediation will ignore a "bad" verdict for it. If set to "Block", Automated investigation and remediation will treat it as “bad”. + +In the first phase, the file hashes are fully supported, while network addresses (IP, Domain names) are partially supported (Automation and Detection). Stay tuned as the network blocking and more IoCs become available. + +The current actions supported are Allow, Alert-only, Alert&Block. + + On the top navigation you can: - Import a list @@ -37,7 +62,34 @@ On the top navigation you can: - Navigate between pages - Apply filters -## Create an indicator +There are several ways to control IoCs: +- [Create an indicator from the settings page](#create-an-indicator-from-the-settings-page) +- [Create contextual IoC](respond-file-alerts.md#add-indicator-to-block-or-allow-a-file) +- [Import a list of IoCs](#import-a-list-of-iocs) +- [Use the Microsoft Defender ATP indicators API](ti-indicator.md) +- [Use partner integrated solutions](partner-applications.md) + +## Before you begin + +Creating IoCs must comply to the following: + +>- This feature is available if your organization uses Windows Defender Antivirus and Cloud–based protection is enabled. For more information, see [Manage cloud–based protection](../windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md). +> +>- The Antimalware client version must be 4.18.1901.x or later. +>- This feature is designed to prevent suspected malware (or potentially malicious files) from being downloaded from the web. It currently supports portable executable (PE) files, including _.exe_ and _.dll_ files. The coverage will be extended over time. +>- This response action is available for machines on Windows 10, version 1703 or later. +>- The allow or block function cannot be done on files if the file's classification exists on the device's cache prior to the allow or block action. + +>[!NOTE] +> The PE file needs to be in the machine timeline for you to be able to take this action. +> +> There may be a couple of minutes of latency between the time the action is taken and the actual file being blocked. + + +## Create an indicator from the settings page + +>[!NOTE] +>There is a limit of 5000 indicators per tenant. 1. In the navigation pane, select **Settings** > **Indicators**. @@ -69,7 +121,7 @@ On the top navigation you can: 3. Update the details of the indicator and click **Save** or click the **Delete** button if you'd like to remove the entity from the list. -## Import a list +## Import a list of IoCs You can also choose to upload a CSV file that defines the attributes of indicators, the action to be taken, and other details. diff --git a/windows/security/threat-protection/microsoft-defender-atp/post-ti-indicator.md b/windows/security/threat-protection/microsoft-defender-atp/post-ti-indicator.md index 53cae96485..10fbaec373 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/post-ti-indicator.md +++ b/windows/security/threat-protection/microsoft-defender-atp/post-ti-indicator.md @@ -29,6 +29,7 @@ ms.topic: article - Submits or Updates new [Indicator](ti-indicator.md) entity. + ## Permissions One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Get started](apis-intro.md) @@ -116,3 +117,6 @@ Content-type: application/json } ``` + +## Related topic +- [Manage indicators](manage-indicators.md) \ No newline at end of file From 48e75fc61e0b4c219a4123aacb342eb4e3a04751 Mon Sep 17 00:00:00 2001 From: Mike Edgar <49731348+medgarmedgar@users.noreply.github.com> Date: Thu, 29 Aug 2019 20:33:39 -0700 Subject: [PATCH 02/49] Update manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md --- ...perating-system-components-to-microsoft-services-using-MDM.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md index d507296ac2..5b4b94f0ae 100644 --- a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md +++ b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md @@ -139,6 +139,7 @@ For Windows 10, the following MDM policies are available in the [Policy CSP](htt 1. Windows Defender Smartscreen - [Browser/AllowSmartScreen](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowsmartscreen). Disable Windows Defender Smartscreen. **Set to 0 (zero)** 1. Windows Defender Smartscreen EnableAppInstallControl - [SmartScreen/EnableAppInstallControl](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-smartscreen#smartscreen-enableappinstallcontrol). Controls whether users are allowed to install apps from places other than the Microsoft Store. **Set to 0 (zero)** 1. Windows Defender Potentially Unwanted Applications(PUA) Protection - [Defender/PUAProtection](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-defender#defender-puaprotection). Specifies the level of detection for potentially unwanted applications (PUAs). **Set to 1 (one)** + 1. [Defender/SignatureUpdateFallbackOrder](https://docs.microsoft.com/en-us/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-mdm). Allows you to define the order in which different definition update sources should be contacted. The OMA-URI for this is: **./Vendor/MSFT/Policy/Config/Defender/SignatureUpdateFallbackOrder**, Data type: **string**, Value: **FileShares** 1. **Windows Spotlight** - [Experience/AllowWindowsSpotlight](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-experience#experience-allowwindowsspotlight). Disable Windows Spotlight. **Set to 0 (zero)** 1. **Microsoft Store** 1. [ApplicationManagement/DisableStoreOriginatedApps](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-applicationmanagement#applicationmanagement-disablestoreoriginatedapps). Boolean value that disables the launch of all apps from Microsoft Store that came pre-installed or were downloaded. **Set to 1 (one)** From 819c8656a37208153a4a237194d32f1b5a5ff079 Mon Sep 17 00:00:00 2001 From: Mike Edgar <49731348+medgarmedgar@users.noreply.github.com> Date: Thu, 29 Aug 2019 20:36:18 -0700 Subject: [PATCH 03/49] Update manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md --- ...erating-system-components-to-microsoft-services-using-MDM.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md index 5b4b94f0ae..850cfe4a4a 100644 --- a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md +++ b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md @@ -100,7 +100,7 @@ For Windows 10, the following MDM policies are available in the [Policy CSP](htt 1. **OneDrive** 1. MDM Policy: [DisableOneDriveFileSync](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-system#system-disableonedrivefilesync). Allows IT Admins to prevent apps and features from working with files on OneDrive. **Set to 1 (one)** 1. Ingest the ADMX - To get the latest OneDrive ADMX file you need an up-to-date Windows 10 client. The ADMX files are located under the following path: %LocalAppData%\Microsoft\OneDrive\ there's a folder with the current OneDrive build (e.g. "18.162.0812.0001"). There is a folder named "adm" which contains the admx and adml policy definition files. - 1. MDM Policy: Prevent Network Traffic before User SignIn. **PreventNetworkTrafficPreUserSignIn**. The OMA-URI value is: ./Device/Vendor/MSFT/Policy/Config/OneDriveNGSC\~Policy\~OneDriveNGSC/PreventNetworkTrafficPreUserSignIn, **String, \** + 1. MDM Policy: Prevent Network Traffic before User SignIn. **PreventNetworkTrafficPreUserSignIn**. The OMA-URI value is: **./Device/Vendor/MSFT/Policy/Config/OneDriveNGSC\~Policy\~OneDriveNGSC/PreventNetworkTrafficPreUserSignIn**, Data type: **String**, Value: **\** 1. **Privacy settings** Except for the Feedback & Diagnostics page, these settings must be configured for every user account that signs into the PC. From 64f7adf622ffee7eb6770baacd9ecf8fa4cd026c Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Fri, 30 Aug 2019 11:09:20 -0700 Subject: [PATCH 04/49] fix icons --- .../microsoft-defender-atp/manage-indicators.md | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md index 48bfb2d7e7..75168ec4e3 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md @@ -45,11 +45,14 @@ The same list of indicators is honored by the prevention agent. Meaning, if Wind **Automated investigation and remediation engine** -The automated investigation and remediation behave the same. If an indicator is set to "Allow", Automated investigation and remediation will ignore a "bad" verdict for it. If set to "Block", Automated investigation and remediation will treat it as “bad”. +The automated investigation and remediation behave the same. If an indicator is set to "Allow", Automated investigation and remediation will ignore a "bad" verdict for it. If set to "Block", Automated investigation and remediation will treat it as "bad". In the first phase, the file hashes are fully supported, while network addresses (IP, Domain names) are partially supported (Automation and Detection). Stay tuned as the network blocking and more IoCs become available. -The current actions supported are Allow, Alert-only, Alert&Block. +The current actions supported are: +- Allow +- Alert only +- Alert and block On the top navigation you can: @@ -73,7 +76,7 @@ There are several ways to control IoCs: Creating IoCs must comply to the following: ->- This feature is available if your organization uses Windows Defender Antivirus and Cloud–based protection is enabled. For more information, see [Manage cloud–based protection](../windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md). +>- This feature is available if your organization uses Windows Defender Antivirus and Cloud-based protection is enabled. For more information, see [Manage cloud-based protection](../windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md). > >- The Antimalware client version must be 4.18.1901.x or later. >- This feature is designed to prevent suspected malware (or potentially malicious files) from being downloaded from the web. It currently supports portable executable (PE) files, including _.exe_ and _.dll_ files. The coverage will be extended over time. From 977634614fc2fe9309df31d08fd4ad88bf82cb49 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Fri, 30 Aug 2019 14:17:09 -0700 Subject: [PATCH 05/49] fix note --- .../microsoft-defender-atp/manage-indicators.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md index 75168ec4e3..b7dc5ee01e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md @@ -39,7 +39,7 @@ The cloud detection engine of Microsoft Defender ATP regularly scans collected d **Endpoint prevention engine**
The same list of indicators is honored by the prevention agent. Meaning, if Windows Defender AV is the primary AV configured, the matched indicators will be treated according to the settings. For example, if the action is "Alert and Block", Windows Defender AV will prevent file executions (block and remediate) and a corresponding alert will be raised. On the other hand, if the Action is set to "Allow", Windows Defender AV will not detect nor block the file from being run. ->![NOTE] +>[!NOTE] >-There is a propagation time of several minutes before the blocking policy for a new hash is applied. >- Trusted signed files will be treated differently. Microsoft Defender ATP is optimized to handle malicious files. Trying to block trusted signed files, in some cases, may have performance implications. From e055d2ad4dd2931761ec4045edbb855bff0c8652 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Fri, 30 Aug 2019 14:31:51 -0700 Subject: [PATCH 06/49] remove file to fix warning on redirect --- .../manage-automation-allowed-blocked-list.md | 68 ------------------- 1 file changed, 68 deletions(-) delete mode 100644 windows/security/threat-protection/microsoft-defender-atp/manage-automation-allowed-blocked-list.md diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-automation-allowed-blocked-list.md b/windows/security/threat-protection/microsoft-defender-atp/manage-automation-allowed-blocked-list.md deleted file mode 100644 index b30f739163..0000000000 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-automation-allowed-blocked-list.md +++ /dev/null @@ -1,68 +0,0 @@ ---- -title: Manage automation allowed/blocked lists -description: Create lists that control what items are automatically blocked or allowed during an automatic investigation. -keywords: manage, automation, whitelist, blacklist, block, clean, malicious -search.product: eADQiWindows 10XVcnh -search.appverid: met150 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security -ms.author: macapara -author: mjcaparas -ms.localizationpriority: medium -manager: dansimp -audience: ITPro -ms.collection: M365-security-compliance -ms.topic: article ---- - -# Manage automation allowed/blocked lists - -**Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) - - - ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-automationexclusionlist-abovefoldlink) - -Create a rule to control which entities are automatically incriminated or exonerated during Automated investigations. - -Entities added to the allowed list are considered safe and will not be analyzed during Automated investigations. - -Entities added to the blocked list are considered malicious and will be remediated during Automated investigations. - -You can define the conditions for when entities are identified as malicious or safe based on certain attributes such as hash values or certificates. - -## Create an allowed or blocked list -1. In the navigation pane, select **Settings** > **Automation allowed/blocked list**. - -2. Select the tab of the type of entity you'd like to create an exclusion for. Currently, you can add a rule for certificates. - -3. Select **Add allowed/blocked list rule**. - -4. For each attribute specify the exclusion type, details, and their corresponding required values. - -5. Click **Add rule**. - -## Edit a list -1. In the navigation pane, select **Settings** > **Automation allowed/blocked list**. - -2. Select the tab of the entity type you'd like to edit the list from. - -3. Update the details of the rule and click **Update rule**. - -## Delete a list -1. In the navigation pane, select **Settings** > **Automation allowed/blocked list**. - -2. Select the tab of the entity type you'd like to delete the list from. - -3. Select the list type by clicking the check-box beside the list type. - -4. Click **Delete**. - - -## Related topics -- [Manage automation file uploads](manage-automation-file-uploads.md) -- [Manage indicators](manage-indicators.md) -- [Manage automation folder exclusions](manage-automation-folder-exclusions.md) From 0c7e6fa71527963f8b8120632e0e070e1c93e505 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 3 Sep 2019 13:46:59 -0700 Subject: [PATCH 07/49] update advanced settings --- .../microsoft-defender-atp/advanced-features.md | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-features.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-features.md index 38d679e8fa..6b7a24edb1 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-features.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-features.md @@ -53,7 +53,7 @@ For tenants created on or after Windows 10, version 1809 the automated investiga > - The result of the auto-resolve action may influence the Machine risk level calculation which is based on the active alerts found on a machine. >- If a security operations analyst manually sets the status of an alert to "In progress" or "Resolved" the auto-resolve capability will not overwrite it. -## Block file +## Allow or block file Blocking is only available if your organization uses Windows Defender Antivirus as the active antimalware solution, and if the cloud-based protection feature is enabled. @@ -71,6 +71,19 @@ To turn **Allow or block** files on: Once you have enabled this feature, you can [block files](respond-file-alerts.md#allow-or-block-file) via the **Add Indicator** tab on a file's profile page. + +## Custom network indicators + +Enabling this feature allows you to create indicators for IP addresses, domains, or URLs which determine whether they will be allowed or blocked based on your custom indicator list. + +To use this feature, machines must be running Windows 10 version 1709 or later. They should also have network protection in block mode and version 4.18.1906.3 or later of the antimalware platform [see KB 4052623](https://go.microsoft.com/fwlink/?linkid=2099834). + +For more information, see [Manage indicators](manage-indicators.md). + +>[!NOTE] +>Network protection leverages reputation services that process requests in locations that might be outside of the location you have selected for your Microsoft Defender ATP data. + + ## Show user details When you enable this feature, you'll be able to see user details stored in Azure Active Directory including a user's picture, name, title, and department information when investigating user account entities. You can find user account information in the following views: From 76b7dd8d3c7c47173a133b68c111f96cae47ac0b Mon Sep 17 00:00:00 2001 From: Greg Lindsay Date: Tue, 3 Sep 2019 16:18:14 -0700 Subject: [PATCH 08/49] fix note error --- ...compatibility-administrator-users-guide.md | 39 ++----- ...lity-fix-in-compatibility-administrator.md | 18 +-- ...oyment-considerations-for-windows-to-go.md | 22 +--- ...ty-fixes-in-compatibility-administrator.md | 7 +- ...ery-tool-in-compatibility-administrator.md | 15 +-- ...rstanding-and-using-compatibility-fixes.md | 12 +- ...s-screen-in-compatibility-administrator.md | 21 +--- .../planning/windows-to-go-overview.md | 103 ++++++------------ 8 files changed, 69 insertions(+), 168 deletions(-) diff --git a/windows/deployment/planning/compatibility-administrator-users-guide.md b/windows/deployment/planning/compatibility-administrator-users-guide.md index 35a5c57fb6..34134c175e 100644 --- a/windows/deployment/planning/compatibility-administrator-users-guide.md +++ b/windows/deployment/planning/compatibility-administrator-users-guide.md @@ -11,7 +11,6 @@ ms.pagetype: appcompat ms.sitesec: library audience: itpro author: greg-lindsay -ms.date: 04/19/2017 ms.topic: article --- @@ -20,33 +19,30 @@ ms.topic: article **Applies to** -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 +- Windows 10 +- Windows 8.1 +- Windows 8 +- Windows 7 +- Windows Server 2012 +- Windows Server 2008 R2 The Compatibility Administrator tool helps you resolve potential application-compatibility issues before deploying a new version of Windows to your organization. Compatibility Administrator provides the following: -- Compatibility fixes, compatibility modes, and AppHelp messages that you can use to resolve specific compatibility issues. +- Compatibility fixes, compatibility modes, and AppHelp messages that you can use to resolve specific compatibility issues. -- Tools for creating customized compatibility fixes, compatibility modes, AppHelp messages, and compatibility databases. +- Tools for creating customized compatibility fixes, compatibility modes, AppHelp messages, and compatibility databases. -- A query tool that you can use to search for installed compatibility fixes on your local computers. +- A query tool that you can use to search for installed compatibility fixes on your local computers. The following flowchart shows the steps for using the Compatibility Administrator tool to create your compatibility fixes, compatibility modes, and AppHelp messages. ![act compatibility admin flowchart](images/dep-win8-l-act-compatadminflowchart.jpg) -> [!IMPORTANT]   -> Application Compatibility Toolkit (ACT) installs a 32-bit and a 64-bit version of the Compatibility Administrator tool. You must use the 32-bit version to create and work with custom databases for 32-bit applications, and the 64-bit version to create and work with custom databases for 64-bit applications. - - +>[!IMPORTANT]   +>Application Compatibility Toolkit (ACT) installs a 32-bit and a 64-bit version of the Compatibility Administrator tool. You must use the 32-bit version to create and work with custom databases for 32-bit applications, and the 64-bit version to create and work with custom databases for 64-bit applications. ## In this section - @@ -72,15 +68,4 @@ The following flowchart shows the steps for using the Compatibility Administrato -

You must deploy your customized database (.sdb) files to other computers in your organization before your compatibility fixes, compatibility modes, and AppHelp messages are applied. You can deploy your customized database files in several ways, including by using a logon script, by using Group Policy, or by performing file copy operations.
- - - - - - - - - - - + \ No newline at end of file diff --git a/windows/deployment/planning/creating-a-custom-compatibility-fix-in-compatibility-administrator.md b/windows/deployment/planning/creating-a-custom-compatibility-fix-in-compatibility-administrator.md index 1f4317116c..36e4f92a25 100644 --- a/windows/deployment/planning/creating-a-custom-compatibility-fix-in-compatibility-administrator.md +++ b/windows/deployment/planning/creating-a-custom-compatibility-fix-in-compatibility-administrator.md @@ -11,7 +11,6 @@ ms.pagetype: appcompat ms.sitesec: library audience: itpro author: greg-lindsay -ms.date: 04/19/2017 ms.topic: article --- @@ -29,8 +28,8 @@ ms.topic: article The Compatibility Administrator tool uses the term *fix* to describe the combination of compatibility information added to a customized database for a specific application. This combination can include single application fixes, groups of fixes that work together as a compatibility mode, and blocking and non-blocking AppHelp messages. -> [!IMPORTANT]   -> Fixes apply to a single application only; therefore, you must create multiple fixes if you need to fix the same issue in multiple applications. +>[!IMPORTANT]   +>Fixes apply to a single application only; therefore, you must create multiple fixes if you need to fix the same issue in multiple applications. @@ -44,8 +43,8 @@ A compatibility fix, previously known as a shim, is a small piece of code that i The Compatibility Administrator tool has preloaded fixes for many common applications, including known compatibility fixes, compatibility modes, and AppHelp messages. Before you create a new compatibility fix, you can search for an existing application and then copy and paste the known fixes into your customized database. -> [!IMPORTANT]   -> Application Compatibility Toolkit (ACT) installs a 32-bit and a 64-bit version of the Compatibility Administrator tool. You must use the 32-bit version to create custom databases for 32-bit applications and the 64-bit version to create custom databases for 64-bit applications. +>[!IMPORTANT]   +>Application Compatibility Toolkit (ACT) installs a 32-bit and a 64-bit version of the Compatibility Administrator tool. You must use the 32-bit version to create custom databases for 32-bit applications and the 64-bit version to create custom databases for 64-bit applications. @@ -76,12 +75,3 @@ If you are unable to find a preloaded compatibility fix for your application, yo ## Related topics [Compatibility Administrator User's Guide](compatibility-administrator-users-guide.md) - - - - - - - - - diff --git a/windows/deployment/planning/deployment-considerations-for-windows-to-go.md b/windows/deployment/planning/deployment-considerations-for-windows-to-go.md index 46b6a0fa22..2d2029cb3c 100644 --- a/windows/deployment/planning/deployment-considerations-for-windows-to-go.md +++ b/windows/deployment/planning/deployment-considerations-for-windows-to-go.md @@ -27,8 +27,8 @@ ms.topic: article From the start, Windows To Go was designed to minimize differences between the user experience of working on a laptop and Windows To Go booted from a USB drive. Given that Windows To Go was designed as an enterprise solution, extra consideration was given to the deployment workflows that enterprises already have in place. Additionally, there has been a focus on minimizing the number of differences in deployment between Windows To Go workspaces and laptop PCs. -> [!NOTE] -> Windows To Go does not support operating system upgrades. Windows To Go is designed as a feature that is managed centrally. IT departments that plan to transition from one operating system version to a later version will need to incorporate re-imaging their existing Windows To Go drives as part of their upgrade deployment process. +>[!NOTE] +>Windows To Go does not support operating system upgrades. Windows To Go is designed as a feature that is managed centrally. IT departments that plan to transition from one operating system version to a later version will need to incorporate re-imaging their existing Windows To Go drives as part of their upgrade deployment process. @@ -323,19 +323,7 @@ If you choose to not use the Windows To Go startup options or are using a PC run ## Related topics -[Windows To Go: feature overview](windows-to-go-overview.md) - -[Prepare your organization for Windows To Go](prepare-your-organization-for-windows-to-go.md) - -[Security and data protection considerations for Windows To Go](security-and-data-protection-considerations-for-windows-to-go.md) - +[Windows To Go: feature overview](windows-to-go-overview.md)
+[Prepare your organization for Windows To Go](prepare-your-organization-for-windows-to-go.md)
+[Security and data protection considerations for Windows To Go](security-and-data-protection-considerations-for-windows-to-go.md)
[Windows To Go: frequently asked questions](windows-to-go-frequently-asked-questions.md) - - - - - - - - - diff --git a/windows/deployment/planning/enabling-and-disabling-compatibility-fixes-in-compatibility-administrator.md b/windows/deployment/planning/enabling-and-disabling-compatibility-fixes-in-compatibility-administrator.md index e06c1c3f42..487a1a93d2 100644 --- a/windows/deployment/planning/enabling-and-disabling-compatibility-fixes-in-compatibility-administrator.md +++ b/windows/deployment/planning/enabling-and-disabling-compatibility-fixes-in-compatibility-administrator.md @@ -11,7 +11,6 @@ ms.pagetype: appcompat ms.sitesec: library audience: itpro author: greg-lindsay -ms.date: 04/19/2017 ms.topic: article --- @@ -31,11 +30,10 @@ You can disable and enable individual compatibility fixes in your customized dat ## Disabling Compatibility Fixes - Customized compatibility databases can become quite complex as you add your fixes for the multiple applications found in your organization. Over time, you may find you need to disable a particular fix in your customized database. For example, if a software vendor releases a fix for an issue addressed in one of your compatibility fixes, you must validate that the vendor's fix is correct and that it resolves your issue. To do this, you must temporarily disable the compatibility fix and then test your application. -> [!IMPORTANT]   -> Application Compatibility Toolkit (ACT) installs a 32-bit and a 64-bit version of the Compatibility Administrator tool. You must use the 32-bit version to work with custom databases for 32-bit applications and the 64-bit version to work with custom databases for 64-bit applications. +>[!IMPORTANT]   +>Application Compatibility Toolkit (ACT) installs a 32-bit and a 64-bit version of the Compatibility Administrator tool. You must use the 32-bit version to work with custom databases for 32-bit applications and the 64-bit version to work with custom databases for 64-bit applications. @@ -66,4 +64,5 @@ You can enable your disabled compatibility fixes at any time. 2. On the **Database** menu, click **Enable Entry**. ## Related topics + [Compatibility Administrator User's Guide](compatibility-administrator-users-guide.md) diff --git a/windows/deployment/planning/searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator.md b/windows/deployment/planning/searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator.md index 03e9af0af8..42ebfb4c7f 100644 --- a/windows/deployment/planning/searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator.md +++ b/windows/deployment/planning/searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator.md @@ -11,7 +11,6 @@ ms.pagetype: appcompat ms.sitesec: library audience: itpro author: greg-lindsay -ms.date: 04/19/2017 ms.topic: article --- @@ -31,8 +30,8 @@ You can access the Query tool from within Compatibility Administrator. The Query For information about the Search feature, see [Searching for Fixed Applications in Compatibility Administrator](searching-for-fixed-applications-in-compatibility-administrator.md). However, the Query tool provides more detailed search criteria, including tabs that enable you to search the program properties, the compatibility fix properties, and the fix description. You can perform a search by using SQL SELECT and WHERE clauses, in addition to searching specific types of databases. -> [!IMPORTANT] -> You must perform your search with the correct version of the Compatibility Administrator tool. To use the Query tool to search for a 32-bit custom database, you must use the 32-bit version of Compatibility Administrator. To use the Query tool to search for a 64-bit custom database, you must use the 64-bit version of Compatibility Administrator. +>[!IMPORTANT] +>You must perform your search with the correct version of the Compatibility Administrator tool. To use the Query tool to search for a 32-bit custom database, you must use the 32-bit version of Compatibility Administrator. To use the Query tool to search for a 64-bit custom database, you must use the 64-bit version of Compatibility Administrator. @@ -172,13 +171,5 @@ You can export any of your search results into a tab-delimited text (.txt) file 2. Browse to the location where you intend to store the search results file, and then click **Save**. ## Related topics -[Compatibility Administrator User's Guide](compatibility-administrator-users-guide.md) - - - - - - - - +[Compatibility Administrator User's Guide](compatibility-administrator-users-guide.md) \ No newline at end of file diff --git a/windows/deployment/planning/understanding-and-using-compatibility-fixes.md b/windows/deployment/planning/understanding-and-using-compatibility-fixes.md index 9c20d5e963..fab1e74808 100644 --- a/windows/deployment/planning/understanding-and-using-compatibility-fixes.md +++ b/windows/deployment/planning/understanding-and-using-compatibility-fixes.md @@ -11,13 +11,11 @@ ms.pagetype: appcompat ms.sitesec: library audience: itpro author: greg-lindsay -ms.date: 04/19/2017 ms.topic: article --- # Understanding and Using Compatibility Fixes - **Applies to** - Windows 10 @@ -31,7 +29,6 @@ As the Windows operating system evolves to support new technology and functional ## How the Compatibility Fix Infrastructure Works - The Compatibility Fix infrastructure uses the linking ability of APIs to redirect an application from Windows code directly to alternative code that implements the compatibility fix. The Windows Portable Executable File Format includes headers that contain the data directories that are used to provide a layer of indirection between the application and the linked file. API calls to the external binary files take place through the Import Address Table (IAT), which then directly calls the Windows operating system, as shown in the following figure. @@ -42,14 +39,13 @@ Specifically, the process modifies the address of the affected Windows function ![act app redirect with compatibility fix](images/dep-win8-l-act-appredirectwithcompatfix.jpg) -> [!NOTE] -> For statically linked DLLs, the code redirection occurs as the application loads. You can also fix dynamically linked DLLs by hooking into the GetProcAddress API. +>[!NOTE] +>For statically linked DLLs, the code redirection occurs as the application loads. You can also fix dynamically linked DLLs by hooking into the GetProcAddress API. ## Design Implications of the Compatibility Fix Infrastructure - There are important considerations to keep in mind when determining your application fix strategy, due to certain characteristics of the Compatibility Fix infrastructure. - The compatibility fix is not part of the Windows operating system (as shown in the previous figure). Therefore, the same security restrictions apply to the compatibility fix as apply to the application code, which means that you cannot use compatibility fixes to bypass any of the security mechanisms of the operating system. Therefore, compatibility fixes do not increase your security exposure, nor do you need to lower your security settings to accommodate compatibility fixes. @@ -65,7 +61,6 @@ There are important considerations to keep in mind when determining your applica ## Determining When to Use a Compatibility Fix - The decision to use compatibility fixes to remedy your compatibility issues may involve more than just technical issues. The following scenarios reflect other common reasons for using a compatibility fix. ### Scenario 1 @@ -88,15 +83,14 @@ In the situation where an application is either unimportant to your organization ## Determining Which Version of an Application to Fix - You can apply a compatibility fix to a particular version of an application, either by using the "up to or including" clause or by selecting that specific version. This means that the next version of the application will not have the compatibility fix automatically applied. This is important, because it allows you to continue to use your application, but it also encourages the vendor to fix the application. ## Support for Compatibility Fixes - Compatibility fixes are shipped as part of the Windows operating system and are updated by using Windows Update. Therefore, they receive the same level of support as Windows itself. You can apply the compatibility fixes to any of your applications. However, Microsoft does not provide the tools to use the Compatibility Fix infrastructure to create your own custom fixes. ## Related topics + [Managing Application-Compatibility Fixes and Custom Fix Databases](managing-application-compatibility-fixes-and-custom-fix-databases.md) diff --git a/windows/deployment/planning/viewing-the-events-screen-in-compatibility-administrator.md b/windows/deployment/planning/viewing-the-events-screen-in-compatibility-administrator.md index 6759684011..e6d35d3d8f 100644 --- a/windows/deployment/planning/viewing-the-events-screen-in-compatibility-administrator.md +++ b/windows/deployment/planning/viewing-the-events-screen-in-compatibility-administrator.md @@ -11,7 +11,6 @@ ms.pagetype: appcompat ms.sitesec: library audience: itpro author: greg-lindsay -ms.date: 04/19/2017 ms.topic: article --- @@ -29,14 +28,14 @@ ms.topic: article The **Events** screen enables you to record and to view your activities in the Compatibility Administrator tool, provided that the screen is open while you perform the activities. -> [!IMPORTANT]   -> The **Events** screen only records your activities when the screen is open. If you perform an action before opening the **Events** screen, the action will not appear in the list. +>[!IMPORTANT]   +>The **Events** screen only records your activities when the screen is open. If you perform an action before opening the **Events** screen, the action will not appear in the list. **To open the Events screen** -- On the **View** menu, click **Events**. +- On the **View** menu, click **Events**. ## Handling Multiple Copies of Compatibility Fixes @@ -46,15 +45,5 @@ Compatibility Administrator enables you to copy your compatibility fixes from on If you open the **Events** screen and then perform the copy operation, you can see a description of the action, along with the time stamp, which enables you to view your fix information without confusion. ## Related topics -[Creating a Custom Compatibility Mode in Compatibility Administrator](creating-a-custom-compatibility-mode-in-compatibility-administrator.md) - -[Compatibility Administrator User's Guide](compatibility-administrator-users-guide.md) - - - - - - - - - +[Creating a Custom Compatibility Mode in Compatibility Administrator](creating-a-custom-compatibility-mode-in-compatibility-administrator.md)
+[Compatibility Administrator User's Guide](compatibility-administrator-users-guide.md) \ No newline at end of file diff --git a/windows/deployment/planning/windows-to-go-overview.md b/windows/deployment/planning/windows-to-go-overview.md index 14a975949c..f25da887d0 100644 --- a/windows/deployment/planning/windows-to-go-overview.md +++ b/windows/deployment/planning/windows-to-go-overview.md @@ -29,32 +29,26 @@ Windows To Go is a feature in Windows 10 Enterprise and Windows 10 Education t PCs that meet the Windows 7 or later [certification requirements](https://go.microsoft.com/fwlink/p/?LinkId=618711) can run Windows 10 in a Windows To Go workspace, regardless of the operating system running on the PC. Windows To Go workspaces can use the same image enterprises use for their desktops and laptops and can be managed the same way. Windows To Go is not intended to replace desktops, laptops or supplant other mobility offerings. Rather, it provides support for efficient use of resources for alternative workplace scenarios. There are some additional considerations that you should keep in mind before you start to use Windows To Go: -- [Differences between Windows To Go and a typical installation of Windows](#bkmk-wtgdif) -- [Roaming with Windows To Go](#bkmk-wtgroam) -- [Prepare for Windows To Go](#wtg-prep-intro) -- [Hardware considerations for Windows To Go](#wtg-hardware) +- [Differences between Windows To Go and a typical installation of Windows](#bkmk-wtgdif) +- [Roaming with Windows To Go](#bkmk-wtgroam) +- [Prepare for Windows To Go](#wtg-prep-intro) +- [Hardware considerations for Windows To Go](#wtg-hardware) -> [!NOTE] -> Windows To Go is not supported on Windows RT. +>[!NOTE] +>Windows To Go is not supported on Windows RT. ## Differences between Windows To Go and a typical installation of Windows - Windows To Go workspace operates just like any other installation of Windows with a few exceptions. These exceptions are: -- **Internal disks are offline.** To ensure data isn’t accidentally disclosed, internal hard disks on the host computer are offline by default when booted into a Windows To Go workspace. Similarly if a Windows To Go drive is inserted into a running system, the Windows To Go drive will not be listed in Windows Explorer. - -- **Trusted Platform Module (TPM) is not used.** When using BitLocker Drive Encryption a pre-operating system boot password will be used for security rather than the TPM since the TPM is tied to a specific computer and Windows To Go drives will move between computers. - -- **Hibernate is disabled by default.** To ensure that the Windows To Go workspace is able to move between computers easily, hibernation is disabled by default. Hibernation can be re-enabled by using Group Policy settings. - -- **Windows Recovery Environment is not available.** In the rare case that you need to recover your Windows To Go drive, you should re-image it with a fresh image of Windows. - -- **Refreshing or resetting a Windows To Go workspace is not supported.** Resetting to the manufacturer’s standard for the computer doesn’t apply when running a Windows To Go workspace, so the feature was disabled. - -- **Upgrading a Windows To Go workspace is not supported.** Older Windows 8 or Windows 8.1 Windows To Go workspaces cannot be upgraded to Windows 10 workspaces, nor can Windows 10 Windows To Go workspaces be upgraded to future versions of Windows 10. For new versions, the workspace needs to be re-imaged with a fresh image of Windows. +- **Internal disks are offline.** To ensure data isn’t accidentally disclosed, internal hard disks on the host computer are offline by default when booted into a Windows To Go workspace. Similarly if a Windows To Go drive is inserted into a running system, the Windows To Go drive will not be listed in Windows Explorer. +- **Trusted Platform Module (TPM) is not used.** When using BitLocker Drive Encryption a pre-operating system boot password will be used for security rather than the TPM since the TPM is tied to a specific computer and Windows To Go drives will move between computers. +- **Hibernate is disabled by default.** To ensure that the Windows To Go workspace is able to move between computers easily, hibernation is disabled by default. Hibernation can be re-enabled by using Group Policy settings. +- **Windows Recovery Environment is not available.** In the rare case that you need to recover your Windows To Go drive, you should re-image it with a fresh image of Windows. +- **Refreshing or resetting a Windows To Go workspace is not supported.** Resetting to the manufacturer’s standard for the computer doesn’t apply when running a Windows To Go workspace, so the feature was disabled. +- **Upgrading a Windows To Go workspace is not supported.** Older Windows 8 or Windows 8.1 Windows To Go workspaces cannot be upgraded to Windows 10 workspaces, nor can Windows 10 Windows To Go workspaces be upgraded to future versions of Windows 10. For new versions, the workspace needs to be re-imaged with a fresh image of Windows. ## Roaming with Windows To Go @@ -96,11 +90,9 @@ For more information about designing and planning your Windows To Go deployment, The devices listed in this section have been specially optimized and certified for Windows To Go and meet the necessary requirements for booting and running a full version of Windows 10 from a USB drive. The optimizations for Windows To Go include the following: -- Windows To Go certified USB drives are built for high random read/write speeds and support the thousands of random access I/O operations per second required for running normal Windows workloads smoothly. - -- Windows To Go certified USB drives have been tuned to ensure they boot and run on hardware certified for use with Windows 7 and later. - -- Windows To Go certified USB drives are built to last. Certified USB drives are backed with manufacturer warranties and should continue operating under normal usage. Refer to the manufacturer websites for warranty details. +- Windows To Go certified USB drives are built for high random read/write speeds and support the thousands of random access I/O operations per second required for running normal Windows workloads smoothly. +- Windows To Go certified USB drives have been tuned to ensure they boot and run on hardware certified for use with Windows 7 and later. +- Windows To Go certified USB drives are built to last. Certified USB drives are backed with manufacturer warranties and should continue operating under normal usage. Refer to the manufacturer websites for warranty details. As of the date of publication, the following are the USB drives currently certified for use as Windows To Go drives: @@ -109,26 +101,21 @@ Using a USB drive that has not been certified is not supported -- IronKey Workspace W700 ([http://www.ironkey.com/windows-to-go-drives/ironkey-workspace-w700.html](https://go.microsoft.com/fwlink/p/?LinkId=618714)) - -- IronKey Workspace W500 ([http://www.ironkey.com/windows-to-go-drives/ironkey-workspace-w500.html](https://go.microsoft.com/fwlink/p/?LinkId=618717)) - -- IronKey Workspace W300 ([http://www.ironkey.com/windows-to-go-drives/ironkey-workspace-w300.html](https://go.microsoft.com/fwlink/p/?LinkId=618718)) - -- Kingston DataTraveler Workspace for Windows To Go ([http://www.kingston.com/wtg/](https://go.microsoft.com/fwlink/p/?LinkId=618719)) - -- Spyrus Portable Workplace ([http://www.spyruswtg.com/](https://go.microsoft.com/fwlink/p/?LinkId=618720)) +- IronKey Workspace W700 ([http://www.ironkey.com/windows-to-go-drives/ironkey-workspace-w700.html](https://go.microsoft.com/fwlink/p/?LinkId=618714)) +- IronKey Workspace W500 ([http://www.ironkey.com/windows-to-go-drives/ironkey-workspace-w500.html](https://go.microsoft.com/fwlink/p/?LinkId=618717)) +- IronKey Workspace W300 ([http://www.ironkey.com/windows-to-go-drives/ironkey-workspace-w300.html](https://go.microsoft.com/fwlink/p/?LinkId=618718)) +- Kingston DataTraveler Workspace for Windows To Go ([http://www.kingston.com/wtg/](https://go.microsoft.com/fwlink/p/?LinkId=618719)) +- Spyrus Portable Workplace ([http://www.spyruswtg.com/](https://go.microsoft.com/fwlink/p/?LinkId=618720)) We recommend that you run the Spyrus Deployment Suite for Windows To Go to provision the Spyrus Portable Workplace. -- Spyrus Secure Portable Workplace ([http://www.spyruswtg.com/](https://go.microsoft.com/fwlink/p/?LinkId=618720)) +- Spyrus Secure Portable Workplace ([http://www.spyruswtg.com/](https://go.microsoft.com/fwlink/p/?LinkId=618720)) > [!IMPORTANT]   > You must use the Spyrus Deployment Suite for Windows To Go to provision the Spyrus Secure Portable Workplace. For more information about the Spyrus Deployment Suite for Windows To Go please refer to [http://www.spyruswtg.com/](https://go.microsoft.com/fwlink/p/?LinkId=618720). - -- Spyrus Worksafe ([http://www.spyruswtg.com/](https://go.microsoft.com/fwlink/p/?LinkId=618720)) +- Spyrus Worksafe ([http://www.spyruswtg.com/](https://go.microsoft.com/fwlink/p/?LinkId=618720)) **Tip**   This device contains an embedded smart card. @@ -151,11 +138,9 @@ Using a USB drive that has not been certified is not supported When assessing the use of a PC as a host for a Windows To Go workspace you should consider the following criteria: -- Hardware that has been certified for use with Windows 7or later operating systems will work well with Windows To Go. - -- Running a Windows To Go workspace from a computer that is running Windows RT is not a supported scenario. - -- Running a Windows To Go workspace on a Mac computer is not a supported scenario. +- Hardware that has been certified for use with Windows 7or later operating systems will work well with Windows To Go. +- Running a Windows To Go workspace from a computer that is running Windows RT is not a supported scenario. +- Running a Windows To Go workspace on a Mac computer is not a supported scenario. The following table details the characteristics that the host computer must have to be used with Windows To Go: @@ -249,37 +234,17 @@ In addition to the USB boot support in the BIOS, the Windows 10 image on your W - - ## Additional resources - -- [Windows 10 forums](https://go.microsoft.com/fwlink/p/?LinkId=618949) - -- [Windows To Go Step by Step Wiki](https://go.microsoft.com/fwlink/p/?LinkId=618950) - -- [Tips for configuring your BIOS settings to work with Windows To Go](https://go.microsoft.com/fwlink/p/?LinkId=618951) +- [Windows 10 forums](https://go.microsoft.com/fwlink/p/?LinkId=618949) +- [Windows To Go Step by Step Wiki](https://go.microsoft.com/fwlink/p/?LinkId=618950) +- [Tips for configuring your BIOS settings to work with Windows To Go](https://go.microsoft.com/fwlink/p/?LinkId=618951) ## Related topics - -- [Deploy Windows To Go in your organization](https://go.microsoft.com/fwlink/p/?LinkId=619975) - -- [Windows To Go: frequently asked questions](windows-to-go-frequently-asked-questions.md) - -- [Prepare your organization for Windows To Go](prepare-your-organization-for-windows-to-go.md) - -- [Deployment considerations for Windows To Go](deployment-considerations-for-windows-to-go.md) - -- [Security and data protection considerations for Windows To Go](security-and-data-protection-considerations-for-windows-to-go.md) - -- [Best practice recommendations for Windows To Go](best-practice-recommendations-for-windows-to-go.md) - - - - - - - - - +[Deploy Windows To Go in your organization](https://go.microsoft.com/fwlink/p/?LinkId=619975)
+[Windows To Go: frequently asked questions](windows-to-go-frequently-asked-questions.md)
+[Prepare your organization for Windows To Go](prepare-your-organization-for-windows-to-go.md)
+[Deployment considerations for Windows To Go](deployment-considerations-for-windows-to-go.md)
+[Security and data protection considerations for Windows To Go](security-and-data-protection-considerations-for-windows-to-go.md)
+[Best practice recommendations for Windows To Go](best-practice-recommendations-for-windows-to-go.md) From de24746606c2905180d67c49c1e73c50475492c9 Mon Sep 17 00:00:00 2001 From: Dani Halfin Date: Tue, 3 Sep 2019 16:39:22 -0700 Subject: [PATCH 09/49] removing space after tag --- .../planning/compatibility-administrator-users-guide.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/deployment/planning/compatibility-administrator-users-guide.md b/windows/deployment/planning/compatibility-administrator-users-guide.md index 34134c175e..d1b8ea0f80 100644 --- a/windows/deployment/planning/compatibility-administrator-users-guide.md +++ b/windows/deployment/planning/compatibility-administrator-users-guide.md @@ -38,7 +38,7 @@ The following flowchart shows the steps for using the Compatibility Administrato ![act compatibility admin flowchart](images/dep-win8-l-act-compatadminflowchart.jpg) ->[!IMPORTANT]   +>[!IMPORTANT] >Application Compatibility Toolkit (ACT) installs a 32-bit and a 64-bit version of the Compatibility Administrator tool. You must use the 32-bit version to create and work with custom databases for 32-bit applications, and the 64-bit version to create and work with custom databases for 64-bit applications. ## In this section @@ -68,4 +68,4 @@ The following flowchart shows the steps for using the Compatibility Administrato

You must deploy your customized database (.sdb) files to other computers in your organization before your compatibility fixes, compatibility modes, and AppHelp messages are applied. You can deploy your customized database files in several ways, including by using a logon script, by using Group Policy, or by performing file copy operations.

