[Upgrade Windows 10 Pro to Pro Education from Windows Store for Business](windows-10-pro-to-pro-edu-upgrade.md)
If you have an education tenant and use Windows 10 Pro in your schools now, find out how you can opt-in to a free upgrade to Windows 10 Pro Education.
+
+
+Windows 8.1 deployment planning
Explore key considerations and questions that should be answered when planning for Windows 8.1 deployment.
Windows 8.1 deployment to PCs
Get an overview of Windows 8.1 deployment to PCs in an educational environment.
BYOD
Explore Bring Your Own Device (BYOD) considerations, including device types, infrastructure, and deployment models.
Deploying Windows RT 8.1
Get step-by-step instructions on how to configure and deploy Windows RT devices (like Surface and other tablets) in educational environments.
+
+Virtual Desktop Infrastructure
Learn how to address challenges related to BYOD scenarios using Virtual Desktop Infrastructure (VDI).
Windows Store apps
Explore Windows Store app deployment strategies and considerations for educational institutions running Windows 8.1.
Windows To Go
Learn about the benefits, limitations, and processes involved in deploying Windows To Go.
Packaging
-
+
All of the Office applications that you want to deploy to users must be in a single package.
In App-V 5.0 and later, you must use the Office Deployment Tool to create packages. You cannot use the Sequencer.
-If you are deploying Microsoft Visio 2016 and Microsoft Project 2016 along with Office, you must include them in the same package with Office. For more information, see [Deploying Visio 2016 and Project 2016 with Office](#bkmk-deploy-visio-project).
+If you are deploying Microsoft Visio 2016 and Microsoft Project 2016 along with Office, you must include them in the same package with Office. For more information, see [Deploying Visio 2016 and Project 2016 with Office](#deploying-visio-2016-and-project-2016-with-office).
Project Pro for Office 365
You must enable [shared computer activation](http://technet.microsoft.com/library/dn782860.aspx).
-You don’t use shared computer activation if you’re deploying a volume licensed product, such as:
--
-
Office Professional Plus 2016
-Visio Professional 2016
-Project Professional 2016
-
Product element
Specifies the application. Project 2016 and Visio 2016 must be specified here as an added product to be included in the applications.
Specifies the application. Project 2016 and Visio 2016 must be specified here as an added product to be included in the applications. + + For more information about the product IDs, see [Product IDs that are supported by the Office Deployment Tool for Click-to-Run](https://support.microsoft.com/kb/2842297) +
Product ID ="O365ProPlusRetail "
Product ID ="VisioProRetail"
Product ID ="ProjectProRetail"
Product ID ="ProPlusVolume"
Product ID ="VisioProVolume"
Product ID = "ProjectProVolume"
Language element
Version (attribute of Add element)
Optional. Specifies a build to use for the package
Defaults to latest advertised build (as defined in v32.CAB at the Office source).
15.1.2.3
16.1.2.3
SourcePath (attribute of Add element)
| Product ID | -Volume Licensing | Subscription Licensing |
|---|---|---|
Office 2016 |
-ProPlusVolume |
O365ProPlusRetail |
Office 2016 with Visio 2016 |
-ProPlusVolume -VisioProVolume |
O365ProPlusRetail VisioProRetail |
Office 2016 with Visio 2016 and Project 2016 |
-ProPlusVolume -VisioProVolume -ProjectProVolume |
O365ProPlusRetail VisioProRetail ProjectProRetail |
@@ -412,9 +400,7 @@ After you download the Office 2016 applications through the Office Deployment To
ProductID |
- Specify the type of licensing, as shown in the following examples: -
|
- -
Volume Licensing
-<Configuration>
- <Add SourcePath= "\\Server\Office2016" OfficeClientEdition="32" >
- <Product ID="ProPlusVolume">
- <Language ID="en-us" />
- </Product>
- <Product ID="VisioProVolume">
- <Language ID="en-us" />
- </Product>
- </Add>
- </Configuration>In this example, the following changes were made to create a package with Volume licensing:
-SourcePath |
- is the path, which was changed to point to the Office applications that were downloaded earlier. |
-
Product ID |
- for Office was changed to |
-
Product ID |
- for Visio was changed to |
-
-
ExcludeApp (optional)
Lets you specify Office programs that you don’t want included in the App-V package that the Office Deployment Tool creates. For example, you can exclude Access and InfoPath.
PACKAGEGUID (optional)
By default, all App-V packages created by the Office Deployment Tool share the same App-V Package ID. You can use PACKAGEGUID to specify a different package ID for each package, which allows you to publish multiple App-V packages, created by the Office Deployment Tool, and manage them by using the App-V Server.
An example of when to use this parameter is if you create different packages for different users. For example, you can create a package with just Office 2016 for some users, and create another package with Office 2016 and Visio 2016 for another set of users.
-
- Note
-
- Even if you use unique package IDs, you can still deploy only one App-V package to a single device.
-
-
-
/packager
creates the Office 2016 App-V package with Volume Licensing as specified in the customConfig.xml file.
creates the Office 2016 App-V package with the type of licensing specified in the customConfig.xml file.
\\server\Office2016\Customconfig.xml
-
+
- An Office 2016 App-V Package Version ID that is unique across all packages created using the Office Deployment Tool. +
- A second App-V Package Version ID, x.x.x.x for example, in the AppX manifest that will only change if there is a new version of Office itself. For example, if a new Office 2016 release with upgrades is available, and a package is created through the Office Deployment Tool to incorporate these upgrades, the X.X.X.X version ID will change to reflect that the Office version itself has changed. The App-V server will use the X.X.X.X version ID to differentiate this package and recognize that it contains new upgrades to the previously published package, and as a result, publish it as an upgrade to the existing Office 2016 package. +
How do I package and publish Visio 2016 and Project 2016 with Office?
You must include Visio 2016 and Project 2016 in the same package with Office.
-If you aren’t deploying Office, you can create a package that contains Visio and/or Project, as long as you follow [Deploying Microsoft Office 2010 by Using App-V](../appv-v5/deploying-microsoft-office-2010-by-using-app-v.md).
If you aren’t deploying Office, you can create a package that contains Visio and/or Project, as long as you follow the packaging, publishing, and deployment requirements described in this topic.
How can I deploy Visio 2016 and Project 2016 to specific users?
[Planning for Using App-V with Office](planning-for-using-app-v-with-office51.md#bkmk-office-vers-supp-appv)
[Supported versions of Microsoft Office](planning-for-using-app-v-with-office.md#bkmk-office-vers-supp-appv)
Supported versions of Office
Supported deployment types (for example, desktop, personal Virtual Desktop Infrastructure (VDI), pooled VDI)
@@ -55,13 +55,14 @@ Use the following table to get information about supported versions of Office an
[Planning for Using App-V with Office](planning-for-using-app-v-with-office51.md#bkmk-plan-coexisting)
[Planning for Using App-V with coexsiting versions of Office](planning-for-using-app-v-with-office.md#bkmk-plan-coexisting)
Considerations for installing different versions of Office on the same computer
Packaging
-
+
All of the Office applications that you want to deploy to users must be in a single package.
In App-V 5.1 and later, you must use the Office Deployment Tool to create packages. You cannot use the Sequencer.
-If you are deploying Microsoft Visio 2016 and Microsoft Project 2016 along with Office, you must include them in the same package with Office. For more information, see [Deploying Visio 2016 and Project 2016 with Office](#bkmk-deploy-visio-project).
+If you are deploying Microsoft Visio 2016 and Microsoft Project 2016 along with Office, you must include them in the same package with Office. For more information, see [Deploying Visio 2016 and Project 2016 with Office](#deploying-visio-2016-and-project-2016-with-office).
Project Pro for Office 365
You must enable [shared computer activation](http://technet.microsoft.com/library/dn782860.aspx).
-You don’t use shared computer activation if you’re deploying a volume licensed product, such as:
--
-
Office Professional Plus 2016
-Visio Professional 2016
-Project Professional 2016
-
Supported operating systems
64-bit version of Windows 10
-64-bit version of Windows 8 or later
+64-bit version of Windows 8 or 8.1
64-bit version of Windows 7
Product element |
- Specifies the application. Project 2016 and Visio 2016 must be specified here as an added product to be included in the applications. |
-
| Specifies the application. Project 2016 and Visio 2016 must be specified here as an added product to be included in the applications. + + For more information about the product IDs, see [Product IDs that are supported by the Office Deployment Tool for Click-to-Run](https://support.microsoft.com/kb/2842297) + |
+
|
+
Language element |
@@ -298,21 +285,19 @@ The XML file that is included in the Office Deployment Tool specifies the produc
||||
SourcePath (attribute of Add element) |
Specifies the location in which the applications will be saved to. |
-
|
+
|
|
Branch (attribute of Add element) |
- Optional. Specifies the update branch for the product that you want to download or install. For more information about update branches, see Overview of update branches for Office 365 ProPlus. |
+ Optional. Specifies the update branch for the product that you want to download or install. For more information about update branches, see Overview of update branches for Office 365 ProPlus. |
|
| Product ID | -Volume Licensing | Subscription Licensing |
|---|---|---|
Office 2016 |
-ProPlusVolume |
O365ProPlusRetail |
Office 2016 with Visio 2016 |
-ProPlusVolume -VisioProVolume |
O365ProPlusRetail VisioProRetail |
Office 2016 with Visio 2016 and Project 2016 |
-ProPlusVolume -VisioProVolume -ProjectProVolume |
O365ProPlusRetail VisioProRetail ProjectProRetail |
@@ -421,9 +400,7 @@ After you download the Office 2016 applications through the Office Deployment To
ProductID |
- Specify the type of licensing, as shown in the following examples: -
|
- -
Volume Licensing
-<Configuration>
- <Add SourcePath= "\\Server\Office2016" OfficeClientEdition="32" >
- <Product ID="ProPlusVolume">
- <Language ID="en-us" />
- </Product>
- <Product ID="VisioProVolume">
- <Language ID="en-us" />
- </Product>
- </Add>
- </Configuration>In this example, the following changes were made to create a package with Volume licensing:
-SourcePath |
- is the path, which was changed to point to the Office applications that were downloaded earlier. |
-
Product ID |
- for Office was changed to |
-
Product ID |
- for Visio was changed to |
-
-
ExcludeApp (optional)
Lets you specify Office programs that you don’t want included in the App-V package that the Office Deployment Tool creates. For example, you can exclude Access.
Lets you specify Office programs that you don’t want included in the App-V package that the Office Deployment Tool creates. For example, you can exclude Access and InfoPath.
PACKAGEGUID (optional)
By default, all App-V packages created by the Office Deployment Tool share the same App-V Package ID. You can use PACKAGEGUID to specify a different package ID for each package, which allows you to publish multiple App-V packages, created by the Office Deployment Tool, and manage them by using the App-V Server.
An example of when to use this parameter is if you create different packages for different users. For example, you can create a package with just Office 2016 for some users, and create another package with Office 2016 and Visio 2016 for another set of users.
-
- Note
-
- Even if you use unique package IDs, you can still deploy only one App-V package to a single device.
-
-
-
/packager
creates the Office 2016 App-V package with Volume Licensing as specified in the customConfig.xml file.
creates the Office 2016 App-V package with the type of licensing specified in the customConfig.xml file.
\\server\Office2016\Customconfig.xml
-
+
- An Office 2016 App-V Package Version ID that is unique across all packages created using the Office Deployment Tool. +
- A second App-V Package Version ID, x.x.x.x for example, in the AppX manifest that will only change if there is a new version of Office itself. For example, if a new Office 2016 release with upgrades is available, and a package is created through the Office Deployment Tool to incorporate these upgrades, the X.X.X.X version ID will change to reflect that the Office version itself has changed. The App-V server will use the X.X.X.X version ID to differentiate this package and recognize that it contains new upgrades to the previously published package, and as a result, publish it as an upgrade to the existing Office 2016 package. +
64-bit
Microsoft System Center 2012 R2 Configuration Manager
64-bit
Microsoft System Center 2012 Configuration Manager
SP1
Microsoft System Center Configuration Manager 2007 R2 or later
SP1 or later
64-bit
-
-Note
-
-Although Configuration Manager 2007 R2 is 32 bit, you must install it and SQL Server on a 64-bit operating system in order to match the 64-bit MBAM software.
-
-
-
Microsoft SQL Server 2014
Standard, Enterprise, or Datacenter
SP1
64-bit
Microsoft SQL Server 2014
Standard, Enterprise, or Datacenter
64-bit
Microsoft SQL Server 2012
Microsoft SQL Server 2014
Standard, Enterprise, or Datacenter
SP2
64-bit
Microsoft SQL Server 2012
Microsoft SQL Server 2014
Standard, Enterprise, or Datacenter
SP1
64-bit
Microsoft SQL Server 2012
Standard, Enterprise, or Datacenter
SP3
64-bit
Microsoft SQL Server 2008 R2
Standard or Enterprise
SP1, SP2, SP3
SP3
64-bit
.NET Framework 4 or higher
Windows 8 and Windows 8.1
Windows 8.1
Enterprise or Pro
None
32-bit or 64-bit
Windows PowerShell 3.0 or higher
.NET Framework 4.5
Windows 10, pre-1607 verison
Enterprise or Pro
32-bit or 64-bit
Windows PowerShell 3.0 or higher
.NET Framework 4.5
Windows Server 2016
Standard or Datacenter
None
64-bit
Windows PowerShell 3.0 or higher
.NET Framework 4.5
.NET Framework 4.5 or higher
Windows 10
+Windows 10, pre-1607 version
Note
-
Only UE-V 2.1 SP1 supports Windows 10
+Only UE-V 2.1 SP1 supports Windows 10, pre-1607 version
@@ -685,6 +689,14 @@ Before you proceed, make sure your environment includes these requirements for r
Windows PowerShell 3.0 or higher
.NET Framework 4.5 or higher
Windows Server 2016
Standard or Datacenter
None
64-bit
Windows PowerShell 3.0 or higher
.NET Framework 4.6 or higher
+[Upgrade Analytics requirements](upgrade-analytics-requirements.md)
+[Upgrade Analytics release notes](upgrade-analytics-release-notes.md)
+[Get started with Upgrade Analytics](upgrade-analytics-get-started.md)
+[Use Upgrade Analytics to manage Windows upgrades](use-upgrade-analytics-to-manage-windows-upgrades.md)
+[Troubleshoot Upgrade Analytics](troubleshoot-upgrade-analytics.md)
diff --git a/windows/deploy/provisioning-apply-package.md b/windows/deploy/provisioning-apply-package.md index 417c9e9e75..1125dd6985 100644 --- a/windows/deploy/provisioning-apply-package.md +++ b/windows/deploy/provisioning-apply-package.md @@ -94,7 +94,7 @@ On a desktop computer, navigate to **Settings** > **Accounts** > **Access work o  -# + ## Learn more diff --git a/windows/deploy/provisioning-create-package.md b/windows/deploy/provisioning-create-package.md index 51b609a8ea..f543e6d10f 100644 --- a/windows/deploy/provisioning-create-package.md +++ b/windows/deploy/provisioning-create-package.md @@ -35,6 +35,7 @@ You use Windows Imaging and Configuration Designer (ICD) to create a provisionin - The **Simple provisioning** and **Provision school devices** options provide wizard-style walkthroughs for creating a provisioning package based on a set of common settings. - The **Advanced provisioning** option opens a new project with all **Runtime settings** available. + >[!TIP] >You can start a project in the simple editor and then switch the project to the advanced editor. > diff --git a/windows/deploy/provisioning-packages.md b/windows/deploy/provisioning-packages.md index ebb4a064c3..557bf3e595 100644 --- a/windows/deploy/provisioning-packages.md +++ b/windows/deploy/provisioning-packages.md @@ -25,13 +25,13 @@ Provisioning packages are simple enough that with a short set of written instruc The [Windows Assessment and Deployment Kit (ADK) for Windows 10](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit) includes the Imaging and Configuration Designer (ICD), a tool for configuring provisioning packages. -## New in Windows 10, Version 1607 +## New in Windows 10, version 1607 -Windows ICD for Windows 10, Version 1607, simplifies common provisioning scenarios. +Windows ICD for Windows 10, version 1607, simplifies common provisioning scenarios.  -Windows ICD in Windows 10, Version 1607, supports the following scenarios for IT administrators: +Windows ICD in Windows 10, version 1607, supports the following scenarios for IT administrators: * **Simple provisioning** – Enables IT administrators to define a desired configuration in Windows ICD and then apply that configuration on target devices. The simple provisioning wizard makes the entire process quick and easy by guiding an IT administrator through common configuration settings in a step-by-step manner. @@ -49,7 +49,7 @@ Windows ICD in Windows 10, Version 1607, supports the following scenarios for IT * Other MDMs (cert-based enrollment) > [!NOTE] -> Windows ICD in Windows 10, Version 1607, also provides a wizard to create provisioning packages for school PCs. To learn more, see [Set up students' PCs to join domain](https://technet.microsoft.com/edu/windows/index). +> Windows ICD in Windows 10, version 1607, also provides a wizard to create provisioning packages for school PCs. To learn more, see [Set up students' PCs to join domain](https://technet.microsoft.com/edu/windows/index). ## Benefits of provisioning packages diff --git a/windows/deploy/troubleshoot-upgrade-analytics.md b/windows/deploy/troubleshoot-upgrade-analytics.md index 468de1e275..03c096cc19 100644 --- a/windows/deploy/troubleshoot-upgrade-analytics.md +++ b/windows/deploy/troubleshoot-upgrade-analytics.md @@ -2,7 +2,7 @@ title: Troubleshoot Upgrade Analytics (Windows 10) description: Provides troubleshooting information for Upgrade Analytics. ms.prod: w10 -author: MaggiePucciEvans +author: greg-lindsay --- # Troubleshoot Upgrade Analytics @@ -13,7 +13,7 @@ If you still don’t see data in Upgrade Analytics, follow these steps: 1. Download and extract UpgradeAnalytics.zip. Ensure the “Diagnostics” folder is included. -2. Edit the script as described in [Run the Upgrade Analytics deployment script](upgrade-analytics-get-started.md#run-the-upgrade-analytics-deployment-script). +2. Edit the script as described in [Upgrade Analytics deployment script](upgrade-analytics-deployment-script.md). 3. Check that isVerboseLogging is set to $true. diff --git a/windows/deploy/update-windows-10-images-with-provisioning-packages.md b/windows/deploy/update-windows-10-images-with-provisioning-packages.md index d292a6cba0..27b3025c15 100644 --- a/windows/deploy/update-windows-10-images-with-provisioning-packages.md +++ b/windows/deploy/update-windows-10-images-with-provisioning-packages.md @@ -8,6 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: mobile author: jdeckerMS +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/provisioning-packages --- # Update Windows 10 images with provisioning packages diff --git a/windows/deploy/upgrade-analytics-additional-insights.md b/windows/deploy/upgrade-analytics-additional-insights.md new file mode 100644 index 0000000000..fd99d97682 --- /dev/null +++ b/windows/deploy/upgrade-analytics-additional-insights.md @@ -0,0 +1,81 @@ +--- +title: Upgrade Analytics - Additional insights +description: Explains additional features of Upgrade Analytics. +ms.prod: w10 +author: greg-lindsay +--- + +# Upgrade Analytics - Additional insights + +This topic provides information on additional features that are available in Upgrade Analytics to provide insights into your environment. These include: + +- [Site discovery](#site-discovery): An inventory of web sites that are accessed by client computers running Windows 7 or Windows 8.1 using Internet Explorer. +- [Office add-ins](#office-add-ins): A list of the Microsoft Office add-ins that are installed on client computers. + +## Site discovery + +The site discovery feature in Upgrade Analytics provides an inventory of web sites that are accessed by client computers using Internet Explorer on Windows 8.1 and Windows 7. Site discovery does not include sites that are accessed using other Web browsers, such as Microsoft Edge. Site inventory information is provided as optional data related to upgrading to Windows 10 and Internet Explorer 11, and is meant to help prioritize compatibility testing for web applications. You can make more informed decisions about testing based on usage data. + +> Note: Site discovery data is disabled by default; you can find documentation on what is collected in the [Windows 7, Windows 8, and Windows 8.1 appraiser telemetry events and fields](https://go.microsoft.com/fwlink/?LinkID=822965). After you turn on this feature, data is collected on all sites visited by Internet Explorer, except during InPrivate sessions. In addition, the data collection process is silent, without notification to the employee. You are responsible for ensuring that your use of this feature complies with all applicable local laws and regulatory requirements, including any requirements to provide notice to employees. + +### Install prerequisite security update for Internet Explorer + +Ensure the following prerequisites are met before using site discovery: + +1. Install the latest [Windows Monthly Rollup](http://catalog.update.microsoft.com/v7/site/Search.aspx?q=security%20monthly%20quality%20rollup). This functionality has been included in Internet Explorer 11 starting with the July 2016 Cumulative Update. +2. Install the update for customer experience and diagnostic telemetery ([KB3080149](https://support.microsoft.com/kb/3080149)). +3. Enable Internet Explorer data collection, which is disabled by default. The best way to enable it is to modify the [Upgrade Analytics deployment script](upgrade-analytics-deployment-script.md) to allow Internet Explorer data collection before you run it. + + If necessary, you can also enable it by creating the following registry entry. + + HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection + + Entry name: IEDataOptIn + + Data type: DWORD + + Values: + + > *IEOptInLevel = 0 Internet Explorer data collection is disabled* + > + > *IEOptInLevel = 1 Data collection is enabled for sites in the Local intranet + Trusted sites + Machine local zones* + > + > *IEOptInLevel = 2 Data collection is enabled for sites in the Internet + Restricted sites zones* + > + > *IEOptInLevel = 3 Data collection is enabled for all sites* + + For more information about Internet Explorer Security Zones, see [About URL Security Zones](https://msdn.microsoft.com/library/ms537183.aspx). + +  + +### Review most active sites + +This blade indicates the most visited sites by computers in your environment. Review this list to determine which web applications and sites are used most frequently. The number of visits is based on the total number of views, and not by the number of unique devices accessing a page. + +For each site, the fully qualified domain name will be listed. You can sort the data by domain name or by URL. + + + +Click the name of any site in the list to drill down into more details about the visits, including the time of each visit and the computer name. + + + +### Review document modes in use + +This blade provides information about which document modes are used in the sites that are visited in your environment. Document modes are used to provide compatibility with older versions of Internet Explorer. Sites that use older technologies may require additional testing and are less likely to be compatible with Microsoft Edge. Counts are based on total page views and not the number of unique devices. For more information about document modes, see [Deprecated document modes](https://technet.microsoft.com/itpro/internet-explorer/ie11-deploy-guide/deprecated-document-modes). + + + +### Run browser-related queries + +You can run predefined queries to capture more info, such as sites that have Enterprise Mode enabled, or the number of unique computers that have visited a site. For example, this query returns the most used ActiveX controls. You can modify and save the predefined queries. + + + +## Office add-ins + +Office add-ins provides a list of the Microsoft Office add-ins in your environment, and enumerates the computers that have these add-ins installed. This information should not affect the upgrade decision workflow, but can be helpful to an administrator. + +## Related topics + +[Upgrade Analytics release notes](upgrade-analytics-release-notes.md) diff --git a/windows/deploy/upgrade-analytics-architecture.md b/windows/deploy/upgrade-analytics-architecture.md index cd153c1420..e7e639105a 100644 --- a/windows/deploy/upgrade-analytics-architecture.md +++ b/windows/deploy/upgrade-analytics-architecture.md @@ -2,7 +2,7 @@ title: Upgrade Analytics architecture (Windows 10) description: Describes Upgrade Analytics architecture. ms.prod: w10 -author: MaggiePucciEvans +author: greg-lindsay --- # Upgrade Analytics architecture @@ -19,16 +19,12 @@ After you enable Windows telemetry on user computers and install the compatibili For more information about what telemetry data Microsoft collects and how that data is used and protected by Microsoft, see: -[Configure Windows telemetry in your organization](https://technet.microsoft.com/itpro/windows/manage/configure-windows-telemetry-in-your-organization) - -[Manage connections from Windows operating system components to Microsoft services](https://technet.microsoft.com/itpro/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services) - -[Windows 7, Windows 8, and Windows 8.1 appraiser telemetry events and fields](https://go.microsoft.com/fwlink/?LinkID=822965) +[Configure Windows telemetry in your organization](https://technet.microsoft.com/itpro/windows/manage/configure-windows-telemetry-in-your-organization)
+[Manage connections from Windows operating system components to Microsoft services](https://technet.microsoft.com/itpro/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services)
+[Windows 7, Windows 8, and Windows 8.1 appraiser telemetry events and fields](https://go.microsoft.com/fwlink/?LinkID=822965)
##**Related topics** -[Upgrade Analytics requirements](upgrade-analytics-requirements.md) - -[Upgrade Analytics release notes](upgrade-analytics-release-notes.md) - -[Get started with Upgrade Analytics](upgrade-analytics-get-started.md) +[Upgrade Analytics requirements](upgrade-analytics-requirements.md)
+[Upgrade Analytics release notes](upgrade-analytics-release-notes.md)
+[Get started with Upgrade Analytics](upgrade-analytics-get-started.md)
diff --git a/windows/deploy/upgrade-analytics-deploy-windows.md b/windows/deploy/upgrade-analytics-deploy-windows.md index 18ee3ac68d..57b8c26f7f 100644 --- a/windows/deploy/upgrade-analytics-deploy-windows.md +++ b/windows/deploy/upgrade-analytics-deploy-windows.md @@ -2,25 +2,96 @@ title: Upgrade Analytics - Get a list of computers that are upgrade-ready (Windows 10) description: Describes how to get a list of computers that are ready to be upgraded in Upgrade Analytics. ms.prod: w10 -author: MaggiePucciEvans +author: greg-lindsay --- -# Upgrade Analytics - Get a list of computers that are upgrade ready - -All of your work up to now involved reviewing and resolving application and driver issues. Along the way, as you’ve resolved issues and decided which applications and drivers are ready to upgrade, you’ve been building a list of computers that are upgrade ready. +# Upgrade Analytics - Step 3: Deploy Windows +All of your work up to now involved reviewing and resolving application and driver issues. Along the way, as you’ve resolved issues and decided which applications and drivers are ready to upgrade, you’ve been building a list of computers that are upgrade ready. The blades in the **Deploy** section are: +- [Deploy eligible computers](#deploy-eligible-computers) +- [Deploy computers by group](#computer-groups) + +>Computers that are listed in this step are assigned an **UpgradeDecision** value, and the total count of computers in each upgrade decision category is displayed. Additionally, computers are assigned an **UpgradeAssessment** value. This value is displayed by drilling down into a specific upgrade decision category. For information about upgrade assessment values, see [Upgrade assessment](#upgrade-assessment). + ## Deploy eligible computers -Computers grouped by deployment decision are listed. +In this blade, computers grouped by upgrade decision are listed. The upgrade decision on the machines is a calculated value based on the upgrade decision status for the apps and drivers installed on the computer. This value cannot be modified directly. The upgrade decision is calculated in the following ways: +- **Review in progress**: At least one app or driver installed on the computer is marked **Review in progress**. +- **Ready to upgrade**: All apps and drivers installed on the computer are marked as **Ready to Upgrade**. +- **Won’t upgrade**: At least one app or driver installed on the computer is marked as **Won’t upgrade**, or a system requirement is not met. - + Select **Export computers** for more details, including computer name, manufacturer and model, and Windows edition currently running on the computer. Sort or further query the data and then select **Export** to generate and save a comma-separated value (csv) list of upgrade-ready computers. >**Important**
When viewing inventory items in table view, the maximum number of rows that can be viewed and exported is limited to 5,000. If you need to view or export more than 5,000 items, reduce the scope of the query so you can export fewer items at a time. + +## Computer groups + +Computer groups allow you to segment your environment by creating device groups based on OMS log search results, or by importing groups from Active Directory, WSUS or System Center Configuration Manager. Computer groups are an OMS feature. For more information, see [Computer groups in OMS](https://blogs.technet.microsoft.com/msoms/2016/04/04/computer-groups-in-oms/). + +Query based computer groups are recommended in the initial release of this feature. A feature known as **Configuration Manager Upgrade Analytics Connector** is anticipated in a future release that will enable synchronization of **ConfigMgr Collections** with computer groups in OMS. + +### Getting started with Computer Groups + +When you sign in to OMS, you will see a new blade entitled **Computer Groups**. See the following example: + + + +To create a computer group, open **Log Search** and create a query based on **Type=UAComputer**, for example: + +``` +Type=UAComputer Manufacturer=DELL +``` + + + +When you are satisfied that the query is returning the intended results, add the following text to your search: + +``` +| measure count() by Computer +``` + +This will ensure every computer only shows up once. Then, save your group by clicking **Save** and **Yes**. See the following example: + + + +Your new computer group will now be available in Upgrade Analytics. See the following example: + + + +### Using Computer Groups + +When you drill into a computer group, you will see that computers are categorized by **UpgradeDecision**. For computers with the status **Review in progress** or **Won’t upgrade** you can drill down to view issues that cause a computer to be in each category, or you can simply display a list of the computers in the category. For computers that are designated **Ready to upgrade**, you can go directly to the list of computers that are ready. + + + +Viewing a list of computers in a certain status is self-explanatory, Let’s look at what happens when you click the details link on **Review in progress**: + + + +Next, select if you want to see application issues (**UAApp**) or driver issues (**UADriver**). See the following example of selecting **UAApp**: + + + +A list of apps that require review so that Dell Computers are ready for upgrade to Windows 10 is displayed. + +### Upgrade assessment + +Upgrade assessment and guidance details are explained in the following table. + +| Upgrade assessment | Action required before or after upgrade pilot? | Issue | What it means | Guidance | +|-----------------------|------------------------------------------------|----------|-----------------|---------------| +| No known issues | No | None | Computers will upgrade seamlessly.
| OK to use as-is in pilot. | +| OK to pilot, fixed during upgrade | No, for awareness only | Application or driver will not migrate to new OS | The currently installed version of an application or driver won’t migrate to the new operating system; however, a compatible version is installed with the new operating system. | OK to use as-is in pilot. | +| OK to pilot with new driver from Windows Update | Yes | Driver will not migrate to new OS | The currently installed version of a driver won’t migrate to the new operating system; however, a newer, compatible version is available from Windows Update. | Although a compatible version of the driver is installed during upgrade, a newer version is available from Windows Update.