- \ No newline at end of file + From c4d8389a8c104fbadaf091c257510af9d8a6e81b Mon Sep 17 00:00:00 2001 From: Dani Halfin Date: Tue, 3 Sep 2019 16:39:47 -0700 Subject: [PATCH 10/49] removing new spaces --- ...a-custom-compatibility-fix-in-compatibility-administrator.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/planning/creating-a-custom-compatibility-fix-in-compatibility-administrator.md b/windows/deployment/planning/creating-a-custom-compatibility-fix-in-compatibility-administrator.md index 36e4f92a25..5a005d4eb7 100644 --- a/windows/deployment/planning/creating-a-custom-compatibility-fix-in-compatibility-administrator.md +++ b/windows/deployment/planning/creating-a-custom-compatibility-fix-in-compatibility-administrator.md @@ -43,7 +43,7 @@ A compatibility fix, previously known as a shim, is a small piece of code that i The Compatibility Administrator tool has preloaded fixes for many common applications, including known compatibility fixes, compatibility modes, and AppHelp messages. Before you create a new compatibility fix, you can search for an existing application and then copy and paste the known fixes into your customized database. ->[!IMPORTANT]   +>[!IMPORTANT] >Application Compatibility Toolkit (ACT) installs a 32-bit and a 64-bit version of the Compatibility Administrator tool. You must use the 32-bit version to create custom databases for 32-bit applications and the 64-bit version to create custom databases for 64-bit applications. From 2521dbb54a09f502abe2bdb46dd5e87d63e008a0 Mon Sep 17 00:00:00 2001 From: Dani Halfin Date: Tue, 3 Sep 2019 16:40:40 -0700 Subject: [PATCH 11/49] removing even more more spaces --- ...abling-compatibility-fixes-in-compatibility-administrator.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/planning/enabling-and-disabling-compatibility-fixes-in-compatibility-administrator.md b/windows/deployment/planning/enabling-and-disabling-compatibility-fixes-in-compatibility-administrator.md index 487a1a93d2..565b9b6833 100644 --- a/windows/deployment/planning/enabling-and-disabling-compatibility-fixes-in-compatibility-administrator.md +++ b/windows/deployment/planning/enabling-and-disabling-compatibility-fixes-in-compatibility-administrator.md @@ -32,7 +32,7 @@ You can disable and enable individual compatibility fixes in your customized dat Customized compatibility databases can become quite complex as you add your fixes for the multiple applications found in your organization. Over time, you may find you need to disable a particular fix in your customized database. For example, if a software vendor releases a fix for an issue addressed in one of your compatibility fixes, you must validate that the vendor's fix is correct and that it resolves your issue. To do this, you must temporarily disable the compatibility fix and then test your application. ->[!IMPORTANT]   +>[!IMPORTANT] >Application Compatibility Toolkit (ACT) installs a 32-bit and a 64-bit version of the Compatibility Administrator tool. You must use the 32-bit version to work with custom databases for 32-bit applications and the 64-bit version to work with custom databases for 64-bit applications. From d86a8f274865abdc89cddf06e0aaa2e54c53cf93 Mon Sep 17 00:00:00 2001 From: Dani Halfin Date: Tue, 3 Sep 2019 16:41:16 -0700 Subject: [PATCH 12/49] more more more spaces removed --- ...iewing-the-events-screen-in-compatibility-administrator.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/deployment/planning/viewing-the-events-screen-in-compatibility-administrator.md b/windows/deployment/planning/viewing-the-events-screen-in-compatibility-administrator.md index e6d35d3d8f..579f4b8bfa 100644 --- a/windows/deployment/planning/viewing-the-events-screen-in-compatibility-administrator.md +++ b/windows/deployment/planning/viewing-the-events-screen-in-compatibility-administrator.md @@ -28,7 +28,7 @@ ms.topic: article The **Events** screen enables you to record and to view your activities in the Compatibility Administrator tool, provided that the screen is open while you perform the activities. ->[!IMPORTANT]   +>[!IMPORTANT] >The **Events** screen only records your activities when the screen is open. If you perform an action before opening the **Events** screen, the action will not appear in the list. @@ -46,4 +46,4 @@ If you open the **Events** screen and then perform the copy operation, you can s ## Related topics [Creating a Custom Compatibility Mode in Compatibility Administrator](creating-a-custom-compatibility-mode-in-compatibility-administrator.md)
-[Compatibility Administrator User's Guide](compatibility-administrator-users-guide.md) \ No newline at end of file +[Compatibility Administrator User's Guide](compatibility-administrator-users-guide.md) From d381096f71d49027f6b8359b4dd33f4406633d5c Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 3 Sep 2019 17:02:25 -0700 Subject: [PATCH 13/49] update indicators page --- .../images/rules-indicators.png | Bin 0 -> 48703 bytes .../manage-indicators.md | 148 +++++++++++------- 2 files changed, 90 insertions(+), 58 deletions(-) create mode 100644 windows/security/threat-protection/microsoft-defender-atp/images/rules-indicators.png diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/rules-indicators.png b/windows/security/threat-protection/microsoft-defender-atp/images/rules-indicators.png new file mode 100644 index 0000000000000000000000000000000000000000..570609f803adb9644b2adbe542fb5ed7961c14e2 GIT binary patch literal 48703 zcmeFZXH-*9)HjMEA|hY`QL2jcrc~)7QbO+~G?fm99(qv_P!y0FIw*u5niMG^3QF&g zgdP-Wp@bF!guom9>vP{P_tX9KtaZ;?K+c|hW@hjC?J|2#c%!eYPIr;zA_WBn9YEu; zAq55190kRhkPGL@l#%4pLh>IPPYnwn3X1F8zkkjE4DW7{iPXLT9aZWD8cOD~5&%u% zkv}9=b6;h!ud|0YMQLTf2AOopmrQ!>;A7|Q;_2(+;ZAXl<~A3Ze(^V5#lthu+r`P* zm!g89UzSXz|3me5c>0_5mahxQfkKkNKtpb!`Q2jV;pprC)Z2l=+Vk``JMEv&U3~1G zKP9tzQ#5|5OCXak{3e?{^>%l0ccS>hx)ejEQUCWm*xSy50)HC0_K!`)0|at#_odkH zPeYJt=YO*qyZAnLpeWfK<)xswMFDuMY#fliJ{xFd0zT>5_MghPGvFz@p89OS*|kv2 z{Uxhwfy*Ov_kxdcOP`&T)K$8MvmddlchULqqYXY8dd_Hmr~Ae|{$4Yy^X*Nh74W^@ zcK{N}i+S@Rv&@C5wZnj|%Y!=#7@xt#pQP*|!Y*8xpMN!zJe5D!i`(vy!u^eD2w3SK z>GSHw9NdzrxB1#X%8cfPR?5FOPi~#X{iEM_{YCEI=ks^A=>L9x@$!EgdowATeN{78 zo8L0EnhT(=C|hYXd5B^LUf7H2X(>z-bs14QD$ljG zAYAw>wm!$q`!6kr-G(}u)eqIZ6<`C&t79Evp+V-;N~wz3%%v|_M@p{(&__KjDZBt` zCzrKil1Y`91>raReqZ_=DM9lJZex53a@-ba$9~~d{&B{T;d@jj^%X-yGSFXe)_PE5 z&(&@b?!b(msfK;_P&RqhDzNa~x^Qk=3*H8SZBks>xLwrA%Kdzfirg_-zLCuB6XVEH ztmJ#})_`!FrwF=Z+>I;XX zRi6iil{?BSneZna;kVi>o}e?P#*kk`&i?Jrod(JhAiWW$&Yx8HknXg+IKPGR^eFaN z#by7ub^pFzjGBFrU>)jHbRmgY4e)jSd-Q;c5BVkd<*ux4Ce_TD|9C0*cs1+CwV&vx z7uo}+Q>yJ=wHKV#LOt%BK<4NCO*W8@MYt(BB)6*WVRN-}KD~xcPD0+K-?~O6M zOm**{0qK_*(zR08y)j-E=$Q%wXdb$8k`8;H!LKf=yr0x*)5htJ=YO{D^|5eQ1e;Im zv7`36@%XOEx007u)()<6X>2+AV?862KqoDW%hrkepZ zxMsRK&JA%CXK*8CcTDBpC`An53{po_4h$smC;aD5+G1BcCCObD|q!g4Hx6&7c@m++bFY|+e%V$FC-7E3NNf7$(Dtg zC;<*-^V&?bmRcPY~OYp_-MD%>aKDUBT^j^R!HeCWbMD`Xolja&Dk z50mBUkK$G}yHj=uI!Ie7iLu({8TE6&IP;(%3QT+M0!*^XF>k|-?cb`Kz>^AFg`m&# zV5_v(_LkGfcHS?zdo32uvB>DsWTZ(&Cp6+!M)j5*Wc|#i8$=DDYY!Cuso~QoU8~lP z+i?=Af?>Rnxk!-TtXFP3z6c+ze(F4FE1Gcg;~@TGg5z?Y`A0KIwsBj;xX;{GoeOlH zKpdtBVM9wdRxqUQvj4_+!2Gk0wWDt$;;vG7_#q%^v-U*r(4@)i#AG&M)ePCZp_h8G z0p4eO!YvHn8CuOWC`P1#!T?`Q*p6mvAv{&|qd5vOu6VTJQ7lN7Nzxq8_GxaH!EIl| zZ5XZ_4sZI&EyKNM2CEuWxz688l4FtfY_=-HGD`T|Q{K)Kk{{t<`sQg9m&)!iyf7vluEm)LwgJtxX|9O^ z4Btn0HJzJfKTsIes#)l0-M=-I?Lew*-V|DwQLoXW_%{u!S+du>Tl(xpCY?p0LNFRz z@7zUke3n$Il~T0P?Tz6jzE0B9Fbu_CsD}<>pHjG ziJIHh!u)m=#?0(PQjFMri=*dxi!DJq*z)e3ofAS?b0auGp`a!KHu~U0sl(2HP`>_XpL-iJSYy?$%w5upM01R&saHa&*zDg2sAcd5#pEMtx~nbrhbZL1fF*T(S6hcT&U8e6j=o-a{(e8--O z4hfd*G8Sovm@roq6d}0~4k^+F=%+z^hNi9*-#qQ#nMw*I8p4zoHxz%Z9YczRF>~P% zfz<4MSHiGQ@^i zbFs)VJ2M1{sM)Pqq-B_1LXHjTp^qYYGJJMZAX&w&&y(Yy1M>kRpuJyPP@9M`<)GG2 z_-TJ9m(HT(G|~_UYClp0Kjwx)FQ9~oM!Us)Cr{FLym#$SB$NTRH~c{%KhOb%CoJrD z0lgS$lcD{r5+w2B;B0nA1@ankWs-(wwEGHn8TR2gL9#$k9iQ`Ab2>rJs^t@JeP|CK zDbTv@u2K|zuo~Wdyyq{Bz6fLYS-n%N$P>H2+MQ-%BeiAr>HaRhG3={%7IXcxP<*gk zl*A_0fMR-a>ouHn=a#=jhmp96+{y@1zL68L4L*!Ybq|}hR z7V6rV)sQ7XhNuPV2w72;pMNU~9B&Mf8elT6e_vEKZiYAr#d^yt3!1?TQtWsgYEklp zDkEDwYjmj(x_JD9#rtEyAoq4$%@trnLuHzX&Bt%EJd1#xsxjpRrC-;vW)IPUQ*70m zpRQNwk9z&dPCD85oGrdV1=3Ay|`5 zZ`V8dYimJO*gvVs6=MCa(L;ErE2`*ikg7a%o;X|eFE`0QaM#k*Y(}+(5^Fc9HG5li z3gmQ*V+#kx_gCw6b8F}RSwGZ;usI90Tws^hJ?TkEy#pw#>IzpGX8)_8-it2@mS0na zK-Pr#MIupdWn0!^iuG^ffhyOQO(oO~Z+p#Gpz6I&WqRrk!5}m34j>FGUj)I<=Ks$y zGpRp+mECJ^qBBDJcL-7WvwyTvXdkc81s?(oZPG>)Ku9@SjDeHm-A(&PDmO8fuWDgM7`#y8l)pW?-~;_313 zoyMlqHemDEX(j9MU)0S*qTc=QP`c+>w^Gf+At}%YB~W**2mrlaq{ApCpuDsO+B*=6 zk^p@i$*OFLx^rW=%QDx3rXaSBdetYB&tCV44tverqRWZDaFvhS9s*YXgR#ci>Aq%4 z3jHq?uMF5Fg};aDAQ}@~9)H)|DK`Y1mR0ogjE;nJRG-?18Y+S*$EH8cQN4t7@lwMC z?g#!3fK7e+d2lNwg({A!X)(71LKySA5#Iz# z`&=9V(NuE-F@F5qL9dst`~BM7P1zq7ijr4Sr4bHz^2ZS#IOKQAy~v6Y#ZOfIS{*N1 zWf_M?J<60aXesduT6-;uL?V)1#(e26dVG9e1d`x$htyUwRtyj&ls}z{YHpAjHO8(7 z?HsOZ9^ApS&4t*f@+e>oV87|+>U5dm=7E*!2X~akKTew;F)3IBY?%u%5N&dPk)2ED z@ys^Q6BRQiX7vKAcn6wZ+v=XE*fpv?jb2|6VYTOVuIo4&$&#;kfW>(by~{V;%W3l} zUm1vWdAVS~wm6db^mJ{A4El_;2a8E}AXA%1)7F3sgTs?n!5u{bYr$fTk6+r zo){j%)%Odyk86@XGHQMiYSQe`R}1k3pR`eKV(`l`FR-MrwGpbm%y}~({gZih08P!ewd*ednipd4f%v+XM$_j&jR=ngrNR>D zjJqT=LYEk(iDj_PiAr^t>~{PK+irYq2-ZJ0>14_>c}}5tn0a}1;2<#Q z{$6&QNOE_cMKR+2qsX%gRfD?2mH9cEazXt&c)xI1*xc<4AQ&s>-u``}RHV*`2$(b` z+2T^CZFF(!@SgLV-~n#{zfqb-c+GS1h8h^j`Xa{BExec~{0fMnEsJa-`J&J8A5>1) z)pN!S#yBhtJp1{TshmLNG49hImKEAV%;$V*ryD~w(Cf=){JxrXdR%~uExLYP{;ptW z>iT{D$XWbLon}XAaGPU;8}|5#u*KM1(lZc2%s2JCBnpBd!Z7a%&iK^DE|2`q?M*2ccm-e3F#;Y(S{8j+xBy`ogbwPSURX7n9p0muRVvLeIEEnW5pRLzsyEnWP9?^YZ!F z23Xcw>WsYtQLT1V$8c6uF%4j7->3n0UllEF$^?7Md_jXHpWxT9Rwjna>d^l9%(SG6 zYfCm4TaAqoxY3@_L&Kc-pfa~~tVv2{{iWo}m1wOzvX%^w+$QBkziYaxxjy%g$z%05 zR#NTTi!01DJZdi0d}H&WDUMc(hU1e_GGe9V?%L3jj#izlgej+NN-fQbqF$f2jzl*; zU_>Qb6H-`}C7?68S}pW2F?_wsWe8_{l>VeAMMy!cFn?Tg0V09&HtwU0(xqZxJll*Y z)X*wV>)!;?*N?cVxq9vy(@kYn*2GcLPBvbGy*7PKda4>OOh(4?j*f**RdSpKjR(vS zp~SJ<^jwErfU>XM1hsUd@kNHrYF4jTW-0F8p_QXA=w` zI*Z~fk}L41Xagdv|L}{KDvVcHjE8gYMn#uem`pRIt=mF1AmRH^%u}owk9qk|$5M~t zxQhul@=xGgOd%?+4!mwa2v4S?Qi6GCK;7#e8JNXJJYb!4cQRs{bYdQGAl;WzF|2D8 z(!4yFK}g#-GW9j?W<(1M-<(2HqC5;yqJOWhp0MAKMq1yFMnyZ&A)(6{+KU zg_y=o{8g5AFuW$PEde6D4WRv|cZs;C*KCsQ7w=YG=&W+6cw~gQ<)@X>$1|m%jdO0CP5kM z_P1QYS!#sz5-!9>6%A!q8Cr#*eDv!ZEV1)x-%;7q%&kpDyf$EXv@y+@oZHvs>r~7U zgA30JUZ1P0BGCu9N9{)!xvjNmF`jN3bHmI_!#t|SCOYT558{4uZ(&t`2fDgD(sg)r#q4bq5xzUO9t*L=blS z%F-fiS|p;CGCbWCY%u{g{MvmMGc?o~BcjF^hkmk^Zl}p=XWCv8f6+xCCWhs=q!a;a zasCvI?_LBY2dslmDlp~YS|s#TJMy8 zL_|#Oq1^=cT_)c@T*O(HZP?zJzzHT{NMB>w#Pv9N+A2LW>VimNjWkw$rpuIquiqOjQL>KRWwWl1uV|ti{*~upgkTU{mb70lZSQb-nF+ zMq+q2T*&i zl@Q)VH*OoDl+<13znM&hZB@swYv~{VTAi|)_!g_WMXcvGQ}o&pfU?O~Y-p*u?9T;n ztPNOpuIl+*P4WKC9jyLFuC`EMfYBFWK+-h}LA(LNN!9Vc`Pb0=7KZxpW^~?nTYLLKljQhTfoDiF#>CLclAayp-`!R=14gl+sM>y`G}LF-8cDxdN^G+FV=hHHqmd z)1zz)o3llZ-2L0vQ|L`&oL%s{gTzeffm+=Oi;1>Qvd4N%`X!cFQh^q&yH&EGvz5+- zUG}zyZ-?bn;3utJ*MgnMYtIwpt@%D}K#l6R;grN4K5`-U;W zl?ap5t<$lY6(OBa|1`DYb9}ztA#gFzm$^Af+<=|nlD1>W(C7+NVA3(ucpJhd*sicW zG(MIYiK9S<-qreaB5S;)m1H~cBr3t85OPFieF{j8rBFTLHU(H;bgdu+2S**jJo$D< z4!EIk;V5~`H;zjigofQ;Wo0)@o2Cm#=r>;JPL?{1u+Q?Effql7YE3dv+oum+BSe$Q zO|z7DGoYeH*q$PzjWsqc)VTziA_v!>@~a+u7on3p+d}rX3+LR{M{+LKrpkG(cgfrK z=ALu=l5$T$#v%49u;0iHpy{>QXuld9^Qdy{guMq#Q1|#gYrS-?dNXTD>ZV6^Cx`WI zNpLm=%8;YTJ_D=RdcG>sC3d0p%wp-g%fHo`-`f29{0m6j-=On&AT4cXrWhpD5#8 zj5;^_XD7|qP6ykzDK+FKwfQ)KS0)SqEq=4zDwGs2uGVOaxbpuO?I|w$bnu$NHyWmm z;Xz>1RtLkrgNutxri9B!5!<%)I*_}26ZhT6Lu zl|zceewVDgup>YpM06}UM^>QF<(jI(wbJo%%Fdh{e^5sLB@o$TQf1ZjG5nN>30l8z zSHvwBe$rZ``^F?DKBtZp$$&4nC26|2aISiI^bZ#zv{4-lN)>`;l`9*KbEA5PN-iCp z=VraS*n4|=Ol@p(Z-@Tt`O8wYV{5qo_Qy0hsbOblXS^A_cD2!eV@eWqf<`d1pnzAd zTq!dyO%gCJ$#)#cEZ2e**MX)@ty}zb0s{k&ekJSe?TyWXmvj8F4b$#M1DW-E-CT(K z^A-O_;M2$6#ED+I`TX?cB{j!zI#A?_nFSN`l_;H{WrewtKXtg-cxZc%-j#bf0RPRPrC~@Cq{>#gt zS59@#x&N&wc9G`Vc%94ZOlc2yjTT8al<{%9G}Db6<|}^SH59T8 zc{=`*l0TC}+L|!qlfZ-6(M%-%>qnnWT4J%qaR3;EEv?kl)*fE$gXEyB;oc_bN^2h* zKYUrG4g6<4Jh;p>HP4ni6t{4Q<{*4o7wP!;c)V4Wc5!jBY2#n<;~`*X>kAQ1m@6-CQGms(b2)_=`5jghGKlu{{)?&<6kBf%cs{*tAWJhTGbx*y#?zDZ zQt{a@4U-acWyC2d`C{nDRKy+&Cpj*3e-$|oS!gIM zEOgtLZWLV$qqsNxfBTVOPJ_Rvp!o-WxH)U7n>f=oF`a+!0{mNxnKF0LHF}B{1Bs%d zsbFSz*#V9+LzMM@%`a$w@2lgK-Gz?>(jezuz$UqZ&Rrh={eo+Mhg|EMOy>*#BFN4W6AY?O(YxkYkCO^%VEmw9?6x zFo1~KimX-srx}VbIv=c10n!=TERx=@+76dkiM4~)&CWZ&%#5477sb|Z{^g^H67;`` z+g%z&rc9W_PL^4q>q*ZrO5`5f@dT#Jk!R~9@AOzbX^$MaAfI8}Z<)(Y2Y~yAlA>)7Op~C`d&yxFN%o&p zsdbiurj^FXG7|@}jBy-8C=-&aw{2+Ltax>j!$9}zPg=)Mez-{(VGfg@LRlI#|CM_D zb}L-!d4MfHwc$peDa>lM-h-?x7V)6Eu^Nst()%<~+oif3;faljJOeIub1a70o1>#0IqFsguQYpRhiuYfhO%kkfi^t%?vLA)buxR^42}=Am-b`RyyQ6@}wt;hvo%c zm8a2v%j*wi3@bGUXZv%fi8K+O^I5OEsn zM64x092&T!MI7Qu2ArP!#024yF8dC2tWx6(ajb$0Bs(f9sz8MV4uzlzv{|LqWT{ev z9YY{loZY=tka0VC-ZJsS5Ft{Az<{XT48y85n`x3Ayuyul*tRf?H@hTMt^mU1hNK`aI z+If%+GRk?WhKHfX#te;My;sq$9nl0@;g?r0>;DONLnPu(Kg4yeHSoi7z>jt+=w04& zm4M(za6AJe+vK1fS${!btZ^|ou43|68(Yi0QxYy5?2l}jRpT~>0ZkCZS==7d%xU8# zp}kT|U;lk3sWKyX;|i1vWCH}}fAEwRE;u_GMK$5^?f#Pr?`r{#4$7wl#Hp}^{^ncq z0{pgZvhn_o1!{2|f?^c5bH1CSs>!?v!}VK-WZ1q<{cdAQZi3wwZOwNXvoX;a`Bb*ZRrTLst+9YiN0=ZKp24L))S z-TLas&BHSRfkL6Hkqiyx(_?z9LAkTJVL&o8D;X3g+->*2Qcu^1PD>Go8e%S!JMxlE zASX4Gkz=`o3vY(?g>BpV$*;AMy-|*wpGNJt#VK~(3|JdbGZr}25Kf-|EQjlZGBUnD z20iBAPwf%Q(B5AxH?16}WKhhHrei(wrDG%hsr`~gYRvRDa#gE6=Vw-7Rr*_oy*H-1 zYhd3PS{T{p6jcp|Ibil5chZnHJUk}C{e%!d&248)BY61u zGi`nWXI`ciK%|7qCmEK?B%&R8*FDP=(dwAjS(n-m%bap0*x*>R(k-K5}kCnd(NQ>T2n)xOC;c^~x z(*TKpG>nRc64r%zS4%QOOsw-1uFbdYASN?wcCtkjmABx9N!M&wK+=F6xVaFaF#s<7Lqz>C!5njbG}wpw<+>(w2gII8-A}h|! zN6Y5zf@*ja6$m40pu^UW5prNNBgp5L#s+y2L}oF=i3>_g$z&vL+3kQWMASXp!)6kw zNUCT^`^+8=-|>b&3)hwLUC}@6C07OBHo-q`9vundXVRD3Hp2~jsoyu|T zeX(q&mI~#;(<{L++W=jfxJ_gx%0I|jsibrE=!1IwRq*mKkteDT74NlicF{yFq$C=) z>a%vf%HWbqCM()n9P43-62DE~=Tqn9buCW9GW=3{m7S=30ZRjNDUPK!ps+6{nP!Sn z9C+K?|7qU?)$E%qJNn!zwC!o-`_UO#(+-E2y+c=p5E!Xz&Yj^-|CD@Xiz8dz$%L5N z8}XLX%n=ZItx^(wI6>oSdeCU=naIuWreAFlr;&R{)5}QwM)or*O!&<(ls_}H_&myN zoYZJ-d(Ac+dZjNMrH7uRB&T_r=piLR)ztbzEtA=eTG#nE9+KZ)%m?qEh?ivZEittG}}NHag;qHIslY5o=4U zyU3t`BA(|OHRpbfEtliByy(vaxqWHfyt9!v*?r>kI3y?HOWPF?qmco0H+ILkSUp^( zV04|()u95}nK$LMhGCW%pfw+?kdAv0n z35>loWcsbeX>TH3o$04-KW#Du+JsxeZf;=?w!-a(enT`gEEV6<#rb~CshZ6vK4qb} zg&}*i+xFoSQ3wBG{+BA9A(d)2q5{5bqH(@uWYc))sehSMpa;P|Z8N}3Gn1|4x>`L= z%9kjv;FKx<{HtzSR|KWY8E&>Atd`<3>u~pVN)SkygOfwqI0?PsBIf6utgb5=9J}@4 z?W`$hn~zRs?`8U8yArO!t??g@tvu6hyUrmP4RJmd9$l za@MCU;*Dn>PL?s{qoc>`&S8?h`Ijc4{HY&)=$EaQGl6%o zlmgK&v7w#`^uHJ@rsYM97aG&8_j`sTs`Z668jpR+6R4-Btq+$0<&kIC(dpt7-&$Q~ zQhgfY5HKYa+SVZzRlgiy72~&{(187hm%q5r-pO@lf^)|RE(G%f>n~evm!OT7Q{#|M^eEiVx;UrzljuC_2_aC#B&twNGww@I?wo9< zZ-kNc!+FB-A>=?;-ETc{RUJb(*zV^5J+OI4NN4TYKb1gJqf~o(j5iJ<5cO~FkG|tu zM#H&RY}9FU8n$=Br`Gh#l>M_Vp2P;UHQS&Wut$FJVpVCQUhcA}`QW#C5&?rwnti)J z+HWxWLb?N}^-*DMA8}h6H zTGxc3w5BJlhfPkBdHtj84Susz+n&eRu%nnA{Ler@b7AwC_9ih!khzX9b}{yOa4}H+ zDDuwrlM)q$Uuly$8v(*5%6+-z>vQ9W&+*m)fHx>kuBlmA_oIXjAZ6S9@_m_Q#*kO>$(KOzdK8++KId47X6Tr?Egt5n|A4nu;+j3PBO@_s~G6@Z` z2SX;N?Jba$l~p_yBSfLkEQzHQgc*;x^n_~V%|1-R&c95=SGc>drP`qhRsYW5S@m59 z=Z%b)Q+e`ZwPH@6I@Q7G2scJmlLv3HwC z*Z04X^s%^~Rfl1D(N^uyM*rDQBA{@ex6wyX(&uYOsNoR@%!pI?Qd-J7{`v$IRF{@? z2us<2Ge(7kEEg8DG)Iqfjz^vuMfu2#dbsf|&(QS9tLXex1EPcZ<&u-jLaB+)U-~~1 z?*fjbj7rN2&WI42ry{|Hkr_uoM~B=rU_D~Up^IqT0PK}VOh8)+m@SCS?tg%z+axinc}zabuQfjOiwesr z_)4odHXp~F>Z7i@$aZ1~sH6!;bKCyNI|eFg(~mMF<4o5BwZ62t$0NpSYlsN{DM7Cx znK+Xd;H+ERlHFzpbwcd5l|yskYW}UnPib_t0ux1@+(__5=f*+DSxI~I_qvVcPiSuF zk^5SdS`l%;4ULUsQ;`kLg;;;S+Mu?j&sMxzUyl5^bsDUx!yVczFF%3UGc-$wRn7zB zdYVd^z|}gj=L1wApz>rnZo<4!?N=mX^wK6v?(v# z(mV>P6-P4__AlkQ4osD%YF$5mIa}(AY)i#QhH}Mu9#>lzq)yeP3})ju20jDPiMpJQ zEK&HH^N-l;-Wh!CxL*d28+nyhI_3Xu_rBQN+vI1@*rw?88_x_bFMb0qgtedVx~1_o z@aAY2%dABEcBGl79Nw?Ha4)q0kEyfMeyEl@P z#U9TN4WMhBDjUy2jk$c^)IO_Sx6Q&1=@ULTY5GhKdWRn!Kf~H9Ay*9?zSmcWv#;$5 z=0O4-NiUT0U(W-NLKrNdn-=RF>dyk$ES^qxh_$y9SLmiMyt`DqAvFCU0qfaUSf9Y- z#ZLP1^zNGv1;Afo&!8(;?l3pJ^HD15yTCc^e51?l`OS=F>85E2<(??S5G0*!5;HRK z-L)Z{S0DoH?~Gpc;WE~6#a#sIE{xGyn=Y~GWUl$dCO9;YZ>88rX+}KlEmBVu#}yry z;uFYO2gk`GY(KZ=UH7T`YE4JvE80~Rj>iC1?jLb9@c6HulwtZ0cXBET1w{Gvw&i`jHV#W(^p1{IC)&U7dh78lJ4w9;kePiPa zjV+>m2g;K$oX~{`>Ce;rT+ONpElk8!)eQyy`jT*E!F?-}bsuG2$)TLa8ev$z14!#g zEmRq>_6d)B)X+`Zk8K-=0Daq@-L@nFt%Fb_DvIp8!DO73y;k!#ujXA|=8mPJKguI1rOmf<^gjzRm)T5c&A)3Y*BumJq&REdbeD%+2tYT0ZjgxX=CLX z`pMoix*MN$<Te`%uOSrsI*V?5s!{cs~;}r`rh!NV?Z0!M>3-4w9 zWE)guXxT8<7j>?QZnYpLXa>%HG!y&~@Mt7$xfF5~BK*EJzQVJ2vmV(#G+D82@PUQ% zQxEs>XDd(zm#WBfavb~d0a$FB_T^*fWJo>U+z!ohtLF51mi~m-tJjGIz)t=VP2 zz{Z3NeL{!!Wp2@~9wD*&3=m1X$(^}zIYm{X(^T4b7a#GiEApk8R~+~)?mgO^4uE^K zm3ijna>$uZI|cWIG*ZpFB_R7YJSHA1EY3Cm_@EoUyk0*53+Ii2Lq51a4X&sXhnU4_ z-D(@zQpLhM_Zv}Z!dX9$-=kevr$!$Zgy|;-L7b4Yqk@0#XtSCFDZ!xYD%3Y_COxm4on5S85?3TVs-+6E=dy z8ckUvM$(88jc@itooOud54A^IFtDU)Yd+aAf1; zT{scldHmHIAxb6Y!^X*YuyQ=4S?7QcPK2Mn+e~*Pzx9=NeW#mv*xgVNOtH3*iBp=7M*A=erSVBu?Z&-& z>NFvtzL<%Kpc=ImcAPn3Y9Fj{M#ApMxwH#J!w5X8?Pl?nj$inb&#cJ}$Gkga1I>u5 zj9vmK&>H9C%ZUI0Z;RkP_t#RHZYv*xp)eUI>wSgtPmZfK!J!Oj+lktlt}vMr6LnZh zsWwFWVITFZY%|8qbW&Q@N572pXDc+E5a$GM-i@18mU0E;h$n0E9n5CwF z0B}h$qS(Jx#n!rke=~HqU&)`J2LAgGKDXOBEKqJ>xeUpIh|oJVb)eS+FDd2Ldm%iB)qAUTPggWPMNlQ13PR zYMcJ$JUQ;=SJjD3Zc8^OT%W=Ovy|#-3nuif<5W@9R8;6bhgZ40xg75&Fw`L%#R&}R zmst3hk7a#Nl+qVHD*L2{IzPX&-y5jn+$b>1^&Sd2g_6HTqb^%f0WbAchiD{Kt}F{e zgI+xQ%#(=U{K69Av7g*5+Ly9uwkij*-cQw)5GSV|iQDw~@+E}VidhGrrhjTSZgGZT zjEw?@T<1PDa4+6vM=}R#sC2}YcKAD2L9MiZN+eG=e}glRe^OsPAryvGqg<+NREv2n z#m8V^;>(@yK(S74Et4e4a#!-E&)f}ozR?I5*$2K=oLWcT5pH~MqMiC&`JttufA(2; zK+o`;q#-UqkMlV!W2xsR%awJz&-te8Yca#_n`fS?961x`roSbkN1XH`h|Uo|eQy0lN^{4>U((9`O1N zmh?v5Uu!;I{+7(_JP*L1!^mhcDc`@JM*PWN-p|s{a#;wVR%a08`brv^^mBdQ$j@bj zMS-=z)IbFpq$8-aCFK-BS-iHG5B%ik%4Fu7SGjyfO&JB-@b8#65Vpb9aIZAgp2L&i zUJUKcpbt~^tyRKg@bt2TU=)L+(~L6Yq3o+SpWtwS(B`E1D3`ySo`AF z)QKxhFl70*oJ7cTUS#j27cJGSwYrBa0%5u)Yeaa|$xRNEaTNyRBt`y!JKJMJqjn58IC1l%lzhRBW~0_8{wtNX zi>`;38ApVw&0+F=iD6)XM8F9(cXm~Nw>mDR>{K%@wF=H_E!~_C&(n;<2}8bb#eO9p zx6n&YZb*(zo4i*fjeLlQ$E))JijH}1=s}BU+C=K<6sv|;=oi(=i!n4 zH)cd-c>&9Z@X>R-8akRa%oC_ig1ROsXqs0~XL`kINC9N$KQMeQYU=Fns+(lTDt-s|T4|)P`XdAiwSa1gQFc#Vwnq4$qm1mKK@vPwXc+3i2jTO6^;CfhEK3ZzTl5r5X zN$*j{oy+kqxMvO_B1!(T+b_nAgep7s!=E;GpS2gCqxK#&*_T<~kS<%~vHunN={$yW z<|MNSzMbiZY;Gb$(ieR#!8J6QTn<>`)%5B69i*$UdR(mJszBq(MtO?{ae?>%F%+h`SbAm8a`)%n4SVzRcm?CAI!sI4N`49m3pE_U|$M*$;6uhOKD}``%ccH+Szz zoL(th^TgqD4bbODd8ehY-Az{|jM>i3_A!Ylz1aETowhW1q$ysDF!N71?PEOJIGdo-)bvVH=xO$?m@7?ZKF^1 zh-aX$`&dcIqL&hQ>n<7x(G|L4Zy|E|FIZ`H?5*y#w;VyIAB$LKHm-xp`Pv;m&a9J` z+IhWTHb!=G)k>#xuDlL5*rM3RRn8iw{<4i-%{=(Q>?An7X8$Ci%;jWM2;a{vf zgS|9Cle&5VJzv5;h6+MEVc<-A6E~FRKEOnHy<-j5;Zf|CkAph8`i}M8_vQnCQU@ud zdabr-P!9Swa&{OhHNK~?+|qE{>iFzW`8(27&lwb-Sw(QBQHKpe z*<+t@B7Z)$21MjmUegTAT209SVnbRzRBO*;i6CB4%Ymd|$O z2Uq8ox#&OO3T<FFOwFJPWbM=CE<^EJqhsw!0MUEdSW zURdFxPD{LpCd}CkSDtamX{|kHd`%(cn?RBtgT}jO?Ci`-eHt>f1cI_wpaiQ2Zj$?t zH%+xk#De?I&1!WosPM0qysAz*^;nNSkD+OX$SvN^WBekTBe{}$+?~S`u&!RZl)xgt zoBSvml9v10&%b=o-ALIY5o_W*b$hqTacxQ#CSKMuT&UcTL*A=!Mjvk3B9HvtEbu-T z^Ble18rMUs@GZO0^Zs($QrMErDXGsTTeFj~m9|F0LFf1ZJbg_XNyjM?6|r~Nc+5;l z4@p~AgKIf{)g&y+Kj2nR#2T0tB_0no&=QUxZ#v!6b#m|M}2O_HDOw;1cVJO zH^*)Y(3V3VYczcH|Mui;QK zN3ivBFllTsXw1y@%*>6aGF?C&$K+dQ)2%Pn6dw9L72F;w@Y|=BXe4sS!kgl!9D)t+sP5D_?L(`AZ zGxj*(>w^ONhzTj2_!?Tdw--J^1O7Y{8`tsCPM$txrt-~N;!?LY?cy!L3Rf%3J zI!o`xW`c}IYa}g$VpLu@K56n?ApXJDjQgcPJ8revbUqm(DN0(F!TlVO;!>MIv-jBf zCs8n6p=3tdr#v2172y|avZ80$egv*k*fb?_&8E(NOU>f=S{^_XXez6yrttZ)`8K1J zqVrDXDU@>JVDhnxuKmkZLro*+ ze}K~8uq*h+tlKvF?R;ikP_ednYPS205AXcEr}WE?QW#Y#^>9eVRZf#er4@I@CV}e9 z9?O@M_hV7UJTQW;oBA3rws@<3K778ObtvnNC_M7(q`^VcWkyoQ-lsKbBHgbaGT$bLEoge=)9kB7`wEy# zPMDk2WUXrOR9Oh6)JM=RC!6i*1*!8iLrfnce?eJY%B*Gvt=kpuX#YA&>G?L9He~xl zrwOG?MA09Z4dg~Xy7`0uu6*$~8YfGwH$!dlE8@=?gT}c!=-)cIAD%x(Ni2TYl3S{$ zO!r;bMQ@!Pp)gNHG*!iK{e+~)>FUaL?(p$ldSj+3f6}XxTDe zVF*}$EFQ5G^{fYqyS#2c96CHiy?`Ckx&H1mvsp5GN=?nB&$NgW*j0pk-$}p4WVoQ{ z@lm6V-`b{Z{It|<-8bb+N?m}ybulG(x8-NA;H31%j-VEy%CEDLLIgU|Hb=dB}{4Vok#}@-@Tb>$}bfCEamF= zqb+EfX@PPVcsybstw)YNUcP2~)D;(BWe^ZF_UJey>OF1fos;*w^w&%B#Q5PYlIBje z|A(`;fU0W!qDK!QA}NBXNGKpB-Hm{PNJ$7tm(txWq5@JX(hW*TiF9{KOE=OT(*4%C z-s`=;_uhE_G2R{ykaPCgdw;cJ&bhv`)-e@$dB|kEiYvlmMFYiolRh-ImT=2Ac6#q( zb5x^$>v%!vVrOjti$|bZ z9xnElW2baU;#rBT?}+eT&dqUqj)SU2j;SAW6nVF8%mrSq?+MH@@?+m2^Q()&#Az#oNzN&jTEe+{QPaiF+dW;-Hg;VZGoU3`ggwdpBbPO~g~BDG`p=^iIi z`;YuION=(jN_7es{iR3gtLSMNzq%`}6Yh4DG7_7cdelEQoZ~Ce?G@Sd%_Xm;6^rt= z+f>Kfd^ut-7dWs$$F~t*s}nP}{i1NvEk%WB#-ew!m243`|Fe?M22NRdwze-mg{6OR z@cOdj<@eZeLT&?kQEo&in~UQv9##>-VFq)wA_$SQSJPEzyj!cRyk~CfH;uK+{1T1o zx7sxLwlEP>SZ7Cj)$avN5ss%7$Fru@_9ZxGtnIFNPbn#FAI+uGoe*!>KMEe?E<(Ra z;f}S~*IJd%#7xFqU-I&NNK?e@2yN)Ha=^1;4CSNmTZ3~vk`+eWdlDb|2{!Kcad&jD z3;70!P%M@0u*+pOdoNfjj4&*}&~S_6-*7|QC|+M4m3Am`ON@J3D0@=Av*CP>eXCDm zb6iD>d%q_*(M@Ay)F6)kwHyA#>yU)9i$2!48`axa&xGtyuV@`Gw4^0?en;Mi4?_;C zUWfK)Q+?J2*@)b_b%bL`dH3XlP%6;cI`D+WByWyt@kms$FRpWA$l*5g?EMNyso51C zieB|zJ|T?!w$6dL*VpxC`uzFc#dY28xbzvpr0B_hvXuM9FW!ZoUBDQ3W4D=gs}<>X zJEFqeXi2PJiFkjmEhJf1+)U8a&eB@=exfaX$2V7zZ;A z`LV;V{roH|i{|Aw3b=>9v&gS^%*Z)U>=I7dTpVD&)O;nj-fjV9Y;K8en4IA0wgE@g z@tI`voZ!0Hxu=t(r<)(Y_#s9`q7Gfhcuv*(fsT$J9q(6g{SNLt-#@z;tlF>Nj<_%~ zF6*^KBD}ZgyPt5q2KsK?OXTcGe_`W|w-e>EW>V6@^U4|hmkqo7j@lZlwhJdKMYypf z!Ax4?n3R;squN$D2|~p6D2V-;pyToqzWd|D5er*2<*K9+H>b?`+k&lS&m1VRQN&+d zO)VYmiMFb0>z(MyX4f5~a{iPOhK^Hr)U4SB}CJq_YAQ>i!Rbab%$b9Fzz z*!ghpeWf%x(cD4t+`*Khq9Ua|J=W`Ad4%!!$A5Tb)2YnD|v;ymF_Frh<%~^sKCVb-$iHejSp}_e(3SSFdyRDY3&% z91LojoR@NGp&z?`7{B}6<2TyW%u;tv$Nl!Y##LcCO{!dce{}X>rbC7I?gzH z?^8(%zbP)}A;P)<|0*ggZDw1Vx!aHrafgPIjsDWeH^T1lxO+8;2t&h9(x~+tRpo?j z;Y_|otLVhcntpZl53X~Wa&lV@V_6JeN>^scbf}Jvep|4EW85Z}crauWNX}Iz+uZwD zC*)eZm)w}s&!3bZ!^0n;P9fgKhhre7*^F!RH8G=P22x#r{NQNt zXq&U8rn!?;P@sI}o%T0FdVPZhe-W0qAr}$KPoDU;Q)FzMTn=^VI>#)#Y6XY%FSW{pKyH3GIzCF`N zOw|`Rx3Iy2vEKO1)6-ZKo8;zAiz0bwH!Iy`E-qJ_D3e4|YxmWpq$ErntOl5s`lckc zv88tJ6TC3(o_BqF7-8@wFONXjmg3c`R}aIX#mGJyS=jI@zCKI)XC;(rjra89vO4IV zdlFFyy){uv$K3S3^O_$?Ju}B z;~~rjbLzLds$YC+xc@2bv;SNe6h^~ZEKp~Hh9y0wdsnDu5HpE&>(Bit>5DH_z$}Hi zq`w`WO-wHjljD6p%S8;ITFMUT%_-fFA3xrrc`gy7RKqJx6RNj1;_x_ghMKP}21nM| z*!Z$fzeEaw!?l&mtaLS&9&>ZF1VlvWuf_E8Wh^Y1c3g$RnKUf(1M{1iBiiz)1a87K zBc6N0aP@5nnWTgS|Mxa|b@T}j504&0W3eYs!e+}b2h9|fKaLyR*&isjn#{38{b%eH zLT0!#p1%^Dnx~gV9GBMB*ELPeE+kNioWCn+*Jai1iWhR+H)0A4;ER*<4Z*_7${|$D zo}FDKlHnvk8*%1rU4CXTkMaI?tJ4mZwT**X%t)t5!s`ok%`oGN??z|F?AsQ(fcD2i^7QG-f5ah z<(+}d*7p0U5>!Pt3hsiYJ6wLzoCGkc2z6R1E|_s44+4mPZZ(r%wfo8<|M2TW{Oyx% zmRoQ;<)1T`xlAY#xA^!P*B?3>1q1FWc{~pZt zlBzt3v`P$NEu9l4#ep(3^&^EVmI?uXEUI66z60;3r%9*1YJrcRrtXyY%l}M-9*dBS z=l`DTr|Ac-`QPIjGMN8!w7k}YRK`w*aGXEZ!26$rF=lzDyj8zG2T# z1~1g=vOWxV+9~(RtZv(}=a0h!6Y^3e)53`i7Lee=_{YuS*PA@A4u1uYU0eUYV?|Tu z09OJx7T{IS92`>Yd`39l$^Xpu2_>bIvbJ`xRn;K|8ynl^rgfKRbB9Ke*k?tl@a#u2 ztH}eGp+OGvaM|>##~!1eA^cyxMD+EaPpR4DH9ARaw0Au<@~dd#6!PPt_@G*YuZ4JGIf;aX4=$e*={~q7bB9#3TLs&?}{P=`uw%rcq~XZ8TS=g8NQ7^;&`n z1K#$>7whqz$zQ%;K|5FtTQ1{JaFc=+y|dC0V$>1c@4OP?^)Z$sTgB}CM6>pzOSi+i zB`;h!u^eiA6&wM2bD6hq#bC*g+lv-ett`yV>7O1ssO3NBns1MP9T;dI;MNfPZo1{f z&Txg}7gAL6kSJ>}u9UlG05PBLB zk zMf#qDwYOJ4*gY3kS2&o+2v!Oh&6w$PKHVK`C_5bQ7Q!TBfys9J_U#h)!*3lm#@gD< zj~+d0=!)T&V=8^#C>f$Z{B4eR^X%e7Ik`Nykn2Gb=Hq1-OqOm;PZFJ-ojHn#&+n(n zrPY^iFR;4&B7z1QvvbIv;kDL49b3aUUp(>#7Ec0$9^%i6{!WvluhTD5G)#E#sg*mD zkw*(Y{YC++%Wk1d50vH1Li@!x;j~YmCjH4sQ^^F2;<@U6y%0s2{skdsMQk*~Qu>Ni z*X(+WdoX^s%3a5Im~on^agJgOzK4QW=E#@0$)CXIo?3y)ka+EsBFC814W+dn~p*d0msIAOjj~Rv}ITA-ueh- z!rtm+wA$ybp=o|DKfMQzKV_SUzv}v=$=v+zw)m>&oA!;aU%x`H3!C%K+PavP#qt&& z#A4#&zK)29P;+c*kD8to4aS^%bzBY8ePUwb0}*|nFhdv?OkTgh!25ll{HJ3sz{mv! z1;LbJCvI#GXcHF~C%8^Tw?w)|55qSF>ka}4g)6JU;PYX8Te?K3g;iy8TOqtf-1~8; zx3cEeizkQ-&}JG`7UKA_RRa1x8m^8<7}%Y6I`&Os#cGE6m3;=oFaxDLv=GR=^zmUD zaB5Bz(Dkr=qG4*f!)w2J3y(~Y?rD`_>ksY?)$4q^>Z*@S8Q|O>KYrwy&h@5eXIm&8 zBfYJ8&yxN0J~l!hA@f=BHsnFDe#Mg>-!iM0h?vFZ#@~c$-C^933;33&p2HB^Pp3$- zS(p|Wp2CdL<0K)&$g(PgE>js5a38YHdL(mSHi#T7<;a+&*=VaFyR(~HN>UO^RaF(U ziHHL-Ov-i;ElcsdXPCpo6#*+QxUI#>m4_ICVF@~~WQ!!9 zjk==aV7+TV31@uDAXjBEQp#lS7slRs!fsd*etA_UnpIM#kCS4fu)T*O|gr7fMk z4kp(i+tngyTYUdl-ZiN0adpyN$!Ad83oSlA{$Pe;@>NwC$$6z?Tt7J><+8S*pdiff ztybEEsU%EH?Dw+>J=S;~x%(BdW8>E#$Jk)MfWC%l=pbvfAw`r&bkV7^i zme%_-yZFoxY|4dFO+2t7A3qw}RIvOZ{nyR+v z6*e{wYA*`R$=yuw4WhD9GH(d*18dq$OjHDl%_|?6h5QZ03ujKf8c?MpcV(*8Q z+r%hyKp4DaV&cr8#}^$Pt*Py`F;Ur*n{Z7~aBTjaf4UDWkgaZU{GXxn!lDiiTrWmx z7x4;$#~7HH);8}d!H2=V5T6^fU&n#k%L@n_eWt|S0DIlXy3HiA5JMCTZ4-om+0;MV zhqR^P(A3?-BRkm9EEkD_q`X80KdB!0o$yCDB74&7k+d`$_yRg2EX`8e3x|iknghX| zl!4To_;d_JSZvK6U-&zwQj@_&as~Rel>N)ns7jo4&_JB#C)4%Fe!a& z%me`hRc?E$1YX1vbOJ{>m-gi$>Y*;|`;<-xo<@sXG*>aBVNt%Kg>fOgW;i|RhU6-;_KWI6oi4F)`G zqh6d?vp;L@t4%9NA@!rb6`BnqAqoVeZGKD@nV#HYfgMlr10r>r(4Y8T&IDE!hpBDa z-U5e*3kRq9U5OPHV|R856pkY?Cb6-xtzr@dy7`l*<_b6=HPeVAsAAfciQ&eDOdVh# zGY_Fni5KHtUGiBXra$fjM#0{X!~h)pSeI2==wrYiw4bl9EYNz=MsahI1YBb=QT-AH zRyz?82zI_0v7~!m6clW}kV2(M1RTrCN;ScheAhMyPR04`@Y=h47D@K^F#>Y4PLQW( zHq)SM+u80RK@g>s_oQ7*y=k{YTeIRhyfvANhjKoBYA|(0T_#DBixUf~YFd7{{`D){ zLDmk3J46Z}=ETU2dQUp{Xl@rcg|ry5D=UALUJrq64NpW|>|#w+uMstwKKOuT-a^CV z=aP21mt@YX*v6kLDicAf0BeCa%ZHTXR71h}IW5f{e-p7RA+uRqz7L^FkDc=5G;@9@ zmoARGuZ(P+o^z6H9j)YoOZ^KasH+o`ioFd9^g({D?h8P9GInJ5_~pzUCZb}9uD)i9 z;R!gtW?LWQI93|^4@T~&`QweWU8=MvxpU(01j?OjxRga|eo4>W-F;-7Ms?s>+wlfP z&E1tjDzkcwKr(^Oxm`lOneVvm6T?zN09*guk}g#wPmdS{(fGYX>@YW zgP)_6zXN^?gJ^B}>koA;ZV>FsK+?d+cRZvw+jJmPRfvS*1o1hZcQ%ZlIn9h7Sv7XO zWlb^}coRg&BI3_db$|**sssz658=xIz)}aSfOid8#_s>{kxdM1^!s-#o8fsT4FVDp zhA5{_m30@hHR3&%EROS7BNI+ca#F_d(kE}2F26kHc^brHb9TbF>bfC>sQK_& zn&27_MWx$5212vM8fD|;u#4C8h8=S(%vBMsXN@wHQ4YbEEnU zTfZu8uI5)aYsJUYF`i($o$v9uAI?Q=?(Kog&%a#l%qA!#v^A2Mo18c$j;Q$(b{FLy zP7M@)p4XLctT!}2c!2cw>(%F;jG6~@srMyQoHizmO-<{tyF`3Z&@gm|Hh&(h=$yTj zB=>I=NRyNQM+@+SHvS$2oyaU^an}|7!iAqs)ovK?32DZ@E6Md)T)22qBhD}kY4b5( z@YZ!seEM>~kK-Mx|q9D_cvb{KQj<~mSg0FpAvH3$fvypEaUF^$s@4|b< z5Z2&@DvPJS;-lpMVHx)5S&vC?kINQ+T{har%Z`nc8wv{e(@{nVjq6(Fn|rCU*9Dzf zX=Dy=AZz8R&#SqNO^@*81-GbCiBN{h_pNxn&II4!k(uUqzQh-4$jq&JsaO97=}jJZ zC7dDWhi9258EjP{-kNqNl4m0V^D%m2Ru)dV)0!Adi1x#W&RErFx#xA`PLo07qgGqR)u&gfB;QPfaXUCZMnjOh8nYu3KYzY( z&cgRJ*3V(K6>TJ{1f<`zvj*Uq*sWljvMa& zxRVG%cXi0-q1>6*Q1v-QB&==iN>>!b8+?l3A(w4y*d=A!m%_8=buNo;O^vs+^N~F` znEUqwo8?7L`}k--{%$vSk}^Z%d)N7P$pr$1u6zczJZZ^_58DSasqv{A=o8{^Ui+b# z>6EgpR~=hwR=QplIoU+(^mHMve}h}^cai*Z+y2HRg*XO&EzhJ{mz~Gbk2}h$s-PO4 z)9)TvmX^k5U|@LczC*`w_wH5)&tzg!5;>J*aKR0nYS&$cD&E}-O@TLjrlx8?6bZ6U zqYx2$zM}C#`E@h29PdW*D}de+Q#s}9bsraviLOyJhRQQG!hhQn&NCflDgOi1m=^QP zyE-iZ$hzo<4055jUi$j_^74=05IN}%1OQcZ-sJQuY*f?UY*+0?JgAW~<4>FLg61xE zXqt?TLS}Zr+qclamA(%Grni>PPbuQv_380EH&I|S9e#)E|J+J_oPU!!wAH#xXn$%Y zxB5+0nYyO7j!p=Nk=*E*Wp^S1hnyX~IfSCQ|E?<6s3=3&NV22>{dFPG(%xlEV?nG}97hsc=*E_I$4i60gw_Joh zRfw71HWyEN24rg#-E!X46|9^#LA>kZaUA1C8db=S0sz>_I}1}~wVi!fu{9qvlxHBo z85LFHdCFf`SGPH`l1n8xw%0xk*1t(;f6V9nG~xV#xVR8(UxRcC+g`hO$6OZTa)k8$ zodSIsu276$a)+P4Z2YQbG>6u&?HaTTi@QJQw-z#6V{d&-&(}P3$eK0Et)54L%puE( zKdMZU0Ku|x7WaesA51fO^ofFk!hYx0e*s6!>(2kO29&n9G5*5={+}Sx|NUr^Kv@~e z{aM$9a1~z0?Y2^s;>0_Dnovvu7jCiOba%_hjJfyE%YAwP{k$LDEO*oW4`Q0`Bj+GD zRr$=r*hpFW{_~v3(=mYXnN2SK8N~61)+hf`m42Enb5s*79Z~Dc4F7qx3^(|HnYqNrGXR)(41?D9&fhO3$0yc%?|Waw((J+e=PaOP$-VjhfAqNifd)`-Yc*p~YG%wF`)|0m4sbrmU@gMi zei*xIvhuO84F0tFmlEAYx4i0n@x>kKa50F2A;YH=)O-c$Gx=5b{q6l`Cs|oYq6^C= zbXg%N-61aia;%u4jLg&?GlY@lv>9{i13K8!*5)AE_GfV~I?g$IJ1GI^b4Q zC`b&kacfKeo_1#cBgH;7X*2!5h+b_*gXqpi_qfBo`CaUk&DRP)29^u%cq#~X#)%m9 zL;--Nps4r~;4$LSA+v<;H$vr3(jx$rG8Ofj7Rn_MB2>B#Z{}7%-y#;%kPLvRs|5hl zh={xEqdTrxGJ{=FLfB6hx}*op3e^MFR>!eZcQfjm{nz@J?18~(0wU*qd^pWhBMX7; znQOt44i}l?X#4_>OHKJC|T0(arrzt)WsoTA;Wr224Czh$sYtk=e__ z*6~Krbl&=Sgb&2?;+g$`(Ccqhks`4Pcorll4M8#@yVkDP5&0PaKZxTv;C}Ux1=@@P zLk{?-_*UKwoLK{LbDS{GKUUy=pGT>~6cFyWx$fLp=H&w1qC_)0*hhv2t(!!qV>rSG znk5y#@nCBU@#4!D21Jeb=`p~7;y9_OHTAt|;u*@*E$>5MF`)oYnG?g|#0-QXG@R+> zIm}_8cVF}v-v{gu9UreKz4yJ8f&wI#@6jy*8j%i`oq~>qJZZWLwrYE+kRqYMXlE}6 z@CiUGZw(q7KX6AD-R0yY@)q^h7eYJ+umO|@#q@(me`Aq|TcNFqD$V{V9zV-yAafej zW{#LahFpio8rfYVmGJgg-JfERl5Le;f(XAUkSrjYq_Ts18DcM$qZ`Q48-+aYtNE~P zz_y6Nyv(aNZ{CWi{>?{MWGFMVa#80wAC64po{KK9+&3Q}*L<%$rBc_?dXkBx5fx?#I6iF5RK6Xi+ z>>beBfyE)pyh3Po=&7WrbO*)L?*Gm|1JjGd_aOlTCY#N)&)CqE^8>-r0H)|M4AJ8Z zWn{``(wi#E9HD_bHENdN!hEc8o6#Hx3mY3$B}hz|g@vWn*vjc6Tmu?yKJo1;WWxZe z05KU?Bm$T=+J+YbP|QOcQwUlOEry0ti&6iWw)A70@)|dd!=t0**6vp@38hHz0nqyK zLlKyhmohZspdDaqv0!$#W(92iG9gF(Jf?Y~1JP;lsyRqQ)IWv*jta;CNGp1hnTnuC zrt9&yllo1OCJwe}t2N~_8XY9w>uk-N)-O-#@g7M01&E0P1m^(eNd%KFeJi?D_2tVq z-UwV=TyDvu(XwkVVp4uVe~o@zZv==!hTedL^_uNSOw}dbfJdLjV5xy#N7Cg`3Oui7 zdUEoZUerV-+4-09?M?x*@WZ6iVZ9q66O~%ua?ei|MDW@)t3Ai{qJ-rHBXT{?E9=>{ zwYA~JGW%A&8%Dw7nK~lA&pc1IBz>R7mJ)Z`Yhs(subLQJpJ0sCc>9os+su~<*sY43 zEtbS@R6Dt^l9LDP1g@?%xH!rM)L#)fI|!|3AIueCo>?28)Qfs_{ukBu*2eo=p0vly*aMSpk7_`BeR+CkDZ6`aSGb?lLPT6H;{Jzfw<9PQb zoOsVXezps3wA=70HAUI+LNMn03^`uuW+hr*qKZDW%{^|;cpv?NQEDNNL*OQ?-)TDY z+iSiiUm^h?1BT`@F*gRS$T=w>TMZ7sA*{cM)mFn4RDf^6-4weulmc?t@}4TsWAvO7 zpsRU07s)j<7PE!>nf*nnl2HPKKlehDlQ)0*9v(~wu#9kKeBl868i>z_G(KF{ak>qk zkBl{e70{$gVW()ohPd?Wdo zANT}?$d|zT-$|I!xbv5!D7Nu_{rt0UoY5L%?Ei!-IsI#B8~0X>xBq75?Gn+lm-JpK z3_bdM<>^gseQ+%LQQ)-_AJb*!xSixlvgy^K+fV>|>c0Y0^<8W%D!`?0zhm8(jmCuV zLnekKsNvHm?x6H|K^H7n7v~{dO@ZF3y{{^{G#rE*RmE)?3d2A~@!B2XR2;cDe5YG~ z;*SiwY5?W}&`exWpYlrR2Xna`EVT)2g;1Jg`AJ~_ywr#&LSVUUsa03+34s!aepq`k z5Y8t=i<)0UiWNX%hNnb%di>)~fW_)(4$2>YUq}{0 za?IswzS9QHce>P7ugn|jPQ}BpyB+3aT*}lrL4$8GdG$Hqn%-`JR}I8J#+H^%8eZ;b zVOOsbj~Z?ay?OZ(KbzTWCB#at!e8;J!tH@-`z=bTxH?anL8FZ!nqh4nt)M4&Rdtu9 zAE*`DUfAjHUo>I3%aBE`AzJH8yil(-T*gvmW?DCLE?4X_PMYnc;>54I&g|CAz4cT# zXfvv4&)vFV#}&IPVXseoZJ~WT^;>e?^7e^J-oDGchj?6Lwqge_mLWsfBSWK&f-+`q z$N2ih)OU8}*(t_^5Ns-rzyU?bhNh?ATKT4xU*FKj?v1}QbJU;O1e`N;Mgp;xhD~Q4?35! z7CN#Uj^FSHXk3`caLf4e1+|<17wESoK%G=8W+K^*R9!_!>$5e#5c-X|O2l#i?V|^5 zD@a=)arOa#SFTf-QU2lO73B*Xo8<%~(kwyAgd%vu$g2;iWX4%&1a4a8>AF}_=&kyBL7m2|(fPiyNRjnwH- z)_~2M9zRtG_9c(Tk(ZaZ87|E?vVmQ1x1NfQV<+(3F9Oxcnm#bpq51d_rgn_&K;j1Z zMy85z5UAP^Un4&rs@brCjiFAE29X>Dz?_`0kMM6H7W1%NWW%sACv*k~Ou(fPgoS12 zj&%H{saQ#ZKFs|MVu1kfsd>I(t72v|C|7ik_Xbo?h_GHaK6KL~f87`m@s~Pe4;J)8 zd1q2XiDnH&@cx zc}2rkR#p~NH_`pBFxC8oJ&yDbJoXFAEyio3Sh{W*4zZ$NxR?TdBt0jmDZM8pJ3Kop zy(Y%00t2!6Ymaym{QwNd)2C5L#b~UD8{6|$wb+vrJH$Q3=|}hF;}{&@L^9AFTrQue zJPiM}k>G}sA`v11GZqW$7n}Kz_3Y{>HiFn8(()$vbDX1{JdsvwB_+ZM&n^7)?9+%( zYxB`DF?l8i#NXxP3wY&3_ku0x_}#A~5+9HGT+>mvD8xgkZS62fO-06XAnz>Vg}2Zd zA2t^9?Ad3(C^o|LlUcu#_LJzSiM#VF&pYBR^2T?T*sgQAa(;6%_nD4&YgE{)^B|+B zMn}7dTbCO2^ty;As<87p!qn{i^T=IXIh|#Cv^xiztZ7ZfpQiKd^gyi?$3$pr!QCVGPPHWFgZyP#e$A60Np$5^v{V zQ_a3kEC;besy(}h3g)Y|S36o@qF}BvU8=GguDAh2ZlYoaBkBe?@kuW$qT<|iI;;Id zWJW)TjfK}_5W*z(=od-AJ->UH$&qe5TMwqsv8m`@zu(?_$p@X?Sj}>JvzEp?526d| zJ2~jLa9cRJxRR_Ug%8@|we(pVRS>1+>}v&^J39^OJ$iI^?-shQgGczfQt9+QWBA3H zuy8uesEJCi#G(zi`b80MorB=>DUnx>YP-e}sWzSfJl3cdOArF&jV%E_!$ zAPLzU3js$lu#$t?ZWn(3B+yUH{Fbaarm}b$^9FbOvW<47?bY%LH&qj zFxpQ~Pa9`gnMNm@CEJe~vsjo;+n6^Xc-O;4r`W!7dI#_Z^Wn$CuxH9L0^HMQ1RshENW*rwwrYXLk=jcL3-c$~4?%Q~C@=~t?Yern$=%(( zC8Tfrq^uBZ1rT|47K)0Ockjda0#ynM(FVcgi+dZAGVM66=$&nZS2W{;=YA)9w}-pH zLPK)f_n`04FUvoc{y{fbWpKUv%y*%sF+Yinzf zmeV=p>eZ{1wsl?I)#n}COq%(Z-V-7UCRE|-z>W0jlOft;(j@NPyH`HCvuF^KQXPVS zbbO%OfJVjYdE#vI%FWps9okxMF80`I@b6gz<9zRh*ll4i3_Oxou=Q#3l0+p~PGXI?k-&{ z)`65rjr17@I6#OA*c;dyADN&gOQBSHi%8Qqets<;vI%F{GJdfyU?KQW-ur3q8nF=_ zZ9TtpgNRI+QR?aR+*%Nfi~c=E2=e*{2WNs{1GAVtg9$;dZ{OG(@97LhvgvEQdZ7(b z#)FBa^)FdjM02$A(>#~jsM|Vd3yBnWA`^@d&YQIf8XfO9aC-Z=?wNhLAo=Q&&1kuN z;;#D9@v#P@l}B3=i=b?k4%RcX74?f@k-0oi><_*k44^y2UjD?$z|a802n1X}XB;F> zu_8`#?q&}zgVU)x-P0%^%uFHL9~-6L-Ba!qwi@{ks6X08yn;g+R(T%uf-0_OYuoFl zg${)(A$+dO$}-SkWXuM;fMVrnRxzfIB#&N0%4;p_K!pr~a0F84KR%Vu1zKaUua7-M z`M)>+rGY^Mu_UM=erwn7xJ;Ru?toOCXrF%8!inp)YQLDM)g~ z2{njdzPhxjKtTc!p0z)PH!8N}Ad@_#Dp$?bW*&~nCb*iqUQ)l6Yh*OCy0*6VHLzCK zT5TR!6}WSXfsh#NY+?L)aW)37tzg|3`2=CSHg_PY z@Y;Co#*cSb7Vbw;kU?H5=;qAp>GC6ror#Glcyy-0W3hxd5tvUnZ~Mm1ruB)8^*rCY zjL-n8)cktc3Ntdz?b&j$vgGEs3?U?3;Jm_gTg9 zzLQ#NUS5x0)Ow9Qb#lJ9lOCs@se0LLX+)(#46pZ>cg4fQ1TCqd+5F#cPQ-Z(_Mum5 zhwKCveu(W8J2TYdq_^fcFu%*%7f+B`=lRN>P0W-;Qt%o3&f4fT2x&0O@?;jTTXSD# z_{g&`GeZ?z#&a(81@rNc7XCd_hiV8Z?8?hqUbS30NH`yUd2-@|iG?Nh*!rvC{nC&S ze3}z;%5dSWPmPBIs;U~AxiDowJ~0_)a7eZn7iCXmBPSUyDXTzJ;c(|u z4T0j1?lpg;E_&?6WoNwWL@yvnAI2GoToAnWa{1*{Z7rl;7gM&LPks7Rg`g%=z`#nD zXUX4Vsu5{L75L*C@Fl}Cs#E}Kf#3$<#)oG}ghx7@vC(^9;R@msRk$`GZZL_7wO`#VDDRuH(T=7N0IyqMETb93E z9q1eAubZ6I5sW~F-Ld2XhVwu4WX&VJcXG1WmeJ4XXs1maQcg^W z!XH>#2A5=gOGY)4OAxiT{@TC$`E!C)r_{;xXJYz*^i!~gHItJR39$c8zp})9f|8Q3 zuyBd%9D^{^p|Ylmva&J9W=_e1HZ&(-kco#UP5f|bDYZ!0O0)3<_r}kC9Np7x%QKht z^rGEm~n=AyS4!eO^i*C4&Jg5dv)=mCUOV z8&Fg5Y_3D+Ae2^KG^h##Kn+9zMs=~}_{-n87{JxyWNB|`IFv}2vH*8dSAPq56aoR# z4`lsAfCC~sC3$~!*dYHDS#L8$BXWKjsm?pgdd#X2JpPXs;4eH6zW(4L>JCVLY)tzK zvk6X-S&lG-?32%1qq-hOOsC^rp@5EN=h2&rE|pdg+=o+t^C!! ze8{>hcAI(BY4;%!`A{LDiFc1QY7vs4tMa*G&mQn0^Y}?>#(D_3$R7DmF|RsM?(A=g z!iL(^k8#IZQiLs{XEm`FdZHl~0a3zjdYjL@b$xxXAOM>PR8xhdVR2#ZK$dapx%Dxa z;;;5w$pa_bc(xVCM@Rn03=E77q4LbdypBJk2L}fOp2^ZaD=a!oNFdF7_yid>UqA@% zAA@X0pij7`r}r`m|M%rj;h>Xq{?$51$H4f}z3J{fbCEyY;y3DzH;> zULSwgerl`j7SEGI`RVSJ`0d;*9a@Z%xKlwV`}1n8t%6ynaS&%D=H`T-;1PLNTNfO! zWe@(W_ti*FVbWQlOLZCN=QP^7~fmFL12M1xI1 zdV&Ctrf+(^mvr&PZUNixJPHjFNWw)DMG{248wlj?moWK&l-{dY7od=Y$gUG;62z@2 z!(sOrP&BhWWd2Afu@{3eyY{(|Z8GFAZ|+2BaM>}n%;3unqaUIr8eeYE%E^bwa?RkV zevY=Gu?XNWQH(8Zwp>u=I6v(20^E=0LA$&NpRljf#L|K5xJ%j$Cwnn_f4c*1@QO-m z^p^EJN}sq=2M)R5klqc-G7ru*DN*3)U3ZtCZC49p|A=EA1i2qhB^2c0$2haAX|NN<#G1j>xbUA}0u$uFxytnPbie;Csv^2VZF@^h$ zQ0w~d@qe!B_y_X-f2m^u(E|W7p#0Yw$0-I;2rJYDK%Js!WMi2olKCTFU@X2g>jP0LQJrnwlgE5-;fK8CX73(vpK4 z*tiSgVE9O{I5>VPvnGe{Txoa)zNv>ex|31e2 zp`|Fd0G9vF&on-R=Y);iBRNg302E2>JpmG3aAGgTk`~|2U-|bjpU!c6JNf5+Pi1A%3WAxPl$$=XnraS7w0JWE%Ndr% zAs2CQgf2fgq`C}ttPK1`(^3bAU;B=kGU~uj1_f_6i&LUd z1}8NT^}VgF@r0L4?um-NXRP{Ib$0AQ-63EX^}r?)aG4|<&Xyk@vI?n+X^1e;y?`1} zD1XKEsl9b0Y-6zmT`c-`uU)<1*`J}CWnN!g#=r!f9i*y{J(AQlRe)cr_r;ZLIM_n6 za8T+1nJtnDP00mK_(g<%%@Zg;*{xP*Qpt8Ff#3>gI8;QD)g%plDAbiGG<~eqy$1*^ z9Mrp5-#AI2AP-p`0k;5Q2msi~NkmPX=0}G5H$;QP{n(*IB9DQM0EQA-n-JYD1N;i; z6cOrZ-5DA5`lGMb;8JW%(&8SKh62B(-mhK{b6g#t*L!O)NziS-CAK&dDaSBFnM zl$I`bC6~FBp$G9Kj1VPXC$NA}28b*}h1mkyqb&79PGsR`#TI~yydFmd&cfNBzu4Go z);TCNXF#2w#+Z|mn@hn>4@C=%Qk@K1@QV?i1By88#(9jOSi2tX+3@E%s7Udb< zy!|2zs#u;b89@WC`OHE53-z^NQ72Epp8^`6`AwB7)W#nuo0Fh>0M@t`}fgdNMU*)l}@R$K}G2- z?Cgps=OESp&?@$f{RS$=g&~|FC`b+e^o^~*yIYs5x&i{P$B!>VaZ|%o@u4Rf8%Yon zM~9s0wh)u-H_N{Cp6T=B!((Zh`)iM&HsAp6k1SbTk&#R~KAyyd1z7ID$It9G2=()S zA1!1hPo~E04Ud84m9o~rZ1CFcSB0z6Ui#7%$*1&T?-T7%#j{La#W76-gBd2vAOmr6 zvCVb2a`WKne|0BiS|uH`U;d6ReL*r65ok^<5ejukV!4AI`YdmH+Hue(^EXpRor+jCpC5eSEdAo2C-#F! z)|wLfZG_|!goA2oZrK3K1Lzd>-r1VfhxeOe_dHhym_F#P#tXSoA9jQIAS@~Ha15EgDGTgnv8Cd|c4yEq;@Np>kt&-&%02A5$lDL&_4_IfY z28c0aSA|Il1XOI!paMf&Fev{)%_|`|Sr>yf&$oy)8**uOOH~W)aRH$TUco0P;?v*Y z2a;Nq-v3i)f4@)L@|yEC*k!!CjgpQTeOgwsuFa4gRyG2WOe6aWOb--xcBh5NeAqK= z{qPxz@|bd1n3x`zRv?DN#2)c<90fXM}i(C`JmEtD+xazg^B zC8iIYp*9NAHzaY2pnuPG}| zp7P|90M73;tMgYVUe2{{8WP5k6rh{y?}~M1$P(=~ylc8|e#I*Sy+p z^t@{OtN1~?ld#VHMJiT12?nI)^{xMDBY1^yy*@)J?L@fS42Jm8#E@Ud=g;~AFDk)TfOy{rs|I}ZOTSItg=glf~Z zf)MwkVx=e2-u`tYulV~rl_jY$5}#C0o@={1@{$gH)f1xJA@B|n1944=e{5h%TahXN>&3l}e0S+5&`~Ifv#(kn&RZw!ymfHJV zDew|5?vuc!Y{g$(7lZ1r#GMYi$q@Kgeq*4I@64?&@Q)qs;ENI#HeRhV=Eh=;pP zV~#Pu&Z9M}R+R&92y40sfdWt=aA|2tA+YpxZ}h4`tlS*;u`TneV>x_k@TVUE)yX#| zoda8UcfM<&qTG@Edk=>k?7jbrtA0_@{8t@y;^+V0Qd$vc>YwH3*Af!>|NQ9Un`vv_ zui%@MRn|$CQ~yy2xHL8h5GWwNsWCe5yr*dW(8e8ui=ChUKGK>3IjkumCz!+m4~jJX zd+6qAX~ul7q}X(i&{))KpjLddRjppLpNyzAriK2*4Pq`Q%TztR5^#;VX8JYuSJ!@) zo@d4NP*qeoS@rhKk!#4a??qOxTMN2Yb_P9<8Diy(5=LFuigT0OEccH+#}+{lleb#> z+4!6KvtHR$54zE+Ck;DJ?*1pAb2ps5w&1##2Tc>-ty@j38=OsamYvi6Iyl212{lP5 z87!aJK=E^{;*^|+q&`k-o|AE#UkB~y%>Joydak6Ko4{G7JvNl;O%94& z)^Zeh^yn?{d6=#~C@EYd6(`@V-W14sf0_&E+B!J7@KD-q$Y6qE(&M6@p59QI$HlT$ z$BJJo5lPsCw`sT?G1VV&aw4Y?7VGo;8%CY+wFMhqI^06w|Mpytc6=WzXnO|-;{p8l zmcm~p^TBf!8t~lj5EAO;4sMx#KAPhp9ofmwMMAAfr!s@$C~u(2^x`1E#OEQ|0_LI{z8n3%-frjq@Z z{pSa)a}f>hCdaP>u3a^#`gME$*PzbbCg>o#rh}D`D68s23ATAhilRAdULpgDAkvKM zGi_Tp1RS&UWmF?<@xSL*t4uiQbT&Sq=sZqWNFhQlNCW5NweJgc5i5r`;Z^vy#j6H& z%|S|mH%2%K_BCzyaeoB~LhqK3#lr`u@uD+1s0e z4Q|qA*dSYdBe*12)$@8qFx6pr4N3;Y9QP;@HO4_085~BSz2c{tSPHNEYpLc9nv{vel7AE`&td83!k8E@HeaETCR`(;v6 zoXq}ZrEhIZ_WHd|S7LcRNfE3J)adY)qIE+yGha;%E`fxy(e=}nTR+eULQN>ts}3~x zUc73F0Yecf^CXg0kCNfL6DmT{sQunvT_YHSt6cs4h!@ezrWGanApbCEyvclJPnO=F3#xAcj)U%y5t%q{)Z$+xl$<@`X?kxx2IB2bCZro+k8g=!lohch! zT5tFgp;B*IY;by{YQ0r=VRj)~RMTBBUh{*`q!oRb$F+|m1HT#<^t~!NoU~L%CU1K8 zF0F3=41{G4*wpH6^S(+2@_pMuhthZ-+KAby8gCLqBbJvEDWXzRY}3=z3JO(9ns;$` zcMrN$2Ll`)_M&thzb`l|D6mKBxnsD)r)nu=nkUa(@0s`R4wc7WTXLPMmo6ibf!!G{ zVEWd31h)_6-)yhJdb8Q=mVBJquPxnN5}wHx z(?QqLML1{vNqg_f6E`-aPEGKT%1_pi)(dgZ&W;cqB>5%V`f-fDfq^>9;*`>i8&OeD zza1j?K@oemSm|}JsaLVPCjjuhH7}`Jc@buev~(ULk1C^*vYHF#Dd<0)Yj&4Ih*1v zoXk(IJ$yQvtk5$jxcSyz)yXZ2|5OKmptpa`Dqkj|ZRbf&QPIO%SBGUTdq>Cbcoi7l zAbL7WmjmOBy0);Yy-^>t&|mB`_pM0zY}-!mqnl}n`Ul3tk@C&C(_J zx!4LyZL`w;7Y=iJ_yUH_$qqF^5g`LOX%TB1sl!zsk`df4iriz`SLC*LYYGMP0+z>c z7rEy}r>Cb8Z93@0UnVlLE=P&=+CVFs)pSvHb+Vb(khjZBNKH+xt*`qEmvp`fHAWrE z^wGqqUz!$!l_dOmwwqclG=YcK^&aQZ=#(r5?IpKFUGUAw=nY(^y>u%@tsw-LJl_PJ zsU0a+%WbT)L!98*UZ%W-sm!7n92|@i6;W4?xo%2>XT*?YYH%gu{ck%F*ssUk{k7mI zqZ07yH@@O&Nk3qKBrKMhv^#_YSyzV}Ba@7xOd!0}eg6EKwziJgC=|T2v#KM@9Fx8* zxNJiuwuXiVmgD-S(d}m`5--U&pkQ^h4GmGIbsoold$B0Fc^=`ll0ai~8T z{3f3G86e^YZwv6bX@8k%*(RSL+D(y0mBK*sQZc0(uGT5SGFTm?b3IkpMnr;>F|A!; z8K}O2vgl(}R1ER*0cX9tx}rx{gD*O4F2|OQx_)|a1!iI-ecXT3YS{e2efvz_m!T(L z0V%XQmlIx&){|hPZj?6gFB~?z*D!Oe~E*)--d>Y5K8EzFY;pCk<@#7&#x#`n!V=qGfIGVZ-MV z%5NTFQTf|y|0y`Ar@s>yEqvxgLRt>?ddg52oQC-{CzEd94tjqxl;rJ|>(7%ZIRcQl z*5?u5QcTgq$)Nl-kE2U9}E56Omy;@jU{1wO@b`NQf$1V;F?fkuOcg3W-;=hNZX%X>BDU)DG6?Ra#q&0bk3X?HNS(_YfIdXU{~3g z2%ZH%0exd^7)>Z}-YjcRn!rOuc618JG@Q$jp@hvasG0mBl_!fwf@28kA8{R@IN|%u z&@ETFGTLpv8JOgO{!gYF0wrLfcwm0rpkXe61bc3{kEzm?N7_A4)GdVc;ZT$VNy zLFa=#!bqvT0)L)@z0do%X^)heZlt-Tc^ye-Y6GdZ z!_W5iLs&g3Ak?%R0TYATE&`q`Fh~E^6lFl zFVLk!K3^zIjv+ueg4LAhSSezF^Ov@FG#Njt_84HJ zTE_sSsAoDRiS%jUv<64GyUWx(>x(cF{_^0 zV3Bbt??Ol}PL#TxVibB8W#!~N?^MS$8v)p&ONl8#AnwLq4_I6ClbFkbh6pxx_6Ef| z#8-XgOMdZJ58aGwNfOx($iF5i*yTGRP;gCLvDujhj$Ct#*~aehKkxc( zK9n|>fttE&!Oeeo>5KmEv!Sv49R+=yVWHe>;|K}g^*Md&i8?@For?*n{CRoK+cU;N z@g;J~7yuWx5`g%qg>ERuMmA;QPB9?)bZ~Eu)8>uVP1yo`y~xDbPCidG|5YE#p@04iBxF?GK)H% zciMWM_XQ(*&8V41!O?q87~tY?045Gim@qIv-5S>&8I+fABfTgQmHXN*!)`Yi_SR>E!I4trub+7Uvkix{U3p#0K2$CL{<5>O zcY<(1i}s_Fhj$DJ1doeKN|Msj$RO$AwttSEK9y0#;@4HbGXkW{%*>_FCwwf*F}qRx z2A=4WnM-WpgIX|dXBZb?1G}U!?+A>OP)_em_yp-C8S3Q4IOauiQd*E8_~wiV8|fjStyfQeJKzX186;68HA@ zc3#|*q_X|5_NZ*h%hY)7*WwO9PZY{&b*&FYJ4*tK%+Jq%ve)E8a9pHkKlMlNn4Sa$ ze`%MT%c^goJxitR$%2DXL9fl^{25S=$J%=fY~e@PKE1mG1BSVp-1!rVesWM$h%grh zF!`Jy&vR;JQO1n8!@w`?EEr76b`@3`jEs{Ck_^7i{ZZOkPaHWE=`0B>7={ksO6!CsVKjtOh4tcb>k8_&V9q;od)Hb$;P< zIwyne*3qL^=@}YP*>cb~32$-VLa-WM$}!^66FXDW_y(t#X3sRc=cgoi9~U|qyBvk5 zJZoHYuwY}CyQtl-O{6AQkvDww>F7t-d-Ovsr-&*Ew>DQd^|_jxkN>zcr=t#ES;pI3 zzo(<)8y0pt{ihlHOHNJ(g1Ye@Bhqgn{2=U6Las?xrqS-Jc?-l>;wY)Ys3=W-U2yIM zxH{(qdmNi%L{v{6zEV_Cl=XAUkt*2@QnpGFV(cM=&NRt!YC9pAzTo~)lXC;i85-4z z@imuSDyB^Y_4YBSWfxOjbW*Df4B*1r4&w6nyuqde#+26rIBhLK-Y+6s<1_zank0o+ zAJK#V=YfZhJ=D?hikyMhOXeB^mRS<)2}r;66yo6*O$yKYAtm*Mi68Rv<>SrGDto-h zkAe4;*UBT5E??nhD%^Pc){P997m0Qi-A*4u%TsYW^8PIJZ@%j0nhFfEg*ML|aD zK~U|($B)H$AD5ojNzF0n{I?kQ7*{~q4vr1;!{uMQj}p{d!2eM+sdX6+g*$s#6Rena zm!z9wgRg`XLeh2gnKa2zKNgc7)5DRme;slEIeS&Y6E7V)#$5-Ch>6M3k&l7E6ntvm z>_olz;~ONtpu6f#yx5T246_1>mi|;)8Keh?mp-|^YnihPD2Ev8HE@KVu zds231Q{&-6-H{6Z*G6;$5-(cS7 z_+}Arubd)f#!N|8Y|%R(Ja1)^j`O6LlRejLBv5SG??aZVvRXbg(}}!or(R&8pW@cq z)bvU_OG8W;L@lDWrBiHy7pO<&jqqLSe7N`@dh)tGXpe|#l_QTHgb{iR`h-?@f}b!q z^FX0kLqbA`dOPC0K{t0(d=+AyVtua|H~6GT6&4s&pmDLHBT%itmxev&3oA+Mv9dC^ z8d8xCM~6@pv6e!iQ1Np-!e{fuL>Rn}6An!?ClrDFiF%=#VvwZqIXE&hu*lrE))B;? zY9+obxeTQhn0TUJ!{ccJakO2?0QB#}ayB+g_x@upluhf{aCT7H)%Guq*pq0oa%@EilC!`%L4zx8Q@o1&IJ z;3>-S8`XMI`|#gQQ|C9@T>9<958XmO{Bdz{KK%L~dqpTejn5DLAd2RLQg(7GK{b^~ z#PVecKj5FNeoGE6hHI%i8jU_}@Zb~p5w5lqJ}bqprmKI+o-n}@r40EW)ZdeM+t+JZ z{w?eO=dVTLO_PxTi`%$76xJR?44nT&83Ga&zd?T;aG`&m zZF1`9vp@m_u@Yfrfv93)YFhTm0i2DMGGoH}$RAJvNB(ng7XdRY+5T28--*`F0_BI# zK+6h$PvouDVUV|BKX}K#?d{F&6(j2?{M!cczTP9kn_O}=*#%EvCK&GYQ?_9ipL+=4 z+?XG&P6jj^)l|=0^|-!eQV6wHM-M(`VKH^rodMH7lnoI#3%Qb2c1sQ(|cz1J0&z);kc^Y z&y?FRqfpT~2|Ds$*PTmxEw0;boCJY)d3wGVe)P-aNNqNfw!&Wv{1B)XXPZ%CeE;c% z4SerwIP3Z5mS={Ny09YYy%zPbVs`7Et$1Z*4oukbshPTaECd%%lzUVbtA3*5tNRN= zPQjCiY_h-DQWjP1mYz9q^lO2!g~yz&zP<s=ZE~kco zG>p#9EWeIcS)+mEz}(jgB$ugfhdsf~2CMOfnZxuzcPuRXXm@Z`S;kMZrkxp8L+cc= zo0#JHW+W7L$R@a`l#^hs$%R02lmf&$6~eCid#pULu4n-8Mn!W8%Tv)GKTZkVIAKs- z{j77UIfg^YT{V9H6k=qc4DP}C$R{)c#sz$D`XK{T{g^1pK#!5g-eDwSumE{9niQ00 zqP-JeECol1G*NV)|CPrmY84wL{B*STv*NDs2P+w63nuVW?x`2(3%5S&d*``LtGT+k z#dyPPT&QHn$POeM41_2b6U!IJ+A9T_mZZbDt(E6KS&BTu~c9=l`6*ZD|LbB>Xd zpIb>5-I8O-UXAL8>kel`Muxy41d*V&#Cl(ppUrk!_40fG7xWL}p4%JseDel$d@32f zJM3yRfq+LrDgS}?(a^wGgCaZ6opVazGffh;>eTpm^nGE$uCcBRbwIgS(5Sn>9k{g% zHHEW2ndO*7np52)=%u<9;RbK@J-UBCAZ~&#kt02?^q0BnJ&5)!7#gyga;>AoH!c7= zgpGD+?NUsnIDz}akA`LRmqAR1q9rdxCjlhL#uoCJV&RkmAwVO7d!X2o3+nj{!P0ZT zTL92P?>TCqv=b8(Kxtv>aQK36S9evEvYVAs1AOFmUrke8*yX^5bF0eb9L0(J#&N#{ z01j{ot=4hCM<@>;Uwww2S8%2cVKF)7d-irVRg&eRz_tK(JR`h>aqdSh90Phdy2Ah% zmRr{o*5@)XG0%coHPJT#Q95?G}aiy(I~~d z?9RviLe@iKd3P^Mv8@lSr3{jo#>2fC){n%2Aq#x$J1UIn`qClT)y`Kqi2lVV#+#0zK=Z`Qn_bn5u z4w$X0_UM7w*KQB@W6yyroG&v>)!9*7PDXSpK~9I2#4`6BDSc};gG(HN*zcVyO*oGP zvXyUeo>>WG;HD;SP{zPsZfkFUdH#rZEkN3ET?2b_7)5p+V(oVdbtDT|+1Za04J}KZ zMdVF>{yd^*ukl$tTRnl$=hG&iP*!#vgb3(_tOg#D3wl8BN_GQ!=9}u%r@^WVVd&gI zq$JC&#l86s_IEgGtk*Gdu(YWG+8=X!qom;a}!N-CE^=@7ua)rf3@E45i zMo!W73!!9kQGR0`>~&F>%tJwN+PjDtR%U>)bV4o9BJM8iO_j@2FF@m2S z6e~v8T9td-m5Q?GFXI_lQcu2`0DkPkW{2?1p;uwt?yJqi7r?CYV-}$dP>PgMUFt}7V1W@|AAv^B7Zn%#MCI_hzinxu?8VMBi+H?CESh^p zrK+6jrq?*+T;SHPVJlu5p+JI0ZYWL_W+-eeN+nhvd5{qeJ<`x|BNc{3yeKW*G(Y?7 zVF&o>{u&o)q-o%^2c9b^LO76JNqLuUu64TS!-stkzkK<>DeIpOicV-#8EZ4`h_E%GRyT zTZ%pmbo3jd$5OhidSo(WKs+KZp5)XhH>ylQ(pH-dX8E6#z1gLInnuRZOkAqDt%!U8m1 zV%7v!)KWn#I}6Dy7L5F2tKkbf3UU0>^y=yb$T1FO2vCQx2P*VNt4e%JQ5qcmC<|6Q z1R~V9MTjWif5>>ZHY@mU)p;Aa_s5nh!$2C9+;9iE*v9Ymz1mhB( z2D@e0V@V2eif}F?67At?sRM}u*5i`49c%-3t>U@;3osugYH#eu=*7!+7Xi(@J}ACjlDECRmg z3CS9oJUV;+vzm3w+SWGnw&vk%*YcmUHGGdiyCV5zv)l5HmdZPJNX8o;U)!YjTtgdFw z)FI^mGVXb<3N!(-#3WPCZ?7zAs&p`k+gx; z0)|>}P|%x*ZhBx2Z+IWS0~_>G+V{m+O0x2bijTGx#rD6;53y@GI1T+=bnT%LL5Q)C zQfl-MG^PxEe=Uovt!KS)Lu-Kc%W?9Z09^lvA-woru;M^z)l(R-pFQ*Kt-b#=1u3`g zb}XlW{l)Nuk6&r8iVs-|p99Es52UM1k<_j4_s1DdCuC>eUHe|xKcD}hMoqPCAI8&w z6Nfpu&tXZ>rYR-rU%O$K^YeK~grXK!>upM;!m4c@KtcmKcrE(ZbN%|gUx8-?>iMiW zH}hFc6B?MUu@s2(PqSGsL7}7u!UjX;*IY1aTPGCc<;iY->ADglV9X2JFJeg|=$Zb4 zm8q$ex_ajedDlp@wJCCYqi-oc;C zB(_FPG(=XRpzCOyJu%Jm`R72FAH0swo^A==a2fMN%Ze8+`qR=F4-?Q}2Je6kJA}^P zs52`X4ajpE0owK*U8i)Mc{WBc;c0uHL%soF)F<4>`|Ey)1`skR9ANKVcbw-WvN!M; zA-C}xn#*!EB_1kU(CAWxYx~2ZXy5r2UPbzZ2eL!pV$%#W^yEJR?=_MoI#));FlJbIxE% zw%yYoZVi!fBaf=B!1zCTq&5?6H`U_Z!9_*onJ1~Yz1-*gxon3cAX-RN+zkdOjCQ_61F!=7wXyGVkBvHOcZc!X3e z5L-e+jab50ENS;ws0RGpT ztH6Qv0YWP4Z{vdAC)~XBtDtob?bRS%713}zAJ!X}&s1IEJhd|inNV;Z**MsD9+Z>7 zm3k^1hFXWb1-jbNTtMhruWrv` zhaN4;TchW^a4u}d#2`>t&AP_8(j&DN(VskceMN{P^Bv9pb2XUhXb9=X~uY$AhyQ2W=%=^6^EDOWT{`1m} z+$at8f~sNueE5hlc zaF7FlSOM-uAVo0SdBx`IOq4J-`r_rw4HvyhZbeuG1_acDvBBNiOvip~h5SUWNwDj< zeb3omwFa6DWt@T5L8exTNjvKP?1&ktq2MMcgne%SAiX-pcMGfJebjovRz!1QRqpdo z2m#fu3_NDLG(eUh(yI%NMG~Pk(7eX!VsJ4+oRFFRbkTht8}1b}`X#Qvk~1p}Bsn{E z0rzF!a0I$l3V8b8N>01E4p9asAYI#%M9KxzEn3vEIjH*DTB6c?nxTppHG6J0?`e&s z{y~VMxw8_2x3O6k(!pHO_CkiJ89Ia(`~`!a!?J9O7U&uKc-O=v zy=Mz}>*?Vtr(rjSGiT0>u7V|w7($}a27g<2Vh6kAdO7kL#+Bx+n3+Ryf^srOM)cq> zonm0%!;9b-Hhml35K}?YyYSX2{5%03i!m*q=bGg27NrO~TI}+kFMZX!UG`+Vy(csE? z6_+mN2wJ^byY&?thj$nU1AMj!n=R*eOvBIiaXDz#-`H*2B0biBzx>J$0o=x~y$gCj zp6L2FO0Y@3^1NKd=(M$BII(`@=;iuSD#ZnVJ`$n94Zed!M!SiAYdV7w=@_?OLIwUo zcIQmvT<-98+vMt0D>2*qc=>`H{}H0G9b5G`quE7o!Wi1mi~_EkHg$|3pvUNfA_S^7 z48!Z1ssbS3V@sT73|=;o6+-Ovduj!asxbCSFyH%3jj(Xbnta2?JqgD*u#F-30G&w2 zx8q13s;CfsY!L|C&lurqcZv)~bq~=l?)?+5Cw(2pNJUOA4UxnjfX}~BN z#uRAh{^v2>&B|V_Yo43d62;G{;FLJ$FFxdLb(@$F`{yAjXl7=XuuDnoiv0Jn<@evs z^Z)yPUjO}8fd7$Soi6@pg`f^juBZS{@z1 The same list of indicators is honored by the prevention agent. Meaning, if Windows Defender AV is the primary AV configured, the matched indicators will be treated according to the settings. For example, if the action is "Alert and Block", Windows Defender AV will prevent file executions (block and remediate) and a corresponding alert will be raised. On the other hand, if the Action is set to "Allow", Windows Defender AV will not detect nor block the file from being run. ->[!NOTE] ->-There is a propagation time of several minutes before the blocking policy for a new hash is applied. ->- Trusted signed files will be treated differently. Microsoft Defender ATP is optimized to handle malicious files. Trying to block trusted signed files, in some cases, may have performance implications. - - -**Automated investigation and remediation engine** +**Automated investigation and remediation engine**
The automated investigation and remediation behave the same. If an indicator is set to "Allow", Automated investigation and remediation will ignore a "bad" verdict for it. If set to "Block", Automated investigation and remediation will treat it as "bad". -In the first phase, the file hashes are fully supported, while network addresses (IP, Domain names) are partially supported (Automation and Detection). Stay tuned as the network blocking and more IoCs become available. - -The current actions supported are: + +The current supported actions are: - Allow - Alert only - Alert and block -On the top navigation you can: - -- Import a list -- Add an indicator -- Customize columns to add or remove columns -- Export the entire list in CSV format -- Select the items to show per page -- Navigate between pages -- Apply filters - -There are several ways to control IoCs: -- [Create an indicator from the settings page](#create-an-indicator-from-the-settings-page) -- [Create contextual IoC](respond-file-alerts.md#add-indicator-to-block-or-allow-a-file) -- [Import a list of IoCs](#import-a-list-of-iocs) -- [Use the Microsoft Defender ATP indicators API](ti-indicator.md) -- [Use partner integrated solutions](partner-applications.md) - -## Before you begin - -Creating IoCs must comply to the following: - ->- This feature is available if your organization uses Windows Defender Antivirus and Cloud-based protection is enabled. For more information, see [Manage cloud-based protection](../windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md). -> ->- The Antimalware client version must be 4.18.1901.x or later. ->- This feature is designed to prevent suspected malware (or potentially malicious files) from being downloaded from the web. It currently supports portable executable (PE) files, including _.exe_ and _.dll_ files. The coverage will be extended over time. ->- This response action is available for machines on Windows 10, version 1703 or later. ->- The allow or block function cannot be done on files if the file's classification exists on the device's cache prior to the allow or block action. - ->[!NOTE] -> The PE file needs to be in the machine timeline for you to be able to take this action. -> -> There may be a couple of minutes of latency between the time the action is taken and the actual file being blocked. - - -## Create an indicator from the settings page +You can create an indicator for: +- Files +- IP addresses +- URLs/domains >[!NOTE] >There is a limit of 5000 indicators per tenant. + +![Image of indicators settings page](images/rules-indicators.png) + + +## Create indicators for files +You can prevent further propagation of an attack in your organization by banning potentially malicious files or suspected malware. If you know a potentially malicious portable executable (PE) file, you can block it. This operation will prevent it from being read, written, or executed on machines in your organization. + +There are two ways you can create indicators for files: +- By creating an indicator through the settings page +- By creating a contextual indicator using the add indicator button from the file details page + +### Before you begin +It's important to understand the following prerequisites prior to creating indicators for files: +- This feature is available if your organization uses Windows Defender Antivirus and Cloud–based protection is enabled. For more information, see [Manage cloud–based protection](../windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md). +- The Antimalware client version must be 4.18.1901.x or later. +- Supported on machines on Windows 10, version 1703 or later. +- To start blocking files, you first need to [turn the **Block or allow** feature on](advanced-features.md) in Settings. +- This feature is designed to prevent suspected malware (or potentially malicious files) from being downloaded from the web. It currently supports portable executable (PE) files, including _.exe_ and _.dll_ files. The coverage will be extended over time. + +>[!IMPORTANT] +>- The allow or block function cannot be done on files if the file's classification exists on the device's cache prior to the allow or block action +>- Trusted signed files will be treated differently. Microsoft Defender ATP is optimized to handle malicious files. Trying to block trusted signed files, in some cases, may have performance implications. +>- The PE file needs to be in the machine timeline for you to be able to take this action. + + +>[!NOTE] +>There may be a couple of minutes of latency between the time the action is taken and the actual file being blocked. + +### Create an indicator for files from the settings page + 1. In the navigation pane, select **Settings** > **Indicators**. -2. Select the tab of the type of entity you'd like to create an indicator for. You can choose any of the following entities: - - File hash - - IP address - - URLs/Domains - -3. Click **Add indicator**. +2. Select the **File hash** tab. -4. For each attribute specify the following details: +3. Select **Add indicator**. + +4. Specify the following details: + - Indicator - Specify the entity details and define the expiration of the indicator. + - Action - Specify the action to be taken and provide a description. + - Scope - Define the scope of the machine group. + +5. Review the details in the Summary tab, then click **Save**. + +### Create a contextual indicator from the file details page +One of the options when taking [response actions on a file](respond-file-alerts) is adding an indicator for the file. + +When you add an indicator hash for a file, you can choose to raise an alert and block the file whenever a machine in your organization attempts to run it. + +Files automatically blocked by an indicator won't show up in the files's Action center, but the alerts will still be visible in the Alerts queue. + + +## Create indicators for IPs and URLs/domains +Microsoft Defender ATP can block what Microsoft deems as malicious IPs/URLs through SmartScreen for Microsoft browsers and Network Protection for non-Microsoft browsers and calls made outside the browser. + +The threat intelligence data set for this has been managed by Microsoft. + +By creating indicators for IPs and URLs or domains, you can now allow or block IPs, URLs or domains based on your own threat intelligence. + + +There are two ways you can create indicators for IPs, URLs or domains: +- By creating an indicator through the settings page +- By creating machine groups + +### Before you begin +It's important to understand the following prerequisites prior to creating indicators for IPS, URLs or domains: +- URL/IP allow and block relies on the Microsoft Defender ATP component Network Protection to be enabled in block mode. For more information on Network Protection and configuration instructions, see [Protect your network](network-protection.md) +- The Antimalware client version must be 4.18.1906.x or later. +- Supported on machines on Windows 10, version 1709 or later. +- Ensure that **Custom network indicators** is enabled in **Microsoft Defender Security Center > Settings > Advanced features**. For more information, see [Advanced features](advanced-features.md). + +>[!NOTE] +>There may be up to 2 hours latency (usually less) between the time the action is taken, and the URL and IP being blocked. + +### Create an indicator for IPs, URLs or domains from the settings page + +1. In the navigation pane, select **Settings** > **Indicators**. + +2. Select the **IP addresses or URLs/Domains** tab. + +3. Select **Add indicator**. + +4. Specify the following details: - Indicator - Specify the entity details and define the expiration of the indicator. - Action - Specify the action to be taken and provide a description. - Scope - Define the scope of the machine group. @@ -111,10 +145,6 @@ Creating IoCs must comply to the following: 5. Review the details in the Summary tab, then click **Save**. ->[!NOTE] ->Blocking IPs, domains, or URLs is currently available on limited preview only. ->This requires sending your custom list to [network protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/enable-network-protection) to be enforced which is an option that will be generally available soon. ->As it is not yet generally available, when Automated investigations finds this indicator during an investigation it will use the allowed/block list as the basis of its decision to automatically remediate (blocked list) or skip (allowed list) the entity. ## Manage indicators @@ -131,5 +161,7 @@ You can also choose to upload a CSV file that defines the attributes of indicato Download the sample CSV to know the supported column attributes. ## Related topic +- [Create contextual IoC](respond-file-alerts.md#add-indicator-to-block-or-allow-a-file) +- [Use the Microsoft Defender ATP indicators API](ti-indicator.md) +- [Use partner integrated solutions](partner-applications.md) -- [Manage automation allowed/blocked lists](manage-automation-allowed-blocked-list.md) From 1059e4f13ceb44ae3fc2264f9de20e11c1574a0c Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 3 Sep 2019 17:08:27 -0700 Subject: [PATCH 14/49] edit url section --- .../microsoft-defender-atp/manage-indicators.md | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md index 540520a737..bced83962b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md @@ -112,12 +112,7 @@ Microsoft Defender ATP can block what Microsoft deems as malicious IPs/URLs thro The threat intelligence data set for this has been managed by Microsoft. -By creating indicators for IPs and URLs or domains, you can now allow or block IPs, URLs or domains based on your own threat intelligence. - - -There are two ways you can create indicators for IPs, URLs or domains: -- By creating an indicator through the settings page -- By creating machine groups +By creating indicators for IPs and URLs or domains, you can now allow or block IPs, URLs or domains based on your own threat intelligence. You can do this through the settings page or by machine groups if you deem certain groups to be more or less at risk than others. ### Before you begin It's important to understand the following prerequisites prior to creating indicators for IPS, URLs or domains: From 38f78a8e8461f5714ae5f8fbcbbddc6beabd4b0f Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 3 Sep 2019 17:14:55 -0700 Subject: [PATCH 15/49] fix meta --- .../microsoft-defender-atp/manage-indicators.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md index bced83962b..29eb827d0e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md @@ -1,7 +1,7 @@ --- title: Manage indicators ms.reviewer: -description: Create indicators for a file hash, IP address, URLs or domains that define the detection, prevention, and exclusion of entities. +description: Create indicators to allow or block file hash, IP address, URLs or domains. keywords: manage, allowed, blocked, whitelist, blacklist, block, clean, malicious, file hash, ip address, urls, domain search.product: eADQiWindows 10XVcnh search.appverid: met150 From bb50ea3bcc7aba9f530f4cd9b578970697c1206d Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 3 Sep 2019 17:16:58 -0700 Subject: [PATCH 16/49] typo --- .../microsoft-defender-atp/manage-indicators.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md index 29eb827d0e..fc5b64d8f4 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md @@ -116,7 +116,7 @@ By creating indicators for IPs and URLs or domains, you can now allow or block I ### Before you begin It's important to understand the following prerequisites prior to creating indicators for IPS, URLs or domains: -- URL/IP allow and block relies on the Microsoft Defender ATP component Network Protection to be enabled in block mode. For more information on Network Protection and configuration instructions, see [Protect your network](network-protection.md) +- URL/IP allow and block relies on the Microsoft Defender ATP component Network Protection to be enabled in block mode. For more information on Network Protection and configuration instructions, see [Protect your network](network-protection.md). - The Antimalware client version must be 4.18.1906.x or later. - Supported on machines on Windows 10, version 1709 or later. - Ensure that **Custom network indicators** is enabled in **Microsoft Defender Security Center > Settings > Advanced features**. For more information, see [Advanced features](advanced-features.md). From a6d5d46937d1a94254fa41b5dad45e436c491fe4 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 3 Sep 2019 17:20:47 -0700 Subject: [PATCH 17/49] meta --- .../microsoft-defender-atp/manage-indicators.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md index fc5b64d8f4..2fc4728d22 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md @@ -1,6 +1,5 @@ --- -title: Manage indicators -ms.reviewer: +title: Manage indicators description: Create indicators to allow or block file hash, IP address, URLs or domains. keywords: manage, allowed, blocked, whitelist, blacklist, block, clean, malicious, file hash, ip address, urls, domain search.product: eADQiWindows 10XVcnh @@ -16,6 +15,7 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article +ms.reviewer: dansimp --- # Manage indicators From de8308df34f6092a7c8bc0bcf16aaaafa4e3776a Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 3 Sep 2019 17:22:52 -0700 Subject: [PATCH 18/49] space --- .../microsoft-defender-atp/manage-indicators.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md index 2fc4728d22..55c7c34653 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md @@ -27,7 +27,6 @@ ms.reviewer: dansimp Indicator of compromise (IoCs) matching is an essential feature in every endpoint protection solution. This capability is available in Microsoft Defender ATP and gives SecOps the ability to set a list of indicators for detection and for blocking (prevention and response). - Create indicators that define the detection, prevention, and exclusion of entities. You can define the action to be taken as well as the duration for when to apply the action as well as the scope of the machine group to apply it to. Currently supported sources are the cloud detection engine of Microsoft Defender ATP, the automated investigation and remediation engine, and the endpoint prevention engine (Windows Defender AV). From 41e4dc584aeb94e3011231d4df638c304280e236 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 3 Sep 2019 17:24:08 -0700 Subject: [PATCH 19/49] meta --- .../microsoft-defender-atp/manage-indicators.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md index 55c7c34653..6c054349cd 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md @@ -1,7 +1,7 @@ --- title: Manage indicators description: Create indicators to allow or block file hash, IP address, URLs or domains. -keywords: manage, allowed, blocked, whitelist, blacklist, block, clean, malicious, file hash, ip address, urls, domain +keywords: file, hash, ip, urls, domain, indicator, indicators, block, allow, hash, alert, detection search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 From 3ceae8d5c5250a37f68cf7994839b50c169d7e13 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 3 Sep 2019 17:25:12 -0700 Subject: [PATCH 20/49] fix link --- .../microsoft-defender-atp/manage-indicators.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md index 6c054349cd..526ca1187d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md @@ -99,7 +99,7 @@ It's important to understand the following prerequisites prior to creating indic 5. Review the details in the Summary tab, then click **Save**. ### Create a contextual indicator from the file details page -One of the options when taking [response actions on a file](respond-file-alerts) is adding an indicator for the file. +One of the options when taking [response actions on a file](respond-file-alerts.md) is adding an indicator for the file. When you add an indicator hash for a file, you can choose to raise an alert and block the file whenever a machine in your organization attempts to run it. From c673cde8b3132facc60d6df09c1bfd608ed58c9c Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 3 Sep 2019 17:27:21 -0700 Subject: [PATCH 21/49] meta --- .../microsoft-defender-atp/manage-indicators.md | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md index 526ca1187d..50339a38c4 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md @@ -1,7 +1,7 @@ --- -title: Manage indicators -description: Create indicators to allow or block file hash, IP address, URLs or domains. -keywords: file, hash, ip, urls, domain, indicator, indicators, block, allow, hash, alert, detection +title: +description: +keywords: search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -15,7 +15,6 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.reviewer: dansimp --- # Manage indicators From 86cd8ae7b33870c16fb2f483ed74750cabf5b697 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 3 Sep 2019 17:31:30 -0700 Subject: [PATCH 22/49] add preview --- .../microsoft-defender-atp/manage-indicators.md | 10 ++++++---- .../microsoft-defender-atp/preview.md | 2 ++ 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md index 50339a38c4..7dbce08628 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md @@ -1,7 +1,7 @@ --- -title: -description: -keywords: +title: Manage indicators +description: Learn how to allow or block files, IPs, URLs or domains using indicators. +keywords: indicator, indicators, allow, block, file, ips, urls, domains, detection, prevention search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -22,6 +22,8 @@ ms.topic: article **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +[!include[Prerelease information](prerelease.md)] + >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-automationexclusionlist-abovefoldlink) Indicator of compromise (IoCs) matching is an essential feature in every endpoint protection solution. This capability is available in Microsoft Defender ATP and gives SecOps the ability to set a list of indicators for detection and for blocking (prevention and response). @@ -105,7 +107,7 @@ When you add an indicator hash for a file, you can choose to raise an alert and Files automatically blocked by an indicator won't show up in the files's Action center, but the alerts will still be visible in the Alerts queue. -## Create indicators for IPs and URLs/domains +## Create indicators for IPs and URLs/domains (preview) Microsoft Defender ATP can block what Microsoft deems as malicious IPs/URLs through SmartScreen for Microsoft browsers and Network Protection for non-Microsoft browsers and calls made outside the browser. The threat intelligence data set for this has been managed by Microsoft. diff --git a/windows/security/threat-protection/microsoft-defender-atp/preview.md b/windows/security/threat-protection/microsoft-defender-atp/preview.md index a18bcddf2c..9b1a96f339 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/preview.md +++ b/windows/security/threat-protection/microsoft-defender-atp/preview.md @@ -42,6 +42,8 @@ Turn on the preview experience setting to be among the first to try upcoming fea ## Preview features The following features are included in the preview release: +- [Indicators for IP addresses, URLs/Domains](manage-indicators.md)
You can now allow or block URLs/domains using your own threat intelligence. + - [Evaluation lab](evaluation-lab.md)
The Microsoft Defender ATP evaluation lab is designed to eliminate the complexities of machine and environment configuration so that you can focus on evaluating the capabilities of the platform, running simulations, and seeing the prevention, detection, and remediation features in action. From 0c5b22e94d881931c889122fa4812ba3371b0178 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 3 Sep 2019 17:32:59 -0700 Subject: [PATCH 23/49] bla --- .../microsoft-defender-atp/manage-indicators.md | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md index 7dbce08628..ca531ec4a1 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md @@ -1,7 +1,8 @@ --- -title: Manage indicators -description: Learn how to allow or block files, IPs, URLs or domains using indicators. -keywords: indicator, indicators, allow, block, file, ips, urls, domains, detection, prevention +title: Manage indicators +ms.reviewer: +description: Create indicators for a file hash, IP address, URLs or domains that define the detection, prevention, and exclusion of entities. +keywords: manage, allowed, blocked, whitelist, blacklist, block, clean, malicious, file hash, ip address, urls, domain search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 From 3eff3fb5078eedc18638a6e1a6881ac12369f319 Mon Sep 17 00:00:00 2001 From: Mike Edgar <49731348+medgarmedgar@users.noreply.github.com> Date: Wed, 4 Sep 2019 09:48:04 -0700 Subject: [PATCH 24/49] Update manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md --- ...ating-system-components-to-microsoft-services-using-MDM.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md index 850cfe4a4a..52f8406707 100644 --- a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md +++ b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md @@ -9,7 +9,7 @@ ms.sitesec: library ms.localizationpriority: medium author: medgarmedgar ms.author: v-medgar -ms.date: 8/23/2019 +ms.date: 9/4/2019 --- # Manage connections from Windows 10 operating system components to Microsoft services using Microsoft Intune MDM Server @@ -139,7 +139,7 @@ For Windows 10, the following MDM policies are available in the [Policy CSP](htt 1. Windows Defender Smartscreen - [Browser/AllowSmartScreen](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowsmartscreen). Disable Windows Defender Smartscreen. **Set to 0 (zero)** 1. Windows Defender Smartscreen EnableAppInstallControl - [SmartScreen/EnableAppInstallControl](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-smartscreen#smartscreen-enableappinstallcontrol). Controls whether users are allowed to install apps from places other than the Microsoft Store. **Set to 0 (zero)** 1. Windows Defender Potentially Unwanted Applications(PUA) Protection - [Defender/PUAProtection](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-defender#defender-puaprotection). Specifies the level of detection for potentially unwanted applications (PUAs). **Set to 1 (one)** - 1. [Defender/SignatureUpdateFallbackOrder](https://docs.microsoft.com/en-us/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-mdm). Allows you to define the order in which different definition update sources should be contacted. The OMA-URI for this is: **./Vendor/MSFT/Policy/Config/Defender/SignatureUpdateFallbackOrder**, Data type: **string**, Value: **FileShares** + 1. [Defender/SignatureUpdateFallbackOrder](https://docs.microsoft.com/en-us/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-mdm). Allows you to define the order in which different definition update sources should be contacted. The OMA-URI for this is: **./Vendor/MSFT/Policy/Config/Defender/SignatureUpdateFallbackOrder**, Data type: **String**, Value: **FileShares** 1. **Windows Spotlight** - [Experience/AllowWindowsSpotlight](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-experience#experience-allowwindowsspotlight). Disable Windows Spotlight. **Set to 0 (zero)** 1. **Microsoft Store** 1. [ApplicationManagement/DisableStoreOriginatedApps](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-applicationmanagement#applicationmanagement-disablestoreoriginatedapps). Boolean value that disables the launch of all apps from Microsoft Store that came pre-installed or were downloaded. **Set to 1 (one)** From 8900a1b54a2da15c65a9f73c541f2251f261b0ab Mon Sep 17 00:00:00 2001 From: Dani Halfin Date: Wed, 4 Sep 2019 11:47:21 -0700 Subject: [PATCH 25/49] Update compatibility-administrator-users-guide.md --- .../planning/compatibility-administrator-users-guide.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/deployment/planning/compatibility-administrator-users-guide.md b/windows/deployment/planning/compatibility-administrator-users-guide.md index d1b8ea0f80..afbb20379c 100644 --- a/windows/deployment/planning/compatibility-administrator-users-guide.md +++ b/windows/deployment/planning/compatibility-administrator-users-guide.md @@ -38,8 +38,8 @@ The following flowchart shows the steps for using the Compatibility Administrato ![act compatibility admin flowchart](images/dep-win8-l-act-compatadminflowchart.jpg) ->[!IMPORTANT] ->Application Compatibility Toolkit (ACT) installs a 32-bit and a 64-bit version of the Compatibility Administrator tool. You must use the 32-bit version to create and work with custom databases for 32-bit applications, and the 64-bit version to create and work with custom databases for 64-bit applications. +> [!IMPORTANT] +> Application Compatibility Toolkit (ACT) installs a 32-bit and a 64-bit version of the Compatibility Administrator tool. You must use the 32-bit version to create and work with custom databases for 32-bit applications, and the 64-bit version to create and work with custom databases for 64-bit applications. ## In this section From 4b8aba4c5d3a3f76b3318855715bb72eb3f77f34 Mon Sep 17 00:00:00 2001 From: Greg Lindsay Date: Wed, 4 Sep 2019 13:46:51 -0700 Subject: [PATCH 26/49] attempt to fix build warning --- ...lity-fix-in-compatibility-administrator.md | 36 +++++++------------ 1 file changed, 13 insertions(+), 23 deletions(-) diff --git a/windows/deployment/planning/creating-a-custom-compatibility-fix-in-compatibility-administrator.md b/windows/deployment/planning/creating-a-custom-compatibility-fix-in-compatibility-administrator.md index 5a005d4eb7..85bcd08e4c 100644 --- a/windows/deployment/planning/creating-a-custom-compatibility-fix-in-compatibility-administrator.md +++ b/windows/deployment/planning/creating-a-custom-compatibility-fix-in-compatibility-administrator.md @@ -19,40 +19,33 @@ ms.topic: article **Applies to** -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 +- Windows 10 +- Windows 8.1 +- Windows 8 +- Windows 7 +- Windows Server 2012 +- Windows Server 2008 R2 The Compatibility Administrator tool uses the term *fix* to describe the combination of compatibility information added to a customized database for a specific application. This combination can include single application fixes, groups of fixes that work together as a compatibility mode, and blocking and non-blocking AppHelp messages. >[!IMPORTANT]   >Fixes apply to a single application only; therefore, you must create multiple fixes if you need to fix the same issue in multiple applications. - - ## What is a Compatibility Fix? - A compatibility fix, previously known as a shim, is a small piece of code that intercepts API calls from applications. The fix transforms the API calls so that the current version of the operating system supports the application in the same way as previous versions of the operating system. This can mean anything from disabling a new feature in the current version of the operating system to emulating a particular behavior of an older version of the Windows API. ## Searching for Existing Compatibility Fixes - The Compatibility Administrator tool has preloaded fixes for many common applications, including known compatibility fixes, compatibility modes, and AppHelp messages. Before you create a new compatibility fix, you can search for an existing application and then copy and paste the known fixes into your customized database. >[!IMPORTANT] >Application Compatibility Toolkit (ACT) installs a 32-bit and a 64-bit version of the Compatibility Administrator tool. You must use the 32-bit version to create custom databases for 32-bit applications and the 64-bit version to create custom databases for 64-bit applications. - - **To search for an existing application** -1. In the left-side pane of Compatibility Administrator, expand the **Applications** folder and search for your application name. - -2. Click the application name to view the preloaded compatibility fixes, compatibility modes, or AppHelp messages. +1. In the left-side pane of Compatibility Administrator, expand the **Applications** folder and search for your application name. +2. Click the application name to view the preloaded compatibility fixes, compatibility modes, or AppHelp messages. ## Creating a New Compatibility Fix @@ -62,16 +55,13 @@ If you are unable to find a preloaded compatibility fix for your application, yo **To create a new compatibility fix** 1. In the left-side pane of Compatibility Administrator underneath the **Custom Databases** heading, right-click the name of the database to which you want to apply the compatibility fix, click **Create New**, and then click **Application Fix**. - -2. Type the name of the application to which the compatibility fix applies, type the name of the application vendor, browse to the location of the application file (.exe) on your computer, and then click **Next**. - -3. Select the operating system for which your compatibility fix applies, click any applicable compatibility modes to apply to your compatibility fix, and then click **Next**. - -4. Select any additional compatibility fixes to apply to your compatibility fix, and then click **Next**. - -5. Select any additional criteria to use to match your applications to the AppHelp message, and then click **Finish**. +2. Type the name of the application to which the compatibility fix applies, type the name of the application vendor, browse to the location of the application file (.exe) on your computer, and then click **Next**. +3. Select the operating system for which your compatibility fix applies, click any applicable compatibility modes to apply to your compatibility fix, and then click **Next**. +4. Select any additional compatibility fixes to apply to your compatibility fix, and then click **Next**. +5. Select any additional criteria to use to match your applications to the AppHelp message, and then click **Finish**. By default, Compatibility Administrator selects the basic matching criteria for your application. As a best practice, use a limited set of matching information to represent your application, because it reduces the size of the database. However, make sure you have enough information to correctly identify your application. ## Related topics + [Compatibility Administrator User's Guide](compatibility-administrator-users-guide.md) From e122ea710f8094f070525d33b8cb5d992cb67a21 Mon Sep 17 00:00:00 2001 From: Greg Lindsay Date: Wed, 4 Sep 2019 13:52:03 -0700 Subject: [PATCH 27/49] attempt to fix build warning --- ...oyment-considerations-for-windows-to-go.md | 69 ++++++------------- 1 file changed, 22 insertions(+), 47 deletions(-) diff --git a/windows/deployment/planning/deployment-considerations-for-windows-to-go.md b/windows/deployment/planning/deployment-considerations-for-windows-to-go.md index 2d2029cb3c..9f061b127a 100644 --- a/windows/deployment/planning/deployment-considerations-for-windows-to-go.md +++ b/windows/deployment/planning/deployment-considerations-for-windows-to-go.md @@ -20,7 +20,7 @@ ms.topic: article **Applies to** -- Windows 10 +- Windows 10 >[!IMPORTANT] >Windows To Go is no longer being developed. The feature does not support feature updates and therefore does not enable you to stay current. It also requires a specific type of USB that is no longer supported by many OEMs. @@ -30,29 +30,19 @@ From the start, Windows To Go was designed to minimize differences between the u >[!NOTE] >Windows To Go does not support operating system upgrades. Windows To Go is designed as a feature that is managed centrally. IT departments that plan to transition from one operating system version to a later version will need to incorporate re-imaging their existing Windows To Go drives as part of their upgrade deployment process. - - The following sections discuss the boot experience, deployment methods, and tools that you can use with Windows To Go. -- [Initial boot experiences](#wtg-initboot) - -- [Image deployment and drive provisioning considerations](#wtg-imagedep) - -- [Application installation and domain join](#wtg-appinstall) - -- [Management of Windows To Go using Group Policy](#bkmk-wtggp) - -- [Supporting booting from USB](#wtg-bootusb) - -- [Updating firmware](#stg-firmware) - -- [Configure Windows To Go startup options](#wtg-startup) - -- [Change firmware settings](#wtg-changefirmware) +- [Initial boot experiences](#wtg-initboot) +- [Image deployment and drive provisioning considerations](#wtg-imagedep) +- [Application installation and domain join](#wtg-appinstall) +- [Management of Windows To Go using Group Policy](#bkmk-wtggp) +- [Supporting booting from USB](#wtg-bootusb) +- [Updating firmware](#stg-firmware) +- [Configure Windows To Go startup options](#wtg-startup) +- [Change firmware settings](#wtg-changefirmware) ## Initial boot experiences - The following diagrams illustrate the two different methods you could use to provide Windows To Go drives to your users. The experiences differ depending on whether the user will be booting the device initially on-premises or off-premises: ![initial boot on-premises](images/wtg-first-boot-work.gif) @@ -66,8 +56,6 @@ When the Windows To Go workspace is going to be used first on an off-premises co **Tip**   Applying BitLocker Drive Encryption to the drives before provisioning is a much faster process than encrypting the drives after data has already been stored on them due to a new feature called used-disk space only encryption. For more information, see [What's New in BitLocker](https://go.microsoft.com/fwlink/p/?LinkId=619076). - - DirectAccess can be used to ensure that the user can login with their domain credentials without needing a local account. For instructions on setting up a DirectAccess solution, for a small pilot deployment see [Deploy a Single Remote Access Server using the Getting Started Wizard](https://go.microsoft.com/fwlink/p/?LinkId=619077) for a larger scale deployment, see [Deploy Remote Access in an Enterprise](https://go.microsoft.com/fwlink/p/?LinkId=619078). If you do not want to use DirectAccess as an alternative users could log on using a local user account on the Windows To Go workspace and then use a virtual private network for remote access to your organizational network. ### Image deployment and drive provisioning considerations @@ -81,8 +69,6 @@ The simplest way to provision a Windows To Go drive is to use the Windows To Go **Tip**   When you create your Windows To Go image use sysprep /generalize, just as you do when you deploy Windows 10 to a standard PC. In fact, if appropriate, use the same image for both deployments. - - **Driver considerations** Windows includes most of the drivers that you will need to support a wide variety of host computers. However, you will occasionally need to download drivers from Windows Update to take advantage of the full functionality of a device. If you are using Windows To Go on a set of known host computers, you can add any additional drivers to the image used on Windows To Go to make Windows To Go drives more quickly usable by your employees. Especially ensure that network drivers are available so that the user can connect to Windows Update to get additional drivers if necessary. @@ -231,8 +217,6 @@ The following list of commonly used Wi-Fi network adapters that are not supporte - - IT administrators that want to target Windows To Go images for specific systems should test their images to ensure that the necessary system drivers are in the image, especially for critical functionality like Wi-Fi that is not supported by class drivers. Some consumer devices require OEM specific driver packages, which may not be available on Windows Update. For more information on how to add a driver to a Windows Image, please refer to the [Basic Windows Deployment Step-by-Step Guide](https://go.microsoft.com/fwlink/p/?LinkId=619079). ### Application installation and domain join @@ -247,39 +231,32 @@ The use of the Store on Windows To Go workspaces that are running Windows 8 can **Settings for workspaces** -- **Allow hibernate (S4) when started from a Windows To Go workspace** +- **Allow hibernate (S4) when started from a Windows To Go workspace** This policy setting specifies whether the PC can use the hibernation sleep state (S4) when started from a Windows To Go workspace. By default, hibernation is disabled when using Windows To Go workspace, so enabling this setting explicitly turns this ability back on. When a computer enters hibernation, the contents of memory are written to disk. When the disk is resumed, it is important that the hardware attached to the system, as well as the disk itself, are unchanged. This is inherently incompatible with roaming between PC hosts. Hibernation should only be used when the Windows To Go workspace is not being used to roam between host PCs. - > [!IMPORTANT]   - > For the host-PC to resume correctly when hibernation is enabled the Windows To Go workspace must continue to use the same USB port. + >[!IMPORTANT]   + >For the host-PC to resume correctly when hibernation is enabled the Windows To Go workspace must continue to use the same USB port. - - -- **Disallow standby sleep states (S1-S3) when starting from a Windows To Go workspace** +- **Disallow standby sleep states (S1-S3) when starting from a Windows To Go workspace** This policy setting specifies whether the PC can use standby sleep states (S1–S3) when started from a Windows To Go workspace. The Sleep state also presents a unique challenge to Windows To Go users. When a computer goes to sleep, it appears as if it is shut down. It could be very easy for a user to think that a Windows To Go workspace in sleep mode was actually shut down and they could remove the Windows To Go drive and take it home. Removing the Windows To Go drive in this scenario is equivalent to an unclean shutdown which may result in the loss of unsaved user data or the corruption on the drive. Moreover, if the user now boots the drive on another PC and brings it back to the first PC which still happens to be in the sleep state, it will lead to an arbitrary crash and eventually corruption of the drive and result in the workspace becoming unusable. If you enable this policy setting, the Windows To Go workspace cannot use the standby states to cause the PC to enter sleep mode. If you disable or do not configure this policy setting, the Windows To Go workspace can place the PC in sleep mode. **Settings for host PCs** -- **Windows To Go Default Startup Options** +- **Windows To Go Default Startup Options** This policy setting controls whether the host computer will boot to Windows To Go if a USB device containing a Windows To Go workspace is connected, and controls whether users can make changes using the **Windows To Go Startup Options** settings dialog. If you enable this policy setting, booting to Windows To Go when a USB device is connected will be enabled and users will not be able to make changes using the **Windows To Go Startup Options** settings dialog. If you disable this policy setting, booting to Windows To Go when a USB device is connected will not be enabled unless a user configures the option manually in the firmware. If you do not configure this policy setting, users who are members of the local Administrators group can enable or disable booting from USB using the **Windows To Go Startup Options** settings dialog. - > [!IMPORTANT]   - > Enabling this policy setting will cause PCs running Windows to attempt to boot from any USB device that is inserted into the PC before it is started. - - + >[!IMPORTANT]   + >Enabling this policy setting will cause PCs running Windows to attempt to boot from any USB device that is inserted into the PC before it is started. ## Supporting booting from USB - The biggest hurdle for a user wanting to use Windows To Go is configuring their computer to boot from USB. This is traditionally done by entering the firmware and configuring the appropriate boot order options. To ease the process of making the firmware modifications required for Windows To Go, Windows includes a feature named **Windows To Go Startup Options** that allows a user to configure their computer to boot from USB from within Windows—without ever entering their firmware, as long as their firmware supports booting from USB. -> [!NOTE] -> Enabling a system to always boot from USB first has implications that you should consider. For example, a USB device that includes malware could be booted inadvertently to compromise the system, or multiple USB drives could be plugged in to cause a boot conflict. For this reason, the Windows To Go startup options are disabled by default. In addition, administrator privileges are required to configure Windows To Go startup options. - - +>[!NOTE] +>Enabling a system to always boot from USB first has implications that you should consider. For example, a USB device that includes malware could be booted inadvertently to compromise the system, or multiple USB drives could be plugged in to cause a boot conflict. For this reason, the Windows To Go startup options are disabled by default. In addition, administrator privileges are required to configure Windows To Go startup options. If you are going to be using a Windows 7 computer as a host-PC, see the wiki article [Tips for configuring your BIOS settings to work with Windows To Go](https://go.microsoft.com/fwlink/p/?LinkID=618951). @@ -303,18 +280,17 @@ Windows To Go Startup Options is a setting available on Windows 10-based PCs th **To configure Windows To Go startup options** -1. On the Start screen, type, type **Windows To Go Startup Options**, click **Settings** and then press Enter. +1. On the Start screen, type, type **Windows To Go Startup Options**, click **Settings** and then press Enter. - ![windows to go startup options](images/wtg-startup-options.gif) + ![windows to go startup options](images/wtg-startup-options.gif) -2. Select **Yes** to enable the startup options. +2. Select **Yes** to enable the startup options. **Tip**   If your computer is part of a domain, the Group Policy setting can be used to enable the startup options instead of the dialog. - -3. Click **Save Changes**. If the User Account Control dialog box is displayed, confirm that the action it displays is what you want, and then click **Yes**. +3. Click **Save Changes**. If the User Account Control dialog box is displayed, confirm that the action it displays is what you want, and then click **Yes**. ### Change firmware settings @@ -322,7 +298,6 @@ If you choose to not use the Windows To Go startup options or are using a PC run ## Related topics - [Windows To Go: feature overview](windows-to-go-overview.md)
[Prepare your organization for Windows To Go](prepare-your-organization-for-windows-to-go.md)
[Security and data protection considerations for Windows To Go](security-and-data-protection-considerations-for-windows-to-go.md)
From bfaab3359a63dde24e6d0dca11b841e045c481f6 Mon Sep 17 00:00:00 2001 From: Greg Lindsay Date: Wed, 4 Sep 2019 13:55:59 -0700 Subject: [PATCH 28/49] attempt to fix build warning --- ...ery-tool-in-compatibility-administrator.md | 98 +++++++------------ 1 file changed, 36 insertions(+), 62 deletions(-) diff --git a/windows/deployment/planning/searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator.md b/windows/deployment/planning/searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator.md index 42ebfb4c7f..0cf55cb3c4 100644 --- a/windows/deployment/planning/searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator.md +++ b/windows/deployment/planning/searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator.md @@ -33,41 +33,32 @@ For information about the Search feature, see [Searching for Fixed Applications >[!IMPORTANT] >You must perform your search with the correct version of the Compatibility Administrator tool. To use the Query tool to search for a 32-bit custom database, you must use the 32-bit version of Compatibility Administrator. To use the Query tool to search for a 64-bit custom database, you must use the 64-bit version of Compatibility Administrator. - - ## Querying by Using the Program Properties Tab - You can use the **Program Properties** tab of the Query tool to search for any compatibility fix, compatibility mode, or AppHelp for a specific application. **To query by using the Program Properties tab** -1. On the Compatibility Administrator toolbar, click **Query**. - -2. In the **Look in** drop-down list, select the appropriate database type to search. - -3. Type the location of the application you are searching for into the **Search for the Application** field. +1. On the Compatibility Administrator toolbar, click **Query**. +2. In the **Look in** drop-down list, select the appropriate database type to search. +3. Type the location of the application you are searching for into the **Search for the Application** field. This name should be the same as the name in the **Applications** area (left pane) of Compatibility Administrator. -4. Type the application executable (.exe) file name into the **Search for the File** box. If you leave this box blank, the percent (%) sign appears as a wildcard to search for any file. +4. Type the application executable (.exe) file name into the **Search for the File** box. If you leave this box blank, the percent (%) sign appears as a wildcard to search for any file. You must designate the executable name that was given when the compatibility fix was added to the database. -5. Optionally, select the check box for one of the following types of compatibility fix: +5. Optionally, select the check box for one of the following types of compatibility fix: - - **Compatibility Modes** - - - **Compatibility Fixes** - - - **Application Helps** + - **Compatibility Modes** + - **Compatibility Fixes** + - **Application Helps** > [!IMPORTANT]   > If you do not select any of the check boxes, the search will look for all types of compatibility fixes. Do not select multiple check boxes because only applications that match all of the requirements will appear. - - -6. Click **Find Now**. +6. Click **Find Now**. The query runs and the results of the query are displayed in the lower pane. @@ -78,53 +69,39 @@ You can use the **Fix Properties** tab of the Query tool to search for any appli **To query by using the Fix Properties tab** -1. On the Compatibility Administrator toolbar, click **Query**. +1. On the Compatibility Administrator toolbar, click **Query**. +2. Click the **Fix Properties** tab. +3. In the **Look in** drop-down list, select the appropriate database type to search. +4. Type the name of the compatibility fix or compatibility mode into the **Search for programs fixed using** field. -2. Click the **Fix Properties** tab. + >[!NOTE] + >You can use the percent (%) symbol as a wildcard in your fix-properties query, as a substitute for any string of zero or more characters -3. In the **Look in** drop-down list, select the appropriate database type to search. +5. Select the check box for either **Search in Compatibility Fixes** or **Search in Compatibility Modes**. -4. Type the name of the compatibility fix or compatibility mode into the **Search for programs fixed using** field. + >[!IMPORTANT] + >Your text must match the type of compatibility fix or mode for which you are performing the query. For example, entering the name of a compatibility fix and selecting the compatibility mode check box will not return any results. Additionally, if you select both check boxes, the query will search for the fix by compatibility mode and compatibility fix. Only applications that match both requirements appear. - > [!NOTE] - > You can use the percent (%) symbol as a wildcard in your fix-properties query, as a substitute for any string of zero or more characters. - - - -5. Select the check box for either **Search in Compatibility Fixes** or **Search in Compatibility Modes**. - - > [!IMPORTANT] - > Your text must match the type of compatibility fix or mode for which you are performing the query. For example, entering the name of a compatibility fix and selecting the compatibility mode check box will not return any results. Additionally, if you select both check boxes, the query will search for the fix by compatibility mode and compatibility fix. Only applications that match both requirements appear. - - - -6. Click **Find Now**. +6. Click **Find Now**. The query runs and the results of the query are displayed in the lower pane. ## Querying by Using the Fix Description Tab - You can use the **Fix Description** tab of the Query tool to add parameters that enable you to search your compatibility databases by application title or solution description text. **To query by using the Fix Description tab** -1. On the Compatibility Administrator toolbar, click **Query**. +1. On the Compatibility Administrator toolbar, click **Query**. +2. Click the **Fix Description** tab. +3. In the **Look in** drop-down list, select the appropriate database type to search. +4. Type your search keywords into the box **Words to look for**. Use commas to separate multiple keywords. -2. Click the **Fix Description** tab. + >[!IMPORTANT] + >You cannot use wildcards as part of the Fix Description search query because the default behavior is to search for any entry that meets your search criteria. -3. In the **Look in** drop-down list, select the appropriate database type to search. - -4. Type your search keywords into the box **Words to look for**. Use commas to separate multiple keywords. - - > [!IMPORTANT] - > You cannot use wildcards as part of the Fix Description search query because the default behavior is to search for any entry that meets your search criteria. - - - -5. Refine your search by selecting **Match any word** or **Match all words** from the drop-down list. - -6. Click **Find Now**. +5. Refine your search by selecting **Match any word** or **Match all words** from the drop-down list. +6. Click **Find Now**. The query runs and the results of the query are displayed in the lower pane. @@ -135,25 +112,22 @@ You can use the **Fix Description** tab of the Query tool to add additional SQL **To query by using the Advanced tab** -1. On the Compatibility Administrator toolbar, click **Query**. - -2. Click the **Advanced** tab. - -3. In the **Look in** drop-down list, select the appropriate database type to search. - -4. Select the appropriate SELECT clause for your search from the **Select clauses** box. For example, **APP\_NAME**. +1. On the Compatibility Administrator toolbar, click **Query**. +2. Click the **Advanced** tab. +3. In the **Look in** drop-down list, select the appropriate database type to search. +4. Select the appropriate SELECT clause for your search from the **Select clauses** box. For example, **APP\_NAME**. The **APP\_NAME** clause appears in the **SELECT** field. You can add as many additional clauses as you require. They will appear as columns in your search results. -5. Select the appropriate WHERE clause for your search from the **Where clauses** box. For example, **DATABASE\_NAME**. +5. Select the appropriate WHERE clause for your search from the **Where clauses** box. For example, **DATABASE\_NAME**. The **DATABASE\_NAME =** clause appears in the **WHERE** box. -6. Type the appropriate clause criteria after the equal (=) sign in the **WHERE** box. For example, **DATABASE\_NAME = "Custom\_Database"**. +6. Type the appropriate clause criteria after the equal (=) sign in the **WHERE** box. For example, **DATABASE\_NAME = "Custom\_Database"**. You must surround your clause criteria text with quotation marks (") for the clause to function properly. -7. Click **Find Now**. +7. Click **Find Now**. The query runs and the results of the query are displayed in the lower pane. @@ -164,11 +138,11 @@ You can export any of your search results into a tab-delimited text (.txt) file **To export your results** -1. After you have completed your search by using the Query tool, click **Export**. +1. After you have completed your search by using the Query tool, click **Export**. The **Save results to a file** dialog box appears. -2. Browse to the location where you intend to store the search results file, and then click **Save**. +2. Browse to the location where you intend to store the search results file, and then click **Save**. ## Related topics From e5c368fbf2f0f226a8b3e697767e2a0e006557c7 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 4 Sep 2019 14:04:33 -0700 Subject: [PATCH 29/49] move 2008 to ga Update preview topic, update what's new, remove preview in topic --- .../microsoft-defender-atp/configure-server-endpoints.md | 4 +--- .../threat-protection/microsoft-defender-atp/preview.md | 2 -- .../whats-new-in-microsoft-defender-atp.md | 5 +++++ 3 files changed, 6 insertions(+), 5 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md b/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md index f32ee1c0e8..0687aa77f4 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md @@ -20,15 +20,13 @@ ms.topic: article **Applies to:** -- Windows Server 2008 R2 SP1 (pre-release) +- Windows Server 2008 R2 SP1 - Windows Server 2012 R2 - Windows Server 2016 - Windows Server, version 1803 - Windows Server, 2019 - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -[!include[Prerelease information](prerelease.md)] - >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configserver-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/preview.md b/windows/security/threat-protection/microsoft-defender-atp/preview.md index ef667cd6c0..672accaabf 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/preview.md +++ b/windows/security/threat-protection/microsoft-defender-atp/preview.md @@ -45,8 +45,6 @@ The following features are included in the preview release: - [Evaluation lab](evaluation-lab.md)
The Microsoft Defender ATP evaluation lab is designed to eliminate the complexities of machine and environment configuration so that you can focus on evaluating the capabilities of the platform, running simulations, and seeing the prevention, detection, and remediation features in action. -- [Windows Server 2008 R2 SP1](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints#windows-server-2008-r2-sp1--windows-server-2012-r2-and-windows-server-2016)
You can now onboard Windows Server 2008 R2 SP1. - - [Microsoft Defender ATP for Mac](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac)
Microsoft Defender ATP for Mac brings the next-generation protection, and endpoint detection and response coverage to Mac devices. Core components of the unified endpoint security platform will now be available for Mac devices. - [Live response](live-response.md)
Get instantaneous access to a machine using a remote shell connection. Do in-depth investigative work and take immediate response actions to promptly contain identified threats – real-time. diff --git a/windows/security/threat-protection/microsoft-defender-atp/whats-new-in-microsoft-defender-atp.md b/windows/security/threat-protection/microsoft-defender-atp/whats-new-in-microsoft-defender-atp.md index ca56b9c2fd..10cba3e6d8 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/whats-new-in-microsoft-defender-atp.md +++ b/windows/security/threat-protection/microsoft-defender-atp/whats-new-in-microsoft-defender-atp.md @@ -28,6 +28,11 @@ The following features are generally available (GA) in the latest release of Mic For more information preview features, see [Preview features](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection). + +## September 2019 +- [Windows Server 2008 R2 SP1](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints#windows-server-2008-r2-sp1--windows-server-2012-r2-and-windows-server-2016)
You can now onboard Windows Server 2008 R2 SP1. + + ## June 2019 - [Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md)
A new built-in capability that uses a risk-based approach to the discovery, prioritization, and remediation of endpoint vulnerabilities and misconfigurations. From f8bb6106c6db3fcdb34ba28d68405197c577ae30 Mon Sep 17 00:00:00 2001 From: Dani Halfin Date: Wed, 4 Sep 2019 14:39:52 -0700 Subject: [PATCH 30/49] fixing note block issues --- ...lity-fix-in-compatibility-administrator.md | 24 ++++++------- ...ery-tool-in-compatibility-administrator.md | 22 +++++------- ...rstanding-and-using-compatibility-fixes.md | 16 ++++----- .../planning/windows-to-go-overview.md | 36 ++++++++----------- 4 files changed, 40 insertions(+), 58 deletions(-) diff --git a/windows/deployment/planning/creating-a-custom-compatibility-fix-in-compatibility-administrator.md b/windows/deployment/planning/creating-a-custom-compatibility-fix-in-compatibility-administrator.md index 5a005d4eb7..ade1b441fe 100644 --- a/windows/deployment/planning/creating-a-custom-compatibility-fix-in-compatibility-administrator.md +++ b/windows/deployment/planning/creating-a-custom-compatibility-fix-in-compatibility-administrator.md @@ -19,19 +19,17 @@ ms.topic: article **Applies to** -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 +- Windows 10 +- Windows 8.1 +- Windows 8 +- Windows 7 +- Windows Server 2012 +- Windows Server 2008 R2 The Compatibility Administrator tool uses the term *fix* to describe the combination of compatibility information added to a customized database for a specific application. This combination can include single application fixes, groups of fixes that work together as a compatibility mode, and blocking and non-blocking AppHelp messages. ->[!IMPORTANT]   ->Fixes apply to a single application only; therefore, you must create multiple fixes if you need to fix the same issue in multiple applications. - - +> [!IMPORTANT] +> Fixes apply to a single application only; therefore, you must create multiple fixes if you need to fix the same issue in multiple applications. ## What is a Compatibility Fix? @@ -43,10 +41,8 @@ A compatibility fix, previously known as a shim, is a small piece of code that i The Compatibility Administrator tool has preloaded fixes for many common applications, including known compatibility fixes, compatibility modes, and AppHelp messages. Before you create a new compatibility fix, you can search for an existing application and then copy and paste the known fixes into your customized database. ->[!IMPORTANT] ->Application Compatibility Toolkit (ACT) installs a 32-bit and a 64-bit version of the Compatibility Administrator tool. You must use the 32-bit version to create custom databases for 32-bit applications and the 64-bit version to create custom databases for 64-bit applications. - - +> [!IMPORTANT] +> Application Compatibility Toolkit (ACT) installs a 32-bit and a 64-bit version of the Compatibility Administrator tool. You must use the 32-bit version to create custom databases for 32-bit applications and the 64-bit version to create custom databases for 64-bit applications. **To search for an existing application** diff --git a/windows/deployment/planning/searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator.md b/windows/deployment/planning/searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator.md index 42ebfb4c7f..ea3e59d28b 100644 --- a/windows/deployment/planning/searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator.md +++ b/windows/deployment/planning/searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator.md @@ -19,25 +19,22 @@ ms.topic: article **Applies to** -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 +- Windows 10 +- Windows 8.1 +- Windows 8 +- Windows 7 +- Windows Server 2012 +- Windows Server 2008 R2 You can access the Query tool from within Compatibility Administrator. The Query tool provides the same functionality as using the Search feature. For information about the Search feature, see [Searching for Fixed Applications in Compatibility Administrator](searching-for-fixed-applications-in-compatibility-administrator.md). However, the Query tool provides more detailed search criteria, including tabs that enable you to search the program properties, the compatibility fix properties, and the fix description. You can perform a search by using SQL SELECT and WHERE clauses, in addition to searching specific types of databases. ->[!IMPORTANT] ->You must perform your search with the correct version of the Compatibility Administrator tool. To use the Query tool to search for a 32-bit custom database, you must use the 32-bit version of Compatibility Administrator. To use the Query tool to search for a 64-bit custom database, you must use the 64-bit version of Compatibility Administrator. - - +> [!IMPORTANT] +> You must perform your search with the correct version of the Compatibility Administrator tool. To use the Query tool to search for a 32-bit custom database, you must use the 32-bit version of Compatibility Administrator. To use the Query tool to search for a 64-bit custom database, you must use the 64-bit version of Compatibility Administrator. ## Querying by Using the Program Properties Tab - You can use the **Program Properties** tab of the Query tool to search for any compatibility fix, compatibility mode, or AppHelp for a specific application. **To query by using the Program Properties tab** @@ -62,9 +59,8 @@ You can use the **Program Properties** tab of the Query tool to search for any c - **Application Helps** - > [!IMPORTANT]   + > [!IMPORTANT] > If you do not select any of the check boxes, the search will look for all types of compatibility fixes. Do not select multiple check boxes because only applications that match all of the requirements will appear. - 6. Click **Find Now**. diff --git a/windows/deployment/planning/understanding-and-using-compatibility-fixes.md b/windows/deployment/planning/understanding-and-using-compatibility-fixes.md index fab1e74808..fe43dd8983 100644 --- a/windows/deployment/planning/understanding-and-using-compatibility-fixes.md +++ b/windows/deployment/planning/understanding-and-using-compatibility-fixes.md @@ -18,12 +18,12 @@ ms.topic: article **Applies to** -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 +- Windows 10 +- Windows 8.1 +- Windows 8 +- Windows 7 +- Windows Server 2012 +- Windows Server 2008 R2 As the Windows operating system evolves to support new technology and functionality, the implementations of some functions may change. This can cause problems for applications that relied upon the original implementation. You can avoid compatibility issues by using the Microsoft Windows Application Compatibility (Compatibility Fix) infrastructure to create a specific application fix for a particular version of an application. @@ -54,11 +54,9 @@ There are important considerations to keep in mind when determining your applica - The compatibility fixes run as user-mode code inside of a user-mode application process. This means that you cannot use a compatibility fix to fix kernel-mode code issues. For example, you cannot use a compatibility fix to resolve device-driver issues. - > [!NOTE]  + > [!NOTE] > Some antivirus, firewall, and anti-spyware code runs in kernel mode. - - ## Determining When to Use a Compatibility Fix The decision to use compatibility fixes to remedy your compatibility issues may involve more than just technical issues. The following scenarios reflect other common reasons for using a compatibility fix. diff --git a/windows/deployment/planning/windows-to-go-overview.md b/windows/deployment/planning/windows-to-go-overview.md index f25da887d0..cbbfa9a287 100644 --- a/windows/deployment/planning/windows-to-go-overview.md +++ b/windows/deployment/planning/windows-to-go-overview.md @@ -20,24 +20,22 @@ ms.topic: article **Applies to** -- Windows 10 +- Windows 10 >[!IMPORTANT] >Windows To Go is no longer being developed. The feature does not support feature updates and therefore does not enable you to stay current. It also requires a specific type of USB that is no longer supported by many OEMs. -Windows To Go is a feature in Windows 10 Enterprise and Windows 10 Education that enables the creation of a Windows To Go workspace that can be booted from a USB-connected external drive on PCs. +Windows To Go is a feature in Windows 10 Enterprise and Windows 10 Education that enables the creation of a Windows To Go workspace that can be booted from a USB-connected external drive on PCs. -PCs that meet the Windows 7 or later [certification requirements](https://go.microsoft.com/fwlink/p/?LinkId=618711) can run Windows 10 in a Windows To Go workspace, regardless of the operating system running on the PC. Windows To Go workspaces can use the same image enterprises use for their desktops and laptops and can be managed the same way. Windows To Go is not intended to replace desktops, laptops or supplant other mobility offerings. Rather, it provides support for efficient use of resources for alternative workplace scenarios. There are some additional considerations that you should keep in mind before you start to use Windows To Go: +PCs that meet the Windows 7 or later [certification requirements](https://go.microsoft.com/fwlink/p/?LinkId=618711) can run Windows 10 in a Windows To Go workspace, regardless of the operating system running on the PC. Windows To Go workspaces can use the same image enterprises use for their desktops and laptops and can be managed the same way. Windows To Go is not intended to replace desktops, laptops or supplant other mobility offerings. Rather, it provides support for efficient use of resources for alternative workplace scenarios. There are some additional considerations that you should keep in mind before you start to use Windows To Go: - [Differences between Windows To Go and a typical installation of Windows](#bkmk-wtgdif) - [Roaming with Windows To Go](#bkmk-wtgroam) - [Prepare for Windows To Go](#wtg-prep-intro) - [Hardware considerations for Windows To Go](#wtg-hardware) ->[!NOTE] ->Windows To Go is not supported on Windows RT. - - +> [!NOTE] +> Windows To Go is not supported on Windows RT. ## Differences between Windows To Go and a typical installation of Windows @@ -67,8 +65,6 @@ These same tools can be used to provision Windows To Go drive, just as you would > [!IMPORTANT] > Make sure you use the versions of the deployment tools provided for the version of Windows you are deploying. There have been many enhancements made to support Windows To Go. Using versions of the deployment tools released for earlier versions of Windows to provision a Windows To Go drive is not supported. - - As you decide what to include in your Windows To Go image, be sure to consider the following questions: Are there any drivers that you need to inject into the image? @@ -85,7 +81,6 @@ For more information about designing and planning your Windows To Go deployment, ## Hardware considerations for Windows To Go - **For USB drives** The devices listed in this section have been specially optimized and certified for Windows To Go and meet the necessary requirements for booting and running a full version of Windows 10 from a USB drive. The optimizations for Windows To Go include the following: @@ -96,8 +91,8 @@ The devices listed in this section have been specially optimized and certified f As of the date of publication, the following are the USB drives currently certified for use as Windows To Go drives: -**Warning**   -Using a USB drive that has not been certified is not supported +> [!WARNING] +> Using a USB drive that has not been certified is not supported. @@ -111,15 +106,14 @@ Using a USB drive that has not been certified is not supported - Spyrus Secure Portable Workplace ([http://www.spyruswtg.com/](https://go.microsoft.com/fwlink/p/?LinkId=618720)) - > [!IMPORTANT]   + > [!IMPORTANT] > You must use the Spyrus Deployment Suite for Windows To Go to provision the Spyrus Secure Portable Workplace. For more information about the Spyrus Deployment Suite for Windows To Go please refer to [http://www.spyruswtg.com/](https://go.microsoft.com/fwlink/p/?LinkId=618720). - Spyrus Worksafe ([http://www.spyruswtg.com/](https://go.microsoft.com/fwlink/p/?LinkId=618720)) - **Tip**   - This device contains an embedded smart card. - + > [!TIP] + > This device contains an embedded smart card. - Super Talent Express RC4 for Windows To Go @@ -138,8 +132,8 @@ Using a USB drive that has not been certified is not supported When assessing the use of a PC as a host for a Windows To Go workspace you should consider the following criteria: -- Hardware that has been certified for use with Windows 7or later operating systems will work well with Windows To Go. -- Running a Windows To Go workspace from a computer that is running Windows RT is not a supported scenario. +- Hardware that has been certified for use with Windows 7 or later operating systems will work well with Windows To Go. +- Running a Windows To Go workspace from a computer that is running Windows RT is not a supported scenario. - Running a Windows To Go workspace on a Mac computer is not a supported scenario. The following table details the characteristics that the host computer must have to be used with Windows To Go: @@ -162,7 +156,7 @@ The following table details the characteristics that the host computer must have

Firmware

-

USB boot enabled. (PCs certified for use with Windows 7 or later can be configured to boot directly from USB, check with the hardware manufacturer if you are unsure of the ability of your PC to boot from USB)

+

USB boot enabled. (PCs certified for use with Windows 7 or later can be configured to boot directly from USB, check with the hardware manufacturer if you are unsure of the ability of your PC to boot from USB)

Processor architecture

@@ -191,11 +185,9 @@ The following table details the characteristics that the host computer must have - - **Checking for architectural compatibility between the host PC and the Windows To Go drive** -In addition to the USB boot support in the BIOS, the Windows 10 image on your Windows To Go drive must be compatible with the processor architecture and the firmware of the host PC as shown in the table below. +In addition to the USB boot support in the BIOS, the Windows 10 image on your Windows To Go drive must be compatible with the processor architecture and the firmware of the host PC as shown in the table below. From c99870ce288b833508ec1038ae7d9d239148c99b Mon Sep 17 00:00:00 2001 From: Dani Halfin Date: Wed, 4 Sep 2019 14:55:58 -0700 Subject: [PATCH 31/49] hopefully last fix --- windows/deployment/planning/windows-to-go-overview.md | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/windows/deployment/planning/windows-to-go-overview.md b/windows/deployment/planning/windows-to-go-overview.md index 44ca391544..57d74a1341 100644 --- a/windows/deployment/planning/windows-to-go-overview.md +++ b/windows/deployment/planning/windows-to-go-overview.md @@ -50,14 +50,12 @@ Windows To Go workspace operates just like any other installation of Windows wit ## Roaming with Windows To Go - Windows To Go drives can be booted on multiple computers. When a Windows To Go workspace is first booted on a host computer it will detect all hardware on the computer and install any needed drivers. When the Windows To Go workspace is subsequently booted on that host computer it will be able to identify the host computer and load the correct set of drivers automatically. The applications that you want to use from the Windows To Go workspace should be tested to make sure they also support roaming. Some applications bind to the computer hardware which will cause difficulties if the workspace is being used with multiple host computers. ## Prepare for Windows To Go - Enterprises install Windows on a large group of computers either by using configuration management software (such as System Center Configuration Manager), or by using standard Windows deployment tools such as DiskPart and the Deployment Image Servicing and Management (DISM) tool. These same tools can be used to provision Windows To Go drive, just as you would if you were planning for provisioning a new class of mobile PCs. You can use the [Windows Assessment and Deployment Kit](https://go.microsoft.com/fwlink/p/?LinkId=526803) to review deployment tools available. @@ -83,10 +81,10 @@ For more information about designing and planning your Windows To Go deployment, **For USB drives** -The devices listed in this section have been specially optimized and certified for Windows To Go and meet the necessary requirements for booting and running a full version of Windows 10 from a USB drive. The optimizations for Windows To Go include the following: +The devices listed in this section have been specially optimized and certified for Windows To Go and meet the necessary requirements for booting and running a full version of Windows 10 from a USB drive. The optimizations for Windows To Go include the following: - Windows To Go certified USB drives are built for high random read/write speeds and support the thousands of random access I/O operations per second required for running normal Windows workloads smoothly. -- Windows To Go certified USB drives have been tuned to ensure they boot and run on hardware certified for use with Windows 7 and later. +- Windows To Go certified USB drives have been tuned to ensure they boot and run on hardware certified for use with Windows 7 and later. - Windows To Go certified USB drives are built to last. Certified USB drives are backed with manufacturer warranties and should continue operating under normal usage. Refer to the manufacturer websites for warranty details. As of the date of publication, the following are the USB drives currently certified for use as Windows To Go drives: @@ -94,8 +92,6 @@ As of the date of publication, the following are the USB drives currently certif > [!WARNING] > Using a USB drive that has not been certified is not supported. - - - IronKey Workspace W700 ([http://www.ironkey.com/windows-to-go-drives/ironkey-workspace-w700.html](https://go.microsoft.com/fwlink/p/?LinkId=618714)) - IronKey Workspace W500 ([http://www.ironkey.com/windows-to-go-drives/ironkey-workspace-w500.html](https://go.microsoft.com/fwlink/p/?LinkId=618717)) - IronKey Workspace W300 ([http://www.ironkey.com/windows-to-go-drives/ironkey-workspace-w300.html](https://go.microsoft.com/fwlink/p/?LinkId=618718)) @@ -114,6 +110,7 @@ As of the date of publication, the following are the USB drives currently certif > [!TIP] > This device contains an embedded smart card. + - Super Talent Express RC4 for Windows To Go From d88cbc6567b4fb0461043f9979c32855003e1c38 Mon Sep 17 00:00:00 2001 From: John Liu <49762389+ShenLanJohn@users.noreply.github.com> Date: Wed, 4 Sep 2019 15:15:29 -0700 Subject: [PATCH 32/49] CAT Auto Pulish for Windows Release Messages - CAT_AutoPublish_20190904142624 (#1046) --- windows/release-information/status-windows-10-1903.yml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/windows/release-information/status-windows-10-1903.yml b/windows/release-information/status-windows-10-1903.yml index 72034e1a27..9201d1cb20 100644 --- a/windows/release-information/status-windows-10-1903.yml +++ b/windows/release-information/status-windows-10-1903.yml @@ -65,6 +65,7 @@ sections: - type: markdown text: "
This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

+ @@ -89,6 +90,15 @@ sections:
" +- title: September 2019 +- items: + - type: markdown + text: " +
SummaryOriginating updateStatusLast updated
Windows Desktop Search may not return any results and may have high CPU usage
Windows Desktop Search may not return any results and SearchUI.exe may have high CPU usage after installing KB4512941.

See details >		OS Build 18362.329

August 30, 2019
KB4512941		Investigating
September 04, 2019
02:25 PM PT
Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
Applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and VBScript may stop responding and you may receive an error.

See details >		OS Build 18362.295

August 13, 2019
KB4512508		Resolved
KB4512941		August 30, 2019
10:00 AM PT
Issues updating when certain versions of Intel storage drivers are installed
Certain versions of Intel Rapid Storage Technology (Intel RST) drivers may cause updating to Windows 10, version 1903 to fail.

See details >		OS Build 18362.145

May 29, 2019
KB4497935		Resolved
KB4512941		August 30, 2019
10:00 AM PT
Initiating a Remote Desktop connection may result in black screen
When initiating a Remote Desktop connection to devices with some older GPU drivers, you may receive a black screen.

See details >		OS Build 18362.145

May 29, 2019
KB4497935		Resolved
KB4512941		August 30, 2019
10:00 AM PT
+ +
DetailsOriginating updateStatusHistory
Windows Desktop Search may not return any results and may have high CPU usage
Microsoft is getting reports that a small number of users may not receive results when using Windows Desktop Search and may see high CPU usage from SearchUI.exe when searching after installing KB4512941. This issue is only encountered on devices in which searching the web from Windows Desktop Search has been disabled.

Affected platforms:
  • Client: Windows 10, version 1903
Next steps: We are working on a resolution and estimate a solution will be available in mid-September.

Back to top		OS Build 18362.329

August 30, 2019
KB4512941		Investigating
Last updated:
September 04, 2019
02:25 PM PT