If the computer automatically receives updates from Windows Update, no action is required. Otherwise, replace the new in-box driver with the Windows Update version after upgrading.
| + +Select **Export computers** to view pilot-ready computers organized by operating system. After you select the computers you want to use in a pilot, click Export to generate and save a comma-separated value (csv) file. + +>**Important**> When viewing inventory items in table view, the maximum number of rows that can be viewed and exported is limited to 5,000. If you need to view or export more than 5,000 items, reduce the scope of the query so you can export fewer items at a time. \ No newline at end of file diff --git a/windows/deploy/upgrade-analytics-deployment-script.md b/windows/deploy/upgrade-analytics-deployment-script.md new file mode 100644 index 0000000000..06bff0e12b --- /dev/null +++ b/windows/deploy/upgrade-analytics-deployment-script.md @@ -0,0 +1,103 @@ +--- +title: Upgrade Analytics deployment script (Windows 10) +description: Deployment script for Upgrade Analytics. +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: deploy +author: greg-lindsay +--- + +# Upgrade Analytics deployment script + +To automate the steps provided in [Get started with Upgrade Analytics](upgrade-analytics-get-started.md), and to troubleshoot data sharing issues, you can run the [Upgrade Analytics deployment script](https://go.microsoft.com/fwlink/?LinkID=822966&clcid=0x409), developed by Microsoft. + +For detailed information about using the upgrade analytics deployment script, also see the [Upgrade Analytics blog](https://blogs.technet.microsoft.com/upgradeanalytics/2016/09/20/new-version-of-the-upgrade-analytics-deployment-script-available/). + +> The following guidance applies to version 11.11.16 or later of the Upgrade Analytics deployment script. If you are using an older version, please download the latest from [Download Center](https://go.microsoft.com/fwlink/?LinkID=822966&clcid=0x409). + +The Upgrade Analytics deployment script does the following: + +1. Sets commercial ID key + CommercialDataOptIn + RequestAllAppraiserVersions keys. +2. Verifies that user computers can send data to Microsoft. +3. Checks whether the computer has a pending restart. +4. Verifies that the latest version of KB package 10.0.x is installed (version 10.0.14348 or later is required, but version 10.0.14913 or later is recommended). +5. If enabled, turns on verbose mode for troubleshooting. +6. Initiates the collection of the telemetry data that Microsoft needs to assess your organization’s upgrade readiness. +7. If enabled, displays the script’s progress in a cmd window, providing you immediate visibility into issues (success or fail for each step) and/or writes to log file. + +To run the Upgrade Analytics deployment script: + +1. Download the [Upgrade Analytics deployment script](https://go.microsoft.com/fwlink/?LinkID=822966&clcid=0x409) and extract UpgradeAnalytics.zip. Inside, there are two folders: Pilot and Deployment. The Pilot folder contains advanced logging that can help troubleshoot issues and is intended to be run from an elevated command prompt. The Deployment folder offers a lightweight script intended for broad deployment through ConfigMgr or other software deployment system. We recommend manually running the Pilot version of the script on 5-10 machines to verify that everything is configured correctly. Once you have confirmed that data is flowing successfully, proceed to run the Deployment version throughout your organization. + +2. Edit the following parameters in RunConfig.bat: + + 1. Provide a storage location for log information. You can store log information on a remote file share or a local directory. If the script is blocked from creating the log file for the given path, it creates the log files in the drive with the Windows directory. Example: %SystemDrive%\\UADiagnostics + + 2. Input your commercial ID key. This can be found in your OMS workspace under Settings -> Connected Sources -> Windows Telemetry. + + 3. By default, the script sends log information to both the console and the log file. To change the default behavior, use one of the following options: + + > *logMode = 0 log to console only* +> + > *logMode = 1 log to file and console* +> + > *logMode = 2 log to file only* + +3. To enable Internet Explorer data collection, set AllowIEData to IEDataOptIn. By default, AllowIEData is set to Disable. Then use one of the following options to determine what Internet Explorer data can be collected: + + > *IEOptInLevel = 0 Internet Explorer data collection is disabled* + > + > *IEOptInLevel = 1 Data collection is enabled for sites in the Local intranet + Trusted sites + Machine local zones* + > + > *IEOptInLevel = 2 Data collection is enabled for sites in the Internet + Restricted sites zones* + > + > *IEOptInLevel = 3 Data collection is enabled for all sites* + +4. After you finish editing the parameters in RunConfig.bat, you are ready to run the script. If you are using the Pilot version, run RunConfig.bat from an elevated command prompt. If you are using the Deployment version, use ConfigMgr or other software deployment service to run RunConfig.bat as system. + + + +The deployment script displays the following exit codes to let you know if it was successful, or if an error was encountered. + +
+
+
+
+
+
+
diff --git a/windows/deploy/upgrade-analytics-get-started.md b/windows/deploy/upgrade-analytics-get-started.md
index 1455ee624e..58a6877174 100644
--- a/windows/deploy/upgrade-analytics-get-started.md
+++ b/windows/deploy/upgrade-analytics-get-started.md
@@ -10,9 +10,25 @@ author: greg-lindsay
# Get started with Upgrade Analytics
-This topic explains how to obtain and set up Upgrade Analytics components. If you haven’t done so already, see [Upgrade Analytics requirements](https://technet.microsoft.com/itpro/windows/deploy/upgrade-analytics-requirements) for information about requirements for using Upgrade Analytics. Also, check out the [Upgrade Analytics blog](https://blogs.technet.microsoft.com/UpgradeAnalytics) for new announcements and helpful tips for using Upgrade Analytics.
+This topic explains how to obtain and configure Upgrade Analytics for your organization.
-You can use Upgrade Analytics to plan and manage your upgrade project end to end. After you’ve established communications between user computers and Microsoft, Upgrade Analytics collects computer, application, and driver data for analysis. This data is used to identify compatibility issues that can block your upgrade and to suggest fixes that are known to Microsoft.
+You can use Upgrade Analytics to plan and manage your upgrade project end-to-end. Upgrade Analytics works by establishing communications between computers in your organization and Microsoft. Upgrade Analytics collects computer, application, and driver data for analysis. This data is used to identify compatibility issues that can block your upgrade and to suggest fixes that are known to Microsoft.
+
+Before you begin, consider reviewing the following helpful information:| Exit code | Meaning | Suggested fix + |
|---|---|---|
| 0 | Success | + |
| 1 | Unexpected error occurred while executing the script | The files in the deployment script are likely corrupted. Download the [latest script](https://go.microsoft.com/fwlink/?LinkID=822966&clcid=0x409) from the download center and try again. + |
| 2 | Error when logging to console. $logMode = 0. | Try changing the $logMode value to **1** and try again. + |
| 3 | Error when logging to console and file. $logMode = 1. | Verify that you have set the logPath parameter in RunConfig.bat, and that the configuration script has access to connect and write to this location. + |
| 4 | Error when logging to file. $logMode = 2. | Verify that you have set the logPath parameter in RunConfig.bat, and that the configuration script has access to connect and write to this location. + |
| 5 | Error when logging to console and file. $logMode = unknown. | Verify that you have set the logPath parameter in RunConfig.bat, and that the configuration script has access to connect and write to this location. + |
| 6 | The commercialID parameter is set to unknown. Modify the script. | Set the value for CommercialID in runconfig.bat file. + |
| 8 | Failure to create registry key path: HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection. | Verify that the configuration script has access to this location. + |
| 9 | Error when writing CommercialId to registry. | Verify that the configuration script has access to this location. + |
| 10 | Error when writing CommercialDataOptIn to registry. | Verify that the configuration script has access to this location. + |
| 11 | Function -SetupCommercialId: Unexpected failure. | Verify that the configuration script has access to this location. + |
| 12 | Can’t connect to Microsoft – Vortex. Check your network/proxy settings. | Verify that the required endpoints are whitelisted correctly. + |
| 13 | Can’t connect to Microsoft – setting. | Verify that the required endpoints are whitelisted correctly. + |
| 14 | Can’t connect to Microsoft – compatexchange. | Verify that the required endpoints are whitelisted. + |
| 15 | Error connecting to Microsoft:Unexpected failure. | + |
| 16 | Machine requires reboot. | The reboot is required to complete the installation of the compatibility update and related KBs. Reboot the machine before running the Upgrade Analytics deployment script. + |
| 17 | Function -CheckRebootRequired: Unexpected failure. | The reboot is required to complete the installation of the compatibility update and related KBs. Reboot the machine before running the Upgrade Analytics deployment script. + |
| 18 | Outdated compatibility update KB package. Update via Windows Update/WSUS. | +The configuration script detected a version of the Compatibility update module that is older than the minimum required to correctly collect the data required by Upgrade Analytics solution. Use the latest version of the Compatibility update for Windows 7 SP1/Windows 8.1. + |
| 19 | The compatibility update failed with unexpected exception. | The files in the deployment script are likely corrupted. Download the [latest script](https://go.microsoft.com/fwlink/?LinkID=822966&clcid=0x409) from the download center and try again. + |
| 20 | Error writing RequestAllAppraiserVersions registry key. | This registry key is required for data collection to work correctly. Verify that the configuration script has access to this location. + |
| 21 | Function – SetRequestAllAppraiserVersions: Unexpected failure. | This registry key is required for data collection to work correctly. Verify that the configuration script has access to this location. + |
| 22 | RunAppraiser failed with unexpected exception. | Check %windir%\System32 directory for a file called CompatTelRunner.exe. If the file does not exist, reinstall the required compatibility updates which include this file, and check your organization group policy to make sure it does not remove this file. + |
| 23 | Error finding system variable %WINDIR%. | Make sure that this environment variable is available on the machine. + |
| 24 | SetIEDataOptIn failed when writing IEDataOptIn to registry. | Verify that the deployment script in running in a context that has access to the registry key. + |
| 25 | SetIEDataOptIn failed with unexpected exception. | The files in the deployment script are likely corrupted. Download the latest script from the [download center](https://go.microsoft.com/fwlink/?LinkID=822966&clcid=0x409) and try again. + |
| 26 | The operating system is Server or LTSB SKU. | The script does not support Server or LTSB SKUs. + |
| 27 | The script is not running under System account. | The Upgrade Analytics configuration script must be run as system. + |
| 28 | Could not create log file at the specified logPath. | Make sure the deployment script has access to the location specified in the logPath parameter. + |
| 29 | Connectivity check failed for proxy authentication. | Install the cumulative updates on the machine and enable the `DisableEnterpriseAuthProxy` authentication proxy setting. The `DisableEnterpriseAuthProxy` setting is enabled by default for Windows 7. For Windows 8.1 machines, set the `DisableEnterpriseAuthProxy` setting to **0** (not disabled). For more information on authentication proxy support, see [this blog post](https://go.microsoft.com/fwlink/?linkid=838688). + |
| 30 | Connectivity check failed. Registry key property `DisableEnterpriseAuthProxy` is not enabled. | The `DisableEnterpriseAuthProxy` setting is enabled by default for Windows 7. For Windows 8.1 machines, set the `DisableEnterpriseAuthProxy` setting to **0** (not disabled). For more information on authentication proxy support, see [this blog post](https://go.microsoft.com/fwlink/?linkid=838688). + |
| 31 | There is more than one instance of the Upgrade Analytics data collector running at the same time on this machine. | Use the Windows Task Manager to check if CompatTelRunner.exe is running, and wait until it has completed to rerun the script. +**The Upgrade Analytics task is scheduled to run daily at 3 a.m.** + |
+ - [Upgrade Analytics requirements](https://technet.microsoft.com/itpro/windows/deploy/upgrade-analytics-requirements): Provides detailed requirements to use Upgrade Analytics.
+ - [Upgrade Analytics blog](https://blogs.technet.microsoft.com/UpgradeAnalytics): Contains announcements of new features and provides helpful tips for using Upgrade Analytics. + +>If you are using System Center Configuration Manager, also check out information about how to integrate Upgrade Analytics with Configuration Manager: [Integrate Upgrade Analytics with System Center Configuration Manager](https://docs.microsoft.com/sccm/core/clients/manage/upgrade/upgrade-analytics). + +When you are ready to begin using Upgrade Analytics, perform the following steps: + +1. Review [data collection and privacy](#data-collection-and-privacy) information. +2. [Add Upgrade Analytics to OMS](#add-upgrade-analytics-to-operations-management-suite). +3. [Enable data sharing](#enable-data-sharing). +4. [Deploy required updates](#deploy-the-compatibility-update-and-related-kbs) to computers, and validate using a pilot deployment. +5. [Deploy Upgrade Analytics at scale](#deploy-upgrade-analytics-at-scale). + +## Data collection and privacy To enable system, application, and driver data to be shared with Microsoft, you must configure user computers to send data. For information about what telemetry data Microsoft collects and how that data is used and protected by Microsoft, see the following topics: @@ -20,13 +36,6 @@ To enable system, application, and driver data to be shared with Microsoft, you - [Manage connections from Windows operating system components to Microsoft services](https://technet.microsoft.com/itpro/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services) - [Windows 7, Windows 8, and Windows 8.1 appraiser telemetry events and fields](https://go.microsoft.com/fwlink/?LinkID=822965) -To configure Upgrade Analytics, you’ll need to: - -- Add the Upgrade Analytics solution to a workspace in the Operations Management Suite portal -- Establish communications and enable data sharing between your organization and Microsoft - -Each task is explained in detail in the following sections. - ## Add Upgrade Analytics to Operations Management Suite Upgrade Analytics is offered as a solution in the Microsoft Operations Management Suite (OMS), a collection of cloud based services for managing your on-premises and cloud environments. For more information about OMS, see [Operations Management Suite overview](http://azure.microsoft.com/documentation/articles/operations-management-suite-overview/). @@ -36,11 +45,8 @@ If you are already using OMS, you’ll find Upgrade Analytics in the Solutions G If you are not using OMS: 1. Go to the [Upgrade Analytics page on Microsoft.com](https://go.microsoft.com/fwlink/?LinkID=799190&clcid=0x409) and click **Sign up** to kick off the onboarding process. - 2. Sign in to Operations Management Suite (OMS). You can use either a Microsoft Account or a Work or School account to create a workspace. If your company is already using Azure Active Directory (Azure AD), use a Work or School account when you sign in to OMS. Using a Work or School account allows you to use identities from your Azure AD to manage permissions in OMS. - 3. Create a new OMS workspace. Enter a name for the workspace, select the workspace region, and provide the email address that you want associated with this workspace. Select **Create**. - 4. If your organization already has an Azure subscription, you can link it to your workspace. Note that you may need to request access from your organization’s Azure administrator. > If your organization does not have an Azure subscription, create a new one or select the default OMS Azure subscription from the list. Your workspace opens. @@ -49,11 +55,7 @@ If you are not using OMS: 2. Click the **Upgrade Analytics** tile to configure the solution. The **Settings Dashboard** opens. -## Enable data sharing between your organization and Upgrade Analytics - -After you’ve signed in to Operations Management Suite and added the Upgrade Analytics solution to your workspace, complete the following tasks to establish communication and enable data sharing between user computers, Microsoft secure data centers, and Upgrade Analytics. - -## Generate your commercial ID key +### Generate your commercial ID key Microsoft uses a unique commercial ID to map information from user computers to your OMS workspace. Generate your commercial ID key in OMS and then deploy it to user computers. @@ -65,7 +67,7 @@ Microsoft uses a unique commercial ID to map information from user computers to >**Important**
Regenerate a commercial ID key only if your original ID key can no longer be used. Regenerating a commercial ID key resets the data in your workspace for all solutions that use the ID. Additionally, you’ll need to deploy the new commercial ID key to user computers again. -## Subscribe to Upgrade Analytics +### Subscribe to Upgrade Analytics For Upgrade Analytics to receive and display upgrade readiness data from Microsoft, subscribe your OMS workspace to Upgrade Analytics. @@ -73,7 +75,7 @@ For Upgrade Analytics to receive and display upgrade readiness data from Microso 1. Click **Overview** on the Settings Dashboard to return to your OMS workspace portal. The Upgrade Analytics tile now displays summary data. Click the tile to open Upgrade Analytics. -## Whitelist select endpoints +## Enable data sharing To enable data sharing, whitelist the following endpoints. Note that you may need to get approval from your security group to do this. @@ -81,7 +83,7 @@ Note: The compatibility update KB runs under the computer’s system account. If | **Endpoint** | **Function** | |---------------------------------------------------------|-----------| -| `https://v10.vortex-win.data.microsoft.com/collect/v1`
`https://Vortex-win.data.microsoft.com/health/keepalive` | Connected User Experience and Telemetry component endpoint. User computers send data to Microsoft through this endpoint. | +| `https://v10.vortex-win.data.microsoft.com/collect/v1`
`https://Vortex-win.data.microsoft.com/health/keepalive` | Connected User Experience and Telemetry component endpoint. User computers send data to Microsoft through this endpoint. | | `https://settings.data.microsoft.com/qos` | Enables the compatibility update KB to send data to Microsoft. | | `https://go.microsoft.com/fwlink/?LinkID=544713`
`https://compatexchange1.trafficmanager.net/CompatibilityExchangeService.svc` | This service provides driver information about whether there will be a driver available post-upgrade for the hardware on the system. | @@ -103,111 +105,26 @@ If you are planning to enable IE Site Discovery, you will need to install a few |----------------------|-----------------------------------------------------------------------------| | [Review site discovery](upgrade-analytics-review-site-discovery.md) | [KB3080149](http://www.catalog.update.microsoft.com/Search.aspx?q=3080149)
Updates the Diagnostic and Telemetry tracking service to existing devices. This update is only necessary on Windows 7 and Windows 8.1 devices.
For more information about this KB, see
Install the latest [Windows Monthly Rollup](http://catalog.update.microsoft.com/v7/site/Search.aspx?q=security%20monthly%20quality%20rollup). This functionality has been included in Internet Explorer 11 starting with the July 2016 Cumulative Update. | +### Deploy the Upgrade Analytics deployment script +You can use the Upgrade Analytics deployment script to automate and verify your deployment. + +See [Upgrade Analytics deployment script](upgrade-analytics-deployment-script.md) for information on obtaining and running the script, and for a description of the error codes that can be displayed. + +>After data is sent from computers to Microsoft, it generally takes 48 hours for the data to populate in Upgrade Analytics. The compatibility update KB takes several minutes to run. If the KB does not get a chance to finish running or if the computers are inaccessible (turned off or sleeping for example), data will take longer to populate in Upgrade Analytics. For this reason, you can expect most your computers to be populated in OMS in about 1-2 weeks after deploying the KB and configuration to user computers. + +## Deploy Upgrade Analytics at scale + +When you have completed a pilot deployment, you are ready to automate data collection and distribute the deployment script to the remaining computers in your organization. ### Automate data collection To ensure that user computers are receiving the most up to date data from Microsoft, we recommend that you establish the following data sharing and analysis processes. -- Enable automatic updates for the compatibility update and related KBs. These KBs are updated frequently to include the latest application and driver issue information as we discover it during testing. -- Schedule the Upgrade Analytics deployment script to automatically run so that you don’t have to manually initiate an inventory scan each time the compatibility update KBs are updated. Computers are re-scanned only when the compatibility KBs are updated, so if your inventory changes significantly between KB releases you won’t see the changes in Upgrade Analytics until you run the script again. -- Schedule monthly user computer scans to view monthly active computer and usage information. +- Enable automatic updates for the compatibility update and related KBs. These KBs are updated frequently to include the latest application and driver issue information as we discover it during testing. +- Schedule the Upgrade Analytics deployment script to automatically run so that you don’t have to manually initiate an inventory scan each time the compatibility update KBs are updated. Computers are re-scanned only when the compatibility KBs are updated, so if your inventory changes significantly between KB releases you won’t see the changes in Upgrade Analytics until you run the script again. +- Schedule monthly user computer scans to view monthly active computer and usage information. -## Run the Upgrade Analytics deployment script +### Distribute the deployment script at scale -To automate many of the steps outlined above and to troubleshoot data sharing issues, you can run the [Upgrade Analytics deployment script](https://go.microsoft.com/fwlink/?LinkID=822966&clcid=0x409), developed by Microsoft. - -> The following guidance applies to version 11.11.16 or later of the Upgrade Analytics deployment script. If you are using an older version, please download the latest from [Download Center](https://go.microsoft.com/fwlink/?LinkID=822966&clcid=0x409). - -The Upgrade Analytics deployment script does the following: - -1. Sets commercial ID key + CommercialDataOptIn + RequestAllAppraiserVersions keys. - -2. Verifies that user computers can send data to Microsoft. - -3. Checks whether the computer has a pending restart. - -4. Verifies that the latest version of KB package 10.0.x is installed (version 10.0.14348 or later is required, but version 10.0.14913 or later is recommended). - -5. If enabled, turns on verbose mode for troubleshooting. - -6. Initiates the collection of the telemetry data that Microsoft needs to assess your organization’s upgrade readiness. - -7. If enabled, displays the script’s progress in a cmd window, providing you immediate visibility into issues (success or fail for each step) and/or writes to log file. - -To run the Upgrade Analytics deployment script: - -1. Download the [Upgrade Analytics deployment script](https://go.microsoft.com/fwlink/?LinkID=822966&clcid=0x409) and extract UpgradeAnalytics.zip. Inside, there are two folders: Pilot and Deployment. The Pilot folder contains advanced logging that can help troubleshoot issues and is intended to be run from an elevated command prompt. The Deployment folder offers a lightweight script intended for broad deployment through ConfigMgr or other software deployment system. We recommend manually running the Pilot version of the script on 5-10 machines to verify that everything is configured correctly. Once you have confirmed that data is flowing successfully, proceed to run the Deployment version throughout your organization. - -2. Edit the following parameters in RunConfig.bat: - - 1. Provide a storage location for log information. You can store log information on a remote file share or a local directory. If the script is blocked from creating the log file for the given path, it creates the log files in the drive with the Windows directory. Example: %SystemDrive%\\UADiagnostics - - 2. Input your commercial ID key. This can be found in your OMS workspace under Settings -> Connected Sources -> Windows Telemetry. - - 3. By default, the script sends log information to both the console and the log file. To change the default behavior, use one of the following options: - - > *logMode = 0 log to console only* -> - > *logMode = 1 log to file and console* -> - > *logMode = 2 log to file only* - -3. To enable Internet Explorer data collection, set AllowIEData to IEDataOptIn. By default, AllowIEData is set to Disable. Then use one of the following options to determine what Internet Explorer data can be collected: - - > *IEOptInLevel = 0 Internet Explorer data collection is disabled* - > - > *IEOptInLevel = 1 Data collection is enabled for sites in the Local intranet + Trusted sites + Machine local zones* - > - > *IEOptInLevel = 2 Data collection is enabled for sites in the Internet + Restricted sites zones* - > - > *IEOptInLevel = 3 Data collection is enabled for all sites* - -4. After you finish editing the parameters in RunConfig.bat, you are ready to run the script. If you are using the Pilot version, run RunConfig.bat from an elevated command prompt. If you are using the Deployment version, use ConfigMgr or other software deployment service to run RunConfig.bat as system. - -The deployment script displays the following exit codes to let you know if it was successful, or if an error was encountered. - -
-
-
-
-
-
-
-## Seeing data from computers in Upgrade Analytics
-
-After data is sent from computers to Microsoft, it generally takes 48 hours for the data to populate in Upgrade Analytics. The compatibility update KB takes several minutes to run. If the KB does not get a chance to finish running or if the computers are inaccessible (turned off or sleeping for example), data will take longer to populate in Upgrade Analytics. For this reason, you can expect most your computers to be populated in OMS in about 1-2 weeks after deploying the KB and configuration to user computers.
+Use a software distribution system such as System Center Configuration Manager to distribute the Upgrade Analytics deployment script at scale. For more information, see the [Upgrade Analytics blog](https://blogs.technet.microsoft.com/upgradeanalytics/2016/09/20/new-version-of-the-upgrade-analytics-deployment-script-available/).
\ No newline at end of file
diff --git a/windows/deploy/upgrade-analytics-identify-apps.md b/windows/deploy/upgrade-analytics-identify-apps.md
new file mode 100644
index 0000000000..cfd5df068f
--- /dev/null
+++ b/windows/deploy/upgrade-analytics-identify-apps.md
@@ -0,0 +1,36 @@
+---
+title: Upgrade Analytics - Identify important apps (Windows 10)
+description: Describes how to prepare your environment so that you can use Upgrade Analytics to manage Windows upgrades.
+ms.prod: w10
+author: greg-lindsay
+---
+
+# Upgrade Analytics - Step 1: Identify important apps
+
+This is the first step of the Upgrade Analytics workflow. In this step, applications are listed and grouped by importance level. Setting the importance level enables you to prioritize applications for upgrade.
+
+
+
+
+
+Select **Assign importance** to change an application’s importance level. By default, applications are marked **Not reviewed** or **Low install count** until you assign a different importance level to them.
+
+To change an application’s importance level:
+
+1. Select **Not reviewed** or **Low install count** on the **Prioritize applications** blade to view the list of applications with that importance level.
+2. Select the applications you want to change to a specific importance level and then select the appropriate option from the **Select importance level** list.
+3. Click **Save** when finished.
+
+Importance levels include:
+
+| Importance level | When to use it | Recommendation |
+|--------------------|------------------|------------------|
+| Low install count | We give you a head start by identifying applications that are installed on 2% or less of your total computer inventory. \[Number of computers application is installed on/total number of computers in your inventory.\]| Exit code | Meaning | Suggested fix - |
|---|---|---|
| 0 | Success | - |
| 1 | Unexpected error occurred while executing the script | The files in the deployment script are likely corrupted. Download the [latest script](https://go.microsoft.com/fwlink/?LinkID=822966&clcid=0x409) from the download center and try again. - |
| 2 | Error when logging to console. $logMode = 0. | Try changing the $logMode value to **1** and try again. - |
| 3 | Error when logging to console and file. $logMode = 1. | Verify that you have set the logPath parameter in RunConfig.bat, and that the configuration script has access to connect and write to this location. - |
| 4 | Error when logging to file. $logMode = 2. | Verify that you have set the logPath parameter in RunConfig.bat, and that the configuration script has access to connect and write to this location. - |
| 5 | Error when logging to console and file. $logMode = unknown. | Verify that you have set the logPath parameter in RunConfig.bat, and that the configuration script has access to connect and write to this location. - |
| 6 | The commercialID parameter is set to unknown. Modify the script. | Set the value for CommercialID in runconfig.bat file. - |
| 8 | Failure to create registry key path: HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection. | Verify that the configuration script has access to this location. - |
| 9 | Error when writing CommercialId to registry. | Verify that the configuration script has access to this location. - |
| 10 | Error when writing CommercialDataOptIn to registry. | Verify that the configuration script has access to this location. - |
| 11 | Function -SetupCommercialId: Unexpected failure. | Verify that the configuration script has access to this location. - |
| 12 | Can’t connect to Microsoft – Vortex. Check your network/proxy settings. | Verify that the required endpoints are whitelisted correctly. - |
| 13 | Can’t connect to Microsoft – setting. | Verify that the required endpoints are whitelisted correctly. - |
| 14 | Can’t connect to Microsoft – compatexchange. | Verify that the required endpoints are whitelisted. - |
| 15 | Error connecting to Microsoft:Unexpected failure. | - |
| 16 | Machine requires reboot. | The reboot is required to complete the installation of the compatibility update and related KBs. Reboot the machine before running the Upgrade Analytics deployment script. - |
| 17 | Function -CheckRebootRequired: Unexpected failure. | The reboot is required to complete the installation of the compatibility update and related KBs. Reboot the machine before running the Upgrade Analytics deployment script. - |
| 18 | Outdated compatibility update KB package. Update via Windows Update/WSUS. | -The configuration script detected a version of the Compatibility update module that is older than the minimum required to correctly collect the data required by Upgrade Analytics solution. Use the latest version of the Compatibility update for Windows 7 SP1/Windows 8.1. - |
| 19 | The compatibility update failed with unexpected exception. | The files in the deployment script are likely corrupted. Download the [latest script](https://go.microsoft.com/fwlink/?LinkID=822966&clcid=0x409) from the download center and try again. - |
| 20 | Error writing RequestAllAppraiserVersions registry key. | This registry key is required for data collection to work correctly. Verify that the configuration script has access to this location. - |
| 21 | Function – SetRequestAllAppraiserVersions: Unexpected failure. | This registry key is required for data collection to work correctly. Verify that the configuration script has access to this location. - |
| 22 | RunAppraiser failed with unexpected exception. | Check %windir%\System32 directory for a file called CompatTelRunner.exe. If the file does not exist, reinstall the required compatibility updates which include this file, and check your organization group policy to make sure it does not remove this file. - |
| 23 | Error finding system variable %WINDIR%. | Make sure that this environment variable is available on the machine. - |
| 24 | SetIEDataOptIn failed when writing IEDataOptIn to registry. | Verify that the deployment script in running in a context that has access to the registry key. - |
| 25 | SetIEDataOptIn failed with unexpected exception. | The files in the deployment script are likely corrupted. Download the latest script from the [download center](https://go.microsoft.com/fwlink/?LinkID=822966&clcid=0x409) and try again. - |
| 26 | The operating system is Server or LTSB SKU. | The script does not support Server or LTSB SKUs. - |
| 27 | The script is not running under System account. | The Upgrade Analytics configuration script must be run as system. - |
| 28 | Could not create log file at the specified logPath. | Make sure the deployment script has access to the location specified in the logPath parameter. - |
| 29 | Connectivity check failed for proxy authentication. | Install the cumulative updates on the machine and enable the `DisableEnterpriseAuthProxy` authentication proxy setting. The `DisableEnterpriseAuthProxy` setting is enabled by default for Windows 7. For Windows 8.1 machines, set the `DisableEnterpriseAuthProxy` setting to **0** (not disabled). For more information on authentication proxy support, see [this blog post](https://go.microsoft.com/fwlink/?linkid=838688). - |
| 30 | Connectivity check failed. Registry key property `DisableEnterpriseAuthProxy` is not enabled. | The `DisableEnterpriseAuthProxy` setting is enabled by default for Windows 7. For Windows 8.1 machines, set the `DisableEnterpriseAuthProxy` setting to **0** (not disabled). For more information on authentication proxy support, see [this blog post](https://go.microsoft.com/fwlink/?linkid=838688). - |
| 31 | There is more than one instance of the Upgrade Analytics data collector running at the same time on this machine. | Use the Windows Task Manager to check if CompatTelRunner.exe is running, and wait until it has completed to rerun the script. -**The Upgrade Analytics task is scheduled to run daily at 3 a.m.** - |
Low install count applications are automatically marked as **Ready to upgrade** in the **UpgradeDecision** column unless they have issues that need attention.
| Be sure to review low install count applications for any business critical or important applications that are not yet upgrade-ready, despite their low installation rates. For example, payroll apps or tax accounting apps tend to be installed on a relatively small number of machines but are still considered business critical applications.
| +| Not reviewed | Applications that are installed on more than 2% of your total computer inventory are marked not reviewed until you set their importance level.
| Once you’ve started to investigate an application to determine its importance level and upgrade readiness, change its status to **Review in progress** in both the **Importance** and **UpgradeDecision** columns. | +| Business critical | By default, no applications are marked as business critical because only you can make that determination. If you know that an application is critical to your organization’s functioning, mark it **Business critical**.
| You may also want to change the application’s status to **Review in progress** in the **UpgradeDecision** column to let other team members know that you’re working on getting this business critical application upgrade-ready. Once you’ve fixed any issues and validated that the application will migrate successfully, change the upgrade decision to **Ready to upgrade**.
| +| Important | By default, no applications are marked as important because only you can make that determination. If the application is important but not critical to your organization’s functioning, mark it **Important**. | You may also want to change the application’s status to **Review in progress** in the **UpgradeDecision** column to let other team members know that you’re working on getting this important application upgrade-ready. Once you’ve fixed any issues and validated that the application will migrate successfully, change the upgrade decision to **Ready to upgrade**.
| +| Ignore | By default, no applications are marked as ignore because only you can make that determination. If the application is not important to your organization’s functioning, such as user-installed applications and games, you may not want to spend time and money validating that these applications will migrate successfully. Mark these applications **Ignore**.
| Set the application’s importance level to **Ignore** to let other team members know that it can be left as-is with no further investigation or testing. If you set the importance level to ignore, and this is an app that you are not planning on testing or validating, consider changing the upgrade decision to **Ready to upgrade**. By marking these apps ready to upgrade, you are indicating that you are comfortable upgrading with the app remaining in its current state.
| +| Review in progress | Once you’ve started to investigate an application to determine its importance level and upgrade readiness, change its status to **Review in progress** in both the **Importance** and **UpgradeDecision** columns.
| As you learn more about the application’s importance to your organization’s functioning, change the importance level to **Business critical**, **Important**, or **Ignore**.
Until you’ve determined that priority applications will migrate successfully, leave the upgrade decision status as **Review in progress**.
| + diff --git a/windows/deploy/upgrade-analytics-prepare-your-environment.md b/windows/deploy/upgrade-analytics-prepare-your-environment.md index a73829de5b..78eeaa078b 100644 --- a/windows/deploy/upgrade-analytics-prepare-your-environment.md +++ b/windows/deploy/upgrade-analytics-prepare-your-environment.md @@ -1,116 +1,4 @@ --- -title: Upgrade Analytics - Prepare your environment (Windows 10) -description: Describes how to prepare your environment so that you can use Upgrade Analytics to manage Windows upgrades. -ms.prod: w10 -author: MaggiePucciEvans ---- - -# Upgrade Analytics - Prepare your environment - -This section of the Upgrade Analytics workflow reports your computer and application inventory and lists computers that you can use in a pilot with no known issues or with fixable driver issues. Additionally, you can determine the priority level of applications to indicate which applications the team should focus on to get them upgrade ready. - -The blades in the **Prepare your environment** section are: - -## Upgrade overview - -Displays the total count of computers sharing data with Microsoft and the count of computers upgraded. As you successfully upgrade computers, the count of computers upgraded increases. - -Check this blade for data refresh status, including the date and time of the most recent data update and whether user changes are reflected. If a user change is pending when changing the upgrade assessment or importance level of an application or driver, **Data refresh pending** is displayed in orange. User changes are processed once every 24 hours and read **Up to date** in green when there are no pending changes. - - - - - -Select **Total computers** for a list of computers and details about them, including: - -- Computer ID and computer name - -- Computer manufacturer - -- Computer model - -- Operating system version and build - -- Count of system requirement, application, and driver issues per computer - -- Upgrade assessment based on analysis of computer telemetry data - -- Upgrade decision status - -Select **Total applications** for a list of applications discovered on user computers and details about them, including: - -- Application vendor - -- Application version - -- Count of computers the application is installed on - -- Count of computers that opened the application at least once in the past 30 days - -- Percentage of computers in your total computer inventory that opened the application in the past 30 days - -- Issues detected, if any - -- Upgrade assessment based on analysis of application data - -- Roll up level - -## Run a pilot - -Computers with no known issues and computers with fixable driver issues are listed, grouped by upgrade assessment. We recommend that you use these computers to test the impact of upgrading. - - - - - -Before you start your pilot project, be sure to review upgrade assessment and guidance details, explained in more detail in the table below. - -| Upgrade assessment | Action required before or after upgrade pilot? | Issue | What it means | Guidance | -|-----------------------|------------------------------------------------|----------|-----------------|---------------| -| No known issues | No | None | Computers will upgrade seamlessly.
| OK to use as-is in pilot. | -| OK to pilot, fixed during upgrade | No, for awareness only | Application or driver will not migrate to new OS | The currently installed version of an application or driver won’t migrate to the new operating system; however, a compatible version is installed with the new operating system. | OK to use as-is in pilot. | -| OK to pilot with new driver from Windows Update | Yes | Driver will not migrate to new OS | The currently installed version of a driver won’t migrate to the new operating system; however, a newer, compatible version is available from Windows Update. | Although a compatible version of the driver is installed during upgrade, a newer version is available from Windows Update.
If the computer automatically receives updates from Windows Update, no action is required. Otherwise, replace the new in-box driver with the Windows Update version after upgrading.
| - -Select **Export computers** to view pilot-ready computers organized by operating system. After you select the computers you want to use in a pilot, click Export to generate and save a comma-separated value (csv) file. - ->**Important**> When viewing inventory items in table view, the maximum number of rows that can be viewed and exported is limited to 5,000. If you need to view or export more than 5,000 items, reduce the scope of the query so you can export fewer items at a time. - -See [Plan for Windows 10 deployment](http://technet.microsoft.com/itpro/windows/plan/index) for more information about ways to deploy Windows in your organization. Read about [how Microsoft IT deployed Windows as an in-place upgrade](https://www.microsoft.com/itshowcase/Article/Content/668/Deploying-Windows-10-at-Microsoft-as-an-inplace-upgrade) for best practices using the in-place upgrade method. - -## Prioritize applications - -Applications are listed, grouped by importance level. Prioritizing your applications allows you to identify the ones that you will focus on preparing for upgrade. - - - - - -Select **Assign importance** to change an application’s importance level. By default, applications are marked **Not reviewed** or **Low install count** until you assign a different importance level to them. - -To change an application’s importance level: - -1. Select **Not reviewed** or **Low install count** on the **Prioritize applications** blade to view the list of applications with that importance level. Select **Table** to view the list in a table. - -2. Select **User changes** to enable user input. - -3. Select the applications you want to change to a specific importance level and then select the appropriate option from the **Select importance level** list. - -4. Click **Save** when finished. - -Importance levels include: - -| Importance level | When to use it | Recommendation | -|--------------------|------------------|------------------| -| Low install count | We give you a head start by identifying applications that are installed on 2% or less of your total computer inventory. \[Number of computers application is installed on/total number of computers in your inventory.\]
Low install count applications are automatically marked as **Ready to upgrade** in the **UpgradeDecision** column unless they have issues that need attention.
| Be sure to review low install count applications for any business critical or important applications that are not yet upgrade-ready, despite their low installation rates.
| -| Not reviewed | Applications that are installed on more than 2% of your total computer inventory are marked not reviewed until you change the importance level.
These applications are also marked as **Not reviewed** in the **UpgradeDecision** column.
| Once you’ve started to investigate an application to determine its importance level and upgrade readiness, change its status to **Review in progress** in both the **Importance** and **UpgradeDecision** columns. | -| Business critical | By default, no applications are marked as business critical because only you can make that determination. If you know that an application is critical to your organization’s functioning, mark it **Business critical**.
| You may also want to change the application’s status to **Review in progress** in the **UpgradeDecision** column to let other team members know that you’re working on getting this business critical application upgrade-ready. Once you’ve fixed any issues and validated that the application will migrate successfully, change the upgrade decision to **Ready to upgrade**.
| -| Important | By default, no applications are marked as important because only you can make that determination. If the application is important but not critical to your organization’s functioning, mark it **Important**. | You may also want to change the application’s status to **Review in progress** in the **UpgradeDecision** column to let other team members know that you’re working on getting this important application upgrade-ready. Once you’ve fixed any issues and validated that the application will migrate successfully, change the upgrade decision to **Ready to upgrade**.
| -| Ignore | By default, no applications are marked as ignore because only you can make that determination. If the application is not important to your organization’s functioning, such as user-installed applications and games, you may not want to spend time and money validating that these applications will migrate successfully. Mark these applications **Ignore**.
| Set the application’s importance level to **Ignore** to let other team members know that it can be left as-is with no further investigation or testing.
You may also want to change the application’s status to **Not reviewed** or **Ready to upgrade** in the **UpgradeDecision** column.
| -| Review in progress | Once you’ve started to investigate an application to determine its importance level and upgrade readiness, change its status to **Review in progress** in both the **Importance** and **UpgradeDecision** columns.
| As you learn more about the application’s importance to your organization’s functioning, change the importance level to **Business critical**, **Important**, or **Ignore**.
Until you’ve determined that priority applications will migrate successfully, leave the upgrade decision status as **Review in progress**.
| - +title: Upgrade Analytics - Identify important apps (Windows 10) +redirect_url: upgrade-analytics-identify-apps +--- \ No newline at end of file diff --git a/windows/deploy/upgrade-analytics-requirements.md b/windows/deploy/upgrade-analytics-requirements.md index 0dd920f998..3875acc090 100644 --- a/windows/deploy/upgrade-analytics-requirements.md +++ b/windows/deploy/upgrade-analytics-requirements.md @@ -2,7 +2,7 @@ title: Upgrade Analytics requirements (Windows 10) description: Provides requirements for Upgrade Analytics. ms.prod: w10 -author: MaggiePucciEvans +author: greg-lindsay --- # Upgrade Analytics requirements @@ -33,6 +33,10 @@ If you are not using OMS, go to [the Upgrade Analytics page on Microsoft.com](ht Important: You can use either a Microsoft Account or a Work or School account to create a workspace. If your company is already using Azure Active Directory, use a Work or School account when you sign in to OMS. Using a Work or School account allows you to use identities from your Azure AD to manage permissions in OMS. +## System Center Configuration Manager integration + +Upgrade Analytics can be integrated with your installation of Configuration Manager. For more information, see [Integrate Upgrade Analytics with System Center Configuration Manager](https://docs.microsoft.com/sccm/core/clients/manage/upgrade/upgrade-analytics). + ## Telemetry and data sharing After you’ve signed in to Operations Management Suite and added the Upgrade Analytics solution to your workspace, you’ll need to complete the following tasks to allow user computer data to be shared with and assessed by Upgrade Analytics. @@ -41,19 +45,13 @@ See [Windows 7, Windows 8, and Windows 8.1 appraiser telemetry events and fields **Whitelist telemetry endpoints.** To enable telemetry data to be sent to Microsoft, you’ll need to whitelist the following Microsoft telemetry endpoints on your proxy server or firewall. You may need to get approval from your security group to do this. -`https://v10.vortex-win.data.microsoft.com/collect/v1` - -`https://vortex-win.data.microsoft.com/health/keepalive` - -`https://settings-win.data.microsoft.com/settings` - -`https://vortex.data.microsoft.com/health/keepalive` - -`https://settings.data.microsoft.com/qos` - -`https://go.microsoft.com/fwlink/?LinkID=544713` - -`https://compatexchange1.trafficmanager.net/CompatibilityExchangeService.svc/extended` +`https://v10.vortex-win.data.microsoft.com/collect/v1`
+`https://vortex-win.data.microsoft.com/health/keepalive`
+`https://settings-win.data.microsoft.com/settings`
+`https://vortex.data.microsoft.com/health/keepalive`
+`https://settings.data.microsoft.com/qos`
+`https://go.microsoft.com/fwlink/?LinkID=544713`
+`https://compatexchange1.trafficmanager.net/CompatibilityExchangeService.svc/extended`
>**Note** The compatibility update KB runs under the computer’s system account and does not support user authentication in this release. diff --git a/windows/deploy/upgrade-analytics-resolve-issues.md b/windows/deploy/upgrade-analytics-resolve-issues.md index 6a61a18a33..ec6f782f9e 100644 --- a/windows/deploy/upgrade-analytics-resolve-issues.md +++ b/windows/deploy/upgrade-analytics-resolve-issues.md @@ -2,10 +2,10 @@ title: Upgrade Analytics - Resolve application and driver issues (Windows 10) description: Describes how to resolve application and driver issues that can occur during an upgrade with Upgrade Analytics. ms.prod: w10 -author: MaggiePucciEvans +author: greg-lindsay --- -# Upgrade Analytics - Resolve application and driver issues +# Upgrade Analytics - Step 2: Resolve app and driver issues This section of the Upgrade Analytics workflow reports application and driver inventory and shows you which applications have known issues, which applications have no known issues, and which drivers have issues. We identify applications and drivers that need attention and suggest fixes when we know about them. @@ -15,10 +15,10 @@ Upgrade decisions include: | Upgrade decision | When to use it | Guidance | |--------------------|-------------------|-------------| -| Not reviewed | When you start to investigate an application or a driver to determine upgrade readiness, change their upgrade decision to **Review in progress.**
| Some applications are automatically assigned upgrade decisions based on information known to Microsoft.
All drivers are marked not reviewed by default.
| -| Review in progress | When you start to investigate an application or a driver to determine upgrade readiness, change their upgrade decision to **Review in progress**.
Until you’ve determined that applications and drivers will migrate successfully or you’ve resolved blocking issues, leave the upgrade decision status as **Review in progress**.
| Once you’ve fixed any issues and validated that the application or driver will migrate successfully, change the upgrade decision to **Ready to upgrade**.
| -| Ready to upgrade | Mark applications and drivers **Ready to upgrade** once you’ve resolved all blocking issues and you’re confident that they will upgrade successfully, or if you’ve decided to upgrade them as-is. | Applications with no known issues or with low installation rates are marked **Ready to upgrade** by default.
Be sure to review low install count applications for any business critical or important applications that are not yet upgrade-ready, despite their low installation rates.
All drivers are marked **Not reviewed** by default.
| -| Won’t upgrade | By default, no applications or drivers are marked **Won’t upgrade** because only you can make that determination.
Use **Won’t upgrade** for applications and drivers you don’t want to upgrade.
| If, during your investigation into an application or driver, you determine that they should not or cannot be upgraded, mark them **Won’t upgrade**.
| +| Not reviewed | All drivers are marked as Not reviewed by default.
Any app that has not been marked **Low install count** will also have an upgrade decision of **Not reviewed** by default.
| Apps you have not yet reviewed or are waiting to review later should be marked as **Not reviewed**. When you start to investigate an application or a driver to determine upgrade readiness, change their upgrade decision to **Review in progress**.
| +| Review in progress | When you start to investigate an application or a driver to determine upgrade readiness, change its upgrade decision to **Review in progress**.
Until you’ve determined that applications and drivers will migrate successfully or you’ve resolved blocking issues, leave the upgrade decision status as **Review in progress**.
| Once you’ve fixed any issues and validated that the application or driver will migrate successfully, change the upgrade decision to **Ready to upgrade**.
| +| Ready to upgrade | Mark applications and drivers **Ready to upgrade** once you’ve resolved all blocking issues and you’re confident that they will upgrade successfully, or if you’ve decided to upgrade them as-is. | Applications with no known issues and with low installation rates are marked **Ready to upgrade** by default.
In Step 1, you might have marked some of your apps as **Ignore**. These should be marked as **Ready to upgrade**. Apps with low installation rates are marked as **Ready to upgrade** by default. Be sure to review any low install count applications for any business critical or important applications that are not yet upgrade-ready, despite their low installation rates.
| +| Won’t upgrade | By default, no applications or drivers are marked **Won’t upgrade** because only you can make that determination.