Opened:
September 04, 2019
02:25 PM PT
+ " + - title: August 2019 - items: - type: markdown From 081d55f197bc9eddcc1cc3cde2a94f93fa270b12 Mon Sep 17 00:00:00 2001 From: Tudor Dobrila Date: Wed, 4 Sep 2019 15:46:56 -0700 Subject: [PATCH 33/49] Update MAU config for Intune; minor fix to JAMF documentation --- ...soft-defender-atp-mac-install-with-jamf.md | 4 +- .../microsoft-defender-atp-mac-updates.md | 64 +++++++++++++++++++ 2 files changed, 67 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md index 44f2ed7150..554c07f40a 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md @@ -198,7 +198,9 @@ You can check that devices have been correctly onboarded by creating a script. F mdatp --health healthy ``` -This script returns: +The above commands prints "1" if the product is onboarded and functioning as expected. + +If the product is not healthy, the exit code (which can be checked through `echo $?`) indicates the problem: - 0 if Microsoft Defender ATP is registered with the Microsoft Defender ATP service - 1 if the device is not yet onboarded - 3 if the connection to the daemon cannot be established—for example, if the daemon is not running diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-updates.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-updates.md index dde9d19622..af5f8b3577 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-updates.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-updates.md @@ -116,6 +116,8 @@ The following configuration profile is used to: - Enable the "Check for updates" button in the user interface - Allow users on the device to enroll into the Insider channels +### JAMF + ```XML @@ -135,6 +137,68 @@ The following configuration profile is used to: ``` +### Intune + +```XML + + + + + PayloadUUID + B762FF60-6ACB-4A72-9E72-459D00C936F3 + PayloadType + Configuration + PayloadOrganization + Microsoft + PayloadIdentifier + com.microsoft.autoupdate2 + PayloadDisplayName + Microsoft Auto-Update settings + PayloadDescription + Microsoft Auto-Update configuration settings + PayloadVersion + 1 + PayloadEnabled + + PayloadRemovalDisallowed + + PayloadScope + System + PayloadContent + + + PayloadUUID + 5A6F350A-CC2C-440B-A074-68E3F34EBAE9 + PayloadType + com.microsoft.autoupdate2 + PayloadOrganization + Microsoft + PayloadIdentifier + com.microsoft.autoupdate2 + PayloadDisplayName + Microsoft Auto-Update configuration settings + PayloadDescription + + PayloadVersion + 1 + PayloadEnabled + + ChannelName + InsiderFast + HowToCheck + AutomaticDownload + EnableCheckForUpdatesButton + + DisableInsiderCheckbox + + SendAllTelemetryEnabled + + + + + +``` + To configure MAU, you can deploy this configuration profile from the management tool that your enterprise is using: - From JAMF, upload this configuration profile and set the Preference Domain to *com.microsoft.autoupdate2*. - From Intune, upload this configuration profile and set the custom configuration profile name to *com.microsoft.autoupdate2*. From a3ac7e1cab13741afb9ee73af026a8d6c793df05 Mon Sep 17 00:00:00 2001 From: Tudor Dobrila Date: Wed, 4 Sep 2019 15:48:05 -0700 Subject: [PATCH 34/49] Spacing --- .../microsoft-defender-atp-mac-install-with-jamf.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md index 554c07f40a..bf8a1373a4 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md @@ -200,7 +200,7 @@ mdatp --health healthy The above commands prints "1" if the product is onboarded and functioning as expected. -If the product is not healthy, the exit code (which can be checked through `echo $?`) indicates the problem: +If the product is not healthy, the exit code (which can be checked through `echo $?`) indicates the problem: - 0 if Microsoft Defender ATP is registered with the Microsoft Defender ATP service - 1 if the device is not yet onboarded - 3 if the connection to the daemon cannot be established—for example, if the daemon is not running From ba8fa891256426057b6cda38cdcf5eb4e1d94366 Mon Sep 17 00:00:00 2001 From: Tudor Dobrila Date: Wed, 4 Sep 2019 15:56:17 -0700 Subject: [PATCH 35/49] Document option to disable check for updates button --- .../microsoft-defender-atp-mac-updates.md | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-updates.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-updates.md index af5f8b3577..8ef53f69df 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-updates.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-updates.md @@ -86,6 +86,17 @@ Change how MAU searches for updates. | **Possible values** | Manual
AutomaticCheck
AutomaticDownload | | **Comment** | Note that AutomaticDownload will do a download and install silently if possible. | +### Change whether the "Check for Updates" button is enabled + +Change whether local users will be able to click the "Check for Updates" option in the Microsoft Auto-Update user interface. + +||| +|:---|:---| +| **Domain** | com.microsoft.autoupdate2 | +| **Key** | EnableCheckForUpdatesButton | +| **Data type** | Boolean | +| **Possible values** | True (default)
False | + ### Disable Insider checkbox Set to true to make the "Join the Office Insider Program..." checkbox unavailable / greyed out to users. From b98bfc64abfc69e35adc4e8ef1e906de1e42fb62 Mon Sep 17 00:00:00 2001 From: Tudor Dobrila Date: Wed, 4 Sep 2019 16:13:54 -0700 Subject: [PATCH 36/49] Typo --- .../microsoft-defender-atp-mac-install-with-jamf.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md index bf8a1373a4..ef76d78529 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md @@ -198,7 +198,7 @@ You can check that devices have been correctly onboarded by creating a script. F mdatp --health healthy ``` -The above commands prints "1" if the product is onboarded and functioning as expected. +The above command prints "1" if the product is onboarded and functioning as expected. If the product is not healthy, the exit code (which can be checked through `echo $?`) indicates the problem: - 0 if Microsoft Defender ATP is registered with the Microsoft Defender ATP service From 3ec6f29488ec738e5032e956f976b40c7aecd346 Mon Sep 17 00:00:00 2001 From: Tudor Dobrila Date: Wed, 4 Sep 2019 16:18:38 -0700 Subject: [PATCH 37/49] Minor tweaks --- .../microsoft-defender-atp-mac-updates.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-updates.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-updates.md index 8ef53f69df..50267f26bb 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-updates.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-updates.md @@ -34,7 +34,7 @@ If you decide to deploy updates by using your software distribution tools, you s ## Use msupdate -MAU includes a command line tool, called *msupdate*, that is designed for IT administrators so that they have more precise control over when updates are applied. Instructions for how to use this tool can be found in [Update Office for Mac by using msupdate](https://docs.microsoft.com/deployoffice/mac/update-office-for-mac-using-msupdate). +MAU includes a command-line tool, called *msupdate*, that is designed for IT administrators so that they have more precise control over when updates are applied. Instructions for how to use this tool can be found in [Update Office for Mac by using msupdate](https://docs.microsoft.com/deployoffice/mac/update-office-for-mac-using-msupdate). In MAU, the application identifier for Microsoft Defender ATP for Mac is *WDAV00*. To download and install the latest updates for Microsoft Defender ATP for Mac, execute the following command from a Terminal window: @@ -88,7 +88,7 @@ Change how MAU searches for updates. ### Change whether the "Check for Updates" button is enabled -Change whether local users will be able to click the "Check for Updates" option in the Microsoft Auto-Update user interface. +Change whether local users will be able to click the "Check for Updates" option in the Microsoft AutoUpdate user interface. ||| |:---|:---| @@ -164,9 +164,9 @@ The following configuration profile is used to: PayloadIdentifier com.microsoft.autoupdate2 PayloadDisplayName - Microsoft Auto-Update settings + Microsoft AutoUpdate settings PayloadDescription - Microsoft Auto-Update configuration settings + Microsoft AutoUpdate configuration settings PayloadVersion 1 PayloadEnabled @@ -187,7 +187,7 @@ The following configuration profile is used to: PayloadIdentifier com.microsoft.autoupdate2 PayloadDisplayName - Microsoft Auto-Update configuration settings + Microsoft AutoUpdate configuration settings PayloadDescription PayloadVersion From b3041f284846314b19071329edb232ab129c4855 Mon Sep 17 00:00:00 2001 From: Dani Halfin Date: Wed, 4 Sep 2019 16:22:02 -0700 Subject: [PATCH 38/49] Update deployment-considerations-for-windows-to-go.md --- ...oyment-considerations-for-windows-to-go.md | 52 +++++++++---------- 1 file changed, 26 insertions(+), 26 deletions(-) diff --git a/windows/deployment/planning/deployment-considerations-for-windows-to-go.md b/windows/deployment/planning/deployment-considerations-for-windows-to-go.md index 9f061b127a..022ac067c8 100644 --- a/windows/deployment/planning/deployment-considerations-for-windows-to-go.md +++ b/windows/deployment/planning/deployment-considerations-for-windows-to-go.md @@ -20,15 +20,15 @@ ms.topic: article **Applies to** -- Windows 10 +- Windows 10 ->[!IMPORTANT] ->Windows To Go is no longer being developed. The feature does not support feature updates and therefore does not enable you to stay current. It also requires a specific type of USB that is no longer supported by many OEMs. +> [!IMPORTANT] +> Windows To Go is no longer being developed. The feature does not support feature updates and therefore does not enable you to stay current. It also requires a specific type of USB that is no longer supported by many OEMs. From the start, Windows To Go was designed to minimize differences between the user experience of working on a laptop and Windows To Go booted from a USB drive. Given that Windows To Go was designed as an enterprise solution, extra consideration was given to the deployment workflows that enterprises already have in place. Additionally, there has been a focus on minimizing the number of differences in deployment between Windows To Go workspaces and laptop PCs. ->[!NOTE] ->Windows To Go does not support operating system upgrades. Windows To Go is designed as a feature that is managed centrally. IT departments that plan to transition from one operating system version to a later version will need to incorporate re-imaging their existing Windows To Go drives as part of their upgrade deployment process. +> [!NOTE] +> Windows To Go does not support operating system upgrades. Windows To Go is designed as a feature that is managed centrally. IT departments that plan to transition from one operating system version to a later version will need to incorporate re-imaging their existing Windows To Go drives as part of their upgrade deployment process. The following sections discuss the boot experience, deployment methods, and tools that you can use with Windows To Go. @@ -53,29 +53,29 @@ When a Windows To Go workspace is first used at the workplace, the Windows To Go When the Windows To Go workspace is going to be used first on an off-premises computer, such as one at the employee’s home, then the IT professional preparing the Windows To Go drives should configure the drive to be able to connect to organizational resources and to maintain the security of the workspace. In this situation, the Windows To Go workspace needs to be configured for offline domain join and BitLocker needs to be enabled before the workspace has been initialized. -**Tip**   -Applying BitLocker Drive Encryption to the drives before provisioning is a much faster process than encrypting the drives after data has already been stored on them due to a new feature called used-disk space only encryption. For more information, see [What's New in BitLocker](https://go.microsoft.com/fwlink/p/?LinkId=619076). +> [!TIP] +> Applying BitLocker Drive Encryption to the drives before provisioning is a much faster process than encrypting the drives after data has already been stored on them due to a new feature called used-disk space only encryption. For more information, see [What's New in BitLocker](https://go.microsoft.com/fwlink/p/?LinkId=619076). DirectAccess can be used to ensure that the user can login with their domain credentials without needing a local account. For instructions on setting up a DirectAccess solution, for a small pilot deployment see [Deploy a Single Remote Access Server using the Getting Started Wizard](https://go.microsoft.com/fwlink/p/?LinkId=619077) for a larger scale deployment, see [Deploy Remote Access in an Enterprise](https://go.microsoft.com/fwlink/p/?LinkId=619078). If you do not want to use DirectAccess as an alternative users could log on using a local user account on the Windows To Go workspace and then use a virtual private network for remote access to your organizational network. ### Image deployment and drive provisioning considerations -The Image Deployment process can be accomplished either by a centralized IT process for your organization or by individual users creating their own Windows To Go workspaces. You must have local Administrator access and access to a Windows 10 Enterprise or Windows 10 Education image to create a Windows To Go workspace, or you must be using System Center Configuration Manager 2012 Service Pack 1 or later to distribute Windows To Go workspaces to users. The image deployment process takes a blank USB drive and a Windows 10 Enterprise image (WIM) and turns it into a Windows To Go drive. +The Image Deployment process can be accomplished either by a centralized IT process for your organization or by individual users creating their own Windows To Go workspaces. You must have local Administrator access and access to a Windows 10 Enterprise or Windows 10 Education image to create a Windows To Go workspace, or you must be using System Center Configuration Manager 2012 Service Pack 1 or later to distribute Windows To Go workspaces to users. The image deployment process takes a blank USB drive and a Windows 10 Enterprise image (WIM) and turns it into a Windows To Go drive. ![windows to go image deployment](images/wtg-image-deployment.gif) The simplest way to provision a Windows To Go drive is to use the Windows To Go Creator. After a single Windows To Go workspace has been created, it can be duplicated as many times as necessary using widely available USB duplicator products as long as the device has not been booted. After the Windows To Go drive is initialized, it should not be duplicated. Alternatively, Windows To Go Workspace Creator can be run multiple times to create multiple Windows To Go drives. -**Tip**   -When you create your Windows To Go image use sysprep /generalize, just as you do when you deploy Windows 10 to a standard PC. In fact, if appropriate, use the same image for both deployments. +> [!TIP] +> When you create your Windows To Go image use sysprep /generalize, just as you do when you deploy Windows 10 to a standard PC. In fact, if appropriate, use the same image for both deployments. **Driver considerations** Windows includes most of the drivers that you will need to support a wide variety of host computers. However, you will occasionally need to download drivers from Windows Update to take advantage of the full functionality of a device. If you are using Windows To Go on a set of known host computers, you can add any additional drivers to the image used on Windows To Go to make Windows To Go drives more quickly usable by your employees. Especially ensure that network drivers are available so that the user can connect to Windows Update to get additional drivers if necessary. -Wi-Fi network adapter drivers are one of the most important drivers to make sure that you include in your standard image so that users can easily connect to the internet for any additional updates. IT administrators that are attempting to build Windows 10 images for use with Windows To Go should consider adding additional Wi-Fi drivers to their image to ensure that their users have the best chance of still having basic network connectivity when roaming between systems. +Wi-Fi network adapter drivers are one of the most important drivers to make sure that you include in your standard image so that users can easily connect to the internet for any additional updates. IT administrators that are attempting to build Windows 10 images for use with Windows To Go should consider adding additional Wi-Fi drivers to their image to ensure that their users have the best chance of still having basic network connectivity when roaming between systems. -The following list of commonly used Wi-Fi network adapters that are not supported by the default drivers provided with Windows 10 is provided to help you ascertain whether or not you need to add drivers to your image. +The following list of commonly used Wi-Fi network adapters that are not supported by the default drivers provided with Windows 10 is provided to help you ascertain whether or not you need to add drivers to your image. @@ -227,7 +227,7 @@ Unless you are using a customized Windows image that includes unattended install In general, management of Windows To Go workspaces is same as that for desktop and laptop computers. There are Windows To Go specific Group Policy settings that should be considered as part of Windows To Go deployment. Windows To Go Group Policy settings are located at `\\Computer Configuration\Administrative Templates\Windows Components\Portable Operating System\` in the Local Group Policy Editor. -The use of the Store on Windows To Go workspaces that are running Windows 8 can also be controlled by Group Policy. This policy setting is located at `\\Computer Configuration\Administrative Templates\Windows Components\Store\` in the Local Group Policy Editor. The policy settings have specific implications for Windows To Go that you should be aware of when planning your deployment: +The use of the Store on Windows To Go workspaces that are running Windows 8 can also be controlled by Group Policy. This policy setting is located at `\\Computer Configuration\Administrative Templates\Windows Components\Store\` in the Local Group Policy Editor. The policy settings have specific implications for Windows To Go that you should be aware of when planning your deployment: **Settings for workspaces** @@ -235,8 +235,8 @@ The use of the Store on Windows To Go workspaces that are running Windows 8 can This policy setting specifies whether the PC can use the hibernation sleep state (S4) when started from a Windows To Go workspace. By default, hibernation is disabled when using Windows To Go workspace, so enabling this setting explicitly turns this ability back on. When a computer enters hibernation, the contents of memory are written to disk. When the disk is resumed, it is important that the hardware attached to the system, as well as the disk itself, are unchanged. This is inherently incompatible with roaming between PC hosts. Hibernation should only be used when the Windows To Go workspace is not being used to roam between host PCs. - >[!IMPORTANT]   - >For the host-PC to resume correctly when hibernation is enabled the Windows To Go workspace must continue to use the same USB port. + > [!IMPORTANT] + > For the host-PC to resume correctly when hibernation is enabled the Windows To Go workspace must continue to use the same USB port. - **Disallow standby sleep states (S1-S3) when starting from a Windows To Go workspace** @@ -248,27 +248,27 @@ The use of the Store on Windows To Go workspaces that are running Windows 8 can This policy setting controls whether the host computer will boot to Windows To Go if a USB device containing a Windows To Go workspace is connected, and controls whether users can make changes using the **Windows To Go Startup Options** settings dialog. If you enable this policy setting, booting to Windows To Go when a USB device is connected will be enabled and users will not be able to make changes using the **Windows To Go Startup Options** settings dialog. If you disable this policy setting, booting to Windows To Go when a USB device is connected will not be enabled unless a user configures the option manually in the firmware. If you do not configure this policy setting, users who are members of the local Administrators group can enable or disable booting from USB using the **Windows To Go Startup Options** settings dialog. - >[!IMPORTANT]   - >Enabling this policy setting will cause PCs running Windows to attempt to boot from any USB device that is inserted into the PC before it is started. + > [!IMPORTANT] + > Enabling this policy setting will cause PCs running Windows to attempt to boot from any USB device that is inserted into the PC before it is started. ## Supporting booting from USB The biggest hurdle for a user wanting to use Windows To Go is configuring their computer to boot from USB. This is traditionally done by entering the firmware and configuring the appropriate boot order options. To ease the process of making the firmware modifications required for Windows To Go, Windows includes a feature named **Windows To Go Startup Options** that allows a user to configure their computer to boot from USB from within Windows—without ever entering their firmware, as long as their firmware supports booting from USB. ->[!NOTE] ->Enabling a system to always boot from USB first has implications that you should consider. For example, a USB device that includes malware could be booted inadvertently to compromise the system, or multiple USB drives could be plugged in to cause a boot conflict. For this reason, the Windows To Go startup options are disabled by default. In addition, administrator privileges are required to configure Windows To Go startup options. +> [!NOTE] +> Enabling a system to always boot from USB first has implications that you should consider. For example, a USB device that includes malware could be booted inadvertently to compromise the system, or multiple USB drives could be plugged in to cause a boot conflict. For this reason, the Windows To Go startup options are disabled by default. In addition, administrator privileges are required to configure Windows To Go startup options. -If you are going to be using a Windows 7 computer as a host-PC, see the wiki article [Tips for configuring your BIOS settings to work with Windows To Go](https://go.microsoft.com/fwlink/p/?LinkID=618951). +If you are going to be using a Windows 7 computer as a host-PC, see the wiki article [Tips for configuring your BIOS settings to work with Windows To Go](https://go.microsoft.com/fwlink/p/?LinkID=618951). ### Roaming between different firmware types -Windows supports two types of PC firmware: Unified Extensible Firmware Interface (UEFI), which is the new standard, and legacy BIOS firmware, which was used in most PCs shipping with Windows 7 or earlier version of Windows. Each firmware type has completely different Windows boot components that are incompatible with each other. Beyond the different boot components, Windows supports different partition styles and layout requirements for each type of firmware as shown in the following diagrams. +Windows supports two types of PC firmware: Unified Extensible Firmware Interface (UEFI), which is the new standard, and legacy BIOS firmware, which was used in most PCs shipping with Windows 7 or earlier version of Windows. Each firmware type has completely different Windows boot components that are incompatible with each other. Beyond the different boot components, Windows supports different partition styles and layout requirements for each type of firmware as shown in the following diagrams. ![bios layout](images/wtg-mbr-bios.gif)![uefi layout](images/wtg-gpt-uefi.gif) This presented a unique challenge for Windows To Go because the firmware type is not easily determined by end-users—a UEFI computer looks just like a legacy BIOS computer and Windows To Go must boot on both types of firmware. -To enable booting Windows To Go on both types of firmware, a new disk layout is provided for Windows 8 or later that contains both sets of boot components on a FAT32 system partition and a new command-line option was added to bcdboot.exe to support this configuration. The **/f** option is used with the **bcdboot /s** command to specify the firmware type of the target system partition by appending either **UEFI**, **BIOS** or **ALL**. When creating Windows To Go drives manually you must use the **ALL** parameter to provide the Windows To Go drive the ability to boot on both types of firmware. For example, on volume H: (your Windows To Go USB drive letter), you would use the command **bcdboot C:\\windows /s H: /f ALL**. The following diagram illustrates the disk layout that results from that command: +To enable booting Windows To Go on both types of firmware, a new disk layout is provided for Windows 8 or later that contains both sets of boot components on a FAT32 system partition and a new command-line option was added to bcdboot.exe to support this configuration. The **/f** option is used with the **bcdboot /s** command to specify the firmware type of the target system partition by appending either **UEFI**, **BIOS** or **ALL**. When creating Windows To Go drives manually you must use the **ALL** parameter to provide the Windows To Go drive the ability to boot on both types of firmware. For example, on volume H: (your Windows To Go USB drive letter), you would use the command **bcdboot C:\\windows /s H: /f ALL**. The following diagram illustrates the disk layout that results from that command: ![firmware roaming disk layout](images/wtg-mbr-firmware-roaming.gif) @@ -276,7 +276,7 @@ This is the only supported disk configuration for Windows To Go. With this disk ### Configure Windows To Go startup options -Windows To Go Startup Options is a setting available on Windows 10-based PCs that enables the computer to be booted from a USB without manually changing the firmware settings of the PC. To configure Windows To Go Startup Options you must have administrative rights on the computer and the **Windows To Go Default Startup Options** Group Policy setting must not be configured. +Windows To Go Startup Options is a setting available on Windows 10-based PCs that enables the computer to be booted from a USB without manually changing the firmware settings of the PC. To configure Windows To Go Startup Options you must have administrative rights on the computer and the **Windows To Go Default Startup Options** Group Policy setting must not be configured. **To configure Windows To Go startup options** @@ -286,15 +286,15 @@ Windows To Go Startup Options is a setting available on Windows 10-based PCs th 2. Select **Yes** to enable the startup options. - **Tip**   - If your computer is part of a domain, the Group Policy setting can be used to enable the startup options instead of the dialog. + > [!TIP] + > If your computer is part of a domain, the Group Policy setting can be used to enable the startup options instead of the dialog. 3. Click **Save Changes**. If the User Account Control dialog box is displayed, confirm that the action it displays is what you want, and then click **Yes**. ### Change firmware settings -If you choose to not use the Windows To Go startup options or are using a PC running Windows 7 as your host computer you will need to manually configure the firmware settings. The process used to accomplish this will depend on the firmware type and manufacturer. If your host computer is protected by BitLocker and running Windows 7 you should suspend BitLocker before making the change to the firmware settings. After the firmware settings have been successfully reconfigured, resume BitLocker protection. If you do not suspend BitLocker first, BitLocker will assume that the computer has been tampered with and will boot into BitLocker recovery mode. +If you choose to not use the Windows To Go startup options or are using a PC running Windows 7 as your host computer you will need to manually configure the firmware settings. The process used to accomplish this will depend on the firmware type and manufacturer. If your host computer is protected by BitLocker and running Windows 7 you should suspend BitLocker before making the change to the firmware settings. After the firmware settings have been successfully reconfigured, resume BitLocker protection. If you do not suspend BitLocker first, BitLocker will assume that the computer has been tampered with and will boot into BitLocker recovery mode. ## Related topics From dcf696c83bad3d31666f40ecd933ef966f0c209f Mon Sep 17 00:00:00 2001 From: Tudor Dobrila Date: Wed, 4 Sep 2019 16:54:41 -0700 Subject: [PATCH 39/49] Remove redundant line --- .../microsoft-defender-atp-mac-install-with-jamf.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md index ef76d78529..9a52b56369 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md @@ -201,7 +201,6 @@ mdatp --health healthy The above command prints "1" if the product is onboarded and functioning as expected. If the product is not healthy, the exit code (which can be checked through `echo $?`) indicates the problem: -- 0 if Microsoft Defender ATP is registered with the Microsoft Defender ATP service - 1 if the device is not yet onboarded - 3 if the connection to the daemon cannot be established—for example, if the daemon is not running From 4cd84901ce45c1310e6cd30f3c3c043cdf40c40d Mon Sep 17 00:00:00 2001 From: Marty Hernandez Avedon Date: Wed, 4 Sep 2019 22:12:34 -0400 Subject: [PATCH 40/49] rm'd some straggling files from eg debranding (#1037) --- .../emet-exploit-protection-exploit-guard.md | 118 ------------ .../exploit-protection-exploit-guard.md | 174 ------------------ .../windows-defender-exploit-guard.md | 90 --------- 3 files changed, 382 deletions(-) delete mode 100644 windows/security/threat-protection/windows-defender-exploit-guard/emet-exploit-protection-exploit-guard.md delete mode 100644 windows/security/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard.md delete mode 100644 windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/emet-exploit-protection-exploit-guard.md b/windows/security/threat-protection/windows-defender-exploit-guard/emet-exploit-protection-exploit-guard.md deleted file mode 100644 index eb98618179..0000000000 --- a/windows/security/threat-protection/windows-defender-exploit-guard/emet-exploit-protection-exploit-guard.md +++ /dev/null @@ -1,118 +0,0 @@ ---- -title: Compare the features in Exploit protection with EMET -keywords: emet, enhanced mitigation experience toolkit, configuration, exploit, compare, difference between, versus, upgrade, convert -description: Exploit protection in Windows 10 provides advanced configuration over the settings offered in EMET. -search.product: eADQiWindows 10XVcnh -ms.pagetype: security -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: medium -author: levinec -ms.author: ellevin -ms.date: 08/08/2018 -ms.reviewer: -manager: dansimp ---- - -# Comparison between Enhanced Mitigation Experience Toolkit and Windows Defender Exploit Guard - -**Applies to:** - -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) - ->[!IMPORTANT] ->If you are currently using EMET, you should be aware that [EMET reached end of life on July 31, 2018](https://blogs.technet.microsoft.com/srd/2016/11/03/beyond-emet/). You should consider replacing EMET with exploit protection in Microsoft Defender ATP. -> ->You can [convert an existing EMET configuration file into Exploit protection](import-export-exploit-protection-emet-xml.md#convert-an-emet-configuration-file-to-an-exploit-protection-configuration-file) to make the migration easier and keep your existing settings. - -This topic describes the differences between the Enhance Mitigation Experience Toolkit (EMET) and exploit protection in Microsoft Defender ATP. - -Exploit protection in Microsoft Defender ATP is our successor to EMET and provides stronger protection, more customization, an easier user interface, and better configuration and management options. - -EMET is a standalone product for earlier versions of Windows and provides some mitigation against older, known exploit techniques. - -After July 31, 2018, it will not be supported. - -For more information about the individual features and mitigations available in Microsoft Defender ATP, as well as how to enable, configure, and deploy them to better protect your network, see the following topics: - -- [Protect devices from exploits](exploit-protection-exploit-guard.md) -- [Configure and audit exploit protection mitigations](customize-exploit-protection.md) - - - ## Feature comparison - - The table in this section illustrates the differences between EMET and Windows Defender Exploit Guard. - -  | Windows Defender Exploit Guard | EMET - -|:-:|:-: -Windows versions | [!include[Check mark yes](images/svg/check-yes.svg)]
All versions of Windows 10 starting with version 1709 | [!include[Check mark yes](images/svg/check-yes.svg)]
Windows 8.1; Windows 8; Windows 7
Cannot be installed on Windows 10, version 1709 and later -Installation requirements | [Windows Security in Windows 10](../windows-defender-security-center/windows-defender-security-center.md)
(no additional installation required)
Windows Defender Exploit Guard is built into Windows - it doesn't require a separate tool or package for management, configuration, or deployment. | Available only as an additional download and must be installed onto a management device -User interface | Modern interface integrated with the [Windows Security app](../windows-defender-security-center/windows-defender-security-center.md) | Older, complex interface that requires considerable ramp-up training -Supportability | [!include[Check mark yes](images/svg/check-yes.svg)]
[Dedicated submission-based support channel](https://www.microsoft.com/wdsi/filesubmission)[[1](#fn1)]
[Part of the Windows 10 support lifecycle](https://support.microsoft.com/help/13853/windows-lifecycle-fact-sheet) | [!include[Check mark no](images/svg/check-no.svg)]
Ends after July 31, 2018 -Updates | [!include[Check mark yes](images/svg/check-yes.svg)]
Ongoing updates and development of new features, released twice yearly as part of the [Windows 10 semi-annual update channel](https://blogs.technet.microsoft.com/windowsitpro/2017/07/27/waas-simplified-and-aligned/) | [!include[Check mark no](images/svg/check-no.svg)]
No planned updates or development -Exploit protection | [!include[Check mark yes](images/svg/check-yes.svg)]
All EMET mitigations plus new, specific mitigations ([see table](#mitigation-comparison))
[Can convert and import existing EMET configurations](import-export-exploit-protection-emet-xml.md) | [!include[Check mark yes](images/svg/check-yes.svg)]
Limited set of mitigations -Attack surface reduction[[2](#fn2)] | [!include[Check mark yes](images/svg/check-yes.svg)]
[Helps block known infection vectors](attack-surface-reduction-exploit-guard.md)
[Can configure individual rules](enable-attack-surface-reduction.md) | [!include[Check mark yes](images/svg/check-yes.svg)]
Limited ruleset configuration only for modules (no processes) -Network protection[[2](#fn2)] | [!include[Check mark yes](images/svg/check-yes.svg)]
[Helps block malicious network connections](network-protection-exploit-guard.md) | [!include[Check mark no](images/svg/check-no.svg)]
Not available -Controlled folder access[[2](#fn2)] | [!include[Check mark yes](images/svg/check-yes.svg)]
[Helps protect important folders](controlled-folders-exploit-guard.md)
[Configurable for apps and folders](customize-controlled-folders-exploit-guard.md) | [!include[Check mark no](images/svg/check-no.svg)]
Not available -Configuration with GUI (user interface) | [!include[Check mark yes](images/svg/check-yes.svg)]
[Use Windows Security app to customize and manage configurations](customize-exploit-protection.md) | [!include[Check mark yes](images/svg/check-yes.svg)]
Requires installation and use of EMET tool -Configuration with Group Policy | [!include[Check mark yes](images/svg/check-yes.svg)]
[Use Group Policy to deploy and manage configurations](import-export-exploit-protection-emet-xml.md#manage-or-deploy-a-configuration) | [!include[Check mark yes](images/svg/check-yes.svg)]
Available -Configuration with shell tools | [!include[Check mark yes](images/svg/check-yes.svg)]
[Use PowerShell to customize and manage configurations](customize-exploit-protection.md#powershell-reference) | [!include[Check mark yes](images/svg/check-yes.svg)]
Requires use of EMET tool (EMET_CONF) -System Center Configuration Manager | [!include[Check mark yes](images/svg/check-yes.svg)]
[Use Configuration Manager to customize, deploy, and manage configurations](https://docs.microsoft.com/sccm/protect/deploy-use/create-deploy-exploit-guard-policy) | [!include[Check mark no](images/svg/check-no.svg)]
Not available -Microsoft Intune | [!include[Check mark yes](images/svg/check-yes.svg)]
[Use Intune to customize, deploy, and manage configurations](https://docs.microsoft.com/intune/whats-new#window-defender-exploit-guard-is-a-new-set-of-intrusion-prevention-capabilities-for-windows-10----1063615---) | [!include[Check mark no](images/svg/check-no.svg)]
Not available -Reporting | [!include[Check mark yes](images/svg/check-yes.svg)]
With [Windows event logs](event-views-exploit-guard.md) and [full audit mode reporting](audit-windows-defender-exploit-guard.md)
[Full integration with Microsoft Defender Advanced Threat Protection](../microsoft-defender-atp/secure-score-dashboard.md) | [!include[Check mark yes](images/svg/check-yes.svg)]
Limited Windows event log monitoring -Audit mode | [!include[Check mark yes](images/svg/check-yes.svg)]
[Full audit mode with Windows event reporting](audit-windows-defender-exploit-guard.md) | [!include[Check mark no](images/svg/check-no.svg)]
Limited to EAF, EAF+, and anti-ROP mitigations - -([1](#ref1)) Requires an enterprise subscription with Azure Active Directory or a [Software Assurance ID](https://www.microsoft.com/licensing/licensing-programs/software-assurance-default.aspx). - -([2](#ref2-1)) Additional requirements may apply (such as use of Windows Defender Antivirus). See [Windows Defender Exploit Guard requirements](windows-defender-exploit-guard.md#requirements) for more details. Customizable mitigation options that are configured with [Exploit protection](exploit-protection-exploit-guard.md) do not require Windows Defender Antivirus. - -## Mitigation comparison - -The mitigations available in EMET are included in Windows Defender Exploit Guard, under the [exploit protection feature](exploit-protection-exploit-guard.md). - -The table in this section indicates the availability and support of native mitigations between EMET and Exploit protection. - -Mitigation | Available in Windows Defender Exploit Guard | Available in EMET --|:-:|:-: -Arbitrary code guard (ACG) | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)]
As "Memory Protection Check" -Block remote images | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)]
As "Load Library Check" -Block untrusted fonts | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] -Data Execution Prevention (DEP) | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] -Export address filtering (EAF) | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] -Force randomization for images (Mandatory ASLR) | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] -NullPage Security Mitigation | [!include[Check mark yes](images/svg/check-yes.svg)]
Included natively in Windows 10
See [Mitigate threats by using Windows 10 security features](../overview-of-threat-mitigations-in-windows-10.md#understanding-windows-10-in-relation-to-the-enhanced-mitigation-experience-toolkit) for more information | [!include[Check mark yes](images/svg/check-yes.svg)] -Randomize memory allocations (Bottom-Up ASLR) | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] -Simulate execution (SimExec) | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] -Validate API invocation (CallerCheck) | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] -Validate exception chains (SEHOP) | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] -Validate stack integrity (StackPivot) | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] -Certificate trust (configurable certificate pinning) | Windows 10 provides enterprise certificate pinning | [!include[Check mark yes](images/svg/check-yes.svg)] -Heap spray allocation | Ineffective against newer browser-based exploits; newer mitigations provide better protection
See [Mitigate threats by using Windows 10 security features](../overview-of-threat-mitigations-in-windows-10.md#understanding-windows-10-in-relation-to-the-enhanced-mitigation-experience-toolkit) for more information | [!include[Check mark yes](images/svg/check-yes.svg)] -Block low integrity images | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)] -Code integrity guard | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)] -Disable extension points | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)] -Disable Win32k system calls | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)] -Do not allow child processes | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)] -Import address filtering (IAF) | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)] -Validate handle usage | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)] -Validate heap integrity | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)] -Validate image dependency integrity | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)] - - ->[!NOTE] ->The Advanced ROP mitigations that are available in EMET are superseded by ACG in Windows 10, which other EMET advanced settings are enabled by default in Windows Defender Exploit Guard as part of enabling the anti-ROP mitigations for a process. -> ->See the [Mitigation threats by using Windows 10 security features](../overview-of-threat-mitigations-in-windows-10.md#understanding-windows-10-in-relation-to-the-enhanced-mitigation-experience-toolkit) for more information on how Windows 10 employs existing EMET technology. - - -## Related topics - -- [Protect devices from exploits with Windows Defender Exploit Guard](exploit-protection-exploit-guard.md) -- [Evaluate exploit protection](evaluate-exploit-protection.md) -- [Enable exploit protection](enable-exploit-protection.md) -- [Configure and audit exploit protection mitigations](customize-exploit-protection.md) -- [Import, export, and deploy exploit protection configurations](import-export-exploit-protection-emet-xml.md) - - diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard.md b/windows/security/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard.md deleted file mode 100644 index 72ab3ef09f..0000000000 --- a/windows/security/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard.md +++ /dev/null @@ -1,174 +0,0 @@ ---- -title: Apply mitigations to help prevent attacks through vulnerabilities -keywords: mitigations, vulnerabilities, vulnerability, mitigation, exploit, exploits, emet -description: Exploit protection in Windows 10 provides advanced configuration over the settings offered in EMET. -search.product: eADQiWindows 10XVcnh -ms.pagetype: security -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: medium -author: levinec -ms.author: ellevin -ms.date: 04/02/2019 -ms.reviewer: -manager: dansimp ---- - -# Protect devices from exploits - -**Applies to:** - -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) - -Exploit protection automatically applies a number of exploit mitigation techniques to operating system processes and apps. - -It is part of [Windows Defender Exploit Guard](windows-defender-exploit-guard.md). Exploit protection is supported beginning with Windows 10, version 1709 and Windows Server 2016, version 1803. - ->[!TIP] ->You can visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the feature is working and see how it works. - -Exploit protection works best with [Microsoft Defender Advanced Threat Protection](../microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md) - which gives you detailed reporting into exploit protection events and blocks as part of the usual [alert investigation scenarios](../microsoft-defender-atp/investigate-alerts.md). - -You can [enable exploit protection](enable-exploit-protection.md) on an individual machine, and then use [Group Policy](import-export-exploit-protection-emet-xml.md) to distribute the XML file to multiple devices at once. - -When a mitigation is encountered on the machine, a notification will be displayed from the Action Center. You can [customize the notification](customize-attack-surface-reduction.md#customize-the-notification) with your company details and contact information. You can also enable the rules individually to customize what techniques the feature monitors. - -You can also use [audit mode](evaluate-exploit-protection.md) to evaluate how exploit protection would impact your organization if it were enabled. - -Many of the features in the [Enhanced Mitigation Experience Toolkit (EMET)](https://technet.microsoft.com/security/jj653751) have been included in Exploit protection, and you can convert and import existing EMET configuration profiles into Exploit protection. See [Comparison between Enhanced Mitigation Experience Toolkit and Windows Defender Exploit Guard](emet-exploit-protection-exploit-guard.md) for more information on how Exploit protection supersedes EMET and what the benefits are when considering moving to exploit protection on Windows 10. - ->[!IMPORTANT] ->If you are currently using EMET you should be aware that [EMET reached end of life on July 31, 2018](https://blogs.technet.microsoft.com/srd/2016/11/03/beyond-emet/). You should consider replacing EMET with exploit protection in Windows 10. You can [convert an existing EMET configuration file into exploit protection](import-export-exploit-protection-emet-xml.md#convert-an-emet-configuration-file-to-an-exploit-protection-configuration-file) to make the migration easier and keep your existing settings. - ->[!WARNING] ->Some security mitigation technologies may have compatibility issues with some applications. You should test exploit protection in all target use scenarios by using [audit mode](audit-windows-defender-exploit-guard.md) before deploying the configuration across a production environment or the rest of your network. - -## Review exploit protection events in the Microsoft Security Center - -Microsoft Defender ATP provides detailed reporting into events and blocks as part of its alert investigation scenarios. - -You can query Microsoft Defender ATP data by using [Advanced hunting](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection). If you're using [audit mode](audit-windows-defender-exploit-guard.md), you can use Advanced hunting to see how exploit protection settings could affect your environment. - -Here is an example query: - -``` -MiscEvents -| where ActionType startswith 'ExploitGuard' and ActionType !contains 'NetworkProtection' -``` - -## Review exploit protection events in Windows Event Viewer - -You can review the Windows event log to see events that are created when exploit protection blocks (or audits) an app: - -Provider/source | Event ID | Description --|:-:|- -Security-Mitigations | 1 | ACG audit -Security-Mitigations | 2 | ACG enforce -Security-Mitigations | 3 | Do not allow child processes audit -Security-Mitigations | 4 | Do not allow child processes block -Security-Mitigations | 5 | Block low integrity images audit -Security-Mitigations | 6 | Block low integrity images block -Security-Mitigations | 7 | Block remote images audit -Security-Mitigations | 8 | Block remote images block -Security-Mitigations | 9 | Disable win32k system calls audit -Security-Mitigations | 10 | Disable win32k system calls block -Security-Mitigations | 11 | Code integrity guard audit -Security-Mitigations | 12 | Code integrity guard block -Security-Mitigations | 13 | EAF audit -Security-Mitigations | 14 | EAF enforce -Security-Mitigations | 15 | EAF+ audit -Security-Mitigations | 16 | EAF+ enforce -Security-Mitigations | 17 | IAF audit -Security-Mitigations | 18 | IAF enforce -Security-Mitigations | 19 | ROP StackPivot audit -Security-Mitigations | 20 | ROP StackPivot enforce -Security-Mitigations | 21 | ROP CallerCheck audit -Security-Mitigations | 22 | ROP CallerCheck enforce -Security-Mitigations | 23 | ROP SimExec audit -Security-Mitigations | 24 | ROP SimExec enforce -WER-Diagnostics | 5 | CFG Block -Win32K | 260 | Untrusted Font - -## Comparison between Enhanced Mitigation Experience Toolkit and Windows Defender Exploit Guard - ->[!IMPORTANT] ->If you are currently using EMET, you should be aware that [EMET reached end of life on July 31, 2018](https://blogs.technet.microsoft.com/srd/2016/11/03/beyond-emet/). You should consider replacing EMET with exploit protection in Microsoft Defender ATP. -> ->You can [convert an existing EMET configuration file into exploit protection](import-export-exploit-protection-emet-xml.md#convert-an-emet-configuration-file-to-an-exploit-protection-configuration-file) to make the migration easier and keep your existing settings. - -This section compares exploit protection in Microsoft Defender ATP with the Enhance Mitigation Experience Toolkit (EMET) for reference. -The table in this section illustrates the differences between EMET and Windows Defender Exploit Guard. - -  | Windows Defender Exploit Guard | EMET - -|:-:|:-: -Windows versions | [!include[Check mark yes](images/svg/check-yes.svg)]
All versions of Windows 10 starting with version 1709 | [!include[Check mark yes](images/svg/check-yes.svg)]
Windows 8.1; Windows 8; Windows 7
Cannot be installed on Windows 10, version 1709 and later -Installation requirements | [Windows Security in Windows 10](../windows-defender-security-center/windows-defender-security-center.md)
(no additional installation required)
Windows Defender Exploit Guard is built into Windows - it doesn't require a separate tool or package for management, configuration, or deployment. | Available only as an additional download and must be installed onto a management device -User interface | Modern interface integrated with the [Windows Security app](../windows-defender-security-center/windows-defender-security-center.md) | Older, complex interface that requires considerable ramp-up training -Supportability | [!include[Check mark yes](images/svg/check-yes.svg)]
[Dedicated submission-based support channel](https://www.microsoft.com/wdsi/filesubmission)[[1](#fn1)]
[Part of the Windows 10 support lifecycle](https://support.microsoft.com/help/13853/windows-lifecycle-fact-sheet) | [!include[Check mark no](images/svg/check-no.svg)]
Ends after July 31, 2018 -Updates | [!include[Check mark yes](images/svg/check-yes.svg)]
Ongoing updates and development of new features, released twice yearly as part of the [Windows 10 semi-annual update channel](https://blogs.technet.microsoft.com/windowsitpro/2017/07/27/waas-simplified-and-aligned/) | [!include[Check mark no](images/svg/check-no.svg)]
No planned updates or development -Exploit protection | [!include[Check mark yes](images/svg/check-yes.svg)]
All EMET mitigations plus new, specific mitigations ([see table](#mitigation-comparison))
[Can convert and import existing EMET configurations](import-export-exploit-protection-emet-xml.md) | [!include[Check mark yes](images/svg/check-yes.svg)]
Limited set of mitigations -Attack surface reduction[[2](#fn2)] | [!include[Check mark yes](images/svg/check-yes.svg)]
[Helps block known infection vectors](attack-surface-reduction-exploit-guard.md)
[Can configure individual rules](enable-attack-surface-reduction.md) | [!include[Check mark yes](images/svg/check-yes.svg)]
Limited ruleset configuration only for modules (no processes) -Network protection[[2](#fn2)] | [!include[Check mark yes](images/svg/check-yes.svg)]
[Helps block malicious network connections](network-protection-exploit-guard.md) | [!include[Check mark no](images/svg/check-no.svg)]
Not available -Controlled folder access[[2](#fn2)] | [!include[Check mark yes](images/svg/check-yes.svg)]
[Helps protect important folders](controlled-folders-exploit-guard.md)
[Configurable for apps and folders](customize-controlled-folders-exploit-guard.md) | [!include[Check mark no](images/svg/check-no.svg)]
Not available -Configuration with GUI (user interface) | [!include[Check mark yes](images/svg/check-yes.svg)]
[Use Windows Security app to customize and manage configurations](customize-exploit-protection.md) | [!include[Check mark yes](images/svg/check-yes.svg)]
Requires installation and use of EMET tool -Configuration with Group Policy | [!include[Check mark yes](images/svg/check-yes.svg)]
[Use Group Policy to deploy and manage configurations](import-export-exploit-protection-emet-xml.md#manage-or-deploy-a-configuration) | [!include[Check mark yes](images/svg/check-yes.svg)]
Available -Configuration with shell tools | [!include[Check mark yes](images/svg/check-yes.svg)]
[Use PowerShell to customize and manage configurations](customize-exploit-protection.md#powershell-reference) | [!include[Check mark yes](images/svg/check-yes.svg)]
Requires use of EMET tool (EMET_CONF) -System Center Configuration Manager | [!include[Check mark yes](images/svg/check-yes.svg)]
[Use Configuration Manager to customize, deploy, and manage configurations](https://docs.microsoft.com/sccm/protect/deploy-use/create-deploy-exploit-guard-policy) | [!include[Check mark no](images/svg/check-no.svg)]
Not available -Microsoft Intune | [!include[Check mark yes](images/svg/check-yes.svg)]
[Use Intune to customize, deploy, and manage configurations](https://docs.microsoft.com/intune/whats-new#window-defender-exploit-guard-is-a-new-set-of-intrusion-prevention-capabilities-for-windows-10----1063615---) | [!include[Check mark no](images/svg/check-no.svg)]
Not available -Reporting | [!include[Check mark yes](images/svg/check-yes.svg)]
With [Windows event logs](event-views-exploit-guard.md) and [full audit mode reporting](audit-windows-defender-exploit-guard.md)
[Full integration with Microsoft Defender Advanced Threat Protection](../microsoft-defender-atp/secure-score-dashboard.md) | [!include[Check mark yes](images/svg/check-yes.svg)]
Limited Windows event log monitoring -Audit mode | [!include[Check mark yes](images/svg/check-yes.svg)]
[Full audit mode with Windows event reporting](audit-windows-defender-exploit-guard.md) | [!include[Check mark no](images/svg/check-no.svg)]
Limited to EAF, EAF+, and anti-ROP mitigations - -([1](#ref1)) Requires an enterprise subscription with Azure Active Directory or a [Software Assurance ID](https://www.microsoft.com/licensing/licensing-programs/software-assurance-default.aspx). - -([2](#ref2-1)) Additional requirements may apply (such as use of Windows Defender Antivirus). See [Windows Defender Exploit Guard requirements](windows-defender-exploit-guard.md#requirements) for more details. Customizable mitigation options that are configured with [exploit protection](exploit-protection-exploit-guard.md) do not require Windows Defender Antivirus. - -## Mitigation comparison - -The mitigations available in EMET are included in Windows Defender Exploit Guard, under the [exploit protection feature](exploit-protection-exploit-guard.md). - -The table in this section indicates the availability and support of native mitigations between EMET and exploit protection. - -Mitigation | Available in Windows Defender Exploit Guard | Available in EMET --|:-:|:-: -Arbitrary code guard (ACG) | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)]
As "Memory Protection Check" -Block remote images | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)]
As "Load Library Check" -Block untrusted fonts | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] -Data Execution Prevention (DEP) | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] -Export address filtering (EAF) | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] -Force randomization for images (Mandatory ASLR) | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] -NullPage Security Mitigation | [!include[Check mark yes](images/svg/check-yes.svg)]
Included natively in Windows 10
See [Mitigate threats by using Windows 10 security features](../overview-of-threat-mitigations-in-windows-10.md#understanding-windows-10-in-relation-to-the-enhanced-mitigation-experience-toolkit) for more information | [!include[Check mark yes](images/svg/check-yes.svg)] -Randomize memory allocations (Bottom-Up ASLR) | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] -Simulate execution (SimExec) | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] -Validate API invocation (CallerCheck) | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] -Validate exception chains (SEHOP) | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] -Validate stack integrity (StackPivot) | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] -Certificate trust (configurable certificate pinning) | Windows 10 provides enterprise certificate pinning | [!include[Check mark yes](images/svg/check-yes.svg)] -Heap spray allocation | Ineffective against newer browser-based exploits; newer mitigations provide better protection
See [Mitigate threats by using Windows 10 security features](../overview-of-threat-mitigations-in-windows-10.md#understanding-windows-10-in-relation-to-the-enhanced-mitigation-experience-toolkit) for more information | [!include[Check mark yes](images/svg/check-yes.svg)] -Block low integrity images | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)] -Code integrity guard | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)] -Disable extension points | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)] -Disable Win32k system calls | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)] -Do not allow child processes | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)] -Import address filtering (IAF) | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)] -Validate handle usage | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)] -Validate heap integrity | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)] -Validate image dependency integrity | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)] - ->[!NOTE] ->The Advanced ROP mitigations that are available in EMET are superseded by ACG in Windows 10, which other EMET advanced settings are enabled by default in Windows Defender Exploit Guard as part of enabling the anti-ROP mitigations for a process. -> ->See the [Mitigation threats by using Windows 10 security features](../overview-of-threat-mitigations-in-windows-10.md#understanding-windows-10-in-relation-to-the-enhanced-mitigation-experience-toolkit) for more information on how Windows 10 employs existing EMET technology. - - -## Related topics - -- [Protect devices from exploits](exploit-protection-exploit-guard.md) -- [Evaluate exploit protection](evaluate-exploit-protection.md) -- [Enable exploit protection](enable-exploit-protection.md) -- [Configure and audit exploit protection mitigations](customize-exploit-protection.md) -- [Import, export, and deploy exploit protection configurations](import-export-exploit-protection-emet-xml.md) -- [Troubleshoot exploit protection](troubleshoot-exploit-protection-mitigations.md) - - diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md b/windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md deleted file mode 100644 index 7f4ef0cb7c..0000000000 --- a/windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md +++ /dev/null @@ -1,90 +0,0 @@ ---- -title: Use Windows Defender Exploit Guard to protect your network -description: Windows Defender EG employs features that help protect your network from threats, including helping prevent ransomware encryption and exploit attacks -keywords: emet, exploit guard, Controlled folder access, Network protection, Exploit protection, Attack surface reduction, hips, host intrusion prevention system -search.product: eADQiWindows 10XVcnh -ms.pagetype: security -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: medium -author: dansimp -ms.author: dansimp -ms.date: 08/09/2018 -ms.reviewer: -manager: dansimp ---- - -# Windows Defender Exploit Guard - -**Applies to:** - -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) - -Windows Defender Exploit Guard (Windows Defender EG) is a new set of host intrusion prevention capabilities for Windows 10, allowing you to manage and reduce the attack surface of apps used by your employees. - -There are four features in Windows Defender EG: - -- [Exploit protection](exploit-protection-exploit-guard.md) can apply exploit mitigation techniques to apps your organization uses, both individually and to all apps. Works with third-party antivirus solutions and Windows Defender Antivirus (Windows Defender AV). -- [Attack surface reduction rules](attack-surface-reduction-exploit-guard.md) can reduce the attack surface of your applications with intelligent rules that stop the vectors used by Office-, script- and mail-based malware. Requires Windows Defender AV. -- [Network protection](network-protection-exploit-guard.md) extends the malware and social engineering protection offered by Windows Defender SmartScreen in Microsoft Edge to cover network traffic and connectivity on your organization's devices. Requires Windows Defender AV. -- [Controlled folder access](controlled-folders-exploit-guard.md) helps protect files in key system folders from changes made by malicious and suspicious apps, including file-encrypting ransomware malware. Requires Windows Defender AV. - -Windows 10, version 1803 provides additional protections: - -- New Attack surface reduction rules -- Controlled folder access can now block disk sectors - -You can evaluate each feature of Windows Defender EG with the guides at the following link, which provide pre-built PowerShell scripts and testing tools so you can see the features in action: -- [Evaluate Windows Defender Exploit Guard](evaluate-windows-defender-exploit-guard.md) - - -You can also [enable audit mode](audit-windows-defender-exploit-guard.md) for the features, which provides you with basic event logs that indicate how the feature would have responded if it had been fully enabled. This can be useful when evaluating the impact of Windows Defender EG and to help determine the impact of the features on your network's security. - ->[!TIP] ->You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the features are working and see how each of them work. - -Windows Defender EG can be managed and reported on in the Windows Security app as part of the Microsoft Defender Advanced Threat Protection suite of threat mitigation, preventing, protection, and analysis technologies. - -You can use the Windows Security app to obtain detailed reporting into events and blocks as part of the usual [alert investigation scenarios](../microsoft-defender-atp/investigate-alerts.md). You can [sign up for a free trial of Microsoft Defender ATP](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=cx-docs-msa4053440) to see how it works. - -## Requirements - -This section covers requirements for each feature in Windows Defender EG. - -| Symbol | Support | -|--------|---------| -| ![not supported](./images/ball_empty.png) | Not supported | -| ![supported](./images/ball_50.png) | Supported | -| ![supported, full reporting](./images/ball_full.png) | Recommended. Includes full, automated reporting into the Microsoft Defender ATP console. Provides additional cloud-powered capabilities, including the Network protection ability to block apps from accessing low-reputation websites and an attack surface reduction rule that blocks executable files that meet age or prevalence criteria.| - -| Feature | Windows 10 Home | Windows 10 Professional | Windows 10 Enterprise | Windows 10 with Enterprise E3 subscription | Windows 10 with Enterprise E5 subscription | -| ----------------- | :------------------------------------: | :---------------------------: | :-------------------------: | :--------------------------------------: | :--------------------------------------: | -| Exploit protection | ![supported](./images/ball_50.png) | ![supported](./images/ball_50.png) | ![supported, enhanced](./images/ball_50.png) | ![supported, enhanced](./images/ball_50.png) | ![supported, full reporting](./images/ball_full.png) | -| Attack surface reduction rules | ![not supported](./images/ball_empty.png) | ![not supported](./images/ball_empty.png) | ![supported, limited reporting](./images/ball_50.png) | ![supported, limited reporting](./images/ball_50.png) | ![supported, full reporting](./images/ball_full.png) | -| Network protection | ![not supported](./images/ball_empty.png) | ![not supported](./images/ball_empty.png) | ![supported, limited reporting](./images/ball_50.png) | ![supported, limited reporting](./images/ball_50.png) | ![supported, full reporting](./images/ball_full.png) | -| Controlled folder access | ![supported, limited reporting](./images/ball_50.png) | ![supported, limited reporting](./images/ball_50.png) | ![supported, limited reporting](./images/ball_50.png) | ![supported, limited reporting](./images/ball_50.png) | ![supported, full reporting](./images/ball_full.png) | - ->[!NOTE] -> The [Identity & Threat Protection package](https://www.microsoft.com/microsoft-365/blog/2019/01/02/introducing-new-advanced-security-and-compliance-offerings-for-microsoft-365/), available for Microsoft 365 E3 customers, provides the same Windows Defender ATP capabilities as the Enterprise E5 subscription. - -The following table lists which features in Windows Defender EG require enabling [real-time protection](../windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md) from Windows Defender Antivirus. - -| Feature | Real-time protection | -|-----------------| ------------------------------------ | -| Exploit protection | No requirement | -| Attack surface reduction rules | Must be enabled | -| Network protection | Must be enabled | -| Controlled folder access | Must be enabled | - - ## In this library - -Topic | Description ----|--- -[Protect devices from exploits](exploit-protection-exploit-guard.md) | Exploit protection provides you with many of the features in now-retired Enhanced Mitigations Experience Toolkit - and adds additional configuration and technologies. These features can help prevent threats from using vulnerabilities to gain access to your network and devices. You can create a template of settings that can be exported and copied to multiple machines in your network at once. -[Reduce attack surfaces with attack surface reduction rules](attack-surface-reduction-exploit-guard.md) | Use pre-built rules to manage mitigations for key attack and infection vectors, such as Office-based malicious macro code and PowerShell, VBScript, and JavaScript scripts. -[Protect your network](network-protection-exploit-guard.md) | Minimize the exposure of your devices from network and web-based infection vectors. -[Protect important folders with controlled folder access](controlled-folders-exploit-guard.md) | Prevent unknown or unauthorized apps (including ransomware encryption malware) from writing to sensitive folders, such as folders containing sensitive or business-critical data. - - From e6f4ce3cbb7f03f993cd9dbae1f7d260078c515f Mon Sep 17 00:00:00 2001 From: Greg Lindsay Date: Thu, 5 Sep 2019 13:22:20 -0700 Subject: [PATCH 41/49] update support statement --- windows/deployment/upgrade/windows-10-upgrade-paths.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/deployment/upgrade/windows-10-upgrade-paths.md b/windows/deployment/upgrade/windows-10-upgrade-paths.md index c1cf90e9a0..c5cc2c3ba1 100644 --- a/windows/deployment/upgrade/windows-10-upgrade-paths.md +++ b/windows/deployment/upgrade/windows-10-upgrade-paths.md @@ -24,7 +24,7 @@ ms.topic: article This topic provides a summary of available upgrade paths to Windows 10. You can upgrade to Windows 10 from Windows 7 or a later operating system. This includes upgrading from one release of Windows 10 to later release of Windows 10. Migrating from one edition of Windows 10 to a different edition of the same release is also supported. For more information about migrating to a different edition of Windows 10, see [Windows 10 edition upgrade](windows-10-edition-upgrades.md). -> **Windows 10 version upgrade**: You can directly upgrade a supported version of Windows 10 to a newer version of Windows 10, even if it involves skipping versions. Work with your account representative if your current version of Windows is out of support. See the [Windows lifecycle fact sheet](https://support.microsoft.com/help/13853/windows-lifecycle-fact-sheet) for availability and service information. +> **Windows 10 version upgrade**: You can directly upgrade any semi-annual channel version of Windows 10 to a newer, supported semi-annual channel version of Windows 10, even if it involves skipping versions. Work with your account representative if your current version of Windows is out of support. See the [Windows lifecycle fact sheet](https://support.microsoft.com/help/13853/windows-lifecycle-fact-sheet) for availability and service information. > > **Windows 10 LTSC/LTSB**: Due to [naming changes](https://docs.microsoft.com/windows/deployment/update/waas-overview#naming-changes), product versions that display Windows 10 LTSB will be replaced with Windows 10 LTSC in subsequent feature updates. The term LTSC is used here to refer to all long term servicing versions. > @@ -34,7 +34,7 @@ This topic provides a summary of available upgrade paths to Windows 10. You can > > **Windows 8.0**: You cannot upgrade directly from Windows 8.0 to Windows 10. To upgrade from Windows 8.0, you must first install the [Windows 8.1 update](https://support.microsoft.com/help/15356/windows-8-install-update-kb-2919355). -âś” = Full upgrade is supported including personal data, settings, and applications.
+âś” = Full upgrade is supported including personal data, settings, and applications.
D = Edition downgrade; personal data is maintained, applications and settings are removed.
From 115accfc564f97a1c4317ea55bd6655308bf76b8 Mon Sep 17 00:00:00 2001 From: Greg Lindsay Date: Fri, 6 Sep 2019 10:08:40 -0700 Subject: [PATCH 42/49] fixing some warnings --- windows/application-management/index.md | 2 +- windows/client-management/index.md | 2 +- ...-by-using-provisioning-packages-and-icd.md | 13 +-- windows/configuration/index.md | 4 +- .../wcd/wcd-deviceupdatecenter.md | 4 +- windows/configuration/wcd/wcd-privacy.md | 4 +- .../wcd/wcd-storaged3inmodernstandby.md | 4 +- windows/configuration/wcd/wcd-time.md | 4 +- windows/deployment/planning/index.md | 4 +- .../windows-10-1703-removed-features.md | 4 +- windows/deployment/update/index.md | 2 +- .../waas-optimize-windows-10-updates.md | 4 +- windows/deployment/update/waas-restart.md | 5 +- .../update/waas-wufb-group-policy.md | 5 +- .../deployment/windows-autopilot/bitlocker.md | 108 +++++++++--------- .../windows-autopilot/enrollment-status.md | 78 ++++++------- windows/hub/index.md | 3 +- 17 files changed, 118 insertions(+), 132 deletions(-) diff --git a/windows/application-management/index.md b/windows/application-management/index.md index 31196fe532..7a65732e01 100644 --- a/windows/application-management/index.md +++ b/windows/application-management/index.md @@ -4,7 +4,7 @@ description: Windows 10 application management ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library -author: jdeckerms +author: dansimp ms.localizationpriority: high ms.date: 09/26/2017 --- diff --git a/windows/client-management/index.md b/windows/client-management/index.md index f47496e3b0..f949fe4666 100644 --- a/windows/client-management/index.md +++ b/windows/client-management/index.md @@ -4,7 +4,7 @@ description: Windows 10 client management ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library -author: jdeckerms +author: dansimp ms.localizationpriority: medium ms.date: 08/16/2017 --- diff --git a/windows/configuration/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md b/windows/configuration/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md index 977161bcd3..369f3eb6fb 100644 --- a/windows/configuration/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md +++ b/windows/configuration/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md @@ -12,7 +12,6 @@ author: dansimp ms.author: dansimp ms.topic: article ms.localizationpriority: medium -ms.date: 11/15/2017 --- # Customize Windows 10 Start and taskbar with provisioning packages @@ -48,7 +47,7 @@ Three features enable Start and taskbar layout control: -## Prepare the Start layout XML file +## Prepare the Start layout XML file The **Export-StartLayout** cmdlet produces an XML file. Because Windows Configuration Designer produces a customizations.xml file that contains the configuration settings, adding the Start layout section to the customizations.xml file directly would result in an XML file embedded in an XML file. Before you add the Start layout section to the customizations.xml file, you must replace the markup characters in your layout.xml with escape characters. @@ -131,7 +130,6 @@ Use the Windows Configuration Designer tool to create a provisioning package. [L ## Related topics - - [Manage Windows 10 Start and taskbar layout](windows-10-start-layout-options-and-policies.md) - [Configure Windows 10 taskbar](configure-windows-10-taskbar.md) - [Customize and export Start layout](customize-and-export-start-layout.md) @@ -140,12 +138,3 @@ Use the Windows Configuration Designer tool to create a provisioning package. [L - [Customize Windows 10 Start and taskbar with Group Policy](customize-windows-10-start-screens-by-using-group-policy.md) - [Customize Windows 10 Start and tasbkar with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md) - [Changes to Start policies in Windows 10](changes-to-start-policies-in-windows-10.md) - - - - - - - - - diff --git a/windows/configuration/index.md b/windows/configuration/index.md index 6517e9e14f..383f35f8fe 100644 --- a/windows/configuration/index.md +++ b/windows/configuration/index.md @@ -7,8 +7,8 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: high -author: jdeckerms -ms.author: jdecker +author: dansimp +ms.author: dansimp ms.topic: article ms.date: 05/11/2018 --- diff --git a/windows/configuration/wcd/wcd-deviceupdatecenter.md b/windows/configuration/wcd/wcd-deviceupdatecenter.md index e8431b2555..52eac80d89 100644 --- a/windows/configuration/wcd/wcd-deviceupdatecenter.md +++ b/windows/configuration/wcd/wcd-deviceupdatecenter.md @@ -4,9 +4,9 @@ description: This section describes the DeviceUpdateCenter settings that you can ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: jdeckerMS +author: dansimp ms.localizationpriority: medium -ms.author: jdecker +ms.author: dansimp ms.topic: article --- diff --git a/windows/configuration/wcd/wcd-privacy.md b/windows/configuration/wcd/wcd-privacy.md index 1e754ef32f..2232d7d011 100644 --- a/windows/configuration/wcd/wcd-privacy.md +++ b/windows/configuration/wcd/wcd-privacy.md @@ -4,9 +4,9 @@ description: This section describes the Privacy settings that you can configure ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: jdeckerMS +author: dansimp ms.localizationpriority: medium -ms.author: jdecker +ms.author: dansimp ms.topic: article --- diff --git a/windows/configuration/wcd/wcd-storaged3inmodernstandby.md b/windows/configuration/wcd/wcd-storaged3inmodernstandby.md index 64f3ae3dc7..604fd59cf7 100644 --- a/windows/configuration/wcd/wcd-storaged3inmodernstandby.md +++ b/windows/configuration/wcd/wcd-storaged3inmodernstandby.md @@ -4,9 +4,9 @@ description: This section describes the StorageD3InModernStandby settings that y ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: jdeckerMS +author: dansimp ms.localizationpriority: medium -ms.author: jdecker +ms.author: dansimp ms.topic: article --- diff --git a/windows/configuration/wcd/wcd-time.md b/windows/configuration/wcd/wcd-time.md index c0ff2212ce..ded38047c3 100644 --- a/windows/configuration/wcd/wcd-time.md +++ b/windows/configuration/wcd/wcd-time.md @@ -4,9 +4,9 @@ description: This section describes the Time settings that you can configure in ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: jdeckerMS +author: dansimp ms.localizationpriority: medium -ms.author: jdecker +ms.author: dansimp ms.topic: article --- diff --git a/windows/deployment/planning/index.md b/windows/deployment/planning/index.md index e0816f65f8..454580a0c1 100644 --- a/windows/deployment/planning/index.md +++ b/windows/deployment/planning/index.md @@ -4,11 +4,11 @@ description: Windows 10 provides new deployment capabilities, scenarios, and to ms.assetid: 002F9B79-B50F-40C5-A7A5-0B4770E6EC15 keywords: deploy, upgrade, update, configure ms.prod: w10 +manager: laurawi ms.mktglfcycl: plan ms.sitesec: library ms.localizationpriority: medium -author: TrudyHa -ms.date: 07/27/2017 +author: greg-lindsay ms.topic: article --- diff --git a/windows/deployment/planning/windows-10-1703-removed-features.md b/windows/deployment/planning/windows-10-1703-removed-features.md index 0d09296845..24b5b1b1d9 100644 --- a/windows/deployment/planning/windows-10-1703-removed-features.md +++ b/windows/deployment/planning/windows-10-1703-removed-features.md @@ -2,11 +2,11 @@ title: Windows 10, version 1703 removed features description: Learn about features that were removed in Windows 10, version 1703 ms.prod: w10 +manager: laurawi ms.mktglfcycl: plan ms.localizationpriority: medium ms.sitesec: library -author: lizap -ms.date: 10/09/2017 +author: greg-lindsay ms.topic: article --- # Features that are removed or deprecated in Windows 10, version 1703 diff --git a/windows/deployment/update/index.md b/windows/deployment/update/index.md index a13003c55f..210ebcaf84 100644 --- a/windows/deployment/update/index.md +++ b/windows/deployment/update/index.md @@ -5,9 +5,9 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library author: Jaimeo +manager: laurawi ms.localizationpriority: high ms.author: jaimeo -ms.date: 04/06/2018 ms.topic: article --- diff --git a/windows/deployment/update/waas-optimize-windows-10-updates.md b/windows/deployment/update/waas-optimize-windows-10-updates.md index 08ff7d66a5..993d1f887d 100644 --- a/windows/deployment/update/waas-optimize-windows-10-updates.md +++ b/windows/deployment/update/waas-optimize-windows-10-updates.md @@ -4,9 +4,9 @@ description: Two methods of peer-to-peer content distribution are available in W ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library -author: greg-lindsay +author: jaimeo ms.localizationpriority: medium -ms.author: greg-lindsay +ms.author: jaimeo ms.reviewer: manager: laurawi ms.topic: article diff --git a/windows/deployment/update/waas-restart.md b/windows/deployment/update/waas-restart.md index bab9a9e136..0ea4468377 100644 --- a/windows/deployment/update/waas-restart.md +++ b/windows/deployment/update/waas-restart.md @@ -4,10 +4,9 @@ description: tbd ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: greg-lindsay +author: jaimeo ms.localizationpriority: medium -ms.author: greg-lindsay -ms.date: 07/27/2017 +ms.author: jaimeo ms.reviewer: manager: laurawi ms.topic: article diff --git a/windows/deployment/update/waas-wufb-group-policy.md b/windows/deployment/update/waas-wufb-group-policy.md index 4748ffac57..d45100b41b 100644 --- a/windows/deployment/update/waas-wufb-group-policy.md +++ b/windows/deployment/update/waas-wufb-group-policy.md @@ -4,10 +4,9 @@ description: Configure Windows Update for Business settings using Group Policy. ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library -author: greg-lindsay +author: jaimeo ms.localizationpriority: medium -ms.author: greg-lindsay -ms.date: 07/27/2017 +ms.author: jaimeo ms.reviewer: manager: laurawi ms.topic: article diff --git a/windows/deployment/windows-autopilot/bitlocker.md b/windows/deployment/windows-autopilot/bitlocker.md index 7e85f7099d..234ae17fcc 100644 --- a/windows/deployment/windows-autopilot/bitlocker.md +++ b/windows/deployment/windows-autopilot/bitlocker.md @@ -1,54 +1,54 @@ ---- -title: Setting the BitLocker encryption algorithm for Autopilot devices -ms.reviewer: -manager: laurawi -description: Microsoft Intune provides a comprehensive set of configuration options to manage BitLocker on Windows 10 devices. -keywords: Autopilot, BitLocker, encryption, 256-bit, Windows 10 -ms.prod: w10 -ms.technology: Windows -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: deploy -ms.localizationpriority: medium -audience: itpro author: greg-lindsay -ms.author: greglin -ms.collection: M365-modern-desktop -ms.topic: article ---- - - -# Setting the BitLocker encryption algorithm for Autopilot devices - -**Applies to** - -- Windows 10 - -With Windows Autopilot, you can configure the BitLocker encryption settings to be applied before automatic encryption is started. This ensures that the default encrytion algorithm is not applied automatically when this is not the desired setting. Other BitLocker policies that must be applied prior to encryption can also be delivered before automatic BitLocker encryption begins. - -The BitLocker encryption algorithm is used when BitLocker is first enabled, and sets the strength to which full volume encryption should occur. Available encryption algorithms are: AES-CBC 128-bit, AES-CBC 256-bit, XTS-AES 128-bit or XTS-AES 256-bit encryption. The default value is XTS-AES 128-bit encryption. See [BitLocker CSP](https://docs.microsoft.com/windows/client-management/mdm/bitlocker-csp) for information about the recommended encryption algorithms to use. - -To ensure the desired BitLocker encryption algorithm is set before automatic encryption occurs for Autopilot devices: - -1. Configure the [encryption method settings](https://docs.microsoft.com/intune/endpoint-protection-windows-10#windows-encryption) in the Windows 10 Endpoint Protection profile to the desired encryption algorithm. -2. [Assign the policy](https://docs.microsoft.com/intune/device-profile-assign) to your Autopilot device group. - - **IMPORTANT**: The encryption policy must be assigned to **devices** in the group, not users. -3. Enable the Autopilot [Enrollment Status Page](https://docs.microsoft.com/windows/deployment/windows-autopilot/enrollment-status) (ESP) for these devices. - - **IMPORTANT**: If the ESP is not enabled, the policy will not apply before encryption starts. - -An example of Microsoft Intune Windows Encryption settings is shown below. - - ![BitLocker encryption settings](images/bitlocker-encryption.png) - -Note that a device which is encrypted automatically will need to be decrypted prior to changing the encyption algorithm. - -The settings are available under Device Configuration -> Profiles -> Create profile -> Platform = Windows 10 and later, Profile type = Endpoint protection -> Configure -> Windows Encryption -> BitLocker base settings, Configure encryption methods = Enable. - -Note: It is also recommended to set Windows Encryption -> Windows Settings -> Encrypt = **Require**. - -## Requirements - -Windows 10, version 1809 or later. - -## See also - -[Bitlocker overview](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-overview) +--- +title: Setting the BitLocker encryption algorithm for Autopilot devices +ms.reviewer: +manager: laurawi +description: Microsoft Intune provides a comprehensive set of configuration options to manage BitLocker on Windows 10 devices. +keywords: Autopilot, BitLocker, encryption, 256-bit, Windows 10 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: deploy +ms.localizationpriority: medium +audience: itpro +author: greg-lindsay +ms.author: greglin +ms.collection: M365-modern-desktop +ms.topic: article +--- + + +# Setting the BitLocker encryption algorithm for Autopilot devices + +**Applies to** + +- Windows 10 + +With Windows Autopilot, you can configure the BitLocker encryption settings to be applied before automatic encryption is started. This ensures that the default encrytion algorithm is not applied automatically when this is not the desired setting. Other BitLocker policies that must be applied prior to encryption can also be delivered before automatic BitLocker encryption begins. + +The BitLocker encryption algorithm is used when BitLocker is first enabled, and sets the strength to which full volume encryption should occur. Available encryption algorithms are: AES-CBC 128-bit, AES-CBC 256-bit, XTS-AES 128-bit or XTS-AES 256-bit encryption. The default value is XTS-AES 128-bit encryption. See [BitLocker CSP](https://docs.microsoft.com/windows/client-management/mdm/bitlocker-csp) for information about the recommended encryption algorithms to use. + +To ensure the desired BitLocker encryption algorithm is set before automatic encryption occurs for Autopilot devices: + +1. Configure the [encryption method settings](https://docs.microsoft.com/intune/endpoint-protection-windows-10#windows-encryption) in the Windows 10 Endpoint Protection profile to the desired encryption algorithm. +2. [Assign the policy](https://docs.microsoft.com/intune/device-profile-assign) to your Autopilot device group. + - **IMPORTANT**: The encryption policy must be assigned to **devices** in the group, not users. +3. Enable the Autopilot [Enrollment Status Page](https://docs.microsoft.com/windows/deployment/windows-autopilot/enrollment-status) (ESP) for these devices. + - **IMPORTANT**: If the ESP is not enabled, the policy will not apply before encryption starts. + +An example of Microsoft Intune Windows Encryption settings is shown below. + + ![BitLocker encryption settings](images/bitlocker-encryption.png) + +Note that a device which is encrypted automatically will need to be decrypted prior to changing the encyption algorithm. + +The settings are available under Device Configuration -> Profiles -> Create profile -> Platform = Windows 10 and later, Profile type = Endpoint protection -> Configure -> Windows Encryption -> BitLocker base settings, Configure encryption methods = Enable. + +Note: It is also recommended to set Windows Encryption -> Windows Settings -> Encrypt = **Require**. + +## Requirements + +Windows 10, version 1809 or later. + +## See also + +[Bitlocker overview](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-overview) diff --git a/windows/deployment/windows-autopilot/enrollment-status.md b/windows/deployment/windows-autopilot/enrollment-status.md index 6c5c118bec..11a393eada 100644 --- a/windows/deployment/windows-autopilot/enrollment-status.md +++ b/windows/deployment/windows-autopilot/enrollment-status.md @@ -1,39 +1,39 @@ ---- -title: Windows Autopilot Enrollment Status Page -ms.reviewer: -manager: laurawi -description: Gives an overview of the Enrollment Status Page capabilities, configuration -keywords: Autopilot Plug and Forget, Windows 10 -ms.prod: w10 -ms.technology: Windows -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: deploy -ms.localizationpriority: medium -audience: itpro author: greg-lindsay -ms.author: greglin -ms.collection: M365-modern-desktop -ms.topic: article ---- - - -# Windows Autopilot Enrollment Status Page - -**Applies to** - -- Windows 10, version 1803 and later - -The Enrollment Status Page (ESP) displays the status of the complete device configuration process when an MDM managed user signs into a device for the very first time. The ESP will help users understand the progress of device provisioning and ensures the device has met the organizations desired state before the user can access the desktop for the first time. - -The ESP will track the installation of applications, security policies, certificates and network connections. Within Intune, an administrator can deploy ESP profiles to a licensed Intune user and configure specific settings within the ESP profile; a few of these settings are: force the installation of specified applications, allow users to collect troubleshooting logs, specify what a user can do if device setup fails. For more information, see how to set up the [Enrollment Status Page in Intune](https://docs.microsoft.com/intune/windows-enrollment-status). - - ![Enrollment Status Page](images/enrollment-status-page.png) - - -## More information - -For more information on configuring the Enrollment Status Page, see the [Microsoft Intune documentation](https://docs.microsoft.com/intune/windows-enrollment-status).
-For details about the underlying implementation, see the [FirstSyncStatus details in the DMClient CSP documentation](https://docs.microsoft.com/windows/client-management/mdm/dmclient-csp).
-For more information about blocking for app installation: -- [Blocking for app installation using Enrollment Status Page](https://blogs.technet.microsoft.com/mniehaus/2018/12/06/blocking-for-app-installation-using-enrollment-status-page/). -- [Support Tip: Office C2R installation is now tracked during ESP](https://techcommunity.microsoft.com/t5/Intune-Customer-Success/Support-Tip-Office-C2R-installation-is-now-tracked-during-ESP/ba-p/295514). +--- +title: Windows Autopilot Enrollment Status Page +ms.reviewer: +manager: laurawi +description: Gives an overview of the Enrollment Status Page capabilities, configuration +keywords: Autopilot Plug and Forget, Windows 10 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: deploy +ms.localizationpriority: medium +audience: itpro +author: greg-lindsay +ms.author: greglin +ms.collection: M365-modern-desktop +ms.topic: article +--- + + +# Windows Autopilot Enrollment Status Page + +**Applies to** + +- Windows 10, version 1803 and later + +The Enrollment Status Page (ESP) displays the status of the complete device configuration process when an MDM managed user signs into a device for the very first time. The ESP will help users understand the progress of device provisioning and ensures the device has met the organizations desired state before the user can access the desktop for the first time. + +The ESP will track the installation of applications, security policies, certificates and network connections. Within Intune, an administrator can deploy ESP profiles to a licensed Intune user and configure specific settings within the ESP profile; a few of these settings are: force the installation of specified applications, allow users to collect troubleshooting logs, specify what a user can do if device setup fails. For more information, see how to set up the [Enrollment Status Page in Intune](https://docs.microsoft.com/intune/windows-enrollment-status). + + ![Enrollment Status Page](images/enrollment-status-page.png) + + +## More information + +For more information on configuring the Enrollment Status Page, see the [Microsoft Intune documentation](https://docs.microsoft.com/intune/windows-enrollment-status).
+For details about the underlying implementation, see the [FirstSyncStatus details in the DMClient CSP documentation](https://docs.microsoft.com/windows/client-management/mdm/dmclient-csp).
+For more information about blocking for app installation: +- [Blocking for app installation using Enrollment Status Page](https://blogs.technet.microsoft.com/mniehaus/2018/12/06/blocking-for-app-installation-using-enrollment-status-page/). +- [Support Tip: Office C2R installation is now tracked during ESP](https://techcommunity.microsoft.com/t5/Intune-Customer-Success/Support-Tip-Office-C2R-installation-is-now-tracked-during-ESP/ba-p/295514). diff --git a/windows/hub/index.md b/windows/hub/index.md index c9bfdfd89d..d9e3556000 100644 --- a/windows/hub/index.md +++ b/windows/hub/index.md @@ -7,9 +7,8 @@ ms.localizationpriority: high ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -ms.date: 07/16/2019 ms.author: dansimp -ms.date: 09/03/2018 +author: dansimp ms.reviewer: dansimp manager: dansimp --- From 867bd2200b9126b663106390308fdc4d0c88fb40 Mon Sep 17 00:00:00 2001 From: Greg Lindsay Date: Fri, 6 Sep 2019 10:37:24 -0700 Subject: [PATCH 43/49] fixing some warnings --- windows/application-management/index.md | 2 +- windows/client-management/index.md | 2 +- windows/configuration/index.md | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/application-management/index.md b/windows/application-management/index.md index 7a65732e01..fef303c216 100644 --- a/windows/application-management/index.md +++ b/windows/application-management/index.md @@ -4,9 +4,9 @@ description: Windows 10 application management ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library +manager: dansimp author: dansimp ms.localizationpriority: high -ms.date: 09/26/2017 --- # Windows 10 application management diff --git a/windows/client-management/index.md b/windows/client-management/index.md index f949fe4666..ff70171304 100644 --- a/windows/client-management/index.md +++ b/windows/client-management/index.md @@ -6,7 +6,7 @@ ms.mktglfcycl: manage ms.sitesec: library author: dansimp ms.localizationpriority: medium -ms.date: 08/16/2017 +ms.author: dansimp --- # Client management diff --git a/windows/configuration/index.md b/windows/configuration/index.md index 383f35f8fe..ca42852107 100644 --- a/windows/configuration/index.md +++ b/windows/configuration/index.md @@ -7,10 +7,10 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: high +manager: dansimp author: dansimp ms.author: dansimp ms.topic: article -ms.date: 05/11/2018 --- # Configure Windows 10 From 517c5d716f72668e016c6ab28d2edd7945bafbc6 Mon Sep 17 00:00:00 2001 From: Greg Lindsay Date: Fri, 6 Sep 2019 11:13:45 -0700 Subject: [PATCH 44/49] one more crack at more warning fixes --- windows/configuration/wcd/wcd-deviceupdatecenter.md | 1 + windows/configuration/wcd/wcd-privacy.md | 1 + windows/configuration/wcd/wcd-time.md | 1 + 3 files changed, 3 insertions(+) diff --git a/windows/configuration/wcd/wcd-deviceupdatecenter.md b/windows/configuration/wcd/wcd-deviceupdatecenter.md index 52eac80d89..0a509c9bc2 100644 --- a/windows/configuration/wcd/wcd-deviceupdatecenter.md +++ b/windows/configuration/wcd/wcd-deviceupdatecenter.md @@ -7,6 +7,7 @@ ms.sitesec: library author: dansimp ms.localizationpriority: medium ms.author: dansimp +manager: dansimp ms.topic: article --- diff --git a/windows/configuration/wcd/wcd-privacy.md b/windows/configuration/wcd/wcd-privacy.md index 2232d7d011..7e5e005614 100644 --- a/windows/configuration/wcd/wcd-privacy.md +++ b/windows/configuration/wcd/wcd-privacy.md @@ -7,6 +7,7 @@ ms.sitesec: library author: dansimp ms.localizationpriority: medium ms.author: dansimp +manager: dansimp ms.topic: article --- diff --git a/windows/configuration/wcd/wcd-time.md b/windows/configuration/wcd/wcd-time.md index ded38047c3..a453f8eabe 100644 --- a/windows/configuration/wcd/wcd-time.md +++ b/windows/configuration/wcd/wcd-time.md @@ -7,6 +7,7 @@ ms.sitesec: library author: dansimp ms.localizationpriority: medium ms.author: dansimp +manager: dansimp ms.topic: article --- From 1c92c79268379ac19c415cb5a35cd71c8517d0ec Mon Sep 17 00:00:00 2001 From: Greg Lindsay Date: Fri, 6 Sep 2019 11:46:03 -0700 Subject: [PATCH 45/49] again --- windows/configuration/wcd/wcd-location.md | 1 - windows/configuration/wcd/wcd-maps.md | 1 - windows/configuration/wcd/wcd-messaging.md | 1 - windows/configuration/wcd/wcd-modemconfigurations.md | 1 - windows/configuration/wcd/wcd-multivariant.md | 1 - windows/configuration/wcd/wcd-networkproxy.md | 1 - windows/configuration/wcd/wcd-networkqospolicy.md | 1 - windows/configuration/wcd/wcd-nfc.md | 1 - windows/configuration/wcd/wcd-personalization.md | 1 - windows/configuration/wcd/wcd-storaged3inmodernstandby.md | 1 + windows/configuration/wcd/wcd-theme.md | 1 - windows/configuration/wcd/wcd-unifiedwritefilter.md | 1 - windows/configuration/wcd/wcd-universalappinstall.md | 1 - windows/configuration/wcd/wcd-universalappuninstall.md | 1 - windows/configuration/wcd/wcd-usberrorsoemoverride.md | 1 - windows/configuration/wcd/wcd-weakcharger.md | 1 - windows/configuration/wcd/wcd-windowshelloforbusiness.md | 1 - windows/configuration/wcd/wcd-windowsteamsettings.md | 1 - windows/configuration/wcd/wcd.md | 1 - 19 files changed, 1 insertion(+), 18 deletions(-) diff --git a/windows/configuration/wcd/wcd-location.md b/windows/configuration/wcd/wcd-location.md index 51c9676fc7..c2585b8fec 100644 --- a/windows/configuration/wcd/wcd-location.md +++ b/windows/configuration/wcd/wcd-location.md @@ -8,7 +8,6 @@ author: dansimp ms.localizationpriority: medium ms.author: dansimp ms.topic: article -ms.date: 10/02/2018 ms.reviewer: manager: dansimp --- diff --git a/windows/configuration/wcd/wcd-maps.md b/windows/configuration/wcd/wcd-maps.md index 413d267bd9..d50b2c93ed 100644 --- a/windows/configuration/wcd/wcd-maps.md +++ b/windows/configuration/wcd/wcd-maps.md @@ -8,7 +8,6 @@ author: dansimp ms.localizationpriority: medium ms.author: dansimp ms.topic: article -ms.date: 04/30/2018 ms.reviewer: manager: dansimp --- diff --git a/windows/configuration/wcd/wcd-messaging.md b/windows/configuration/wcd/wcd-messaging.md index cb9a984961..67158a5f0c 100644 --- a/windows/configuration/wcd/wcd-messaging.md +++ b/windows/configuration/wcd/wcd-messaging.md @@ -8,7 +8,6 @@ author: dansimp ms.localizationpriority: medium ms.author: dansimp ms.topic: article -ms.date: 04/30/2018 ms.reviewer: manager: dansimp --- diff --git a/windows/configuration/wcd/wcd-modemconfigurations.md b/windows/configuration/wcd/wcd-modemconfigurations.md index 7e4b830d53..2e35a4939e 100644 --- a/windows/configuration/wcd/wcd-modemconfigurations.md +++ b/windows/configuration/wcd/wcd-modemconfigurations.md @@ -8,7 +8,6 @@ author: dansimp ms.localizationpriority: medium ms.author: dansimp ms.topic: article -ms.date: 09/12/2017 ms.reviewer: manager: dansimp --- diff --git a/windows/configuration/wcd/wcd-multivariant.md b/windows/configuration/wcd/wcd-multivariant.md index 1a6771f972..504a5fbd1b 100644 --- a/windows/configuration/wcd/wcd-multivariant.md +++ b/windows/configuration/wcd/wcd-multivariant.md @@ -8,7 +8,6 @@ author: dansimp ms.localizationpriority: medium ms.author: dansimp ms.topic: article -ms.date: 09/06/2017 ms.reviewer: manager: dansimp --- diff --git a/windows/configuration/wcd/wcd-networkproxy.md b/windows/configuration/wcd/wcd-networkproxy.md index 6fc060772a..916599130b 100644 --- a/windows/configuration/wcd/wcd-networkproxy.md +++ b/windows/configuration/wcd/wcd-networkproxy.md @@ -8,7 +8,6 @@ author: dansimp ms.localizationpriority: medium ms.author: dansimp ms.topic: article -ms.date: 09/06/2017 ms.reviewer: manager: dansimp --- diff --git a/windows/configuration/wcd/wcd-networkqospolicy.md b/windows/configuration/wcd/wcd-networkqospolicy.md index 33a0bfac6b..9a459a884b 100644 --- a/windows/configuration/wcd/wcd-networkqospolicy.md +++ b/windows/configuration/wcd/wcd-networkqospolicy.md @@ -8,7 +8,6 @@ author: dansimp ms.localizationpriority: medium ms.author: dansimp ms.topic: article -ms.date: 09/06/2017 ms.reviewer: manager: dansimp --- diff --git a/windows/configuration/wcd/wcd-nfc.md b/windows/configuration/wcd/wcd-nfc.md index cede584f46..0e69a8611f 100644 --- a/windows/configuration/wcd/wcd-nfc.md +++ b/windows/configuration/wcd/wcd-nfc.md @@ -8,7 +8,6 @@ author: dansimp ms.localizationpriority: medium ms.author: dansimp ms.topic: article -ms.date: 09/06/2017 ms.reviewer: manager: dansimp --- diff --git a/windows/configuration/wcd/wcd-personalization.md b/windows/configuration/wcd/wcd-personalization.md index 5368e5b446..c452d22dbc 100644 --- a/windows/configuration/wcd/wcd-personalization.md +++ b/windows/configuration/wcd/wcd-personalization.md @@ -8,7 +8,6 @@ author: dansimp ms.localizationpriority: medium ms.author: dansimp ms.topic: article -ms.date: 09/06/2017 ms.reviewer: manager: dansimp --- diff --git a/windows/configuration/wcd/wcd-storaged3inmodernstandby.md b/windows/configuration/wcd/wcd-storaged3inmodernstandby.md index 604fd59cf7..e435b32ee5 100644 --- a/windows/configuration/wcd/wcd-storaged3inmodernstandby.md +++ b/windows/configuration/wcd/wcd-storaged3inmodernstandby.md @@ -8,6 +8,7 @@ author: dansimp ms.localizationpriority: medium ms.author: dansimp ms.topic: article +manager: dansimp --- # StorageD3InModernStandby (Windows Configuration Designer reference) diff --git a/windows/configuration/wcd/wcd-theme.md b/windows/configuration/wcd/wcd-theme.md index 658b518cfb..d368119a52 100644 --- a/windows/configuration/wcd/wcd-theme.md +++ b/windows/configuration/wcd/wcd-theme.md @@ -8,7 +8,6 @@ author: dansimp ms.localizationpriority: medium ms.author: dansimp ms.topic: article -ms.date: 09/06/2017 ms.reviewer: manager: dansimp --- diff --git a/windows/configuration/wcd/wcd-unifiedwritefilter.md b/windows/configuration/wcd/wcd-unifiedwritefilter.md index 104503cd09..2d215d1d84 100644 --- a/windows/configuration/wcd/wcd-unifiedwritefilter.md +++ b/windows/configuration/wcd/wcd-unifiedwritefilter.md @@ -8,7 +8,6 @@ author: dansimp ms.localizationpriority: medium ms.author: dansimp ms.topic: article -ms.date: 10/02/2018 ms.reviewer: manager: dansimp --- diff --git a/windows/configuration/wcd/wcd-universalappinstall.md b/windows/configuration/wcd/wcd-universalappinstall.md index be0152d06b..0877cba652 100644 --- a/windows/configuration/wcd/wcd-universalappinstall.md +++ b/windows/configuration/wcd/wcd-universalappinstall.md @@ -8,7 +8,6 @@ author: dansimp ms.localizationpriority: medium ms.author: dansimp ms.topic: article -ms.date: 04/30/2018 ms.reviewer: manager: dansimp --- diff --git a/windows/configuration/wcd/wcd-universalappuninstall.md b/windows/configuration/wcd/wcd-universalappuninstall.md index d31c0c0dec..b9a7329acf 100644 --- a/windows/configuration/wcd/wcd-universalappuninstall.md +++ b/windows/configuration/wcd/wcd-universalappuninstall.md @@ -8,7 +8,6 @@ author: dansimp ms.localizationpriority: medium ms.author: dansimp ms.topic: article -ms.date: 09/14/2017 ms.reviewer: manager: dansimp --- diff --git a/windows/configuration/wcd/wcd-usberrorsoemoverride.md b/windows/configuration/wcd/wcd-usberrorsoemoverride.md index c2ba08ffff..92a723d0c0 100644 --- a/windows/configuration/wcd/wcd-usberrorsoemoverride.md +++ b/windows/configuration/wcd/wcd-usberrorsoemoverride.md @@ -8,7 +8,6 @@ author: dansimp ms.localizationpriority: medium ms.author: dansimp ms.topic: article -ms.date: 09/14/2017 ms.reviewer: manager: dansimp --- diff --git a/windows/configuration/wcd/wcd-weakcharger.md b/windows/configuration/wcd/wcd-weakcharger.md index a20822fe41..317198f6b9 100644 --- a/windows/configuration/wcd/wcd-weakcharger.md +++ b/windows/configuration/wcd/wcd-weakcharger.md @@ -8,7 +8,6 @@ author: dansimp ms.localizationpriority: medium ms.author: dansimp ms.topic: article -ms.date: 04/30/2018 ms.reviewer: manager: dansimp --- diff --git a/windows/configuration/wcd/wcd-windowshelloforbusiness.md b/windows/configuration/wcd/wcd-windowshelloforbusiness.md index e955414622..936d9d7e62 100644 --- a/windows/configuration/wcd/wcd-windowshelloforbusiness.md +++ b/windows/configuration/wcd/wcd-windowshelloforbusiness.md @@ -8,7 +8,6 @@ author: dansimp ms.localizationpriority: medium ms.author: dansimp ms.topic: article -ms.date: 10/02/2018 ms.reviewer: manager: dansimp --- diff --git a/windows/configuration/wcd/wcd-windowsteamsettings.md b/windows/configuration/wcd/wcd-windowsteamsettings.md index 1f05397e01..f459457d42 100644 --- a/windows/configuration/wcd/wcd-windowsteamsettings.md +++ b/windows/configuration/wcd/wcd-windowsteamsettings.md @@ -8,7 +8,6 @@ author: dansimp ms.localizationpriority: medium ms.author: dansimp ms.topic: article -ms.date: 04/30/2018 ms.reviewer: manager: dansimp --- diff --git a/windows/configuration/wcd/wcd.md b/windows/configuration/wcd/wcd.md index 8719cd6f74..4372317664 100644 --- a/windows/configuration/wcd/wcd.md +++ b/windows/configuration/wcd/wcd.md @@ -8,7 +8,6 @@ author: dansimp ms.localizationpriority: medium ms.author: dansimp ms.topic: article -ms.date: 07/19/2018 ms.reviewer: manager: dansimp --- From bffa6491c5cd97bf7e5d45bb162b54479cc3e2ee Mon Sep 17 00:00:00 2001 From: Greg Lindsay Date: Fri, 6 Sep 2019 12:22:57 -0700 Subject: [PATCH 46/49] a few more fixes --- .../ie11-deploy-guide/index.md | 5 +- .../feature-selection-ieak11-wizard.md | 128 ++++---- browsers/internet-explorer/ie11-ieak/index.md | 5 +- smb/cloud-mode-business-setup.md | 7 +- smb/index.md | 6 +- ...-10-start-screens-by-using-group-policy.md | 1 - .../configuration/start-secondary-tiles.md | 3 +- windows/whats-new/index.md | 78 ++--- windows/whats-new/ltsc/index.md | 102 +++--- ...ts-new-windows-10-version-1507-and-1511.md | 7 +- .../whats-new-windows-10-version-1607.md | 7 +- .../whats-new-windows-10-version-1703.md | 7 +- .../whats-new-windows-10-version-1709.md | 7 +- .../whats-new-windows-10-version-1803.md | 7 +- .../whats-new-windows-10-version-1809.md | 6 +- .../whats-new-windows-10-version-1903.md | 304 +++++++++--------- 16 files changed, 340 insertions(+), 340 deletions(-) diff --git a/browsers/internet-explorer/ie11-deploy-guide/index.md b/browsers/internet-explorer/ie11-deploy-guide/index.md index 6d5935a29b..d2bc3fa2d1 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/index.md +++ b/browsers/internet-explorer/ie11-deploy-guide/index.md @@ -1,13 +1,14 @@ --- ms.mktglfcycl: deploy description: Use this guide to learn about the several options and processes you'll need to consider while you're planning for, deploying, and customizing Internet Explorer 11 for your employee's devices. -author: shortpatti +author: lomayor +ms.author: lomayor ms.prod: ie11 ms.assetid: bddc2d97-c38d-45c5-9588-1f5bbff2e9c3 title: Internet Explorer 11 (IE11) - Deployment Guide for IT Pros (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.localizationpriority: medium -ms.date: 07/27/2017 +manager: dansimp --- diff --git a/browsers/internet-explorer/ie11-ieak/feature-selection-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/feature-selection-ieak11-wizard.md index 78294cd509..0790851097 100644 --- a/browsers/internet-explorer/ie11-ieak/feature-selection-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/feature-selection-ieak11-wizard.md @@ -1,64 +1,64 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to use the Feature Selection page in the IEAK 11 Customization Wizard to choose which parts of the setup processes and Internet Explorer 11 to change for your company. -author: lomayor -ms.prod: ie11 -ms.assetid: 9cb8324e-d73b-41ba-ade9-3acc796e21d8 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Use the Feature Selection page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the Feature Selection page in the IEAK 11 Wizard -The **Feature Selection** page of the Internet Explorer Customization Wizard 11 lets you choose which parts of the setup processes and Internet Explorer 11 to change for your company, including: - -- **Setup Customizations.** Lets you add custom components, decide which components to install, provide your download site information, and modify the Setup title bar and graphics. - -- **Internal Install.** Lets you decide to install the latest updates, run the malicious Software Removal Tool, and set IE11 as the default browser. - -- **Connection Manager.** Lets you import your Connection Manager Profiles, created by the Connection Manager Administration Kit (CMAK). - -- **Browser User Interface.** Lets you change the toolbar buttons, the title bar, and the general look of the browser. - -- **Search Providers.** Lets you add, remove, and pick a new default search provider for IE11. - -- **Important URLs – Home Page and Support.** Lets you choose multiple **Home** pages that open in different tabs in IE. You can also use this page to change the **Welcome** and **Online Support** pages. - -- **Accelerators.** Lets you import, add, edit, or remove Accelerators, the contextual services that give you quick access to external services from any webpage. - -- **Favorites, Favorites Bar, and Feeds.** Lets you pick which favorites, web slices, and feeds are installed with your custom installation package. - -- **Browsing Options.** Lets you pick how you delete items in the Favorites, Favorites Bar, and Feeds folders, and whether to add the Microsoft default items. - -- **Compatibility View.** Lets you decide whether IE renders content using compatibility mode or standards mode. - -- **Connections Customization.** Lets you set up and deploy custom connections. - -- **Security Zones and Content Ratings.** Lets you control what your employees can view and what’s downloaded to their computer. - -- **Programs.** Lets you pick the default program that’s used automatically by email, HTML, newsgroups, Internet calls, calendars, and contact lists. - -- **Additional Settings.** Lets you pre-set and lockdown specific functionality on your employee’s computer. - -**Note**
Your choices on this page determine what wizard pages appear. - -**To use the Feature Selection page** - -1. Check the box next to each feature you want to include in your custom installation package.

-You can also click **Select All** to add, or **Clear All** to remove, all of the features. - -2. Click **Next** to go to the [Automatic Version Synchronization](auto-version-sync-ieak11-wizard.md) page or **Back** to go to the [Package Type Selection](pkg-type-selection-ieak11-wizard.md) page. - -  - -  - - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: How to use the Feature Selection page in the IEAK 11 Customization Wizard to choose which parts of the setup processes and Internet Explorer 11 to change for your company. +author: lomayor +ms.prod: ie11 +ms.assetid: 9cb8324e-d73b-41ba-ade9-3acc796e21d8 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: lomayor +title: Use the Feature Selection page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) +ms.sitesec: library +--- + + +# Use the Feature Selection page in the IEAK 11 Wizard +The **Feature Selection** page of the Internet Explorer Customization Wizard 11 lets you choose which parts of the setup processes and Internet Explorer 11 to change for your company, including: + +- **Setup Customizations.** Lets you add custom components, decide which components to install, provide your download site information, and modify the Setup title bar and graphics. + +- **Internal Install.** Lets you decide to install the latest updates, run the malicious Software Removal Tool, and set IE11 as the default browser. + +- **Connection Manager.** Lets you import your Connection Manager Profiles, created by the Connection Manager Administration Kit (CMAK). + +- **Browser User Interface.** Lets you change the toolbar buttons, the title bar, and the general look of the browser. + +- **Search Providers.** Lets you add, remove, and pick a new default search provider for IE11. + +- **Important URLs – Home Page and Support.** Lets you choose multiple **Home** pages that open in different tabs in IE. You can also use this page to change the **Welcome** and **Online Support** pages. + +- **Accelerators.** Lets you import, add, edit, or remove Accelerators, the contextual services that give you quick access to external services from any webpage. + +- **Favorites, Favorites Bar, and Feeds.** Lets you pick which favorites, web slices, and feeds are installed with your custom installation package. + +- **Browsing Options.** Lets you pick how you delete items in the Favorites, Favorites Bar, and Feeds folders, and whether to add the Microsoft default items. + +- **Compatibility View.** Lets you decide whether IE renders content using compatibility mode or standards mode. + +- **Connections Customization.** Lets you set up and deploy custom connections. + +- **Security Zones and Content Ratings.** Lets you control what your employees can view and what’s downloaded to their computer. + +- **Programs.** Lets you pick the default program that’s used automatically by email, HTML, newsgroups, Internet calls, calendars, and contact lists. + +- **Additional Settings.** Lets you pre-set and lockdown specific functionality on your employee’s computer. + +**Note**
Your choices on this page determine what wizard pages appear. + +**To use the Feature Selection page** + +1. Check the box next to each feature you want to include in your custom installation package.

+You can also click **Select All** to add, or **Clear All** to remove, all of the features. + +2. Click **Next** to go to the [Automatic Version Synchronization](auto-version-sync-ieak11-wizard.md) page or **Back** to go to the [Package Type Selection](pkg-type-selection-ieak11-wizard.md) page. + +  + +  + + + + + diff --git a/browsers/internet-explorer/ie11-ieak/index.md b/browsers/internet-explorer/ie11-ieak/index.md index ea51efa9dc..6dc2619b8b 100644 --- a/browsers/internet-explorer/ie11-ieak/index.md +++ b/browsers/internet-explorer/ie11-ieak/index.md @@ -1,13 +1,14 @@ --- ms.mktglfcycl: plan description: IEAK 11 - Internet Explorer Administration Kit 11 Users Guide -author: shortpatti +author: lomayor +ms.author: lomayor ms.prod: ie11 ms.assetid: 847bd7b4-d5dd-4e10-87b5-4d7d3a99bbac title: Internet Explorer Administration Kit 11 (IEAK 11) - Administrator's Guide (Internet Explorer Administration Kit 11 for IT Pros) ms.sitesec: library ms.localizationpriority: medium -ms.date: 07/27/2017 +manager: dansimp --- diff --git a/smb/cloud-mode-business-setup.md b/smb/cloud-mode-business-setup.md index 5db1de9950..b3f0ec8f06 100644 --- a/smb/cloud-mode-business-setup.md +++ b/smb/cloud-mode-business-setup.md @@ -2,15 +2,14 @@ title: Deploy and manage a full cloud IT solution for your business description: Learn how to set up a cloud infrastructure for your business, acquire devices and apps, and configure and deploy policies to your devices. keywords: smb, full cloud IT solution, small to medium business, deploy, setup, manage, Windows, Intune, Office 365 -ms.prod: w10 -ms.technology: smb-windows -ms.topic: hero-article +ms.prod: +ms.technology: ms.author: eravena +audience: itpro ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: smb author: eavena -ms.date: 10/30/2017 ms.reviewer: manager: dansimp ms.localizationpriority: medium diff --git a/smb/index.md b/smb/index.md index 4df3e742c1..5cc2746261 100644 --- a/smb/index.md +++ b/smb/index.md @@ -2,16 +2,16 @@ title: Windows 10 for small to midsize businesses description: Microsoft products and devices to transform and grow your businessLearn how to use Windows 10 for your small to midsize business. keywords: Windows 10, SMB, small business, midsize business, business -ms.prod: w10 -ms.technology: smb-windows +ms.prod: +ms.technology: ms.topic: article ms.author: celested ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: smb author: CelesteDG -ms.date: 05/01/2017 ms.localizationpriority: medium +manager: dansimp --- # Windows 10 for SMB diff --git a/windows/configuration/customize-windows-10-start-screens-by-using-group-policy.md b/windows/configuration/customize-windows-10-start-screens-by-using-group-policy.md index 0647e4eec3..3cd4ad2b71 100644 --- a/windows/configuration/customize-windows-10-start-screens-by-using-group-policy.md +++ b/windows/configuration/customize-windows-10-start-screens-by-using-group-policy.md @@ -12,7 +12,6 @@ author: dansimp ms.localizationpriority: medium ms.author: dansimp ms.topic: article -ms.date: 11/15/2017 --- # Customize Windows 10 Start and taskbar with Group Policy diff --git a/windows/configuration/start-secondary-tiles.md b/windows/configuration/start-secondary-tiles.md index 2cdfa8a68e..2064129dc1 100644 --- a/windows/configuration/start-secondary-tiles.md +++ b/windows/configuration/start-secondary-tiles.md @@ -9,7 +9,6 @@ ms.localizationpriority: medium author: dansimp ms.author: dansimp ms.topic: article -ms.date: 06/27/2018 ms.reviewer: manager: dansimp --- @@ -111,7 +110,7 @@ In Microsoft Intune, you create a device restrictions policy to apply to device ### Using a provisioning package -#### Prepare the Start layout and Edge assets XML files +#### Prepare the Start layout and Edge assets XML files The **export-StartLayout** and **export-StartLayoutEdgeAssets** cmdlets produce XML files. Because Windows Configuration Designer produces a customizations.xml file that contains the configuration settings, adding the Start layout and Edge assets sections to the customizations.xml file directly would result in an XML file embedded in an XML file. Before you add the Start layout and Edge assets sections to the customizations.xml file, you must replace the markup characters in your layout.xml with escape characters. diff --git a/windows/whats-new/index.md b/windows/whats-new/index.md index 27d454fa86..b4809b546b 100644 --- a/windows/whats-new/index.md +++ b/windows/whats-new/index.md @@ -1,38 +1,40 @@ ---- -title: What's new in Windows 10 (Windows 10) -description: Learn about new features in Windows 10 for IT professionals, such as Windows Information Protection, Windows Hello, Device Guard, and more. -ms.assetid: F1867017-76A1-4761-A200-7450B96AEF44 -keywords: ["What's new in Windows 10", "Windows 10"] -ms.prod: w10 -audience: itpro author: greg-lindsay -manager: laurawi -ms.localizationpriority: high -ms.topic: article ---- - -# What's new in Windows 10 - -Windows 10 provides IT professionals with advanced protection against modern security threats and comprehensive management and control over devices and apps, as well as flexible deployment, update, and support options. Learn about new features in Windows 10 for IT professionals, such as Windows Information Protection, Windows Hello, Device Guard, and more. - -## In this section - -- [What's new in Windows 10, version 1903](whats-new-windows-10-version-1903.md) -- [What's new in Windows 10, version 1809](whats-new-windows-10-version-1809.md) -- [What's new in Windows 10, version 1803](whats-new-windows-10-version-1803.md) -- [What's new in Windows 10, version 1709](whats-new-windows-10-version-1709.md) -- [What's new in Windows 10, version 1703](whats-new-windows-10-version-1703.md) -- [What's new in Windows 10, version 1607](whats-new-windows-10-version-1607.md) -- [What's new in Windows 10, versions 1507 and 1511](whats-new-windows-10-version-1507-and-1511.md) - -## Learn more - -- [Windows 10 release information](https://technet.microsoft.com/windows/release-info) -- [Windows 10 update history](https://support.microsoft.com/help/12387/windows-10-update-history) -- [Windows 10 content from Microsoft Ignite](https://go.microsoft.com/fwlink/p/?LinkId=613210) -- [Compare Windows 10 Editions](https://go.microsoft.com/fwlink/p/?LinkId=690485) - -## See also - -[Windows 10 Enterprise LTSC](ltsc/index.md)
-[Edit an existing topic using the Edit link](contribute-to-a-topic.md) - +--- +title: What's new in Windows 10 (Windows 10) +description: Learn about new features in Windows 10 for IT professionals, such as Windows Information Protection, Windows Hello, Device Guard, and more. +ms.assetid: F1867017-76A1-4761-A200-7450B96AEF44 +keywords: ["What's new in Windows 10", "Windows 10"] +ms.prod: w10 +audience: itpro +author: greg-lindsay +ms.author: greglin +manager: laurawi +ms.localizationpriority: high +ms.topic: article +--- + +# What's new in Windows 10 + +Windows 10 provides IT professionals with advanced protection against modern security threats and comprehensive management and control over devices and apps, as well as flexible deployment, update, and support options. Learn about new features in Windows 10 for IT professionals, such as Windows Information Protection, Windows Hello, Device Guard, and more. + +## In this section + +- [What's new in Windows 10, version 1903](whats-new-windows-10-version-1903.md) +- [What's new in Windows 10, version 1809](whats-new-windows-10-version-1809.md) +- [What's new in Windows 10, version 1803](whats-new-windows-10-version-1803.md) +- [What's new in Windows 10, version 1709](whats-new-windows-10-version-1709.md) +- [What's new in Windows 10, version 1703](whats-new-windows-10-version-1703.md) +- [What's new in Windows 10, version 1607](whats-new-windows-10-version-1607.md) +- [What's new in Windows 10, versions 1507 and 1511](whats-new-windows-10-version-1507-and-1511.md) + +## Learn more + +- [Windows 10 release information](https://technet.microsoft.com/windows/release-info) +- [Windows 10 update history](https://support.microsoft.com/help/12387/windows-10-update-history) +- [Windows 10 content from Microsoft Ignite](https://go.microsoft.com/fwlink/p/?LinkId=613210) +- [Compare Windows 10 Editions](https://go.microsoft.com/fwlink/p/?LinkId=690485) + +## See also + +[Windows 10 Enterprise LTSC](ltsc/index.md)
+[Edit an existing topic using the Edit link](contribute-to-a-topic.md) + diff --git a/windows/whats-new/ltsc/index.md b/windows/whats-new/ltsc/index.md index fa6b259b1c..b1464088fc 100644 --- a/windows/whats-new/ltsc/index.md +++ b/windows/whats-new/ltsc/index.md @@ -1,50 +1,52 @@ ---- -title: Windows 10 Enterprise LTSC -description: New and updated IT Pro content about new features in Windows 10, LTSC (also known as Windows 10 LTSB). -keywords: ["What's new in Windows 10", "Windows 10", "Windows 10 LTSC", "Windows 10 LTSB"] -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -manager: laurawi -ms.localizationpriority: low -ms.topic: article ---- - -# Windows 10 Enterprise LTSC - -**Applies to** -- Windows 10 Enterprise LTSC - -## In this topic - -This topic provides links to articles with information about what's new in each release of Windows 10 Enterprise LTSC, and includes a short description of this servicing channel. - -[What's New in Windows 10 Enterprise 2019 LTSC](whats-new-windows-10-2019.md)
-[What's New in Windows 10 Enterprise 2016 LTSC](whats-new-windows-10-2016.md)
-[What's New in Windows 10 Enterprise 2015 LTSC](whats-new-windows-10-2015.md) - -## The Long Term Servicing Channel (LTSC) - -The following table summarizes equivalent feature update versions of Windows 10 LTSC and semi-annual channel (SAC) releases. - -| LTSC release | Equivalent SAC release | Availability date | -| --- | --- | --- | -| Windows 10 Enterprise 2015 LTSC | Windows 10, Version 1507 | 7/29/2015 | -| Windows 10 Enterprise 2016 LTSC | Windows 10, Version 1607 | 8/2/2016 | -| Windows 10 Enterprise 2019 LTSC | Windows 10, Version 1809 | 11/13/2018 | - ->[!NOTE] ->The Long Term Servicing Channel was previously called the Long Term Servicing Branch (LTSB). All references to LTSB are changed in this article to LTSC for consistency, even though the name of previous versions might still be displayed as LTSB. - -With the LTSC servicing model, customers can delay receiving feature updates and instead only receive monthly quality updates on devices. Features from Windows 10 that could be updated with new functionality, including Cortana, Edge, and all in-box Universal Windows apps, are also not included. Feature updates are offered in new LTSC releases every 2–3 years instead of every 6 months, and organizations can choose to install them as in-place upgrades or even skip releases over a 10-year life cycle. Microsoft is committed to providing bug fixes and security patches for each LTSC release during this 10 year period. - ->[!IMPORTANT] ->The Long Term Servicing Channel is not intended for deployment on most or all the PCs in an organization. The LTSC edition of Windows 10 provides customers with access to a deployment option for their special-purpose devices and environments. These devices typically perform a single important task and don’t need feature updates as frequently as other devices in the organization. These devices are also typically not heavily dependent on support from external apps and tools. Since the feature set for LTSC does not change for the lifetime of the release, over time there might be some external tools that do not continue to provide legacy support. See [LTSC: What is it, and when it should be used](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/LTSC-What-is-it-and-when-should-it-be-used/ba-p/293181). - -For detailed information about Windows 10 servicing, see [Overview of Windows as a service](/windows/deployment/update/waas-overview). - -## See Also - -[What's New in Windows 10](https://docs.microsoft.com/windows/whats-new/): See what’s new in other versions of Windows 10.
-[Windows 10 - Release information](https://docs.microsoft.com/windows/windows-10/release-information): Windows 10 current versions by servicing option. +--- +title: Windows 10 Enterprise LTSC +description: New and updated IT Pro content about new features in Windows 10, LTSC (also known as Windows 10 LTSB). +keywords: ["What's new in Windows 10", "Windows 10", "Windows 10 LTSC", "Windows 10 LTSB"] +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.author: greglin +manager: laurawi +ms.localizationpriority: low +ms.topic: article +--- + +# Windows 10 Enterprise LTSC + +**Applies to** +- Windows 10 Enterprise LTSC + +## In this topic + +This topic provides links to articles with information about what's new in each release of Windows 10 Enterprise LTSC, and includes a short description of this servicing channel. + +[What's New in Windows 10 Enterprise 2019 LTSC](whats-new-windows-10-2019.md)
+[What's New in Windows 10 Enterprise 2016 LTSC](whats-new-windows-10-2016.md)
+[What's New in Windows 10 Enterprise 2015 LTSC](whats-new-windows-10-2015.md) + +## The Long Term Servicing Channel (LTSC) + +The following table summarizes equivalent feature update versions of Windows 10 LTSC and semi-annual channel (SAC) releases. + +| LTSC release | Equivalent SAC release | Availability date | +| --- | --- | --- | +| Windows 10 Enterprise 2015 LTSC | Windows 10, Version 1507 | 7/29/2015 | +| Windows 10 Enterprise 2016 LTSC | Windows 10, Version 1607 | 8/2/2016 | +| Windows 10 Enterprise 2019 LTSC | Windows 10, Version 1809 | 11/13/2018 | + +>[!NOTE] +>The Long Term Servicing Channel was previously called the Long Term Servicing Branch (LTSB). All references to LTSB are changed in this article to LTSC for consistency, even though the name of previous versions might still be displayed as LTSB. + +With the LTSC servicing model, customers can delay receiving feature updates and instead only receive monthly quality updates on devices. Features from Windows 10 that could be updated with new functionality, including Cortana, Edge, and all in-box Universal Windows apps, are also not included. Feature updates are offered in new LTSC releases every 2–3 years instead of every 6 months, and organizations can choose to install them as in-place upgrades or even skip releases over a 10-year life cycle. Microsoft is committed to providing bug fixes and security patches for each LTSC release during this 10 year period. + +>[!IMPORTANT] +>The Long Term Servicing Channel is not intended for deployment on most or all the PCs in an organization. The LTSC edition of Windows 10 provides customers with access to a deployment option for their special-purpose devices and environments. These devices typically perform a single important task and don’t need feature updates as frequently as other devices in the organization. These devices are also typically not heavily dependent on support from external apps and tools. Since the feature set for LTSC does not change for the lifetime of the release, over time there might be some external tools that do not continue to provide legacy support. See [LTSC: What is it, and when it should be used](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/LTSC-What-is-it-and-when-should-it-be-used/ba-p/293181). + +For detailed information about Windows 10 servicing, see [Overview of Windows as a service](/windows/deployment/update/waas-overview). + +## See Also + +[What's New in Windows 10](https://docs.microsoft.com/windows/whats-new/): See what’s new in other versions of Windows 10.
+[Windows 10 - Release information](https://docs.microsoft.com/windows/windows-10/release-information): Windows 10 current versions by servicing option. diff --git a/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md b/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md index cfc863d9b5..d4aae3c31c 100644 --- a/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md +++ b/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md @@ -3,14 +3,13 @@ title: What's new in Windows 10, versions 1507 and 1511 (Windows 10) description: This topic lists new and updated topics in the What's new in Windows 10 documentation for Windows 10 and Windows 10 Mobile. ms.assetid: 75F285B0-09BE-4821-9B42-37B9BE54CEC6 ms.reviewer: -manager: dansimp -ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: dansimp +author: greg-lindsay +manager: laurawi +ms.author: greglin ms.localizationpriority: high -ms.date: 10/16/2017 ms.topic: article --- diff --git a/windows/whats-new/whats-new-windows-10-version-1607.md b/windows/whats-new/whats-new-windows-10-version-1607.md index a77ae7c354..4a42f3e98b 100644 --- a/windows/whats-new/whats-new-windows-10-version-1607.md +++ b/windows/whats-new/whats-new-windows-10-version-1607.md @@ -5,12 +5,11 @@ keywords: ["What's new in Windows 10", "Windows 10", "anniversary update"] ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: dansimp ms.localizationpriority: high -ms.date: 10/16/2017 ms.reviewer: -manager: dansimp -ms.author: dansimp +author: greg-lindsay +manager: laurawi +ms.author: greglin ms.topic: article --- diff --git a/windows/whats-new/whats-new-windows-10-version-1703.md b/windows/whats-new/whats-new-windows-10-version-1703.md index 0e1be04497..71c7f06847 100644 --- a/windows/whats-new/whats-new-windows-10-version-1703.md +++ b/windows/whats-new/whats-new-windows-10-version-1703.md @@ -5,13 +5,12 @@ keywords: ["What's new in Windows 10", "Windows 10", "creators update"] ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: dansimp ms.localizationpriority: high ms.assetid: dca7c655-c4f6-45f8-aa02-64187b202617 ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.date: 10/16/2017 +author: greg-lindsay +manager: laurawi +ms.author: greglin ms.topic: article --- diff --git a/windows/whats-new/whats-new-windows-10-version-1709.md b/windows/whats-new/whats-new-windows-10-version-1709.md index 2c5570e18c..ef9b4541f0 100644 --- a/windows/whats-new/whats-new-windows-10-version-1709.md +++ b/windows/whats-new/whats-new-windows-10-version-1709.md @@ -5,11 +5,10 @@ keywords: ["What's new in Windows 10", "Windows 10", "Fall Creators Update"] ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: dansimp -ms.date: 01/24/2018 ms.reviewer: -manager: dansimp -ms.author: dansimp +author: greg-lindsay +manager: laurawi +ms.author: greglin ms.localizationpriority: high ms.topic: article --- diff --git a/windows/whats-new/whats-new-windows-10-version-1803.md b/windows/whats-new/whats-new-windows-10-version-1803.md index bdc31a26e4..e13290b34f 100644 --- a/windows/whats-new/whats-new-windows-10-version-1803.md +++ b/windows/whats-new/whats-new-windows-10-version-1803.md @@ -5,11 +5,10 @@ keywords: ["What's new in Windows 10", "Windows 10", "April 2018 Update"] ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: dansimp -ms.date: 07/07/2018 ms.reviewer: -manager: dansimp -ms.author: dansimp +author: greg-lindsay +manager: laurawi +ms.author: greglin ms.localizationpriority: high ms.topic: article --- diff --git a/windows/whats-new/whats-new-windows-10-version-1809.md b/windows/whats-new/whats-new-windows-10-version-1809.md index 42ef6de59b..0ff6fadb69 100644 --- a/windows/whats-new/whats-new-windows-10-version-1809.md +++ b/windows/whats-new/whats-new-windows-10-version-1809.md @@ -1,14 +1,14 @@ --- title: What's new in Windows 10, version 1809 ms.reviewer: -manager: dansimp -ms.author: dansimp description: New and updated features in Windows 10, version 1809 keywords: ["What's new in Windows 10", "Windows 10", "Windows 10 October 2018 Update"] ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: dansimp +author: greg-lindsay +manager: laurawi +ms.author: greglin ms.localizationpriority: high ms.topic: article --- diff --git a/windows/whats-new/whats-new-windows-10-version-1903.md b/windows/whats-new/whats-new-windows-10-version-1903.md index 0301b62f00..d5949e5781 100644 --- a/windows/whats-new/whats-new-windows-10-version-1903.md +++ b/windows/whats-new/whats-new-windows-10-version-1903.md @@ -1,151 +1,153 @@ ---- -title: What's new in Windows 10, version 1903 -description: New and updated IT Pro content about new features in Windows 10, version 1903 (also known as the Windows 10 May 2019 Update). -keywords: ["What's new in Windows 10", "Windows 10", "May 2019 Update"] -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -manager: laurawi -ms.localizationpriority: high -ms.topic: article ---- - -# What's new in Windows 10, version 1903 IT Pro content - -**Applies to** -- Windows 10, version 1903 - -This article lists new and updated features and content that are of interest to IT Pros for Windows 10 version 1903, also known as the Windows 10 May 2019 Update. This update also contains all features and fixes included in previous cumulative updates to Windows 10, version 1809. - ->[!NOTE] ->New disk space requirement for Windows 10, version 1903 applies only to OEMs for the manufacture of new PCs. This new requirement does not apply to existing devices. PCs that don’t meet new device disk space requirements will continue to receive updates and the 1903 update will require about the same amount of free disk space as previous updates. For more information, see [Reserved storage](#reserved-storage). - -## Deployment - -### Windows Autopilot - -[Windows Autopilot](https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-autopilot) is a collection of technologies used to set up and pre-configure new devices, getting them ready for productive use. The following Windows Autopilot features are available in Windows 10, version 1903 and later: - -- [Windows Autopilot for white glove deployment](https://docs.microsoft.com/windows/deployment/windows-autopilot/white-glove) is new in this version of Windows. "White glove" deployment enables partners or IT staff to pre-provision devices so they are fully configured and business ready for your users. -- The Intune [enrollment status page](https://docs.microsoft.com/intune/windows-enrollment-status) (ESP) now tracks Intune Management Extensions​. -- [Cortana voiceover](https://docs.microsoft.com/windows-hardware/customize/desktop/cortana-voice-support) and speech recognition during OOBE is disabled by default for all Windows 10 Pro Education, and Enterprise SKUs. -- Windows Autopilot is self-updating during OOBE. Starting with the Windows 10, version 1903 Autopilot functional and critical updates will begin downloading automatically during OOBE. -- Windows Autopilot will set the [diagnostics data](https://docs.microsoft.com/windows/privacy/windows-diagnostic-data) level to Full on Windows 10 version 1903 and later during OOBE. - -### Windows 10 Subscription Activation - -Windows 10 Education support has been added to Windows 10 Subscription Activation. - -With Windows 10, version 1903, you can step-up from Windows 10 Pro Education to the enterprise-grade edition for educational institutions – Windows 10 Education. For more information, see [Windows 10 Subscription Activation](https://docs.microsoft.com/windows/deployment/windows-10-subscription-activation). - -### SetupDiag - -[SetupDiag](https://docs.microsoft.com/windows/deployment/upgrade/setupdiag) version 1.4.1 is available. - -SetupDiag is a command-line tool that can help diagnose why a Windows 10 update failed. SetupDiag works by searching Windows Setup log files. When searching log files, SetupDiag uses a set of rules to match known issues. In the current version of SetupDiag there are 53 rules contained in the rules.xml file, which is extracted when SetupDiag is run. The rules.xml file will be updated as new versions of SetupDiag are made available. - -### Reserved storage - -[**Reserved storage**](https://techcommunity.microsoft.com/t5/Storage-at-Microsoft/Windows-10-and-reserved-storage/ba-p/428327): Reserved storage sets aside disk space to be used by updates, apps, temporary files, and system caches. It improves the day-to-day function of your PC by ensuring critical OS functions always have access to disk space. Reserved storage will be enabled automatically on new PCs with Windows 10, version 1903 pre-installed, and for clean installs. It will not be enabled when updating from a previous version of Windows 10. - -## Servicing - -- [**Delivery Optimization**](https://docs.microsoft.com/windows/deployment/update/waas-delivery-optimization): Improved Peer Efficiency for enterprises and educational institutions with complex networks is enabled with of [new policies](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-deliveryoptimization). This now supports Office 365 ProPlus updates, and Intune content, with System Center Configuration Manager content coming soon! -- [**Automatic Restart Sign-on (ARSO)**](https://docs.microsoft.com/windows-insider/at-work-pro/wip-4-biz-whats-new#automatic-restart-and-sign-on-arso-for-enterprises-build-18305): Windows will automatically logon as the user and lock their device in order to complete the update, ensuring that when the user returns and unlocks the device, the update will be completed. -- [**Windows Update for Business**](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-Update-for-Business-and-the-retirement-of-SAC-T/ba-p/339523): There will now be a single, common start date for phased deployments (no more SAC-T designation). In addition, there will a new notification and reboot scheduling experience for end users, the ability to enforce update installation and reboot deadlines, and the ability to provide end user control over reboots for a specific time period. -- **Update rollback improvements**: You can now automatically recover from startup failures by removing updates if the startup failure was introduced after the installation of recent driver or quality updates. When a device is unable to start up properly after the recent installation of Quality of driver updates, Windows will now automatically uninstall the updates to get the device back up and running normally. -- **Pause updates**: We have extended the ability to pause updates for both feature and monthly updates. This extension ability is for all editions of Windows 10, including Home. You can pause both feature and monthly updates for up to 35 days (seven days at a time, up to five times). Once the 35-day pause period is reached, you will need to update your device before pausing again. -- **Improved update notifications**: When there’s an update requiring you to restart your device, you’ll see a colored dot on the Power button in the Start menu and on the Windows icon in your taskbar. -- **Intelligent active hours**: To further enhance active hours, users will now have the option to let Windows Update intelligently adjust active hours based on their device-specific usage patterns. You must enable the intelligent active hours feature for the system to predict device-specific usage patterns. -- **Improved update orchestration to improve system responsiveness**: This feature will improve system performance by intelligently coordinating Windows updates and Microsoft Store updates, so they occur when users are away from their devices to minimize disruptions. - -## Security - -### Windows Information Protection - -With this release, Windows Defender ATP extends discovery and protection of sensitive information with [Auto Labeling](https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/how-wip-works-with-labels#how-wip-protects-automatically-classified-files). - -### Security configuration framework - -With this release of Windows 10, Microsoft is introducing a [new taxonomy for security configurations](https://docs.microsoft.com/windows/security/threat-protection/windows-security-configuration-framework/windows-security-configuration-framework), called the **SECCON framework**, comprised of 5 device security configurations. - -### Security baseline for Windows 10 and Windows Server - -The draft release of the [security configuration baseline settings](https://blogs.technet.microsoft.com/secguide/2019/04/24/security-baseline-draft-for-windows-10-v1903-and-windows-server-v1903/) for Windows 10, version 1903 and for Windows Server version 1903 is available. - -### Intune security baselines - -[Intune Security Baselines](https://docs.microsoft.com/intune/security-baselines) (Preview): Now includes many settings supported by Intune that you can use to help secure and protect your users and devices. You can automatically set these settings to values recommended by security teams. - -### Microsoft Defender Advanced Threat Protection (ATP): - -- [Attack surface area reduction](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/overview-attack-surface-reduction) – IT admins can configure devices with advanced web protection that enables them to define allow and deny lists for specific URL’s and IP addresses. -- [Next generation protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10) – Controls have been extended to protection from ransomware, credential misuse, and attacks that are transmitted through removable storage. - - Integrity enforcement capabilities – Enable remote runtime attestation of Windows 10 platform. - - Tamper-proofing capabilities – Uses virtualization-based security to isolate critical ATP security capabilities away from the OS and attackers. -- [Platform support](https://techcommunity.microsoft.com/t5/Windows-Defender-ATP/Protecting-Windows-Server-with-Windows-Defender-ATP/ba-p/267114) – In addition to Windows 10, Windows Defender ATP’s functionality has been extended to support Windows 7 and Windows 8.1 clients, as well as macOS, Linux, and Windows Server with both its Endpoint Detection (EDR) and Endpoint Protection Platform (EPP) capabilities. - -### Microsoft Defender ATP next-gen protection technologies: - -- **Advanced machine learning**: Improved with advanced machine learning and AI models that enable it to protect against apex attackers using innovative vulnerability exploit techniques, tools and malware. -- **Emergency outbreak protection**: Provides emergency outbreak protection which will automatically update devices with new intelligence when a new outbreak has been detected. -- **Certified ISO 27001 compliance**: Ensures that the cloud service has analyzed for threats, vulnerabilities and impacts, and that risk management and security controls are in place. -- **Geolocation support**: Support geolocation and sovereignty of sample data as well as configurable retention policies. - -### Threat Protection - -- [Windows Sandbox](https://techcommunity.microsoft.com/t5/Windows-Kernel-Internals/Windows-Sandbox/ba-p/301849): Isolated desktop environment where you can run untrusted software without the fear of lasting impact to your device. -- [Microphone privacy settings](https://support.microsoft.com/en-us/help/4468232/windows-10-camera-microphone-and-privacy-microsoft-privacy): A microphone icon appears in the notification area letting you see which apps are using your microphone. - -- [Windows Defender Application Guard](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-guard/wd-app-guard-overview) enhancements: - - Standalone users can install and configure their Windows Defender Application Guard settings without needing to change Registry key settings. Enterprise users can check their settings to see what their administrators have configured for their machines to better understand the behavior. - - WDAG is now an extension in Google Chrome and Mozilla Firefox. Many users are in a hybrid browser environment, and would like to extend WDAG’s browser isolation technology beyond Microsoft Edge. In the latest release, users can install the WDAG extension in their Chrome or Firefox browsers. This extension will redirect untrusted navigations to the WDAG Edge browser. There is also a companion app to enable this feature in the Microsoft Store. Users can quickly launch WDAG from their desktop using this app. This feature is also available in Windows 10, version 1803 or later with the latest updates. - - To try this extension: - 1. Configure WDAG policies on your device. - 2. Go to the Chrome Web Store or Firefox Add-ons and search for Application Guard. Install the extension. - 3. Follow any additional configuration steps on the extension setup page. - 4. Reboot the device. - 5. Navigate to an untrusted site in Chrome and Firefox. - - - WDAG allows dynamic navigation: Application Guard now allows users to navigate back to their default host browser from the WDAG Microsoft Edge. Previously, users browsing in WDAG Edge would see an error page when they try to go to a trusted site within the container browser. With this new feature, users will automatically be redirected to their host default browser when they enter or click on a trusted site in WDAG Edge. This feature is also available in Windows 10, version 1803 or later with the latest updates. - -- [Windows Defender Application Control (WDAC)](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control): In Windows 10, version 1903 WDAC has a number of new features that light up key scenarios and provide feature parity with AppLocker. - - [Multiple Policies](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies): WDAC now supports multiple simultaneous code integrity policies for one device in order to enable the following scenarios: 1) enforce and audit side-by-side, 2) simpler targeting for policies with different scope/intent, 3) expanding a policy using a new â€supplemental’ policy. - - [Path-Based Rules](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/create-path-based-rules): The path condition identifies an app by its location in the file system of the computer or on the network instead of a signer or hash identifier. Additionally, WDAC has an option that allows admins to enforce at runtime that only code from paths that are not user-writeable is executed. When code tries to execute at runtime, the directory is scanned and files will be checked for write permissions for non-known admins. If a file is found to be user writeable, the executable is blocked from running unless it is authorized by something other than a path rule like a signer or hash rule.
- This brings WDAC to functionality parity with AppLocker in terms of support for file path rules. WDAC improves upon the security of policies based on file path rules with the availability of the user-writability permission checks at runtime time, which is a capability that is not available with AppLocker. - - [Allow COM Object Registration](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/allow-com-object-registration-in-windows-defender-application-control-policy): Previously, WDAC enforced a built-in allow list for COM object registration. While this mechanism works for most common application usage scenarios, customers have provided feedback that there are cases where additional COM objects need to be allowed. The 1903 update to Windows 10 introduces the ability to specify allowed COM objects via their GUID in the WDAC policy. - -#### System Guard - -[System Guard](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-system-guard/system-guard-how-hardware-based-root-of-trust-helps-protect-windows) has added a new feature in this version of Windows called **SMM Firmware Measurement**. This feature is built on top of [System Guard Secure Launch](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-system-guard/system-guard-secure-launch-and-smm-protection) to check that the System Management Mode (SMM) firmware on the device is operating in a healthy manner - specifically, OS memory and secrets are protected from SMM. There are currently no devices out there with compatible hardware, but they will be coming out in the next few months. - -This new feature is displayed under the Device Security page with the string “Your device exceeds the requirements for enhanced hardware security” if configured properly: - -![System Guard](images/system-guard.png "SMM Firmware Measurement") - -### Identity Protection - -- [Windows Hello FIDO2 certification](https://fidoalliance.org/microsoft-achieves-fido2-certification-for-windows-hello/): Windows Hello is now a FIDO2 Certified authenticator and enables password-less login for websites supporting FIDO2 authentication, such as Microsoft account and Azure AD. -- [Streamlined Windows Hello PIN reset experience](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-videos#windows-hello-for-business-forgotten-pin-user-experience): Microsoft account users have a revamped Windows Hello PIN reset experience with the same look and feel as signing in on the web. -- Sign-in with [Password-less](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/passwordless-strategy) Microsoft accounts: Sign in to Windows 10 with a phone number account. Then use Windows Hello for an even easier sign-in experience! -- [Remote Desktop with Biometrics](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-features#remote-desktop-with-biometrics): Azure Active Directory and Active Directory users using Windows Hello for Business can use biometrics to authenticate to a remote desktop session. - -### Security management - -- [Windows Defender Firewall now supports Windows Subsystem for Linux (WSL)](https://blogs.windows.com/windowsexperience/2018/04/19/announcing-windows-10-insider-preview-build-17650-for-skip-ahead/#II14f7VlSBcZ0Gs4.97): Lets you add rules for WSL process, just like for Windows processes. -- [Windows Security app](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-security-center/windows-defender-security-center) improvements now include Protection history, including detailed and easier to understand information about threats and available actions, Controlled Folder Access blocks are now in the Protection history, Windows Defender Offline Scanning tool actions, and any pending recommendations. -- [Tamper Protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection) lets you prevent others from tampering with important security features. - -## Microsoft Edge - -Several new features are coming in the next version of Edge. See the [news from Build 2019](https://blogs.windows.com/msedgedev/2019/05/06/edge-chromium-build-2019-pwa-ie-mode-devtools/#2QJF4u970WjQ2Sv7.97) for more information. - -## See Also - -[What's New in Windows Server, version 1903](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1903): New and updated features in Windows Server.
-[Windows 10 Features](https://www.microsoft.com/windows/features): Review general information about Windows 10 features.
-[What's New in Windows 10](https://docs.microsoft.com/windows/whats-new/): See what’s new in other versions of Windows 10.
-[What's new in Windows 10](https://docs.microsoft.com/windows-hardware/get-started/what-s-new-in-windows): See what’s new in Windows 10 hardware.
-[What's new in Windows 10 for developers](https://blogs.windows.com/buildingapps/2019/04/18/start-developing-on-windows-10-may-2019-update-today/#2Lp8FUFQ3Jm8KVcq.97): New and updated features in Windows 10 that are of interest to developers. +--- +title: What's new in Windows 10, version 1903 +description: New and updated IT Pro content about new features in Windows 10, version 1903 (also known as the Windows 10 May 2019 Update). +keywords: ["What's new in Windows 10", "Windows 10", "May 2019 Update"] +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.author: greglin +manager: laurawi +ms.localizationpriority: high +ms.topic: article +--- + +# What's new in Windows 10, version 1903 IT Pro content + +**Applies to** +- Windows 10, version 1903 + +This article lists new and updated features and content that are of interest to IT Pros for Windows 10 version 1903, also known as the Windows 10 May 2019 Update. This update also contains all features and fixes included in previous cumulative updates to Windows 10, version 1809. + +>[!NOTE] +>New disk space requirement for Windows 10, version 1903 applies only to OEMs for the manufacture of new PCs. This new requirement does not apply to existing devices. PCs that don’t meet new device disk space requirements will continue to receive updates and the 1903 update will require about the same amount of free disk space as previous updates. For more information, see [Reserved storage](#reserved-storage). + +## Deployment + +### Windows Autopilot + +[Windows Autopilot](https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-autopilot) is a collection of technologies used to set up and pre-configure new devices, getting them ready for productive use. The following Windows Autopilot features are available in Windows 10, version 1903 and later: + +- [Windows Autopilot for white glove deployment](https://docs.microsoft.com/windows/deployment/windows-autopilot/white-glove) is new in this version of Windows. "White glove" deployment enables partners or IT staff to pre-provision devices so they are fully configured and business ready for your users. +- The Intune [enrollment status page](https://docs.microsoft.com/intune/windows-enrollment-status) (ESP) now tracks Intune Management Extensions​. +- [Cortana voiceover](https://docs.microsoft.com/windows-hardware/customize/desktop/cortana-voice-support) and speech recognition during OOBE is disabled by default for all Windows 10 Pro Education, and Enterprise SKUs. +- Windows Autopilot is self-updating during OOBE. Starting with the Windows 10, version 1903 Autopilot functional and critical updates will begin downloading automatically during OOBE. +- Windows Autopilot will set the [diagnostics data](https://docs.microsoft.com/windows/privacy/windows-diagnostic-data) level to Full on Windows 10 version 1903 and later during OOBE. + +### Windows 10 Subscription Activation + +Windows 10 Education support has been added to Windows 10 Subscription Activation. + +With Windows 10, version 1903, you can step-up from Windows 10 Pro Education to the enterprise-grade edition for educational institutions – Windows 10 Education. For more information, see [Windows 10 Subscription Activation](https://docs.microsoft.com/windows/deployment/windows-10-subscription-activation). + +### SetupDiag + +[SetupDiag](https://docs.microsoft.com/windows/deployment/upgrade/setupdiag) version 1.4.1 is available. + +SetupDiag is a command-line tool that can help diagnose why a Windows 10 update failed. SetupDiag works by searching Windows Setup log files. When searching log files, SetupDiag uses a set of rules to match known issues. In the current version of SetupDiag there are 53 rules contained in the rules.xml file, which is extracted when SetupDiag is run. The rules.xml file will be updated as new versions of SetupDiag are made available. + +### Reserved storage + +[**Reserved storage**](https://techcommunity.microsoft.com/t5/Storage-at-Microsoft/Windows-10-and-reserved-storage/ba-p/428327): Reserved storage sets aside disk space to be used by updates, apps, temporary files, and system caches. It improves the day-to-day function of your PC by ensuring critical OS functions always have access to disk space. Reserved storage will be enabled automatically on new PCs with Windows 10, version 1903 pre-installed, and for clean installs. It will not be enabled when updating from a previous version of Windows 10. + +## Servicing + +- [**Delivery Optimization**](https://docs.microsoft.com/windows/deployment/update/waas-delivery-optimization): Improved Peer Efficiency for enterprises and educational institutions with complex networks is enabled with of [new policies](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-deliveryoptimization). This now supports Office 365 ProPlus updates, and Intune content, with System Center Configuration Manager content coming soon! +- [**Automatic Restart Sign-on (ARSO)**](https://docs.microsoft.com/windows-insider/at-work-pro/wip-4-biz-whats-new#automatic-restart-and-sign-on-arso-for-enterprises-build-18305): Windows will automatically logon as the user and lock their device in order to complete the update, ensuring that when the user returns and unlocks the device, the update will be completed. +- [**Windows Update for Business**](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-Update-for-Business-and-the-retirement-of-SAC-T/ba-p/339523): There will now be a single, common start date for phased deployments (no more SAC-T designation). In addition, there will a new notification and reboot scheduling experience for end users, the ability to enforce update installation and reboot deadlines, and the ability to provide end user control over reboots for a specific time period. +- **Update rollback improvements**: You can now automatically recover from startup failures by removing updates if the startup failure was introduced after the installation of recent driver or quality updates. When a device is unable to start up properly after the recent installation of Quality of driver updates, Windows will now automatically uninstall the updates to get the device back up and running normally. +- **Pause updates**: We have extended the ability to pause updates for both feature and monthly updates. This extension ability is for all editions of Windows 10, including Home. You can pause both feature and monthly updates for up to 35 days (seven days at a time, up to five times). Once the 35-day pause period is reached, you will need to update your device before pausing again. +- **Improved update notifications**: When there’s an update requiring you to restart your device, you’ll see a colored dot on the Power button in the Start menu and on the Windows icon in your taskbar. +- **Intelligent active hours**: To further enhance active hours, users will now have the option to let Windows Update intelligently adjust active hours based on their device-specific usage patterns. You must enable the intelligent active hours feature for the system to predict device-specific usage patterns. +- **Improved update orchestration to improve system responsiveness**: This feature will improve system performance by intelligently coordinating Windows updates and Microsoft Store updates, so they occur when users are away from their devices to minimize disruptions. + +## Security + +### Windows Information Protection + +With this release, Windows Defender ATP extends discovery and protection of sensitive information with [Auto Labeling](https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/how-wip-works-with-labels#how-wip-protects-automatically-classified-files). + +### Security configuration framework + +With this release of Windows 10, Microsoft is introducing a [new taxonomy for security configurations](https://docs.microsoft.com/windows/security/threat-protection/windows-security-configuration-framework/windows-security-configuration-framework), called the **SECCON framework**, comprised of 5 device security configurations. + +### Security baseline for Windows 10 and Windows Server + +The draft release of the [security configuration baseline settings](https://blogs.technet.microsoft.com/secguide/2019/04/24/security-baseline-draft-for-windows-10-v1903-and-windows-server-v1903/) for Windows 10, version 1903 and for Windows Server version 1903 is available. + +### Intune security baselines + +[Intune Security Baselines](https://docs.microsoft.com/intune/security-baselines) (Preview): Now includes many settings supported by Intune that you can use to help secure and protect your users and devices. You can automatically set these settings to values recommended by security teams. + +### Microsoft Defender Advanced Threat Protection (ATP): + +- [Attack surface area reduction](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/overview-attack-surface-reduction) – IT admins can configure devices with advanced web protection that enables them to define allow and deny lists for specific URL’s and IP addresses. +- [Next generation protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10) – Controls have been extended to protection from ransomware, credential misuse, and attacks that are transmitted through removable storage. + - Integrity enforcement capabilities – Enable remote runtime attestation of Windows 10 platform. + - Tamper-proofing capabilities – Uses virtualization-based security to isolate critical ATP security capabilities away from the OS and attackers. +- [Platform support](https://techcommunity.microsoft.com/t5/Windows-Defender-ATP/Protecting-Windows-Server-with-Windows-Defender-ATP/ba-p/267114) – In addition to Windows 10, Windows Defender ATP’s functionality has been extended to support Windows 7 and Windows 8.1 clients, as well as macOS, Linux, and Windows Server with both its Endpoint Detection (EDR) and Endpoint Protection Platform (EPP) capabilities. + +### Microsoft Defender ATP next-gen protection technologies: + +- **Advanced machine learning**: Improved with advanced machine learning and AI models that enable it to protect against apex attackers using innovative vulnerability exploit techniques, tools and malware. +- **Emergency outbreak protection**: Provides emergency outbreak protection which will automatically update devices with new intelligence when a new outbreak has been detected. +- **Certified ISO 27001 compliance**: Ensures that the cloud service has analyzed for threats, vulnerabilities and impacts, and that risk management and security controls are in place. +- **Geolocation support**: Support geolocation and sovereignty of sample data as well as configurable retention policies. + +### Threat Protection + +- [Windows Sandbox](https://techcommunity.microsoft.com/t5/Windows-Kernel-Internals/Windows-Sandbox/ba-p/301849): Isolated desktop environment where you can run untrusted software without the fear of lasting impact to your device. +- [Microphone privacy settings](https://support.microsoft.com/en-us/help/4468232/windows-10-camera-microphone-and-privacy-microsoft-privacy): A microphone icon appears in the notification area letting you see which apps are using your microphone. + +- [Windows Defender Application Guard](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-guard/wd-app-guard-overview) enhancements: + - Standalone users can install and configure their Windows Defender Application Guard settings without needing to change Registry key settings. Enterprise users can check their settings to see what their administrators have configured for their machines to better understand the behavior. + - WDAG is now an extension in Google Chrome and Mozilla Firefox. Many users are in a hybrid browser environment, and would like to extend WDAG’s browser isolation technology beyond Microsoft Edge. In the latest release, users can install the WDAG extension in their Chrome or Firefox browsers. This extension will redirect untrusted navigations to the WDAG Edge browser. There is also a companion app to enable this feature in the Microsoft Store. Users can quickly launch WDAG from their desktop using this app. This feature is also available in Windows 10, version 1803 or later with the latest updates. + + To try this extension: + 1. Configure WDAG policies on your device. + 2. Go to the Chrome Web Store or Firefox Add-ons and search for Application Guard. Install the extension. + 3. Follow any additional configuration steps on the extension setup page. + 4. Reboot the device. + 5. Navigate to an untrusted site in Chrome and Firefox. + + - WDAG allows dynamic navigation: Application Guard now allows users to navigate back to their default host browser from the WDAG Microsoft Edge. Previously, users browsing in WDAG Edge would see an error page when they try to go to a trusted site within the container browser. With this new feature, users will automatically be redirected to their host default browser when they enter or click on a trusted site in WDAG Edge. This feature is also available in Windows 10, version 1803 or later with the latest updates. + +- [Windows Defender Application Control (WDAC)](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control): In Windows 10, version 1903 WDAC has a number of new features that light up key scenarios and provide feature parity with AppLocker. + - [Multiple Policies](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies): WDAC now supports multiple simultaneous code integrity policies for one device in order to enable the following scenarios: 1) enforce and audit side-by-side, 2) simpler targeting for policies with different scope/intent, 3) expanding a policy using a new â€supplemental’ policy. + - [Path-Based Rules](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/create-path-based-rules): The path condition identifies an app by its location in the file system of the computer or on the network instead of a signer or hash identifier. Additionally, WDAC has an option that allows admins to enforce at runtime that only code from paths that are not user-writeable is executed. When code tries to execute at runtime, the directory is scanned and files will be checked for write permissions for non-known admins. If a file is found to be user writeable, the executable is blocked from running unless it is authorized by something other than a path rule like a signer or hash rule.
+ This brings WDAC to functionality parity with AppLocker in terms of support for file path rules. WDAC improves upon the security of policies based on file path rules with the availability of the user-writability permission checks at runtime time, which is a capability that is not available with AppLocker. + - [Allow COM Object Registration](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/allow-com-object-registration-in-windows-defender-application-control-policy): Previously, WDAC enforced a built-in allow list for COM object registration. While this mechanism works for most common application usage scenarios, customers have provided feedback that there are cases where additional COM objects need to be allowed. The 1903 update to Windows 10 introduces the ability to specify allowed COM objects via their GUID in the WDAC policy. + +#### System Guard + +[System Guard](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-system-guard/system-guard-how-hardware-based-root-of-trust-helps-protect-windows) has added a new feature in this version of Windows called **SMM Firmware Measurement**. This feature is built on top of [System Guard Secure Launch](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-system-guard/system-guard-secure-launch-and-smm-protection) to check that the System Management Mode (SMM) firmware on the device is operating in a healthy manner - specifically, OS memory and secrets are protected from SMM. There are currently no devices out there with compatible hardware, but they will be coming out in the next few months. + +This new feature is displayed under the Device Security page with the string “Your device exceeds the requirements for enhanced hardware security” if configured properly: + +![System Guard](images/system-guard.png "SMM Firmware Measurement") + +### Identity Protection + +- [Windows Hello FIDO2 certification](https://fidoalliance.org/microsoft-achieves-fido2-certification-for-windows-hello/): Windows Hello is now a FIDO2 Certified authenticator and enables password-less login for websites supporting FIDO2 authentication, such as Microsoft account and Azure AD. +- [Streamlined Windows Hello PIN reset experience](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-videos#windows-hello-for-business-forgotten-pin-user-experience): Microsoft account users have a revamped Windows Hello PIN reset experience with the same look and feel as signing in on the web. +- Sign-in with [Password-less](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/passwordless-strategy) Microsoft accounts: Sign in to Windows 10 with a phone number account. Then use Windows Hello for an even easier sign-in experience! +- [Remote Desktop with Biometrics](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-features#remote-desktop-with-biometrics): Azure Active Directory and Active Directory users using Windows Hello for Business can use biometrics to authenticate to a remote desktop session. + +### Security management + +- [Windows Defender Firewall now supports Windows Subsystem for Linux (WSL)](https://blogs.windows.com/windowsexperience/2018/04/19/announcing-windows-10-insider-preview-build-17650-for-skip-ahead/#II14f7VlSBcZ0Gs4.97): Lets you add rules for WSL process, just like for Windows processes. +- [Windows Security app](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-security-center/windows-defender-security-center) improvements now include Protection history, including detailed and easier to understand information about threats and available actions, Controlled Folder Access blocks are now in the Protection history, Windows Defender Offline Scanning tool actions, and any pending recommendations. +- [Tamper Protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection) lets you prevent others from tampering with important security features. + +## Microsoft Edge + +Several new features are coming in the next version of Edge. See the [news from Build 2019](https://blogs.windows.com/msedgedev/2019/05/06/edge-chromium-build-2019-pwa-ie-mode-devtools/#2QJF4u970WjQ2Sv7.97) for more information. + +## See Also + +[What's New in Windows Server, version 1903](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1903): New and updated features in Windows Server.
+[Windows 10 Features](https://www.microsoft.com/windows/features): Review general information about Windows 10 features.
+[What's New in Windows 10](https://docs.microsoft.com/windows/whats-new/): See what’s new in other versions of Windows 10.
+[What's new in Windows 10](https://docs.microsoft.com/windows-hardware/get-started/what-s-new-in-windows): See what’s new in Windows 10 hardware.
+[What's new in Windows 10 for developers](https://blogs.windows.com/buildingapps/2019/04/18/start-developing-on-windows-10-may-2019-update-today/#2Lp8FUFQ3Jm8KVcq.97): New and updated features in Windows 10 that are of interest to developers. From 0fbd6990ae20d6595cfd550adb5647e40172da42 Mon Sep 17 00:00:00 2001 From: lomayor Date: Fri, 6 Sep 2019 14:13:26 -0700 Subject: [PATCH 47/49] Update configure-machines-onboarding.md --- .../configure-machines-onboarding.md | 26 ++++++------------- 1 file changed, 8 insertions(+), 18 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-machines-onboarding.md b/windows/security/threat-protection/microsoft-defender-atp/configure-machines-onboarding.md index 931aeaa4a4..bd168aac8b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-machines-onboarding.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-machines-onboarding.md @@ -44,30 +44,20 @@ The **Onboarding** card provides a high-level overview of your onboarding rate b Microsoft Defender ATP provides several convenient options for [onboarding Windows 10 machines](onboard-configure.md). For Intune-managed machines, however, you can leverage Intune profiles to conveniently deploy the Microsoft Defender ATP sensor to select machines, effectively onboarding these devices to the service. -From the **Onboarding** card, select **Onboard more machines** to create and assign a profile on Intune. The link takes you to a similar overview of your onboarding state. +From the **Onboarding** card, select **Onboard more machines** to create and assign a profile on Intune. The link takes you to the device compliance page on Intune, which provides a similar overview of your onboarding state. + +![Microsoft Defender ATP device compliance page on Intune device management](images/secconmgmt_onboarding_1deviceconfprofile.png)
+ *Microsoft Defender ATP device compliance page on Intune device management* >[!TIP] >Alternatively, you can navigate to the Microsoft Defender ATP onboarding compliance page in the [Microsoft Azure portal](https://portal.azure.com/) from **All services > Intune > Device compliance > Microsoft Defender ATP**. -From the overview, create a configuration profile specifically for the deployment of the Microsoft Defender ATP sensor and assign that profile to the machines you want to onboard. +From the device compliance page, create a configuration profile specifically for the deployment of the Microsoft Defender ATP sensor and assign that profile to the machines you want to onboard. To do this, you can either: -1. Select **Create a device configuration profile to configure ATP sensor**. +- Select **Create a device configuration profile to configure ATP sensor** to start with a predefined device configuration profile. +- Create the device configuration profile from scratch. - ![Microsoft Defender ATP device compliance page on Intune device management](images/secconmgmt_onboarding_1deviceconfprofile.png)
- *Microsoft Defender ATP device compliance page on Intune device management* - -2. Specify a name for the profile, specify desired configuration options for sample sharing and reporting frequency, and select **Create** to save the new profile. - - ![Configuration profile creation screen on Intune](images/secconmgmt_onboarding_2deviceconfprofile.png)
- *Configuration profile creation* - -3. After creating the profile, assign it to all your machines. You can review profiles and their deployment status anytime by accessing **Device configuration > Profiles** on Intune. - - ![Profile assignment screen on Intune](images/secconmgmt_onboarding_3assignprofile.png)
- *Assigning the new profile to all machines* - ->[!TIP] ->To learn more about Intune profiles, read about [assigning user and device profiles](https://docs.microsoft.com/intune/device-profile-assign). +For more information, [read about using Intune device configuration profiles to onboard machines to Microsoft Defender ATP](https://docs.microsoft.com/en-us/intune/advanced-threat-protection#onboard-devices-by-using-a-configuration-profile). >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-onboardconfigure-belowfoldlink) From 708025d5ac13e007368d4ce93b397aaf6a61db92 Mon Sep 17 00:00:00 2001 From: Matthew Palko Date: Fri, 6 Sep 2019 14:45:59 -0700 Subject: [PATCH 48/49] fixing typo in aadj device registration flow --- .../images/howitworks/devreg-aadj-managed.png | Bin 96912 -> 71214 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/images/howitworks/devreg-aadj-managed.png b/windows/security/identity-protection/hello-for-business/images/howitworks/devreg-aadj-managed.png index bc2fdb105ba057ad26ec8d1cd1b7df77208ddb3a..44bbc4a572481220438d34ae69526cf5ce7ab182 100644 GIT binary patch literal 71214 zcmeFZcT`jP^EV!BxQZaUiWEWJbycbYN+;MBSEWg>5fPEzj3JN&)D={OxT_GCt}ML- zL^=s-glGZ;1rm@FLks}|1PCo5B+rd*b9X+k_0lD(sYNBnY&9ujG*W;oP^=AdookhZ9E~qP!+nHa@(_hO1pYrr_Q; zP^Azmd`Y=bm~pQ^%ABEzW@sM66#A+PkU=v?gKosx^l|>mEMuiw+d*M69&K ztQ}!A1hRN}F=qO4L&r+SILanFHnRvH00;{FYuMVkTJrPR?#=)6%m39%;1cvGn(C@m z+gGO&9-PxFZlUoQa2kR`1kzOj?c{VA%=4b?m$<9vE& z&YV}PR^ z-}`x}#3B1_%z-i7>G`7IDcmZ7nG3!%QS9mB&@`=6w;-F>eOCizP0>MxF#WFbd5uD& zq4MuGS-zQNhtGi7_Ic$&W-+P*{CanhutjW?Jm-}scrbM42d-nWO>hi%TPOAaWZ-h~ z%!R5n%~C!5RE;z63`!m zjYC<@JZ?=?)|sb(}J! z(Hc1CB2?bu&k{j;Y8JhuR?>!9cNGkVl8hFgwib6EaS&!?nZdlHW{dpNujsS2#wcOm z8fB~ZV6`))6BAPmrH$oO!4eTpbN5QLQWDGsv~sv*V?$IhMkk`FSE=M254&WvGJKz% zurI5jV(I4Su;(0k9gY{dX^xF3c4#K?-ZR-9Tyr^Nc~z5tyOfenh(2}wvc6N^2xKNw zaC2XWoF8VB;1|YN3nfgXx9@$Jp+uro_H$zPkdd5Mn5t>3WI-uIXWqu7j63%a#jKqR ze1(2_t2H|0jSI7d>XMQc+d>&5_+{g-C?FBrSB8nbI>fM388#{7?kxC0aXpszekONO zy{C50>pGxl`n!c8jU32veQFeKuTo&sD_~juc7QPalQ&Qk=PbAwAH%Z}>y(+wp=Q2f zKWCl=Y#KU-TLUNF8&z{WY1>W9U5vbz#gW5$Qs_q3F*2*XvIRS1l5 zbKo4-O;WCnDXz)(Ht)PpXe6hq1Ly>KhP!tZP;c2M^-hG8&e+@s6jJkOnC)O8$72AB zq(?6tV+p5Ub{%`nJpGTmuS;?)nk-#1YL7FgAN3UOSZ3{zy)AKT4a$x1N3%=z?3*Wu z4;yQxEGIsxsvf6}g@deS^TA9Q?We{T(^Z8)Lmu*k3{6gBbF8LT~GFzx#?=TFzuc6b1sj(YUsl4NOG zI82U2;WfC$4WqP!i>-oGI=?N9;-{vjikubBD(k4@lf4gV7sR~(DH79)A+T-hJ?+Y7 zd{d+rT-t-h3+GszuOYShb{xkem!-_wZfx9^C!p3q3M&-(Q$+6mQEzIcThV*ZyrOo7@2NygznQ;spxoLGl08aAZ&^Sd_S^-Te9q z^{aukbK`YivVh9UR2YS*78`73Pb-cyH+S1BIu&SrpB#d0BXz4m+rwFd%dVBB5j$s$ z`19$T=1rlKdvkOa>j%(k2%=d#@|AbE=7q)!%MmV!a&fO(a1zs1BtKLbHDuhuGQN;L z8!G)WP>D%K*A>we`gbmSh;i3;Y-f`EBaQgR4|pvVy|vLW5rZ1IH9Mrig z`k}Ofy2MHU-A5k!_-Gw}Gn*TnAE23oK3FX~!nt#>*2BrDT*dsbc1@KECgmE`$;hT; z52(YR$)W1I%B!=VR%Xd0lMM_>OblU<2ewwD#EadF^6kOe$YRm(Ci6q6Ah8q9`cSz{ zE17k-U4alO@UZ0L9G#o|f9jg_b(bx9a&+UUx2i|se!#a@j@@kk=(W*0MT?U=Qr<2ww;bcuZ$#W@(`eu&k6E zVWIXYKvrXQZ>jEwr0K&6?25t&L1j40b7bCf_5rLO!@KLa)0E~YO^`puuInXI!(WjY zW#O!yO#Zs#il=B@n10t}vbSBh=ALdeGmC*Tf*^JhNCvCM4YoaYW0F`Oi0q3g;_Erp z$pWjJPZp}Q5*+{c`!wvqYC%++cbNq=2qBxOUZAE-+mJ~PXxDQpN$n}tJw;KchrLoK z(wJ@>E%cZ}idv+-EXCWmnre@iwcn;@qgS0#6kdW?_|p3wB(}PtPW+%KvhML-H&nfO%UXT`1I65%r7J;X?=Rb7 z-!CcBFWQxvJa>malv;6cQRzwZD|ON;aV*<~gC@X?@T#=v`;VY!ogJ;!dX(tznjNwB zCHcu+N2!(B!A7ND5I&5KP-pc9b4eyoiN)K#qh(XPD0)}fF%nJc5c(rL5ZVaY61r{S zVx9`ExafVoBg=1q*znCmwRCWTWe@RbhEA#?V8heY6^x7#(jgELC??VT2hqvD7+aT6 z56vsiEq~$O4D``jy|~_i9A_xH=lA2Ve9ooLfeoV^hWvT9+MOg8%W~|ck4V0&(CO7q za@$x{gkV-K@q6EAp6eD}jVLZwYbj;wwTEkR5nFfH)Cvi8My5noxH?S{*p9R9H+N($ zZ`(#ROZG!z;MQu6vJ|EM<_PeGdVciF1>)70OS8~SV{1l`j z^>+nUw^gzTk6V*}Kx$qPQLnhB133qtDXY|pb+bh2OhUgbZcHT|Ud3E0Owm1<^vvWs zQ}E2 z)@Xz}Dy+(l*>m-`O(Ovf|0zo8Q?sBUV_H{17i4u z!#*WTpdk2<2<39=>0m$K8{0bxrV@1fpHkOR0O*_i|DZZ!Y;;cyxLPQc*ubtr8x(xR zKWQTd;Du9>O3=CACA!jtn%=o61C$|*xAhu$(F~-i)@ahM1UD696zqCPc+IjyD^~iJ zZ_S8V$Zz;4rgCW3B)hLiuR{}c#I0**N(1-NzN?d=u5UC#8@X@Zcq!9t%J`3m>sp$8 zkVm4!G{FVvA(j3u#OA{*cA63p8InJ{h>r?Na#sHx!*ZI6g)CzfKhSDxv;K(w3^Xv! zie?Q*b+|0ccaNq1#VP;j&a`#o*r_8NSh4*-@7C>vx%$NOU z_pX^cCR=h1PQL$%{c|n~=128fG%L8Ro~Ib zltStfuG{;=iDJknuyfQW)A_5>o`&C7{;qtz&a6vd)IM zf@t~#S{qGFlMQ&Yob?>{F14FV8%L{1K3f=YxPh>{y1REqgQn2+fTvRXNd@Z5ryT-? zUIE3mMU&W11vYQH>tIND?wuCXSq z7;q|wWOP6hnimE4(q81&^?XAA+$ofcIXd9xYmO)+yQ`)8s8OtuHqBKI(&NYBpdad# zL#RmRRYwbmjr|m@yV?P+wLOJE_N^{&PPUg+a4@|Tdxr_|iPfS^f(CN2xI;+f_Rk5|ElYZ?U|5P*HXf?(fU$%e@X}vAJoX=`O z)R#8QVg`erm8qxKj=TR}T1}E5ZOlVi7+4Cs;tA<|QTc3>;kJ&uNn~%|{a-t3!+PNQ zt?Z{I0oY~L6lSg)GneFZC4)lv7+F;ohujxZ)>~h2=_5wCxY{@OV`$r1(-ESgaHF7N zO6!pnCaDFD@;wg_ltnj^f{9l zeazv-mddQmP(-8rP zmc1ObzbVe}3-B;%DxIjBPnTAFd-vv;&ta(SE2T!1BIl7W7OhS(s?227mAXvz3eW+7 zVVi+SK|-CA)rs+#%W69MEB>cnGyHnE3HD54>!hCvY2rZWw?%qIOvH`XsJ}*%lM$Kf z>3(oO%fT=XM4gA>B2=#(6&G0`3+3yoYO?P68T;j8k{fdEMraF;n0!?S8zGHX6; zs=hkK$!aArLq*k5He1PAHgvvk)`}E?FMI-{F~`%4r7yNjXXH1b4#bSQRKLjWO^Cqx zT4j=x-F{!Exn!MIE8+USu{z82V!B*GD>|v4bM-`ao3}5$Jx!?~|8Hwl3d|~lIJh%` znqh|QI~bKqntXefZTGvwVw~3w;c`X8g9Uff(|xUuAC<483ntk8MWhY+9WV!gV_E`sqvOK8h$R$?;yJ&}=w1RGb1)ewLF^sHs8XjtW3FRg zCkgT``JD|IWTeA>^;#IOxfOe>0_oCHlqf?1}cNlL3z>-YP7L9O|u8 z+3ska-D9j)Q#}7h-*@LldSsLX;9LBcN&QdqJEUA$GY9C;E_}!>zrd&&#yhT(w;^-5qQZn=BR#R7Y({G~cFZ*Yev|9FV-hGUp z=+94_Fz(M2{ElSCrUC{%4V_s0?}|;?ch{=g10{60k!Ep*d0-Fx%AoNpJcdbPxXM3C z=_+j?&+Vsu43d(iNG%r^)7vz#``kjm{XT_VP^xojpSpe%FOlntM-dj4UU8q*Onqj{e5lb z?yUNY?B04K z&MqL*6CRVse88kgco01tA7lR8_IVe>T;xwk`=}AOnC&UJP0F%c`1y&r+i{_&Y2=od zL;Qpt%hZQZMHtC3B1>)8wj}j*SBa0>H#<<naW$FJroWN_Vs&_jS8` zLH5r4<(MB0-k8k7OGv8Dc!rD9+)zY4OF$X}96WsI+lKu8ftj4dCls_}kY9n;Z_AfH5P|Dn;(vRTGKJeaVKDyDQ0Ajyh+` z%KyYMvzU?D>$uX{%s14XdNYX^;eKZw^eI%GLU_SxYlS5Jk>JB^y)_Z_LwwVL-_stl zM%VC8m?z6fCqK!%1oa5Z)}eUAMd}!32z#!6!h`10!hhls;$Vv2m|C=Q8`!9p zNt3af1`AlIHn{vFI&KZ0z{$V37T!`hd4cIB-*(3T~E>`JcJ zZyTX9%XOh{7S`v;e5{s&JB-(k@kV$Ko!!E$;*QijK!!I1cQ$=en9!|kXqV0$HZ zCA_6B6-vl@O#W>&=rxvB&oj#RZ&xMy$! zRJf;ePs;jH@~$Q!s%}f@m5FN7WIz(#=2J5I?^X>cm3JT-oObx}MVbF&68d@3YASWk z*LS@#S%)B~3`08J^9nihW2ev2SkL~iJ2B6rkOnY*ns1MI&m*DpMtdx$xM7PFa>Y)U zKmQ%qjUJjp|7MxLBhTr}?#;5SKD)MpKXZg{_brP!cy^HQv96`Ee3swqSAgC6E2it| zlxk>CF{>5Tt;XEi-|L2g50GYzVoh6>rR9y;nG-YLw>0dA!867Uj*>b}H6WPM%1QDa z1EULc65q$2W7{A*%HdxCFDhMR&)kBO*>+_H?&Cg6{Xc~YUN+6-+nCW&Be#p`riDaq z!T-K%z&L%FY8)4AwN)y}`aaAE1FN)=NSvkk;gYSJtVUpF99||zZ`9M#o~%_{vT4<6aJXWhxZ14nO=RLHCpe;f^EY*Lauo_Z|bTz{{5*m z0?DEV3R^Vp|C$h)=G6JFxRRCnC_Kn7o-yMR-{^bZWc!Cy&MhS6S-pp)gEiO@t`Oy* z=)tZqOlDnuKz!2VZVI6MetDi>h516fWxX&WOVC@ooPWIDrhY0S-7U1{0a0IlQO}DY z6x~rrzX24hjwUoLKP~8?l=O}Ip5`n z0$s1(2=YoH&AGf_fC^nD5PWkkpW0RI_+_d(xhK1VtjnHCQ$s5nje zAv2tD$WTC`y zK9j|V^7BvdjZ=uYd7X_UWEr1wA^eOVpm^o7!OcH^~=BPD>gOfphC;Opo3d?E~#2Z z^P6r>Vv1DI&h;3_c&z-7sYe49n`qmlE?YaV<3sD-6+gr`B_c}QoB>r%DGR3D@qIvUp9b_;M$;=sAs6&) z9O}_Nq2Eqae?iDN4fNrk0Zc}rlD8kwd6g%zpUQuYf$hd_cua=+?RvK%J@>-9-c%R5 z!!8e}df}3BO|WKNGAmUo_^ew0+jj{Ozy?lt_L+GtJ5nE5X4R?#Qo?%#Tp{2)!1in#W$4>+}w~=tvq$Klt8A zjuVATnW-2{dQVP51X487Mc$aQZ#y^=7#ordqWx`XiLA_l1EWJ)g+ZNUlTih5qs>>N z3|q+vSgmB>YWNsy?2P#5v!|{I|2f2CdxW|#x6&M5S*Z?;Zpn9oYk2YotD+4(B$Gtg zGocP9a;olA@i&^z9i$!I{1|sTe0?Z?ZI9qwxtG#)at&Nfe&-3>sNUOpl3|B_$8H~(0bJT(8 z=ovkg=5P7H%oCb7wvZahYSM`HGUs>RCuiqTOd~?zs)!FWi3;lBs)%vn+TCvsH) zir{JEFbAT!3#mgUT;n^EA+CI1A5Vv-)mynQUv5<8wq>B^idY6ORuV&RtzVn__;stn z?RQzx%uwVdzRiVUiBLH0_*uJbuXr9io}!I9!o+0jXrjKl1BoBT>;ddx&hDDjVv~%V zg{7vIrqZn^Nvjj1!@_5pmrX~L#(^oa!J)S?Y=Ecgnj4zb!ofPA`X5LA6vXhiEv*eg z_78~)!i{LK8A4Q95Kn0_$w6niqmG}rzjD^J7*LS7<1ru4NM`u}?cVEmvT-L{DBewx zO6_p|)Y#*rM4jVra+p&$m-hO*E9tA8>?r7W?*N#;rM}yZv(`GORGK^a-Hn8Po~-4J!`rHY-yr!0IupG zES<#LhJR-o@@e@SPjh{L9BRY?<~h2vQZkZf-;^YLPAFH)AZ1OmuaeR^+6V``d0tN}TY@t9LglAjX9bo(ti+v#yAGL@O@xJ>sfHyc4 zQJxXYqSy?WJzX}9n%T3Lazh3D$p!vp+4)L36D=^X&JkMF8)geSdQZTc%eksx1^SMF z^l?A)ipzMccvRw?!IoOFqN^xbrXHKAebXbH#cJYU zqP#`jlia}$z}X;{Wxxd9;(o}7%M~+F{l2J~syD@xrP(;GH119^ks4L)S-lj>uc{Zq zliuL?1D2yF1QnANR^IY5y#q8j@%`31>7k}IttG+5nc2iM;B18iDPH8*fFcAEJ%uo) zMU)T3ld>P3WKnu%{Q_sez2QZaRvIRYD`Q`!frBZl$Hs3@0Xvhk%UZ)cLf? zy%w?2I+6qT)u{JT-r6|-jugTor_$ zSr78)sNa$U#wh>?W@yb^McBdspYdT(PDf2Dj{Nyak|}eL?6o-6|7X8!@5nL%XBa{+ zu@ynKk>zVfZMbWJBhNs}O!EX2`Mer-`5EZoi@%9Om@L4w8>s$6nCvoNRBZp3%QMHI%X&Csa%UFLCp#JVfn^&z})dh2t1-bi|}^CC=(u}5LRzW zJBjI17&C&n zNg*{GhYF(I$1R$@t~%7?9(jH5P@mD8MMdn6r^Wi@n6H~(JW;OmLBH}Yu3Y*wyxhH@ z+z2lAJ&OCgOXejwg$3h7x9QW6ZcSd5q*6Kaj7xqr*4f z!^=VOYj#r}Zr~{WU589@ZvHBPsVd7H)1T2V-<8*!Pi-I}DXftN^rVd`n!!5K%8THa z1@DItBZjC?A62Usvg$*0=Be&#O<#ALeD3p4`1rYz7z{+CdaQwWji`OIuuQ#r)ntV_ z!dh`Z#yea)GU%O(c}?490_QyrsP4Lclu02^`fpOc-|s?3svjQ{>}Y9X9ifgR3$23v z%tCQfw%FJp$T)*<+ri`CQb5po8Bt;S2I+==wa;4Ik7cN2AoIZv#EEG|n6+MgjA@7JMo!?4_m^au;jar^s z^LwCpHNugNhUOJF-9S0+_mrj|h)*GWykF2erq1j2#$zWB37Qe*zFrkE^0f zE6+FjP9!hh<4`u6VKB=NmLD>Y2SH?%OEPM_t{$M>57qo2Vm+P8arUXEn~XNI+hLpb zS!XJii=W*fvnw@0f?HW7K)}iS6ma%L-5OCwhvi+o*P#BO{08@H0*T?%RZXo5cqdcF zfj$`b?WX7%mapc@6q6Z7K|Pi0E0bNEwT@2=EF3%%d}l28f;%UtaW6o%G@mKkY(~xG zpy8Zg*J`A{dX8M>-5uEwY}MIU8r049r@+*B?c{@~@_P9)=cA#7xSa6f2pRvfs9__GK>w4E6NKG>+ zkULbKg*6}YaaudaI<&Ljys%8Uvw3c0IaT4Cd80RJEX@G7k{ehp> z9jf|({0bSWRp0@;!G&RFi=j7&hd4$PK%Ozl_8ktush!K(=v#vJv%zQp%!X9Y8TBrTAe^IG`5wUzdG`S_SNX|c&6Pvs%P9s zflTuDJ*5gvB347&IGv3H$)#@VrtG_Z%{Zb;>?RkZxd1t2tyitOKWXipd>b7$ayzpK zxaH^%7II-S-QLFiI&_!)^jp^s_*$sNE;$~Q1A)Sp*35y3adD#2+cbS3WjU__&V)qH zqMn-q&n%r?KdLz2rbh|-HIA?^2kbV>{Ba!JdhLKbDI0*QnSQ{<+pfiBkv(qPdfLh* zoUw>~x)h}hd}^q)W^N*a@!}?nX_LKlgAphS1sfpx44P0&Z?W#(G%l_@da8$zElj7$ ziM!lUp-V6Ncx2XwaVg+rkoK0&$X{qeGFlcQN}|a+uk-~Tv5y@&OjyLv8N^$v(OsX* zWC9Lk7(U+Cp$E$OJkMy~ZtSO+K~YNv`1z#C9Axu+)5(=FXSrtHPn5}0f7Ig{{QGw% z`sYDA7@y?=ZKGJxi|L=xW>1AK>6bcD_XH&8O|*e1+VqF|L^Y_Mfx!SO8i0NBpt_9D z9Ji14L0WAGUeg?m-}VHv4c6jU-AbEx#44d?%hVL{OH1}9foTf=$nsg9)D5HAyatA{ z*HQ<=T`aO9WQ()XpIw}}lfDmSuu06>A7&+$i}udjvpFm|Wc?6{naUv^ZqU$S?U@O41~ zm~Vhp=v@6w{&QVkbye&X1G-adSRRH{qQ=KI5?W$L6Bv!+vDXX@Jbx3xk)r(7*xETz zMbBqxnW7Ce5+bpx_=RSEJ%a~{iZGfK&nDXw*s7=t{COQw>%MsK0%k}TrGWc4F?Dmq zX*5~!+@@MNG#HLDnuG}O=?Q9$BQ<9pEoTdKVlUN=8?A~48Q%Gq+j zbP?2+Yicz)qAouSLDc9xU@Q!zM|dv#gaCg351Dg6$vkF4H$pHfBgtbSjl8+(N$@n8 z5GhJmj)x5jidYqki1)x{#S67H+{Y4~Iem@+8t<-~g8*jTH#Ey&ypB`=4~@LgqsXv< z$CVH$#xYS*ulLfpSm1|&y@MQS{

J=frk!;%$%%m6=7YEB9%r^B;W~Bd&CjG6Mx2 zW}l7|&3Q?V=&hYqXY@Y$0z`BT((rY;n94P)6YfusWu?;(3QJk$BY&KVoj6+z9Oo*DUP9pg(|Pl{msC5mC0iT5NFWn&(H~|C5^9AVeyQyy zr%%Z}v%7LHaxZ8(_jjb6<=JX}!+h0ZX|zW-1~J&;e_?1z@Wdau2$y)@2C@S+RntY- zh;8JZGZYK%FLLj$-4UFyY7WAPMB|R z;sc9eXxL~IiKbeIrYy0|NOoTU%eX28KY8E8hy4h87kq_#91{$q9<7A{8yf^VE8iLU zT90C?XDa$&PjE)q&&wZ4FT^5xrpw)H#Z$A31AIQCg%&$;?x6U|*2PUQ^RTOankr{C zOq0WKs@oy7N73Skbev9vVKRZoC8%Qz5X&s)|a)qCrA| zbts$Id}6(tH)0)6{;j2pobxeYp={vUmyFPHri<<^9o7?f*jU1j8uf=ETD3J(=`v$JO-3V`*1xQOZ)tYZ$@?9(-T$n>3 zod?-pnkEbAq1SpKsBzqlihrZ1$*y^M1oJ2=zRwpl813_DTQreZIFN0NHF%m# zD2_w*EZrk(72IA)^tQ{RF0gA-m;2m8OA7`pC01wzN>Ijg%PbYt^dtdaB@W8bI#qB_v#~eiz zW8@)dT)9nV^LuvSb(T#(cNPmEQUVwpPVYDe8r>ap1hg{xu`a$DJIkY>I)od&)aKtv zYF_T$;KUisNS~#v=*rFlmgV#|H%7SDv3}#Zq|GqRS5{@dM4s;E@`Bq~1Nlz&Amb47 z)%??A<2$nYp9VBU;D9blQJiR(6bkQk0Dba|nKr(B@xUMel0505F=a+bF}FZ7wxN7( z7J?)fTuoi`EM>ct-JI7^c?v&YcklJ z3}MR(&aHXQx&mE4@H6j$H_TLLwP5qnSZxhe;;P|px9`h_fL5&2wAawdtga--`rvt9 zXY^_yA~>&|E`y(r`D&EO?@d2YnQ1iHtxGsMm6P4SDE1=H7I02$i}MWVjfP;<75F|g z5b}gLDe(TsvgIQuaIbx_3}B?9mY3C3@Vq3LcD5xB0KDg%ncIRhK$ zflynOVR$^_K<#c!y?RclR;?3uAMMS%p@>ZTt{xKqEl|zr8iw`-T7YXxBh1Qz69^;6 z*8Y`#ur;99HBM)$2?nN-p)m`QV~_}@TDh&dohM33i(yocpORA7ADD5NL+mcJWOH{LRjI&*4XcNn^(v0qgd zc+~PQ>5cHhg@+vZ#d|5mUTzck%8D6z1{e#GNer*}L4Fm+J0zYUuU}Ak(EJ8FI!fC| z(==og1^(D+ZP)JFM%g;OyX6V&8Y*)(>DoE%M%kx6?;>2z+J|zEt`=1Ky!(0CP1_*L zFU5^;VdtSzL|Nnt>uO6)d6ik%-a4Q@`wRb3+J#_F@#_-J^Aqnha+uo7j@k1Y?MVks zi)A0{{i;!Q8huqbqq(D~kbhoi}f(SXnn` zp2irdbt`#}_RnPQ4!!LvvK)^};R}SeTBh|FbV0{A$Gy3eL|Cg^+AiU^{ zWG8Gb=$J5F4GQ?2j=OoeN%HLdrX8T~4L>I+Lh4rL0L1eTVF>?6)$#xN#rhDCXdaG? zWuF5bR0#Kqc(ke$^CxE+)vlH8c7$G^a$gD*`8Pki*ACN$brP={DuNE~3%8C4Sv7j* zPm)l=9RlT1xNL?D=wW(&riN7V>OXMcUx-V#g@xR+fwoDHufkMD|6oBCKV|M`Z}#OR ze9`Y|J{GaO;B1vF@e`O_Xag%Nb2rm#iFBX53P^OIRv^*EFDP|dhI!GBuAYrn#H|)s zO%PBoMJ){wR98{vZppX8eAi39wxu(6bSNS9+AP{DcDdtT;suv(RF72sCnojC8GvK- zqhzW{I9cArbnu=WN)9~J0=d(CI6gJ%n{V(s!^@iu-;G=?Ut=iy2P`KX(;r&@lKnOg z$VJ?}wvdFltnEODMlBLxy;P+CB!sf3f5EYaO*Btk!A#)#BXIC~2;3IySKNR{J&V$~$Q=ki2lw)-9o> ztU`bF;QF95Molt)oVccKvm*#rMU-mFwS|Y#{K`^Y7cak+Lsqz~C@+9qYj$_z-1bo> zJf7Xby23hA`*Z|I!cS`s*W_hsFY2i$1=|N^Q$2x1*jzizi7+yetjO!(d{v1oS9S6Pw#Y zAwcwCTKws&ZDsr^-x%E!Wd!zmM-D?VKV(l%=uP~Ak)*UOm< zu-yE6t+Ex;J=}JVYjw5{Z-hgACyuBu$=ASS_Iug5bGsTivNKSl(6V_YkY(3@P;T$L z4cU4s9n<=RZa}?d_o`(ZIQMF|T`YK5D+4E9e5T@P(;Tp}I}6}7qwx;b>11^cG$hc> zUJ4l)(d!*x)Wf_6Xn~sl-T7V&q;b7!_7SK~77*!K z`OZ{Im-pJa1GOa{5S(bB^~rdJVK*RI*a~;P}(?u%^X0Q{w*5Z ztUpZ01yNjVvyMiZnZ~C`1p;$xR-QFDOXi4P#3p@e5*;sKRRqf3==^6Q6;xyIr zg^Kj5=$w7*?><9P18La%N8NvX18o_cC#J-yj=rw{>aXZ7Y`FUuUtSW?C`=c0KI9+r zN^+*81%nvCK3v4>*-V(4>;Q_%$g0~wO&;?{O|B}tUwJVR+wA9at>IG$O*RK2-?L0P z(<4nl6UHNcEM2A>po}B|cn*luYUAgD&g*yP?3Tk}FF7s009q=7RI)K;)KuR4R$!@~^Ui z{6v3_pq>fE!xW3vo?bAjY+6zRjqIYNfad;`e*5E@?{|qZLxn4z*OtA3tHss7ip)#g z7Ki#vY+u7ryk)r>H8a1cna!;}0+mK?2eqBdzzln^g=;#|e@52Jhv_S8=F<#7mMNb@ zs22`AGl1g=l>XO08n-XPxX3F}W9^Gt1bFo1WRR{st(EMwDSatDo6@ z`26#KL2v(rE0kaTvf!7#ISl(JBE-~hxh5F65&bV*sJ2I41)_Ni)V8Qm{?{t!7+9rt-ag1 z`RY=m4xBsPnaji75WOtYBLl4t&@mnm_w+}xPYavJ`y^hXM0ygUsc>RDsBr*pyQZx)7@PPz??|7 zVwSf0z*Y7bLkCH3C#c;9Yxg&l{I=gJ5&>2QDEj1v=Ia^1B*GD0ejOP*@#CT5w%L$n z@(93gN<^C214s{DEokO_!&MY@i5Er~&G6ST@yj;ZIKwbTf9!iqybiyiML6#{_mS-Z z#d!h@%##ocakIFlR>m1Q$w_6Rd=A+}O+O+gh`V_7Lmu-Pi3HehoA$hdlv!h`a;Lb; z0CjoE5?cq2qDY(LgdPG*d{oHNM)7-v1j!Aax-Tit{ei_~K!u+*RkJ)7mKEm|wts`- z*Mf}@Jo+-9L2iCDlW@ULwbSxHw6H%)$raCMtBPJ3c$rAp;lb$=?s9h+@KP=LaLbkK zC5=$!@@VV%kC&l`Esp^q(h~GO;jOStby(O`BCj9gs%Y5|b`+f=Q@( z=4b7StF8t)u@dUO%EqIVr*L(hHUi)a&MnKeY#5a~U-CE207kY~i@EGqJZLVyxi5h( z!bvBH1(ri*Lab;2ib>$v0fy`SycF`oyonRlJIm2$2f<)rk3wdhL+qq~EK zCH!#uP^WC4+&Kw{>sdS0T$Rs%gQ#_1GcNxa0|lyu0mVjxL)bXgzgds{^ZHQ&+B33$ zR*#(?I{^jH7kHTolhgz$jOP?cQ;a!HZ(kaB;m)-1Cf2l`HvznBz^ZnjiWh`j6&-iv zv&yvU45F~QO+QC=H-;Fnjs+=PLeLNg(zzZ}Iq1nS z-G`~!Ce0yXS>92uzMHeh89q|TrbD*cffLrE46w$OKn{39m(s8$bPXuzSjK$`PF8 z?<^aD7>*ye50&}$V?cg31I+dSl`MAO@oA@1Y6RYtK&Fqp%apA}ShAHP!}W6H4w=XI zz=*`F4+yi7v%otb8bv+`PW#7@D}hXH_u^2Ydv>668cU5$DHixrDv|ke+EEJmis9SC zkx_i>*Au$FyI=A~%x5#ZKQEhaRP`WaS?IqM ziy;?c_Q-7OgeZo4Kmd-xgc8pRzsvmP8uFFJJI@6L0K_i0|4RvD6@-oxkzV;Yuj7`* znZKMtGuDqX_CNfGx&!g)y;M=Na$PLwN?H9LPFj%cQUUbNqy~|VVogVbd3Chqlz!)cV91KAfE7-m6`FomHmTOX z?tIKY>N9{l(*!2$I-Y-Ly$*WWjRdNeLFrkvA2cG+y3_XEc&GcUopqweJ1Ed25O{K> zcJGHKRzt)JYdXW=2GisFKoPYe@)y>X1FNT_J=!4U8ZAd25D(^S(6(K`Q^S)dt!9iz zW&(nbw`FsZu^gIN7L6=3{}g_gMAJfB8imT1)PD0}0Yh$QZgtdF?$!P~r^1l5F^Q-XPft$xf!V9*R%_+Wi!CY1)Oux@ad}e_oSxO=a2Z=dL+E8v^vxz z+s5J31`G6SGJ!{^A;1L3DfXe)aJ@LSbl_!oL$%%STBE$U_9(dzm1K4qt<39E$Z;8L zHC1i)uzV+B;oZynEpfOvf5b%T2T9A4ahJ+i(Ul#5y~@kZ8+UgV7~d;f&3@ZkS7}?j zz3aj9gZ`$F_YjI2h1OT_G(gZmeG}cahaGyekN@sub#i#yR;F$gnmv;?GM%vx?YYua z-4Q*|{j{>2y671Qmdr~eoBXZ3lHSyP2B4IP*WcdT9g3{IvJUI&`_N4`)X^Atw}vbw zxHPZ}cmY{T{;@IY0$On+kHbo3UdTF!3>v2$@>Sk?aT?Al9lcK1=rwK64jMdUga~eq%VbCoHbpZAc|fNAy? z;O+4VMd3xV-UX}1-=e7Q(gQwSEfu=Log42&!mFc2(8U8a-;5+p1{BrCo;`bC3Qj_1 zZYX!>2~=Ymw$$lw>!fw%tC&}314;uClj2mVo1Y6chE`sa zSMeK0zV1v|e}Yq?Pv|kemE`Sv-aTPJ@qNvzkqDP{9jqsSy*!+EeoOQr#Tlq}x!8Jy z#uT&ZFU@a8FB4y;ORNb)^FcUy=3y?ejsI_IBrywHm_S!+FO zc-C{@_iwm|XVWSAI4e_ma{4%USAODGqMXPJ5!^CW6*PMKsmIKKJh@|jLKsnlkLz$H|9 z)FMMU9lqUMet|Tu0wU^;n{u3=cxAp6HyFb+ItRP-Jmf;;lu4rRctA|t(C+{L+*!&$ zVvfL^P<|YIn{#Z7jvU$hC+jtS^;6^Z*p-WKxjYvr)7O7YMXalkkz}s_ysl&Zt9;0x zmE+FK#D%ZMOumrdJ{XCfo=jw@eDOn6CXY9`Fv|Zuiw8et=J=%)+#{1GFG{$DPD|M{ zD4#(E4Tn!qkOdzixHoUB@;wAA-`tm%%Kx$snSU>^k&N2oevbN5es14xHd(wX?q18s zdHcUf0RA$4_TOL=$A5S;FH^vMg2rV3lUDIr@*|UD*YTl1x|~*1N&COrXr^966wBYyU5(!*{YOkY~zq#E&6LYEczoQS2T!e*p+E!=| zRlObZyljDS5mMOQis+87v6VLL#s_Yq`arE`(A(4-Y=$DbykQU*f@aTX!?t-}&J0m2 z^LZQTOQf5!E2=J6mYSQgYuGVmX5WR>XRI{cPD63KP4@6ey7$9Bz0_^(&Icf5*So=* z(--;hmGe_5&E=G;3-xD}efO1kcv#csjlb(ST_;?5NSi!wG@Qz*YXi0`MI{9Nbcb?% zocqfDU=6Czg~ejzFVqLj$1P^sXD37JQY=nd1nQ9nNS&Fc&t`kNo*o?j?^(jA3=~HR z>keEc_Z}WOx2oC4FG8ElHfk$Z;w!)4qBzsk$ip_6<8506xR5;R>H1BbgqnhG*D#;) z+F@~MpHQ%|-$@VShZgcP^b>jx#&GB8+*ICmy6DE)=m+MM=XC+FO$X7sJBg{b3gW-i zzX5b=k2|!wK&9a=E>8IpHO}l1Z);7!H(IO!o%MRvlhSe=W6cY4?=(_+-w;V%D{L(D z5tw&BiOg^fD;D9;VUzIi{;#oYK_yxnSADsO9W{o`B7L(Ll_8WD9ohFlq85AgyFcEO zeni0G4ZT0DA{KXyZ*@#;+%VqEuiUFNqa4fKt2AQyz1G^hs-V1Hi8izbwmgMNo@)7o zXLEE--u85d$!I-&k>PAzH5%!lR|0s!Sg(Na6Hcc9-MIStE1u@e60aV-GL#vZH&56C z=goj!KvOrT+$c`9vNU54&Yj0A78ZzW>C>pTp*2}Gp!Otx^Lr$BbH4j1L04+)JlCmlFi`Ey z$RpI8`rR;#QkB9`;{9BZR~cBQYqkRENg2bPXMb&q9bAmlyZ|?jpn27#cfFd-hNi=5 zUr(ENQ}z_*Se942*_E#~^?y(9&Hg93_u{3!`H;0&jR)E<$3NNdH(Xb@V#NI`!}R?u zVE5bdjSaAxAh$-sx#b*R;PcRR8`!T=EZM;&*n@yPJU!;a9eVXE_qrtEr25*?of#xv z+t*h1Aj<2!1yb0HJC-ei4C2_gO5!;({^v;W)&{)XRdH$=VyCYwzS_`fYk+Bgv9Lk_ z-si?3WQ$YVx-hz<_x5VGom_-q4F2~BKwlM%-wgSK-`~t___HU$|J9iI=cVfZkh~z` z{sdT60d-s!U_}Q#@_Xy{)#JgxL_16AI4?G0zSaqAEuG=Z-N>sVZNGY_XnsQ_qUzRzBd;vQQHv@OE;x*6(shVNt+W1X@ zbzDFbY!v~O;~XcqS8Z*UXlc!Q@?p(tWqG}h>E9FHJUKg^b;{jz!ns0&`@+Zd0&(?o zj+|($py0Pt(PsQf^yK0q|1B35rk#Q5yS|WM1u<_h-dvvTcmQ%R#zwcOg!0tO4|fT9ZOYjg#Z@TMM+eReVb&3WVQOP zn2E$K>@6uw3Tja4H;$v_6L&9(X27Ps`ieFuuC0eYol_p!`44P`RuuR)k`<}V@qN7_ zZ&1Ei`?NNUhW3>;%v_NlG3JjW-rWwZ*$pM`zA``OoCSF3=DHy1h5>76+VL`eQ~LH8 zwYNAHCe}UHx&sj9%dJL|fG@aZODZsst}({hJC*^vb`)pUHmyIK{9EDR<8Rrdqb;qB zf4e8+K~_p^BR70? zdd}UjOMtpJQFW{saQ!&uW$?0X1Ei>Dsxdx18_)%8o4SA$Vy+ZRxx8m1?Qz!gFzgAC?Q8HH%9!l zVcO+!*57fPLQ?4vv?qnUj%@QS^D1@aZG|DabTO}D zaTv)eEe+}X^@XtXWd~II9s()Ldzskctvt+Z=m>%@zK>Pe1D%_h}cMzjJoiFVr11sB6W$?m6?sZ^278PEXT-?2&Jbh`=Nui|v}E&FY>>E|7C zoDR^U$xrP_JmZF^iT7)d^LOR}S!M|J;ABwp`~|6Ydf@yS?!ZArYo}R}Z+u@h@O6G@ zb!d32V{4FAA$Drjy3wNI+uX7ex5?~f;t1%hWm>;Qb(;e?D5gYC5geYDGiZ_oL$!wtlV*M1{wAE7WR!rPAaliW1(C>uK=~PZxq|uvHkn}^S2oub;dG0qd zgJojpQzz^pG7XOotFZAguW|OtEg4FmAcvJB3vI?^zD|+Ww%Ac|bo$V}w_M=YpO15V zqe0^~;NgIt`$Wh$FpbguLB)c0aG6-S1kQ@K(50U#-@_@vMHeWEZ&Low8__2eWSb>2 zs7aneL+XS!!8rAxg%G-sg4U}k*!JA@S8Mb> z8Q-R6fHT>=obza(pr-#C!=S7ac%h6VNGaCHy74EeYNLqmReC)J)o^uBd^*Rt* zVZ2!(b@NA8$@_Oe+J5*;X2X^J%xEoZtHzOZJADo|ik6edR8vy0P5kH_L+|KpxQ|dC z3(sxq+?~lQg3A68q!qW5`cZP|Q$Nu`TSt@e22En-0T>0K&nCHGh8gWHZ1hclNhbm| zrBfwLnDtD2D3#q|@(;#m3e!IJ)A+SOWf6H{jv&2dw(h-n1|fOH;t_|N$cM2VqRn5x zU#W}3aF}(B%YY(tO~1&V2Jg;`74oeh^8+2*Mr=P5t#XWHA{lKT6@`chouEq%EsQN}YNtdq^=VY=7{C2dM_^14DC zklwmod@sw8jgc@Sz(Ys#%ZvD|R~w>k~t)#+9)p*GopyzKe)v$I&r14 z!p@JX5HzpmW#W?DP$550N-$H+n;#gWzI!Veg<#&kV~wARZP!0Q)Ft6o0YOft#lhc_T04h^6`x zF#}OdpF0k?K$a0w>Yz>IXgxeU*B{$Exdd!@2YEfSn2a8bVFZB!S$M*D%145=x;Eyb zEy*(GU8bVsl`svzP5Rsl8ujks80VE-`sA6AhO3G)k?yRM?8D*=2GLpgOPH*R2GMBSYZH(j2ExUEAEV#=@x|PIc;=y<$JRlCbRjY8)F1(0KP9Kk@L$*_6m_VQ=hq69M{bQ! zHIi4%$Wc;$RIc*CJ$fZ04ti(`h12Xh$~HZk7N~KX{LuA6KX69P0yMq=gd;jxkkM?^ z>O;lEpVlH*g`h2B{Q#rxf-|}lzOZT)IBnEe<}DFo^T(p?-2dXx5WVx4F?wxt<@3LS z<96STy1_BDR+?81C|cI9oJ8$3!`Z6_`n1Ceq~GUgdntHO4H}fk;R{*h>5SpoqdmaR z%)bn+b9g4?bs3u-tV`H4971L2)6YQ28HG?s5dP_j^qZLX;s9*E|j{Zypi zGO_@YefQY1b3D0pJW~;^;u}vu9dIk*tgUM-jf%M(-)p}k$iwVF2avA_fA6)VvdX@( z9ww&s8*VOSkl}&KSLusLsz!ggtFJV|V={c4+&h)bOQVZ!o-Nti5gc6JZ+GN0gnA7> zv>^`qXR7wpH(SS(Q?QPE~=f}B2ltLF1Od0Vw`q*+> znNO&UD_O@@S5Pa&u2}S{u&F7JQbST30RywHJiUIk8wRK&bUf%}r+hYRDsnU2(58wdT3 zGuEVles4_?zgp`zKzP?kU+uT^n){|=ys>*i1L}<%l^>z&=V6wQ2uFK@@`vaA?IzGZ z2h~#!94Z6X-|nhOSEEr-;RQ~;{&*7EbUXQIVj(3PQ4z=b-wK>N%fycH8)?!Jv z6UKp4c z)3<4{0yT5JNBirMHaHTvB1XgIj9b*!15uz_(_ffTq_LTXtXD1-^a3=GJSKcT!>(uo z8WsPhl)5}NcMJDhhJAo{U0Xyh#S&+qX?d}t902jl1ydW2frWQwXa1^;>&k&Zt!=-u z$1A0snQ5vt>6-8ihx&#BOQ>`~VI4GV$1Oy?g|W z>_&uK$!+j8Sh3@f-yE9n!a}Qo7E>Y4;!7 zhP${rgGQt68 z2Astkmt|3xu3^irWAQJ}L!tED(7~0dNnp7J`nTY4bTVEiJu5`btA`3|KJz07n*67L zk+}_2q@A8dZP`m$E8oSj^__>eOFMlRpD>h1hE$(4L$1aTU4$u0il??0`NYp{_?1#? z6hWK#7U!~R#sbmQ7IQd%BaMn>y_mSZm+>-l3)so|E>JS#zu9T00-Kv{&|e{7P9<0+ z<~2;r@Q1s$gca5fe9#9e%QgRq>Kkmkhl@U|T%-Ultii`YOSi!Q5vg6htGPDA>^2|} zndgy_ug==U_~nh6DZb6PO}Vs*nJ2H7xcyJ7C34jt?B`l=ZMe(l01->`8g49j-nzuZ z&hKz?Ne|UEJbLLkSqSF0)I2?EUbz!<`a#Yv#h`*C2R1f2otD#(mt2VE-igo`o#xhW z3jZp0xC=XRBDn6#0Bft@`J%lpbDA=COkak~vx(NuA3T15nOS7I`I_x|EizKA+ESOs zQF}_L*+WU`sRv7{J};j+%V5ZBITY^yf*^6Kb4|a~iWx)yWbC`<(lw*T=K8>}V#=D~ zq7M|44)k@SiXhWYJou+vqZ`x*^kO)PP_r0jf3Cz$EQjcHV5SPGH^9PUQNE~Dx)1r& zTz8eRAJ*rPW-n)MYpxMrKe0O59~-Bo$N9JtU_g(_i@dlsmfd}rtm=-Tg~Xf#>VgXz z8V=xf9r{XMW$n1>W9YBbLd$PzOoCpS4Y2~?*^iZzThq74ws;l{B!bB({De^bMU7zp zCEff~&$1iu7-`gwyUAUyJc`hdDhrA6P5YU1*5Wxg zaRziR6c2?Gq-{t$-U&qoTkJnMJ9~XG8T{|mj^}yMFfrK* zG4WvvelP-4CSxVz;h-^v5STutkY;IN2~X32@?iWmeqf%?f-q+Yi6W+`#OmatOpHwx7A@m z69qm)zOQ!N#3Gm5)SXi7ZCE{uh#?d7xqAi|BmmhKE)__ZZj4G)dE5G0h0p$!mO>8W!ktiR3Gm7Cgs;~LE76n&X1F8AX_L8IHGmS8QKcbPAg{s zH{;{|`K_4Q&O7FT@{T;N7YY;1-eyG&u0X8h6#%AMfNs93MR_(9ds5F=H-cui!to?- zTDYx0@!p98G|!-%WfkEdE7SQ|j2)2mTiMtA#UV{|#?4}LCw3jewxeMmAXBlB+apr@ zeGfpop4VpRr%_CPW>;bg)(f81I`pTfh8}<{?8`4QlMm8tQ>QoZe2^Jf|2X?3$0FT%AYq-MUTRy5R&PT(Yd#v`8x6F7^H6zD=pFmJ7d5XXY|Z7iy{U6^YVrS;K=APJ zwSpU6Qz?_IHaw{p4O2wh5UmI6u)^RD0J_&N{MwHQfEQnRM~@1%DMO{CBylPSBHD)1 z`#nxM1;VXsex5$db>@V$GN8{YVp0mb<)oz$sYAay4H*-;*vd#7dV*T>co6h{rA2WP z@x+bY-1k!bOZCi!8k{OVg4aVmT7LWNu?Md=aats~IxsK~a6dny_dkzHh|WpW;CvRIj_Mp#_7N zcuc#X`w92i+d~gjk`G&B z_j<*>UUP%{*a(CVgzX8o3a`#$efRC5+n@TH24{^s8@S(?zmRzj2HYNUanw@IgPtMo zkUI=deit)nIayFCNf8pB4!Z?v^+$n`1|zx2!fGNYSHCn8zN!YCTa;RLFOgoUjSaV^ z#nmcD9_ChGQd?Ucy3o8A>jlit%lDfG_~i(pi37aSX_L|(N`AMiH!v=kH7uK0V_2Gt zxf~5rT+fs40}` ztv{F($7%^bbJzDfK^~^N*-6mro10V0jOk|89T`O?h|8KB`9Kkz==0;wrDCmOf*DZ{ zu`_j#e8O+pj@F5Tlt5rpPrVFebM^?gjt}$cuZr@zE4e!GpMqPyd89$y+j63=4R{i$ zso0utNXyV);#&P|zp$}#qGSXQo=1&Th6&avE|#Js0hC_LU| zwmG5ZXKHrMreAU7!b9w>9*KM(KewxQ%Yv+vSCm$k+1~|R3d2Bc+!hDOEs&8`wgZ;x zT}o=WUeVyl1Ek9~c)&FlDqn-TFOePPD!`_|&GPX@FNVx_0rerEMH)u+y9EjX#G=N|OeX)N>ggHTdMy?pCI(4so4tO3pOLuPAx=<2j;4myaV)&{7lOOe4x z4w(N(OfCNnR^FF9KL5uQzyIw!`vAq%BJw0}ixS{KarWPn8lY42tY&8PYyMkxBHHCp zltSunS3nWI_b)_FJ7AJ)xHz2?s3mPsm%S%U7dGmd&U1ky- zuv*HCVjfSligpdBIxYUL%2P(04(kIl5+_vbnlO0=)r;7Rd+7>b{|Yr=k4N^;i{bHUOo5!!AbZOI zYPC`CL4tfYfkye*AR7q0bv-fneV9YEf-Mu@SC&wo&7lg9Bl|&WeF6Z}S68!kCezMC z4~bWE6%|x=D2Z#6(0i9-rwq$CH3JdJc1{WkxO@my=IOSq;SglD{J|~<607~sDD-C( z#t#M%i0{{sKqZBWue=VxHl^EUXgv|dE)$1nYJ+rpXh$60s{#V%Hpo{HPV zri2=kVLrW55tIc$3?2W8?~uazTVn?-iRI+!?A=?9yC;)!_cc)||lC4kgyo z?k$N3S#Juioe)rVVIHK!nM=8JI&9*;zHEzKQ)Gk?kLc3aQhj5H1lRnY@N{~0h4G2N z_=z&l>ZllC3UFwuF$>lle`V!NWw|&d@ie}udf)a$?*p>RE=YhD)1mqXkLCk*2TXG0 zw155Bxvx`c%c*%6>eu}T-yZbC@f5r2-dW*Lw4F)I`AA17fKgmQQqY>TbY@G zud5c{eg0F7L#+B;C{Si{IUq3vtqbFz-88D%il+eYj)EK$)&d~^>!hR+`joqa?ZiUS z#d+KCd63$u5f}Esda?swTeed6I1|}+X>2q#15e8-2!yqRP{q;0U? zo@+7;Pdv%;CoRyzo07Ki8k?;u>{X^!Dweha8~*c$go=0`4J`FU{`v^eO|8arp=it? zow?>8)Cz0BL|t8VSjR7LolcpnZHw^Pqp}0?{_>jTxLNg197iE9w1pT`_l#EZUAvgkBgT|`x7xC0%qODZrQVF5+*{1 z=DDV>iW_QzoXL~>t7R|t0@b2ehZ(7TA9Sg6PF9K=dJ6WN^4eW%d$=&Bzh z?gBU0nKSIHWuC9&h}8o(6{G9&>WB`3D~B6_N-|aF4{Cbp#)C5leJANY#9&d(z>&Oz z=mB>~cpqNeW~^Yo#_hfz-T43va3qpx3Jv9!m+X)S#l3v+&kg%$ zA3m0@+-Tu*pa3t9 z43le=Ytlag7W%vZ7huqY8YF!IJQ0d$FoB;9+S44vy2CnY_S&X#4kOKBA?8QS#&hvY z+Sq*`QBWUJ&mEBMW1_o^ZbL#n4SBCcHdTvC4-scOvP_2J{-r`)52$wZ$JdNvhI@Dr zq68wH=H~%TH)y0VbV|HLW{|eahEp0i*v#Mq7(lW8vQapYN&l_W)?DU=kcnBxiIbTu zY%CDV@6lR(+mYcpH;BvC0Q7`nuQu}~J&wYtT#pW3fHHv`v_2kE&jH$4J}H7ZZTybh zZ@2h_Z%cY0wgzd{(n2nmq4(Jzkf|ocNh5)HcrgbCv!3sMj**5+8l?E9H0k( zg02JYJGc_CNKkT`y@IC|0c~L&DoO?^O)SN(y=5xIs$NP=B;2> zOD3I5Pm3~UCaV~>2F?IG`xh=$OLBd{{a9o%s))nf%|p3_==ztgD`!ZS)Ho^N{>gps zKhu85r_vo`Z+##`yeaucm|c>%Wswx9mMht~F#owpec!HS;^!E0-dstbZ{j$Zt&tOa z7-?eXmtAZN%?5uIEtxq=uy_{-T3yr}k~y2s`iW*^>Q-w&Qmy*}9q7cs5inUi=jueU zF>?gjQ@eFeXrZsFqihP$oPZTAB$g|JK75z})Z3q0=&J=!-Fi!d2FK2|GoyoQ-wmS| ziV<_d=tR}msEc*k7G0lh;R2@R;`|l#-`nHYPSwqZE_PMWe*f%S|E@Lv7sB>yg$qrA z(ewNpA}}*R;FEJw@v++{6`)A6kD!+Or4a49u}g zKiT#VXRRF>z>&dV&%f3?b^!bT&-J`O&n%bt#ND%7(l-BRzdzcWzf>A@K@z!Rfts=7 z-Xvd+TH?ee(hQl(`1=@xw-^t?@u_#n*tw4wEib_5Y39A<>FP(=GJwLd(wxO&R@}KnvKbATaoXIgy!W zr}qJP?DAupH|bQr6*YC)_Z@rTC5$@)#uJRP4#A9(GhIFr;!^3(4jJ>ht%zzBQexA| z#s+#|xZaw2_)uN2=ytxst?wG1^=@%5Z!jr6hsBFvL_Mrsi_crbkt95o0gUBquZF_Q3v^EM7W_LQn! z*ud6_mif2bX<_Su2Dflu=La6P0mzm7?X!khbQ5N3D~-#`des|zUC62Ot($l-NZ((r z{D%K=*rN;FoXSB4wyXotAkNop-hS!Ct%Jh)C!?00k*$x-(%o+eZ*z+UgJ!nS3ZF6%YA>b}Vu|Fs5o1&E6a zjUK58r&e>dZqXa79V2r3!KGr~MV%;2wNKT-qQJw0kJNqG`i^1I;R!TX{E$1^3Alxf zet44SvZxIG&u=gwR9yS!p~^Ai+hvF888ynM;M;w5G*Tj4J>|F@yfx1JN?*twHD$(j zl=AU11r4T#%>$2Xx`5ulqU~d{E?I7$1|$M4LA9ku)~CF-TAR49>~TRk zXR`c!2h%~Tj;GA~mEglDO*LKb9?zI>DTG380_@7r{mRp|Zr&>yTrKL^@)A>1YX&^w zRT;yw7^QK@&psIsd`DSzh`Ky`SIRB`SzI3Pr8Ctl-78Bg-~B}X6s81H|9}Iu!Excb zl?u6^I5Ytt0G)i25g>*ve7@O#{K+52Um)xAivQM7>b6z^6-y^j|)fQ3qLqNRLc zlSgIIAUU?#x_0E@lBz@DaXlz3C#)X9HwZDcx;OD3Vlug-*Vj-9AEL}#axtr(qk`pMj88ta1(;&M!iM-mdpvrT+njm| zC-Z5`;_AMY>!a`fnToo$hrGgtd$0C05Y>1$_Fco0!}e_U=Pfk2Pb! z_v5o&XI&-+I{{wmk^h~T@D~8)4{^_DhFkALgC&E9&q7`KL!_Xw?ES;_pZ}t}q>}z( zUkT@H%?m&K@;c)b&tLs08}yWGZoU|I|C=JRFG1vAxE%kUo$mkg&T6OM_h@>v>KvUkgoDQlnrNZS*h;P&@?m`An_tCgDf zQ1_tCpNC-m)9$T*GJH}z-fBSf(#=NeOTdN7@dE(94_w-3wDx# z7-v0eF*cq0@{QY9PJ=+1D!dVn`JK}ZG5+Hyif^u6$2MI5rb&7&%K;Q#r_^Q*p)e{G z_K=uMl$I{K>g_3!j%Ig?8zpDkx-#`ecNZHa107XkW@;DEXDl%1bdma8Mf3Y$0hGHF z2C8X*ax+-J6%ut15dmZTX0Nnq<&$^c2s%z)tqpyJ>rFQ&Mt}7SfSiPLK#<4Xr!?Ul zJ}=SiYPPN{-8e+`dUR-NAWxYdYJuv^4WBQfL#u1a0jrAJ%tWq6l4FK@vC=#k5XEzB!J;s4TVB80D&E~}LbbdT z(>UruB85@eDCU?j>;pqBbfdyba5@Fu9&##Czw%qB9^e^ids|XoY zI~GoE`30+g`faRY@8Nq6Ed3!xc4(zbAKN>0zX=+|F!&`%b7 z<=vIGhGRqzibcL%u<~2yQcEph#~&4=^LJWa4qfzP2dsKsureiglFRh}Na^JrZf(AztoOE_fflJG#N zz9Fk3PwwfXuhcNm>==P)-WM*b56#hsKsHbt0(bOBJg6Q&tGfrmMB%=waN6)Y0T}h)z}9R4+)_W# z@2&0J@`D?eO*pK);MKF^>W%!e+%Vn!N$-jZsh#_tRsb=;UU>iQgE1>F0iV}I<&_U- z|8|LE**v0VMHli{55J8Zw+pbFv~5K_H+%t1P~7ZKbVb=TFMA9eh{VqE4_NHrZxIax zAcD#_5?Sep2-W4UJVtWFxjKkM*ESrLiY_UlvRum0Ij*vdkk{Kq`o-Pi$Zwwu=!QNM zc6G@pk1HAFF%sW8|1w^ahEqr0g83##4p%Eg{J_8E9rD%hy^T}Wvo;ilpa)OQ$S4#x z-JD*~gK&ikeoyNaC18Tt0lsX|cK{REt{3ojhxaM^y0l|zZ_+$3=#01WE0ymxAEIq_ z46xOCtfNG;Y)O7MCTS7k3J>8kNV(8ld~}Rat@_#(aH^`%vK6_1^A98Y?+T+HJ==eV z&HY7?PKESiqXyTLT`5JmnDJ`g_B`hCd7EGRyE1EPaFJY3VP!`o7n#?^jvXelEe{i+ z?26u+5EsMP%M#>UlW#dmkznr=K+yfJVy^{_|27T zp)wLte)S$uqkwi)u^V?#uKW?VfyGUIi%sa|$7Sok&GkNT+abXXw0IalYh!)rzTjGb#_xD?vu1ybduCu92sq3Hz>oRWjZ^hbQ z$fR@6=)-{hue+a}+%Os=yBf0awAYl5x78wB4!5BQ^t4%{KuJ^D7^@8VOMi9%0{p==>pXiS&Yo-IwqM@@|c=6T|!2@2|R)nK(^yRt%$LF=K-0F75_LAyB z>s*&IUS39E&wlM9O)IU)6V$x~i$}zw%ZBaUQDC~{>agys{i&x9&i;!uyK(CcO5L^f zm-gN)CR3F2U7wt}dWu~&#?cD3?4{^Kb%=a=2@-ZXdK z{YLR<^1BVcJ}Md7ar=hR3i3IsYLl*d|9ON~)sr)|=hgeRC@u4I`N{XiuZuTz;Z-;B zx^Q}ROhHLQ6b8<@#ku2MUM+%RBWIx;kvcLpbaueE-Gbq|5X&8x^;upxH38aKPRR8W zxAZ(3%>x^LS(x-n_MlhJT|BVm?uFx;rWfbTYS7wOp1Ep5Q~aH>)InAtm(hB_@f(t8W5Yo>d*XdadfberfA)EmNtm8t$) ze#4BRs#=Lu;>aNlTR+H!rg?NRr=2o|YTGMdgfJT&g;5tYlSb^=!VX^1ER}0AD?ZPg z7TQbIVF8V2e!8;d?xIB1re3(Z+ar#gKl^)DTyEjoEn0b)l=G5wRZK_(=cGuvh#Ad0 zHW5B3sbqCTLo%^n(=F~J7;n`*Pd`dmPHOE8?TZW0y_zhcO1Jv@NzeN3dtl-efLNKT zW^i>grJYDQ7(9q*7Fa|Ld28^&+*$LrD?Hzz$Rw^-PN zw{^dl`gI^^Dq#=YMC|2mA~cl^9k7_mmn@m&clAX5#RR8ycF`R@{-~9+g|JgH~Z8xvjxt97Drox(|_qtU2#vijWRr6hBan5VPU8f1--jnlW(~)j3_!B zwT7cYS7U>65zUZ`ysYV)Ta;mZ8%Y;1(qD&LQii#_Y3@$x8yn*^HlOQK8d_Gc2<;F z6x;4VzK*_ZCuwz3k?|2Ebi|wOdHKu~W#Jh8*SkOTjlIFE{LS9aijJs>%F2GIY;#=g zyf^htrH4~O(aW&|Mk8&Us(m_SYE;{8r2emryU>nGskOc^n0_H^>pfyencxoPY)vn| zz&h{cp_Q+E#$Tmq+M_kA@UbT!l~x7Txj(9$3e73wP*TgF`q6ht-Qw^~SfnguU0r!q zO4HG4<|%IVO{BMaG@2YcbriIFsRrF}2)6 z35W*P^_xDgrQIoS*OuN>W_fDX%3Ed3%KyrrSARY0*x(38I|Opd+BXk?8MNA%h`tx_ znv1UbH}oq4HcN1j&a7zA8TT^ijC)z$8MkjYv{%}1HfRHYU*jLJn`tT459|hILTaK8 zzQNzOQ25*2GVX3!4DC1AFUy-gIoxg~@$vF)M7}!0B!(=KH3z*D5hHCE#JmL|OE!(M zval`~)CUd<=Y6D&>$uHLpr!7gCuywK2@~94sbOTp{LVUC+kT)*4vG+mmizGJZoMgN z575;26>y(?C8yKZxNPji%){o`W&8RE#fgwja%bM*PrkA%A0x1u)F96NUXrLUO=np5 zNuQdLqByaAAgHgX901Nzf6fZilI1fzv}{iTWRAeoh@IKR%OpS+>X;DX#0rvywea`8 z8r->sqi}!>cHem@c&m<3jLZ3a7hAMQ=GoE1m8^$()G*Jv9s=glPT8~eI>DBNE&|M4 zwnkz6^I^(nytOm~h(qH+BUe=0`ZdEbm%)7!t+Q*G8Dl-$l?BdDo=<}|#ok#C%fy6i zqVF7y`0f=8AIs&AOyDK28LF6f@L12KQ?vbDpbxVNwCzi>8{BU#+7+lCKotB`mfOC; zH?`Wk{~1!gFY{vXU_Cr`05c6nl|A>n3~fHugOB+Q-Ba3L(^rWwRh0bl2nfHFhJluM z$dM-QyBa4g2(&Op4EYAsB1<@51^Zu+6qqxf%5gur|IO0SnBpr9z$3Z_h|J&0q&k9G z2N~Z9SWS;l*^f!8z8b~;T~PwMYt1l7oXLxqz>NhPJF9-UpU=Z(t@L!exo20f%BnHq zP{HgAmxTg*NN%`mJD&=#b%*q4%pPQmqyJGF3dA|D?5G?#j>}%#4XJhlg z_A})>X|{FlYGd@f{@S8_G-PtqCI7O}96|Nd!BO8F9^JxM6WM~g-Aw<*Hzksaq=vfU zD^0?R34u8e)196C7?zVU?&%cG&~D!rqIGVzm1|@Zobm0W)RJm{v{q>D^tNXLHng&a zURjo9o+^&Q--a~*!DjjVP?F@AJy+&0F^Js3`OqxgLyx_d{qES?zlLbEK5NaE&@9Wp>-8Wh z+qmCUY`WPz6xEQ8w=M+HMsq#JuVFOFkb1h>v?lQKit4*P5bV9`B}fhwYel~qVk2}DTH=~=EhruyR@@z_JL&c1)AcxT1`bRe zMe~S1-^3$tpC^%vprNr+&gI>(b)?JDBb&$waTZ=JRsfJ9ldh<`$-)KBbI~*b^JDF} zxM758yC8L9S~jw#V5;pSV4GeXhl_Ch&&vQM0pG6YHC0V)0a!E62;P)HzgVK+{UUpb`zIWd8=E zv3?89>yM`!#*1syn{wxCtNph%6moZ`-bHEBkK}TvqpC>L9%=~1(Zheld?#^vG0dR1 zR0K48uGp!AEVQYXfwQ?T6SD=f>*G7I0VgXidWh)_iM+lw?0XWv{vfn*e#EX#_OS3| z`jhj0t=|NlIglrbUN?H!@0RcV!^BaY!_}4%nrjDL(PjQaQ|G|!(iunsHubva+byU! zo6>)pbk-52P|8qOD-8%x@4LiQZS0gy?Cm5A4^g0tA1Rxa~0l4JUeSa#kV8(7M= zaNAgj<5)5ffp7?8FTNpq1)4hIv zVm(=Dc+4J|5?@!g{?XE@JKF&IR`KW_E%ksVE{i3BSP-~j zv_7F&U@-MyZtlmJm}Af@^N>EV^!`ThLI9J;Xtl=L!BE*aWG%4@(-Tyw;>N9n`(D1| zYTrllQ*h18+lV&2m~3;=kGVgr9PUazeXcy^$@_X*cW&-u$-jOWbH@ecP!-s8cZcPIMM!!*3+(k@QB7zL3{K zREywrVAdGtw;qZsj5KbMQhj@Yy$w!r4A@d8j9McM#v$3ELW_3kS?g5aY<#8Pd|+v| z_xLN0uOZyG{UyxA?mo@FhVF~p@X^h+>pB?obEC3U_3)zR{9N?(R5<%y=g}mRnama< zo%uzFsFseCjkj_QC3 zcT*4haInS$t`%-!rvaZilC|cM>q2v**ZuT^E;grLZ^3e_3r7P}ei3klUzKsUh9sZ0 zF2^ISJ0joCPdkT07^rz!W@~&k&OC&=;%4*&`O$9X%4aHW2lMkt)bg@QUlN zm6&M25h?GMYTB5lOpOXKXJU=0QJ!{RYPZ>G*{31c9$s5-F2 zo}}f-P5~Y6{&;y=Ohbizl!Uy+6jfT1Zw+Qj2eP$1f@5R1x&Ogi^}JfFEHvDjkX7@& z?;@Osj^Osa)=_G?wBglvI!d|9)vXGK!$cHjC9H49%ma$wi}QQo(`{>}5DX;7zh#S64|{q$?+Ays^2duu;@qwi(TCnl_lkmOMI=3~Qh3 zGDXLj+PcvyMcN7)%1c4NMx;~YP;R6ry2@Qb^vBvUrEh+iO5so^oct?gx9M|~`Q0}U zp1pde`Uq=B=?;XiSAO*E@3z9F@NH{-j;rk;NF_&PAiPl9VVB|pAITgJeqK{RC)y*^ zXelW!H~iuKKVTl11nQhu71k!D;u~YZ`1-5GhXxm#UD2{)URq)>#;rgNQxASLg;RYR zsEHMC-YhMxoR%!{a&(N5HuUa(hZxcHSA`mwW4?=$x#g0=%r$}?*@%tnpH>+?Dpl&Z z_ZyVBNZ2Gn7J}hmBs_icaDCeLneGfVSBC#srtX@GP-cu<;_nXzOo`1y+I1&w0zu=C z@kf^r!04?**C|44VdQEg=fc?kN8WotHGTbm<2Z33XjO)+s;vtF0oj2#sp;FVS2X2*WpWtja`EVjRVBz14Ne#g<*u{Ivl?F&#k$DDLm z-b1fytv55zXx5b0r8N|kX4q4iRPwV*e?<0oBtmYV3BlB(z?wi@M-X5NzG;b<^puoc zr;@q)>Co=L@CQKU`E$OP_WFI)Y&X#D zi^2slvP&wsRCKLT;7rHujk0c(>;ua}MPRDv`AL?0@r*TnG+9MY?{nf>^eZ7|68$3L z40lFo1tRStkg-1_-@eD&Gz&eoQ{nXcEHrS~SmBf;QhWy#e-+nxXWdgV;Dag!zymsH z7^0YbE6lh0_mKw-~Y_86UE>x|(pym4^swTQ+zZ@x5b>e)fBB z`tfChh-`OZjsIOOzTsKTx_&Ig(3lFh%3;dRNmqCCvxBe0mwreS z#Z+Y3?LiTX)dq9vJ9)Y7Xs?Zg?ey1X#mU{*(ze1z*BW0HO={`eIvf2$2$=NzPe*8G z%*FX*yDy&Fg&v)|)(`S!4}#4T^9zAXUh6!~Rm*&EWXY6HiqpGHK-Q3l6h`8E7f;=! z?<{>W0a0y*H>WdB#Z5){6DJS~H4yI=HwOROLGjiql7EqIYgil)&kk!cUNOEV^>N$VOcb({W9erd*DM6kh$PXA0HHz8qB&(szoUKqUtO z91iMs_9Z6f*HfUMi;XzUGhOwwi(nBe^@}3Z*@F`fj`SRD+c$+@hiL> z@kKx^bnHQ5ldi1d$kO){SX&exxPM;|r4gOmQo&prnRI{Jer^~Ho&j7j=f3|b!vC3X z(7*1blhGLt3arT8Cm$Qs$I5q|kHu;8mv-p>>xM<2-{Ua7Tqp~2Um!EjJ_;R7L|59nvlBeH;qYDj-l%wT4QxQP)-xBTzm#w@y~Lcf$usF_j^TS{a)LG*cct~ zA%4UHtJ_~+`I6X+U*Bdel}BHX1PI9kUsSu&Y%v4F)iZQAl`~tvypG2Ix%Q-dO;v0b ze*)*s|A4 z4A_ClZC4`x1QP`Sn9u%CquNNmSOwGpKQI5NV1V?wjHh8CaEt?4vyRrLiJsbCb4i2D1Q3Opt-7ApULp7y|>g-P~h<;nZ@f_cQa{P%gdZf`*J0<(VIa2Ghb7TR)eia)sMQ4g(w?ZxNn5ExBqd$Dlt z#qF?0LsHkYVC__=${DYh*zKd3QRgo{={nJSu`1OI$BwQdKl(4Y)DMp{toBXf&pY@ZLsdomYrb8fi7zQILS{^tr72QxeTz(M<<$j!C7;+?m+Ky<@ z@`)4oSY*VE)fknA_58vd@9TCniyr6~dTb`5+-dMSYsXU>Do($DF@Rq@!;ogZU2U#xY-P1iu#uMZ<+#II#mKGiQ7d+5NO?4P_%@oy^eUiYs> zv+TMeUV!3+i-X>Gu3dng`2^@dsl133WWL9l zOGze*+WwcR0j{53w-#k9C*ASlNTfd_!Zab>m8n&GMO2d1+%{nwykRb>_3IzBgg#2@}?(SP>m z7Z_!HLu~ZSFyEm2l2#lXD~*rKh4SxC%RlW0v0Fit$u~JxPF_jS2;+$F^gBBSh1v+8 ztH#-n%G<`D-X7D<3jNqF3u518x;yB-k+=Nibmx2n0s7Thk4fm9_vutvp$`x{`v6JWo)KI@{PZe*=Q8>%#`SIBiBe*n_^kclCewG;8 z7xdji$+l`{)qv&_U{(L`hS+H-8Yqq`J7E`R`ctcsGkrL8?Km!GR987g?^lfA%jgSa ze@30_RXSe(>#&6BDZZygbSqFIo^#@iKk2`i>fPJ(=)d)_)N^ALo8Kym*@x~oWf54B zF$G{9K7;roc*qJcz(s2ZQb*R-UMG1^GFb(0vL>GPKe6srmXwbx2{~VcB%K2j3{!QD z%&1>x8gSB5=japE^(AAE90WH&YeaskHob46m3W7B^ZiNzSJ@x>yWwPT=Bs|>BlujC zJ$U_R>rY431--xHHcZ5}`)8O&b&fBBikka-_+?w%EpDI;NfrJ0i1DsVs^8c4rKLB0 z3uK~W!dt7sC0?kWQ_??BxZ0rCVoz(&(2=NksbTal zj-z%bqNT6ii6r8lns(u@%9d8OqHZgyYp4^D!<#n$>i}Cau@|&IS3dJKr7<(yZm1P4 zSwUJ~MaM^dT3@yuT}0!r$5<0 zdQ0GKrQJMoXrkPp3UgRA(FR)(^~$!GrrvM}V72A`ws*jF^uTGCaK8drdJ*;t)_OuXnNZA3lT zZ*$_+f<2y(o6}hi>(BVT^Q<2U({0IxWTkCx?~i=Kbn}1PWzvQ?tj}q)e8Llahc_Cy zFrp)uzl zWA9DHN&9DZi9F*P$wv+$Yd{009vd>6r((Z| z?@ulR>T^lliTl7_?o}qykrAx^fRq)sa}N`pOk97(Ss%WQ-PQ#Kg#B0Opg;mQ3Z7(p4bC}NJ)a-g?vS#D|DG^ie z3I?dV4CqmYQoGTA=>ms>jSC!9M{Jf%0VD?ary`&n^p9H2|9M#&r`DY*8mov3A3fAJ zeg5hL6Sz>hNe~Ur)K~TzEx<4Od+7jKns^s$?Oxs?PKd9dHL`NHS+z{|&DjExJga_WfY1y(mbcH5Hg z8dGj=>F8D7-~ZvOcz{$mm%VHVpa)GIBi^1rlg_``8rpE9G+6*}X0)f;QAd)%qr8i$ za$BgU`bF-E8WWx0gY{e}SytB|pPb8#4aeSD2z7_ME1uSzFv{ z{?-Dfv+D!yO0c#lg-fSyVk#Yq?g;Xg>@pHPux{m zN?(l?P5b~aiOkS@kYP%==jmc_$op!`2Gd1DkupHcu~-1G0ygSjQ~@}Bg4a34>c=e73Z(m|*v~J$B7?1Ob&2|R ziy$JyU?tImPCrUiu{B^gK9tOONb7_V)jA(io(CCIwlCtr8e8pHgZX@oh-zN-giY7e zbKR4bb)KRPlU@H|Ri7=OCGpEJi75`vc@aZqp}H+j$dObTIUsM8iFWlKgG}eKRs8?> zZ%-9Wgj??MxAGU)<;4X0caz7>2arvje;^3g$Yw_&@G`pu!2M$r1iP#ZDR`*QF};AD zIf>)O#z^p$OWi3Q)C>zMiG56U3c=n%2p*n`Cu8?dnW8gX5N%B3;zvoOY=5HQ zboR|8>44*Gc}Cc<dt~+ZUm9nr?4+$ zF77NZsAZB{ER`qrX2pR+4fs=rxVUPa)olJo0?qLe41b&G?U!&`wfyEnfO}Re6)+w~ z%Kdp6qS69_!-rWNBm%jr0+rwaIMg;q02x3dh|#N(NEA=TefF|{ z-=cxfiBT`HLtI!)@OS7+KLSKz`Vnzivz{`W#3dA;R~0|v9W?1C_O5~%ZU-7G(sN-z zw=j&v*GqxkDY3|=jhPsb&VLkRBB{6aSnx{?v!fJ7@1W-E`4y5aaSkzf4{wqg4{5>3 z6E{?({*HKAKI@?Oy%f}F&shHb-V&Y$(Z)aMOEn*pqJSJwA?xfVohvCJ&33?`SYwN_OJ`=d2j*nI;!oc^bpdyER422t<|mhG=Xg%x+>MI3|}-H z%px2TX%mHzM~;QjBW2#IKAfZuEBbZI(n94rzUL<(EF2^Nw)UoxZ{r8fN@A7{2@G1| z)hrrXcGotV>*=oyV_fOB3(B0IFb#Oi&^a<{ioF+U;D5vzgscK=ME;Qdr1hOXun2kjzp~ zmy$>?a4ssAK-_7cexo4+Y-!J6WswQ4%Qn!jbf=*%HJ`wH#lODTNv7j*1yDj2m=gY= z%|6W&@*p}YsYFahD+g3~3u!&j!izfIj0{X#Cco5xqLy9U&L*WGwYvj5xoX5&j}Vzl z_pcycG^xmvVAk><>si1K;VXub+Tidu%5Cuq8B~WJEuGSH);Z|(*wbUGL8ogn1221{ zv{=mnVzJ-$rd477qG2z5#Zbg6 zbWJvLf#j=@y*TxKlwv=@Q3n*s(h=>>7!(Y64pK7i#J^wjWGuCJ=~RDFvtbdg`uKu> zR%eIZCK8?7i*+_#C{$E8wQa4jHqL=l_CRoFRs2o9I?Wqn6Xu#P4U=PI^cDX(T)3UO zF#XFkeb<8-15+YY@y*8Ysdi%!w#h3}L(;3@4m^jvr3vTeX-TmFOqs? zhsE1`st`aF8CDn@!;l`eH!iZDgla{p%ga*rEfTMBXD`l>Z5!m_dc^M~4dXP3>GmvC zX7(Ubv?%@g7d49ci(j*ia^?L2&|ha`zRjf5iGMcA)CW^_l#Mc=fHlbA4w~*4OM>%a z3M~U6fwJxC?rz9{fAwdSU_|d|u8|W5g!VnAWfxC}_K<@dq^V$8M>ZAJtj7ai_Kgyd zeeg3X@SbkSEE_zFtn&3q%{LyWMl_mfAyWqi^*4qD+yP+LkFG5c;56}E+5r)Tp6xWN z1%0z=PXlM2AqLk6WD>{(&G!{^R82;!o#q*fFRD2PHldq-z~@wy9o}OYQssI~Uxr!c z&9t_14s=tUYDmzjw`7^;zz0$nPLw;AwMCjRmXYIFvn$C>9TKn#sNjL0U(oP*cdxiN z8=*(~R^$rC?HSvk5m{#=OVrvJFXpsOVfD`(U`9Fc-M-V{{#W!xriXhLZf--Q(z6=m zGhKi1%OG&&P>jr2a59fx4A1QjFEKAK1SVho5le?AY|0vT*>$^b^9o$sA6jU{SZU^4 z5^dt)FmTew05r!+>o%Y>Bx(Dmlug1pg!D)z8VnZ81tojELoR101AX@3v^Djeby^JL zGL((wSmxT6MT`@_c1rahfyP#Lw!{<~0k2 z>;kvqnP=IVx`kCA<+E-ol5s~REM5tT-?jGg{&k!g(84ZKuXa|x*h*#zXtRRBD<}T` z*n=5xJn0DNT=Yo-!@l_Bo^rWEm@f zX8a%NW6|$gyxpFahvO!cn}H2hdey@r|BIvSgX&zNO&R-@MLHVpEQR@VfbEp`d(4&` zj{j*>*7vKmT52Qf#X7CZ_6bq1Eh<}yZBXLaLGSQhw(B0w(8>uL$>x*8d-ph-#;^a+ zia{|@Om{y>Wp3-a--MfnP;K+!>vtrF8d{ShRxApp;ID-;2THXHMfc}>}_*a8%mq+uGWTRDCuu*IS=s_-5F&VO+~TAYm% zP@?2bL9lfOJ~ozCbf9W*rSgq8^BOqB;we>AWDam@KSX7wU4kmgsz6;W@)smwq}sVt zZMJwQ@cgPkS@pBfsv73=C-dx!+JyHjWhF0WT;bcVHj`JIE-VkH2Ksa)A(Ds&r1hEu z>5n8$dmQ{~ruB@d1L(%nWuH048R23CV5A0$#4%(7*RmPHt+h}V{j*y-tQRyiKGJ@n;CO0f$RWe39iBa$N-mn!{FfkXU2AYPV>`|jOs;ZiP7kT^31>xa zzKePa6TCv73Ix$?U;wAm*ETc)@J&3?_|t_XjQ>VygIQ{(y+JB_C)Jd}#HQG483Sxw z$Y?d5Xk8mYJYnDg^k2x=SQ2#g0fb3@mNlUQBHlO?Kks z`-%strSNlwr%0=Y<37D30Q=J^3TvjZcaNOuB8nY*q7fy7O(&?Y??hTymNm6eMd^8- zPQPLidl3-4T$1=>FEsS9Z6JhpgB)>aB3f|dP;d6e^T-09fuADeu>MPpt&uJ;F@>dv z2FQg?0}=WBOPNfcfo5A6(m6llW(uq8#1tbKaA{e(%=UBLPoeD7%(pPbQ^e>2!5qQs z_FUKrcs#^3SnXjYlsVC6c_RWL_bDmt>=5LX(#aJth7Li1HV^H2NJgh1QSGrO1mSc% z`Jp$WP2^ewF5yJ0q=S|3AqQvb<#y#m6?;V?ixoxPTjE`h)99DHdo12poZ_WbwLWQR*ddsRxo#$i z3e7hy9nCcUdfDdG;|;_0bJTll(29za4K$s~1kq_G5GqvuP7FqU{WvYFNO09uxh8+c4w z#BgaVKLS%sKC^SoeF;nKk2$^@^QU2S)P7W*%b+}Wbxo>Iu@7T`tr0Sz}A_@f)Lr5+9fY)@TiP6Ag#!YIZ!$vrbrw1_0 zijIocTmrv=!9zYi38qhItM=K}$a<_WI;nd=&I=|a-r;X1nC&b+_)cj4;dEIINWg{S z?*MurZHyK;=7RtELVKlK>8L|Q_KpLxd`biLgqKlqOp3U+hh#vC>3PD~D1nJ=*j|C0 zCkkWo5iB!Ml&tAss43goQpql1{m!s2JCgNwGK*E&M?O-6L&EV}b=D|l>$k+HID$C9 zS^lk>UIt5}pGZw&mi9#_O~y|}CghR1s*~X+yfU3;p2o-4>~k4|9#dDN99-+I-7$(y z4b^9V<7;K+?wVe@eP>kkMs}OIrBgl9m1HYzus(s{7lTsKovMd@sAP2OAM8p`5Aarv z_7uh>(j)KFG?6=*O&t)j*Ho$i9@^-W(4@<4L)39umO531vl}kRsxsenp@utP$a)0e zFihKBXll2cZrNaMK&Y7(019fsEg6qWBu|Fd1D;R55Ox77JL+l@D3i{H)ETWvdXfhuX!K%(j?@gsP#tlT_EN zR7hX-Qc(;7>Q*B0kWvbb8MhOD1HqcgFUinvQ=v0ul6~?s)InAG?y`WXIy6sXM(4+5 z=wnJuIKg^Vs~h$5O-3vH2DX99a^FbE8%7ZyT1_AP4$Na4vU8{P^ucW1(7YD;R7G_7&T0}V-H}&ZISz}FedkD-f(01B9Yy`sZ=4KoP@5M zY1J}L)c2T5X77dzTkF}QPZ9W*VG@56&z)Dg$}DucuAFDvfY>g6 z9b7M5J!Hv)-7lr@1d?f-$fhKQMW_kD%C^mJ<6#clqH0k7Zr(SmeOv3%yF(L#{Y7QA z;`^2ho!!>~A9zFDj!Q0j$+3=tv!{XiVgM1Q&vAn1^=%pQ6HvRJlp14>Xb>$aqt4q0 zNQ}pIRAQ7Xa^zyG@E&H)1sUL=MJO&UJeAeZLD_A^+QCHc zcH7Xh6Y^)?Ws$=@G_|~t08#p#a8LXxC})FF$(15c4`Azu$r`do+s1Sb1$&@w{XDzH z0w!p3t{gh2X4GAQYT&bh= zXm5hnx#~eC+s8Xs;tnI-mXxj$4j?xw(~L$B+R-61bafv4r^k%zabQ?oK@<%{v0FmFsLs9SWe23V@;@9**jkbUx17TykaPRLMY~=%EkJ_kuo7ez+Yb z0M2~Ub}p|X0ju?z{4)``vgIn!wN*b(eeOQ>XrTOJ&2lfT3E!aMBSSHlYJMO2eqefF z-I=jXukdH&Pu`0Cf7z9dKd}eC^cmuwKX`>6y8hPPRoJ&>^rOgXqg3ekocydxRD9gQ zsjGpx+RV2Gm2X;y7FELNtld_j-l>z2mt066%hY+2KNKGLdq@EQ4y)gsKYsPbi7jVx zS?Mj9Td28|+4CnhwX`-85x%CyP8S!J*Vk0w(=_dulo=1n(IC)kyt2TLuYdb%TL{U%1BJNY9gABEw}ur+m}e;R_9~5JaA> z3A^3S?cQjE@Wj$dTW47@te3q34l+@&7pWA5())r8wg%6M($A{c9CiXNt)TEBKfK!I z;se@x-JsF{7%^A-)Ut}}<~o5w`m0z6kA$_L%B=H;lhLBV$ifRZU(BxVZinJtR*T$Q z>(4~%@Tk0rGFI0Hdx-#j7imOrAUSo`^Y>4+BbEr|GKZ6YFCgStHmRAQe_W|HFKi z2EDNG6EulMoUYUYC_I?cr)2L>bcMh*s&^$oKoTGPnYQjy!cAzH{F>1vpzh9U1uSXb zzwk<&%64z@LeNeT01aRbi@$(UsNPGYs0E;ji}^D#{Dcyv1eUUER6u*fPHDdmlCV!$ zEDuVTz*_}0n)H?1*TIQDVWvcn5sYa^RVtO&IA42HCdDXGkh|wf`oG5wgR;@WOpV6c z)~7X~+DFN9s8qLGhbL#_W_$RVX5rXg_)04_xLiDNR#ay5pKptloTU~d2$JvOYcq|;OsvpqG-kK}3AC`+;!~c%;BGR4G)zG?iK2iRBKf<7_wK%$OujBWoIh;&@ z`?kex-sR#)l8W!ksBH65+;Kcs!{#0rk<1sy95 zBQ22Kw{z9)wo>RPls;wo$nrgGM>}ZG3v>_xLpCX^uDRXWEIu;f>EPrr)?xR?8*j!8 zhyaA!hZ&^mgT`j4!h8NcBf9owKtv0D41O~uJZ4C*AVfaIcnI-+7Y<-}wFoT}bc!SiNHWI@*szG)eEgQ!%CmhyaBz%%3!P1z&FxFy8`Zn%71OGe38zJuPgZu9`7QuvD&(MT>9H}W$yL$% zi_h=bH9Y`*aV;;__jfh3`l1gxJ6GIRex!(kIjx#6I29${3>>;ns5TfQECV`^m8_2( z5LD}h4VThVachr<2`cta^Sj(KH%}8v8FJ!;V3!?pZ{ypisfb2Puqa4QII=4rJ!Dy# zc~9{pRwAB9`MXW?ZAm^jTi*bGPD%aj%@I1@fwVRV0w9$e7fMibIN+Vss%Upp+e&@U z6VhA^yS*hfC<7|+*uc)b8H?lsC?wo0Bb+rn8wmw_o!;p+>auxk_KNl+duY~(=T6mR zX3qWffzHe&@SRXR@4Srsos2{MGc^%7UvrQDKdA4QMht2yQugNAYNiysq`# zb;5_yt8xpxFps-8SWC`%m8u;TthT1#SrJ<7ohtkg%;pl!o#Y{#rt=6JUpn%FKiK9G zj3sZp3FHDDBK4LaFp~>w)CFu)(FOtHhzL@lFlXOqby+uGtf2ZZ;SNXhM6e}zjRg+& zhnGw_&)x-k9G2+pQ?L7<$2V*64I=z!Kp##>%8r?t8-HE}3^q77Ic6H; zlo6$b$Ywt15UY`B6V!fHcvLrj&*S#RQ&C!|cY-~e_Qi(3%|?xHhWto$zB>@Qk$SM9 zB}Z@b)y&FvVd`F|61y~=+h`xKZj+OqJKepznLt*T?i)_!f}+^SQ<{IN+L@<`*LIe& zIslqNs3(iq**R1?U~5G3dn`s~)*j0iR;P$&n_Q_W?uPMTUKr(Qh>%t=s)5VY5t#?F zCJ-s2^`==Pee>iL*b_zX5BZ8!Wo-z$O{d!!tzOTC$so7$$)_5`=C~VtL{*1%Vz2dm z;tA&=EV?k{2obT0?A4ns^-HhREREz`5RrGH<@ZsYY;?rY%U}m#sy|pDD<p2m< z<70goHsqEwrEm7#IGQBA-A_Qx78A41&b-d=bI6!^ni{|XftZRDy`q!3F#p&6pr;v? zihAb~w{eY~&u_=#Ds_$~*MECYef4C8dGrO*!(~6#@3LWAtl#&mUa=<u=Io6P(`Qf5{Lc1mHL z#CEu=DjUqr@x|b2CnzD(mI@0if>(GnwU@z+37s*N^WOp;1UfPvsyG7d1?H>)2Aw;m zm>i#kSNP0)M56j0$2!KeIDCrVa#Fa_HO{(P05k(J(eea!5|7w@ewAyArdxokO zvALu0>Ic0C>t7C_eSYg6TA4qc`hJ$Yr$&vNnz^}_e*zl_TYweJC50rIl?H=OE7 zKSpvORF&c@q2i_pG-uGXU54mRrk7o3dkZY{^rP)(8Diq8k;LG0)iVa~9{;fhgmYQ? zcNfUMcUuJ?$B;I}yvxlBFP^#%SzFl|gW41gF6p9kB9!Pa?G zu1u~2C>|4gCuCy>MU5f|pf@|`t)Gj}Lo9P)lAhw-ake<`o7$USYV)`!rue4I9+e$J z2!5MCeG!rqHbQKY*Mg4syKT2WoqN{;S#m9Iu8Cw2Gf=8HOKs{kR5XrLVg@-)`)5DF z;5#|!-tk5SgVfaRCVK$amDl6MmHjV^^A*R3H>gg{KC0EYtJ31yXT)u)U+LU8asF8G z&%))BUdr5J>~GKPuJUK7b4j5(F9*axf?l&co`ptq`-MYT^cU|234DtjlTx4`+4D3R zB&eIRO!<%bnJ}mNSOC`_(UpN3uU?xFzl3{FzGScWO+9PA4l=^=QDMXek9g-6LvJG} znR>KT>)p1Sc3Pz_H4n7F)Y`pB;s>{#tE0`{?LS46%V({^dZl+dt!R#)5c$OPttLSGs0!J*Ws-yi}gMwqIzLgq{mcIn5ODb<+V0Qg_V6;@ad4IRs$%b3yYNruZ z=EFx_&ISl7$RnE}s6^VUle_v>41(#z)-f+PX%`M~J5Y!9ZMd(?nmhf;~!5^J&PTuDcw#v}$(w(22NG zQOrG2Psg+i_we-*1T8Y46ZjXUg5935+KyhxAYGkUP2hSap0-jUCF&!7qlTLhwo?L# z4-9~~OW{^=qI`SAuuHeGz2-cp=19A@%`%`bqb=2)Qc4y@Y%^3UPtEXvf|LBUB$p{s z+&(SE$cX8{LwhKh(R6i9!V1DrS zLDY_X7o-H=8oNZD1zCURJ)IV( zC>EICq8@8C3hsl8aAck=V~MH=D4&`|ZJ>VWjse~9Z0Xeq8pxLMS*J#mC&W)kc39@^ z=f^sGkYeXJqR*`i^Tl}9(@Ve%X))fFd1parnQKtr3A~Q+KmwH|Z)pCV(HBWw-x3cQ z$Ri7*Qv-B(rLSC7KLS7bG9voKr6p7M9OGD4_Z;yO*nn+4z5fJ&&v`tYei5@8#3mQ^ zD2DUnpkfSLO)-OumX7B!A$FYUiJMySQPAMPa$#0{oT{U&A_6{h2VNdwGXdPzRP@$Y zRk-zGrhnHz`+Jn}a8sM9n@yw=_ZA8+-BdZdHngBhO(hbyCa9%CNSn&7HJp2mtp#)b zRWwZ%B>m;nY?LmTXEA;teuxI~!)Z5vjvLq>bdjdwdZ{0D^Lh6V-YcUv1L0rgz|$w9 z&RTePwv1!fp|HTHvjd zJ-j&7RQ^L#N4B_sP)X?OCUvcB0Fl}L#Zz!GmgZ>C;&&4mFaZ+fY3UG=Bpj!b1At?l zivLdW&o-VsPMY}REcb8K8GA@*|NHS?#bki&QL?TJ$+0n1QBHKn4 z#|)usS5X|wMaxw1nqL8OqPA1BCBukXf&3j;D0={$Tx@Q9jqiCh6EjL?#KWVQvRWaj z217-aXohG-ejI~oomcjORm*}fQ1mUdh3fpm7 zH2IR}_h)m5869Q^OCVVnbQ*z-N6(h8p3doLxCrPhC~Da=j<7kx87^+w%4hwsbuDZr z#qpFOsDH;?f*7)&hw8tgER?V!>&Yp1aE&pEUU74l**U5mYJY<&2i!QqA10cn=a9hi zX22S1K389*@b|vu7I5>=5}iMq&=lvq7R3Kng? z#c`vBk7;&`nfw=vzy8`cPHeuAwW4gZKYowh`QIE^^}*(k@z{NfIU)$=0(IMYxR1Om z248b&kK!`a-Z}!y-B2eBrex