Use **Won’t upgrade** for applications and drivers that you do not work on your target operating system, or that you are unable to upgrade.
| If, during your investigation into an application or driver, you determine that they should not or cannot be upgraded, mark them **Won’t upgrade**.
| The blades in the **Resolve issues** section are: @@ -26,7 +26,7 @@ The blades in the **Resolve issues** section are: - Review applications with no known issues - Review drivers with known issues -As you review applications with known issues, you can also see ISV support of applications for [Ready for Windows](https://www.readyforwindows.com/). +As you review applications with known issues, you can also see ISV support statements or applications using [Ready for Windows](https://www.readyforwindows.com/). ## Review applications with known issues @@ -41,13 +41,9 @@ Applications with issues known to Microsoft are listed, grouped by upgrade asses To change an application's upgrade decision: 1. Select **Decide upgrade readiness** to view applications with issues. - -2. In the table view, sort on **UpgradeAssessment** to group applications into **Attention needed** and **Fix available**. - -3. Select **User changes** to change the upgrade decision for each application. - +2. In the table view, select an **UpgradeDecision** value. +3. Select **Decide upgrade readiness** to change the upgrade decision for each application. 4. Select the applications you want to change to a specific upgrade decision and then then select the appropriate option from the **Select upgrade decision** list. - 5. Click **Save** when finished. IMORTANT: Ensure that you have the most recent versions of the compatibility update and related KBs installed to get the most up-to-date compatibility information. diff --git a/windows/deploy/upgrade-analytics-review-site-discovery.md b/windows/deploy/upgrade-analytics-review-site-discovery.md index 5f0e5067ad..e42b53e9d0 100644 --- a/windows/deploy/upgrade-analytics-review-site-discovery.md +++ b/windows/deploy/upgrade-analytics-review-site-discovery.md @@ -1,68 +1,7 @@ --- title: Review site discovery -description: Explains how to review internet web site discovery with Upgrade Analytics. -ms.prod: w10 -author: Justinha +redirect_url: upgrade-analytics-additional-insights --- -# Review site discovery - -This section of the Upgrade Analytics workflow provides an inventory of web sites that are being used by client computers that run Internet Explorer on Windows 8.1 and Windows 7 in your environment. This inventory information is provided as optional data related to upgrading to Windows 10 and Internet Explorer 11, and is meant to help prioritize compatibility testing for web applications. You can make more informed decisions about testing based on usage data. Data from Microsoft Edge is not collected. - -> Note: Site discovery data is disabled by default; you can find documentation on what is collected in the [Windows 7, Windows 8, and Windows 8.1 appraiser telemetry events and fields](https://go.microsoft.com/fwlink/?LinkID=822965). After you turn on this feature, data is collected on all sites visited by Internet Explorer, except during InPrivate sessions. In addition, the data collection process is silent, without notification to the employee. You are responsible for ensuring that your use of this feature complies with all applicable local laws and regulatory requirements, including any requirements to provide notice to employees. - -## Install prerequisite security update for Internet Explorer - -Ensure the following prerequisites are met before using site discovery: - -1. Install the latest [Windows Monthly Rollup](http://catalog.update.microsoft.com/v7/site/Search.aspx?q=security%20monthly%20quality%20rollup). This functionality has been included in Internet Explorer 11 starting with the July 2016 Cumulative Update. -2. Install the update for customer experience and diagnostic telemetery ([KB3080149](https://support.microsoft.com/kb/3080149)). -3. Enable Internet Explorer data collection, which is disabled by default. The best way to enable it is to modify the [Upgrade Analytics deployment script](upgrade-analytics-get-started.md#run-the-upgrade-analytics-deployment-script) to allow Internet Explorer data collection before you run it. - - If necessary, you can also enable it by creating the following registry entry. - - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection - - Entry name: IEDataOptIn - - Data type: DWORD - - Values: - - > *IEOptInLevel = 0 Internet Explorer data collection is disabled* - > - > *IEOptInLevel = 1 Data collection is enabled for sites in the Local intranet + Trusted sites + Machine local zones* - > - > *IEOptInLevel = 2 Data collection is enabled for sites in the Internet + Restricted sites zones* - > - > *IEOptInLevel = 3 Data collection is enabled for all sites* - - For more information about Internet Explorer Security Zones, see [About URL Security Zones](https://msdn.microsoft.com/library/ms537183.aspx). - -  - -## Review most active sites - -This blade indicates the most visited sites by computers in your environment. Review this list to determine which web applications and sites are used most frequently. The number of visits is based on the total number of views, and not by the number of unique devices accessing a page. - -For each site, the fully qualified domain name will be listed. You can sort the data by domain name or by URL. - - - -Click the name of any site in the list to drill down into more details about the visits, including the time of each visit and the computer name. - - - -## Review document modes in use - -This blade provides information about which document modes are used in the sites that are visited in your environment. Document modes are used to provide compatibility with older versions of Internet Explorer. Sites that use older technologies may require additional testing and are less likely to be compatible with Microsoft Edge. Counts are based on total page views and not the number of unique devices. For more information about document modes, see [Deprecated document modes](https://technet.microsoft.com/itpro/internet-explorer/ie11-deploy-guide/deprecated-document-modes). - - - -## Run browser-related queries - -You can run predefined queries to capture more info, such as sites that have Enterprise Mode enabled, or the number of unique computers that have visited a site. For example, this query returns the most used ActiveX controls. You can modify and save the predefined queries. - - diff --git a/windows/deploy/upgrade-analytics-upgrade-overview.md b/windows/deploy/upgrade-analytics-upgrade-overview.md new file mode 100644 index 0000000000..4d1885b34a --- /dev/null +++ b/windows/deploy/upgrade-analytics-upgrade-overview.md @@ -0,0 +1,51 @@ +--- +title: Upgrade Analytics - Upgrade Overview (Windows 10) +description: Displays the total count of computers sharing data and upgraded. +ms.prod: w10 +author: greg-lindsay +--- + +# Upgrade Analytics - Upgrade overview + +The first blade in the Upgrade Analytics solution is the upgrade overview blade. This blade displays the total count of computers sharing data with Microsoft, and the count of computers upgraded. As you successfully upgrade computers, the count of computers upgraded increases. + +The upgrade overivew blade displays data refresh status, including the date and time of the most recent data update and whether user changes are reflected. The following status changes are reflected on the upgrade overview blade: + +- Computers with incomplete data: + - Less than 4% = count is displayed in green. + - 4% - 10% = Count is displayed in amber. + - Greater than 10% = Count is displayed in red. +- Delay processing device inventory data = The "Last updated" banner is displayed in amber. +- Pending user changes = User changes count displays "Data refresh pending" in amber. +- No pending user changes = User changes count displays "Up to date" in green. + +In the following example, less than 4% of (3k\355k) computers have incomplete data, and there are no pending user changes: + + + + + +If data processing is delayed, you can continue using your workspace as normal. However, any changes or additional information that is added might not be displayed. Data is typically refreshed and the display will return to normal again within 24 hours. + +Select **Total computers** for a list of computers and details about them, including: + +- Computer ID and computer name +- Computer manufacturer +- Computer model +- Operating system version and build +- Count of system requirement, application, and driver issues per computer +- Upgrade assessment based on analysis of computer telemetry data +- Upgrade decision status + +Select **Total applications** for a list of applications discovered on user computers and details about them, including: + +- Application vendor +- Application version +- Count of computers the application is installed on +- Count of computers that opened the application at least once in the past 30 days +- Percentage of computers in your total computer inventory that opened the application in the past 30 days +- Issues detected, if any +- Upgrade assessment based on analysis of application data +- Rollup level \ No newline at end of file diff --git a/windows/deploy/use-upgrade-analytics-to-manage-windows-upgrades.md b/windows/deploy/use-upgrade-analytics-to-manage-windows-upgrades.md index 4045eb3913..3b686e8dae 100644 --- a/windows/deploy/use-upgrade-analytics-to-manage-windows-upgrades.md +++ b/windows/deploy/use-upgrade-analytics-to-manage-windows-upgrades.md @@ -2,27 +2,51 @@ title: Use Upgrade Analytics to manage Windows upgrades (Windows 10) description: Describes how to use Upgrade Analytics to manage Windows upgrades. ms.prod: w10 -author: MaggiePucciEvans +author: greg-lindsay --- # Use Upgrade Analytics to manage Windows upgrades -This topic explains how to use the Upgrade Analytics solution to plan, manage, and deploy Windows upgrades. +You can use Upgrade Analytics to prioritize and work through application and driver issues, assign and track issue resolution status, and identify computers that are ready to upgrade. Upgrade Analytics enables you to deploy Windows with confidence, knowing that you’ve addressed potential blocking issues. -Based on telemetry data from user computers, Upgrade Analytics identifies application and driver compatibility issues that may block Windows upgrades, allowing you to make data-driven decisions about your organization’s upgrade readiness. +- Based on telemetry data from user computers, Upgrade Analytics identifies application and driver compatibility issues that may block Windows upgrades, allowing you to make data-driven decisions about your organization’s upgrade readiness. +- Information is refreshed daily so you can monitor upgrade progress. Any changes your team makes, such as assigning application importance and marking applications as ready to upgrade, are reflected 24 hours after you make them. -You and your IT team can use the Upgrade Analytics workflow to prioritize and work through application and driver issues, assign and track issue resolution status, and identify computers that are ready to upgrade. You can then export the list of upgrade-ready computers and start deploying Windows with confidence, knowing that you’ve addressed potential blocking issues. +When you are ready to begin the upgrade process, a workflow is provided to guide you through critical high-level tasks. -Information is refreshed daily so you can monitor upgrade progress. Any changes your team makes, such as assigning application importance and marking applications as ready to upgrade, are reflected 24 hours after you make them. + -The Upgrade Analytics workflow gives you compatibility and usage information about computers, applications, and drivers and walks you through these high-level tasks. Each task is described in more detail in the topics that follow. +Each step in the workflow is enumerated using blue tiles. Helpful data is provided on white tiles to help you get started, to monitor your progress, and to complete each step. -1. [Preparing your environment](upgrade-analytics-prepare-your-environment.md) +>**Important**: You can use the [Target OS](#target-os) setting to evaluate computers that are runnign a specified version of Windows before starting the Upgrade Analytics workflow. By default, the Target OS is configured to the released version of Windows 10 for the Current Branch for Business (CBB). -2. [Resolving application and driver issues](upgrade-analytics-resolve-issues.md) +The following information and workflow is provided: -3. [Identifying computers that are upgrade ready](upgrade-analytics-deploy-windows.md) +- [Upgrade overview](upgrade-analytics-upgrade-overview.md): Review compatibility and usage information about computers, applications, and drivers. +- [Step 1: Identify important apps](upgrade-analytics-identify-apps.md): Assign importance levels to prioritize your applications. +- [Step 2: Resolve issues](upgrade-analytics-resolve-issues.md): Identify and resolve problems with applications. +- [Step 3: Deploy](upgrade-analytics-deploy-windows.md): Start the upgrade process. -4. [Review site discovery](upgrade-analytics-review-site-discovery.md) +Also see the following topic for information about additional items that can be affected by the upgrade process: +- [Additional insights](upgrade-analytics-additional-insights.md): Find out which MS Office add-ins are installed, and review web site activity. +## Target OS + +The target OS setting is used to evaluate the number of computers that are already running the default version of Windows 10, or a later version. + +As mentioned previously, the default target OS in Upgrade Analytics is set to the released version of the Current Branch for Business (CBB). CBB can be determined by reviewing [Windows 10 release information](https://technet.microsoft.com/windows/release-info.aspx). The target OS setting is used to evaluate the number of computers that are already running this version of Windows, or a later version. + +The number displayed under **Computers upgraded** in the Upgrade Overview blade is the total number of computers that are already running the same or a later version of Windows compared to the target OS. It also is used in the evaluation of apps and drivers: Known issues and guidance for the apps and drivers in Upgrade Analytics is based on the target OS version. + +You now have the ability to change the Windows 10 version you wish to target. The available options currently are: Windows 10 version 1507, Windows 10 version 1511, and Windows version 1610. + +To change the target OS setting, click on **Solutions Settings**, which appears at the top when you open you Upgrade Analytics solution: + + + +>You must be signed in to Upgrade Analytics as an administrator to view settings. + +On the **Upgrade Analytics Settings** page, choose one of the options in the drop down box and click **Save**. The changes in the target OS setting are reflected in evaluations when a new snapshot is uploaded to your workspace. + + diff --git a/windows/deploy/usmt-overview.md b/windows/deploy/usmt-overview.md index 9f6a18384a..9dca476f1c 100644 --- a/windows/deploy/usmt-overview.md +++ b/windows/deploy/usmt-overview.md @@ -35,7 +35,7 @@ USMT provides the following benefits to businesses that are deploying Windows op - Increases employee satisfaction with the migration experience. ## Limitations -USMT is intended for administrators who are performing large-scale automated deployments. If you are only migrating the user states of a few computers, you can use [Windows Easy Transfer](https://go.microsoft.com/fwlink/p/?LinkId=140248). +USMT is intended for administrators who are performing large-scale automated deployments. If you are only migrating the user states of a few computers, you can use [PCmover Express](http://go.microsoft.com/fwlink/?linkid=620915). PCmover Express is a tool created by Microsoft's partner, Laplink. There are some scenarios in which the use of USMT is not recommended. These include: diff --git a/windows/deploy/usmt-requirements.md b/windows/deploy/usmt-requirements.md index c8632b0b4a..525f3c872b 100644 --- a/windows/deploy/usmt-requirements.md +++ b/windows/deploy/usmt-requirements.md @@ -15,11 +15,11 @@ author: greg-lindsay - [Supported Operating Systems](#bkmk-1) - -- [Software Requirements](#bkmk-2) - +- [Windows PE](#windows-pe) +- [Credentials](#credentials) +- [Config.xml](#config-xml) +- [LoadState](#loadstate) - [Hard Disk Requirements](#bkmk-3) - - [User Prerequisites](#bkmk-userprereqs) ## Supported Operating Systems @@ -44,16 +44,6 @@ The following table lists the operating systems supported in USMT.
32-bit versions of Windows Vista
X
64-bit versions of Windows Vista
X
32-bit versions of Windows 7
X
X
+You must run USMT using an account with full administrative permissions, including the following privileges: - 4. Right-click **Command Prompt**. +- SeBackupPrivilege (Back up files and directories) +- SeDebugPrivilege (Debug programs) +- SeRestorePrivilege (Restore files and directories) +- SeSecurityPrivilege (Manage auditing and security log) +- SeTakeOwnership Privilege (Take ownership of files or other objects) - 5. Click **Run as administrator**. - 6. At the command prompt, type the `ScanState` or `LoadState` command. +## Config.xml - **Important** - You must run USMT in Administrator mode from an account with full administrative permissions, including the following privileges: +- **Specify the /c option and <ErrorControl> settings in the Config.xml file.**
+ USMT will fail if it cannot migrate a file or setting, unless you specify the **/c** option. When you specify the **/c** option, USMT logs an error each time it encounters a file that is in use that did not migrate, but the migration will not be interrupted. In USMT, you can specify in the Config.xml file which types of errors should allow the migration to continue, and which should cause the migration to fail. For more information about error reporting, and the **<ErrorControl>** element, see [Config.xml File](usmt-configxml-file.md), [Log Files](usmt-log-files.md), and [XML Elements Library](usmt-xml-elements-library.md). - - SeBackupPrivilege (Back up files and directories) +## LoadState - - SeDebugPrivilege (Debug programs) - - - SeRestorePrivilege (Restore files and directories) - - - SeSecurityPrivilege (Manage auditing and security log) - - - SeTakeOwnership Privilege (Take ownership of files or other objects) - - - -- **Specify the /c option and <ErrorControl> settings in the Config.xml file.** USMT will fail if it cannot migrate a file or setting, unless you specify the **/c** option. When you specify the **/c** option, USMT logs an error each time it encounters a file that is in use that did not migrate, but the migration will not be interrupted. In USMT, you can specify in the Config.xml file which types of errors should allow the migration to continue, and which should cause the migration to fail. For more information about error reporting, and the **<ErrorControl>** element, see [Config.xml File](usmt-configxml-file.md), [Log Files](usmt-log-files.md), and [XML Elements Library](usmt-xml-elements-library.md). - -- **Install applications before running the LoadState command.** Install all applications on the destination computer before restoring the user state. This ensures that migrated settings are preserved. +- **Install applications before running the LoadState command.**
+ Install all applications on the destination computer before restoring the user state. This ensures that migrated settings are preserved. ## Hard-Disk Requirements @@ -146,21 +133,16 @@ Ensure that there is enough available space in the migration-store location and This documentation assumes that IT professionals using USMT understand command-line tools. The documentation also assumes that IT professionals using USMT to author MigXML rules understand the following: - The navigation and hierarchy of the Windows registry. - - The files and file types that applications use. - - The methods to extract application and setting information manually from applications created by internal software-development groups and non-Microsoft software vendors. - - XML-authoring basics. ## Related topics -[Plan Your Migration](usmt-plan-your-migration.md) - -[Estimate Migration Store Size](usmt-estimate-migration-store-size.md) - -[User State Migration Tool (USMT) Overview Topics](usmt-topics.md) +[Plan Your Migration](usmt-plan-your-migration.md)
+[Estimate Migration Store Size](usmt-estimate-migration-store-size.md)
+[User State Migration Tool (USMT) Overview Topics](usmt-topics.md)
diff --git a/windows/deploy/windows-10-poc-mdt.md b/windows/deploy/windows-10-poc-mdt.md index 057d16d9f6..54eb632a5f 100644 --- a/windows/deploy/windows-10-poc-mdt.md +++ b/windows/deploy/windows-10-poc-mdt.md @@ -306,7 +306,7 @@ This procedure will demonstrate how to deploy the reference image to the PoC env ``` [Settings] Priority=Default - + [Default] _SMSTSORGNAME=Contoso OSInstall=YES @@ -362,7 +362,7 @@ This procedure will demonstrate how to deploy the reference image to the PoC env ``` [Settings] Priority=Default - + [Default] DeployRoot=\\SRV1\MDTProd$ UserDomain=CONTOSO @@ -417,12 +417,16 @@ This procedure will demonstrate how to deploy the reference image to the PoC env Disable-NetAdapter "Ethernet 2" -Confirm:$false ``` + >Wait until the disable-netadapter command completes before proceeding. + + 2. Next, switch to the Hyper-V host and open an elevated Windows PowerShell prompt. Create a generation 2 VM on the Hyper-V host that will load its OS using PXE. To create this VM, type the following commands at an elevated Windows PowerShell prompt: ``` New-VM –Name "PC2" –NewVHDPath "c:\vhd\pc2.vhdx" -NewVHDSizeBytes 60GB -SwitchName poc-internal -BootDevice NetworkAdapter -Generation 2 Set-VMMemory -VMName "PC2" -DynamicMemoryEnabled $true -MinimumBytes 720MB -MaximumBytes 2048MB -Buffer 20 ``` + >Dynamic memory is configured on the VM to conserve resources. However, this can cause memory allocation to be reduced past what is required to install an operating system. If this happens, reset the VM and begin the OS installation task sequence immediately. This ensures the VM memory allocation is not decreased too much while it is idle. 3. Start the new VM and connect to it: @@ -452,24 +456,24 @@ This completes the demonstration of how to deploy a reference image to the netwo This section will demonstrate how to export user data from an existing client computer, wipe the computer, install a new operating system, and then restore user data and settings. The scenario will use PC1, a computer that was cloned from a physical device to a VM, as described in [Step by step guide: Deploy Windows 10 in a test lab](windows-10-poc.md). -If the PC1 VM is not already running, then start and connect to it: - +1. If the PC1 VM is not already running, then start and connect to it: + ``` Start-VM PC1 vmconnect localhost PC1 ``` -1. Switch back to the Hyper-V host and create a checkpoint for the PC1 VM so that it can easily be reverted to its current state for troubleshooting purposes and to perform additional scenarios. Checkpoints are also known as snapshots. To create a checkpoint for the PC1 VM, type the following command at an elevated Windows PowerShell prompt on the Hyper-V host: +2. Switch back to the Hyper-V host and create a checkpoint for the PC1 VM so that it can easily be reverted to its current state for troubleshooting purposes and to perform additional scenarios. Checkpoints are also known as snapshots. To create a checkpoint for the PC1 VM, type the following command at an elevated Windows PowerShell prompt on the Hyper-V host: ``` Checkpoint-VM -Name PC1 -SnapshotName BeginState ``` -2. Sign on to PC1 using the CONTOSO\Administrator account. +3. Sign on to PC1 using the CONTOSO\Administrator account. >Specify **contoso\administrator** as the user name to ensure you do not sign on using the local administrator account. You must sign in with this account so that you have access to the deployment share. -3. Open an elevated command prompt on PC1 and type the following: +4. Open an elevated command prompt on PC1 and type the following: ``` cscript \\SRV1\MDTProd$\Scripts\Litetouch.vbs @@ -477,13 +481,13 @@ If the PC1 VM is not already running, then start and connect to it: **Note**: Litetouch.vbs must be able to create the C:\MININT directory on the local computer. -4. Choose the **Windows 10 Enterprise x64 Custom Image** and then click **Next**. +5. Choose the **Windows 10 Enterprise x64 Custom Image** and then click **Next**. -5. Choose **Do not back up the existing computer** and click **Next**. +6. Choose **Do not back up the existing computer** and click **Next**. **Note**: The USMT will still back up the computer. -6. Lite Touch Installation will perform the following actions: +7. Lite Touch Installation will perform the following actions: - Back up user settings and data using USMT. - Install the Windows 10 Enterprise X64 operating system. - Update the operating system via Windows Update. @@ -491,15 +495,15 @@ If the PC1 VM is not already running, then start and connect to it: You can review the progress of installation on SRV1 by clicking on the **Monitoring** node in the deployment workbench. When OS installation is complete, the computer will restart, set up devices, and configure settings. -7. Sign in with the CONTOSO\Administrator account and verify that all CONTOSO domain user accounts and data have been migrated to the new operating system, or other user accounts as specified [previously](#configure-the-mdt-production-deployment-share). +8. Sign in with the CONTOSO\Administrator account and verify that all CONTOSO domain user accounts and data have been migrated to the new operating system, or other user accounts as specified [previously](#configure-the-mdt-production-deployment-share). -8. Create another checkpoint for the PC1 VM so that you can review results of the computer refresh later. To create a checkpoint, type the following command at an elevated Windows PowerShell prompt on the Hyper-V host: +9. Create another checkpoint for the PC1 VM so that you can review results of the computer refresh later. To create a checkpoint, type the following command at an elevated Windows PowerShell prompt on the Hyper-V host: ``` Checkpoint-VM -Name PC1 -SnapshotName RefreshState ``` -9. Restore the PC1 VM to it's previous state in preparation for the replace procedure. To restore a checkpoint, type the following command at an elevated Windows PowerShell prompt on the Hyper-V host: +10. Restore the PC1 VM to it's previous state in preparation for the replace procedure. To restore a checkpoint, type the following command at an elevated Windows PowerShell prompt on the Hyper-V host: ``` Restore-VMSnapshot -VMName PC1 -Name BeginState -Confirm:$false @@ -507,7 +511,7 @@ If the PC1 VM is not already running, then start and connect to it: vmconnect localhost PC1 ``` -10. Sign in to PC1 using the contoso\administrator account. +11. Sign in to PC1 using the contoso\administrator account. ## Replace a computer with Windows 10 @@ -557,10 +561,10 @@ At a high level, the computer replace process consists of:
``` 3. Complete the deployment wizard using the following: - **Task Sequence**: Backup Only Task Sequence - - **User Data**: Specify a location: **\\SRV1\MigData$\PC1** + - **User Data**: Specify a location: **\\\\SRV1\MigData$\PC1** - **Computer Backup**: Do not back up the existing computer. 4. While the task sequence is running on PC1, open the deployment workbench console on SRV1 and click the **Monitoring* node. Press F5 to refresh the console, and view the status of current tasks. -5. Verify that **The user state capture was completed successfully** is displayed, and click **Finish** when the capture is complete. +5. On PC1, verify that **The user state capture was completed successfully** is displayed, and click **Finish** when the capture is complete. 6. On SRV1, verify that the file **USMT.MIG** was created in the **C:\MigData\PC1\USMT** directory. See the following example: ``` @@ -585,18 +589,24 @@ At a high level, the computer replace process consists of:
``` Disable-NetAdapter "Ethernet 2" -Confirm:$false ``` + + >As mentioned previously, ensure that you disable the **external** network adapter, and wait for the command to complete before proceeding. + + 3. Start and connect to PC3 by typing the following commands at an elevated Windows PowerShell prompt on the Hyper-V host: ``` Start-VM PC3 vmconnect localhost PC3 ``` + 4. When prompted, press ENTER for network boot. -6. On PC3, ue the following settings for the Windows Deployment Wizard: +6. On PC3, use the following settings for the Windows Deployment Wizard: - **Task Sequence**: Windows 10 Enterprise x64 Custom Image - **Move Data and Settings**: Do not move user data and settings - - **User Data (Restore)**: Specify a location: **\\SRV1\MigData$\PC1** + - **User Data (Restore)**: Specify a location: **\\\\SRV1\MigData$\PC1** + 5. When OS installation has started on PC1, re-enable the external network adapter on SRV1 by typing the following command on SRV1: ``` @@ -606,7 +616,9 @@ At a high level, the computer replace process consists of:
8. When PC3 has completed installing the OS, sign in to PC3 using the contoso\administrator account. When the PC completes updating, click **Finish**. -9. Verify that settings have been migrated from PC1, and then shut down PC3 in preparation for the next procedure. +9. Verify that settings have been migrated from PC1. This completes demonstration of the replace procedure. + +10. Shut down PC3 in preparation for the [next](windows-10-poc-sc-config-mgr.md) procedure. ## Troubleshooting logs, events, and utilities diff --git a/windows/deploy/windows-10-poc-sc-config-mgr.md b/windows/deploy/windows-10-poc-sc-config-mgr.md index d9278a15c5..ff0b497b45 100644 --- a/windows/deploy/windows-10-poc-sc-config-mgr.md +++ b/windows/deploy/windows-10-poc-sc-config-mgr.md @@ -163,8 +163,8 @@ Topics and procedures in this guide are summarized in the following table. An es adsiedit.msc ``` -6. Right-click **ADSI Edit**, click **Connect to**, select **Default** under **Computer** and then click **OK**. -7. Expand **Default naming context**>**DC=contoso,DC=com**, right-click **CN=System**, point to **New**, and then click **Object**. +6. Right-click **ADSI Edit**, click **Connect to**, select **Default (Domain or server that you logged in to)** under **Computer** and then click **OK**. +7. Expand **Default naming context**>**DC=contoso,DC=com**, and then in the console tree right-click **CN=System**, point to **New**, and then click **Object**. 8. Click **container** and then click **Next**. 9. Next to **Value**, type **System Management**, click **Next**, and then click **Finish**. 10. Right-click **CN=system Management** and then click **Properties**. @@ -194,7 +194,7 @@ Topics and procedures in this guide are summarized in the following table. An es - **Settings Summary**: Review settings and click **Next**. - **Prerequisite Check**: No failures should be listed. Ignore any warnings and click **Begin Install**. - >There should be at most three warnings present: WSUS on site server, configuration for SQL Server memory usage, and SQL Server process memory allocation. These warnings can safely be ignored. + >There should be at most three warnings present: WSUS on site server, configuration for SQL Server memory usage, and SQL Server process memory allocation. These warnings can safely be ignored in this test environment. Depending on the speed of the Hyper-V host and resources allocated to SRV1, installation can require approximately one hour. Click **Close** when installation is complete. @@ -207,7 +207,7 @@ Topics and procedures in this guide are summarized in the following table. An es ## Download MDOP and install DaRT -1. Download the [Microsoft Desktop Optimization Pack 2015](https://msdn.microsoft.com/en-us/subscriptions/downloads/#ProductFamilyId=597) to the Hyper-V host using an MSDN subscription. Download the .ISO file (mu_microsoft_desktop_optimization_pack_2015_x86_x64_dvd_5975282.iso) to the C:\VHD directory on the Hyper-V host. +1. Download the [Microsoft Desktop Optimization Pack 2015](https://msdn.microsoft.com/en-us/subscriptions/downloads/#ProductFamilyId=597) to the Hyper-V host using an MSDN subscription. Download the .ISO file (mu_microsoft_desktop_optimization_pack_2015_x86_x64_dvd_5975282.iso, 2.79 GB) to the C:\VHD directory on the Hyper-V host. 2. Type the following command at an elevated Windows PowerShell prompt on the Hyper-V host to mount the MDOP file on SRV1: @@ -292,19 +292,19 @@ This section contains several procedures to support Zero Touch installation with 2. In the System Center Configuration Manager console, in the **Administration** workspace, click **Distribution Points**. 3. In the display pane, right-click **SRV1.CONTOSO.COM** and then click **Properties**. 4. On the PXE tab, select the following settings: - - Enable PXE support for clients. Click **Yes** in the popup that appears. - - Allow this distribution point to respond to incoming PXE requests - - Enable unknown computer support. Click **OK** in the popup that appears. - - Require a password when computers use PXE - - Password and Confirm password: pass@word1 - - Respond to PXE requests on specific network interfaces: Click the yellow starburst and then enter the MAC address determined in the first step of this procedure. + - **Enable PXE support for clients**. Click **Yes** in the popup that appears. + - **Allow this distribution point to respond to incoming PXE requests** + - **Enable unknown computer support**. Click **OK** in the popup that appears. + - **Require a password when computers use PXE** + - **Password** and **Confirm password**: pass@word1 + - **Respond to PXE requests on specific network interfaces**: Click the yellow starburst and then enter the MAC address determined in the first step of this procedure. See the following example:
5. Click **OK**.
-6. Type the following command at an elevated Windows PowerShell prompt on SRV1, and verify that the files displayed are present:
+6. Wait for a minute, then type the following command at an elevated Windows PowerShell prompt on SRV1, and verify that the files displayed are present:
```
cmd /c dir /b C:\RemoteInstall\SMSBoot\x64
@@ -340,7 +340,7 @@ This section contains several procedures to support Zero Touch installation with
>You can open C:\Sources\OSD\Branding\contoso.bmp in MSPaint.exe if desired to customize this image.