q$&-4utu0AW*hC?p09xKNxZ-mfxtT8V{l7dUWCU zROefU4acK#0j|-UaVPOAj$+7zPk7)JD)Xu}#Lm3+@K_k6z3GC%%5WpL{9e9-jH8A=4V~YFM z*bDu*$`#L^r>z)#KvOS$V7hR~=LZ$TZr>Sw_#xmz*gtbWC@OjO5V)@~s#BtxZ(^^0 zCd?Xa@dTj<4Kr{V*pDj1Pv!i8sO~Xbvzzi_VA-7q?e`*=wh*0b+1T0Tb816KFy8xM zAefvXa97@`LVX) zh@;4dYY71X^E}0(v{-}CkN*&>lgx|N5&hJ>!5ZHGTd^#k2>sLZk+U zRe5Fu;JCLx36m)Q|IEdIaQxHeiQxa0=D2I^HEVfH^+Gk3ueo7@z)GAFmZwtm|C(aK zzqy8g*QNg^M*+ms|BC#<|JQ^4#jXEZ^i#tEbepx00(qvnf8Cq;r}S>M($yLK`R_km z-aG<$h#Rt`e^3G(BKHCOO7Cx2U~iJ>L70DVV$gWV>H%2Ts1?;3U0aq+nPMC6%+7ow zzbHR}H(%gTv~{6Gwt2pZVdMQ5lgIC9ucc?$TN$$5>iJ$^+5}@js>nYrkR4AV5z6t; zd~Zha@+|x)1`AsLu`filkM&tV#_oEs3Iq22Xqw{(x*B+V`0a1RTTrfFuNHU^ zEU~9xugHpE1&G^=B*QnM?SCwYDsyd-&owwhXQQJHLlP?6`@?0?GX7ZrLE}?9LA4^5 z3W>YGvzyfORAg0AA{|Yq8z#T8z2d;BG<#QLM}t$P@w9Fo+c$T)cc=C>kiSp7If9kcmmA)_9o@#V#&b%X{? zX&WM$aWcLG11~ftY!(|6j6Q_wgoFJDBA2Aqli$zg%`!firSPrj+ZWCF(3>p}8nJcg zc>NAY`Y))3Haos#iyW!cIj`cev=7v-`UCYVIlWQBFEb|}+9 z5`~(Nnvt;3;XLxBjR2|cpLL|tdV${hzc*^2m@&4cSIs=O_Ye>-yk)XzoIGw#F=kvM zK6C=oS4k0v8t>3zf5Y&_7lF+<2?6A)llYk9GqlDI1bbUTjb?09@lQaTT$NfTdZe}9l22v3R7urf+_))Fcg9&EoF+;xh0I4pN7ef@Da5N+uL>=D)mxpZLP;|%Y zW8dPSlmFO0{}-iB7U_NWOhrZWo1cEzdvabr?SE7D>OfLl-x_3uCI8uesAh-YViY1LlSE6=vyq~)xbG!MdapXiJE(T zA*lhK(5tr*DMU@KY1bBcbL8UUdp#x!d8C6g#H3EIBA~)ce`>%+G||ongg8K}0`hKU zk%g;eWUq=5_X`ls7J`V)#|)>vM+T@CfUWk*;s(S;(L+yEMI4Jvw*v22!o^HxQKM%>0k6Wec3cu}kzvYg zzdx~Ws-2-t5XkkQtXuahYYHlZ$XrWi#|AB;J`iJlx9jsuo%=DF7SaGogHBkwjd)0%71PLg4czeC+G{JF z=N6vH1PU+*cj17xPrO!EHG*>^tR~B~+)neQiS8e)yMe#kM!;+V1grG1R>Gfcj<-vMP z5>ii>w642NnoKWj?GWr#^5*PCU4~Uw&-f!i66@LM=kxVTpIf_IQAbgnusF|gQ3@9` z6>qYe8F1?=V=ARjIzFxp=BZ;bnq!d;#Al&9k0ns^a)Niv9U&{+TVPCk&A2l9tBQu$ zUxsalFlE!Lh+G|ex*CoFvkirKuRD>OwzVwVE_WloG=mgK9^F+YPZG9EjU~K85I2Lj z9T@z`kerNmD-0gOxZD^CQII2sVjV%V@92vs3uNxPx`yE|0>^-3Ue@P~xa@kYTv_Fv z&3ZaC_qvJg*IeAKVCldqSYx{1g^_?zW4WkzvL|6lPySL4FZk&7i4>i%ozaEFr_CAm)5{TTTIv7O-kF9q zb)|6}a0H72T3jewWPDn*l%iN6q9l&gv09x}nF1w9&=kc6NF^)@Bm~rAU2(K579?t0 zS!`GYi7X~+l#DDU6iKWQLX0Jp7#0H|kmTMuH<@jE`IkMFcZ2}9vM4xq(3gA-n|a6OWNF-3;5Y$5nLdf%8~yx z!sr?;R`O`NlT1xFi#ZIKKL-rP^BN^LQ5!{p*;$!J$j12esoNcckf$D=3J6W$nWk)v zn-}ru=^H>~R1kSNmCnje&XG@`$8I`eK*lUL|8hLg+B|DWXjOb2=J|0YZ%MV%CB-Ug z^0Zp^CPhMWaqj6>t~oE7reTIuosECJ+*gkoSsz`ObegF6;bt^D zC9mpOIpqQ+KPe$p`TaMF0!q%~(&0Jv_+)VPVawacfuaXl5U^W7@YNvVT8zTz|4HP- z6RbVhjc;=@#7p=^iMmlkgC-Y)K?p5P8fUGWi%14St{^x7R+@eixd_WEQ-_aLN@``+ zjFo(K9FdsUQ+HQVv-$%qn}eD^NbK<+XLDBNkxnouydY7>@_l*< z=P2DImr#}@oe^ryz=YSQt0x*xiGx^c$f|E!v?nrZ?yac-bT7LZf@lvw2365CdX~X?ooxC$7}8i9*H*b?s+@*P)bKqDh|>pb zFrjd^nOo{xoPnPgojz~|hY2x0Z=a3UsrO@@UV-&do17a&dCd5N55;{Qx-^;^I) zM%4)h)OW?DO8z_W@gk(Q+HWIGU>K`N;9>s4Qlml0Gd}00-~C&|H+xxD;u&08J&@V( zDD~0{PMFnX=5)4Qj<7f*xepcKdnxx5%n34mXVV))OUPDdD#S>f;fLQ2mjG1+P)nV> zOudOsbc{F6u5yFAc*ZAk#3#m^)l-*+fl8}Qu#Fo_jcv9Q;NAR8MLBYpW@6U}dkMaX z;%1@`J;>8Q&V-3pc_5QXfxTjBBIFSC*cpJGz!V^)89nfLN4`w2EXDAoUhf3rJKx0&r zV7B&vTAaACy31{uX}SYgW2GF{O=ga1gu(h&`G`>?E5=T)fK?+7IOfB3J(H(X@7YWz zo28laEjYNJ_xoRB-7w`b2s(!W6ctchf6OoyP!Qd1Ptk zqcY;Ct&#v6ZQR%a(o^OFw}d?9m0(q?9A&tN&rLR;C9B^9V*@7Zq6Q7W>l#il@-gy= zI>F;j_4|?YqDdwU>{J+3F~9>s+jP=;KjzP)IkM?~x*=tTRce*>G6U&gx*o+CKMr@Q zn82ds-rB0i8T#u54zf`r4?}-(Sx{nl`*zUryKeCLa6o~2@{*cOSjK_m0^llA-UTvD zd&utGWR7}+3~iX;0TZD+LJ0a&zt!`JE6s?!tp7(}k?)TQo%nieQX)=W-z0R%1qraq z---igCM1LJjp8Z|WR9l;KVh;t4bpXw=m?y2t0&F4>?4!ediZnI2I^t6 zX6g7{eKRR>SC%z8wQpP?Y3DzUwNX$p9EOt3tLfg*&J#k7TU?~)gs@Ik($w9Rzc;mR zUSr@tvOFLAj)eC28^!D@R5Vp8^XM~phdVkIH<7OuD0Y~2W0slHk6slrxn(acahdO7 z<2PQ+pO^U;LJtT=Z+tLrWyoY)>|;XPnn*>wJ%|zE`$})$0kMRlOP*#8B@jn`83kY< zUP&GR$}7kB033oB%ZER>piE$6`008NyB4h5s+2iK8q3D6%5kvvmOL2i4SYH+0>9gb z@_^X+!nZXGH%@psfdW^oJRI)Zg+SEOIW>rj%?lu6^}{CQFw6)i$xqU z!ISVVUt8#1r}YgP3qwmI(`>ct6C*&8Mn0)yUF_MCq~;feN$p7&*{YuqEPk29VO+_u zcW(x-Tk%-^2JD~9uuo0H29<&iX%$Ap2%!Io{J6=`jfv)~2fw}Qaepb?km?b`*{t+$ zPWXz;=I*xbn4){klaS`6pxtGD_Jc$zJ7EZNZ(7g^G~}Kcm9-d@mn158(G_g2?<2uE zMT<*$isR7ZDc@=W?-4Esgjj&(b`K2YD}gw_WBkP?H(J{-N38I>~z{*94t+y2%*pkz`V z@}c9{qM&ZC6d$T15zujo`Aa(_u7Sdgjp1K()V5D;pXen5`?778uEFpmTA0>`9mSpx z-e(eTDI?;H`OWc|3s;cA3&a2`?*WOe51E9hOFI_rD;b=>J~|PE;p5l7BXB2$X4Br4 zEKF+m{|L9H?{WGNB}^!BO?wYrC9r2}mgSa4x)ym$BD9=`=W!xZq-=n3;;IL|N9{eh zqL8Vy>-&JN?G(mK-(LT&Svm$H%UOyFM`4IIW_}Hr@~fx2)Dq6;z&W= zVdYuD#j7o+K+V98iD}hTq+%fDYvpz}r89^*p;$xIJacV>YJfaef!yeMzv8V85ht+; zD+;ksW=-(C?1Z;O2O>(?kL(qA#wz3y3%l)p#Sb4GHV#PGUWcD=={Z`{Ps_{VE{QuP zuIbj?Xz`f;u)tvu--Fo71eK&qH!)3fIN%b1*F#5Rpu$fOFE>*)xZqRU`d9#%d(IB& z7a=`(2`U9~bKAW*xnU={TjUv)D_U0F-xw>47;WCZi6!j5OfBK;4knO#L5;+6C!qW} zWE|oyROBOt3OiktcQ+Vo_;09(cxS*0XZ@t7@W=y&A)phmj7>ZQuJN_Cpwu ztm?#X3U;@yZmb7=_@5PuBZ;OiWU-q(^MP%Pwt(HYKfWZ2NP^r+LmRE^`1-|YD$yDk ztD-VSkKpl#ipzeJIDTAQnosL@ph!oZCn2KVddtS!~X(;wL=F0 literal 96912 zcmdqJ2UOEp)Gvx%2LXjqLvBPFCDy`?}Xk^W9_oEfLQ`R;pny|>oQnpr~l=bYX5Z|{9hg0E^RbNsUZ7dAFF z4po)QI&5s)RN2_JyxP7IyaTDtodN%Bw!NTvfsHNy3H$P`E#UVZw^fYX+1NNgvHst% z=djux@a8^`E7v`AU2Hs%x7@7RZr`$pdq~5rJr16fJ|Qh#=gHa^sd%Nny@p?QrUtaJCJeqbNzAh$>M?_+o9EYjK9# z0x4Hxp2o<7l&#PnptlQGwsg*MU~@J;igo&$N-jz8O@RggcuG0a_ZQR0EV+(x&i*ZiR z>WVXxlJMWyE?+^@m;rv{Yv1sBWyx&9R)@Vk`#&|~P~%K{x3r|?pgNoIx2Gb7t*rVl zZ#7!1Y;`DF9h5pS%PkXCTP>D!9Yc>@6XQ>o=%8lQTuRLhy8Og{&F^AutB7&N0d4`` z)$#Qs^l*Wz zAH!aX#1yYNjTtY+kl@Hd->KX5I~6o>E4|1|FQ8-}=IZKb!Shn(D{KQdpSW6Y$|Q(c zc`OWnN=kL6Qv}bdlxxF+N*Mtf2bad(4_&HN0qQUr4~N<(4oUP!YmXy#@abC(_I`V1 z&FMo`G;&9j<4ACf5l!f94{7b$r9&5$Vum8d4CyqApS1FoMx>ro1iwwRJ}v z$1;iQ+$*r-Ww7IeCK!@V^^@L~>-H_t?DGfSiTeYWA4VJpB9mSi8y@WTqkCdZFDk_e zC8Hcye56i~DX27`uEl8Gju?A=Go#{+Mfzy{>NGnTi&&*41yHC>QSB8!oa++IX2O0UnpMinj z`V_qL?X0`DKim9J8j?OUH<{WFo`11CMlp7rOeK#m<9a`i*4=u7?VH1x&d{G)X*UV) z78X%+Q}J-MpP`kfgx4c)Eq0R*aBn!#>TD$MfPZhjDIf^Y9XY)G=|R^Bsf8v`dpG+) zdHn?^hMz<66^*@GR@-;*Xj$D%Pen1F*vubIiX-otW2@Hdg^2POIraYL7|&8G zrs{H>alRUy=CJrD)1GI7f#Zp4oQk|FCWP^wVr)9NL{26JK7o$0Y}emoKIh4~)yted z^jB*(FWeQM(VEejgw7_$>guN76ssWW(1-7U>AR|IuDUF5MWEJi)dKc2=H|cpX|B)7 zg(@0UN)y{@<5(ry|C_oRV?!eo$C9>5E6XAo$v3Eka;(B3Am)F#w>%Np`lz#~50hx6|J%j1AKdy`Y58xM)|%aEjnZ(T&Qhy0K{<2eW++~R<) zlhVLmc1Lq003{rMPI&Oc6pt>nf<1QdfW`Oo0vmo*_YioD%F|Zrryni}I0OsaSG|NK z70u(4kn^H+XD5`lfV2Pf$77}^j4sjN)HRN$7gzDCaPs}U#4p|;kcb8W8~BY9KZ5YflQ(s*WZ_!!?nSTtqJndy`>y~MIYTf?^&nQy4J*UZXV8P!5BDfL{J7Y&@K z6qNRZ(B-1@ja8|%~YyRAn$CkreR zk0>62|E!|P2%yG@$A6+W4UTrn&(0ql<#f8Z*!9SaIPE?t-)k8U=r33$V7Cbs(|oia zX!LOnt6)r#&jZQwiI)x?v?vh%O~vmxLDb&jCBkb5A5kRx;M&2Ee-np8v(edw#CL z7-0pK@kKE|2pAoj96zQvAbrt7sD6mNo%R^t(~$2xbPL{K9Xx zBvJ%@X~#aD^PFi;ftl#E@9;@~rL+}O8Pr2nBc34X`?**WIFXY#U{eE~gi_oqQDb^s z8A{A0`RFIqrLx_WUHr^pujwv_H2r$bK4@tfL10!QYm5{(wp}dGRA;#6;mMIlekW9!s|(nKi(VJ z6vBH0p@FnA&f1I1jq-9SS)$buhn`pAyh`nMBLtjSBsB%)U}?HCrAvHu7pYGJb9LZE z=mH?0(d9iY{mL`b)A0PEkm%Cb<;$goQEeU%x_gn{w!uNOX|HDK>%Ltw*=t3dW=^90p8(Cs3V@6r#@v0k7N3`i8ZX(8Mn7RWVX-L%l zqGnCeGXJX<5|Y8#M^0ABq(~CGil;Lv>WlF+fn3QO+RU7HE|G>$G3s@=lh+H23L!1^ zJNqVM3TcIiBXkZA!}IFe$lWaB>-&bBi1yo7g5Bb+mAgtNC8HZe5gH2~R*zn(iwXTQ|xRpYZxbWeBeZ1 zDo{suH|;H==}4d9b#rh76v6!Eu?b0fC4MiGoWjP=O)AU*$HHe)=HAgJ>vK!}>iyy= z=Yt7#y(KJygrbx7XU8Nlpr`p^x582nqoMInw9n-ckxC%19E|@D!59tCXU!X_vJ_V; zd(>R5&vS|u4VdkwVYt3~{K(DpH$3$EgP+g4S&sc_FN z+RldfcBDYr&NJmzel;gc4J$ArUfQY!Ef_}~ZoV8VaWgmN*Q-&EZ*|~{($}{3?iNLO z_3fY*a>J%Ta;l%FbJLHwAfJ0+*^c5Pe#?;8=U5pg@ZlfnOoWcWsf#zbTyq%Ive?$; zI6#STy7ClO$w;3y-3AE^PemEo!6j(nUllr;7*_UV$``v2`kzPm1`CXdBkxZ@O4pUo zZJj1?!6Jy6+$+U;v=~`8k+{2FQQSLh{tS_2o#ieC zOVw(WDIdjaW<>QIQbGxP&NsvT@;|3;{UsKCSO1`o`vqYxQLe7KYsK96w)#W$Auh(% zpoUAyRpFBPGt<%=5bRA+U7ff^Pe)txNmI1`mmXDOh?y8dlH4RFO4E5f&=oGTEukvp z*cmZe#dP!CP9#C$-!05)1ugIsSUg6#hLI5aXybWZkLBw-n4gkOFiRvULne~b(NU4 zy|r{8_FtK%iGIy#>}oDQs&c5(c@wStFf5~r(?j><#f5CdWbXw-NhnRjO*!r^Vsr3P z40@wqzzYvwK1~B1vsw`U5ei~(s+3Ti04<~b3CGV-U0?(VT1Vjzm)!9MB)fqA6n>QL z^ z<1wKof6I}a0EBLTv+s|jbAJ*cmKonWKhF*a$&nbq3CV9tTmC4J>+NzWV=DU+pWZB; zX$}BrZwo-XEZ|c~-IaH~G5PXV46mh6^iYP&%VUvk#1I5kbLUAjh`pmZGVScF!(~%r zfev+G1o&RO(3oyS%#*M4U-uimGo(0V)scs3NBU& znb3=Wg@;ot)gSpI(5tq>yGP!;R~i``a3=CX-cvNPzPv>&PpH3-)=LQZDhjLD@_1C1 zJK^YPo>+}SJjxFlTPogWoc^Ljs+Fnm-cqeBv#h5jo&NMMP9j&u!ndk_IEmXylJsfc zC;@8;vaS`eQh4{S6MqE2XSKVy#sARrbAmuOYv;1e+LEB3fyp10*m`KVh=%2=B4U!g zv?E=)ezu<9EAj96`aT?K5=}V_n@%}2DEMfP0$>P~PEj4=`kzoM_R95V z4?Fs!F#ZiOgUY?Vke9Q@=E#U~O3=>1|9oMV^{y>wZ0*;$ZWm?t)))2)Ljean}qB%V_H7 zIzGS-;N3`S?ftq}R2venqpqvVxMsTK={#4FmpF93vj~rm$mIjSMGaJK?P@(Ope%E{ zD~~o>N^!QXT%_s7QVR2J7%VYkpy*kkRtYFi`1_i=npZz(qj9QPLx5da^kYY}U-7UW zBh`o4!YLb?Lbhw)3y|FDMqw~5s@!|`2rq3p*&lfe3N5Ng6RAC)=XZJAzH1NRyatup zR-dfe5rsi`<2Y@pmc1(?*G}JxoZ0WSR!Lsq#ussm+1u$=t=_D=Ei9GGg0^J4o!Qq(XlBJv;B2;VMmWk8Rbgf=DcB6N%QZ^B$7Ln-G}H zPl8*qsH#v?_g5M=CWeo!M)T1L(4_r5aW3~EW_G1PTRJPoN%*)jozr(B9`t&(bUlKB zPRxsvCa3wZdUDkfSol&gZ*p=y%-&GLpdDpkX?rMt6IBnP;{JO)D15WBMd0AD`3e2< zhxM{!jzVo4lwv@0sB?%X;dsIa66Mx>oLC2D^b|MDH)qBXCl+mz2>e_Me_#y370+0C z%8S1=ky~J=!3Q6e$B^{;I&Zsw+hqTOMR~}lD4~O=5pAxs2dmG;)IN!UWyJ62nI~;$ zLES?&*U8&UU2T)Fa`kOWvlY1(#hJOt7baae^qaC%A0+MMh@`EEes-yk1|; zU*jiCyB$_$N!#{3k}0tiTq06?i9TGLsOLKq_A$@B!YvjQ;L>KGq7#wJn^`dbc+V2!6c-)9F~uAB41`*}&G5i*KWq5SOGA6!QH zMPebbLBr{q^QoHHe1%3~C9y(hP6O)4HPto~{T=E+!Ul8s={m%yFQcin?3=P)%mcG5*(_ z(xm;rMU7}}tBqDN$n~h9FPSi}h(L|Q@T#E;^)I}=6NPQRN< zX$pfG=Mm<@C9JSfk+>teTQSik+Iu)4Y6!=cYQM?ZQ#v9^I00#w@RdT8)i@`_JDu?u zG#6G-ucG3OVxolZO#Plq%(kwi96Nm=W=IfjQ&IT1JcD}PD0ii>I$ULwL0ZYIj zKaxXA@VlpLo{QWOQAb?&beSCNewwIEqCjqB!pR9nBx{afP$1k&6_gfRIs_{dl_?FU z&?XDo=v$B}h>J-tUO+MtKd0J%o2FoRmC$H!_t=pl0Pl{wA?2-H*GI-dTyf zpAKg$vvnVAHjrmyN;0QvS3)d|)IeJzt%`FNR1Z^d0B5=Br&^Llp^WC9NYaz)X60?Y zu0&)H=_?M}T7CfO8;t6i5LCh6-A|Cg?kTMDvkm`4t?FTPqXn~fuEiQc@`P)e%wmW=k>FQ_m@nure%A_kTV08F&s-iX*KrAqx2Nj5*;xbV&dt<} zE@+JX_3$LHCG@OECEEMaNTw*-=Wyaxvp2?R>v>vCaoGbKq+aLW$QiG9)S0M|Vi;;i zDJ(DnQ4wfdOy9ur5wPo~R~}f#C7T-83Imd(|FFa#oaUBRq2!@7CsIz^itzx&^&z&H z8+I0Xv+lNPZ1=D@tQ`A!qV2h{0wER++vt*wFtQT|^!N*B^cPjVhrMQl;=7JotT%xj9FJMqS4DSTCn^%Rn=WwvJ`XDEI zlXHElLevlBV476v+oDG7uvrN@XhtcNfzl=UEK)rynn5Q_V5~a%ohV++=gms*u+h?& zU0las>;zD;I;A%BOmtb&u^StpS5OT^dy?$0NH0|@VA*kAB2~PsxT-kwy9Jh1ie1sI zOQqh%kZNUilX921A{T8A^Qb-c2Xrf|yWQ+x_bSUasv6~+o0SL`H5;)u(3?yRbsuz2 zt_p)?go?XdgcFr|!Xd!AOhEVTII9qI=A2P5PA@;o_k7))dhWs20ZYwiXost1Z)apcwn#a`@kW5;@UJOMKq;EexOQ!Jpk(i-9rMCh?C zTtdI_?!C(myBZA(hD{v@QPTPl#*_|GZx~!%O6*=F&)e(F#9=mjZ` znb`PhjPoJl8AY&sj8MfH^9OTu?8do&;_b#lp#V)mKWcw;sLS8k(!&RqI!A^1Ar50_ ziK=R5yH9Iaj3LD4gDwpyh}9gPmt5G;S+RL)VATsRlRtkyks)M+9O34}^FKdaAdWb~ zoXTFNcam(opJiK9fni*iG0|DYxD5)*mquf29?3|-hypc!Vf(!a)Ix?W9Z&3;7AugU z>B8xha#>~mA1;%9x{>*I$$5<0L+WuArNxIck5T-SODn18p#=tr&8+74=K~`}@d3M0 z5KX0drKhjIgOkQFnL4ad-FFN|4@E5=r0dZ7(o5r`RLX1z*+I`gD%Bf9s!X>sw+d1x z_D8*VGt`3cf-l`ljXmHWpMu?A*;~m2iS)qI`czQbrNha~mwj3s+$vlhwO_jigbyc~ z`NzmH1}6n~saOp+zmewj*;}Z|1Xbfu~J}OAs@&cE-n)b&9$6iD}N~ z1sBk-7q4}CS=MVQkBEaHec=i=>BXnCN>*7E`jcnJx*vMzawE#T^Lu zyhG)d#ewfGJwBxC&EfXFoQh_ZQ!$hf%I#nP4o`M!&|UZo@&^H*X7Bftn@h=pDPAnF zy(a$g*mY8c!Lc<*9cIvV|6&JiyC9TeUTLIjmhVTDu01i{UPS6^*hsahLfDd1EU*=7 z;aQsgrbNo3?b;a?va!p7B!=M;*S_npt9vH|ALCC_RYHDr7Suq*uPq29FaSK2VpPdZ4xEK(kIbeNMhX3CnU28q@=r2= zX9VYN)+o4+OYsN#6r&2;Y8UO2o9Tbf3W2 zK1meN^}p>1n8KnEcSFy;xgXf2*O1W0_0vOt) zaHJ@bE{Sx*SE6{+>V_C$BA@}tH2&akJyxKmv*K9WaLWv9^^Z(LH0r`f%1Tpp!T0j_%(;FBfz_AT9{i_HU~ncOwrA;Km5=dO8R6dn-uDq2=&|hL zR{o>I$gPh?^)4u|@i0&-sxkllu$1=-qYLznqOSEZ5+d4uFZR|CHoU85bp^Nosdv-^ z#@UCq|B%!7x#Qn@jQ<}s&i+sACvI&3XFZ0%fXC$&pT&>n+P|GUvASbY<^#iD$V~8_ z!!VEX8T{7=!kWQA+9&yKHELcZijvmxwutVn9eL|7O8;AzlR#`N^HIR_pYaCsb$$uo zu3jc(5j30s2Olhfo^N%c3wjOSZ-JaEvF=vx0>>?Piv37s|8iW0G-BgutBB{H&)88> z)tDRl_Br!cKDGbijze?);m$;sPo1b71^q$nxn-rIYxjQy+V2+qcjj7sdoW3qUpmS_ zvu)KojUe-7NzBPF6C9x-B{W}(tq<+Ric?|c5Sj42WD7U5l2d)Se@2bSVU5J$V|$ip#Pc^po6F3 zwO=`6mInfj5hc~<((}9L&B}ZT0@7SmQEsNB>gPA2wEC&ZFAx7~jsPDVAU7Gf)TT*R z91HYQW00$hmtsPlQZe4PEq?W&noLzYbO}&b;TiVjzgqHWS66j?oN!>qa`Dc2$zbLe zmQkg;K{m(rtm74{BVcZ!@|WoQx4DY531Zk(iy4Sl>csKfV@frzBY=UpPvpWYm11JL zs$&S{{Xf#yKOWcGL4p?!m>t8SrWTrDD7X_<3g3gFYuT}oV&V(ikcW5Okn3`gd}P{v!=3&^}J+?<$6xve_)MwBJ%U;hVw zP!GnxR?PV7C4GB&+VFdBfZ-3XPjD;H`BYBG0*6!7V_j8>F5di`5~t9Ai8wHdvINeq zxeb!hAI+Q`gJMJpl|CXv;;>E-B>lRUV&PVYf6j3K;7?*S4!(MJT_!UJ59{w0jso)m z=5rh7*BMHfD`|I@_OMy!B&qK1f5)VZs$&`f;7}gj2uiaq1Wq-19(MT<7YRG8Hgt>T za@M^jGH6ex8(rWdM2G*%e}#-lQM?P{#U(KR^aqn4$v5Vcn$|AAd~8A}|N38I5mlW} z0<*r@SJir;&MT}yh3$m?myv;R4+T@dBdTFkpJ(P#r>ZMDgHN%DF63}#S=qXTH>0G80%|VdAv(z_AGM5!bjzO4H%#b z;UjQxW{oWbgJQc_`;M_Vz~3EUi7`Fxn@&i!`XhjoCJ}2hkiOX;$Nh!;d`&rh&>igi zk07wA4Lye4ilz%=6Wiju$rbPC$w7|vToa>1noSi+D0Rj_fOj9i*8V;CN92{MdX$iv zQTclWwc54xjr)a8`D z-l@n7;OH#4I>4OC!D8cw(wHx^8{(V7A8W@3p}`qPb(AF-~=VqH;yW(S@Xd#U6gG z#ONn*iiv%nv7>}>NA(DNa-NohtrKo*CXZs5Fh=5pgLhm<4~(3P;4qPQ$M;xA$8#vI z$lxH@jd)=%?DqEi0PLAoXhY0!gDmz=ACApY<-9t4T%XfmI6@yBN)Nn#I%c@RL&o)x zY)~~w zh36L2>$c9-*@$gWLx$k{oe3YEF2m2cW!cL-2-k_(T-^ZTPl&DJhg zXvgO|qqHL*Ugo+yoTkUAIn1WdsXNz~QFk}n3>N2~Y{C75!%4+lpGwu2psFiqZ&6s- z(7M!5Bq@AzvQ@-+AeqrQL#c1a&45{Mni1;5yjdd8NF@Q@gvSME;Z*-bv-gf`A1}94 z1;6p0ob|vKxYl?1RiqTx}O4Yz9ctj4N zu1k~E+{$(8ts~W(F+A}U(m|*z+F5XE3c35$hJ}yI62Q+^ z=dfV=(~*_eP9N@s=qgmlUNSg+JGQcWXdjw+oHsh~yPvI%ma@zcoJhMMxYDe-+EjIc zffA3ZFvLo1!)*grh4l^!BrA=6fk8d{mU@Se(Iwl{oT$BlW-IXyi{L*l@iO-PWpK3n znZ#A~cIxbFm3b1nINCe1T4}9*cnwKQ1lo}z)G2bsbnL`u!21Xl#$`qu_c@N=f*06N zI`dgs#%rEikijKUHd`5fr5{j{Wqi6<3P%oi2!Orb*FLvjwDw7Z3Pf+}hF9E_zs$Nh zQVqonuFMnn0Ll$ml#ixCOXH^CH|YLxwC0I5J#Bx}qi~rJp9i$? zl7ZJMkgWR{;S^n94YWY2n55y4ZU~jbKeK+RRj$#Yj+|@IV@0|Sx^B4!f1=RpOeRo4 zTNsOjXSMyW55$P)pH82<~#Q<6R*ghPB?q~=% z^w*kQ>Rq~Uh@&pRzuN=Lo9jEGa3zrk)r!iTY577!((Xr7e0XfseeZ3l^( zE=h+v8s;TsqmobA+W^89&5W22qiw`ab1(WT=N<3WE?W5ePiYl)p7d|sGXsGyH5;)MM`M5Ovqu^`? zjJzC3PJtVGD5)XZWy0X8_E9jaXq%BXIu5dcHI!$mDl$w3Elw(E4}9)nEXyx+=k+P` z3=)STM_(pKlcI^;ICFfi$rQ-#bq`&aR6vQBG=Ht)zwcBeA9^gD2?;13;gARemkSPm zyg=_69_E6NmorIoFkqe6K$OVXCU4W1glwHeVn2oU;?K#+u($V|U0h*`uB|R(fMkv* zJFBh6S7>g0q*Rd4^iTDHZEkrO^+|?exprIZvfeDsON`vYWv>S; zEj}|3sB2RPK4U0=;?*Xy@Nta9^ie$f>e>RNqC9jKq+JCkZyYst=IhJ3R_t5w@_U$%CsQ+qIEp;QaHhog}#L7{W3w zNsM(Vw5W}`@w^viFrBdF&do8z;3YKwCel%GwS(<-7@U{wQ-=TqJhmCUErcQM8?#YG zv$LIdX04M#^8$|@+=n53Yo%77hpK};*c@Jhb*4OO)WKsP!P`M_=+-C6*W;R^z+!iL zwQzpAT<&PZeA7DB!Hvik6S*fF*hJ(5yw$mU#t|BSXu(NB7g0wSo@RGiCd zMPbZS8a%Eo!Q@SxPtk^ZUMv4xR*D;5L>nWal0lhfJ>hPwW{;F+}IC^%YZ zg4Y7~FrKwQ;gT~D(s7GF?Xum)l}0gqGCJC0(hz!b^92lPenJm3qC2BJ#}V(Hpj@H$ z;Z!~;*QWKi6;MupTR|I3vaI3Fu#w@j5#Y-pP>))F-np-Karx78eyS51^;&|ySsg{@vn&N#>T~xA}2S<&6UDe=zB-A43^${>lk3vwRum-6~>H* z3k2dc0#sxejh|+TQC1G(x}o#U#JwfW1f6~kRoix~U6DePR#I|O=(F4?Zz-Sd`T&WJ z>7tW)dh65Pb56bgre@f+|F5M288=?Kl_Zt7C8XD@kc>lbf@ zm!7>Jh>vxZi;rcMwinuJz_ig$n$nI<$+mSmYTdqRAsX9I3ABh`)W;irn{ij6-ne8L z%mBZI(u|@>#p5P(6Pw;=EsnUH76X%At$pW7xz*0=0q-mpx*mR%zK6tDNyDhV#X4m- zGc}bv%Zy6R6};@RQCFN!r)rDoMvc5~ z*z{L?5t2IFuFu@XkT#fSz+MF;m>r+Vt#^53l*;%8Yv+2V4CXwV+-RI%u%+qksxP&e zIjF31t$bSOT4;4A7axhYag zvhmZHWk;=Sh?uR{92oUNWcdz7OSsoAc-~IWgPv&RkK)6-IKechHQYw~$f8J+XII%+ zvYs{j3xe1!#+=adjd`a#I!Su4e1I8h+CYU$V|YMWPJd$a?i@e z1BcDmKIWNYyas8s4NNPxzos%bvm;5v!QHt@HRlgEQ4ue3@a|r-XXc3vsV|kD*j4@k z(y@;kjxMzavsTz1Me)8M?snU|S?|OcU8gW7SId8bnsmk&9GnSaV^h-9wkk)BWUYt% zg$84vR@9p!%dNK>L1g$!WaLO_=j9t6D!b-^^`5gsa6T}74vil0UgS;ZEQop5ABeyP z`6dX|ZI^)>2ga3|$<^{7dM16!T|aLOTM}LlscOu!yKsI_C)PBtQ{Nc2)TiLC|Bw~V z+6FIgW!p%Ac}>kWOmZ&-uICN*v~swRVaDt3hMg^D&_tPJ%Z%AC25pju9`KP()9-nY zn0`z&ZK-!mF%R9lZ_0Wk=X^YKw}(xXH;&qgkM(%AfgEw)&opFlTVD0CXGxiB>?aD3 z+}L&XLM$AL?qsFcJ14H7!6w2;?D#I~+!>DXd5ckUL8+y9CDt=5^sOaE-_kZkmgXWT zbwCyy@XSYy@lEx0G5n!iH>MtXCZTFYIrm-1^`lw}>pbCr^(gYesGG~)+)aarS9*HiJ2yKi5`&6&EEO3z4)w5Y}=O#A*L;I9t z?wpudK2!8b>d{@DUTXUU3m-i_0KBbwH%MrWr29)N4(HNZ(f*9xIV_-cCm7rxym_FF zsw9EKOQ%Y5TGGGXUEl$KVbj7?HdlhQqK_x_P#R>eNLjeXBw3G&rdA`Dz23#pl-9GGWg1mm1vjS zy8(cbYceNCK|1o*zIHF0O0sQ!DIp_ahJ~{diBpcBHlmC>*ZxtpDCp|Fr~CIewD>ep zt}=*k_7sM`^CFQeGi=tdKrgv~7>3hATwloPTZ=SOy8azz;mCrOLk?l%PSO%s4TP2bdt+*KCZu2FG3+h6j5IR>U`J-s{r z&x&iME=Jlmd2tDyn}*KF4CSSw)P?-p%O}GV_yuJDl{!;JTeG#EQ07!WeR=xr&V_cv z6tp4Z93w2XRK)h>%PkrICIvTa03nO)=G%m6JxbJ1!j z@cjXTNB>o3DP;_sHJ@4LDn$tQhWIq{Q~Phl+TZX#bwu6Vn;d#=qDHZT zqB&L_`s=@I8oD;`vW5=@H-3Qipyo?;r53*c?~fwLjGemcx3aAwu8C3Q*bTri+wnAA zm%cBR#GGV5+3f)J`y84f$r`T1WZ<&xfn?y~vfC}g;pn6X>2Z96{gsN}W>Qft^?D$p#lV&n$4 zomTX(A3Gp<;M(YV`IuYhvaXR&#h4=@v#B#E$5czXDbua zg&iZ%-TNn{vO8qiWlUt{3QuASaPXAb9JFzvJG*XjqKgIrOI15hR}UEytv*UVv_q;{`zBUSp%9#TZF+Cdi@$-^ zv_PR;{Z;w zxPT?m^y~C7_MLr9Un}$ZmE8fSlt=q`)VDa~a zJs|z8(kvC{7V$pbL;Q-y*Bz?%_}(+%)zrC7g7@8%!+BmxZ9CK5;`7<{hTX_~;gxi& zyfY#4`V@-VXgG&8bGN){&QS{=xIL!BZQiVbm~d-!zcKS+>HJ*QN37}6ejE+;1P+B+`(=a~4Lbbv$v#T(2eXsk(IYu>*z7;fAN_j^CRy3{4+2e^7{_ z;u1aJ{Xj8BSFwDyabXTja}L*+4jZGkaW&3vvD(bnl=RM`+HZB#P=2X-4UEzfkOcDm zJt8wucS(8LjCO)_US_F#E>UAYxh&v`i(2D3D94mk8~I|#mzT{NM?A4bdr3xdecP8D zuX}xb%SqQFn=YjAWw<0WxhFiZ$qVsvSzEFbb+7Z9jT4>Sn(jRAX3qrY>u3BYvNG%Y z>@^w7kRn8*$>SVwqDfc(iH75d&fEN%)YZ%Jc>>a&!QaP983mNgI;ajIKc%-SezQBnw? zAE9564e)Mge63-ImTHIP*5B4_pPDzTgnzHgv-7yo$;xN_ zA`=L9L%BjuG5S*`BO8aVhOYG&Fh!tO<>l!~e0%ndFEcp>&#qo<=|gkuKiwubQ_pjA zl~w(KyN;vzJPpH{V=q%G%FgiBBsoOXE-ON3HUf|X0AM5qHC)oY4tcG3rY=1R%v>r zvw80baz6g)PmM2k9l2ikAcOC@Z0e`2UHXn~pWSJ=gWZk3Hj=oG+@zsgZ1aJ~Hcw^G z&SdeFZW5^TwYnb#M|*LS&wNY0_#}nhQ@y6~8!aK5{KRC=7bF;Iy7cGQqia+!q{*6y zTwtysH@!?*yM>`kX!(1+pNY4%KH!pd*9{=K1YXcL1-;&(ak=%T5ilvwzJ_#c8{p~! z#;BZW-r^x;x-e4#LsCD*w#=$6IUPwUskZ~>CQF;48xvoLH7&7z5uQPNn&B%}T+kYu zCiUXTb17Sv@5y9_YhXV&pStqE{>hCH=@fUfQlpsL-P92h;iK#`IC|7)=p)9|^-a;> z%2$1jK8tIbl;x(`6)#{^3FSh7_7fe{<>%bMjM4 z7lbfxb1FS2(p(u~t55uZnK+8M-E7m?EFf4G^m$!pO#RV{Jr5VI)*HU`(qHjB?0qe$ zv`>1M;9p?wdN)T0YkH+J#74#EL*6_UF*Bjpu}RSUMq`de2m3{LiMqXs$q(DGna(VyY=aI}2l1$v;rlG>a-$vpS#TZhp^b6dtI-eL3C z#$LGFD9>VM{P+gtd;ip{97kXuKjc-ug+ka|$i{efEaC;<$@zh#2=~kpWB}?NH$K@(%o5RXS+%=yk)G1uBVvD!bDu| z@x`bGLZu$-9rs&+R25dj))tzJm#%K&j0y=^och zuW5{}7_m20MJJtXwx3Q!PTo1x$xF&HLFI-eOO|8@nx#+vnkHjI*WB^2kJ_95YelDb zFDc%=@vT)mY4okJ&oy^+za}~R-V?cn>Em<kVHe9+ki9C^zLKD_%5kfe8QVl|xpIx!heBjqyon`znI z{RqY;C%`w^{Ix-ZG3uH`bdo;?x`U$?CZ*1ToA$B&>uR@Hm`oh(_EV|%qoWDNB>p&d36@(V~wGrL4j^?hj#{(5IavN=8m(ov&zlrC`gcpw{_ zNQQ(A=!PC&pFwq%OTf(PKvQD9LV<3@7`drz1`{&K|Ha;WKsA|m-=k4RamG3-BBC-j zP>>>sNVg$MRcQj!1QKeZ1QO|X6vP732`EyeBQ1mwq995~x)2fs2|YyV5JK+r26SeW znS0mw|L*U9@4EM0YeuEyZBIF8pS|}nD|+6U1l5F&gCYW`$Agf+8bbaDR;&&Be^!0& zA0UVS$#MAKE;$w&`wWQ)Rk+)qbV1IvP^mmQJ}}tf7%%sMsRLlT{qo{ZWQBX1+4k}v zAW0K~!2;EP0xiJIaxy7U{{?3G0AOW57fYiW6OK50!(jaZKd+QZ^CkXHp?7HP7h~>~ex84Z@@yJ${#as_&+0>6Y&B9V%`J0 ze*Oie>##?JkvxW}KW0)NuMx9amM{t^6K+yJsIKAb9yI^*7|*3~++Lr5+)z}A(DJg;t?FkQ7n24&eN_h_Hk2SOe56(L@t+Vrtlgz5JZ z-aBz+bf_&;`cTM&PG`Yj(=~N7)Dfp7cUPv$CC0|y;kflOy1pj&lkZQo!uPxmK6n$E0=>eP3YgmziBECQf3C^B0Klz?PWD{c!maXh?c=*=%%w z8EA@PTqHpcM@A|Mr5#=@i8yZN?wwm@5n9_QsEV?bw#s&8<|Va~LNhO@&lAsMV{rB| z%nS8I#9d;@R~QqGp&P)j9trMvn=e;r@GpGHO~^Kx<3qWSD5l+u+1Du&YAm7aut?<3+&Yf3;sYoy{eUxrCHp}ZMO#q0FWJ8=wtPpU z(6xS~k+WniR^rfzp?`#Yyz)d-$DnJ{Q>7z0Qp!x~xr>{{3ui@b-z!xst$u&NXUc0& zKZf_Bhx*9-Q=oLU=W$q&L~W24x@=hJQ_O$-g-Z{{GUU}(;pd$Wd17qZms5_4&Ohl z1_|?gR`6#u9(-RXQ)CqW(Sn)!CA8UiY`!(3H-oT$TTIA~F{!bGJCi<9s}8+pU7FdG zQ9N!=TOSpXXB#?%iNFvU}l_BDNz$XUmy zxSXleAI*n5qGV+Vjvybh@~|bEu9}t2B_A|H%gri&kjC5YAG{E77eOai7mghict4&s zx@= zht%2qB0{w~y>=F>RPMZYY-M7z`5gfdtyeGg+* zSzA|W>dJNxefZgHd#_uYAI)r?OK0Cqb996e`(Eln67&7uAbz{|15-%YJ%Ob{ZkGZN_O@ro zmz-{{#F`MAz!6R_&p4p^HqYNg@Lo7mjRwN|p{CpBxnkf` z53gG4fdTZTtHsEWk-17!gEr3ZE1oanjsTvLOI^sD&ys27aQE)Kq290O8>zp5&$E00 zLh$rX3oLeh^&%Tg524DXR!r9BDgLz}ZV3W(0N|TBcFH_@6geUcE(vCB11f_9VXe9( z??!G&A5;E85_U`q;Da&pyIWNPYng4nxN)RDIp`GwoQM^_*m)Oj3dX!M;p_TYE$G3RK5 z4$uWc$Mr)1@FR$(X8`jr?iXNN_qY=4Q-1uB=f_RWzV~R5It}*Vtd?RdpbG#9al*u` zMsB{87i1KNp7yVSsCm{{Oe#s32=p5F#2_pcb z{siz7;A{ZCE3ue5OGFQf(wF!%Qo%tcID`D;!Vb%IK<^^y~QfX4IuG?!@< zZnI>%KFoIJb%5wLu;2$vtr*7R#46Dv5FO1l3mYf%KYKEx& zznvk0VnA36ksmFCmfW9HvBXNpfB67;JAA6szult;HKPy=M`+Nm2i10^B_Bj7G$6H( zE#wg_0*j;<6`8#_-zlLwwwl0qS5t`#4L6+YCEkXKL z@pl0g|L#3?JDOJ%0cNNVz##w{yTF(PxsptuTx}7zy!JvwL>hchxX&`!35Boi6Tzt5 zYMuw=g?iHWg1@@&)!KuL6+75zdr&NkEp{mz0>v_@!WUt?FpFWY_iKaVeQOBn-+86SV6H@E_hH4%@|?E00SnS> zLZ%WkFk0~2+5%hlfic+w)wj;L(@g9+wL*0s!Pma8MH^sLq;4hA?CV+92!HWhnq0`= zfAcK^L$8a3s-;h7@xH7&nm&l@7cb2frZ#7gp=Nbwf^`|t0?Q$psZ z`@-BTWtbIzE=3DZbphQ9%|v}C6qSG#;J~5vQuF;7&u$EnTM+HjN$-E`N#rF@Avpco z-N5CZ3h{W=$(;ELIggPY;A&D7@m`w6T0)AiyZ}tI2GkeA0S}fv3XOuTudo@^Cp$82 zzGYF+HP?8IG*v3~7Ph5!*7+vf{Uj{pNAJY0T8<(O(Lk!t4-^?v*3#lOf1tcQL;`;@=_b}0(X45zy)UehfaEN;pE1GHgWzY1c{ zA0k`b4kZ3eMbE~6I@17!F;5+4?c--?K530^K>6R?tnB$NU7fITTRPm=RF z0&S=ksGc2Mu!dBw6pdVUWS+IFB7gt%Cg_^uujKd={)j z87M-BgE0a>vX0(gz~$B!5PbBjFBkdrSgtXDB$q;18^F1elg$f_Tyiz?%WA zA=w2+4E0d1vZA%9ndEzT=$4wJ&38sHt$qAK1~^BM<4V>3unR=IMH(pq`i8l<;?tth z-um3s0XSg}EJQB)O^>6!UgQCAux0&BVcAI2B}eL-rmAa=H^y#_Ai$pV3<6jnaM)$m z@*59zQ#*r3QN9Ld^tGDdU1Lq_!>T)OHP%4D(#jAE0rAuO8pYuEG-DvH@Z%pZQtb@4D(qiJW-!VKBc$uWhx&pwA2=Ukz+LxA!@#`%+hD3Y zg(cR1sL7T$b7*Wyx^Eb|^1#U&vu#0V0fY}PBsri&OkYuC(ZOAfXw634;N-{Z6q4la zdUH3Q(x`*@vA!9`L`Z_onYx^y1TE?snDwonM#9#g(63M_tjtk!I)7pWWmK4KmQINl z4r@$A??<`hoK!%gN4_}nPSRHF_SG`ZAl?535HL3c12F)-Y6ui0{}LxQO0rtPdV9JD z=ZMYCB{a1kT8LR7I==kQ_K!uVMZhfdVsvBS5p=SXVHaO9b)AdXxE82lEX$;Jo&&USPemdKnjlx9?v<-^ zdw0+b$qUUJaJ>FKjtjs|%0?qw$shAkc*kDD%?LwiB0`6@Iv0^+ROQAgD?4R8xr8^R zeN2QVHFQLR;t)XSC>9k(|Ph;?8)*<}3=yupgrsc!k;V7Gm@_6@kJSf`G0qOh2eiaCV_5 zF7AmZ7w#lIg_I(TJn|kMU6PCD@pGLn(MJT)8VvOZFga+`ewFc&jK@a^vrl)3EBY#) zfCEGoI;0jK>TxF#{?gjLa&rAo<25G}dCkBemruH_9Mkb?7h2@D0~NWOq|rKXZ;W3w zDBxaAAzd;T9dcE=q*|2!%L2v;L@a-YIOSG`nJ9v=`V~|M5CX6!?DfYs01$$>8!A*o zQ#;dML>eabYpr-^&|-PuT6d2h#47CLSCM`62q2>{%i;268D8$npzt~}a$^zGb)ThI z*Sv$lUVP=o)qtQJaeOO!0c_^ZI9}NG;(x^BxDhptKIBez<+TP>N>Ek+ByZSHw7~y& zWAy)eOU=1(MD2HO)RI`>S$u$oVQ8@j*l8jF487GmFOk0E#aiCWOJevBUQ(zrIC)m{ zXGBu(YRqAPKNsc~Zt0twGW08WGKB#Z-Y580P}37${=;VV?J4v1G(82)p}a>PB$|$H z@%bhA4w657)lVDjf);8#414nKa7fYU?;lITfrn4t=iZjctXn5EA4{rh~ zYUWA`!_eb=9FzCF)J=1}Xk*gE%pKRmoG|iCYFNK<>9}?kO}3zCk4_$7pH*yhTQ|T0 zk}$1b7I#GG7QYM3=r&m5SypJM>uRut1SLl}3EKVE7N4d0?$E?#rd{H6ls4;>c9QdW zY-HrXLm5(#PI^OgW7pZMZ35zY>$cQN?Z`p5Ik^aS^sKLlWoz1{7R5>E1;H~))0-IU zM&n$gZ?2EC`DIMMF3R4hl<8H&`ut#c%Lr9g>-|-WNKU?Hp$yg>J|$bJA^aIU&L=;_ z5L{&%IcxVKpI==YyJ;7Z8rRZLpRD1T;Zq|~-V{&~F4G%SH<7PG8Pi7y<5&%a6A5WC zzHBG#0Q^`<#B;M$4EEXEjE{wc#O8EgAe}aG*$fGdjTl3y^cI+v&onRc(wdxxo)_`Z8l@sFxF`s{|TV=v2X7InpyO zKKG5Wcj3o0D7t5vRTV`d1{UZ2Ebe0HMV^dMd-<_<%*unQ;8m;KwD+Ng=<+`g`!K1M z5Ri|;xyxn8p2)v0F@LW{Ypx5P4s=W(sZ`~oAaMd!DK4XF{1kkl0Q`UkDq0#KnNkIi z3#88TRmlB9MJ8>kCb1pkzPOwRzC`}yn_DvblY`D~mv44>b339$-(JkY;so8u=2|eZ zTCbu;=y1i!9n$>)DYM5n2R@#vNL=4Il~Qm@!rcwGuibvNYGw&Ow_AOIOTJ+XRU#-V zUFquR$@}hJc3ng>=T4g-o0Mpa*ye$Gc#vSxq%c7}T_!aMI%juA7S$x0DY4)9#z|MA z`Pju7zT}`*TR2^qATZ)Jl8H3!2%RGTUaj6qV4oP3!jb3SWRRy^G<+@RQm?M= z{4G-w^OWSdup_D8L1N?VQ&SCw!?DE6o=4KR$&!rjMha|6(D-UJr(gR8$P@4=cg-hj zGAZfv{ufq^>6hW)j~pa5o_cLaak@H8E@(@TSGD=M!^CiPIu=W;g}3zo?oi2j9p3sB&}g~l3RB3sS(MYjGLdE`o#L<9L+ z&Y82|4xY*tecIMwg(ZeqobOtbK1a(}pWvqtDUJ=V!rVL9gd?oc?aUbW9y8bJB0e!2 z>wZ*VDcp;z!!3S#KLFltj~W^^rXlfq6+0AZW16HEps9ctn7*zk=juhWB^ldo4<~IK zslM`##WowjE$d|@M3$9VG$UK}gWvbgdGgyB5-soY5veJe>Y0#`Jz7x7cTXr1v=-n8_*_CA%v-62heA>MAq)bZsgwc^*ul& z3t@eUR@4kT`@kseL|d7O1RDpqRmvEGJU`TQuR^cFZZ*}9dWf~z*In24E~NntP<5oe zhcLrtf>Sz-NhN`0jYgkMaV0jJ>vyh?YZnPAmVqC}rbo9%=^3z?r~B&W6)%nc9wle7 z$I)(H3NM;!cJx>7`CtDIgjj|X;HeaWdP-(ynnU2rv;JyRSa)Ma&#VT%J<7boS+vp7 z1lNKBxm7-*I;b1Wj-oC`s2RiNK!w{gh4ynq>Zw>GeJO)S8q|!Jqj9r78=6&;YbWw) zQH>1_1z9PRaHL^_-ncx*HDj%AuO+QIK1d>J@vZFtz&LI90i3@a$?s>A5iCyFwFsoV z1A6;45_uR9?^rt`$mXf3Gjes}s_q`n`|AaOu>q?OY|h4bpDB-n+!EQ)molq7={l8#EZ#X=eBe(v`xrq?g)RZO`LVXa5!c zWMT}?{@WP{Fi$KJg5+-2ET~y0LEA{9*d9u-z`l4 zPlD<z!__D|eE;HL2Suc%kra08ydFD$Xou(jqS?Bp1b$WN?(wJ@drE{ftZ_tZ+oYjHsB z5wji0L1giTN84NStf)v&H&Jhf-k8^;MiNE4T?5Ek{W5rLPE~0+xHpXf2d>loH^! zkb%ie@8U!&Iv#QIGO0`i~zF6yt)sYvFR(8=_(Cl&CAsmZeJcUfbe6%9#2p3{-4 zQ_Kt6lJZgcfk8BTMK`pI<0mL7VI2vot#s`>681EP-6A3o^g!u_DJCJFOxNPo7{1wJ6dF|TQmJ8tAW$dKrkR#CT0@z- zIj&QYbem{eLLbSm1lWItg-5iwuSZm`C>e5g&+oo)y-V;VrMY0K z;q};gR5!+(^OfJQ=jFY}iFA~&)wU8RJhAw)KQ(4sy=(Ho+D(@fl$b)SsW0kcLm1L& z14qNNC`sdUhK0Yiw2kL0YfiN$eRAo27>6yjeOJ+vNDVa4z3My_b|6 zXDvMWuF$8*pOiPVLwEO~XzPF7rCn|^C7 z2v^XSX$QLXHlSPgt`XnVN=Yx98L=CTDAFE;xg9& zHN~v`q&*^XrMSumd#;|YO8;ZEM+FGh%O;&n&N@aH6Layh8t*F>)b3%1Y_{Y8hK)8rtheh^^6_`%|Mt+>z z$l+EVH=;61Kc97^JvB!R$8SFUkWN<1|6*3{ZD!EP@sW%lgZE0V*m^^hibQhN(=cm5 zC_nbc3M#ViL_P9_!?ud}EyDwA8%?)VW5rI$bVd7~ylZ3m2`PuOVpcjyVvx^GLBsF> zvvBja+TzEQI_5=zmkbj^K@&^$TFt%Buq%`&*{gw z+{vUQ=oooK2++LzPwU}?+ezyRjlhEJi>HWpvWneaOW6?3Ot|^(Rq#e&56;|~=ij;$ zzj$J)Um=|P#rZ2c4omI+n;!l8c`1B*IdL_w)J70GJmWqRsq@fJ?|Dpf3KNv(#z9gF zV9mJRB}2ac@Y`2F2a~^qNY+_i-Yg)KK>;o#7$UE)kBsb$zQ&jZB5p2|!ee(1M7sqD zFtdpw_l;Ds)7Oe#&m>DC;uk8RfPw)$d_LZ%gJ2H60f>mkPxTIj5&Sm6ei;RsNA~BC zOAd_iZ@BN@oP7GH4sh13{GX3?{`Xoz{U;Ikg2~W-P4e*Hr<(s$L<&_3vW*v(RNx%o z3Kk%*2uPmww<-a^t%2ql)EizBejsqp_kL_)8k9c!|&s8;%0rJ%uAWaBT zjd~6kAsc5_D*d^_VaqoOz>cj2{GPL17>;@$ZfeHX6r86mkg8!@`CW;dL@9$lkn(z0 zuRTmX`CElnJxgt8R~)yh^cpyTiRd6xSs={qFyHW}0$Hs0m5GHhF2?wAS7dTTLR$zU zPB7~y0kZThkHhI7zE#8600P_REIea0>(=DTor-wP$k^5ly8? z+Tj(IQ8AU53N`VLpsEj@Sn5bW=7m~n0DO#SmTo~kk$>!hN@cjaoP(4C9R*rmH!?C@ zLmPn9m3~4`T{96lc3k?SL+>~b(%8r4rm-V&Lit8XiowK2 zjL`s4{9Z~$sl}W@T};afN^Zy#_Ym_iR5W|*0MFAKU5<C2&K! z#Jl5f+=$+*TgF?~dY>M;R5--<-hM~4YZy+|RP9dU`^{-NIM#B_=*WVEkko1fSMQ6O zd`iagY5IvwZ9d{V$&WJ=@~tN|Vo(?A(=Ax}Jqxkw=C|@g)`+3B{I`;so_+R4iShS% zxep##!JWQi$p5*NiODN|y6b)QiujonYT=veN<)7gd=%OMWgZq;Rc&Z=EYrjcHMCoS z;ZV0C2X2XPbIR12;UB|@9Ol{BHgR=}Gk^UE==PJ4W|T~3xDc5=lb4f@j^J7z4wzd+ zUy3$83THjXT$9&ep7efb50cxN~Hvw@*{;DSiyGp+z2lVz%s`VMx zzIaHQQ=I4dbS&&f??4CAC?4w=(iIus#US0q0;{k5%Pmn#S>4@2yh6|4;rl^~Ga3!ael=eK z9HA&VMLkg#eW0a!h9jAj0Ts`^u7(ppof`!l-nL&<@Vf`Q{v=rDp{U3XXg(jB4n}CF zDxL#%YO0pSv2{5`Ks5ZauM?}=^krr$-RQJ32k`sdgV#I-h&@meyYxx=F?$E%kgfeQ z2{t1WNu?k#bktc-VMOLd0xz1}Az{K05)(9m(KLUyLnH$8l8U_Q=4eCPP-Xg<0}O2l z=kTu8<4lu|*xSI8VeHfmprq}8sA~5RGY?poI~D8Mto&^UIK+hBI$wYxREyQU>|?UC zn$OJ4ErXqm=Zrii8}VGXq!BRc>pfU8hpjFx7zfI6WenV@6Sx4;D;e0Wf0-h1f5zmCk=k z2#|AV_0hRiEl-s?A5x4+nqgL?v zL-i9#3U@}IdWv=Z-Vyx#Mk`}^%@kOIXIB6=?aww_Ucw~3Wta={L?-mZ8!rfdrIn+!#QtNu>Si^1NRJI#!i3X*B@;ta(pRP{Od8$rR)bH z6J+|xPz7FgWk=5_yv=MWK(=D;0b2%i>c`r=S8Zpr!=7T=E9QvZ@XZ(^$tY{ffr4yq z*vxliQ{ie+FZ=nb0j(&39FhWswfgII_>%Ny5BwkTU20>1>wnO$29Ml!lCmp5alywf zpV%oeB$oJbf>@=~B^Iok>4c4SKuIQ&!w$Nq;9CHj)441SU3I|Ob2CVbRoR?nh>A7B1is6FzIrx>HS`KrMRwM88svM_&&cOjHlrN!iJ-yEgzL~cl;S> zH>@<|2o+Lf8y#$%YlM0Y=`y4IJ>=Zl*s+%P5A8c|lwjA`ZCw(*MdDL|HDr(R4(*er z0Wa#2+Stf9$?{Bxj+Wt$AjaBYohxvwb~etsn9&pYLFYik160PGtS(WbkQ#qgC)22g z$he-AOVN%u8c+cG-s&J<#hX1lq=uq1vWkx3oWCHAa*Y`8uU4lyG?4oa?k5QsQocmW z)&-9(zwz}463~Ki8}R!KiB4+(Jc-9kDjnMJ6obP>FqqAf<30+B{-cc+F_rze1DPi8Y<_d?9&pI%%Vm5~Cf z1<^GCn}gzpzanCrs9Yu%y(Tcpr(hh1pr!4IxCFo4d+n5Kj*<=dw4XqEh?)v)sipz- ziUS!?J@3H^u?9@VoMnbS{e$HZFzR5(dvon|h7ju`B)#eG5$VRq{>i=xu)}=%BIHPL z%zpQ7RBz4le=^yL_<)>RKR?$8vC`&%3yAFMe=>VQoFGyma^jRj+w&fXGkEZiG(fPl zZ9Ax2To1|OUSEe;D_r4f=U=F_w7H|hQQju0WXWrF8#!luw z%)0q{!J2@-eVgn4#9?&K=LpDtP7j$3D;_P9yB{d9P`?8E+UxqnU-U4S$Hve zzJ5NA!l(cqWk;;Pf0~^XAe0u!QJ^9X_xJ#MRw~aB+oo!^S~oMy3tU)0ogfFyHn?uR zfXELbi=$)6DU>_NY=ya8f}R>^c_(|z#ntZ#Xz zVA6Mfv{!@%NLjy=_-irD2fVPY$y{W`eBNAq8+0*%7EMLh_WSfbLgeh38xIkK?22et z1Z8Z&Km}-1DHpQ$fXp6LNLM}UxD?!xYrx7C4yC@sbCrkT_MGcnJ2W+( zzvK27J7yR2qT0QBGMYJJ6v9OJY~|p1^@%s(K>SIK*i8TUH9<|rXP5ClV}G-KX8!KT z+=qpGoihhhVZo+9yAgezvlubvh;cQ%FD15kK(r#wZmtjjC)0Tu3r)sh7T zuvE>{V%aZRE7t9Uh6{X|6~xUASlO^xDnOy85GMKpD$1QEc-_2U%5pmtrLi>QV8w=t zT+d(A%`Hu@Jh8XBW&F}~Sf?g$_)h77ZPCE%HyQBsu9rk=WIyKWVNgWSBQ4nG{%J1) zEohK2RjRFD5ZCwZ+lecOFltHf+$vA$Np9i0iHqX-c(!_4hNt5<%!ieF@58kE%<@F* z8W>xiQOfGe85miEp9(b4YW=CQ7h=k{R_~Oy@aiD|`tY|^c&+{i24r~U-K%p44u3a(D$$E4s?*lk9s>i?=!I$Bh_aK^c6hR(+@I? zu)?M{R7Eh#HAgy}d>QYIFVlYO4{5>)Xe7>2Y&U1-qeX0u8ObwNc@@Xv;wjC5{_sQH zSj!GC22C%c+MUACO3ZrEd2ug^KjJb*JdahkAmmQDz)NpOg?hzAcTCo~?1$ z{yYK~(?syTJz!vK$YtufG?Kdu#s>H5;X2o0og@xikr_JYd^aL5J169$*pp!Cc9OwW z7hRkC3l3%JTfr3)xi#Tbm1Qx z2iwd=7&xo7QVKPwMBRe0uYoChAXc=P7-E8?6`XHBl&jYFgt<}@3UrqU&R5J3^s z)C}K%;my#WTm0`G8+>{!hawj!3nGe98k>Rt{h&;(99-@{)Z8P{mre2Fy>U zkZ;r|JwZM5IE3dBw>0h5`rS!lUVJMOVJ>BoWP#CW@R!kYZAnR5aRg;T@0LwUsOgea zMx@*f722A3qtGmH(SZ1G^`l$9Y?4im*W4XGdC}eRzs}J8OlM2&w>5m8m1OS&q^2P8 z`IRFWHATXm)LK1+smodv4vB9lzq7)wYoqoX2hsMyW`{C?ME@31#59OVuR)gkD+oz{f^AxQb_ytr<3%?hUg;KuXpFKIGh|5 zCQu!Ems4h`8TDhtGJlD6;z%iUxIu~+0Irv{N1S!>1QiQ>L0)jboqH;yj?leEPtDQb zQqj5wMh4z=G=`EO5*&shDx5p5X+985K;OwS(%9(IGm{x3>kGM_{NxJcLY1)BDH_7C z<~8SP)o^sRlmomB=CUz2=H%l>HUCf4i~}zME?0f1q#~OaZ}k`zIXcuT9S}M`1Zo#) zo=@C7)=IWAf_5cNx)Fmw_N_EF=*E@-D>!7=(B{W2segCl22^LeXZ}=Vm$QwTyPW?- z!sqfd7gi^DM=~xm-4EhKa|Ww2I~ayOs+-gtLyTGtnV3dhQ8V7Y?xEkNY_7OUW{-^B z=iy1YN;azixsG{uI5gd>dI>lc_6UY-6Z<1R#mvTDB-PcBFOyMY)(tG7 z%@Tf7bFd1rZy|JU3{W5IyL9z#a$H`efH}}^bB^&2VGN`nR;ToA;$10ghj%nJa|0OQ z8n5BEqfm6a=yf<=#W(+aGt6=;H!r>mMGOmw@ngM4;Hc7MF}C)wh7Vu(``pm??9Mz} zR|$TG-imchkWm^Z%ssr&d&CxQaLLw?u+w<+1GwQw9J)+E7#d6k#^-cUBY~H$RDD*U zj=)p}kEtyf0)u27gofR-D`2bc1Ke;G6YTSgr4gwUJmXlL$s~{#41_rMb+S;PXwfj( zl$}2CdG$bM&tR>)cY=)HO-D~&1}5*t;nbdvo0cSMWQ!mRcr_{7zD&D-Lf~j&mNaj9 z_+4DW(ab_bEgxb(xE|CsE8F2mPO~E;9)&`eKvURMhIg8+xY9Y@zxxDR-d;&OlG8Xv zhgUK-Dcaf{sX+Bhf1U&62-0I+c(hp}!I|hff z;NWBz3k(URL}pU;2lpc~+286SjRqmAA{=HT1JkG4JTqn)yW)ec`=SZ%AHYT&cG~WX zFP2Oy&bFzliJzBg?TbtzwgZ0#fyM`+59AxsZq9}{q+C~K1LR=g&+_*-(HA4VY}pby z>OUtRAH8!XTwqu7sj=Qmws*l?k}5(Uaw!~d&Tdx_Xe<(}hzqVYQx_8_HV$P{4LuZC z>tKF*O^Zgm_xK>_^WO3NZ)F!b5F)`g@cg|Ra%@fRx9W&I1acl*1GpMbx!%UFPkmR0 z{c{@wz`(jhU^lfr`fE(8OD=+3sTcX25Wy7E*+KEBDpU%DSSW&!Nsv1*#Ho5`528Zg zhvSYHw@3{7OU(lUN+7lrM0io|r!$-5KpO{uD8$N>t+>BJ0t=H*EUkcq;2LFMi*#em zp}NZ+jE}9}6baI?E>L9tqXrZIpQdcuVRgkvQ8bIoQC|7%f z)sFV&+iF*;CJKz9K%E0agn)pBmtMZoeZi$??AkFXPm=T!MdSc9Fl$l^^t}K}&HCC* zCv#9qgSbb*n<5}dkk?!8K%JwfgOq1MdMFa<>^33kJnbpCkdRpdcv0u2Qz{FHxvOhU`4RE#IdQ@u7%C05JDX+(-#0d3IVe)e}ew;RAP zRd70s8i|wHm&wsz3C(qI92MmjC{{E9DW`^}X~np|KoA7JK*x5zLaJT;;PMP$A?mjt zk3a+=0z6Dj=L;+Jb14C1ntB6X<855&S82@<#waw=zZV`R3wSl%>4aJb`}6Z3k=hh` z?ZNZgxdcp5GN!HqA7^|E@bTY7Zhm1B0td!2`|$mY!|6E1NeTJpbV|l#M>QTFT;ob) z7~q_l{t<+Va44Qc!|UI}4RIDMcpVw&r zlw8m{Cu3#;nesKkP|?>om%AkVe62PdtD%!7deFaY&|ACRisq&2F<|H-caM84ptZdeLTLv7}>JpdfO zO@#wt{||oK4xb0hpvvG3iZKkFF|UC|4B)*2BXhP|0;*Sl$45vFAqFpV7PTvCOD1mU zii{rLk@CdcJY1&fCZfmPs{8?xnmOm6{8O30NH|?XT4rJd(`hD$KArY5WB|(F?Q~3dkm0p<@)R zoLOKk|{i}HC2$M!^0`ifhQ7L z`=iK33B07a1rvZTpw&&IxZW5b^33}dUuz?7KM++M^%dBpp@MESVCSW8%AK7k|7sC3 z86aV+{r|%X+x*$#O{7`BPL3AeKEW!DhQ_%Ve+N9cSA*JbO(*VibWM z$%O|+vlx}JimMqUAcgPn0LbdZlISV}mt}wLM%pqW)mblTa_FRtnzNtp)r=5Qe5;sw zuwO+kGT8K}9OzPX?njL+mm1i>68Ae?bUoDtPXwWj0+m2^HfK;$v)mZ^xiYB%)YHv| z??$F0x@B=mZwX(KQy%6BANgvtB@9@39eUPy*hXxz(n-F*3x z0SUgi4%duM>*uG4wwYtv8L6@-^%lf_ArWoPI6&Pv4V8%<`VHM~$1NhOBz``+RCCst}AXh&dzwrW(iTp0em85PN zObYaHUc#*rs0wWbX^`bCByk5K@}MO@$`K3LDN8zS{s#@W{>$-DG3do*lcNL-^0;te zLutp~y$~}7jA@s)e$BD2@&G1zi}UR04D#v)fRWN_+R2S|HB6#I!ex-S==w6c;y-BObrZCQ~|SM zkp_eYU0EP3)Cqv#z)NCp?;&nGuSG-_THqI`KtKUi8I}w@X*w5u48T%uz@>JKh2h7a zg^`T{R&v`&^`Jm(|B?X;j^nKHcML#*1N4u=&)%cskr3tY6{yt~GR=yMofmq+{7YZ8 z|I%wt@npYf3_})K?_BfnFAbGIi0OoP+$mSmY+>d#>WT23zVE(jO>?@DZY;aKb)HSu z7|Ux+g-dM+;`V`iRwzW8;kb7vaH<-~b8x7U*PqRqz-M(Jr;HGJ441JyR4ltI6FE@u zykoWt-Nb#xU*_ZXs&QrUbWdh=)@~zR@<(@`x?+dB38S6xrMLo zq_MPTxbJMNvnrQZNqrQX5iS<2Uz z)J{#K7w7r)C!4bAl8A|lk#Nb$OWx7$evIZ96|b3eQpHK*jHFt>jcdmwCd4am)Hf`g zp$|iZ6diwSbyo!{p|T?ers^>nZWGAEvT^QcEkV($k-!{4P%97~8+{%t3^SV+GF|SdI$T zjlV0fH=fL6rcY|wRaMeH4*BLu>qwkp+vLdzH5Lr$(LzdW1H=vtk9t(AIL1^J%hTzW zQ_9=3DB>Qm;ObL5{o+!JRK0;0`^L|vs&g^L`;GDZvAJ@{5uKop5AvRwU8!URmMnHf zvG*&DwYUrn;_5)OCz21xX}bk-`-j?kxJ{z z#3&Fmy_v(oojGNpjZgQnsR7gyO_b!&X0OC$N>p&Y%DmYV#^kaH3v#G)ceYrkZw*== zrE`8rBsvLTZDXhvicje#Y?aODzq0H1g?f2WlWcy+{cf{Xkq_h2XvMx|gc$0{K4o?z zH-j-Xa5NRC)qn7-McWoxPF~;Ps+4|e?K&p0MAo-wgWLkI-OT_zVC0V%3z)rnQH5BZ zesinAr+NgwE1*q#O5?q==7(F2d|Wh>CI)jv1F9@M632E})+moez3{Cqei_4W`hrs9 zp6Zu#N%yPY1vYzt^>w25{hW`|CdE`;EgUsnBcL_?6e7=4W3b1>1l3zoP1Z1ujyOVJ z&%~EZ{N2)JDq7gvKQ43RUT<%4Hcq}U63MkW_kX>M{)zkGGfwyL<=t7tZ@ zz1u}m(Rbih8X>8#rUH194Qt6n$zkZeASd` ztq3Mch4nR}tsBybZ5i$8Qc+)3pJc-?PHw;DR7g5!6NU7N=Kr zE>olTB84sD^ZxtkG_15+d=*cDov7 zg>;;I{_gS9Teb0~XhKZfdNqUrWATzM!fmUg{`l%6U~;3Vn9^`ZL6xUXF6&tR>gsip zrr?r*^X#tM8#W4C_*z9G<$zJ^p=nUC<;--lf%S*Nglf6K0r3434m}jk!2R*6ansSV zNc)}IjxC;V5_eqOjO{7e_NqW}ld`UXMYIvcc8l`INY6RB_e8Cup0^#ThBoi~^7L4pBMnSjTIcL~1qbGyCyoF^?OB(g4GP22&3fO&pcFH+TbR zH(5N>s5*9c(+SWCjWZWJUq0lJsxI93eZ3n2W%FasY@e{mBgV=+tj$kJzd4*b--Np# zleF^UC0(YyLtc=hC2tVU(63*!$~^)kns8xdzQHS@LkDJo>3gP8^P^11>qsLrc5|6X z<9hvuG0?AyfpL4j2ME<_e_KBqdN~`klVgD}%MDP|cY;L63v%#YUg;5MqsX&l3F2hA@^ID3N zs3Rb0S){3FACECz!ckg%{?Z2}cx4_E|Iy-Vh+)H%2^9m!tK>@OHM|iaBFvgY%xb(v zwP&Ea0sM{P!Hmd_Qe$`5fGaCmZ+m?zY4kk;jArAA?#Y~K?V`~mtnx=qyBWEy#)$1BrTx3f(h;Wx7%vKDpCnq@?%=HSn5Q=?l?e0t= zPEj+`UbhzGJ@OPE&K%1TO3)1JPtQ-U@-&Cjk@zud$>1pW$|%cD%#>e_*PS6wIjEx> zg&^@So7F%i9sI+ir{&&#CvuBGP^cjwAHG!?mwY`uj+E}}QP4B>UwdKQx~!w76=z2! zLbux(X3WVYDdMZM{fX3@d-33}VniJ4 zt9AfSfa;#eyfEvRqpH>Vp*FwdHzRLNfQm+pBC+r;U*paqr_*INpjZKnna_V@v@cIh z^4E}5a@EL1k*9kGiZG*H=|&8<goHCA};n-~#>5W+@T&o{35&Np-j*fITcQ`(~oO^|@1Vj(X5OY5U)P905XMa9*Q8B(UuM8P9g z|9kI_Rphjt+utN9v$8*&cIpr$9)EAXy}fB7;p9%*$I^RdRJ3;cjW0LzWfl6;M%q>+ zuhb5{bT#>T|MO3GY(K!t06q?3^2WE9^r~o)~fTc^C(Hdu3C% zmfO1b0v-b(tmKXlCPa<;c%Yf*B$va+wN}#f`Z5MUsu5$hofh?1$hVu!Oy|^AAsL13BC~q{Jp(X8N(@Zjq0(SPha|r7srY`i}YyR8g{HMBXHzQzUSwb%<jJ0qiO*7!N675VN9>+p{6yozH(+qVwvm!oiG@*e#hI~y zQe?-ZYCcjL4dX~1$c*+dl0*}HMnZBEMfqtBRTr4%<)QqQ!I?^<)d_f&76XmM?DODr zEPb9ZBsN?CBkx1-g@dL-F-Y9DRxf(OWxFWZ(emKTe(8*vut!Shfx?Wih|1HcDxu}! zt04a+nMY38U5`OS$Lr>2t0NO$$>!Ki%(WpT;;mA}Dc%j`S5!TRI#%o$-KMK;`@+Bm zT6DtsZHQ0yK+>9JHm`u=_f5B6zzecypB=*BPMG3z#;y+`|*51 zap=l6Xzi>Tv}}43`>>G`+BPzMmvE=tO;k|4a#N3sdrt?V@WkLOF-%AK0Pbw8_h^YG zGgNdxO4-`@{8e#?fnN9r;JqhD5X2c}^!q9E@XFHxDl~$JiJO$j(!}AA1)3vg+ZB^}r zE1dkCjCfy6I^oAor$)DB&`!xlq|+pCf~gJ2a9}m~6u~52)N! zSE&*vv8we9h2dfLB?B45@q-*nl%|6l_3^F2*O%~|t{NeB>X@%hTEFoulH-+wnL zhw>t$S%~5(PCK#ji*p`xvXea%#pzaM-*^>=7$CCW%#w%m*qkr7REbzuBe|Y0>{wjX z&?JZA*E!qR>f3p-K4-jreiP>_mON9+If?Ja%#W@{Q|AestA@>oTP6;8<1;7Qle`U* z(5%6agN7ZwB=66@8(CqdymHNh^oxcFT*A|qa)YE828L=EB1Q?RY3m(>r#>)6hA~p= z&ysircw2H_o;M0474Gso+it{c4{Th~M5GkqGgWR0hi;HKR=Ce+^Gt_;PDQ@TZ9vGPLO*EUy^*k#kZcEJ- z4P;>FM?}>EV+wci%Kjnt)5p}gu#Id!NdP(L__3_ER zx{(XpD9pJw{mRL7F>qtGv4Qc2^E+p9o;-b*$xFRSDB6x<4VEUHCp*g@ol8JgB{C-Zns5GIWtd&7fmCEW;Xj{F-QJcV zu2_4v>a%evBil^2aGQFb!FlEmaIF&~)@cnXFQ-(%*q9x027liUmZio!uQXDnFLJ`b z1r<|#Ki>)qgzmTPf?UrBN7f@1&YKsK63|TsT9`NCd8|VW??|do{Pn*Crlk6is;7nA zZF%*4kc-W9k_&T3J!d9n$T2MP9Fa3yH$T@c1YVJ9ef~@QyLZFK49+z_;8PCJWjV}U z5V8vVKbU*(u%@!_T^x1n1uLisSSTXBcTiE3j`Yx#4k1Vj9aKa{5S0>o5v6w$2tp_} zY6wU-gn){41Jb4D?h|xAGs=8^-{*JlbDw+unUS3Az0W>-uf5j$zH8-}tjYi-_laB> z)nU4KV9m0CMEy4Wq?2=>#no1!y_DR=o)++N3;5WrAH4IFN2ROa3*!EZnw>p97Q9sG zp4Ndn!*wf$Uj2ap=;J{T&h)8;Rx|(C2Dt{ws~S(Jm>PdoRAKc}&2f!vA+MEr@Nt)e zQQ7AV(`|Kz$yXJvg|Buk))6kNt`*&Wd;b8jplvux%&?1{BwE(RN78+fd(t9o+XSo= zr#R?=uO`WZH{|_93~V^e`)cp~9tbnP3l51rM2{87$hWYzJgHiPoQo$d)$^Rx=>So1 zryT40%KA*Z$BM6H`+muvYjU=K{g%I^)O-pxW&Fq#buB%>b?Jp4`5?