-## Create a boot image for Configuration Manager
+### Create a boot image for Configuration Manager
1. In the Configuration Manager console, in the **Software Library** workspace, expand **Operating Systems**, right-click **Boot Images**, and then click **Create Boot Image using MDT**.
2. On the Package Source page, under **Package source folder to be created (UNC Path):**, type **\\\SRV1\Sources$\OSD\Boot\Zero Touch WinPE x64**, and then click **Next**.
@@ -357,13 +357,15 @@ This section contains several procedures to support Zero Touch installation with
```
Invoke-Item 'C:\Program Files\Microsoft Configuration Manager\tools\cmtrace.exe'
```
- >In the trace tool, click **Tools** on the menu and choose **Find**. Search for "**STATMSG: ID=2301**". For example:
+
+ In the trace tool, click **Tools** on the menu and choose **Find**. Search for "**STATMSG: ID=2301**". For example:
- ```
- STATMSG: ID=2301 SEV=I LEV=M SOURCE="SMS Server" COMP="SMS_DISTRIBUTION_MANAGER" SYS=SRV1.CONTOSO.COM SITE=PS1 PID=2476 TID=4636 GMTDATE=Wed Sep 14 22:11:09.363 2016 ISTR0="Configuration Manager Client Upgrade Package" ISTR1="PS100003" ISTR2="" ISTR3="" ISTR4="" ISTR5="" ISTR6="" ISTR7="" ISTR8="" ISTR9="" NUMATTRS=1 AID0=400 AVAL0="PS100003" SMS_DISTRIBUTION_MANAGER 9/14/2016 3:11:09 PM 4636 (0x121C)
- ```
-11. You can also review status by clicking the **Zero Touch WinPE x64** image, and then clicking **Content Status** under **Related Objects** in the bottom right-hand corner of the console, or by entering **\Monitoring\Overview\Distribution Status\Content Status** on the location bar in the console. Doublt-click **Zero Touch WinPE x64** under **Content Status** in the console tree and verify that a status of **Successfully distributed content** is displayed on the **Success** tab.
-12. In the **Software Library** workspace, double-click **Zero Touch WinPE x64** and then click the **Data Source** tab.
+ ```
+ STATMSG: ID=2301 SEV=I LEV=M SOURCE="SMS Server" COMP="SMS_DISTRIBUTION_MANAGER" SYS=SRV1.CONTOSO.COM SITE=PS1 PID=2476 TID=4636 GMTDATE=Wed Sep 14 22:11:09.363 2016 ISTR0="Configuration Manager Client Upgrade Package" ISTR1="PS100003" ISTR2="" ISTR3="" ISTR4="" ISTR5="" ISTR6="" ISTR7="" ISTR8="" ISTR9="" NUMATTRS=1 AID0=400 AVAL0="PS100003" SMS_DISTRIBUTION_MANAGER 9/14/2016 3:11:09 PM 4636 (0x121C)
+ ```
+
+11. You can also review status by clicking the **Zero Touch WinPE x64** image, and then clicking **Content Status** under **Related Objects** in the bottom right-hand corner of the console, or by entering **\Monitoring\Overview\Distribution Status\Content Status** on the location bar in the console. Double-click **Zero Touch WinPE x64** under **Content Status** in the console tree and verify that a status of **Successfully distributed content** is displayed on the **Success** tab.
+12. Next, in the **Software Library** workspace, double-click **Zero Touch WinPE x64** and then click the **Data Source** tab.
13. Select the **Deploy this boot image from the PXE-enabled distribution point** checkbox, and click **OK**.
14. Review the distmgr.log file again for "**STATMSG: ID=2301**" and verify that there are three folders under **C:\RemoteInstall\SMSImages** with boot images. See the following example:
@@ -380,7 +382,7 @@ This section contains several procedures to support Zero Touch installation with
>The first two images (*.wim files) are default boot images. The third is the new boot image with DaRT.
-## Create a Windows 10 reference image
+### Create a Windows 10 reference image
If you have already completed steps in [Deploy Windows 10 in a test lab using Microsoft Deployment Toolkit](windows-10-poc-mdt.md) then you have already created a Windows 10 reference image. In this case, skip to the next procedure in this guide: [Add a Windows 10 operating system image](#add-a-windows-10-operating-system-image). If you have not yet created a Windows 10 reference image, complete the steps in this section.
@@ -534,7 +536,7 @@ If you have already completed steps in [Deploy Windows 10 in a test lab using Mi
This step requires from 30 minutes to 2 hours, depending on the speed of the Hyper-V host and your network's download speed. After some time, you will have a Windows 10 Enterprise x64 image that is fully patched and has run through Sysprep. The image is located in the C:\MDTBuildLab\Captures folder on SRV1. The file name is **REFW10X64-001.wim**.
-## Add a Windows 10 operating system image
+### Add a Windows 10 operating system image
1. Type the following commands at an elevated Windows PowerShell prompt on SRV1:
@@ -553,11 +555,11 @@ If you have already completed steps in [Deploy Windows 10 in a test lab using Mi
6. In the Distribute Content Wizard, click **Next**, click **Add**, click **Distribution Point**, add the **SRV1.CONTOSO.COM** distribution point, click **OK**, click **Next** twice and then click **Close**.
-7. Enter **\Monitoring\Overview\Distribution Status\Content Status** on the location bar, click **Windows 10 Enterprise x64**, and monitor the status of content distribution until it is successful and no longer in progress. Refresh the view with the F5 key or by right-clicking **Windows 10 Enterprise x64** and clicking **Refresh**. Processing of the image on the site server can take several minutes.
+7. Enter **\Monitoring\Overview\Distribution Status\Content Status** on the location bar (be sure there is no space at the end of the location or you will get an error), click **Windows 10 Enterprise x64**, and monitor the status of content distribution until it is successful and no longer in progress. Refresh the view with the F5 key or by right-clicking **Windows 10 Enterprise x64** and clicking **Refresh**. Processing of the image on the site server can take several minutes.
>If content distribution is not successful, verify that sufficient disk space is available.
-## Create a task sequence
+### Create a task sequence
>Complete this section slowly. There are a large number of similar settings from which to choose.
@@ -567,37 +569,37 @@ If you have already completed steps in [Deploy Windows 10 in a test lab using Mi
3. On the General page, type **Windows 10 Enterprise x64** under **Task sequence name:** and then click **Next**.
-4. On the Details page, enter the following settings:- - Join a domain: contoso.com
- - Account: click **Set**
- - User name: contoso\CM_JD
- - Password: pass@word1
- - Confirm password: pass@word1
- - Click **OK**
- - Windows Settings
- - User name: Contoso
- - Organization name: Contoso
- - Product key: \
- - Administrator Account: Enable the account and specify the local administrator password
- - Password: pass@word1
- - Confirm password: pass@word1
- - Click Next
+4. On the Details page, enter the following settings: + - Join a domain: **contoso.com** + - Account: click **Set** + - User name: **contoso\CM_JD** + - Password: **pass@word1** + - Confirm password: **pass@word1** + - Click **OK** + - Windows Settings + - User name: **Contoso** + - Organization name: **Contoso** + - Product key: \
. -## Finalize the operating system configuration +### Finalize the operating system configuration >If you completed all procedures in [Deploy Windows 10 in a test lab using Microsoft Deployment Toolkit](windows-10-poc-mdt.md) then the MDT deployment share is already present on SRV1. In this case, skip the first four steps below and begin with step 5 to edit CustomSettings.ini. @@ -670,7 +672,7 @@ If you have already completed steps in [Deploy Windows 10 in a test lab using Mi [Settings] Priority=Default Properties=OSDMigrateConfigFiles,OSDMigrateMode - + [Default] DoCapture=NO ComputerBackupLocation=NONE @@ -681,6 +683,14 @@ If you have already completed steps in [Deploy Windows 10 in a test lab using Mi EventService=http://SRV1:9800 ApplyGPOPack=NO ``` + + >As noted previously, if you wish to migrate accounts other than those in the Contoso domain, then change the OSDMigrateAdditionalCaptureOptions option. For example, the following option will capture settings from all user accounts: + + ``` + OSDMigrateAdditionalCaptureOptions=/all + ``` + + 7. Return to the Configuration Manager console, and in the Software Library workspace, expand **Application Management**, click **Packages**, right-click **Windows 10 x64 Settings**, and then click **Update Distribution Points**. Click **OK** in the popup that appears. 8. In the Software Library workspace, expand **Operating Systems**, click **Task Sequences**, right-click **Windows 10 Enterprise x64**, and then click **Distribute Content**. @@ -705,6 +715,8 @@ If you have already completed steps in [Deploy Windows 10 in a test lab using Mi ## Deploy Windows 10 using PXE and Configuration Manager +In this first deployment scenario, we will deploy Windows 10 using PXE. This scenario creates a new computer that does not have any migrated users or settings. + 1. Type the following commands at an elevated Windows PowerShell prompt on the Hyper-V host: ``` @@ -718,7 +730,7 @@ If you have already completed steps in [Deploy Windows 10 in a test lab using Mi 3. In the Task Sequence Wizard, provide the password: **pass@word1**, and then click **Next**. -4. Before you click Next in the Task Sequence Wizard, press the **F8** key. A command prompt will open. +4. Before you click **Next** in the Task Sequence Wizard, press the **F8** key. A command prompt will open. 5. At the command prompt, type **explorer.exe** and review the Windows PE file structure. @@ -745,6 +757,7 @@ If you have already completed steps in [Deploy Windows 10 in a test lab using Mi - Join the computer to the contoso.com domain - Install any applications that were specified in the reference image + 12. When Windows 10 installation has completed, sign in to PC4 using the **contoso\administrator** account. 13. Right-click **Start**, click **Run**, type **control appwiz.cpl**, press ENTER, click Turn Windows features on or off, and verify that **.NET Framework 3.5 (includes .NET 2.0 and 3.0)** is installed. This is a feature included in the reference image. @@ -927,7 +940,7 @@ vmconnect localhost PC1 - Task sequence comments: **USMT backup only** 4. Click **Next**, and on the Boot Image page, browse and select the **Zero Touch WinPE x64** boot image package. Click **OK** and then click **Next** to continue. -5. On the MDT Package page, browse and select the **MDT 2013** package. Click **OK** and then click **Next** to continue. +5. On the MDT Package page, browse and select the **MDT** package. Click **OK** and then click **Next** to continue. 6. On the USMT Package page, browse and select the **Microsoft Corporation User State Migration Tool for Windows** package. Click **OK** and then click **Next** to continue. 7. On the Settings Package page, browse and select the **Windows 10 x64 Settings** package. Click **OK** and then click **Next** to continue. 8. On the Summary page, review the details and then click **Next**. diff --git a/windows/deploy/windows-10-poc.md b/windows/deploy/windows-10-poc.md index d2d418cbda..74b8d0f352 100644 --- a/windows/deploy/windows-10-poc.md +++ b/windows/deploy/windows-10-poc.md @@ -844,17 +844,16 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40GB to  19. Click **File**, click **Save As**, and save the commands as **c:\VHD\pc1.ps1** on the Hyper-V host. -20. In the (lower) terminal input window, type the following command to copy the script to PC1 using integration services: +20. In the (lower) terminal input window, type the following commands to enable Guest Service Interface on PC1 and then use this service to copy the script to PC1:
+ Enable-VMIntegrationService -VMName PC1 -Name "Guest Service Interface"
Copy-VMFile "PC1" –SourcePath "C:\VHD\pc1.ps1" –DestinationPath "C:\pc1.ps1" –CreateFullPath –FileSource Host
- >In order for this command to work properly, PC1 must be running the vmicguestinterface (Hyper-V Guest Service Interface) service. If this service is not installed, you can try updating integration services on the VM by mounting the Hyper-V Integration Services Setup (vmguest.iso), which is located in C:\Windows\System32 on Windows Server 2012 and 2012 R2 operating systems that are running the Hyper-V role service. You can also try running the following command from an elevated Windows PowerShell prompt on the Hyper-V host:
-
- Enable-VMIntegrationService -VMName PC1 -Name "Guest Service Interface"+ >In order for this command to work properly, PC1 must be running the vmicguestinterface (Hyper-V Guest Service Interface) service. If this service is not enabled in this step, then the copy-VMFile command will fail. In this case, you can try updating integration services on the VM by mounting the Hyper-V Integration Services Setup (vmguest.iso), which is located in C:\Windows\System32 on Windows Server 2012 and 2012 R2 operating systems that are running the Hyper-V role service. - If the copy-vmfile command does not work and you cannot properly enable or upgrade integration services on PC1, then create the file c:\pc1.ps1 on the VM by typing the commands into this file manually. The copy-vmfile command is only used in this procedure as a demonstration. After typing the script file manually, be sure to save the file as a Windows PowerShell script file with the .ps1 extension and not as a text (.txt) file. + If the copy-vmfile command does not work and you cannot properly enable or upgrade integration services on PC1, then create the file c:\pc1.ps1 on the VM by typing the commands into this file manually. The copy-vmfile command is only used in this procedure as a demonstration of automation methods that can be used in a Hyper-V environment when enhanced session mode is not available. After typing the script file manually, be sure to save the file as a Windows PowerShell script file with the .ps1 extension and not as a text (.txt) file. 21. On PC1, type the following commands at an elevated Windows PowerShell prompt: @@ -865,7 +864,7 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40GB to >The commands in this script might take a few moments to complete. If an error is displayed, check that you typed the command correctly, paying close attention to spaces. PC1 is removed from its domain in this step while not connected to the corporate network so as to ensure the computer object in the corporate domain is unaffected. PC1 is also not renamed to "PC1" in system properties so that it maintains some of its mirrored identity. However, if desired you can also rename the computer. 22. Upon completion of the script, PC1 will automatically restart. When it has restarted, sign in to the contoso.com domain using the **Switch User** option, with the **user1** account you created in step 11 of this section. - >**Important**: The settings that will be used later to migrate user data specifically select only accounts that belong to the CONTOSO domain. However, this can be changed to migrate all use accounts, or only other specific accounts. If you wish to test migration of user data and settings with accounts other than those in the CONTOSO domain, you must specify these accounts or domains when you configure the value of **ScanStateArgs** in the MDT test lab guide. This value is specifically called out when you get to that step. If you wish to only migrate CONTOSO accounts, then you can log in with the user1 account or the administrator account at this time and modify some of the files and settings for later use in migration testing. + >**Important**: The settings that will be used later to migrate user data specifically select only accounts that belong to the CONTOSO domain. However, this can be changed to migrate all user accounts, or only other specified accounts. If you wish to test migration of user data and settings with accounts other than those in the CONTOSO domain, you must specify these accounts or domains when you configure the value of **ScanStateArgs** in the MDT test lab guide. This value is specifically called out when you get to that step. If you wish to only migrate CONTOSO accounts, then you can log in with the user1 account or the administrator account at this time and modify some of the files and settings for later use in migration testing. 23. Minimize the PC1 window but do not turn it off while the second Windows Server 2012 R2 VM (SRV1) is configured. This verifies that the Hyper-V host has enough resources to run all VMs simultaneously. Next, SRV1 will be started, joined to the contoso.com domain, and configured with RRAS and DNS services. 24. On the Hyper-V host computer, at an elevated Windows PowerShell prompt, type the following commands: diff --git a/windows/index.md b/windows/index.md index d5e7f92b8a..31050c6bd6 100644 --- a/windows/index.md +++ b/windows/index.md @@ -3,6 +3,7 @@ title: Windows 10 and Windows 10 Mobile (Windows 10) description: This library provides the core content that IT pros need to evaluate, plan, deploy, and manage devices running Windows 10 or Windows 10 Mobile. ms.assetid: 345A4B4E-BC1B-4F5C-9E90-58E647D11C60 ms.prod: w10 +localizationpriority: high author: brianlic-msft --- diff --git a/windows/keep-secure/TOC.md b/windows/keep-secure/TOC.md index 7662302c08..3a3d3bcda1 100644 --- a/windows/keep-secure/TOC.md +++ b/windows/keep-secure/TOC.md @@ -1,14 +1,15 @@ # [Keep Windows 10 secure](index.md) ## [Block untrusted fonts in an enterprise](block-untrusted-fonts-in-enterprise.md) -## [Manage identity verification using Windows Hello for Business](manage-identity-verification-using-microsoft-passport.md) -### [Implement Windows Hello for Business in your organization](implement-microsoft-passport-in-your-organization.md) -### [Enable phone sign-in to PC or VPN](enable-phone-signin-to-pc-and-vpn.md) -### [Why a PIN is better than a password](why-a-pin-is-better-than-a-password.md) -### [Prepare people to use Windows Hello](prepare-people-to-use-microsoft-passport.md) -### [Windows Hello and password changes](microsoft-passport-and-password-changes.md) -### [Windows Hello errors during PIN creation](microsoft-passport-errors-during-pin-creation.md) -### [Event ID 300 - Windows Hello successfully created](passport-event-300.md) -### [Windows Hello biometrics in the enterprise](windows-hello-in-enterprise.md) +## [Windows Hello for Business](hello-identity-verification.md) +### [How Windows Hello for Business works](hello-how-it-works.md) +### [Manage Windows Hello for Business in your organization](hello-manage-in-organization.md) +### [Enable phone sign-in to PC or VPN](hello-enable-phone-signin.md) +### [Why a PIN is better than a password](hello-why-pin-is-better-than-password.md) +### [Prepare people to use Windows Hello](hello-prepare-people-to-use.md) +### [Windows Hello and password changes](hello-and-password-changes.md) +### [Windows Hello errors during PIN creation](hello-errors-during-pin-creation.md) +### [Event ID 300 - Windows Hello successfully created](hello-event-300.md) +### [Windows Hello biometrics in the enterprise](hello-biometrics-in-enterprise.md) ## [Configure S/MIME for Windows 10 and Windows 10 Mobile](configure-s-mime.md) ## [Install digital certificates on Windows 10 Mobile](installing-digital-certificates-on-windows-10-mobile.md) ## [Device Guard deployment guide](device-guard-deployment-guide.md) @@ -197,7 +198,7 @@ ###### [Monitor claim types](monitor-claim-types.md) ##### [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) ###### [Audit Credential Validation](audit-credential-validation.md) -####### [Event 4774 S: An account was mapped for logon.](event-4774.md) +####### [Event 4774 S, F: An account was mapped for logon.](event-4774.md) ####### [Event 4775 F: An account could not be mapped for logon.](event-4775.md) ####### [Event 4776 S, F: The computer attempted to validate the credentials for an account.](event-4776.md) ####### [Event 4777 F: The domain controller failed to validate the credentials for an account.](event-4777.md) @@ -873,7 +874,6 @@ ###### [Verify That Network Traffic Is Authenticated](verify-that-network-traffic-is-authenticated.md) ## [Enterprise security guides](windows-10-enterprise-security-guides.md) ### [Control the health of Windows 10-based devices](protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md) -### [Microsoft Passport guide](microsoft-passport-guide.md) ### [Windows 10 Mobile security guide](windows-10-mobile-security-guide.md) ### [Windows 10 security overview](windows-10-security-guide.md) ### [Windows 10 credential theft mitigation guide abstract](windows-credential-theft-mitigation-guide-abstract.md) diff --git a/windows/keep-secure/app-behavior-with-wip.md b/windows/keep-secure/app-behavior-with-wip.md index bf932d459d..1f83aad42f 100644 --- a/windows/keep-secure/app-behavior-with-wip.md +++ b/windows/keep-secure/app-behavior-with-wip.md @@ -38,8 +38,8 @@ This table includes info about how unenlightened apps might behave, based on you
/*AppCompat*/ string/*AppCompat*/ string or proxy-based policies| App rule setting | -Networking policy configuration for name-based policies, possibly using the /*AppCompat*/ string, or proxy-based policies |
+ Networking policy configuration for name-based policies, possibly using the /*AppCompat*/ string, or proxy-based policies | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Not required. App connects to enterprise cloud resources, using an IP address or a hostname. | diff --git a/windows/keep-secure/audit-credential-validation.md b/windows/keep-secure/audit-credential-validation.md index 5e54e23875..a6e23ecd47 100644 --- a/windows/keep-secure/audit-credential-validation.md +++ b/windows/keep-secure/audit-credential-validation.md @@ -42,7 +42,7 @@ The main reason to enable this auditing subcategory is to handle local accounts **Events List:** -- [4774](event-4774.md)(S): An account was mapped for logon. +- [4774](event-4774.md)(S, F): An account was mapped for logon. - [4775](event-4775.md)(F): An account could not be mapped for logon. diff --git a/windows/keep-secure/bitlocker-countermeasures.md b/windows/keep-secure/bitlocker-countermeasures.md index 89261d666c..5cf31239ce 100644 --- a/windows/keep-secure/bitlocker-countermeasures.md +++ b/windows/keep-secure/bitlocker-countermeasures.md @@ -115,7 +115,11 @@ Windows 10 uses Trusted Boot on any hardware platform: It requires neither UEFI Because UEFI-based Secure Boot has protected the bootloader and Trusted Boot has protected the Windows kernel or other Windows startup components, the next opportunity for malware to start is by infecting a non-Microsoft boot-related driver. Traditional antimalware apps don’t start until after the boot-related drivers have been loaded, giving a rootkit disguised as a driver the opportunity to work. -The purpose of ELAM is to load an antimalware driver before drivers that are flagged as boot-start can be executed. This approach provides the ability for an antimalware driver to register as a trusted boot-critical driver. It is launched during the Trusted Boot process, and with that, Windows ensures that it is loaded before any other non-Microsoft software. +Early Launch Antimalware (ELAM) is designed to enable the antimalware solution to start before all non-Microsoft drivers and apps. ELAM checks the integrity of non-Microsoft drivers to determine whether the drivers are trustworthy. Because Windows needs to start as fast as possible, ELAM cannot be a complicated process of checking the driver files against known malware signatures. Instead, ELAM has the simple task of examining every boot driver and determining whether it is on the list of trusted drivers. If malware modifies a boot-related driver, ELAM will detect the change, and Windows will prevent the driver from starting, thus blocking driver-based rootkits. ELAM also allows the registered antimalware provider to scan drivers that are loaded after the boot process is complete. + +Windows Defender in Windows 10 supports ELAM, as do Microsoft System Center 2012 Endpoint Protection and non-Microsoft antimalware apps. + +To do this, ELAM loads an antimalware driver before drivers that are flagged as boot-start can be executed. This approach provides the ability for an antimalware driver to register as a trusted boot-critical driver. It is launched during the Trusted Boot process, and with that, Windows ensures that it is loaded before any other non-Microsoft software. With this solution in place, boot drivers are initialized based on the classification that the ELAM driver returns according to an initialization policy. IT pros have the ability to change this policy through Group Policy. ELAM classifies drivers as follows: diff --git a/windows/keep-secure/bitlocker-group-policy-settings.md b/windows/keep-secure/bitlocker-group-policy-settings.md index 26cadf522b..c0112dcf47 100644 --- a/windows/keep-secure/bitlocker-group-policy-settings.md +++ b/windows/keep-secure/bitlocker-group-policy-settings.md @@ -32,6 +32,7 @@ The following sections provide a comprehensive list of BitLocker Group Policy se The following policy settings can be used to determine how a BitLocker-protected drive can be unlocked. +- [Allow devices with Secure Boot and protect DMS ports to opt out of preboot PIN](#bkmk-hstioptout) - [Allow network unlock at startup](#bkmk-netunlock) - [Require additional authentication at startup](#bkmk-unlockpol1) - [Allow enhanced PINs for startup](#bkmk-unlockpol2) @@ -85,6 +86,55 @@ The following policies are used to support customized deployment scenarios in yo - [Allow access to BitLocker-protected fixed data drives from earlier versions of Windows](#bkmk-depopt4) - [Allow access to BitLocker-protected removable data drives from earlier versions of Windows](#bkmk-depopt5) +### Allow devices with Secure Boot and protect DMS ports to opt out of preboot PIN + +This policy setting allows users on devices that are compliant with InstantGo or the Microsoft Hardware Security Test Interface (HSTI) to not have a PIN for preboot authentication. + +|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Policy description |
+With this policy setting, you can allow TPM-only protection for newer, more secure devices, such as devices that support InstantGo or HSTI, while requiring PIN on older devices. |
+
Introduced |
+Windows 10, version 1703 |
+
Drive type |
+Operating system drives |
+
Policy path |
+Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives |
+
Conflicts |
+This setting overrides the Require startup PIN with TPM option of the [Require additional authentication at startup](#bkmk-unlockpol1) policy on compliant hardware. + + |
+
When enabled |
+Users on InstantGo and HSTI compliant devices will have the choice to turn on BitLocker without preboot authentication. |
+
When disabled or not configured |
+The options of the [Require additional authentication at startup](#bkmk-unlockpol1) policy apply. |
+
+> The domain controller hosts authentication services which integrate with processes isolated when Credential Guard is enabled, causing crashes. + +>[!NOTE] +> Credential Guard does not provide protections for the Active Directory database or the Security Accounts Manager (SAM). The credentials protected by Kerberos and NTLM when Credential Guard is enabled are also in the Active Directory database (on domain controllers) and the SAM (for local accounts). + +Applications will break if they require: +- Kerberos DES encryption support +- Kerberos unconstrained delegation +- Extracting the Kerberos TGT +- NTLMv1 + +Applications will prompt & expose credentials to risk if they require: +- Digest authentication +- Credential delegation +- MS-CHAPv2 + +Applications may cause performance issues when they attempt to hook the isolated Credential Guard process. + +### Security considerations The following tables provide more information about the hardware, firmware, and software required for deployment of Credential Guard. The tables describe baseline protections, plus protections for improved security that are associated with hardware and firmware options available in 2015, available in 2016, and announced as options for 2017. > [!NOTE] -> For new computers running Windows 10, Trusted Platform Module (TPM 2.0) must be enabled by default. This requirement is not restated in the tables that follow.
+> Beginning with Windows 10, version 1607, Trusted Platform Module (TPM 2.0) must be enabled by default on new computers. This requirement is not restated in the tables that follow.
> If you are an OEM, see the requirements information at [PC OEM requirements for Device Guard and Credential Guard](https://msdn.microsoft.com/library/windows/hardware/mt767514.aspx).
> Starting in Widows 10, 1607, TPM 2.0 is required. +#### Baseline protection recommendations -## Credential Guard requirements for baseline protections - -|Baseline Protections - requirement | Description | +|Baseline Protections | Description | |---------------------------------------------|----------------------------------------------------| | Hardware: **64-bit CPU** | A 64-bit computer is required for the Windows hypervisor to provide VBS. | -| Hardware: **CPU virtualization extensions**,
plus **extended page tables** | **Requirements**: These hardware features are required for VBS:
One of the following virtualization extensions:
- VT-x (Intel) or
- AMD-V
And:
- Extended page tables, also called Second Level Address Translation (SLAT).
**Security benefits**: VBS provides isolation of secure kernel from normal operating system. Vulnerabilities and Day 0s in normal operating system cannot be exploited because of this isolation. | +| Hardware: **CPU virtualization extensions**,
plus **extended page tables** | **Requirements**: These hardware features are required for VBS:
One of the following virtualization extensions:
• VT-x (Intel) or
• AMD-V
And:
• Extended page tables, also called Second Level Address Translation (SLAT).
**Security benefits**: VBS provides isolation of secure kernel from normal operating system. Vulnerabilities and Day 0s in normal operating system cannot be exploited because of this isolation. | | Hardware: **Trusted Platform Module (TPM)** | **Requirement**: TPM 1.2 or TPM 2.0, either discrete or firmware.
**Security benefits**: A TPM provides protection for VBS encryption keys that are stored in the firmware. This helps protect against attacks involving a physically present user with BIOS access. | | Firmware: **UEFI firmware version 2.3.1.c or higher with UEFI Secure Boot** | **Requirements**: See the following Windows Hardware Compatibility Program requirement: [System.Fundamentals.Firmware.UEFISecureBoot](http://msdn.microsoft.com/library/windows/hardware/dn932805.aspx#system-fundamentals-firmware-uefisecureboot)
**Security benefits**: UEFI Secure Boot helps ensure that the device boots only authorized code. This can prevent boot kits and root kits from installing and persisting across reboots. | | Firmware: **Secure firmware update process** | **Requirements**: UEFI firmware must support secure firmware update found under the following Windows Hardware Compatibility Program requirement: [System.Fundamentals.Firmware.UEFISecureBoot](http://msdn.microsoft.com/library/windows/hardware/dn932805.aspx#system-fundamentals-firmware-uefisecureboot).
**Security benefits**: UEFI firmware just like software can have security vulnerabilities that, when found, need to be patched through firmware updates. Patching helps prevent root kits from getting installed. | -| Software: Qualified **Windows operating system** | **Requirement**: Windows 10 Enterprise, Windows 10 Education, Windows 2016 Server, or Windows Enterprise IoT
Important:
Windows Server 2016 running as a domain controller does not support Credential Guard. Only Device Guard is supported in this configuration.
**Security benefits**: Support for VBS and for management features that simplify configuration of Credential Guard. | +| Software: Qualified **Windows operating system** | **Requirement**: Windows 10 Enterprise, Windows 10 Education, Windows Server 2016, or Windows 10 IoT Enterprise
Important:
Windows Server 2016 running as a domain controller does not support Credential Guard. Only Device Guard is supported in this configuration.
**Security benefits**: Support for VBS and for management features that simplify configuration of Credential Guard. | > [!IMPORTANT] -> The preceding table lists requirements for baseline protections. The following tables list requirements for improved security. You can use Credential Guard with hardware, firmware, and software that support baseline protections, even if they do not support protections for improved security. However, we strongly recommend meeting the requirements for improved security, to significantly strengthen the level of security that Credential Guard can provide. +> The preceding table lists requirements for baseline protections. The following tables list requirements for improved security. You can use Credential Guard with hardware, firmware, and software that support baseline protections, even if they do not support protections for improved security. However, we strongly recommend meeting the requirements for improved security to significantly strengthen the level of security that Credential Guard can provide. -## Credential Guard requirements for improved security +#### 2015 Additional Security Recommendations (starting with Windows 10, version 1507, and Windows Server 2016, Technical Preview 4) -The following tables describes additional hardware and firmware requirements, and the improved security that is available when those requirements are met. - -### 2015 Additional Qualification Requirements for Credential Guard (starting with Windows 10, version 1507, and Windows Server 2016, Technical Preview 4) - -| Protections for Improved Security - requirement | Description | +| Protections for Improved Security | Description | |---------------------------------------------|----------------------------------------------------| | Hardware: **IOMMU** (input/output memory management unit) | **Requirement**: VT-D or AMD Vi IOMMU
**Security benefits**: An IOMMU can enhance system resiliency against memory attacks. For more information, see [ACPI description tables](https://msdn.microsoft.com/windows/hardware/drivers/bringup/acpi-system-description-tables). | -| Firmware: **Securing Boot Configuration and Management** | **Requirements**:
- BIOS password or stronger authentication must be supported.
- In the BIOS configuration, BIOS authentication must be set.
- There must be support for protected BIOS option to configure list of permitted boot devices (for example, “Boot only from internal hard drive”) and boot device order, overriding BOOTORDER modification made by operating system.
- In the BIOS configuration, BIOS options related to security and boot options (list of permitted boot devices, boot order) must be secured to prevent other operating systems from starting and to prevent changes to the BIOS settings.
**Security benefits**:
- BIOS password or stronger authentication helps ensure that only authenticated Platform BIOS administrators can change BIOS settings. This helps protect against a physically present user with BIOS access.
- Boot order when locked provides protection against the computer being booted into WinRE or another operating system on bootable media. | -| Firmware: **Secure MOR implementation** | **Requirement**: Secure MOR implementation
**Security benefits**: A secure MOR bit prevents advanced memory attacks. For more information, see [Secure MOR implementation](https://msdn.microsoft.com/windows/hardware/drivers/bringup/device-guard-requirements). | +| Firmware: **Securing Boot Configuration and Management** | **Requirements**:
• BIOS password or stronger authentication must be supported.
• In the BIOS configuration, BIOS authentication must be set.
• There must be support for protected BIOS option to configure list of permitted boot devices (for example, “Boot only from internal hard drive”) and boot device order, overriding BOOTORDER modification made by operating system.
• In the BIOS configuration, BIOS options related to security and boot options (list of permitted boot devices, boot order) must be secured to prevent other operating systems from starting and to prevent changes to the BIOS settings.
**Security benefits**:
• BIOS password or stronger authentication helps ensure that only authenticated Platform BIOS administrators can change BIOS settings. This helps protect against a physically present user with BIOS access.
• Boot order when locked provides protection against the computer being booted into WinRE or another operating system on bootable media. | +| Firmware: **Secure MOR, revision 2 implementation** | **Requirement**: Secure MOR, revision 2 implementation
**Security benefits**: A secure MOR bit prevents advanced memory attacks. For more information, see [Secure MOR implementation](https://msdn.microsoft.com/windows/hardware/drivers/bringup/device-guard-requirements). |
-### 2016 Additional Qualification Requirements for Credential Guard (starting with Windows 10, version 1607, and Windows Server 2016) +#### 2016 Additional Security Recommendations (starting with Windows 10, version 1607, and Windows Server 2016) > [!IMPORTANT] > The following tables list requirements for improved security, beyond the level of protection described in the preceding tables. You can use Credential Guard with hardware, firmware, and software that do not support the following protections for improved security. As your systems meet more requirements, more protections become available to them. -| Protections for Improved Security - requirement | Description | +| Protections for Improved Security | Description | |---------------------------------------------|----------------------------------------------------| -| Firmware: **Hardware Rooted Trust Platform Secure Boot** | **Requirements**:
Boot Integrity (Platform Secure Boot) must be supported. See the Windows Hardware Compatibility Program requirements under [System.Fundamentals.Firmware.CS.UEFISecureBoot.ConnectedStandby](https://msdn.microsoft.com/library/windows/hardware/dn932807(v=vs.85).aspx#system_fundamentals_firmware_cs_uefisecureboot_connectedstandby)
- The Hardware Security Test Interface (HSTI) must be implemented. See [Hardware Security Testability Specification](https://msdn.microsoft.com/en-us/library/windows/hardware/mt712332(v=vs.85).aspx).
**Security benefits**:
- Boot Integrity (Platform Secure Boot) from Power-On provides protections against physically present attackers, and defense-in-depth against malware.
- HSTI provides additional security assurance for correctly secured silicon and platform. | +| Firmware: **Hardware Rooted Trust Platform Secure Boot** | **Requirements**:
Boot Integrity (Platform Secure Boot) must be supported. See the Windows Hardware Compatibility Program requirements under [System.Fundamentals.Firmware.CS.UEFISecureBoot.ConnectedStandby](https://msdn.microsoft.com/library/windows/hardware/dn932807(v=vs.85).aspx#system_fundamentals_firmware_cs_uefisecureboot_connectedstandby)
• The Hardware Security Test Interface (HSTI) must be implemented. See [Hardware Security Testability Specification](https://msdn.microsoft.com/en-us/library/windows/hardware/mt712332(v=vs.85).aspx).
**Security benefits**:
• Boot Integrity (Platform Secure Boot) from Power-On provides protections against physically present attackers, and defense-in-depth against malware.
• HSTI provides additional security assurance for correctly secured silicon and platform. | | Firmware: **Firmware Update through Windows Update** | **Requirements**: Firmware must support field updates through Windows Update and UEFI encapsulation update.
**Security benefits**: Helps ensure that firmware updates are fast, secure, and reliable. | -| Firmware: **Securing Boot Configuration and Management** | **Requirements**:
- Required BIOS capabilities: Ability of OEM to add ISV, OEM, or Enterprise Certificate in Secure Boot DB at manufacturing time.
- Required configurations: Microsoft UEFI CA must be removed from Secure Boot DB. Support for 3rd-party UEFI modules is permitted but should leverage ISV-provided certificates or OEM certificate for the specific UEFI software.
**Security benefits**:
- Enterprises can choose to allow proprietary EFI drivers/applications to run.
- Removing Microsoft UEFI CA from Secure Boot DB provides full control to enterprises over software that runs before the operating system boots. | +| Firmware: **Securing Boot Configuration and Management** | **Requirements**:
• Required BIOS capabilities: Ability of OEM to add ISV, OEM, or Enterprise Certificate in Secure Boot DB at manufacturing time.
• Required configurations: Microsoft UEFI CA must be removed from Secure Boot DB. Support for 3rd-party UEFI modules is permitted but should leverage ISV-provided certificates or OEM certificate for the specific UEFI software.
**Security benefits**:
• Enterprises can choose to allow proprietary EFI drivers/applications to run.
• Removing Microsoft UEFI CA from Secure Boot DB provides full control to enterprises over software that runs before the operating system boots. |
-### 2017 Additional Qualification Requirements for Credential Guard (starting with the next major release of Windows 10) +#### 2017 Additional security requirements starting with Windows 10, version 1703 -| Protection for Improved Security - requirement | Description | +The following table lists requirements for Windows 10, version 1703, which are in addition to all preceding requirements. + +| Protection for Improved Security | Description | |---------------------------------------------|----------------------------------------------------| -| Firmware: **Firmware support for SMM protection** | **Requirements**: The [Windows SMM Security Mitigations Table (WSMT) specification](http://download.microsoft.com/download/1/8/A/18A21244-EB67-4538-BAA2-1A54E0E490B6/WSMT.docx) contains details of an Advanced Configuration and Power Interface (ACPI) table that was created for use with Windows operating systems that support Windows virtualization-based security (VBS) features.
**Security benefits**:
- Protects against potential vulnerabilities in UEFI runtime in functions such as Update Capsule, Set Variables, and so on, so they can't compromise VBS.
- Reduces attack surface to VBS from system firmware.
- Blocks additional security attacks against SMM. | +| Firmware: **VBS enablement of NX protection for UEFI runtime services** | **Requirements**:
• VBS will enable No-Execute (NX) protection on UEFI runtime service code and data memory regions. UEFI runtime service code must support read-only page protections, and UEFI runtime service data must not be exceutable.
• UEFI runtime service must meet these requirements:
- Implement UEFI 2.6 EFI_MEMORY_ATTRIBUTES_TABLE. All UEFI runtime service memory (code and data) must be described by this table.
- PE sections need to be page-aligned in memory (not required for in non-volitile storage).
- The Memory Attributes Table needs to correctly mark code and data as RO/NX for configuration by the OS:
- All entries must include attributes EFI_MEMORY_RO, EFI_MEMORY_XP, or both
- No entries may be left with neither of the above attributes, indicating memory that is both exceutable and writable. Memory must be either readable and executable or writeable and non-executable.
Notes:
• This only applies to UEFI runtime service memory, and not UEFI boot service memory.
• This protection is applied by VBS on OS page tables.
Please also note the following:
• Do not use sections that are both writeable and exceutable
• Do not attempt to directly modify executable system memory
• Do not use dynamic code
**Security benefits**:
• Vulnerabilities in UEFI runtime, if any, will be blocked from compromising VBS (such as in functions like UpdateCapsule and SetVariable)
• Reduces the attack surface to VBS from system firmware. | +| Firmware: **Firmware support for SMM protection** | **Requirements**: The [Windows SMM Security Mitigations Table (WSMT) specification](http://download.microsoft.com/download/1/8/A/18A21244-EB67-4538-BAA2-1A54E0E490B6/WSMT.docx) contains details of an Advanced Configuration and Power Interface (ACPI) table that was created for use with Windows operating systems that support Windows virtualization-based security (VBS) features.
**Security benefits**:
• Protects against potential vulnerabilities in UEFI runtime services, if any, will be blocked from compromising VBS (such as in functions like UpdateCapsule and SetVariable)
• Reduces the attack surface to VBS from system firmware.
• Blocks additional security attacks against SMM. | ## Manage Credential Guard @@ -145,11 +181,11 @@ You can do this by using either the Control Panel or the Deployment Image Servic 1. Open an elevated command prompt. 2. Add the Hyper-V Hypervisor by running the following command: - ``` syntax + ``` dism /image:
**Set-RuleOption -FilePath $InitialCIPolicy -Option 0** + > - When you specify the **-UserPEs** parameter (to include user mode executables in the scan), rule option **0 Enabled:UMCI** is automatically added to the code integrity policy. In contrast, if you do not specify **-UserPEs**, the policy will be empty of user mode executables and will only have rules for kernel mode binaries like drivers, in other words, the whitelist will not include applications. If you create such a policy and later add rule option **0 Enabled:UMCI**, all attempts to start applications will cause a response from Device Guard. In audit mode, the response is logging an event, and in enforced mode, the response is blocking the application. + + > - You can add the **-Fallback** parameter to catch any applications not discovered using the primary file rule level specified by the **-Level** parameter. For more information about file rule level options, see [Code integrity file rule levels](deploy-code-integrity-policies-policy-rules-and-file-rules.md#code-integrity-file-rule-levels) in “Deploy code integrity policies: policy rules and file rules.” - > - You can add the *–Fallback* parameter to catch any applications not discovered using the primary file rule level specified by the *–Level* parameter. For more information about file rule level options, see [Code integrity file rule levels](deploy-code-integrity-policies-policy-rules-and-file-rules.md#code-integrity-file-rule-levels) in “Deploy code integrity policies: policy rules and file rules.” - - > - To specify that the code integrity policy scan only a specific drive, include the *–ScanPath* parameter followed by a path. Without this parameter, the entire system is scanned. + > - To specify that the code integrity policy scan only a specific drive, include the **-ScanPath** parameter followed by a path. Without this parameter, the entire system is scanned. > - The preceding example includes `3> CIPolicylog.txt`, which redirects warning messages to a text file, **CIPolicylog.txt**. diff --git a/windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md b/windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md index 9f7be87cbb..b03c8c1332 100644 --- a/windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md +++ b/windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md @@ -30,10 +30,10 @@ For information about enabling Credential Guard, see [Protect derived domain cre In addition to the hardware requirements found in [Hardware, firmware, and software requirements for Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md#hardware-firmware-and-software-requirements-for-device-guard), you must confirm that certain operating system features are enabled before you can enable VBS: -- With Windows 10, version 1607 or Windows Server 2016:
+- Beginning with Windows 10, version 1607 or Windows Server 2016:
Hyper-V Hypervisor, which is enabled automatically. No further action is needed. -- With an earlier version of Windows 10, or Windows Server 2016 Technical Preview 5 or earlier:
+- With an earlier version of Windows 10:
Hyper-V Hypervisor and Isolated User Mode (shown in Figure 1). > **Note** You can configure these features by using Group Policy or Deployment Image Servicing and Management, or manually by using Windows PowerShell or the Windows Features dialog box. @@ -42,12 +42,8 @@ Hyper-V Hypervisor and Isolated User Mode (shown in Figure 1). **Figure 1. Enable operating system features for VBS, Windows 10, version 1511** -After you enable the feature or features, you can enable VBS for Device Guard, as described in the following sections. - ## Enable Virtualization Based Security (VBS) and Device Guard -Before you begin this process, verify that the target device meets the hardware and firmware requirements for the features that you want, as described in [Hardware, firmware, and software requirements for Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md#hardware-firmware-and-software-requirements-for-device-guard). Also, confirm that you have enabled the Windows features discussed in the previous section, [Windows feature requirements for virtualization-based security](#windows-feature-requirements-for-virtualization-based-security-and-device-guard). - There are multiple ways to configure VBS features for Device Guard: - You can use the [readiness tool](https://www.microsoft.com/en-us/download/details.aspx?id=53337) rather than the procedures in this topic. @@ -68,7 +64,7 @@ There are multiple ways to configure VBS features for Device Guard: 3. Open the Group Policy Management Editor: right-click the new GPO, and then click **Edit**. -4. Within the selected GPO, navigate to Computer Configuration\\Administrative Templates\\System\\Device Guard. Right-click **Turn On Virtualization Based Security**, and then click **Edit**. +4. Within the selected GPO, navigate to Computer Configuration\\Policies\\Administrative Templates\\System\\Device Guard. Right-click **Turn On Virtualization Based Security**, and then click **Edit**.  @@ -91,7 +87,7 @@ There are multiple ways to configure VBS features for Device Guard: - With Windows 10, version 1607 or Windows Server 2016, choose an appropriate option:
For an initial deployment or test deployment, we recommend **Enabled without lock**.
When your deployment is stable in your environment, we recommend changing to **Enabled with lock**. This option helps protect the registry from tampering, either through malware or by an unauthorized person. - - With earlier versions of Windows 10, or Windows Server 2016 Technical Preview 5 or earlier:
Select the **Enable Virtualization Based Protection of Code Integrity** check box. + - With earlier versions of Windows 10:
Select the **Enable Virtualization Based Protection of Code Integrity** check box.  @@ -183,7 +179,7 @@ reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "RequirePlatformS reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "HypervisorEnforcedCodeIntegrity" /t REG_DWORD /d 1 /f -reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v " Unlocked" /t REG_DWORD /d 1 /f +reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "Unlocked" /t REG_DWORD /d 1 /f ``` If you want to customize the preceding recommended settings, use the following settings. @@ -211,7 +207,7 @@ reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "HypervisorEnforc **To enable virtualization-based protection of Code Integrity policies without UEFI lock** ``` command -reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v " Unlocked" /t REG_DWORD /d 1 /f +reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "Unlocked" /t REG_DWORD /d 1 /f ``` ### Validate enabled Device Guard hardware-based security features diff --git a/windows/keep-secure/domain-controller-ldap-server-signing-requirements.md b/windows/keep-secure/domain-controller-ldap-server-signing-requirements.md index 10001b50e6..9ef4617e9f 100644 --- a/windows/keep-secure/domain-controller-ldap-server-signing-requirements.md +++ b/windows/keep-secure/domain-controller-ldap-server-signing-requirements.md @@ -22,9 +22,9 @@ This policy setting determines whether the Lightweight Directory Access Protocol Unsigned network traffic is susceptible to man-in-the-middle attacks, where an intruder captures packets between the server and the client device and modifies them before forwarding them to the client device. In the case of an LDAP server, this means that a malicious user can cause a client device to make decisions based on false records from the LDAP directory. You can lower the risk of a malicious user accomplishing this in a corporate network by implementing strong physical security measures to protect the network infrastructure. Furthermore, implementing Internet Protocol security (IPsec) Authentication Header mode, which provides mutual authentication and packet integrity for IP traffic, can make all types of man-in-the-middle attacks extremely difficult. -This setting does not have any impact on LDAP simple bind or LDAP simple bind through SSL. +This setting does not have any impact on LDAP simple bind through SSL (LDAP TCP/636). -If signing is required, then LDAP simple bind and LDAP simple bind through SSL requests are rejected. +If signing is required, then LDAP simple binds not using SSL are rejected (LDAP TCP/389). >**Caution:** If you set the server to Require signature, you must also set the client device. Not setting the client device results in loss of connection with the server. diff --git a/windows/keep-secure/enable-phone-signin-to-pc-and-vpn.md b/windows/keep-secure/enable-phone-signin-to-pc-and-vpn.md index e3c6cbddf6..b3077d445a 100644 --- a/windows/keep-secure/enable-phone-signin-to-pc-and-vpn.md +++ b/windows/keep-secure/enable-phone-signin-to-pc-and-vpn.md @@ -6,7 +6,7 @@ ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: jdeckerMS -localizationpriority: high +redirect_url: https://technet.microsoft.com/en-us/itpro/windows/keep-secure/hello-enable-phone-signin --- # Enable phone sign-in to PC or VPN @@ -17,74 +17,3 @@ localizationpriority: high - Windows 10 - Windows 10 Mobile -In Windows 10, version 1607, your network users can use Windows Phone with Windows Hello to sign in to a PC, connect to VPN, and sign in to Office 365 in a browser. Phone sign-in uses Bluetooth, which means no need to wait for a phone call -- just unlock the phone and tap the app. - - - -> [!NOTE] -> Phone sign-in is currently limited to select Technology Adoption Program (TAP) participants. - -You can create a Group Policy or mobile device management (MDM) policy that will allow users to sign in to a work PC or their company's VPN using the credentials stored on their Windows 10 phone. - - ## Prerequisites - - - Both phone and PC must be running Windows 10, version 1607. - - The PC must be running Windows 10 Pro, Enterprise, or Education - - Both phone and PC must have Bluetooth. - - The **Microsoft Authenticator** app must be installed on the phone. - - The PC must be joined to an Active Directory domain that is connected to an Azure Active Directory (Azure AD) domain, or the PC must be joined to Azure AD. - - The phone must be joined to Azure AD or have a work account added. - - The VPN configuration profile must use certificate-based authentication. - -## Set policies - -To enable phone sign-in, you must enable the following policies using Group Policy or MDM. - -- Group Policy: **Computer Configuration** or **User Configuration** > **Policies** > **Administrative Templates** > **Windows Components** > **Windows Hello for Business** - - Enable **Use Windows Hello for Business** - - Enable **Phone Sign-in** -- MDM: - - Set **UsePassportForWork** to **True** - - Set **Remote\UseRemotePassport** to **True** - -## Configure VPN - -To enable phone sign-in to VPN, you must enable the [policy](#set-policies) for phone sign-in and ensure that VPN is configured as follows: - -- For inbox VPN, set up the VPN profile with Extensible Authentication Protocol (EAP) with the **Smart card or other certificate (TLS)** EAP type, also known as EAP-Transport Level Security (EAP-TLS). To exclusively access the VPN certificates on the phone, in the EAP filtering XML, add either **EKU** or **Issuer** (or both) filtering to make sure it picks only the Remote NGC certificate. -- For a Universal Windows Platform (UWP) VPN plug-in, add filtering criteria based on the 3rd party mechanism for the Remote NGC Certificate. - -## Get the app - -If you want to distribute the **Microsoft Authenticator** app, your organization must have set up Windows Store for Business, with Microsoft added as a [Line of Business (LOB) publisher](../manage/working-with-line-of-business-apps.md). - -[Tell people how to sign in using their phone.](prepare-people-to-use-microsoft-passport.md#bmk-remote) - - -## Related topics - -[Manage identity verification using Windows Hello for Business](manage-identity-verification-using-microsoft-passport.md) - -[Implement Windows Hello for Business in your organization](implement-microsoft-passport-in-your-organization.md) - -[Why a PIN is better than a password](why-a-pin-is-better-than-a-password.md) - -[Prepare people to use Windows Hello](prepare-people-to-use-microsoft-passport.md) - -[Windows Hello and password changes](microsoft-passport-and-password-changes.md) - -[Windows Hello errors during PIN creation](microsoft-passport-errors-during-pin-creation.md) - -[Event ID 300 - Windows Hello successfully created](passport-event-300.md) - -[Windows Hello biometrics in the enterprise](windows-hello-in-enterprise.md) - - - - - - - - - - diff --git a/windows/keep-secure/event-4774.md b/windows/keep-secure/event-4774.md index 2b626f9576..0616a1e887 100644 --- a/windows/keep-secure/event-4774.md +++ b/windows/keep-secure/event-4774.md @@ -1,6 +1,6 @@ --- -title: 4774(S) An account was mapped for logon. (Windows 10) -description: Describes security event 4774(S) An account was mapped for logon. +title: 4774(S, F) An account was mapped for logon. (Windows 10) +description: Describes security event 4774(S, F) An account was mapped for logon. ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy @@ -8,14 +8,13 @@ ms.sitesec: library author: Mir0sh --- -# 4774(S): An account was mapped for logon. +# 4774(S, F): An account was mapped for logon. **Applies to** - Windows 10 - Windows Server 2016 - -It appears that this event never occurs. +Success events do not appear to occur. Failure event [has been reported](http://forum.ultimatewindowssecurity.com/Topic7313-282-1.aspx). ***Subcategory:*** [Audit Credential Validation](audit-credential-validation.md) @@ -23,11 +22,11 @@ It appears that this event never occurs. *An account was mapped for logon.* -*Authentication Package:%1* +*Authentication Package:Schannel* -*Account UPN:%2* +*Account UPN:*<*Acccount*>@<*Domain*> -*Mapped Name:%3* +*Mapped Name:*<*Account*> ***Required Server Roles:*** no information. diff --git a/windows/keep-secure/hello-and-password-changes.md b/windows/keep-secure/hello-and-password-changes.md new file mode 100644 index 0000000000..b9937eeaa8 --- /dev/null +++ b/windows/keep-secure/hello-and-password-changes.md @@ -0,0 +1,49 @@ +--- +title: Windows Hello and password changes (Windows 10) +description: When you change your password on a device, you may need to sign in with a password on other devices to reset Hello. +ms.assetid: 83005FE4-8899-47A6-BEA9-C17CCA0B6B55 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +author: jdeckerMS +localizationpriority: high +--- +# Windows Hello and password changes + +**Applies to** +- Windows 10 +- Windows 10 Mobile + +When you set up Windows Hello, the PIN or biometric gesture that you use is specific to that device. You can set up Hello for the same account on multiple devices. If the PIN or biometric is configured as part of Windows Hello for Business, changing the account password will not impact sign-in or unlock with these gestures since it uses a key or certificate. However, if Windows Hello for Business is not deployed and the password for that account changes, you must provide the new password on each device to continue to use Hello. + +## Example + +Let's suppose that you have set up a PIN for your Microsoft account on **Device A**. You use your PIN to sign in on **Device A** and then change the password for your Microsoft account. +Because you were using **Device A** when you changed your password, the PIN on **Device A** will continue to work with no other action on your part. + +Suppose instead that you sign in on **Device B** and change your password for your Microsoft account. The next time that you try to sign in on **Device A** using your PIN, sign-in will fail because the account credentials that Hello on **Device A** knows will be outdated. + +>[!NOTE] +>This example also applies to an Active Directory account when [Windows Hello for Business is not implemented](implement-microsoft-passport-in-your-organization.md). + +## How to update Hello after you change your password on another device + +1. When you try to sign in using your PIN or biometric, you will see the following message: **Your password was changed on a different device. You must sign in to this device once with your new password, and then you can sign in with your PIN.** +2. Click **OK.** +3. Click **Sign-in options**. +4. Click the **Password** button. +5. Sign in with new password. +6. The next time that you sign in, you can select **Sign-in options** and then select **PIN** to resume using your PIN. + +## Related topics + +- [Windows Hello for Business](hello-identity-verification.md) +- [How Windows Hello for Business works](hello-how-it-works.md) +- [Manage Windows Hello for Business in your organization](hello-manage-in-organization.md) +- [Enable phone sign-in to PC or VPN](hello-enable-phone-signin.md) +- [Why a PIN is better than a password](hello-why-pin-is-better-than-password.md) +- [Prepare people to use Windows Hello](hello-prepare-people-to-use.md) +- [Windows Hello errors during PIN creation](hello-errors-during-pin-creation.md) +- [Event ID 300 - Windows Hello successfully created](hello-event-300.md) +- [Windows Hello biometrics in the enterprise](hello-biometrics-in-enterprise.md) \ No newline at end of file diff --git a/windows/keep-secure/hello-biometrics-in-enterprise.md b/windows/keep-secure/hello-biometrics-in-enterprise.md new file mode 100644 index 0000000000..162ff7d762 --- /dev/null +++ b/windows/keep-secure/hello-biometrics-in-enterprise.md @@ -0,0 +1,97 @@ +--- +title: Windows Hello biometrics in the enterprise (Windows 10) +description: Windows Hello is the biometric authentication feature that helps strengthen authentication and helps to guard against potential spoofing through fingerprint matching and facial recognition. +ms.assetid: d3f27d94-2226-4547-86c0-65c84d6df8Bc +keywords: Windows Hello, enterprise biometrics +ms.prod: w10 +ms.mktglfcycl: explore +ms.sitesec: library +ms.pagetype: security +author: jdeckerMS +localizationpriority: high +--- + +# Windows Hello biometrics in the enterprise +**Applies to:** + +- Windows 10 + +Windows Hello is the biometric authentication feature that helps strengthen authentication and helps to guard against potential spoofing through fingerprint matching and facial recognition. + +>[!NOTE] +>When Windows 10 first shipped, it included Microsoft Passport and Windows Hello, which worked together to provide multi-factor authentication. To simplify deployment and improve supportability, Microsoft has combined these technologies into a single solution under the Windows Hello name. Customers who have already deployed these technologies will not experience any change in functionality. Customers who have yet to evaluate Windows Hello will find it easier to deploy due to simplified policies, documentation, and semantics. + +Because we realize your employees are going to want to use this new technology in your enterprise, we’ve been actively working with the device manufacturers to create strict design and performance recommendations that help to ensure that you can more confidently introduce Windows Hello biometrics into your organization. + +##How does Windows Hello work? +Windows Hello lets your employees use fingerprint or facial recognition as an alternative method to unlocking a device. With Windows Hello, authentication happens when the employee provides his or her unique biometric identifier while accessing the device-specific Windows Hello credentials. + +The Windows Hello authenticator works to authenticate and allow employees onto your enterprise network. Authentication doesn’t roam among devices, isn’t shared with a server, and can’t easily be extracted from a device. If multiple employees share a device, each employee will use his or her own biometric data on the device. + +## Why should I let my employees use Windows Hello? +Windows Hello provides many benefits, including: + +- It helps to strengthen your protections against credential theft. Because an attacker must have both the device and the biometric info or PIN, it’s much more difficult to gain access without the employee’s knowledge. + +- Employees get a simple authentication method (backed up with a PIN) that’s always with them, so there’s nothing to lose. No more forgetting passwords! + +- Support for Windows Hello is built into the operating system so you can add additional biometric devices and polices as part of a coordinated rollout or to individual employees or groups using Group Policy or Mobile Device Management (MDM) configurations service provider (CSP) policies.