_l>AdzlU~b++ zJ&7tGD%`SO8?d}>{%Wyv9`Jgba$^uVi`u$~N#^mZwl7ZNn+_{o=e4t2f$NKFHP~kY z^Yd*Mc{hlC+f=q|5A9^)JK)s#K?Te7mlG2f_|`0$e*hkSA6OYyOWYCkJM`eo4hCCn z3(~#B@R2cS<-#?r(VoZqy;071OWYmCUpy4NFr!n0!eLW7y56&-q^G>ms8h47a!VoM zJ{i4MxE}WcL-niBP?R+jPVB6IFdk)E#a1I)^qx18vh~ETZOM?1u>tM(_j8~n(P+YR zRh6c(B#J53b0XcwvJR2HmJRQG6ZdKSqe1DnNr^;)>xkCc^ktLTW!&K7aLU&BeU;!) zIk=CA@NGa^oQ_Ekr|f}7=KGYQ-f$9QT_X^!nCN|@E{P)5bgmVSVoGUObVTpd7fo)a z@?I$(tkac#A`=(X68#dZsjYEVFTmK7E2$OOY+Ipk5g=RyiKNrO%ereE-3`}&3MA~B z;J~}Q5G$I{VF;T{p~%gA;m&MvG%3p{)+T0=ZJdT8gCb!S-ge`{UF+ut@9WQhdt^zwK_orpebDH#>PbbvZ zpcmdV){yhF+*5q~Jm>3@5rPusJhB**n`)jlRE+Dg9dI}H5rO)Ma~nVS&mX{>ObKd1 z_K17<&(iC!_sdHN=g)8ktd~`c6@5X&QIrt-H#onE5dQ;ocdlLr=hvskSI{x`8XQSB z&KPp8_<}zrb>z`);7Kof{^wC)eegw( z>N#;m9%ocSz|1-c7H=lg^&oTX%4|q{#R0?Ci z@5qB2$x^c|gJv*ojT0yn=oQ^5SNP|Y1jEa8*4L-jQ3W@gM<&C+REEjFVUQ#FxwxyC zMDtTm&pEx^LU%9>#1rF$xwa8`37LvQ#w~Q-9A=g+{!=v1599DcI)c*wa-O?tm+NED zo;{k}mtTdW_nRiwh14FFBavlaE-rM*R)=n-6L<)k@~s1vUcZDkQ*hUo1?ipzuuh)J zdd_OT9!`l438z#q40mO=RGu3mc+`2wye#$52ZuC4RZ%2fqCs+;LgG- zFVWwgLJ_-S)4KL8mEV5_T7}>qU4G^4E?qSXawS+58=Z|Z5fRzPi3PfTMY+n~;ft$J zu9>ZOxAFy)6w*QfV0PuE3EVa{i{bwJ=tfgOu(&dw4E-F8u5?=E(h zJJ7z*7+hxgm7Nr}gE%?27upT3!M~c7|MCIeEU&Uq{78s#G_(lZ6#u!d^NZzU5GU#SOPpG(o1&H;YEjo(|I$j;6K9V8mocYeOom#> zFAA$myk@e+p>@Q`MV&LNabI7N?+M$%xw*}N&B4VFY;Jd0X>h=%L!%u*|6+rnGi0+# z4Tg*F`1g)hBN^9Q(@_IHt6fw(WK)e4^%`scYWO7hEin*!{e}co&o!~0Y#Zl^f}hn%CY_(JMz;o2gnbt<$6h7bJHz-~OKr1T;Qzz}rJ%)i)ZfMa;l zOx(Ciw!d#5v?X0fD7iks$Q3gN1L$S`EQpMOiP}4nGD^con8@MqnBDu^KqU4W*e&6C zsuA?9+0nO2f#g7+lkfRsPlLIa2K$Fy|Zl)9?SzzeIr((^@q{ z&$@&U`2Hn*!u#$gOic2siteXy*OamC5~fq8-dB&jkYI4Lf;O5gR%N9GvZ}Dq>P$d6=X4Zt<7y_QtcQn2=P*?uK(3 z)z9%Sht1?>REKH>P+@v%(?uIke2O0|wnXamD1Km>IP_#;esE9`E4?=(nPP1RC-4~h zS*MggeUOiZ_sEQ;RJl*yJKzFFCIwwK8(T)tX!7|sIx|OL#3a)2K2vQ zzm2YUj1=ZRUw?C79bA$}o^6c1nEtf-OzxUuwJTKdQzf@f&k<%AE`XN|n~ zNgBRmrsee++?p#>p4*zJe*abZRQY3o!#7pGH z4^76Eg*)cG@AITs?({qxs7G6BLM#xje&fX*;62a_nEe#f! zk>Ck&u4DBANB~Nh&n9)5%3_S)(j2VMPmWsbNbm{vJ_O9I(6?kM4>j7HeEt^wsLB!t ztxm92Z`j}>;@P>r2s5f@N2EDfhb(prOGQLV!H}?=3{0DAdTi_T)SA0^yHtHvtN6`!vCO3TsF z`g6X`Pvl)a-X_X8#F>uw&fyq4E0(7a$1Wu4^Q`HkPh_X-w7I{RIgpWk9N#pspMY#Y zV!lh)EWQEw%25B>SDvW${x2fzdsXVA;f#MC*~|c(aK@4j?!AD5rNqZA4iU2~3P35E zJEOgB1+GEk*qQZ&-5EnqD=s$=2f}U`*7h5bwK(poA9k!#x=>;zh55NNddwa>ZLWv1 zfRV<8UAnSua3%lB>#*<~0#fNi>0t{;J` zj}GlK6Lrc_Szeg7ajNpM>oe~SlW}tFjTzpvo}}NmR>+o6a1aCfI#CQ~pAg}mdrCp} z*`fxEI+Ho<%9p4I-Mrkl#4>OCqB@BME^CP`x*b~8Tsb16e9R*hj+$y+drp4sX5^Z5 z;mZ}L;U~bc(sC8xZ9dv1aj9#mmKjZMQc3~XT7@NU7~6onEAg8f3$4r9NQ!rzZ>_4Z z#~NA1t6!?%{risw33F=QIUZ>un5aH5epzaFTXR5-+3v47hG|XnuDqkGlvqe<+J5#3r{A!1I{goDFY;Iu9c!s>sSf3smVX=Lxg?ssP3}p#(XDu>XBnOrjHVy^D0^M5xOAH(?p5X4 z%~sn87l|-pw?1^P_2{JMw`m)G*%vX4=frfE!fmhxPu@x}7csmo&3mo?h;^rmlk{z_ zlt)~jp6M@VY^%Q&67N{nC(A6s;LsH2jS(p-zGpLn%F8Zs={8Ibi*{A=F&J|dQ0q1j z3l(ylShmLX$oDt3z9g>eh}nN?zKyXklG?jqA#IxFkRy!p0C;|^{${Ia$k+7xKS`2(iZPv?|Muhr4li?Y|ustnBRF!TBnw>LAn&Gjn#8)5BE zU!x!j1Ge4Zb?$7)BvqKmpPC(C5zn5;yz{l4C^2#1H4mmP?{S*+Pz#co{b7Q8RWlfx zg)9%(ERSV?zL`K!{1TTZFq~t>`8qoUI5&NHUU=lOIIN^PXXMe+?{BTjTMKG@QV)7$ z2y4u1vyWZrxy-f*LgP6<`VukV2ojBgCS_+Vg{Jikv;GK;j<*Us7B5}+XvHjkdRbZS zZV3-Ds~}SKTGw7#`r%kvYr=4eUi69$&YLyg?kgCZjV#X_35f+^)P-bCzYI2UPSW<_ zW1AT($zUR1uYH`_HoD49w~r-m?;YSaE&meL{&d3lpg?pK@|*t_EB|!(aCBfIp7C$? zuGoo_TOpfP{ab_?c6V7IjZbAhT}NIH0ls>td=`Xp^VZ8BLf^i90jMHy2muBlXkOz# zL<0W)16v6FT_C@RTc+|t-}0LK)bbjH3u^$OuYs+AJn7Jnb@^u58zJA>V!w$d2l-`{ zHS=5GZrXKm0I&#T06PZG2P}QhrFKBRqj%do@C>xi?*J@4B*TkKc(=6#Ovtq0aHY~1g-&kswZ~*KOx)jE+V2?M%#qz=SW_i z0tkwB?k``m=s5FB-!w;OIwoMbJ6L`)dVE0#8i(tb;r>)_VOdv@;_-XT1*o^|e>gFb zt!o78OfR+Ty8e?g-`QYlFwIq-0p_;qeB~6{2LIgZt*-7`R*=N38 z%}c(j+#`z?)BhXt#zlQJ*WX4)?4CM01yu>?10nA33}0y3uCGra;E9gm7qnwz5yIA% zV)S-HAdY$Xrt7;PWnn=TA{6ODHzf+)tZ>f-KSBOHkI?V_{8Kzyj&w})zjYu-EGXiD zFtWNoL6Csh(M{{e(d4X9UW-e~XW zV@r?&wfKWj%yLQv2+t^(k!O)iW&Z9fli}bur$<@MEa^^H0%vwrr8M?09OKpMU--$L zB?zqAxMm?FVB;F5|G9tZnpuBtZn{|cpIeqrAmFDFpfg|pw}zPlfivyHUjP7uD$X-kdj2(%o3v9L*E+FzzGl(LJNm_(O1Y;3cy2o0 zs`dWNae@vC#DhO=f@;g}h|Humb-+ZF?W#Gs%HWO(03l9G06TcUCcW%6l(&iDLM6b3ZS~ z`jaTVi4=*d>XM35!S-YONN@9pUVEE**%g%w^%c_JBq7IM+d3$X=S{b9x&WVcAcRn8I zvKUY6L2czgZS`N}DBJ>>q8|zlPoNTUhgE~c3Kn+rj@?>>BKHyuI_HS)AeYhFnoO7p zS4%%LLU}L#?d74imKk$0CveLTGt@&{g?9R5096E%fVpjSu_qQzi=tX9O!(OB9xpdG!z{}4{BONq7JKQ4yC38Nga?QL*>-w5 zRUDMd86%AT1l$A59Z)~O#JEj*MV!Ox#+!|diC1wr{yP`vwBTg3uGFS0S3 zGVb+G>3&5;c2oPa#4v05nrQg>@^q(#Mb8(~c&{9z>X9jlNHwNniut_lXt&N#iM*6{ z!Mjo^l8F+1Qk12J5quXN$LEwEec5jGrSLS~>e-U)!LRe&U0SeL-n~-Sy0RT((AV8g z`H2y%nKjmVujDq0^yd-s-k4(qZir_;C>UKlL^VogX=&!wrJpB2&9{Gml2!+6W`YDzZ zBQcj#H7iimqJ@Xyq-92kwW8w&eflmL$qUP^Lmdi6*PE?pKT;>7$@Z|E9k{bq`HrT% zN}dVB-_!vFlxpMLO^Gd$Z!zVzzYu#O*J?PgC17?k?uL_kp;3VALsiOy3IgVZ=J_Z& z+9Tb$3k;z~N)5vITRQlo1+28o$nJD z#gFIao2$Rc*C}AbF8{edg0vp3;?hI5FQX649!^pG z3?xuT_XG)@8+w~W5)u*pBO5jL9JMUvn%A%R>Q+glF19Ylki;i>wrvgd+4qz4vJ4Ds z^bipiSBZjEREX+xv6jWddn$t!oE5-<5jLxms(GH=1Q4Zj1@k|YYK}TzB9y;m#vej7J?-*3-=ap9TI=R~&xJN=}a~;;5Q)J(bTHqCbMd;Ld z?_;>EhPljO9M_dAf+%=)^IF}tIxJW-#<}nq9dNY1+6hk8XZ(|=-OYj{hO*jj)ErIj zjk#_H+ygGWF;X z#!2U*hO6Rxk=chIP8RO#jtO2FRExcfR)4OMH~GaK8{C-BgpS7S3H&@&G}MS@KdNri zHqIK8`>va4JgDWM>|OI`=`A@@6vdi3vOO{F+DPwciv|CI6uAHs`5gj|VMM;{$*mFm zLWv%9yM_UVcx0e*X2@wx^#|)w_wfr6Ki=^z4rHHL(8cbL&^N?C>`=O#GhqcR9k+ab z^cNdKT8IMJC1-CWrRShU-g`Nq5zf&L@n0TKScW}O=z@Dh4Am;0dhO6}v$AT85v{8I za?@_o(E>{)g<+XZ6(y7i_QT8+r#yz44!4tq z{uji1VJvJOV(%%8!{6)`&vi?c&mnf_M2&o6NXNMCJyHBM++WL~1vwk*Dd^Pj?Qe2G z0o`t}5rByPD4yHU_Pw%{nHlf|&buEF25Om{pScAEj{g+-9clDe z&v#ySjRG)G^$?hKK9`w@O>TQHUR^{!VgaN=Tm7^d8MFEJ{fBV<%S*X4*`7e*`?~)G zh~l0(t+I&cY;ri$B{>$d%dcaL#4R!@+VrHUd z?Tv!j>VkN+>(w%*f9GDvMm`<^fHv&CZpX<}<33Xg_@lWUm%}#~K=Qa@S9Ss!e|WQc zdZO>RTGd@Z5N|4?1O#z^xz8LRlF5HsWoqeQ?q*Il{VQLz_UX2zC0d)usrrbBHR@mb zMqpR^CKS#+O}a%Ri+>O0Dd~_SEMWG_{5+*B&?4s8-;n`Ix?EzFw?%7~6D@)s{tZ|# z@uBqv(Jy}|%g>NX86mHn0SdGKfkc@2a6Q1(Y0J@w=%wFKj2_crZjv9(H%X>WL$E&` z@7gG1jSel&=!9JINPZ!Hs`)i2$bbXY>q$?I2YVDfz~AniM$%7`t9{aFv~#bDpM$EX3RrT7~I|KXXvuVNkeYj1aZHf2IHOuI&p5eusR`d6%#C8!eq zGmrh`EW|r2W#dyifwv7vAFjI?GGn*A zq}Rd>Nq=$9LS8W^H^kf1)6GnNKi#XdH=II2VCVZoODw;1))kzPKjyrDke{k^Y$gTR zgaxgwHn{QG_itOP1BRbZDduKR0^trsIH&9oSX>bA7K_m@!_F&w{{WNo`}A&X9u@8{ z<6~VDJWByb!;tJW07rgkQE!+j{w4ScHr0A&%Y(rB0FF}}(nkPlyejVW7xY{sI9%>Z zmKJ+|+M7v0ix`-hl8XO$`68b^yQr><0<hRg`cBT8 z)wnKRcjDMp&NG1l*2}y=3G4HDZn^zpjLaw9y)j|?Jfec`C{)q0RB&dJ92& z$J?ZH8N4~!&b~L&K5%}hOHDU=#}Hg(WjoeVp^?`QQ&Z2xJM56|v;J7SyyTD(I%C_Y zy+e*mFKd#d-e*JRZ}~^hRzlu**7M5D3N`nOk9O?s3RyAAi)4!(&(1US?$c>JtNw)H ztBgS)I$zHl`rC31Xgu{~g|KJe|WsvGI052wCZegZ}WvHElk>F^zBOCYbEgu zMTUeAiH>ATv(7hZGZ!_kky*0$Bs1kSd9Xb>v}na}8(sABxqVZjs?;Rb^r;Jr(G){d zrH@1bEI=!28p%AOUt9^->KY1)j1Z4qzn8+J!!FNHS`LsA@la%7P`4fHd_sTKn>R|^ zyr!{N4LSrWR~2P{4@6Du(ut9_ zkN=cs4JWUBU0JN}&u|t!F$5%80_y|)xkGRd@B$h!F|*5#Dy4pJ?^EO#p0DU8Yf+%# z)c3EKwlM=S?9f9e(>6%UxgIRNv+hEEQ)I5uhLRS%MCe)jjlkphl|7L>I}-Ib{DH;4 z`@4&Q_lMZEd=nyXx0BIHl0Kv~M%8_Fsv|iyuX8kaGm!$8c1nXrLzWk^z>EzofYZ58 z!W|I-Cugn|`gxGR3&~n2lV3rVoE!VVMnsr$+SRY-=QlMgYddatJ!zfp!cOSCIdHn1 z;#AHiu09`f=m>!+$AwjCrR2w*DU83sq1z8{ng9V z`6cndkerNy@dH*s>}y7GJ5mai>ww+>x^ITwLVmDS#yIS=onnE?o859{Ke3=igh`=z z4JBd_r4{>@6uZ`?m&KMNWs4W8R-Vi-az(jJj`haqNUFk{4N!VS#Ei5FYBC!@2i{ms zktBGTo0jzj(!Bi2`dV?y*1>y1Aq6_-mbf=yZb#=6jyrfo*HO7S4m_D;+UP%ws;`kH z*tfA&r{S!#mw(CTnc-h2h0V&d$S!==WXW*>VhZ3IOh0O+Yep{vg})IYHTJ`RLC4(} z9t-+LuM^80ED7G^&whtbJ|B-*_T!RsAZqG{!o|sjB`%-*3$fX+Ti`vopyy*iL$~pQ zH1)y4^|r#T+YHpmPint^APW4fIptr60puIwQvjl4tGwuIKPZsYckCXo{&~Hq&KnL& zhc8fiu2_g3bIa3Hp4)TtId2oZ&-l{Y>PJshwXHAoC5VZOAj-4UuoDB9Z;)7)6Qkne zw-+dwm`r97IY^G(mf&fP&<2dh{_ zi3oj3gB+(wD}#7mY67M-C&RCC=E};0oKp!ck1tlAsW^(74|qxB0Tu*r=1t?FZ2Rw}H9`hvER#^D5Qr)qBuC^{KVywK=wzECpZ&AD;G?zS+`9A75VcxCni9FMG8t+*K>b@#KiOpy`dW z4E11FTy*5;ILdOeU%g%)-f#9Z$OrjFs|%FLR-&Y15#JaB9wppojFmoI0fRzg+uRAe zu5T)tb~!xz-TLG6j1q?ozjqa;sds;W8O{@<8qLU5oaXefvUTAd0j}mG=w%S^GqLA; z-AOSW)bJgxPUJjmuF?2G*rL9>lb5@zWPbL#`nm(+{8$>orbrHvc6F~+vaHUkhVtN& z?w)**Zs@G#i!o`%Oi9gm4?Wg?zvI{V0?Kq7YeKq?Z{_&3eOO17Bpa^!kZjDQUdxOL zGJ9b;X(Ona%l0OxFdGYu^;Pl^==U+B756_uMVn`pn}f*>(;4f;)w$pJ=M2 z-p+6HY?|F&)yB47aH?c{OZd7@1ToFJ|6})e7?ok)Ut<2<*x)IuC$u74YF_F z4m#CPpxa#9*-xF>K_?Igj9A3hLtCx_j^MC3VojOa^&tFP4u6R;iEcQo8g+ZA=gS>F zAp8Wju!o+G?vgPRxh-G|-MtU8FFha<=FZYJY^c^7y!@5z0yZGfc2S_kA+NTcB?T?K zFk77giZ~!_Yu>#kZPNFYM!gn!0_R~PmiTvW<^L~fWAW|HGAE=r-B6~|8CHl@%#O~o zCjO8)Y50YE0V0(DfDY8F~d1XauKI?*Gf9pBT z-=bMa7^xUT;o$0OH(%SE$$wo^5Zcy`QTd84FQAKITMl&}eeHMjK_Gi}{2vxF_fZ@*gMLLS@BmZI&Y zr7GOjcBxJ6czUH`>;xOh9VC)kAKh%1pSX%mxN^1D9MnW`?VsMiB|>_3+(u+~YP+Uq z2_}&oa60ZJ{7Jf@$V=HyQI)&H*C!eCj5Mw6isA;E^tAL}=m??fZRs2QLHhFwbOSc+09^o@OSSql(ZMVo39VV{d@HRxU z;QT#f6aLZ~tTrP5?F0c^KIf7(mzwH4#jMlJ3^R0)Hl{;vYD)JJ3*Oz63x_>?JklA0 z&rQI?Cbe50x+RuH3}4AP8jzkZ#8|2lXtxHx?7R@EH)hyKhGX`4_e4k-@V1VpmEm-) zPOUG`r(R+|%59fGvBtq=rGqkiEpd2Qf6S@$RohsT3w4Eqf!WHEtZwdw6~@uutB&u< z6e>jC>N;trS7J~$=7uk^#WT#yOniMNdEjz6r5yj!Zpj+zAm8Cd69OSLPW}qg|D^_jfrs* z2tEERys7NU`)AtN+(m9P)4U9N{q)!E4=RDjPRPn8ac%b{rk>wE(AZ2+CZwquNf?+Q z$ljFDR0Cd>`;MdwGiE&_ZcOyT)@=5&yA~F@1e@={Qw|uQ#BJ!2vP>TEg37>oemnEa zn@+Y25s~{*QDZ*8?{1IkarZ?11F>+-c9NJu{+QNo*`!M-C)SfCEy!!j85Ol^F*!u( z3~fo~qu%cA&QdvBQu?1C(z`JDPLsc=K3>^hPD|=)?x!c z+RKmhY)SY$Ja@xH$keGntcPNbeLwSjd&Y0#btv08kqR%1?`CHsa7Euz*J;EGNoC?4 zdW8z_m-~L+L2hP9B+X1JY_pN(N=i$KCS7_&O{y-|9ugslmACI2i{Eys)@#l!1rJMh zXM7aDp826BV}(v?C1uvE2i74$UcTx4Vn|2!=9mFN@Mtx2QG<9)mB59t65BqDo$e0l zN`0?7e?#jaVP3H{j^yC=J!`i97E79I?j@HIf{W7R7_8x;@y$eNU@9B_H^ZYA+%5ho zIg#6S_FP2eVzxyA(Eu|Qef--#9%H6!Wr{(&G31$X?0HE}(faz1#iJ`dA|8&-Wa=Yo zg;vL)oBrbm>^}L(yoKW#mC~9hxOzT!t#>;~WD*yMmLyG$Z8@^3vV`%oKhC=Q#oN>R zcC4#v{m-IT4Gpc_bwe(p&iTwwDQruDmvPJ-u@<#(u@d!50Qx(oJOVpG%_sR*ZCS?3 z!Sa=qY16XWF|m8@q$OJK92{O%RtZKbE%6tI`P)hzD_1`|o1Pw{aX{~&-SCenI|IMP%Zj8CR$CE zoz#`vGaQkA)L>e+c3qSl+(4U&WX`iU_H@s`=Bm%`dMs*D1yrjfGc!2$(o9 z44|_)s$8~O%3X#{?eZ?Pi4roRsP53U3bcvMTCx2wd-Ko{@z|mf7%#@;39xKjB;NZu z*gydo)?u!ESaURfaQ{;BEo%H^zBIH}%B)$r_gr!u8j3=@@4xnz@BIy;e%E}#1vBi)U4CXNCT{sY}`F-)IsgN zr=r`br=0Hvj(`B-r034u*Cig<+-{Rbw0_)Hp4#TIW`*!I6WQ-U@m_%{xklXEUbrMM zDlq7YmD&x~AQC!wZP>hWyuX>?^uAlwR8DJ^J}wl;52No_`3z1ncM29?P&&87{dy&Y zZv1zV*6W^XTs|LOoG&1Qwf<(5`UL)S0^92odHneZ$47ZDG_q$NTIyK{jp)nA*&Z2T zmlBUXLAjomtFMuv+H_&)<%R5M$J&Ox1aKJC!^Im1m~+b-kzMNu`m&jG&yYnjrNWWw zM3$ZRmOXoq(&OZel};PTY4e)xd*Mt^c9beH=vi^I2`_eN&#khEW=u;3$8LpW(yM4Q zPsfw3Xmh+uk0*Othv&TZt9NpJlA2B#8oskM#1u+)TC38a$>jj-FT1?DGbc-aL!ETJ z50C)Vt#_7&)wAv9+gr}Eeu-7J)-BA`;4;ZLg<3rQ?r?Q1J@v#m7R zMRS9}lB8>XG-r+b;UGh4se&(^C-e(VDkNUC4zyH0@g3v1QB|vKaI^yH zC&U%5yZg;mXt6it3+ICQ5%h&T!VFRjumHfmV&T9p~;0*|%)W=3R$VFuMY064a~a)KX9Mq-Cp zhYeYBid%&j`vwe5Vn~%4ltTXeA*JZ5Aj-|`SuZX&6t8s3`U8VvdOIq2#gv72Gagr7 ziPdh=^;;I`FZ^ivNlrR#? zsLZ&4uUj+N>-d<-SnXbZhR6k?vX)m-btNRExwz(dr6ip}Os``(vnM8EdC*wZ(ZjB* z8CfM&cpwc{rFFSO%v-+`~${}5>cd;Qu84+DnoDtw+szl(a zq01;URfm&2OoJ0H^Yd61k{8=bABO3=Gt3S6`)Mk#unP_>T-U$N+T3)rnLFk{kXAmi z(`z6`TWxXGV?fhGq%wh!Bboxk-&9><5wYk{<6pn8!F*a~vyr*9VNAI3{0?Iu^Aa`2 zlpd$E;Umg8+<2@S-_)_e-A6pE?KvDz&O7eqq*Quc;GZo8H^{ zJQpBF_~6B@(n=;f6t6s}c=3sp_adIsY z-`G{9hjYr3Jn5GR>lyyKlc3w=qci(i<0<9V<|ZXHnUbMxrVBIV?hD1%%2UN-G!iKx zYhj|yhZrhu*qx!Q0-(T!AtmW}9zUbUm4wP!c0X%ewcqtF$4O7L$v{jb#>Wu}ttxK` zOaUPdPnrs!uT42ks)cWwN5UvWD&47Z#0Hlfek;=QSeGF(aQllOHv2h;+cPaOs^}+S z3E#dd*bl-HN8jbD^18tw_qppa<$5N0|Q3f%{^|Jug2;w zw|?oFS&B$nypdgyJ9Q%=-80!w(|85tq8JigdMfp1skOpLm6^IId3L~0fzmemsd+p} z7x#=YCnHbPPb`1Dv*x?DiN&pFo2SU!v%w9HIu<3bBB>XJs^@CbcQqbMBt~cMj*3bz z$^P=BDPWtqq^=xo$z}^98R_!1& zCOiq80>qso{tv&vU@E1WS=KPTG=RS=r|?S7?yUif`{%D&poMW*E4#|~AE~wxWKfIF zP3g)dotGK&qVFrm>KJQovxf_B+?hxuXSo^k_x3;upnC3QS@)a3jG z_Q@NU=KXShx98;};p|hN^pIk_4y6r9)N+eYRif6yXt-`xMlBq&%)f9=J6$D^9#`x?EKU%w}SWOq9Gb@Fym zvcbxs8*V6VONzANmoKkK2h9F5rnJVjo2H4cq1B0jH1Ujae=kx;Ulk+Y+q04Rdpc$a$n`o=*>cAl-(rVC zsh>E<9VjJDOfm9<0b2-Bl+t}iX|mZpzy9(GJ{pIiI>VV`){P5I&`>ImKN z9q-u)@hi|_tN05cB~-KXa@l>4kec)dM9fr@`y@|_n7v-ieZkjA_8ZJ_$BBCFVj2kC zizN(7dD9tgTJ|n%g@jcDDJ2%&w-#*o5hsB%d`v@&#gR8@vi<8lLhO!VNZaw7J7u>< z5u)A)%=E1YcRu?0w}yu-acgd#kQVg#UVw7;M*g`)m37l^5|BX}Z$Qx;{@v{2;&X4k zyUa^cvPxh*lm!=s2TI=u4sLtpyy;=!fHt|20`hkhb4|J>r-+EdX)V372ffR${c*=` z(`RGCn0!)(o{jzW^EGQ6q)q&SC{haQn7}KDqF1bNZwX)IwhabpaVDLV0kT9(#{+4E zv--D;aO4MKd%x`1m9Es}xDwsjr|uz;A8qqFou$ddE&pM;e~#xX8^i@cy1kn@LG8k% zV_neHXnC{b4q4-fPXe>iQJl%Sinh5rTKf3HkTD%Mt5XjPo-pwf^z%zHbYmvi@eW~* zk6|ud-F_rvC8qG_3ZJGiFnaetjmd{d?{2Dm-e*4iyU_zaemyd$Py=Y zk4Ke*JkTJd=1^zYEJFAyL<$jk8J?dT*&W|qmxEVv92PcpbR5pRgv3>!5G}j5gg7bd z*0=gPc}Z{az^mp>;Vo%P+~vbSXDLyh5z}O{^@6ZcLc2kdKVO`O=X-qU8F? z@#pDd!moLF8sBIZmX;{fjpx8HCTkKl`*n}iCk1g%C1lAsNMe@{mRl=ByxL~WCvtOm(&Mu-`m(c@gl`qZ zFHn|CxmJx@zAvchq~tfRx}Ty{l-JQ&{{k*U3LsEP!+(|AAz+F%F;01DrDjEcq=xEB zcDo4qVsCCK6A@@jUZu;r#cFbnO&aygx4Yb&%E}2*vfp$$rV@%|96;->4>&-QCEY*w z2UIrbXPJ%$8%}M4E9@y2^e~;h>z!+Wg{Tr|WDx36X$jkYEnTiJ zn2J(Mvh%B)lTqEuyJtL85x32>+T2phO{ywW3Cq$f-^;X#9f#{NFa%DgBe;UAiq3lb zFY^z|qzw3uJb=2CS*(z?9B+i^I!O4M+my6Z2zDhG#Dtl-G|=kY>k`X&m_R&#r+YNU zO~Og@nDC@(p!$n=A6x=AY-R$EIU_kgm2j@AE3vhyO|!Nu*cajC^;zH!af2XZJOS;6 zjf9t~s8>W#@cu94YTH%OMegH{yqOrajy(z7z*cd(nmeAz4YwQ5M#C&+3NW&#%F0C= zI7gzxkkObsrFJ+aL&Jd#$^!1{x}R%C8P_5Prd(ZOJr#Jr29@1GXN?DH8c;gqq0^4F z7;(Cyj{s8vTBsaI*M{}EJq1KMnm?=SNa2Be(+6yy0vAxyC2YC&umq6ufdrUu!8;%9lDO=`t&K3t%xn?+CjWVf|Hd`ACXV| z2QIXBn&i%aHhHIjz<;cCc>U!uul)Q=@@qjGoC|&zqJicq&}BS^_rPZ0i=dvBF7dpX zpIt|m8IL6{RuEtT^{5oRsdgjxO5&s-C!TiyY2f6vL;%qz{a|(-aQ9&yvtQd_>H<$n zovK=6H#DrFp`gjXIO1j=fKWGrsPzT<#$SJ&3;FF9NJ&h)1TYQAq##i2dgGt5Fwmor z8F3OS6$KJo-Zw&d#Ef*OkN&KYtGiKiGzpTt0*%qiC!2wQ!5JIi6Vlm^y-nH%@|E6+ z7eX~$)`2I{Gq9rbQ^^X%K+pDcoP2%>JHg``MagMZ$VvPwlkdNlDEf;zo&b{t@;ndx zW_MelRru=jZ+P_tO-CMF{T-_7Tc;iNFH-2T7~1!Je>*NnD$q=s|Bvnf3z-|`Tj9dPtU!9>GfAbv&yj+lkWH_hqp|`BJL-aZrE&`>oBU!@^6(geT|`IwLasMn(DD>FYph zi-?*bIPYz&;y}l9?nuBMcMGs^ullf*Ui!J{hPP$NV^wzt)Bp1!t^^$mAgU&{mRHx(w7L~1p*AnW4Nv^~ZjA&9PbI0Dj9%uPH zy5OmvZ$HoYj-+K6#=c8Z8i_Q(_RZ#HJMS_YE%&+?BIz>5*En?gLv>&yM@U#Eugg|qt{=-W)x-swU`)uv5yj63cIQaQ`@zgY$ItVH$#Vwmk?Y;Wo;r3Q! zlHIe%LZRiRg8M~ulF_Q9PC+YBTu3ZItX!cvUR^3S!L`(!uk|xtY*Du1cw1)jQ8?Z* zEPh^kRE|g2OB(jx7=|atJHL|wbIsK>Py=y|$Ny2{5~M_ZN#2KvOm7k>{zxoPKen@x zatqI1jpeaJZdRBKmSNOb0--I=Hl#a$U{Nf`2%%nuhxTIoPs@U<|ltqAch@$JNc#f8T0FgsL z28kkpL?5Uawu$P%Eo+>V2mW69gVQh5ICM*7t@eh8Zn>49mLO$~v-=|sQF5E#WZ+v# z#t?+korpQy8n0_@(O*y!S;f{YhN~9i897Ni%Ak@3ssop4tqsa&_lfP#E0WXwlgE*I zy@rsXMn;>ggvVXRa!2gRS-YGuW?cJWF+x%y_lW#TF)W*)J%!+JTO}FDiGtMfvzD z4O)v5bkgTl>SZ0t_j+UcwXy&vceEwGfEgZHr`N00qnrMos>f+ti5XI)JbQ`G+}UAcRXcMt8(k84wJ|8j zQC;)xkEad|fu34|IQh_W`0KE;b3`^*(nDCok@RYREwI?h8djJ~w{LMk=UW~q%xecLTMf#@L$^Sgc*;zLTJhqtA9yqZ3CH)3PoD5a3OL;K zHOR@MSRQd#DbHWr-SlGificU*@&LY?s#zY9&stIY08_$M5=dJD*GJ$WbO4cFGOs~* z+*)G1kGBNv?*>>cDn6`r^VHKvKhRYk8}W)`=kdjrIPG;Bu*)H|RvKXi(PtiMsbjt2Uzf%*oZR<$tL ziGT#78*ZU_x)YF${6|6-^eY5Eu^muh{^GF=(JN5V0!(yziy#?i37l8$@K;#VV#;;f1r}wlKLz^RH!T!x27Qa8)5A8OhLMu~@!D!+U<}PjCt6q;H zzj*h*HbB)jmevT?#_5||7g=X0(ys(=uTg(n8UbePM!R>+E!Px#OPvkx3h27*tZ3 zS^B}`S?N@|61T{kCTe5d#%<_}OOfFp^lupO^(R=>S=|X)exLizowwvXCCOY#K4!_e zu12nR8Sm4aanG*dO8M`GQLW6(31vdJrQLDVoAvSJKEDgZA`Mi2n3$4N7;W>^BUv?+ z492Hh%)3yx>$neZjjQxLwAGuf)crYfk&VuEnbk>yaq{&MWm%cLfF{-<3I zzACYdAgb!*w7$_8)WZVmzth*wy8Jt=qRs^_QjdALEI1K~#i}_xN*5vx-{jiD$!E1H z@ungi?LL(_~kYzYBgUv$7_Q%MNv6#%wS3g)-))RP{?!HRgg!JTZJf_gn1<-2R#) zxg-hfK)P+Ky=@Hu>+7<5yDiG;rg7v=R{Y&$OTpU~Lx*h!+LM|@+Z{E>CqnRBs!2Jj z1s%hrXp;Y#LEQy{Rp`uRA>vy=ZxGYo5U6;Mm^_5QoUqW`;&t@80?aB@hH%ly0#(~c z=j0%vMvlIQ=m(NJLX^vEps)ZaBA}k~r>cAAQwA@!ab}xn^#zn=rW?7$oAC&#D0g|} zK;V13zA{@rb3B6Dm~t9^?2)vzLc|Anwpf?Xbu<%x^DX{SH{az%dD zUOLTbXiwR}<~!+4!xi1?_%bs+=jyGaQtKnu%q5vjG#`U>1;QI9Ma=!BD*Aj1WPAJW zu3g><+nPh6K35q5yNouLG{)2W`X}F=b^mB}DFa7B$Vb**Wuz zuwdVH3kz*dWYG-tMapR_<@Pb2 zV)nJ<``Nb(wrVk*ZYS~!VUd`}PYqgR6n3O-$fzy~b7?_`V2rZF&`TrqOw?9O#ps<6 zElI8Ld<}F`mSfqHK-&viTEa|iQJO4~QE+Eyt%0-571IJl?59?5*w?Kl$8+P-^$ofy zoP|=%iJ&bh`Lv@$#yLVUYYH_cE4-VXrRPu_yI<4Y_Xft-J@61*ZPRV$BF&rQj&l<& zg*khYJ9L3`Qtc6%aat3mPSlHayxkR~t5y`$#x>0En@4xazJHes;b8Zd&mXsAv;;l?YF*Hx7T>HovL%kb zQNPT_8Kc$sw&X!Y?%en{50)JZaA8{DyV5OAE!(}Q7TF>Rt$`6S=vj*9e?Wn|I3Mp<%bL2o1P`+6-x!j95v(z za9w)vPSJoa`0dI7Xbl0dnA)IKT%sIW1!KGis&J&;D#@mof2Y7KS&x^%DNSTiHd91HxIFY1rYC1YP%(_7IC|4_4$7wxBjQUAa@@j`%OWpZdC}Bg0cL)ogC_fmME4+On+k7z;5 zMoIY6h_y(+Zu8p5smS01XSIKKgdBSmUm^7fb$C~XAW)8!k4y1d!;R1p$aOos)kw$%R)85yl)qLx=H%CdgK0dnx)s}$hs zDWdo|s9zI09t4V!isz1H3;ak0D^)sORGD2{bFmTgA+3Ppm;T7T{{yh)-QoRdJ8L_3 z-zGMhg`B~pg(9>aInDKTitZF-?D+3uK&d;Z7k=NL$y>L0$DGw8eO4dXlMx?q9g@KL zyO99|%kM8!N)v`v3!P%G{+4OZ5eujhWm*{kP?RH1!T%zvVzubdMFQ!cNm>$a00!Q$*XqD?DF z$+tZMV&`(dDmJ6pXA)h#<{;O9+jq!8FgwwK&rJi_9EJFHM}I#eY7Z9D4RhCzw|7R& zidH0+YDGEsRA%P}JuJp627PQrOVee!R5KUsdA8?wcS;3SdyxyUaD~g=TwJemLcFj= zf~&4N@Ih5cF~6bfM5DHM-B0tQhil^YJlp&41Aruqkr|LuzIZQ>6uX^HD$L8)Wx&SD zFp7oTY}Z59^fzh@54ks0x@MB0wqqrWKlH~B?D^GNWMM?$?RnF zGm{=5FBa{I=Fnv%jCSR2c-Gx8Ku@_-#C2BQ8YI@azF#Q1wAd4LxW)UyXET-oKY#%Q zQ{MEiA_0)JZetz*!SGDTT3#X867L8O9{7oTl{;M~9fwU`=-L`5wH`SQ9iAKwVnEre zH6zEGX!~P!cH!+{H*Yzp9!DBGZENdaB*IwSzo&m3MDiPXlZ2PkX$%6> zg^u6>pnfcGf^@S-^Xbb|Z@UjWGhXQG7SPSoGcrU6Vi(?f8m}MLCxly0KZ$ir76YK0 zjrBNwheT3j6yb>oYsri5oga<_H8)|OLyPK1#?ba2Fm;jQ0@ZWrSSbh0dr8ZI9tP_+ z=g5;&`&T&`HBK6r4cPc8CNKNQ{%~zh8?wnSUlCm(4k2pQrJ zF#Z;(ANhnAAzw9qeJ2mWN)L`mhwX2$1Zq}IdDtN%bqBO4l4Wix+}G4Tpb92Ywq17P zWWns3e*SK(^_~SYzw3=Ybqt0q?p!$}urQY_Qm;{+j^?^7RE%FgJ6vLm5ZxZVx0gU= zWbBsEYVbcwXxsmKlo^am6!{r*l#qgR1B~QmU)vA%NYqa|h)*o#Tbxg)NL-ru*1Mn+ zMPOqEHS@~wZ@&cF+qF{<$0@gQH)0;Pc1fSj6&29la(Vmf_Zjgn94`H2*cL6Vbzh8% zz0^BdT!ThPnCSh}KrHCr_2OWDB_=;M9`a9kU0@*9F z)>+i{x6Q+jCnVs`2?KEswe8-Vbr2Ip0Jt9N3qVA!9q zm=D&?E&Ima0__noS$X`ifj)pG|Lp`GjFfHjUxfIJVS~)J8Mi^C+U6v)D~sX%vBy_Y zG8C{gy{ryKu2K!+O_>P%5{9S@p70LP)C9>z-7p8 zCm&zXkqUp6uyL!(#IOijIi|edw_c;_;P_P5j3wRj!x7x(=zd9B$m3TeRR`FQ*6j)W zuh&RDxS7ZPevlFpJIKbbrKf%&?JR+lcsiMS$g>3O?z%y){_FS8XdVPlB~1|kDRw?K z;01zqTyyhan zFbO|Y#i+~oUwt|y1)Y(9P+$-fS05e(y^oQjPov^6-lKRxd^sYrw>0#^2Q;UF(;5nl zq+-@MrhDuO*#o?vu0C(1ZWoF70gbtkb59++n{{)n+YqX&Ud_qH*_W;9e1J^o)=$q| zQ5h3w!Qz;d`Gs7wYM4{?P_ACZ!n~=mnz?mwNxrm(KyQt61E%SzM9@Lor=QoX;NB%Q zb#JmWG!&-x8C4bOg2EP)5Ikw*%l9&Ldc|s2@Nw9fM)yi%n~HjDpDts+B6{!0BVu9c zvi(DbY_ST+YgiN1Kvm;CALC!9|Lv#wTNUWIkLgvDgJ-=A<1l0m|ByNpS^o)=nUEIi zGG-DP#yk9Mb3EG9NhQ0iraFbFN;K55m*6w<)E>-7bZg>HI|yi*912>TOt4xJFthc@ zSrcZSA=!+7E)gN7VnT{s3cS>~uerjLvW(&@CFv&J3*z<~YB!HCVqX`8s#Xe=l+XOg zO)T-}^_v_!!YrhmC01NxDrD5LTgNB)%%O3FuMuOVp$F@R5Fz_R#Yy9uFS5^7KX4_H zhsYdUp6M~(hnx$oSR892=~3{p$9+Co3Nfj#A1l#9jOW|Ea|{{G{lcI=V|qguqA7Z) zI>*2hrDY9`ufz6)Uipj5>VpvsCjou_Nm92W*K7RPid|Q*TIub}Jwir?fhWFaZnXdag5BmSaI9>xx%_P*4(D~Bhp&6z|~zHrBw59U05GmK7vmy zGM+zb>tHZYa2hVSDn}O)&^LCgx7y^Q4`E9c$!dP153Er~L(Z)@gCYVuGJODE`Y$1f@TR7UaL5HMYl)bE;bT-~#;{2Geo z7p*tr*6x$b71w`_2O5kA=wH-IM|DO5XT0`TAi9!oHo&7vzh! z{E4r?r7tUX^24|0Dlf}Th(#c{8ZY4y>owGi6p*hxIlFIeOSwcN3m(I2^LpQo&G1>u z2>>6x7H8e+?PPC~Ao6WVKikklkZtI2v`hdXe0H|JA6M&XM!T>pCXa{v`luI7D<((v zb$H9ljL1)72_vt0xr5$p^kGjlcvYF4a+NNy)Y3JpHBI%O47k@=gtC zln+X6Znl~Z&1gnFAU?R1m+ri|)hnA;>t#{tCOh|*+%OU>f(g2nGp1O3IRc^S{*v0{ z`O71@ntM;^@hWvst^H9d43VABDjvL$3KdunuZr7ysZduQHia{_<;6#6SOd_>r5psk zv%F(%-#ke@Ikt7t7bQ*C8Z7^g!w)69>9OF-Hp^7zB4gnY<`mC;@X#hUaxGXsIj>({W1)60z0TZ9 z$x1A=FF$tnIi;OmsMl7-bo_AHX728Wimsr7|1!TD^#KOz#5#r`rI4@fe0$LBHuX7(d2WTS6C_s*G` zmv{?lZ$G==B*XQ$?=?c7`s|{l=&I+rx4t_SfrrCqu|W^Hotb`-BK4~=u=O4Eti&N9S0xM9_UAJ&;bzVXm2ZmOkCsnPF=ew?|#}G-&o99I&|S+~4iUnYz?_ccJlnw~kT8 z=v?-RMT=B}!irJ$JIchS%HZjB%@2g~HH5+UA#C=mC8ISHm^+t=R5tzruTQ&2b4~>s zwj_7SA-mkn?BELrQY#|dYscj0U7JGh?ewt0hMGL~JqO^M_8*^6C_+<;=cjA@83S&{ zIhSv=l;l=iCUF0J?Bw^TiR4dx4Ias~6uP5E@TYw$9NQY2k!Uwz4vhk@#i%)Fy3o|x zP^(H(iRh}J!Rpu5Z{6kiJN7v&V`3(o%%+5@=>o*~CH&P2t9cp2O)lp3IiKSUVnMiw z-ls|D#}BqvS6a<=a&Uic+?mROj(zk+_y(en|0SYhJ^QrWVf~xpZ9npxu6W?`maQGV zWJ?4Kf+4*_%9RP;xwpD}vc%?$M#!P`EdCiIBb9bRLT?(cj$(Wc>1A*ocb;|RAq@_6w-F^acdtvMF*P!jj#gh;&?1G5ZN=D(* zosMfEH;aN-+&kFvgWrhAdr#B*<#eW2h#WgqnEox)$!||jCEfB>?;G;d>)zBcS`;>} zBFxW(XBnfApW>EVE;n!(I-(@$xJGXDZZCSmbY=^}1x9Pe7irtz)5Or8;?;MhuF3@{ z{AY5#atQKrWC;3|r#yC9R$u9OGgsjHT+neRa=&EvsA(H*U`bMo)~y#z5Z{G%@8W`4 zXf$0XMd4ZZ+#{low%lRd-q@t@_MF@0(rN1rPP$DVG;KGLUhoG6(`>D{XBotC?>lm7 zoEm1uvkmfWp?YCYbzQ%1xb-o~AWVc6d?tPBbGvp~B0xy^HoH#Y!mKN3BnXKiZv9Mf z3-WJMfFB8ym}xA0uYB{Y%k zbY~4EOYoz#)~pf#squn@>8_dQk0@%@+HNG2_cl2 zgvK;(8q4ITkfv~&PQIoo0>HDtErm0 zn8LO2y8=@qx@+kf)f1hs0J{jM#{M2df3K!uw80ENG)5!VmM5`!42h_i7x-`}oy{ch zN_X;)1BVum5LukTw7aEPxGtRJ2p$o2W?q%sUQ6swCUJ4JMJRDpgwus10qoo3z}OycKJ-wUnrNhJUXFMsL$5 z^ApYW&FZdsVg?8P-DuXE!F=13%rd#6LCVEa;hYid-a*naqe`J@m3>NWp9XrwVvyF; zkD7BM;;&2Z(N%zXumZVHQQt!^nh1lwDouyowZ!Hs9djC`KJ|tZVyMZAs8117Cr5o5 zI3q74=KB@S%aT*Bf2ugxxkWIjO#7%B?}^;sT+=~hjDt6M3;52yzC3(x_qXOGQinq! zpUp|D&)!|{G$Oo=SPOozsa&&$Dn{6Q@rWv zBM;juxoUm#uvwYe0CbQrbESBaLNt;xD)#Po@6|yNA=~X7mNn5);ZuvY=8#2PiWa9e#96LQwT=9216gwoC2VaFG9SX z;B~XK0zAw$EZ8gq;bOm9_t#|tN$E*_Grr5Q2YcKh9#jc{u-<}H#R5-YDSD-O;!56( zA^mP4HOR!(G}6tNQ(*~Z16H2Bf*h%52^IC&J|}-@c?Mx%5Lawc>7&xM2HhN!_S7q} zsvbg+We9iIIu1K~_b*qs0h2RUkOPOP-(FBD4>tdBEr}TQ^_?dE(wV*HagZ-BfY*#t z%v4x@*}zijDs4-n(W}*WQzmcdj^;&^^zAYnVLbU;EXBF$r<+lMujh z-uzB7o4f>z?q`xQm$QBU=kI8dpT~r(m|yw;hAOpeM20$4uh~HX@CNvqs5nJXeYuo)h9@P1I(45pmhY5l;TDi;GJd8Szr-}{Ygg;%gl*~2 z6fug8;i z-~WWJSJeBJeWGHug7*F*BY?k3@cU)vL^W!pJ?jrh$u>oxnJ#bJ7Pjer)LGz;II&&K zi8VS5IU4?}k`tA@^i)V6a^4$Yf}3jE*w^~im_6NgaV;8qLYK_DmAe@uj)WZLoie&?wG4)x~#ui}L@c>4_Y+ih?Y zKU#Vy_8fE!aF)Z9L5Zn9%N+0z<}=K{NEo2tlGRpWSNTYKEPpbVO9QkVwnNf#RME`?j&>@;O&hQAP-I%@}Z|EB~O!AH=* zh&G;5bFUm_IzsrMQ5`Y!{OY{H`{m`x+z`8Vc zQNHnr5#t!VP`r!L%+G2--*d&FFQ}N6R+`y>=8jjO(@3`4;%p_`YN;M7SqtwXzph~~ zAQl|TA(8c&H~kc}581~wo@sT6=F67<;N9T0bE3a4hk5&Q?*6)*+n~iwV{Ss#{tjR0 z4>cOUg`(`oAg2hlh{%4lx&m^DNiCguXuYEM0mogw&FtiUPI0Z{o8mTly=31mxC+8R zYPW`oN^)UQ&P2Iro3`^E+iDg+OXFu2wR6^OP>GOT-Gh4gk)oV-17&j^Mi0k(FFbBv zO5JleM6N`%ZsXqJU$+SKT56Gx?SH4~>j)x$cb#EXBmAPiM&q zw7mD+E8ZKO?-amsyUmwue@;e3yQ7;*>$>WYEAX?~EU>@$vyCUAX?1MQwRfn;pH z+0|S6#aN6`A<$uYE?nwflZqqxS*4Li>T{Pk znHp;J(6Xmr%V@B-syIo`G}%Tm(hKQX`;wdNe50iI3rQ6Q>}jpLWbS(r+*gmjJwbIMSZ*4e3!HS_Hm!#( zfR3@%{%Pl@_aKm?RF|o!#*Hp~V$gobS84=++oWk8+O=~OO1~yhny}WKpW*E z$NWQkquz8@=O=vMRYYLI3x0uvZab={bVQ){!U8b-_L>Hjgk8#oe9s~HSy|=anE*d5 zx8J1Vhy>{%+uUGvdG9o77`IS3V({&OdfHTLFFamT-B@N8YS8SAuzG^}FuGb6E?wvg zI-$jFesnOHKyUb5mhnf)6IgtdVi-tS+5;M^k$L>cD1nWRq-jPg!Bz0A=*WU00+L4m z3ZSB-e|q6U9I)J`w*C2on$cOuPgLu@+3Qn{$EQuUsvEMzgCC)@O>S#cH@2>{)}{}z zE)G`zob%F-IRFt0*EI+WcCo_ri3Y2oSFtX|_?Ksxa`spoSKm|9Z}T(=sKQw(GH&@< zy(o?y+y@MN(;!ZwgQqk!%cE4imdX2(C$Bi$%mm;}OO8@5%mhZ*=K4aWQB=Dp#|-3v zYv6d;u{J=Gm#rzT1XUL+U7&Y)Nz&w6vzs8(@eCbK9TGNESkV@1Z3tmnczEAJhNaO# zs|n>J@;0O-`Oy=VmqP7gPKA6odJ+=K#Z^#*F-nPK39U+3pn3jEf3Yo!KnlB8;xucJ zTzujtgkbJ@H!wO#*Jk1}AbG zl}xWR`_f6JarZz^=p3cUeWURu;M$&2*rb#g!mQ2eGrk8`;8h1ZkE~-I&y+(wU`^YM zt~Y=WfyXZa#pSeCP!px7+WZ`hxCN$7f0{QgDVq;P1 zGGkL4;~w->y>Y29k9A0R*?@>^R7?A6A=Bc$ewirHYyCNy4VxCr#GGsjRnV&@foq>_BA-jC$BB1AS zs}dOYy=oG={UzciUyqHG!FZOODR-1u0!+mpp3y-|V10~X3C%MpkhL8SqTcuPN8hBk z=P$%yE|*&GuI>v2F>8FmwgraO_ZVv9eQLs1v_o)ud`T$WWZ_6xAWmw4$0(X&6G1jl z3U(6+qQt)Gya;p6o0RC?z`rAxwc9z0_8IX6)@t^+2dz8zUPou=xtmYk4T%lx6soYO z>$J|CmTwI+%Fht5FLw;27#yls{a!qiV2H|8+-oBFy+^S*jhuS7{b(n6yv^;wbL5<4J3%)wL`cmVjkr-9+-!Y&UI#; zM~reVAWu|eZe3u@M{hbJ8K29?m$Ch#9T?Attsa!;>89c{$lJ zub~_+G;HK@H^NBmki`?dtMO7sK0?pwZBRH{D5iKkPQc*dSLpY9+8%H8d~vRd`k^P*ADi=4hdHkk z>tX!4$U2Ma@8^WskREDV@5*hDre z=30QxaqV{tn@HK^3T35;DV{6^m;iGbW3!o_MR@a23a!a%|6}VcyD^ginSgZ`_%wdW zzLQSZmM`wO_9p#sX)*jYNMREek^EBmHW>&Lb@7I&A_ItK%pk5M!R9Y zGTn6RZaSv;^Yi@2F#PeC9Scv3thKW%^20wxOeE#1(y(oMu~So-b^{rci-;w^fUSm%tA$+9lG}n+7xd%7_i;7{zbeb!kpFZFMjM!#yIClt*}K;T}RL=*m*{L zw!q4{aFNoM0UTBp%zrwJ>sCgA>F%u6-}g{SrA55y>l-~UDy@DZ$Aj;+nV{wE?ulh4n>n3M*%u_^&{@j7B+!)eS+F|jofI22M_i=rt z^@B#GqHDSyHYMiC_eT42eq!$q9fvX3%vw9Qjh!%FofIA$>`PjnzO$GHYSc)ht@%cZ zWp0@n7aH=c7X(?Srv=9;HitYw6L7e#9?#&*VYm<=>5+H*e$>)PgZ(m~|EpPVspXbx zi)Az(W_6VSMZf>3cL@g8{7{58ot|19a=<(J%VvA@Et5*nYn8fMin0~)bZPZ&7K5Yx zSKhd3G2j@`a;GCpKY#X{>aRFm&HaeCe}?W#|912WZeZcYAbW^X&%Gh93~FC1Few5K zi2RdrKME^sywr1#?o(AYtRY@om^ta0#wP|}%aTzqmm_}mb~@j;e-Q7|rZLg3tKZ{b zC)Fd~=c*}NOTB!#cEG*4vkE=gtbDTr;6qwISW^VVAkTo684&ZM4fSCPYm1Fou|s%- z@y{_CiSUKwkgDhsJ^m@4`rz%(SCADj0@QP7pa~psINj{$uwuX0y9tTPcS*v#JiYj( zK2wgcJb3-wyYl{*R~-g|>DLq3I^C?MW!YdC=Gwhk0w#1Kpgy?IpA+qCGZo*%d-g&^ zfvpui^_44Ju4{v4Pm}IGGdPEZy zVynTl1@6T-a2d*9_%Qr4fJ#t+xB)A~ZKQ~d*kpFMP^?S7@hyKGaFy##a}48&;jifK z-fHR_!x*ENI^B{Ihny{~#SSv@1-Vo|pFtf~n>0Qn!HifLeYbK?M=Y9{$1rE@aHAr5 z@;&BVw^)w*@O@pUK9KSP@6hDltK#Hy7xKWcryVRo9D&^3E@zsF#OdYyG;svH2COei z@pdD z$+{*;AM!KKh?90GJLx&=%j|wB<$WwY0OVar_%MIzcJjr}4|=S4m-i)4BLa+lGLI#N zrvS2izKXBck-wZ;EQkto`Etwy7N@A2jx!+8*OQ`brcdX9-7Dl{rt^-PR8TlE33~Ea z^s6qwRlz+rP@wtGu)`LBM_Eu1a)teM4#+4#o+(yB4Ng#1vX+;n3B~ zvpLBF+&x?CzRzABu1iIly?aXw+4^IS(b+ciZjX1ct%cN_rbwP?bVVuKd`lGuY0jS) ze!Z5O+c)rE9%=l**iDPFZ1P74`}Uu0`BXC}i=sMLY6z~tx_@(-hDz($1)2CqlUC<7 z`&tFo$Z&OUUg`zz`|l2Mw5cTC#?|JbOVRiiwQnq!FH(E)|82}m#if)C_O1hKyVJwa zaq8XLtnPVQGkG646Bh}B)*1*zIslMQiPp0~fm?q7xMBg}_R`w)w!RT~*ANwj@GhcE zas)llYENB4DU*%C(-}g+0nrQGAzPIXT#?DZBpeN(Oq6XG9sxA^ZkD;iI zf9d4&R7igj6)_4#-7+9z0K^4ZK!5t>%tlqHfzSVazkuH#IO5%(*0X>Y0a#QZ9Rgeo zUWZJ*Xa~ZwZ4)@4fd2)Ku)YTtC18?9`9HR{X7<&)qp2vm-LXjJPl3*1$QKOAZM3fQ zAWuQ4J=9vMwYgOI$96{4d<%bl=dXeO4FXC1FEG*n=E$rWO_~Kp2jDJZ84=*1Z-5@} zH?V#eJh;X6JFaeJqVCR~N(#F`B8@8G`|;0)f3Qvi$G6t_#$_Z`i`WIy9mjW)k5mEt ze*|P01wwId4aiIAP=O&Y?rbZ}sVs=czqe1f0ls4pVOnv0p}^sCqa9^ly%GXAwBh@i z*~e6Wd*bA6|53ZAHo(rcMCgcT3xj#Zz3QHBU`d?fVhfy%uUiHPNZsew_gNaz{M`}M zKnAlR3kZiJPiUJ#B+a8qNh0<;$w*smXV7c`5zhPP2*9bPVvu&O090~xf;No!Yz(^+ z0oIkV*uzwR`2R>2Z7&fxvHR{D{e|Md0c&x6-BRqnLvg@NNe{6a26Gg%2HCCJoXUxE z&)ST@E^Dukp+i`tzjgPQVS1}P13VN-9e^b*Q~T=1@Fy$04E?VZ;@^G@%*@mQTz8~u z_MRj=TuB^FNKCao7^qbuRN^9Nf7^klMI(d*&Ez!oMv{;sKtKmu3KYckQzX^{`W2(- z48VwyC4jd>|FO}BzKsc~5q+U!MTfQUIXdWs%i87AvW`(MF*2-Zz-L>{Z5_JA~%uisG zj4;FN4Oz>?QpMO@j$SSlYR1nc6K7f(0?=`(XRU8^Vtm%Ap78qpWA&Th8KeT@N;B;z zYd3+VVGSejU}^-L4e%cggdt#70t8aj?>Mc4W@CpT(s;%lMN~2|K^jt_KBCdG@P1T( z+W9nZwLK@nt0H}I_I^RB?Wan&AoZeRBjkV&g2WirDD5=WKRFK7W%HxoY#IvIHvNhe zMG18~U8z4F?iCbfzdj`f1>R+37mEnqpvsaa!GSPBU1iDOqi{yK7ybsMTHqa4Y~q%@ zx`MSA-noD&9XPlsC@P(9Iu`H+1Prf_MX z!Prb<^v43d_qKJ`iiIKNqhXHTZR;GD&v$^0R`^`w%78Pl>B=eHEHVFC4Gg(3Kbgel zNC2g03l1RK)Erbv0j9O>;9CwUI#O+r-8!;Dpah zNWd?Rkl>xc;2!~|!*2V+x8k=7?*xMK5$%qw=Vb_QYb(W?iaUb`f36P4NLF~ihmv~_=?h~N%8UeF=eHVn*xe;I`_Qx6sVJ=p-96?iBR^58dan5}P{gEdzB+y&Q` zUuqyR`sX?N&vhM<%J-4jzK21}`>@p8o9+z0&S2LSLDEV9n4!3ub2Q77U%|hC$30|= z`f487iN*m{WFcz*NQueR^w1i6)Rg^dzSfT^)!AF!VKvWs^X4Zb7Kr z!h)GQf_Dld{_B4pnc4D^06ipUvQqk-7o&Awk){;V7aJ{&Ly(7TcV!!!p3*=93$K~f^l*KU=+1xng=xEH3-H`Y2PH!*m#7{{_uD*E} zM|;xc^J`#qGEI1JDIMC=I1e)RCTooc=AZxE1<^TYVZ%HQ+XKnvq{M@2)>kSe9SlOl zMsa$Jt>60WF<@-oUe$L+M=8@!n+I0^sO?&&WA(X5R!_1cNR=~h6FS2NBUZOJt%2Z< zF;fOaA(mmIFVsh(01GOY2<|HA@qk}bKLO0qC13s6{gyxGN>?0!XA~h%SQ+j=iB0%dicq;y+L}kU%{Kw9K}4o$#TU z=-KML%p(`$^QPjqs`x6^{1nFMJR)VJ!Ky*l`#AEQ$^&^|!{WcnT67x1gvZlBmT`#lf2(g{FpJLb6e(?Flk zt09vbkUH8aXM+y@zxqUtS_?wg~jg#?Z_>?Z3@ZH_5)7oe=&0Y1(OHc(T?8+ zCg9D6NdLB*@ORq-`v3oje)V$wYEAjSHFSUU*@GR~42be!QPtE<bJ7<8KVcCA#L7qS{9N3dS;u=PKf)NY%_54Kl*{4za!s3y|_{N zM@I~4x*2I3TsH6(hnX~zkKXx{(sP7QnbTr~0do_Bh;+k&uTdt+Sx^b5!2FXR?|c^l zIY;pMauReSg$Mhsg8dA@?|OK*g8bk>bs|8|Fax;RHQ@0&2$Un6;4d3NxYpep00KEG zNN*14)OpFf#@NBbOU*B~fcH_si3mg@UKC(OE$9d`dM`jY0N%^#(vwfG1KCJ>4BW(V zCg{#4!?x)J2>6co3Fn;yzq3u%Y6Yj@NwG^7AixfLdMIv6QD-N{==-j39Mo>CO6d0x z^^t&_kyF7z6RZB^Vvea-?8eVtZCn*EHO@tD9t79l(ONkBsIXC1S7yRkf}}Fo@<12o zSta#mL)lnr)l(GVjSLKo>+$B*zF${P(n)?=?oO<)2ESxhg1^La3ZEpb1D`f#eP#_b z@SchG`*)Jw>RXzsaf5b^vRu<+B!kQkj+Rr;ZXF3-X^w!;8cDnwYjgCgp{?m05teXn zMSa?Yd48Jtf|u5xy?MqaS*f;Rk03fC00m8(^@O2eWRU}BfjaEpjn2dwn*t;*-5&up zun!zzy=URb6!WeraG&wz@t0Hi<)+mDa3ZER6Uby5*Td#oe$SqzW9di0$88lU`03xq+Bk7K=Z@6(?uvRwLZ>A zAJEzE4*CuNAJX?KK=s5#$B7=VZc+bC1Aecf8Yfs}HM7vd^!*#wBLc=9nw7;MrElp5 z9+SVD$Wv{pY-$Ip=2~u{wa`SPiOCHgGAa6MD%(khCPyvPAQlhT?ynR_jVx~1EtzzP zNx}msaYUX}&upzL4KFi`YnS`LIcJ~!yV^yl0oK1QKq`|}%FK*1^|g!*v6Pg?{7a|% z&yb)+oDx$omiJsR?hfw(+fy^;EG7Z*w(fJR7Q*HrLiA4jz=v~#kNk2YJkJSosH0*c|Le-MDR$?W|@R} zG6^+t#mIW3*cc&`4PLl^lOuO%g0+c~1V%6kNW&|xXJT!H>!+P+2Hpz<)w`U$b@KY5 zIcR0B-Hl1qVQDD=ke0s0yxQVT@O+(JJufcM!>0W|4YWEBfl*~2*7%HnP4v}(1xYNl zhe;`Ey2eSL@w={?0!%QXa`KAGNSO2g?hIcYy{C#t;FC1>gTT{6DjfD%hU?*&M* zR?8s2D%XD9s}z_XrpuRUHF>;^pfU2l~c|p5~;082AXzbs+(c_mr>|^FVFU} zWW7N)VNr?MF88i;Ua40hZof?o{l6ZToC(_6<7Je#IjBUQcZ<365KK72O6DPRI)0Qs zst|D(#GlK;CQUxXY@6Z=#6^Jd_RW~aT~?=-lEwg>qCT(FA_NrG zsEbXb(fav4kgwEryJF4-{)a)prJz3+>?=c5q~8A%{|AgF|4g6lwfoYsF!>Ao0J4YR zbN@70Y9~dI+iN#1a6r1_;A|oEjvsHR(V=f%E%cve)%zZB}C572Un_87LnU|O8{7&*jrh@{?&mHQ>{e4QnTMDE?LGS{uzl5D# zLWFQbtvQ;sgZDB^@GAn>eFmg)>p|*eJ7Egspuh@hd*JAO=yZ2TyVgHI0%C@W*74ng+R6W5fq`1aRlTr0$r0(R`vb;JQY7a# z-P3EEbRe%^01w&N)sp0Zr`wXc%Rkb7nbFPw6WMTJM)3WG%}$#&QP!@O&*(fVHYc-? zUt%y$V%<&L=n{R~p-G!dGitNv_(I^?n(tBulmn7AOf_7t!wpLIrW(Kg&iw+{Cv_YM1517n4VtImBuH{&YjCvJAbSh-BoW4Wcn z%vi@j^@O>=r~Q26nV#oaQ&LwI+{*l`E4|ipRM+~~Qg;6r*Ex@P(p0}=ii+*3ud{MN z)9Rs%x@vYhcF)cAGh&N48KXlHE~CXcjT>A52*%J!8n)9$GaXRXz>)$z$U|cWC_N*y zQhpywSMYj6+k5SDvq|jAXDLS+Ad6SNvvvYC=-Km7a~!e7DGGuPdsL*)bs=R#&Bqx9 zi)XkI#9+OS)Nvlj7XT~xH%w0|3IMq>F*^Lyixo7|)?OXg(7d`V1zi3kE))BBR3>zJ zp4#H}3OK!M&w|6?G*=DdWG-CmX=qz;V=ptuvgYgtz_7lr&4s=1MNzY#Ux}o4m`%sO zv|2H8OMPAXq(dUTN_^c`&Zi*{as_aR{}Dj3r%<*!sbWBCQItMto-hz*yh^P*X(0wN z0{gk+iI4HKCmLJz$vPTnQ>i4^2D|5-mw_?)lD_6Sfn*O3TU1;s+sZ(kb2Z<2&zn!B zzqDUy9Q$CHy~+d(Mp3A>jtYpna4Zom$w^9syd0d6X}oiyVf3$eAKXQJU;lF!DEsjm<{!> zQSr);kumYq>Z8Qbm!@%GZBy~GT?QyXIr{|7O9WEv4V=vceHE(-`E08&lOYS0 zEWP^gzRWYC9jVK{c8#9)vDci!#;YCC(7XF}A- znq6{62{Tl8$(=q_n5yO3;vKZgHym^b;&~Np$o^sjW$%U@kmn+)`Yop77VWt?;sJ-p z1StR7RRH0z*l{)yUhq1rvZ>CC8Sj$ABH&#uPbkK(sxRK*Ur;~1j`!C#604O}Kcha} zuNOyHb-_RlVx>zwCEW(sVL#;eL2CX%IYz$5&th2uZl0C-w9r3ogkb=d0-(CfhlO1h z!XrA~s}`6#mRDR>r{VHAZ-bBy!jx9W0l5Uf0j`affHCRxxB_P60(w}T&`7_SA~=h( zymY-?DEYN&k$9Q0c1>=A7`@p#!+4_w&k&g2X#W-TbP0(hkZ?f1HO5JRNvpiqd!|Et zQfPD~PVdx-5R#)sr{B`^MUJaZF{HR@lS-IIjV|pnuq?&w?+PW#i{5xZG}FPD>@6a) zElP!3-@Gy@zJ}AI1-R?Y`3D*z`dB+AKdr!7-nQkMPe0@c`4*3=n>u<@s#;dneA9k6 zS)~Ri7C?Kr!R0I9U7}yB{Rpm?S+c7Rqr;FybEWHEn|$RJ=*qY>1nR z0$`F$H!6GKb$tK?*ZOv_w9bx%m>keL6Dc$1b4mnshK!o@e9h)C01U)#keA&Pg@#a5$WUsveVf2 z0JH0tvPq2bXbT%S1I?9qrF>jbjXgTaXq?7`==XY(1AR?0Up#M4DZ`JwNf%JfF5z(z zi_smAv06kfDIXj$&ftZv6O82VJs9+ztFI)Jx^Vsb&e}-H9@Aw(o-9jAdL?D^N+h`!u|cd67hXgx{!pw->eS8&4N<#v3w zuqs4-ivDJxW0yDt^_e85x3Y@>A>b|uFeUoi%S#=)F$u!vNy@xE@SKcow9lvmnAw5G z1ZsH{EU3G_QHBOLH=5kiXjmIpdaWss&jgU(-PdxC+~v<3zMtpo-q1ajyTTw3gbwe{ zeDHutuA4?pa5T5nIQf}b_p$fcm!WU8^*+9_k$HkW8qHWHo}+4~@*b6M@fdS1J-&@N z!;egvsl(N61pZ(Z{eW$EiT3%tW>?)RBv{ucctyO=#jkvTe7JI8uKq{Ihy~@VWy4zK zNzBPJ*iM_O#?5=fn-$)nt1Nl(g`slAQsNR#;7jMq&F*h}e-9_^w#g#JDG`c0?-Ara zUch=cu54Q9wk>q8O_u_QnCASD_MZELexUa8o#p!&?om1I{m4%d?IN`QtG#QFOY+>~ zG*5Y&Yc99N)YLZD+VZw?N{XhdO|z!v%3K;+(M-voR<( zL~T_Wg!x`$I{3;p?G$6-qYCl2je4Y&y(#Crpdk!Ujho*NgtR+Uv7hnFyk{W9^-ZfT zFn5G8PE<)xYxi-x%z^E7^WACvad^8T#hf%NVLFYlYmrS;tI&->Mt4jr1#eu5mi3nx zLK-|fkX|hIBE)jF#$6P$aK$b>Ez<3>gQ67$TEk!{4!FF;mjI_V6@oV_>2vI1XQO%$ zoRLaon9fBB@S+&c2VRt*>Qoo(!V*=;B8WE2PpdzOso>-w`U5>hts~=pE^$Lk`hl^N zp}cjl)UjWCIwo$7bL-T4>Y$HY?IX-1CtfU2Hn_HAawUi1!qZ0(k|NZ6-webcsJNoj zp1AFENP;vm#e2Fi^0`6V?4z$GMX$k{Vn&9_787D8Im=;im`SqUbYJ#}M#`ov`yt+B z8KY@e9VG9p756I(vM?uQh};+9ys}3X-MBS*b`X3^z1DNRrx+s+br9`buvnILM-gGw zNxjprP!bliasxe+IxR8_K}5>J7_gfH!B2J-OY8H!-`6l3dm|Kq~%#6{fq&n)f?^5(;S*;p%+ zY?}$zWaxh_>-8WjN^+AxhTVf;1K-)xOr4gSTS&Fb9-4}dFfXuyg+vmT2d_5y)-Rz9 zR;n(KK+$e7UsSQQWdc*UgX2r!GiLTTZaDCBb%cDOZIU((6@wDI=pK09oGexGG^TI( zg3ruU*XB^xFszRW;-(9j>~+dwapu4uYo~Rh@3F}A)&=Zndn^yj(>Vx7?A*4=k7NHa zq?bjIcKE5J480(qnDuR#=n}nfyHew5j&-aT-|AD#11<(@Tni4s(V;j;@aV(2$SihU z#F5VS>D?7MWD&a#mDMQ`o8|N_WoN*df_?f9$G2}2>qGEU=Gc(YPRnBGIPb2w`NNvS z+Va9LDMZ?~_cEtbUJvPQ93HQvE8RPDO;f3O-Rx|lH(A{(3iS#+=8?v?y_q3%x8X}t z#-`)N;|DKSrL%DP$VSL-u<)*?cWW#JJ~jG0R8aabsV3RJmLPlHD|p81#-TAAqLqEw z#X z`;Z=d!A*m~26OL`d&+$AE6}5q>r_2~Ar}|?mN0l9-|Al__=!xmI+k7!{&vRYvxzXpn^b9mQ=kl3}TWHy< zqtap>vpC%dWjceb-u|r@?aeRsP0@=k*I3+LSnpwSiK+df?nnvwk(pb+53-V5_hx!& z7MVs6F_Gk;>`P8VZf^W5k}ud=Z|wPlH##e3M694j7wP1Z6%QLn`Sqal?I#}YQ}v(5 zjGYJ*bwwuE(UHr#$2`0X^1mrk`q+m*&`%{tSL?9Ij$YktkNuLdI|4%|^+G;zug$yh zdzvoQ?_S_aYz+sJLE>rxIICIsChyf+9dDd;7anI=Z2k3cXaGe}d+*sZTtF_Rd}&t! zA(|BabobLOYsZ>}j_2Cz*Hvhw0aUE!RiYM$nzWI2 zIL%M-iP0<4=2=6ok~2qGYP8{&H#NT#+`c21kgyy+WIWPfiBxzo(|3Qxyn;+9pz>w+ z?1BSAUd>9BIPiQMtAvhAmhinW#s~{{K-&Exx7)e_sJU*)!MQV@@1qeD_|OG*&Y}gVKt`@T(rJeEF!8Lz zh5pU**8PXlOus|pzw#k29t#ePv8usI!76~rQ7&^pcl(pPmkUr0ALx%+dJN73CZpBE z0UGgFFT{_JEV>;f{ZtvmB-PK5efcI!H`VuV&*#;8?|BEwiSL)>Lp0TkZ4R?PMtXMR z7%}1vkeq{@)LQLGoUks+30F=Ys#G@r7}gO@n7!#=N{lP1PZ)WMAIHC6*!BAWV}kQ- zZUsl}Yu861CQ{bbZGsRcAwTtajohV$ z=^%Jj-LNSgGd1qk&(;dWR8aX17&EJGS1f4%;yuwHgfmJcJMvd|BfHSv?gboLs-L&j zv-08i77IiERzVG?8w^vX3pLUQXO3ZQ3u<$s(iLLE6l8Mve z4_>_E>VNhmqC-m!&q&Z+kC#WQ+$HyOvD3_j`kfl5VAxdT0ypp~5lLPSonY0kjRM}L zpvF1}A-^8yZ&%}mg3==1-JN(bKm%X!Xoe8Nt^`@mvMH0ZA$q4Q!~nadagN5gJX@RhnQhXM^9nb4hi} z?Um;2T~~G3s_l@7^m6p|wK|bMo-KXtmmglEp?tHRTq(W9!jby=_A|yDKrc@|VBEvp z3#J&`9tQix+y)ymzjn-v0`9y7P^hF@K`5y{X#Y1xvi6tazZmKQ zg9q5Yc;&1@i*8}N?gFLoEcIj7Ru81N4 zeShA3Ba9+@(iAYGoPSy@=UBrWH^GH;+cphPX)-n{p~orbD9Lw#qBq*U1cmtY-x$!# zDeBL`t(i^Mkck^9t7oGp0I;k1*2_`zM>Guj*8he7nI!yYw=`tfSo><(W|%QZl`C@Y zP)i?QPSu7Fv6B!j1CQ#0ncxAa8%h#dAZTnYBx?XE4@jjYN#LQuu@KfdMwXHmgqLRk z5+eswISAG|3P|Rg$)yQ%jQ3Z_nX7sw>0!#33~fGbg)w%$WN&}Ip@WpLpw3~pl)3b6 Rbk%@YkI%h6E8lbc@^2X=O+Eks From 6c1f66d7d219737daba6c959b5552a64bd8c7f72 Mon Sep 17 00:00:00 2001 From: John Liu <49762389+ShenLanJohn@users.noreply.github.com> Date: Fri, 6 Sep 2019 18:16:57 -0700 Subject: [PATCH 49/49] CAT Auto Pulish for Windows Release Messages - CAT_AutoPublish_20190906173611 (#1061) --- .../resolved-issues-windows-10-1607.yml | 6 +++--- .../resolved-issues-windows-10-1703.yml | 6 +++--- .../resolved-issues-windows-10-1709.yml | 6 +++--- .../resolved-issues-windows-10-1803.yml | 6 +++--- ...-issues-windows-10-1809-and-windows-server-2019.yml | 6 +++--- .../resolved-issues-windows-10-1903.yml | 10 +++++----- .../status-windows-10-1607-and-windows-server-2016.yml | 6 +++--- windows/release-information/status-windows-10-1703.yml | 6 +++--- windows/release-information/status-windows-10-1709.yml | 6 +++--- windows/release-information/status-windows-10-1803.yml | 6 +++--- .../status-windows-10-1809-and-windows-server-2019.yml | 6 +++--- windows/release-information/status-windows-10-1903.yml | 10 +++++----- 12 files changed, 40 insertions(+), 40 deletions(-) diff --git a/windows/release-information/resolved-issues-windows-10-1607.yml b/windows/release-information/resolved-issues-windows-10-1607.yml index 08b49123c4..6f92dbe2b1 100644 --- a/windows/release-information/resolved-issues-windows-10-1607.yml +++ b/windows/release-information/resolved-issues-windows-10-1607.yml @@ -32,9 +32,9 @@ sections: - type: markdown text: "