For more info about the available Group Policies and MDM CSPs, see the [Implement Windows Hello for Business in your organization](implement-microsoft-passport-in-your-organization.md) topic. + +## Where is Microsoft Hello data stored? +The biometric data used to support Windows Hello is stored on the local device only. It doesn’t roam and is never sent to external devices or servers. This separation helps to stop potential attackers by providing no single collection point that an attacker could potentially compromise to steal biometric data. Additionally, even if an attacker was actually able to get the biometric data, it still can’t be easily converted to a form that could be recognized by the biometric sensor. + +## Has Microsoft set any device requirements for Windows Hello? +We’ve been working with the device manufacturers to help ensure a high-level of performance and protection is met by each sensor and device, based on these requirements: + +- **False Accept Rate (FAR).** Represents the instance a biometric identification solution verifies an unauthorized person. This is normally represented as a ratio of number of instances in a given population size, for example 1 in 100 000. This can also be represented as a percentage of occurrence, for example, 0.001%. This measurement is heavily considered the most important with regards to the security of the biometric algorithm. + +- **False Reject Rate (FRR).** Represents the instances a biometric identification solution fails to verify an authorized person correctly. Usually represented as a percentage, the sum of the True Accept Rate and False Reject Rate is 1. Can be with or without anti-spoofing or liveness detection. + +### Fingerprint sensor requirements +To allow fingerprint matching, you must have devices with fingerprint sensors and software. Fingerprint sensors, or sensors that use an employee’s unique fingerprint as an alternative log on option, can be touch sensors (large area or small area) or swipe sensors. Each type of sensor has its own set of detailed requirements that must be implemented by the manufacturer, but all of the sensors must include anti-spoofing measures (required) and a way to configure them (optional). + +**Acceptable performance range for small to large size touch sensors** + +- False Accept Rate (FAR): <0.001 – 0.002% + +- False Reject Rate (FRR) without Anti-spoofing or liveness detection: <5% + +- Effective, real world FRR with Anti-spoofing or liveness detection: <10% + +**Acceptable performance range for swipe sensors** + +- False Accept Rate (FAR): <0.002% + +- False Reject Rate (FRR) without Anti-spoofing or liveness detection: <5% + +- Effective, real world FRR with Anti-spoofing or liveness detection: <10% + +### Facial recognition sensors +To allow facial recognition, you must have devices with integrated special infrared (IR) sensors and software. Facial recognition sensors use special cameras that see in IR light, letting them tell the difference between a photo and a living person while scanning an employee’s facial features. These sensors, like the fingerprint sensors, must also include anti-spoofing measures (required) and a way to configure them (optional). + +- False Accept Rate (FAR): <0.001 + +- False Reject Rate (FRR) without Anti-spoofing or liveness detection: <5% + +- Effective, real world FRR with Anti-spoofing or liveness detection: <10% + +## Related topics +- [Windows Hello for Business](hello-identity-verification.md) +- [How Windows Hello for Business works](hello-how-it-works.md) +- [Manage Windows Hello for Business in your organization](hello-manage-in-organization.md) +- [Enable phone sign-in to PC or VPN](hello-enable-phone-signin.md) +- [Why a PIN is better than a password](hello-why-pin-is-better-than-password.md) +- [Prepare people to use Windows Hello](hello-prepare-people-to-use.md) +- [Windows Hello and password changes](hello-and-password-changes.md) +- [Windows Hello errors during PIN creation](hello-errors-during-pin-creation.md) +- [Event ID 300 - Windows Hello successfully created](hello-event-300.md) +- [PassportforWork CSP](https://go.microsoft.com/fwlink/p/?LinkId=708219) + + + + + + + + + diff --git a/windows/keep-secure/hello-enable-phone-signin.md b/windows/keep-secure/hello-enable-phone-signin.md new file mode 100644 index 0000000000..c77dfeeaf1 --- /dev/null +++ b/windows/keep-secure/hello-enable-phone-signin.md @@ -0,0 +1,84 @@ +--- +title: Enable phone sign-in to PC or VPN (Windows 10) +description: You can set policies to allow your users to sign in to a PC or VPN using their Windows 10 phone. +keywords: ["identity", "PIN", "biometric", "Hello"] +ms.prod: W10 +ms.mktglfcycl: deploy +ms.sitesec: library +author: jdeckerMS +localizationpriority: high +--- + +# Enable phone sign-in to PC or VPN + + +**Applies to** + +- Windows 10 +- Windows 10 Mobile + +In Windows 10, version 1607, your network users can use Windows Phone with Windows Hello to sign in to a PC, connect to VPN, and sign in to Office 365 in a browser. Phone sign-in uses Bluetooth, which means no need to wait for a phone call -- just unlock the phone and tap the app. + + + +> [!NOTE] +> Phone sign-in is currently limited to select Technology Adoption Program (TAP) participants. + +You can create a Group Policy or mobile device management (MDM) policy that will allow users to sign in to a work PC or their company's VPN using the credentials stored on their Windows 10 phone. + + ## Prerequisites + + - Both phone and PC must be running Windows 10, version 1607. + - The PC must be running Windows 10 Pro, Enterprise, or Education + - Both phone and PC must have Bluetooth. + - The **Microsoft Authenticator** app must be installed on the phone. + - The PC must be joined to an Active Directory domain that is connected to an Azure Active Directory (Azure AD) domain, or the PC must be joined to Azure AD. + - The phone must be joined to Azure AD or have a work account added. + - The VPN configuration profile must use certificate-based authentication. + +## Set policies + +To enable phone sign-in, you must enable the following policies using Group Policy or MDM. + +- Group Policy: **Computer Configuration** or **User Configuration** > **Policies** > **Administrative Templates** > **Windows Components** > **Windows Hello for Business** + - Enable **Use Windows Hello for Business** + - Enable **Phone Sign-in** +- MDM: + - Set **UsePassportForWork** to **True** + - Set **Remote\UseRemotePassport** to **True** + +## Configure VPN + +To enable phone sign-in to VPN, you must enable the [policy](#set-policies) for phone sign-in and ensure that VPN is configured as follows: + +- For inbox VPN, set up the VPN profile with Extensible Authentication Protocol (EAP) with the **Smart card or other certificate (TLS)** EAP type, also known as EAP-Transport Level Security (EAP-TLS). To exclusively access the VPN certificates on the phone, in the EAP filtering XML, add either **EKU** or **Issuer** (or both) filtering to make sure it picks only the Remote NGC certificate. +- For a Universal Windows Platform (UWP) VPN plug-in, add filtering criteria based on the 3rd party mechanism for the Remote NGC Certificate. + +## Get the app + +If you want to distribute the **Microsoft Authenticator** app, your organization must have set up Windows Store for Business, with Microsoft added as a [Line of Business (LOB) publisher](../manage/working-with-line-of-business-apps.md). + +[Tell people how to sign in using their phone.](hello-prepare-people-to-use.md#bmk-remote) + + +## Related topics + +- [Windows Hello for Business](hello-identity-verification.md) +- [How Windows Hello for Business works](hello-how-it-works.md) +- [Manage Windows Hello for Business in your organization](hello-manage-in-organization.md) +- [Why a PIN is better than a password](hello-why-pin-is-better-than-password.md) +- [Prepare people to use Windows Hello](hello-prepare-people-to-use.md) +- [Windows Hello and password changes](hello-and-password-changes.md) +- [Windows Hello errors during PIN creation](hello-errors-during-pin-creation.md) +- [Event ID 300 - Windows Hello successfully created](hello-event-300.md) +- [Windows Hello biometrics in the enterprise](hello-biometrics-in-enterprise.md) + + + + + + + + + + diff --git a/windows/keep-secure/hello-errors-during-pin-creation.md b/windows/keep-secure/hello-errors-during-pin-creation.md new file mode 100644 index 0000000000..3d85f75565 --- /dev/null +++ b/windows/keep-secure/hello-errors-during-pin-creation.md @@ -0,0 +1,233 @@ +--- +title: Windows Hello errors during PIN creation (Windows 10) +description: When you set up Windows Hello in Windows 10, you may get an error during the Create a work PIN step. +ms.assetid: DFEFE22C-4FEF-4FD9-BFC4-9B419C339502 +keywords: PIN, error, create a work PIN +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +author: jdeckerMS +localizationpriority: high +--- + +# Windows Hello errors during PIN creation + +**Applies to** +- Windows 10 +- Windows 10 Mobile + +When you set up Windows Hello in Windows 10, you may get an error during the **Create a PIN** step. This topic lists some of the error codes with recommendations for mitigating the problem. If you get an error code that is not listed here, contact Microsoft Support. + +## Where is the error code? + +The following image shows an example of an error during **Create a PIN**. + + + +## Error mitigations + +When a user encounters an error when creating the work PIN, advise the user to try the following steps. Many errors can be mitigated by one of these steps. +1. Try to create the PIN again. Some errors are transient and resolve themselves. +2. Sign out, sign in, and try to create the PIN again. +3. Reboot the device and then try to create the PIN again. +4. Unjoin the device from Azure Active Directory (Azure AD), rejoin, and then try to create the PIN again. To unjoin a desktop PC, go to **Settings** > **System** > **About** and select **Disconnect from organization**. To unjoin a device running Windows 10 Mobile, you must [reset the device](https://go.microsoft.com/fwlink/p/?LinkId=715697). +5. On mobile devices, if you are unable to setup a PIN after multiple attempts, reset your device and start over. For help on how to reset your phone go to [Reset my phone](https://go.microsoft.com/fwlink/p/?LinkId=715697). +If the error occurs again, check the error code against the following table to see if there is another mitigation for that error. When no mitigation is listed in the table, contact Microsoft Support for assistance. + +
| Hex | +Cause | +Mitigation | +
|---|---|---|
| 0x801C044D | +Authorization token does not contain device ID | +Unjoin the device from Azure AD and rejoin | +
| 0x80090036 | +User cancelled an interactive dialog | +User will be asked to try again | +
| 0x80090011 | +The container or key was not found | +Unjoin the device from Azure AD and rejoin | +
| 0x8009000F | +The container or key already exists | +Unjoin the device from Azure AD and rejoin | +
| 0x8009002A | +NTE_NO_MEMORY | +Close programs which are taking up memory and try again. | +
| 0x80090005 | +NTE_BAD_DATA | +Unjoin the device from Azure AD and rejoin | +
| 0x80090029 | +TPM is not set up. | +Sign on with an administrator account. Click **Start**, type "tpm.msc", and select **tpm.msc Microsoft Common Console Document**. In the **Actions** pane, select **Prepare the TPM**. | +
| 0x80090031 | +NTE_AUTHENTICATION_IGNORED | +Reboot the device. If the error occurs again after rebooting, [reset the TPM]( https://go.microsoft.com/fwlink/p/?LinkId=619969) or run [Clear-TPM](https://go.microsoft.com/fwlink/p/?LinkId=629650) | +
| 0x80090035 | +Policy requires TPM and the device does not have TPM. | +Change the Windows Hello for Business policy to not require a TPM. | +
| 0x801C0003 | +User is not authorized to enroll | +Check if the user has permission to perform the operation. | +
| 0x801C000E | +Registration quota reached | +Unjoin some other device that is currently joined using the same account or [increase the maximum number of devices per user](https://go.microsoft.com/fwlink/p/?LinkId=626933). |
+
| 0x801C000F | +Operation successful but the device requires a reboot | +Reboot the device. | +
| 0x801C0010 | +The AIK certificate is not valid or trusted | +Sign out and then sign in again. | +
| 0x801C0011 | +The attestation statement of the transport key is invalid | +Sign out and then sign in again. | +
| 0x801C0012 | +Discovery request is not in a valid format | +Sign out and then sign in again. | +
| 0x801C0015 | +The device is required to be joined to an Active Directory domain | +Join the device to an Active Directory domain. | +
| 0x801C0016 | +The federation provider configuration is empty | +Go to [http://clientconfig.microsoftonline-p.net/FPURL.xml](http://clientconfig.microsoftonline-p.net/FPURL.xml) and verify that the file is not empty. | +
| 0x801C0017 | +The federation provider domain is empty | +Go to [http://clientconfig.microsoftonline-p.net/FPURL.xml](http://clientconfig.microsoftonline-p.net/FPURL.xml) and verify that the FPDOMAINNAME element is not empty. | +
| 0x801C0018 | +The federation provider client configuration URL is empty | +Go to [http://clientconfig.microsoftonline-p.net/FPURL.xml](http://clientconfig.microsoftonline-p.net/FPURL.xml) and verify that the CLIENTCONFIG element contains a valid URL. | +
| 0x801C03E9 | +Server response message is invalid | +Sign out and then sign in again. | +
| 0x801C03EA | +Server failed to authorize user or device. | +Check if the token is valid and user has permission to register Windows Hello for Business keys. | +
| 0x801C03EB | +Server response http status is not valid | +Sign out and then sign in again. | +
| 0x801C03EC | +Unhandled exception from server. | +sign out and then sign in again. | +
| 0x801C03ED | +Multi-factor authentication is required for a 'ProvisionKey' operation, but was not performed +-or- +Token was not found in the Authorization header +-or- +Failed to read one or more objects +-or- The request sent to the server was invalid. |
+Sign out and then sign in again. If that doesn't resolve the issue, unjoin the device from Azure Active Directory (Azure AD) and rejoin. | +
| 0x801C03EE | +Attestation failed | +Sign out and then sign in again. | +
| 0x801C03EF | +The AIK certificate is no longer valid | +Sign out and then sign in again. | +
| 0x801C044D | +Unable to obtain user token | +Sign out and then sign in again. Check network and credentials. | +
| 0x801C044E | +Failed to receive user creds input | +Sign out and then sign in again. | +
| Policy | +Options | +|
|---|---|---|
| Use Windows Hello for Business | ++ |
+ Not configured: Users can provision Windows Hello for Business, which encrypts their domain password. +Enabled: Device provisions Windows Hello for Business using keys or certificates for all users. +Disabled: Device does not provision Windows Hello for Business for any user. + |
+
| Use a hardware security device | ++ |
+ Not configured: Windows Hello for Business will be provisioned using TPM if available, and will be provisioned using software if TPM is not available. +Enabled: Windows Hello for Business will only be provisioned using TPM. +Disabled: Windows Hello for Business will be provisioned using TPM if available, and will be provisioned using software if TPM is not available. + |
+
| Use biometrics | ++ |
+ Not configured: Biometrics can be used as a gesture in place of a PIN. +Enabled: Biometrics can be used as a gesture in place of a PIN. +Disabled: Only a PIN can be used as a gesture. + |
+
| PIN Complexity | +Require digits | +
+ Not configured: Users must include a digit in their PIN. +Enabled: Users must include a digit in their PIN. +Disabled: Users cannot use digits in their PIN. + |
+
| Require lowercase letters | +
+ Not configured: Users cannot use lowercase letters in their PIN. +Enabled: Users must include at least one lowercase letter in their PIN. +Disabled: Users cannot use lowercase letters in their PIN. + |
+|
| Maximum PIN length | +
+ Not configured: PIN length must be less than or equal to 127. +Enabled: PIN length must be less than or equal to the number you specify. +Disabled: PIN length must be less than or equal to 127. + |
+|
| Minimum PIN length | +
+ Not configured: PIN length must be greater than or equal to 4. +Enabled: PIN length must be greater than or equal to the number you specify. +Disabled: PIN length must be greater than or equal to 4. + |
+|
| Expiration | +
+ Not configured: PIN does not expire. +Enabled: PIN can be set to expire after any number of days between 1 and 730, or PIN can be set to never expire by setting policy to 0. +Disabled: PIN does not expire. + |
+|
| History | +
+ Not configured: Previous PINs are not stored. +Enabled: Specify the number of previous PINs that can be associated to a user account that can't be reused. +Disabled: Previous PINs are not stored. +Note Current PIN is included in PIN history.
+ |
+|
| Require special characters | +
+ Not configured: Users cannot include a special character in their PIN. +Enabled: Users must include at least one special character in their PIN. +Disabled: Users cannot include a special character in their PIN. + |
+|
| Require uppercase letters | +
+ Not configured: Users cannot include an uppercase letter in their PIN. +Enabled: Users must include at least one uppercase letter in their PIN. +Disabled: Users cannot include an uppercase letter in their PIN. + |
+|
| Phone Sign-in | +
+ Use Phone Sign-in +Note Applies to desktop only. Phone sign-in is currently limited to select Technology Adoption Program (TAP) participants.
+ |
+
+ Not configured: Phone sign-in is disabled. +Enabled: Users can use a portable, registered device as a companion device for desktop authentication. +Disabled: Phone sign-in is disabled. + |
+
| Policy | +Scope | +Default | +Options | +|
|---|---|---|---|---|
| UsePassportForWork | ++ | Device | +True | +
+ True: Windows Hello for Business will be provisioned for all users on the device. +False: Users will not be able to provision Windows Hello for Business. +Note If Windows Hello for Business is enabled, and then the policy is changed to False, users who previously set up Windows Hello for Business can continue to use it, but will not be able to set up Windows Hello for Business on other devices.
+ |
+
| RequireSecurityDevice | ++ | Device | +False | +
+ True: Windows Hello for Business will only be provisioned using TPM. +False: Windows Hello for Business will be provisioned using TPM if available, and will be provisioned using software if TPM is not available. + |
+
| Biometrics | +
+ UseBiometrics + |
+Device | +False | +
+ True: Biometrics can be used as a gesture in place of a PIN for domain sign-in. +False: Only a PIN can be used as a gesture for domain sign-in. + |
+
|
+ FacialFeaturesUser +EnhancedAntiSpoofing + |
+Device | +Not configured | +
+ Not configured: users can choose whether to turn on enhanced anti-spoofing. +True: Enhanced anti-spoofing is required on devices which support it. +False: Users cannot turn on enhanced anti-spoofing. + |
+|
| PINComplexity | +||||
| Digits | +Device or user | +2 | +
+ 1: Numbers are not allowed. +2: At least one number is required. + |
+|
| Lowercase letters | +Device or user | +1 | +
+ 1: Lowercase letters are not allowed. +2: At least one lowercase letter is required. + |
+|
| Maximum PIN length | +Device or user | +127 | +
+ Maximum length that can be set is 127. Maximum length cannot be less than minimum setting. + |
+|
| Minimum PIN length | +Device or user | +4 | +
+ Minimum length that can be set is 4. Minimum length cannot be greater than maximum setting. + |
+|
| Expiration | +Device or user | +0 | +
+ Integer value specifies the period of time (in days) that a PIN can be used before the system requires the user to change it. The largest number you can configure for this policy setting is 730. The lowest number you can configure for this policy setting is 0. If this policy is set to 0, then the user’s PIN will never expire. + + |
+|
| History | +Device or user | +0 | +
+ Integer value that specifies the number of past PINs that can be associated to a user account that can’t be reused. The largest number you can configure for this policy setting is 50. The lowest number you can configure for this policy setting is 0. If this policy is set to 0, then storage of previous PINs is not required. + + |
+|
| Special characters | +Device or user | +1 | +
+ 1: Special characters are not allowed. +2: At least one special character is required. + |
+|
| Uppercase letters | +Device or user | +1 | +
+ 1: Uppercase letters are not allowed +2: At least one uppercase letter is required + |
+|
| Remote | +
+ UseRemotePassport +Note Applies to desktop only. Phone sign-in is currently limited to select Technology Adoption Program (TAP) participants.
+ |
+Device or user | +False | +
+ True: Phone sign-in is enabled. +False: Phone sign-in is disabled. + |
+
| Windows Hello for Business mode | +Azure AD | +Active Directory (AD) on-premises (available with production release of Windows Server 2016) | +Azure AD/AD hybrid (available with production release of Windows Server 2016) | +
|---|---|---|---|
| Key-based authentication | +Azure AD subscription | +
|
+
|
+
| Certificate-based authentication | +
|
+
|
+
|
+
| Policy | -Options | -|
|---|---|---|
| Use Windows Hello for Business | -- |
- Not configured: Users can provision Windows Hello for Business, which encrypts their domain password. -Enabled: Device provisions Windows Hello for Business using keys or certificates for all users. -Disabled: Device does not provision Windows Hello for Business for any user. - |
-
| Use a hardware security device | -- |
- Not configured: Windows Hello for Business will be provisioned using TPM if available, and will be provisioned using software if TPM is not available. -Enabled: Windows Hello for Business will only be provisioned using TPM. -Disabled: Windows Hello for Business will be provisioned using TPM if available, and will be provisioned using software if TPM is not available. - |
-
| Use biometrics | -- |
- Not configured: Biometrics can be used as a gesture in place of a PIN. -Enabled: Biometrics can be used as a gesture in place of a PIN. -Disabled: Only a PIN can be used as a gesture. - |
-
| PIN Complexity | -Require digits | -
- Not configured: Users must include a digit in their PIN. -Enabled: Users must include a digit in their PIN. -Disabled: Users cannot use digits in their PIN. - |
-
| Require lowercase letters | -
- Not configured: Users cannot use lowercase letters in their PIN. -Enabled: Users must include at least one lowercase letter in their PIN. -Disabled: Users cannot use lowercase letters in their PIN. - |
-|
| Maximum PIN length | -
- Not configured: PIN length must be less than or equal to 127. -Enabled: PIN length must be less than or equal to the number you specify. -Disabled: PIN length must be less than or equal to 127. - |
-|
| Minimum PIN length | -
- Not configured: PIN length must be greater than or equal to 4. -Enabled: PIN length must be greater than or equal to the number you specify. -Disabled: PIN length must be greater than or equal to 4. - |
-|
| Expiration | -
- Not configured: PIN does not expire. -Enabled: PIN can be set to expire after any number of days between 1 and 730, or PIN can be set to never expire by setting policy to 0. -Disabled: PIN does not expire. - |
-|
| History | -
- Not configured: Previous PINs are not stored. -Enabled: Specify the number of previous PINs that can be associated to a user account that can't be reused. -Disabled: Previous PINs are not stored. -Note Current PIN is included in PIN history.