+ - @@ -80,9 +80,9 @@ sections: - type: markdown text: "
SummaryOriginating updateStatusDate resolved
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

See details >		OS Build 14393.3115

July 16, 2019
KB4507459		Resolved
KB4512517		August 13, 2019
10:00 AM PT
Devices starting using PXE from a WDS or SCCM servers may fail to start
Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

See details >		OS Build 14393.3025

June 11, 2019
KB4503267		Resolved
KB4512495		August 17, 2019
02:00 PM PT
Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
Applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and VBScript may stop responding and you may receive an error.

See details >		OS Build 14393.3144

August 13, 2019
KB4512517		Resolved
KB4512495		August 17, 2019
02:00 PM PT
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

See details >		OS Build 14393.3115

July 16, 2019
KB4507459		Resolved
KB4512517		August 13, 2019
10:00 AM PT
Internet Explorer 11 and apps using the WebBrowser control may fail to render
JavaScript may fail to render as expected in Internet Explorer 11 and in apps using JavaScript or the WebBrowser control.

See details >		OS Build 14393.3085

July 09, 2019
KB4507460		Resolved
KB4512517		August 13, 2019
10:00 AM PT
MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on Windows devices that installed updates on June 11, 2019 or later.

See details >		OS Build 14393.3025

June 11, 2019
KB4503267		Resolved External
August 09, 2019
07:03 PM PT
SCVMM cannot enumerate and manage logical switches deployed on the host
For hosts managed by System Center Virtual Machine Manager (VMM), VMM cannot enumerate and manage logical switches deployed on the host.

See details >		OS Build 14393.2639

November 27, 2018
KB4467684		Resolved
KB4507459		July 16, 2019
10:00 AM PT
+ -
DetailsOriginating updateStatusHistory
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4507459. Devices that are domain controllers or domain members are both affected.

To safeguard your update experience, we have applied a compatibility hold on devices configured to use MIT Kerberos realm from being offered Windows 10, version 1903 or Windows Server, version 1903.

Note If you are not sure if your device is affected, contact your administrator. Advanced users can check for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos or check if this registry key exists:
HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms
+

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
Resolution: This issue was resolved in KB4512517 and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to offered Windows 10, version 1903 or Windows Server, version 1903.

Back to top		OS Build 14393.3115

July 16, 2019
KB4507459		Resolved
KB4512517		Resolved:
August 13, 2019
10:00 AM PT

Opened:
July 25, 2019
06:10 PM PT
Devices starting using PXE from a WDS or SCCM servers may fail to start
Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) or System Center Configuration Manager (SCCM) may fail to start with the error \"Status: 0xc0000001, Info: A required device isn't connected or can't be accessed\" after installing KB4503267 on a WDS server.

Affected platforms:
  • Server: Windows Server 2008 SP2; Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server, version 1803; Windows Server 2019; Windows Server, version 1809; Windows Server, version 1903
Resolution: This issue was resolved in KB4512495.

Back to top		OS Build 14393.3025

June 11, 2019
KB4503267		Resolved
KB4512495		Resolved:
August 17, 2019
02:00 PM PT

Opened:
July 10, 2019
02:51 PM PT
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4507459. Devices that are domain controllers or domain members are both affected.

To safeguard your update experience, we have applied a compatibility hold on devices configured to use MIT Kerberos realm from being offered Windows 10, version 1903 or Windows Server, version 1903.

Note If you are not sure if your device is affected, contact your administrator. Advanced users can check for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos or check if this registry key exists:
HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms
-

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
Resolution: This issue was resolved in KB4512517. To safeguard your upgrade experience, the compatibility hold on devices from being offered Windows 10, version 1903 or Windows Server, version 1903 is still in place. Once the issue is addressed on Windows 10, version 1903, this safeguard hold will be removed for all affected platforms. Check the Windows 10, version 1903 section of the release information dashboard for the most up to date information on this and other safeguard holds.

Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until this issue has been resolved.

Back to top		OS Build 14393.3115

July 16, 2019
KB4507459		Resolved
KB4512517		Resolved:
August 13, 2019
10:00 AM PT

Opened:
July 25, 2019
06:10 PM PT
Internet Explorer 11 and apps using the WebBrowser control may fail to render
Internet Explorer 11 may fail to render some JavaScript after installing KB4507460. You may also have issues with apps using JavaScript or the WebBrowser control, such as the present PowerPoint feature of Skype Meeting Broadcast.

Affected platforms:
  • Client: Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
  • Server: Windows Server 2016
Resolution: This issue was resolved in KB4512517.

Back to top		OS Build 14393.3085

July 09, 2019
KB4507460		Resolved
KB4512517		Resolved:
August 13, 2019
10:00 AM PT

Opened:
July 26, 2019
04:58 PM PT
" diff --git a/windows/release-information/resolved-issues-windows-10-1703.yml b/windows/release-information/resolved-issues-windows-10-1703.yml index 22ddb295df..582aec0f1a 100644 --- a/windows/release-information/resolved-issues-windows-10-1703.yml +++ b/windows/release-information/resolved-issues-windows-10-1703.yml @@ -32,8 +32,8 @@ sections: - type: markdown text: " + - @@ -71,8 +71,8 @@ sections: - type: markdown text: "
SummaryOriginating updateStatusDate resolved
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

See details >		OS Build 15063.1955

July 16, 2019
KB4507467		Resolved
KB4512507		August 13, 2019
10:00 AM PT
Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
Applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and VBScript may stop responding and you may receive an error.

See details >		OS Build 15063.1988

August 13, 2019
KB4512507		Resolved
KB4512474		August 17, 2019
02:00 PM PT
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

See details >		OS Build 15063.1955

July 16, 2019
KB4507467		Resolved
KB4512507		August 13, 2019
10:00 AM PT
MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on Windows devices that installed updates on June 11, 2019 or later.

See details >		OS Build 15063.1868

June 11, 2019
KB4503279		Resolved External
August 09, 2019
07:03 PM PT
Devices with Hyper-V enabled may receive BitLocker error 0xC0210000
Some devices with Hyper-V enabled may start into BitLocker recovery with error 0xC0210000.

See details >		OS Build 15063.1805

May 14, 2019
KB4499181		Resolved
KB4507450		July 09, 2019
10:00 AM PT
Difficulty connecting to some iSCSI-based SANs
Devices may have difficulty connecting to some Storage Area Network (SAN) devices that leverage iSCSI.

See details >		OS Build 15063.1839

May 28, 2019
KB4499162		Resolved
KB4509476		June 26, 2019
04:00 PM PT
- +
DetailsOriginating updateStatusHistory
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4507467. Devices that are domain controllers or domain members are both affected.

To safeguard your update experience, we have applied a compatibility hold on devices configured to use MIT Kerberos realm from being offered Windows 10, version 1903 or Windows Server, version 1903.

Note If you are not sure if your device is affected, contact your administrator. Advanced users can check for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos or check if this registry key exists:
HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms
-

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
Resolution: This issue was resolved in KB4512507. To safeguard your upgrade experience, the compatibility hold on devices from being offered Windows 10, version 1903 or Windows Server, version 1903 is still in place. Once the issue is addressed on Windows 10, version 1903, this safeguard hold will be removed for all affected platforms. Check the Windows 10, version 1903 section of the release information dashboard for the most up to date information on this and other safeguard holds.

Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until this issue has been resolved.

Back to top		OS Build 15063.1955

July 16, 2019
KB4507467		Resolved
KB4512507		Resolved:
August 13, 2019
10:00 AM PT

Opened:
July 25, 2019
06:10 PM PT
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4507467. Devices that are domain controllers or domain members are both affected.

To safeguard your update experience, we have applied a compatibility hold on devices configured to use MIT Kerberos realm from being offered Windows 10, version 1903 or Windows Server, version 1903.

Note If you are not sure if your device is affected, contact your administrator. Advanced users can check for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos or check if this registry key exists:
HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms
+

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
Resolution: This issue was resolved in KB4512507 and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to offered Windows 10, version 1903 or Windows Server, version 1903.

Back to top		OS Build 15063.1955

July 16, 2019
KB4507467		Resolved
KB4512507		Resolved:
August 13, 2019
10:00 AM PT

Opened:
July 25, 2019
06:10 PM PT
" diff --git a/windows/release-information/resolved-issues-windows-10-1709.yml b/windows/release-information/resolved-issues-windows-10-1709.yml index 9bf77f7d45..0cdbe87fcb 100644 --- a/windows/release-information/resolved-issues-windows-10-1709.yml +++ b/windows/release-information/resolved-issues-windows-10-1709.yml @@ -32,9 +32,9 @@ sections: - type: markdown text: " + - @@ -73,9 +73,9 @@ sections: - type: markdown text: "
SummaryOriginating updateStatusDate resolved
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

See details >		OS Build 16299.1296

July 16, 2019
KB4507465		Resolved
KB4512516		August 13, 2019
10:00 AM PT
Devices starting using PXE from a WDS or SCCM servers may fail to start
Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

See details >		OS Build 16299.1217

June 11, 2019
KB4503284		Resolved
KB4512494		August 16, 2019
02:00 PM PT
Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
Applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and VBScript may stop responding and you may receive an error.

See details >		OS Build 16299.1331

August 13, 2019
KB4512516		Resolved
KB4512494		August 16, 2019
02:00 PM PT
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

See details >		OS Build 16299.1296

July 16, 2019
KB4507465		Resolved
KB4512516		August 13, 2019
10:00 AM PT
MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on Windows devices that installed updates on June 11, 2019 or later.

See details >		OS Build 16299.1217

June 11, 2019
KB4503284		Resolved External
August 09, 2019
07:03 PM PT
Difficulty connecting to some iSCSI-based SANs
Devices may have difficulty connecting to some Storage Area Network (SAN) devices that leverage iSCSI.

See details >		OS Build 16299.1182

May 28, 2019
KB4499147		Resolved
KB4509477		June 26, 2019
04:00 PM PT
Event Viewer may close or you may receive an error when using Custom Views
When trying to expand, view or create Custom Views in Event Viewer, you may receive an error and the app may stop responding or close.

See details >		OS Build 16299.1217

June 11, 2019
KB4503284		Resolved
KB4503281		June 18, 2019
02:00 PM PT
+ -
DetailsOriginating updateStatusHistory
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4507465. Devices that are domain controllers or domain members are both affected.

To safeguard your update experience, we have applied a compatibility hold on devices configured to use MIT Kerberos realm from being offered Windows 10, version 1903 or Windows Server, version 1903.

Note If you are not sure if your device is affected, contact your administrator. Advanced users can check for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos or check if this registry key exists:
HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms
+

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
Resolution: This issue was resolved in KB4512516 and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to offered Windows 10, version 1903 or Windows Server, version 1903.

Back to top		OS Build 16299.1296

July 16, 2019
KB4507465		Resolved
KB4512516		Resolved:
August 13, 2019
10:00 AM PT

Opened:
July 25, 2019
06:10 PM PT
Devices starting using PXE from a WDS or SCCM servers may fail to start
Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) or System Center Configuration Manager (SCCM) may fail to start with the error \"Status: 0xc0000001, Info: A required device isn't connected or can't be accessed\" after installing KB4503284 on a WDS server.

Affected platforms:
  • Server: Windows Server 2008 SP2; Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server, version 1803; Windows Server 2019; Windows Server, version 1809; Windows Server, version 1903
Resolution: This issue was resolved in KB4512494.

Back to top		OS Build 16299.1217

June 11, 2019
KB4503284		Resolved
KB4512494		Resolved:
August 16, 2019
02:00 PM PT

Opened:
July 10, 2019
02:51 PM PT
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4507465. Devices that are domain controllers or domain members are both affected.

To safeguard your update experience, we have applied a compatibility hold on devices configured to use MIT Kerberos realm from being offered Windows 10, version 1903 or Windows Server, version 1903.

Note If you are not sure if your device is affected, contact your administrator. Advanced users can check for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos or check if this registry key exists:
HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms
-

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
Resolution: This issue was resolved in KB4512516. To safeguard your upgrade experience, the compatibility hold on devices from being offered Windows 10, version 1903 or Windows Server, version 1903 is still in place. Once the issue is addressed on Windows 10, version 1903, this safeguard hold will be removed for all affected platforms. Check the Windows 10, version 1903 section of the release information dashboard for the most up to date information on this and other safeguard holds.

Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until this issue has been resolved.

Back to top		OS Build 16299.1296

July 16, 2019
KB4507465		Resolved
KB4512516		Resolved:
August 13, 2019
10:00 AM PT

Opened:
July 25, 2019
06:10 PM PT
" diff --git a/windows/release-information/resolved-issues-windows-10-1803.yml b/windows/release-information/resolved-issues-windows-10-1803.yml index f6b4c85fb6..174aa6ebe6 100644 --- a/windows/release-information/resolved-issues-windows-10-1803.yml +++ b/windows/release-information/resolved-issues-windows-10-1803.yml @@ -32,10 +32,10 @@ sections: - type: markdown text: " + - @@ -83,9 +83,9 @@ sections: - type: markdown text: "
SummaryOriginating updateStatusDate resolved
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

See details >		OS Build 17134.915

July 16, 2019
KB4507466		Resolved
KB4512501		August 13, 2019
10:00 AM PT
Notification issue: \"Your device is missing important security and quality fixes.\"
Some users may have incorrectly received the notification \"Your device is missing important security and quality fixes.\"

See details >		N/A

Resolved
September 03, 2019
12:32 PM PT
Devices starting using PXE from a WDS or SCCM servers may fail to start
Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

See details >		OS Build 17134.829

June 11, 2019
KB4503286		Resolved
KB4512509		August 19, 2019
02:00 PM PT
Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
Applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and VBScript may stop responding and you may receive an error.

See details >		OS Build 17134.950

August 13, 2019
KB4512501		Resolved
KB4512509		August 19, 2019
02:00 PM PT
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

See details >		OS Build 17134.915

July 16, 2019
KB4507466		Resolved
KB4512501		August 13, 2019
10:00 AM PT
MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on Windows devices that installed updates on June 11, 2019 or later.

See details >		OS Build 17134.829

June 11, 2019
KB4503286		Resolved External
August 09, 2019
07:03 PM PT
Difficulty connecting to some iSCSI-based SANs
Devices may have difficulty connecting to some Storage Area Network (SAN) devices that leverage iSCSI.

See details >		OS Build 17134.799

May 21, 2019
KB4499183		Resolved
KB4509478		June 26, 2019
04:00 PM PT
Event Viewer may close or you may receive an error when using Custom Views
When trying to expand, view or create Custom Views in Event Viewer, you may receive an error and the app may stop responding or close.

See details >		OS Build 17134.829

June 11, 2019
KB4503286		Resolved
KB4503288		June 18, 2019
02:00 PM PT
+ -
DetailsOriginating updateStatusHistory
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4507466. Devices that are domain controllers or domain members are both affected.

To safeguard your update experience, we have applied a compatibility hold on devices configured to use MIT Kerberos realm from being offered Windows 10, version 1903 or Windows Server, version 1903.

Note If you are not sure if your device is affected, contact your administrator. Advanced users can check for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos or check if this registry key exists:
HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms
+

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
Resolution: This issue was resolved in KB4512501 and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to offered Windows 10, version 1903 or Windows Server, version 1903.

Back to top		OS Build 17134.915

July 16, 2019
KB4507466		Resolved
KB4512501		Resolved:
August 13, 2019
10:00 AM PT

Opened:
July 25, 2019
06:10 PM PT
Devices starting using PXE from a WDS or SCCM servers may fail to start
Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) or System Center Configuration Manager (SCCM) may fail to start with the error \"Status: 0xc0000001, Info: A required device isn't connected or can't be accessed\" after installing KB4503286 on a WDS server.

Affected platforms:
  • Server: Windows Server 2008 SP2; Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server, version 1803; Windows Server 2019; Windows Server, version 1809; Windows Server, version 1903
Resolution: This issue was resolved in KB4512509.

Back to top		OS Build 17134.829

June 11, 2019
KB4503286		Resolved
KB4512509		Resolved:
August 19, 2019
02:00 PM PT

Opened:
July 10, 2019
02:51 PM PT
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4507466. Devices that are domain controllers or domain members are both affected.

To safeguard your update experience, we have applied a compatibility hold on devices configured to use MIT Kerberos realm from being offered Windows 10, version 1903 or Windows Server, version 1903.

Note If you are not sure if your device is affected, contact your administrator. Advanced users can check for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos or check if this registry key exists:
HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms
-

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
Resolution: This issue was resolved in KB4512501. To safeguard your upgrade experience, the compatibility hold on devices from being offered Windows 10, version 1903 or Windows Server, version 1903 is still in place. Once the issue is addressed on Windows 10, version 1903, this safeguard hold will be removed for all affected platforms. Check the Windows 10, version 1903 section of the release information dashboard for the most up to date information on this and other safeguard holds.

Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until this issue has been resolved.

Back to top		OS Build 17134.915

July 16, 2019
KB4507466		Resolved
KB4512501		Resolved:
August 13, 2019
10:00 AM PT

Opened:
July 25, 2019
06:10 PM PT
" diff --git a/windows/release-information/resolved-issues-windows-10-1809-and-windows-server-2019.yml b/windows/release-information/resolved-issues-windows-10-1809-and-windows-server-2019.yml index 99b8f5966a..81e2a0f077 100644 --- a/windows/release-information/resolved-issues-windows-10-1809-and-windows-server-2019.yml +++ b/windows/release-information/resolved-issues-windows-10-1809-and-windows-server-2019.yml @@ -32,9 +32,9 @@ sections: - type: markdown text: " + - @@ -82,9 +82,9 @@ sections: - type: markdown text: "
SummaryOriginating updateStatusDate resolved
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

See details >		OS Build 17763.652

July 22, 2019
KB4505658		Resolved
KB4511553		August 13, 2019
10:00 AM PT
Devices starting using PXE from a WDS or SCCM servers may fail to start
Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

See details >		OS Build 17763.557

June 11, 2019
KB4503327		Resolved
KB4512534		August 17, 2019
02:00 PM PT
Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
Applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and VBScript may stop responding and you may receive an error.

See details >		OS Build 17763.678

August 13, 2019
KB4511553		Resolved
KB4512534		August 17, 2019
02:00 PM PT
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

See details >		OS Build 17763.652

July 22, 2019
KB4505658		Resolved
KB4511553		August 13, 2019
10:00 AM PT
MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on Windows devices that installed updates on June 11, 2019 or later.

See details >		OS Build 17763.557

June 11, 2019
KB4503327		Resolved External
August 09, 2019
07:03 PM PT
Difficulty connecting to some iSCSI-based SANs
Devices may have difficulty connecting to some Storage Area Network (SAN) devices that leverage iSCSI.

See details >		OS Build 17763.529

May 21, 2019
KB4497934		Resolved
KB4509479		June 26, 2019
04:00 PM PT
Devices with Realtek Bluetooth radios drivers may not pair or connect as expected
Devices with some Realtek Bluetooth radios drivers, in some circumstances, may have issues pairing or connecting to devices.

See details >		OS Build 17763.503

May 14, 2019
KB4494441		Resolved
KB4501371		June 18, 2019
02:00 PM PT
+ -
DetailsOriginating updateStatusHistory
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4505658. Devices that are domain controllers or domain members are both affected.

To safeguard your update experience, we have applied a compatibility hold on devices configured to use MIT Kerberos realm from being offered Windows 10, version 1903 or Windows Server, version 1903.

Note If you are not sure if your device is affected, contact your administrator. Advanced users can check for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos or check if this registry key exists:
HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms
+

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
Resolution: This issue was resolved in KB4511553 and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to offered Windows 10, version 1903 or Windows Server, version 1903.

Back to top		OS Build 17763.652

July 22, 2019
KB4505658		Resolved
KB4511553		Resolved:
August 13, 2019
10:00 AM PT

Opened:
July 25, 2019
06:10 PM PT
Devices starting using PXE from a WDS or SCCM servers may fail to start
Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) or System Center Configuration Manager (SCCM) may fail to start with the error \"Status: 0xc0000001, Info: A required device isn't connected or can't be accessed\" after installing KB4503327 on a WDS server.

Affected platforms:
  • Server: Windows Server 2008 SP2; Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server, version 1803; Windows Server 2019; Windows Server, version 1809; Windows Server, version 1903
Resolution: This issue was resolved in KB4512534.

Back to top		OS Build 17763.557

June 11, 2019
KB4503327		Resolved
KB4512534		Resolved:
August 17, 2019
02:00 PM PT

Opened:
July 10, 2019
02:51 PM PT
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4505658. Devices that are domain controllers or domain members are both affected.

To safeguard your update experience, we have applied a compatibility hold on devices configured to use MIT Kerberos realm from being offered Windows 10, version 1903 or Windows Server, version 1903.

Note If you are not sure if your device is affected, contact your administrator. Advanced users can check for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos or check if this registry key exists:
HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms
-

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
Resolution: This issue was resolved in KB4511553. To safeguard your upgrade experience, the compatibility hold on devices from being offered Windows 10, version 1903 or Windows Server, version 1903 is still in place. Once the issue is addressed on Windows 10, version 1903, this safeguard hold will be removed for all affected platforms. Check the Windows 10, version 1903 section of the release information dashboard for the most up to date information on this and other safeguard holds.

Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until this issue has been resolved.

Back to top		OS Build 17763.652

July 22, 2019
KB4505658		Resolved
KB4511553		Resolved:
August 13, 2019
10:00 AM PT

Opened:
July 25, 2019
06:10 PM PT
" diff --git a/windows/release-information/resolved-issues-windows-10-1903.yml b/windows/release-information/resolved-issues-windows-10-1903.yml index e3349d1356..56fb3d90af 100644 --- a/windows/release-information/resolved-issues-windows-10-1903.yml +++ b/windows/release-information/resolved-issues-windows-10-1903.yml @@ -32,12 +32,12 @@ sections: - type: markdown text: " + + - - @@ -74,11 +74,11 @@ sections: - type: markdown text: "
SummaryOriginating updateStatusDate resolved
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

See details >		OS Build 18362.145

May 29, 2019
KB4497935		Resolved
KB4512941		August 30, 2019
10:00 AM PT
Issues updating when certain versions of Intel storage drivers are installed
Certain versions of Intel Rapid Storage Technology (Intel RST) drivers may cause updating to Windows 10, version 1903 to fail.

See details >		OS Build 18362.145

May 29, 2019
KB4497935		Resolved
KB4512941		August 30, 2019
10:00 AM PT
Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
Applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and VBScript may stop responding and you may receive an error.

See details >		OS Build 18362.295

August 13, 2019
KB4512508		Resolved
KB4512941		August 30, 2019
10:00 AM PT
Issues updating when certain versions of Intel storage drivers are installed
Certain versions of Intel Rapid Storage Technology (Intel RST) drivers may cause updating to Windows 10, version 1903 to fail.

See details >		OS Build 18362.145

May 29, 2019
KB4497935		Resolved
KB4512941		August 30, 2019
10:00 AM PT
Initiating a Remote Desktop connection may result in black screen
When initiating a Remote Desktop connection to devices with some older GPU drivers, you may receive a black screen.

See details >		OS Build 18362.145

May 29, 2019
KB4497935		Resolved
KB4512941		August 30, 2019
10:00 AM PT
Windows Sandbox may fail to start with error code “0x80070002”
Windows Sandbox may fail to start with \"ERROR_FILE_NOT_FOUND (0x80070002)\" on devices in which the operating system language was changed between updates

See details >		OS Build 18362.116

May 20, 2019
KB4505057		Resolved
KB4512941		August 30, 2019
10:00 AM PT
Devices starting using PXE from a WDS or SCCM servers may fail to start
Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

See details >		OS Build 18362.175

June 11, 2019
KB4503293		Resolved
KB4512941		August 30, 2019
10:00 AM PT
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

See details >		OS Build 18362.145

May 29, 2019
KB4497935		Resolved
KB4512941		August 30, 2019
10:00 AM PT
MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on Windows devices that installed updates on June 11, 2019 or later.

See details >		OS Build 18362.175

June 11, 2019
KB4503293		Resolved External
August 09, 2019
07:03 PM PT
Display brightness may not respond to adjustments
Microsoft and Intel have identified a driver compatibility issue on devices configured with certain Intel display drivers.

See details >		OS Build 18362.116

May 21, 2019
KB4505057		Resolved
KB4505903		July 26, 2019
02:00 PM PT
RASMAN service may stop working and result in the error “0xc0000005”
The Remote Access Connection Manager (RASMAN) service may stop working and result in the error “0xc0000005” with VPN profiles configured as an Always On VPN connection.

See details >		OS Build 18362.145

May 29, 2019
KB4497935		Resolved
KB4505903		July 26, 2019
02:00 PM PT
- + + -
DetailsOriginating updateStatusHistory
Issues updating when certain versions of Intel storage drivers are installed
Intel and Microsoft have found incompatibility issues with certain versions of the Intel Rapid Storage Technology (Intel RST) drivers and the Windows 10 May 2019 Update (Windows 10, version 1903).  

To safeguard your update experience, we have applied a compatibility hold on devices with Intel RST drivers, versions 15.1.0.1002 through version 15.5.2.1053 installed from installing or being offered Windows 10, version 1903 or Windows Server, version 1903, until the driver has been updated.

Versions 15.5.2.1054 or later are compatible, and a device that has these drivers installed can install the Windows 10 May 2019 Update. For affected devices, the recommended version is 15.9.8.1050.

Affected platforms:
  • Client: Windows 10, version 1903
  • Server: Windows Server, version 1903
Workaround: To mitigate this issue before the safeguard hold is removed, you will need to update the Intel RST drivers for your device to version 15.5.2.1054 or a later.  Check with your device manufacturer (OEM) to see if an updated driver is available and install it. You can also download the latest Intel RST drivers directly from Intel at Intel® Rapid Storage Technology (Intel® RST) User Interface and Driver. Once your drivers are updated, you can restart the installation process for Windows 10, version 1903. Please note, it can take up to 48 hours before you can update to Windows 10, version 1903.

Resolution: This issue was resolved in KB4512941. The safeguard hold is estimated to be removed in early September.

Back to top		OS Build 18362.145

May 29, 2019
KB4497935		Resolved
KB4512941		Resolved:
August 30, 2019
10:00 AM PT

Opened:
July 25, 2019
06:10 PM PT
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4497935. Devices that are domain controllers or domain members are both affected.

To safeguard your update experience, we have applied a compatibility hold on devices configured to use MIT Kerberos realm from being offered Windows 10, version 1903 or Windows Server, version 1903.

Note If you are not sure if your device is affected, contact your administrator. Advanced users can check for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos or check if this registry key exists:
HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms
+

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
Resolution: This issue was resolved in KB4512941 and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to offered Windows 10, version 1903 or Windows Server, version 1903.

Back to top		OS Build 18362.145

May 29, 2019
KB4497935		Resolved
KB4512941		Resolved:
August 30, 2019
10:00 AM PT

Opened:
July 25, 2019
06:10 PM PT
Issues updating when certain versions of Intel storage drivers are installed
Intel and Microsoft have found incompatibility issues with certain versions of the Intel Rapid Storage Technology (Intel RST) drivers and the Windows 10 May 2019 Update (Windows 10, version 1903).  

To safeguard your update experience, we have applied a compatibility hold on devices with Intel RST drivers, versions 15.1.0.1002 through version 15.5.2.1053 installed from installing or being offered Windows 10, version 1903 or Windows Server, version 1903, until the driver has been updated.

Versions 15.5.2.1054 or later are compatible, and a device that has these drivers installed can install the Windows 10 May 2019 Update. For affected devices, the recommended version is 15.9.8.1050.

Affected platforms:
  • Client: Windows 10, version 1903
  • Server: Windows Server, version 1903
Resolution: This issue was resolved in KB4512941 and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to Windows 10, version 1903.

Back to top		OS Build 18362.145

May 29, 2019
KB4497935		Resolved
KB4512941		Resolved:
August 30, 2019
10:00 AM PT

Opened:
July 25, 2019
06:10 PM PT
Initiating a Remote Desktop connection may result in black screen
When initiating a Remote Desktop connection to devices with some older GPU drivers, you may receive a black screen. Any version of Windows may encounter this issue when initiating a Remote Desktop connection to a Windows 10, version 1903 device which is running an affected display driver, including the drivers for the Intel 4 series chipset integrated GPU (iGPU).

Affected platforms:
  • Client: Windows 10, version 1903
  • Server: Windows Server, version 1903
Resolution: This issue was resolved in KB4512941.

Back to top		OS Build 18362.145

May 29, 2019
KB4497935		Resolved
KB4512941		Resolved:
August 30, 2019
10:00 AM PT

Opened:
July 12, 2019
04:42 PM PT
Devices starting using PXE from a WDS or SCCM servers may fail to start
Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) or System Center Configuration Manager (SCCM) may fail to start with the error \"Status: 0xc0000001, Info: A required device isn't connected or can't be accessed\" after installing KB4503293 on a WDS server.

Affected platforms:
  • Server: Windows Server 2008 SP2; Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server, version 1803; Windows Server 2019; Windows Server, version 1809; Windows Server, version 1903
Resolution: This issue was resolved in KB4512941.

Back to top		OS Build 18362.175

June 11, 2019
KB4503293		Resolved
KB4512941		Resolved:
August 30, 2019
10:00 AM PT

Opened:
July 10, 2019
02:51 PM PT
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4497935. Devices that are domain controllers or domain members are both affected.

To safeguard your update experience, we have applied a compatibility hold on devices configured to use MIT Kerberos realm from being offered Windows 10, version 1903 or Windows Server, version 1903.

Note If you are not sure if your device is affected, contact your administrator. Advanced users can check for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos or check if this registry key exists:
HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms
-

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
Resolution: This issue was resolved in KB4512941. The safeguard hold is estimated to be removed in early September.

Back to top		OS Build 18362.145

May 29, 2019
KB4497935		Resolved
KB4512941		Resolved:
August 30, 2019
10:00 AM PT

Opened:
July 25, 2019
06:10 PM PT
" diff --git a/windows/release-information/status-windows-10-1607-and-windows-server-2016.yml b/windows/release-information/status-windows-10-1607-and-windows-server-2016.yml index fb76299a24..da23159b5b 100644 --- a/windows/release-information/status-windows-10-1607-and-windows-server-2016.yml +++ b/windows/release-information/status-windows-10-1607-and-windows-server-2016.yml @@ -60,9 +60,9 @@ sections: - type: markdown text: "
This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

+ - @@ -95,9 +95,9 @@ sections: - type: markdown text: "
SummaryOriginating updateStatusLast updated
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

See details >		OS Build 14393.3115

July 16, 2019
KB4507459		Resolved
KB4512517		August 13, 2019
10:00 AM PT
Devices starting using PXE from a WDS or SCCM servers may fail to start
Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

See details >		OS Build 14393.3025

June 11, 2019
KB4503267		Resolved
KB4512495		August 17, 2019
02:00 PM PT
Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
Applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and VBScript may stop responding and you may receive an error.

See details >		OS Build 14393.3144

August 13, 2019
KB4512517		Resolved
KB4512495		August 17, 2019
02:00 PM PT
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

See details >		OS Build 14393.3115

July 16, 2019
KB4507459		Resolved
KB4512517		August 13, 2019
10:00 AM PT
Internet Explorer 11 and apps using the WebBrowser control may fail to render
JavaScript may fail to render as expected in Internet Explorer 11 and in apps using JavaScript or the WebBrowser control.

See details >		OS Build 14393.3085

July 09, 2019
KB4507460		Resolved
KB4512517		August 13, 2019
10:00 AM PT
MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on Windows devices that installed updates on June 11, 2019 or later.

See details >		OS Build 14393.3025

June 11, 2019
KB4503267		Resolved External
August 09, 2019
07:03 PM PT
Apps and scripts using the NetQueryDisplayInformation API may fail with error
Applications and scripts that call the NetQueryDisplayInformation API or the WinNT provider equivalent may fail to return results after the first page of data.

See details >		OS Build 14393.3053

June 18, 2019
KB4503294		Investigating
August 01, 2019
05:00 PM PT
+ -
DetailsOriginating updateStatusHistory
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4507459. Devices that are domain controllers or domain members are both affected.

To safeguard your update experience, we have applied a compatibility hold on devices configured to use MIT Kerberos realm from being offered Windows 10, version 1903 or Windows Server, version 1903.

Note If you are not sure if your device is affected, contact your administrator. Advanced users can check for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos or check if this registry key exists:
HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms
+

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
Resolution: This issue was resolved in KB4512517 and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to offered Windows 10, version 1903 or Windows Server, version 1903.

Back to top		OS Build 14393.3115

July 16, 2019
KB4507459		Resolved
KB4512517		Resolved:
August 13, 2019
10:00 AM PT

Opened:
July 25, 2019
06:10 PM PT
Devices starting using PXE from a WDS or SCCM servers may fail to start
Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) or System Center Configuration Manager (SCCM) may fail to start with the error \"Status: 0xc0000001, Info: A required device isn't connected or can't be accessed\" after installing KB4503267 on a WDS server.

Affected platforms:
  • Server: Windows Server 2008 SP2; Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server, version 1803; Windows Server 2019; Windows Server, version 1809; Windows Server, version 1903
Resolution: This issue was resolved in KB4512495.

Back to top		OS Build 14393.3025

June 11, 2019
KB4503267		Resolved
KB4512495		Resolved:
August 17, 2019
02:00 PM PT

Opened:
July 10, 2019
02:51 PM PT
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4507459. Devices that are domain controllers or domain members are both affected.

To safeguard your update experience, we have applied a compatibility hold on devices configured to use MIT Kerberos realm from being offered Windows 10, version 1903 or Windows Server, version 1903.

Note If you are not sure if your device is affected, contact your administrator. Advanced users can check for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos or check if this registry key exists:
HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms
-

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
Resolution: This issue was resolved in KB4512517. To safeguard your upgrade experience, the compatibility hold on devices from being offered Windows 10, version 1903 or Windows Server, version 1903 is still in place. Once the issue is addressed on Windows 10, version 1903, this safeguard hold will be removed for all affected platforms. Check the Windows 10, version 1903 section of the release information dashboard for the most up to date information on this and other safeguard holds.

Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until this issue has been resolved.

Back to top		OS Build 14393.3115

July 16, 2019
KB4507459		Resolved
KB4512517		Resolved:
August 13, 2019
10:00 AM PT

Opened:
July 25, 2019
06:10 PM PT
Internet Explorer 11 and apps using the WebBrowser control may fail to render
Internet Explorer 11 may fail to render some JavaScript after installing KB4507460. You may also have issues with apps using JavaScript or the WebBrowser control, such as the present PowerPoint feature of Skype Meeting Broadcast.

Affected platforms:
  • Client: Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
  • Server: Windows Server 2016
Resolution: This issue was resolved in KB4512517.

Back to top		OS Build 14393.3085

July 09, 2019
KB4507460		Resolved
KB4512517		Resolved:
August 13, 2019
10:00 AM PT

Opened:
July 26, 2019
04:58 PM PT
" diff --git a/windows/release-information/status-windows-10-1703.yml b/windows/release-information/status-windows-10-1703.yml index dbe7b4e91e..804da5f5fe 100644 --- a/windows/release-information/status-windows-10-1703.yml +++ b/windows/release-information/status-windows-10-1703.yml @@ -66,8 +66,8 @@ sections: - type: markdown text: "
This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

+ -
SummaryOriginating updateStatusLast updated
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

See details >		OS Build 15063.1955

July 16, 2019
KB4507467		Resolved
KB4512507		August 13, 2019
10:00 AM PT
Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
Applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and VBScript may stop responding and you may receive an error.

See details >		OS Build 15063.1988

August 13, 2019
KB4512507		Resolved
KB4512474		August 17, 2019
02:00 PM PT
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

See details >		OS Build 15063.1955

July 16, 2019
KB4507467		Resolved
KB4512507		August 13, 2019
10:00 AM PT
MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on Windows devices that installed updates on June 11, 2019 or later.

See details >		OS Build 15063.1868

June 11, 2019
KB4503279		Resolved External
August 09, 2019
07:03 PM PT
Certain operations performed on a Cluster Shared Volume may fail
Certain operations, such as rename, performed on files or folders on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\".

See details >		OS Build 15063.1563

January 08, 2019
KB4480973		Mitigated
April 25, 2019
02:00 PM PT
@@ -95,8 +95,8 @@ sections: - type: markdown text: " - +
DetailsOriginating updateStatusHistory
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4507467. Devices that are domain controllers or domain members are both affected.

To safeguard your update experience, we have applied a compatibility hold on devices configured to use MIT Kerberos realm from being offered Windows 10, version 1903 or Windows Server, version 1903.

Note If you are not sure if your device is affected, contact your administrator. Advanced users can check for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos or check if this registry key exists:
HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms
-

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
Resolution: This issue was resolved in KB4512507. To safeguard your upgrade experience, the compatibility hold on devices from being offered Windows 10, version 1903 or Windows Server, version 1903 is still in place. Once the issue is addressed on Windows 10, version 1903, this safeguard hold will be removed for all affected platforms. Check the Windows 10, version 1903 section of the release information dashboard for the most up to date information on this and other safeguard holds.

Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until this issue has been resolved.

Back to top		OS Build 15063.1955

July 16, 2019
KB4507467		Resolved
KB4512507		Resolved:
August 13, 2019
10:00 AM PT

Opened:
July 25, 2019
06:10 PM PT
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4507467. Devices that are domain controllers or domain members are both affected.

To safeguard your update experience, we have applied a compatibility hold on devices configured to use MIT Kerberos realm from being offered Windows 10, version 1903 or Windows Server, version 1903.

Note If you are not sure if your device is affected, contact your administrator. Advanced users can check for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos or check if this registry key exists:
HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms
+

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
Resolution: This issue was resolved in KB4512507 and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to offered Windows 10, version 1903 or Windows Server, version 1903.

Back to top		OS Build 15063.1955

July 16, 2019
KB4507467		Resolved
KB4512507		Resolved:
August 13, 2019
10:00 AM PT

Opened:
July 25, 2019
06:10 PM PT
" diff --git a/windows/release-information/status-windows-10-1709.yml b/windows/release-information/status-windows-10-1709.yml index 9fa8392574..27e013f10f 100644 --- a/windows/release-information/status-windows-10-1709.yml +++ b/windows/release-information/status-windows-10-1709.yml @@ -60,9 +60,9 @@ sections: - type: markdown text: "
This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

+ -
SummaryOriginating updateStatusLast updated
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

See details >		OS Build 16299.1296

July 16, 2019
KB4507465		Resolved
KB4512516		August 13, 2019
10:00 AM PT
Devices starting using PXE from a WDS or SCCM servers may fail to start
Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

See details >		OS Build 16299.1217

June 11, 2019
KB4503284		Resolved
KB4512494		August 16, 2019
02:00 PM PT
Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
Applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and VBScript may stop responding and you may receive an error.

See details >		OS Build 16299.1331

August 13, 2019
KB4512516		Resolved
KB4512494		August 16, 2019
02:00 PM PT
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

See details >		OS Build 16299.1296

July 16, 2019
KB4507465		Resolved
KB4512516		August 13, 2019
10:00 AM PT
MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on Windows devices that installed updates on June 11, 2019 or later.

See details >		OS Build 16299.1217

June 11, 2019
KB4503284		Resolved External
August 09, 2019
07:03 PM PT
Certain operations performed on a Cluster Shared Volume may fail
Certain operations, such as rename, performed on files or folders on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\".

See details >		OS Build 16299.904

January 08, 2019
KB4480978		Mitigated
April 25, 2019
02:00 PM PT
@@ -90,9 +90,9 @@ sections: - type: markdown text: " + -
DetailsOriginating updateStatusHistory
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4507465. Devices that are domain controllers or domain members are both affected.

To safeguard your update experience, we have applied a compatibility hold on devices configured to use MIT Kerberos realm from being offered Windows 10, version 1903 or Windows Server, version 1903.

Note If you are not sure if your device is affected, contact your administrator. Advanced users can check for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos or check if this registry key exists:
HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms
+

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
Resolution: This issue was resolved in KB4512516 and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to offered Windows 10, version 1903 or Windows Server, version 1903.

Back to top		OS Build 16299.1296

July 16, 2019
KB4507465		Resolved
KB4512516		Resolved:
August 13, 2019
10:00 AM PT

Opened:
July 25, 2019
06:10 PM PT
Devices starting using PXE from a WDS or SCCM servers may fail to start
Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) or System Center Configuration Manager (SCCM) may fail to start with the error \"Status: 0xc0000001, Info: A required device isn't connected or can't be accessed\" after installing KB4503284 on a WDS server.

Affected platforms:
  • Server: Windows Server 2008 SP2; Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server, version 1803; Windows Server 2019; Windows Server, version 1809; Windows Server, version 1903
Resolution: This issue was resolved in KB4512494.

Back to top		OS Build 16299.1217

June 11, 2019
KB4503284		Resolved
KB4512494		Resolved:
August 16, 2019
02:00 PM PT

Opened:
July 10, 2019
02:51 PM PT
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4507465. Devices that are domain controllers or domain members are both affected.

To safeguard your update experience, we have applied a compatibility hold on devices configured to use MIT Kerberos realm from being offered Windows 10, version 1903 or Windows Server, version 1903.

Note If you are not sure if your device is affected, contact your administrator. Advanced users can check for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos or check if this registry key exists:
HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms
-

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
Resolution: This issue was resolved in KB4512516. To safeguard your upgrade experience, the compatibility hold on devices from being offered Windows 10, version 1903 or Windows Server, version 1903 is still in place. Once the issue is addressed on Windows 10, version 1903, this safeguard hold will be removed for all affected platforms. Check the Windows 10, version 1903 section of the release information dashboard for the most up to date information on this and other safeguard holds.

Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until this issue has been resolved.

Back to top		OS Build 16299.1296

July 16, 2019
KB4507465		Resolved
KB4512516		Resolved:
August 13, 2019
10:00 AM PT

Opened:
July 25, 2019
06:10 PM PT
" diff --git a/windows/release-information/status-windows-10-1803.yml b/windows/release-information/status-windows-10-1803.yml index fe3c6577c2..5b3d8b4dd9 100644 --- a/windows/release-information/status-windows-10-1803.yml +++ b/windows/release-information/status-windows-10-1803.yml @@ -65,10 +65,10 @@ sections: - type: markdown text: "
This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

+ - @@ -106,9 +106,9 @@ sections: - type: markdown text: "
SummaryOriginating updateStatusLast updated
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

See details >		OS Build 17134.915

July 16, 2019
KB4507466		Resolved
KB4512501		August 13, 2019
10:00 AM PT
Notification issue: \"Your device is missing important security and quality fixes.\"
Some users may have incorrectly received the notification \"Your device is missing important security and quality fixes.\"

See details >		N/A

Resolved
September 03, 2019
12:32 PM PT
Devices starting using PXE from a WDS or SCCM servers may fail to start
Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

See details >		OS Build 17134.829

June 11, 2019
KB4503286		Resolved
KB4512509		August 19, 2019
02:00 PM PT
Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
Applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and VBScript may stop responding and you may receive an error.

See details >		OS Build 17134.950

August 13, 2019
KB4512501		Resolved
KB4512509		August 19, 2019
02:00 PM PT
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

See details >		OS Build 17134.915

July 16, 2019
KB4507466		Resolved
KB4512501		August 13, 2019
10:00 AM PT
MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on Windows devices that installed updates on June 11, 2019 or later.

See details >		OS Build 17134.829

June 11, 2019
KB4503286		Resolved External
August 09, 2019
07:03 PM PT
Startup to a black screen after installing updates
Your device may startup to a black screen during the first logon after installing updates.

See details >		OS Build 17134.829

June 11, 2019
KB4503286		Mitigated
June 14, 2019
04:41 PM PT
Certain operations performed on a Cluster Shared Volume may fail
Certain operations, such as rename, performed on files or folders on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\".

See details >		OS Build 17134.523

January 08, 2019
KB4480966		Mitigated
April 25, 2019
02:00 PM PT
+ -
DetailsOriginating updateStatusHistory
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4507466. Devices that are domain controllers or domain members are both affected.

To safeguard your update experience, we have applied a compatibility hold on devices configured to use MIT Kerberos realm from being offered Windows 10, version 1903 or Windows Server, version 1903.

Note If you are not sure if your device is affected, contact your administrator. Advanced users can check for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos or check if this registry key exists:
HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms
+

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
Resolution: This issue was resolved in KB4512501 and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to offered Windows 10, version 1903 or Windows Server, version 1903.

Back to top		OS Build 17134.915

July 16, 2019
KB4507466		Resolved
KB4512501		Resolved:
August 13, 2019
10:00 AM PT

Opened:
July 25, 2019
06:10 PM PT
Devices starting using PXE from a WDS or SCCM servers may fail to start
Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) or System Center Configuration Manager (SCCM) may fail to start with the error \"Status: 0xc0000001, Info: A required device isn't connected or can't be accessed\" after installing KB4503286 on a WDS server.

Affected platforms:
  • Server: Windows Server 2008 SP2; Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server, version 1803; Windows Server 2019; Windows Server, version 1809; Windows Server, version 1903
Resolution: This issue was resolved in KB4512509.

Back to top		OS Build 17134.829

June 11, 2019
KB4503286		Resolved
KB4512509		Resolved:
August 19, 2019
02:00 PM PT

Opened:
July 10, 2019
02:51 PM PT
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4507466. Devices that are domain controllers or domain members are both affected.

To safeguard your update experience, we have applied a compatibility hold on devices configured to use MIT Kerberos realm from being offered Windows 10, version 1903 or Windows Server, version 1903.

Note If you are not sure if your device is affected, contact your administrator. Advanced users can check for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos or check if this registry key exists:
HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms
-

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
Resolution: This issue was resolved in KB4512501. To safeguard your upgrade experience, the compatibility hold on devices from being offered Windows 10, version 1903 or Windows Server, version 1903 is still in place. Once the issue is addressed on Windows 10, version 1903, this safeguard hold will be removed for all affected platforms. Check the Windows 10, version 1903 section of the release information dashboard for the most up to date information on this and other safeguard holds.

Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until this issue has been resolved.

Back to top		OS Build 17134.915

July 16, 2019
KB4507466		Resolved
KB4512501		Resolved:
August 13, 2019
10:00 AM PT

Opened:
July 25, 2019
06:10 PM PT
" diff --git a/windows/release-information/status-windows-10-1809-and-windows-server-2019.yml b/windows/release-information/status-windows-10-1809-and-windows-server-2019.yml index 5a2c3b8df0..d85effd748 100644 --- a/windows/release-information/status-windows-10-1809-and-windows-server-2019.yml +++ b/windows/release-information/status-windows-10-1809-and-windows-server-2019.yml @@ -64,9 +64,9 @@ sections: - type: markdown text: "
This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

+ - @@ -98,9 +98,9 @@ sections: - type: markdown text: "
SummaryOriginating updateStatusLast updated
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

See details >		OS Build 17763.652

July 22, 2019
KB4505658		Resolved
KB4511553		August 13, 2019
10:00 AM PT
Devices starting using PXE from a WDS or SCCM servers may fail to start
Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

See details >		OS Build 17763.557

June 11, 2019
KB4503327		Resolved
KB4512534		August 17, 2019
02:00 PM PT
Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
Applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and VBScript may stop responding and you may receive an error.

See details >		OS Build 17763.678

August 13, 2019
KB4511553		Resolved
KB4512534		August 17, 2019
02:00 PM PT
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

See details >		OS Build 17763.652

July 22, 2019
KB4505658		Resolved
KB4511553		August 13, 2019
10:00 AM PT
MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on Windows devices that installed updates on June 11, 2019 or later.

See details >		OS Build 17763.557

June 11, 2019
KB4503327		Resolved External
August 09, 2019
07:03 PM PT
Apps and scripts using the NetQueryDisplayInformation API may fail with error
Applications and scripts that call the NetQueryDisplayInformation API or the WinNT provider equivalent may fail to return results after the first page of data.

See details >		OS Build 17763.55

October 09, 2018
KB4464330		Investigating
August 01, 2019
05:00 PM PT
Startup to a black screen after installing updates
Your device may startup to a black screen during the first logon after installing updates.

See details >		OS Build 17763.557

June 11, 2019
KB4503327		Mitigated
June 14, 2019
04:41 PM PT
+ -
DetailsOriginating updateStatusHistory
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4505658. Devices that are domain controllers or domain members are both affected.

To safeguard your update experience, we have applied a compatibility hold on devices configured to use MIT Kerberos realm from being offered Windows 10, version 1903 or Windows Server, version 1903.

Note If you are not sure if your device is affected, contact your administrator. Advanced users can check for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos or check if this registry key exists:
HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms
+

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
Resolution: This issue was resolved in KB4511553 and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to offered Windows 10, version 1903 or Windows Server, version 1903.

Back to top		OS Build 17763.652

July 22, 2019
KB4505658		Resolved
KB4511553		Resolved:
August 13, 2019
10:00 AM PT

Opened:
July 25, 2019
06:10 PM PT
Devices starting using PXE from a WDS or SCCM servers may fail to start
Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) or System Center Configuration Manager (SCCM) may fail to start with the error \"Status: 0xc0000001, Info: A required device isn't connected or can't be accessed\" after installing KB4503327 on a WDS server.

Affected platforms:
  • Server: Windows Server 2008 SP2; Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server, version 1803; Windows Server 2019; Windows Server, version 1809; Windows Server, version 1903
Resolution: This issue was resolved in KB4512534.

Back to top		OS Build 17763.557

June 11, 2019
KB4503327		Resolved
KB4512534		Resolved:
August 17, 2019
02:00 PM PT

Opened:
July 10, 2019
02:51 PM PT
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4505658. Devices that are domain controllers or domain members are both affected.

To safeguard your update experience, we have applied a compatibility hold on devices configured to use MIT Kerberos realm from being offered Windows 10, version 1903 or Windows Server, version 1903.

Note If you are not sure if your device is affected, contact your administrator. Advanced users can check for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos or check if this registry key exists:
HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms
-

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
Resolution: This issue was resolved in KB4511553. To safeguard your upgrade experience, the compatibility hold on devices from being offered Windows 10, version 1903 or Windows Server, version 1903 is still in place. Once the issue is addressed on Windows 10, version 1903, this safeguard hold will be removed for all affected platforms. Check the Windows 10, version 1903 section of the release information dashboard for the most up to date information on this and other safeguard holds.

Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until this issue has been resolved.

Back to top		OS Build 17763.652

July 22, 2019
KB4505658		Resolved
KB4511553		Resolved:
August 13, 2019
10:00 AM PT

Opened:
July 25, 2019
06:10 PM PT
" diff --git a/windows/release-information/status-windows-10-1903.yml b/windows/release-information/status-windows-10-1903.yml index 9201d1cb20..efe7452abd 100644 --- a/windows/release-information/status-windows-10-1903.yml +++ b/windows/release-information/status-windows-10-1903.yml @@ -65,13 +65,13 @@ sections: - type: markdown text: "
This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

+ + - - @@ -115,11 +115,11 @@ sections: - type: markdown text: "
SummaryOriginating updateStatusLast updated
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

See details >		OS Build 18362.145

May 29, 2019
KB4497935		Resolved
KB4512941		August 30, 2019
10:00 AM PT
Issues updating when certain versions of Intel storage drivers are installed
Certain versions of Intel Rapid Storage Technology (Intel RST) drivers may cause updating to Windows 10, version 1903 to fail.

See details >		OS Build 18362.145

May 29, 2019
KB4497935		Resolved
KB4512941		August 30, 2019
10:00 AM PT
Windows Desktop Search may not return any results and may have high CPU usage
Windows Desktop Search may not return any results and SearchUI.exe may have high CPU usage after installing KB4512941.

See details >		OS Build 18362.329

August 30, 2019
KB4512941		Investigating
September 04, 2019
02:25 PM PT
Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
Applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and VBScript may stop responding and you may receive an error.

See details >		OS Build 18362.295

August 13, 2019
KB4512508		Resolved
KB4512941		August 30, 2019
10:00 AM PT
Issues updating when certain versions of Intel storage drivers are installed
Certain versions of Intel Rapid Storage Technology (Intel RST) drivers may cause updating to Windows 10, version 1903 to fail.

See details >		OS Build 18362.145

May 29, 2019
KB4497935		Resolved
KB4512941		August 30, 2019
10:00 AM PT
Initiating a Remote Desktop connection may result in black screen
When initiating a Remote Desktop connection to devices with some older GPU drivers, you may receive a black screen.

See details >		OS Build 18362.145

May 29, 2019
KB4497935		Resolved
KB4512941		August 30, 2019
10:00 AM PT
Windows Sandbox may fail to start with error code “0x80070002”
Windows Sandbox may fail to start with \"ERROR_FILE_NOT_FOUND (0x80070002)\" on devices in which the operating system language was changed between updates

See details >		OS Build 18362.116

May 20, 2019
KB4505057		Resolved
KB4512941		August 30, 2019
10:00 AM PT
Devices starting using PXE from a WDS or SCCM servers may fail to start
Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

See details >		OS Build 18362.175

June 11, 2019
KB4503293		Resolved
KB4512941		August 30, 2019
10:00 AM PT
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

See details >		OS Build 18362.145

May 29, 2019
KB4497935		Resolved
KB4512941		August 30, 2019
10:00 AM PT
Updates may fail to install and you may receive Error 0x80073701
Installation of updates may fail and you may receive an error, \"Updates Failed, There were problems installing some updates, but we'll try again later\" and \"Error 0x80073701.\"

See details >		OS Build 18362.145

May 29, 2019
KB4497935		Investigating
August 16, 2019
04:28 PM PT
MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on Windows devices that installed updates on June 11, 2019 or later.

See details >		OS Build 18362.175

June 11, 2019
KB4503293		Resolved External
August 09, 2019
07:03 PM PT
Intermittent loss of Wi-Fi connectivity
Some older devices may experience loss of Wi-Fi connectivity due to an outdated Qualcomm driver.

See details >		OS Build 18362.116

May 21, 2019
KB4505057		Mitigated External
August 01, 2019
08:44 PM PT
- + + -
DetailsOriginating updateStatusHistory
Issues updating when certain versions of Intel storage drivers are installed
Intel and Microsoft have found incompatibility issues with certain versions of the Intel Rapid Storage Technology (Intel RST) drivers and the Windows 10 May 2019 Update (Windows 10, version 1903).  

To safeguard your update experience, we have applied a compatibility hold on devices with Intel RST drivers, versions 15.1.0.1002 through version 15.5.2.1053 installed from installing or being offered Windows 10, version 1903 or Windows Server, version 1903, until the driver has been updated.

Versions 15.5.2.1054 or later are compatible, and a device that has these drivers installed can install the Windows 10 May 2019 Update. For affected devices, the recommended version is 15.9.8.1050.

Affected platforms:
  • Client: Windows 10, version 1903
  • Server: Windows Server, version 1903
Workaround: To mitigate this issue before the safeguard hold is removed, you will need to update the Intel RST drivers for your device to version 15.5.2.1054 or a later.  Check with your device manufacturer (OEM) to see if an updated driver is available and install it. You can also download the latest Intel RST drivers directly from Intel at Intel® Rapid Storage Technology (Intel® RST) User Interface and Driver. Once your drivers are updated, you can restart the installation process for Windows 10, version 1903. Please note, it can take up to 48 hours before you can update to Windows 10, version 1903.

Resolution: This issue was resolved in KB4512941. The safeguard hold is estimated to be removed in early September.

Back to top		OS Build 18362.145

May 29, 2019
KB4497935		Resolved
KB4512941		Resolved:
August 30, 2019
10:00 AM PT

Opened:
July 25, 2019
06:10 PM PT
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4497935. Devices that are domain controllers or domain members are both affected.

To safeguard your update experience, we have applied a compatibility hold on devices configured to use MIT Kerberos realm from being offered Windows 10, version 1903 or Windows Server, version 1903.

Note If you are not sure if your device is affected, contact your administrator. Advanced users can check for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos or check if this registry key exists:
HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms
+

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
Resolution: This issue was resolved in KB4512941 and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to offered Windows 10, version 1903 or Windows Server, version 1903.

Back to top		OS Build 18362.145

May 29, 2019
KB4497935		Resolved
KB4512941		Resolved:
August 30, 2019
10:00 AM PT

Opened:
July 25, 2019
06:10 PM PT
Issues updating when certain versions of Intel storage drivers are installed
Intel and Microsoft have found incompatibility issues with certain versions of the Intel Rapid Storage Technology (Intel RST) drivers and the Windows 10 May 2019 Update (Windows 10, version 1903).  

To safeguard your update experience, we have applied a compatibility hold on devices with Intel RST drivers, versions 15.1.0.1002 through version 15.5.2.1053 installed from installing or being offered Windows 10, version 1903 or Windows Server, version 1903, until the driver has been updated.

Versions 15.5.2.1054 or later are compatible, and a device that has these drivers installed can install the Windows 10 May 2019 Update. For affected devices, the recommended version is 15.9.8.1050.

Affected platforms:
  • Client: Windows 10, version 1903
  • Server: Windows Server, version 1903
Resolution: This issue was resolved in KB4512941 and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to Windows 10, version 1903.

Back to top		OS Build 18362.145

May 29, 2019
KB4497935		Resolved
KB4512941		Resolved:
August 30, 2019
10:00 AM PT

Opened:
July 25, 2019
06:10 PM PT
Initiating a Remote Desktop connection may result in black screen
When initiating a Remote Desktop connection to devices with some older GPU drivers, you may receive a black screen. Any version of Windows may encounter this issue when initiating a Remote Desktop connection to a Windows 10, version 1903 device which is running an affected display driver, including the drivers for the Intel 4 series chipset integrated GPU (iGPU).

Affected platforms:
  • Client: Windows 10, version 1903
  • Server: Windows Server, version 1903
Resolution: This issue was resolved in KB4512941.

Back to top		OS Build 18362.145

May 29, 2019
KB4497935		Resolved
KB4512941		Resolved:
August 30, 2019
10:00 AM PT

Opened:
July 12, 2019
04:42 PM PT
Devices starting using PXE from a WDS or SCCM servers may fail to start
Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) or System Center Configuration Manager (SCCM) may fail to start with the error \"Status: 0xc0000001, Info: A required device isn't connected or can't be accessed\" after installing KB4503293 on a WDS server.

Affected platforms:
  • Server: Windows Server 2008 SP2; Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server, version 1803; Windows Server 2019; Windows Server, version 1809; Windows Server, version 1903
Resolution: This issue was resolved in KB4512941.

Back to top		OS Build 18362.175

June 11, 2019
KB4503293		Resolved
KB4512941		Resolved:
August 30, 2019
10:00 AM PT

Opened:
July 10, 2019
02:51 PM PT
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4497935. Devices that are domain controllers or domain members are both affected.

To safeguard your update experience, we have applied a compatibility hold on devices configured to use MIT Kerberos realm from being offered Windows 10, version 1903 or Windows Server, version 1903.

Note If you are not sure if your device is affected, contact your administrator. Advanced users can check for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos or check if this registry key exists:
HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms
-

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
Resolution: This issue was resolved in KB4512941. The safeguard hold is estimated to be removed in early September.

Back to top		OS Build 18362.145

May 29, 2019
KB4497935		Resolved
KB4512941		Resolved:
August 30, 2019
10:00 AM PT

Opened:
July 25, 2019
06:10 PM PT
The dGPU may occasionally disappear from device manager on Surface Book 2 with dGPU
Microsoft has identified a compatibility issue on some Surface Book 2 devices configured with Nvidia discrete graphics processing unit (dGPU). After updating to Windows 10, version 1903 (May 2019 Feature Update), some apps or games that needs to perform graphics intensive operations may close or fail to open.

To safeguard your update experience, we have applied a compatibility hold on Surface Book 2 devices with Nvidia dGPUs from being offered Windows 10, version 1903, until this issue is resolved.

Affected platforms:
  • Client: Windows 10, version 1903
Workaround: To mitigate the issue if you are already on Windows 10, version 1903, you can restart the device or select the Scan for hardware changes button in the Action menu or on the toolbar in Device Manager.

Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until this issue has been resolved.

Next steps: We are working on a resolution and will provide an update in an upcoming release.

Back to top		OS Build 18362.145

May 29, 2019
KB4497935		Investigating
Last updated:
July 16, 2019
09:04 AM PT

Opened:
July 12, 2019
04:20 PM PT
"