- |
-|
| Require special characters | -
- Not configured: Users cannot include a special character in their PIN. -Enabled: Users must include at least one special character in their PIN. -Disabled: Users cannot include a special character in their PIN. - |
-|
| Require uppercase letters | -
- Not configured: Users cannot include an uppercase letter in their PIN. -Enabled: Users must include at least one uppercase letter in their PIN. -Disabled: Users cannot include an uppercase letter in their PIN. - |
-|
| Phone Sign-in | -
- Use Phone Sign-in -Note Applies to desktop only. Phone sign-in is currently limited to select Technology Adoption Program (TAP) participants.
- |
-
- Not configured: Phone sign-in is disabled. -Enabled: Users can use a portable, registered device as a companion device for desktop authentication. -Disabled: Phone sign-in is disabled. - |
-
| Policy | -Scope | -Default | -Options | -|
|---|---|---|---|---|
| UsePassportForWork | -- | Device | -True | -
- True: Windows Hello for Business will be provisioned for all users on the device. -False: Users will not be able to provision Windows Hello for Business. -Note If Windows Hello for Business is enabled, and then the policy is changed to False, users who previously set up Windows Hello for Business can continue to use it, but will not be able to set up Windows Hello for Business on other devices.
- |
-
| RequireSecurityDevice | -- | Device | -False | -
- True: Windows Hello for Business will only be provisioned using TPM. -False: Windows Hello for Business will be provisioned using TPM if available, and will be provisioned using software if TPM is not available. - |
-
| Biometrics | -
- UseBiometrics - |
-Device | -False | -
- True: Biometrics can be used as a gesture in place of a PIN for domain sign-in. -False: Only a PIN can be used as a gesture for domain sign-in. - |
-
|
- FacialFeaturesUser -EnhancedAntiSpoofing - |
-Device | -Not configured | -
- Not configured: users can choose whether to turn on enhanced anti-spoofing. -True: Enhanced anti-spoofing is required on devices which support it. -False: Users cannot turn on enhanced anti-spoofing. - |
-|
| PINComplexity | -||||
| Digits | -Device or user | -2 | -
- 1: Numbers are not allowed. -2: At least one number is required. - |
-|
| Lowercase letters | -Device or user | -1 | -
- 1: Lowercase letters are not allowed. -2: At least one lowercase letter is required. - |
-|
| Maximum PIN length | -Device or user | -127 | -
- Maximum length that can be set is 127. Maximum length cannot be less than minimum setting. - |
-|
| Minimum PIN length | -Device or user | -4 | -
- Minimum length that can be set is 4. Minimum length cannot be greater than maximum setting. - |
-|
| Expiration | -Device or user | -0 | -
- Integer value specifies the period of time (in days) that a PIN can be used before the system requires the user to change it. The largest number you can configure for this policy setting is 730. The lowest number you can configure for this policy setting is 0. If this policy is set to 0, then the user’s PIN will never expire. - - |
-|
| History | -Device or user | -0 | -
- Integer value that specifies the number of past PINs that can be associated to a user account that can’t be reused. The largest number you can configure for this policy setting is 50. The lowest number you can configure for this policy setting is 0. If this policy is set to 0, then storage of previous PINs is not required. - - |
-|
| Special characters | -Device or user | -1 | -
- 1: Special characters are not allowed. -2: At least one special character is required. - |
-|
| Uppercase letters | -Device or user | -1 | -
- 1: Uppercase letters are not allowed. -2: At least one uppercase letter is required - |
-|
| Remote | -
- UseRemotePassport -Note Applies to desktop only. Phone sign-in is currently limited to select Technology Adoption Program (TAP) participants.
- |
-Device or user | -False | -
- True: Phone sign-in is enabled. -False: Phone sign-in is disabled. - |
-
| Windows Hello for Business mode | -Azure AD | -Azure AD/AD hybrid (available with production release of Windows Server 2016) | -
|---|---|---|
| Key-based authentication | -[Azure AD subscription](https://docs.microsoft.com/azure/active-directory/active-directory-howto-tenant) | -
|
-
| Certificate-based authentication | -
|
-
|
-
| Hex | -Cause | -Mitigation | -
|---|---|---|
| 0x801C044D | -Authorization token does not contain device ID | -Unjoin the device from Azure AD and rejoin | -
| 0x80090036 | -User cancelled an interactive dialog | -User will be asked to try again | -
| 0x80090011 | -The container or key was not found | -Unjoin the device from Azure AD and rejoin | -
| 0x8009000F | -The container or key already exists | -Unjoin the device from Azure AD and rejoin | -
| 0x8009002A | -NTE_NO_MEMORY | -Close programs which are taking up memory and try again. | -
| 0x80090005 | -NTE_BAD_DATA | -Unjoin the device from Azure AD and rejoin | -
| 0x80090029 | -TPM is not set up. | -Sign on with an administrator account. Click **Start**, type "tpm.msc", and select **tpm.msc Microsoft Common Console Document**. In the **Actions** pane, select **Prepare the TPM**. | -
| 0x80090031 | -NTE_AUTHENTICATION_IGNORED | -Reboot the device. If the error occurs again after rebooting, [reset the TPM]( https://go.microsoft.com/fwlink/p/?LinkId=619969) or run [Clear-TPM](https://go.microsoft.com/fwlink/p/?LinkId=629650) | -
| 0x80090035 | -Policy requires TPM and the device does not have TPM. | -Change the Passport policy to not require a TPM. | -
| 0x801C0003 | -User is not authorized to enroll | -Check if the user has permission to perform the operation. | -
| 0x801C000E | -Registration quota reached | -Unjoin some other device that is currently joined using the same account or [increase the maximum number of devices per user](https://go.microsoft.com/fwlink/p/?LinkId=626933). |
-
| 0x801C000F | -Operation successful but the device requires a reboot | -Reboot the device. | -
| 0x801C0010 | -The AIK certificate is not valid or trusted | -Sign out and then sign in again. | -
| 0x801C0011 | -The attestation statement of the transport key is invalid | -Sign out and then sign in again. | -
| 0x801C0012 | -Discovery request is not in a valid format | -Sign out and then sign in again. | -
| 0x801C0015 | -The device is required to be joined to an Active Directory domain | -Join the device to an Active Directory domain. | -
| 0x801C0016 | -The federation provider configuration is empty | -Go to [http://clientconfig.microsoftonline-p.net/FPURL.xml](http://clientconfig.microsoftonline-p.net/FPURL.xml) and verify that the file is not empty. | -
| 0x801C0017 | -The federation provider domain is empty | -Go to [http://clientconfig.microsoftonline-p.net/FPURL.xml](http://clientconfig.microsoftonline-p.net/FPURL.xml) and verify that the FPDOMAINNAME element is not empty. | -
| 0x801C0018 | -The federation provider client configuration URL is empty | -Go to [http://clientconfig.microsoftonline-p.net/FPURL.xml](http://clientconfig.microsoftonline-p.net/FPURL.xml) and verify that the CLIENTCONFIG element contains a valid URL. | -
| 0x801C03E9 | -Server response message is invalid | -Sign out and then sign in again. | -
| 0x801C03EA | -Server failed to authorize user or device. | -Check if the token is valid and user has permission to register Passport keys. | -
| 0x801C03EB | -Server response http status is not valid | -Sign out and then sign in again. | -
| 0x801C03EC | -Unhandled exception from server. | -sign out and then sign in again. | -
| 0x801C03ED | -Multi-factor authentication is required for a 'ProvisionKey' operation, but was not performed --or- -Token was not found in the Authorization header --or- -Failed to read one or more objects --or- The request sent to the server was invalid. |
-Sign out and then sign in again. If that doesn't resolve the issue, unjoin the device from Azure Active Directory (Azure AD) and rejoin. | -
| 0x801C03EE | -Attestation failed | -Sign out and then sign in again. | -
| 0x801C03EF | -The AIK certificate is no longer valid | -Sign out and then sign in again. | -
| 0x801C044D | -Unable to obtain user token | -Sign out and then sign in again. Check network and credentials. | -
| 0x801C044E | -Failed to receive user creds input | -Sign out and then sign in again. | -
| Microsoft Passport method | -Azure AD | -Hybrid Active Directory | -
|---|---|---|
| Key-based | -Azure AD subscription |
-
|
-
| Certificate-based | -Azure AD subscription -PKI infrastructure -Intune |
-
|
-
For more information about patches (software updates) related to Restricted Admin mode, see [Microsoft Security Advisory 2871997](https://technet.microsoft.com/library/security/2871997.aspx). | diff --git a/windows/keep-secure/requirements-and-deployment-planning-guidelines-for-device-guard.md b/windows/keep-secure/requirements-and-deployment-planning-guidelines-for-device-guard.md index fad266b5ee..49742f17e8 100644 --- a/windows/keep-secure/requirements-and-deployment-planning-guidelines-for-device-guard.md +++ b/windows/keep-secure/requirements-and-deployment-planning-guidelines-for-device-guard.md @@ -42,19 +42,19 @@ You can deploy Device Guard in phases, and plan these phases in relation to the The following tables provide more information about the hardware, firmware, and software required for deployment of various Device Guard features. The tables describe baseline protections, plus protections for improved security that are associated with hardware and firmware options available in 2015, available in 2016, and announced as options for 2017. > **Notes** -> - To understand the requirements in the following tables, you will need to be familiar with the main features in Device Guard: configurable code integrity policies, virtualization-based security (VBS), and Universal Extensible Firmware Interface (UEFI) Secure Boot. For information about these features, see [How Device Guard features help protect against threats](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md#how-device-guard-features-help-protect-against-threats). -> - For new computers running Windows 10, Trusted Platform Module (TPM 2.0) must be enabled by default. This requirement is not restated in the tables that follow. +> • To understand the requirements in the following tables, you will need to be familiar with the main features in Device Guard: configurable code integrity policies, virtualization-based security (VBS), and Universal Extensible Firmware Interface (UEFI) Secure Boot. For information about these features, see [How Device Guard features help protect against threats](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md#how-device-guard-features-help-protect-against-threats).
+> • Beginning with Windows 10, version 1607, Trusted Platform Module (TPM 2.0) must be enabled by default on new computers. ## Device Guard requirements for baseline protections |Baseline Protections - requirement | Description | |---------------------------------------------|----------------------------------------------------| | Hardware: **64-bit CPU** | A 64-bit computer is required for the Windows hypervisor to provide VBS. | -| Hardware: **CPU virtualization extensions**,
plus **extended page tables** | **Requirements**: These hardware features are required for VBS:
One of the following virtualization extensions:
- VT-x (Intel) or
- AMD-V
And:
- Extended page tables, also called Second Level Address Translation (SLAT).
**Security benefits**: VBS provides isolation of secure kernel from normal operating system. Vulnerabilities and Day 0s in normal operating system cannot be exploited because of this isolation. | +| Hardware: **CPU virtualization extensions**,
plus **extended page tables** | **Requirements**: These hardware features are required for VBS:
One of the following virtualization extensions:
• VT-x (Intel) or
• AMD-V
And:
• Extended page tables, also called Second Level Address Translation (SLAT).
**Security benefits**: VBS provides isolation of the secure kernel from the normal operating system. Vulnerabilities and zero-days in the normal operating system cannot be exploited because of this isolation. | | Firmware: **UEFI firmware version 2.3.1.c or higher with UEFI Secure Boot** | **Requirements**: See the following Windows Hardware Compatibility Program requirement: [System.Fundamentals.Firmware.UEFISecureBoot](http://msdn.microsoft.com/library/windows/hardware/dn932805.aspx#system-fundamentals-firmware-uefisecureboot)
**Security benefits**: UEFI Secure Boot helps ensure that the device boots only authorized code. This can prevent boot kits and root kits from installing and persisting across reboots. | | Firmware: **Secure firmware update process** | **Requirements**: UEFI firmware must support secure firmware update found under the following Windows Hardware Compatibility Program requirement: [System.Fundamentals.Firmware.UEFISecureBoot](http://msdn.microsoft.com/library/windows/hardware/dn932805.aspx#system-fundamentals-firmware-uefisecureboot).
**Security benefits**: UEFI firmware just like software can have security vulnerabilities that, when found, need to be patched through firmware updates. Patching helps prevent root kits from getting installed. | | Software: **HVCI compatible drivers** | **Requirements**: See the Windows Hardware Compatibility Program requirements under [Filter.Driver.DeviceGuard.DriverCompatibility](https://msdn.microsoft.com/library/windows/hardware/mt589732(v=vs.85).aspx).
**Security benefits**: [HVCI Compatible](https://blogs.msdn.microsoft.com/windows_hardware_certification/2015/05/22/driver-compatibility-with-device-guard-in-windows-10/) drivers help ensure that VBS can maintain appropriate memory permissions. This increases resistance to bypassing vulnerable kernel drivers and helps ensure that malware cannot run in kernel. Only code verified through code integrity can run in kernel mode. | -| Software: Qualified **Windows operating system** | **Requirement**: Windows 10 Enterprise, Windows 10 Education, Windows 2016 Server, or Windows Enterprise IoT
Important:
Windows Server 2016 running as a domain controller does not support Credential Guard. Only Device Guard is supported in this configuration.
**Security benefits**: Support for VBS and for management features that simplify configuration of Device Guard. | +| Software: Qualified **Windows operating system** | **Requirement**: Windows 10 Enterprise, Windows 10 Education, Windows Server 2016, or Windows 10 IoT Enterprise
Important:
Windows Server 2016 running as a domain controller does not support Credential Guard. Only Device Guard is supported in this configuration.
**Security benefits**: Support for VBS and for management features that simplify configuration of Device Guard. | > **Important** The preceding table lists requirements for baseline protections. The following tables list requirements for improved security. You can use Device Guard with hardware, firmware, and software that support baseline protections, even if they do not support protections for improved security. However, we strongly recommend meeting the requirements for improved security, to significantly strengthen the level of security that Device Guard can provide. @@ -62,32 +62,34 @@ The following tables provide more information about the hardware, firmware, and The following tables describes additional hardware and firmware requirements, and the improved security that is available when those requirements are met. -### 2015 Additional Qualification Requirements for Device Guard (starting with Windows 10, version 1507, and Windows Server 2016, Technical Preview 4) +### Additional Qualification Requirements starting with Windows 10, version 1507, and Windows Server 2016, Technical Preview 4 | Protections for Improved Security - requirement | Description | |---------------------------------------------|----------------------------------------------------| -| Firmware: **Securing Boot Configuration and Management** | **Requirements**:
- BIOS password or stronger authentication must be supported.
- In the BIOS configuration, BIOS authentication must be set.
- There must be support for protected BIOS option to configure list of permitted boot devices (for example, “Boot only from internal hard drive”) and boot device order, overriding BOOTORDER modification made by operating system.
- In the BIOS configuration, BIOS options related to security and boot options (list of permitted boot devices, boot order) must be secured to prevent other operating systems from starting and to prevent changes to the BIOS settings.
**Security benefits**:
- BIOS password or stronger authentication helps ensure that only authenticated Platform BIOS administrators can change BIOS settings. This helps protect against a physically present user with BIOS access.
- Boot order when locked provides protection against the computer being booted into WinRE or another operating system on bootable media. | +| Firmware: **Securing Boot Configuration and Management** | **Requirements**:
• BIOS password or stronger authentication must be supported.
• In the BIOS configuration, BIOS authentication must be set.
• There must be support for protected BIOS option to configure list of permitted boot devices (for example, “Boot only from internal hard drive”) and boot device order, overriding BOOTORDER modification made by operating system.
• In the BIOS configuration, BIOS options related to security and boot options (list of permitted boot devices, boot order) must be secured to prevent other operating systems from starting and to prevent changes to the BIOS settings.
**Security benefits**:
• BIOS password or stronger authentication helps ensure that only authenticated Platform BIOS administrators can change BIOS settings. This helps protect against a physically present user with BIOS access.
• Boot order when locked provides protection against the computer being booted into WinRE or another operating system on bootable media. |
-### 2016 Additional Qualification Requirements for Device Guard (starting with Windows 10, version 1607, and Windows Server 2016) +### Additional Qualification Requirements starting with Windows 10, version 1607, and Windows Server 2016 > **Important** The following tables list requirements for improved security, beyond the level of protection described in the preceding tables. You can use Device Guard with hardware, firmware, and software that do not support the following protections for improved security. As your systems meet more requirements, more protections become available to them. | Protections for Improved Security - requirement | Description | |---------------------------------------------|----------------------------------------------------| -| Firmware: **Hardware Rooted Trust Platform Secure Boot** | **Requirements**:
Boot Integrity (Platform Secure Boot) must be supported. See the Windows Hardware Compatibility Program requirements under [System.Fundamentals.Firmware.CS.UEFISecureBoot.ConnectedStandby](https://msdn.microsoft.com/library/windows/hardware/dn932807(v=vs.85).aspx#system_fundamentals_firmware_cs_uefisecureboot_connectedstandby)
- The Hardware Security Test Interface (HSTI) must be implemented. See [Hardware Security Testability Specification](https://msdn.microsoft.com/en-us/library/windows/hardware/mt712332(v=vs.85).aspx).
**Security benefits**:
- Boot Integrity (Platform Secure Boot) from Power-On provides protections against physically present attackers, and defense-in-depth against malware.
- HSTI provides additional security assurance for correctly secured silicon and platform. | +| Firmware: **Hardware Rooted Trust Platform Secure Boot** | **Requirements**:
Boot Integrity (Platform Secure Boot) must be supported. See the Windows Hardware Compatibility Program requirements under [System.Fundamentals.Firmware.CS.UEFISecureBoot.ConnectedStandby](https://msdn.microsoft.com/library/windows/hardware/dn932807(v=vs.85).aspx#system_fundamentals_firmware_cs_uefisecureboot_connectedstandby)
• The Hardware Security Test Interface (HSTI) 1.1.a must be implemented. See [Hardware Security Testability Specification](https://msdn.microsoft.com/en-us/library/windows/hardware/mt712332.aspx).
**Security benefits**:
• Boot Integrity (Platform Secure Boot) from Power-On provides protections against physically present attackers, and defense-in-depth against malware.
• HSTI 1.1.a provides additional security assurance for correctly secured silicon and platform. | | Firmware: **Firmware Update through Windows Update** | **Requirements**: Firmware must support field updates through Windows Update and UEFI encapsulation update.
**Security benefits**: Helps ensure that firmware updates are fast, secure, and reliable. | -| Firmware: **Securing Boot Configuration and Management** | **Requirements**:
- Required BIOS capabilities: Ability of OEM to add ISV, OEM, or Enterprise Certificate in Secure Boot DB at manufacturing time.
- Required configurations: Microsoft UEFI CA must be removed from Secure Boot DB. Support for 3rd-party UEFI modules is permitted but should leverage ISV-provided certificates or OEM certificate for the specific UEFI software.
**Security benefits**:
- Enterprises can choose to allow proprietary EFI drivers/applications to run.
- Removing Microsoft UEFI CA from Secure Boot DB provides full control to enterprises over software that runs before the operating system boots. | +| Firmware: **Securing Boot Configuration and Management** | **Requirements**:
• Required BIOS capabilities: Ability of OEM to add ISV, OEM, or Enterprise Certificate in Secure Boot DB at manufacturing time.
• Required configurations: Microsoft UEFI CA must be removed from Secure Boot DB. Support for 3rd-party UEFI modules is permitted but should leverage ISV-provided certificates or OEM certificate for the specific UEFI software.
**Security benefits**:
• Enterprises can choose to allow proprietary EFI drivers/applications to run.
• Removing Microsoft UEFI CA from Secure Boot DB provides full control to enterprises over software that runs before the operating system boots. |
-### 2017 Additional Qualification Requirements for Device Guard (announced as options for future Windows operating systems for 2017) +### Additional Qualification Requirements starting with Windows 10, version 1703 -| Protections for Improved Security - requirement | Description | +The following table lists requirements for Windows 10, version 1703, which are in addition to all preceding requirements. + +| Protection for Improved Security | Description | |---------------------------------------------|----------------------------------------------------| -| Firmware: **UEFI NX Protections** | **Requirements**:
- All UEFI memory that is marked executable must be read only. Memory marked writable must not be executable.
UEFI Runtime Services:
- Must implement the UEFI 2.6 EFI_MEMORY_ATTRIBUTES_TABLE. The entire UEFI runtime must be described by this table.
- All entries must include attributes EFI_MEMORY_RO, EFI_MEMORY_XP, or both.
- No entries may be left with neither of the above attributes, indicating memory that is both executable and writable. Memory MUST be either readable and executable OR writeable and non-executable.
**Security benefits**:
- Protects against potential vulnerabilities in UEFI runtime in functions such as Update Capsule, Set Variables, and so on, so they can't compromise VBS.
- Reduces attack surface to VBS from system firmware. | -| Firmware: **Firmware support for SMM protection** | **Requirements**: The [Windows SMM Security Mitigations Table (WSMT) specification](http://download.microsoft.com/download/1/8/A/18A21244-EB67-4538-BAA2-1A54E0E490B6/WSMT.docx) contains details of an Advanced Configuration and Power Interface (ACPI) table that was created for use with Windows operating systems that support Windows virtualization-based security (VBS) features.
**Security benefits**:
- Protects against potential vulnerabilities in UEFI runtime in functions such as Update Capsule, Set Variables, and so on, so they can't compromise VBS.
- Reduces attack surface to VBS from system firmware.
- Blocks additional security attacks against SMM. | +| Firmware: **VBS enablement of NX protection for UEFI runtime services** | **Requirements**:
• VBS will enable No-Execute (NX) protection on UEFI runtime service code and data memory regions. UEFI runtime service code must support read-only page protections, and UEFI runtime service data must not be exceutable.
• UEFI runtime service must meet these requirements:
• Implement UEFI 2.6 EFI_MEMORY_ATTRIBUTES_TABLE. All UEFI runtime service memory (code and data) must be described by this table.
• PE sections need to be page-aligned in memory (not required for in non-volitile storage).
• The Memory Attributes Table needs to correctly mark code and data as RO/NX for configuration by the OS:
• All entries must include attributes EFI_MEMORY_RO, EFI_MEMORY_XP, or both
• No entries may be left with neither of the above attributes, indicating memory that is both exceutable and writable. Memory must be either readable and executable or writeable and non-executable.
Notes:
• This only applies to UEFI runtime service memory, and not UEFI boot service memory.
• This protection is applied by VBS on OS page tables.
Please also note the following:
• Do not use sections that are both writeable and exceutable
• Do not attempt to directly modify executable system memory
• Do not use dynamic code
**Security benefits**:
• Vulnerabilities in UEFI runtime, if any, will be blocked from compromising VBS (such as in functions like UpdateCapsule and SetVariable)
• Reduces the attack surface to VBS from system firmware. | +| Firmware: **Firmware support for SMM protection** | **Requirements**: The [Windows SMM Security Mitigations Table (WSMT) specification](http://download.microsoft.com/download/1/8/A/18A21244-EB67-4538-BAA2-1A54E0E490B6/WSMT.docx) contains details of an Advanced Configuration and Power Interface (ACPI) table that was created for use with Windows operating systems that support Windows virtualization-based security (VBS) features.
**Security benefits**:
• Protects against potential vulnerabilities in UEFI runtime services, if any, will be blocked from compromising VBS (such as in functions like UpdateCapsule and SetVariable)
• Reduces the attack surface to VBS from system firmware.
• Blocks additional security attacks against SMM. | ## Device Guard deployment in different scenarios: types of devices @@ -95,9 +97,9 @@ Typically, deployment of Device Guard happens best in phases, rather than being | **Type of device** | **How Device Guard relates to this type of device** | **Device Guard components that you can use to protect this kind of device** | |------------------------------------|------------------------------------------------------|--------------------------------------------------------------------------------| -| **Fixed-workload devices**: Perform same tasks every day.
Lists of approved applications rarely change.
Examples: kiosks, point-of-sale systems, call center computers. | Device Guard can be deployed fully, and deployment and ongoing administration are relatively straightforward.
After Device Guard deployment, only approved applications can run. This is because of protections offered by the Hypervisor Code Integrity (HVCI) service. | - VBS (hardware-based) protections, enabled.
- Code integrity policies in enforced mode, with UMCI enabled. | -| **Fully managed devices**: Allowed software is restricted by IT department.
Users can request additional software, or install from a list of applications provided by IT department.
Examples: locked-down, company-owned desktops and laptops. | An initial baseline code integrity policy can be established and enforced. Whenever the IT department approves additional applications, it will update the code integrity policy and (for unsigned LOB applications) the catalog.
Code integrity policies are supported by the HVCI service. | - VBS (hardware-based) protections, enabled.
- Code integrity policies in enforced mode, with UMCI enabled. | -| **Lightly managed devices**: Company-owned, but users are free to install software.
Devices are required to run organization's antivirus solution and client management tools. | Device Guard can be used to help protect the kernel, and to monitor (audit) for problem applications rather than limiting the applications that can be run. | - VBS (hardware-based) protections, enabled. When enabled with a code integrity policy in audit mode only, VBS means the hypervisor helps enforce the default kernel-mode code integrity policy, which protects against unsigned drivers or system files.
- Code integrity policies, with UMCI enabled, but running in audit mode only. This means applications are not blocked—the policy just logs an event whenever an application outside the policy is started. | +| **Fixed-workload devices**: Perform same tasks every day.
Lists of approved applications rarely change.
Examples: kiosks, point-of-sale systems, call center computers. | Device Guard can be deployed fully, and deployment and ongoing administration are relatively straightforward.
After Device Guard deployment, only approved applications can run. This is because of protections offered by the Hypervisor Code Integrity (HVCI) service. | - VBS (hardware-based) protections, enabled.
• Code integrity policies in enforced mode, with UMCI enabled. | +| **Fully managed devices**: Allowed software is restricted by IT department.
Users can request additional software, or install from a list of applications provided by IT department.
Examples: locked-down, company-owned desktops and laptops. | An initial baseline code integrity policy can be established and enforced. Whenever the IT department approves additional applications, it will update the code integrity policy and (for unsigned LOB applications) the catalog.
Code integrity policies are supported by the HVCI service. | - VBS (hardware-based) protections, enabled.
• Code integrity policies in enforced mode, with UMCI enabled. | +| **Lightly managed devices**: Company-owned, but users are free to install software.
Devices are required to run organization's antivirus solution and client management tools. | Device Guard can be used to help protect the kernel, and to monitor (audit) for problem applications rather than limiting the applications that can be run. | - VBS (hardware-based) protections, enabled. When enabled with a code integrity policy in audit mode only, VBS means the hypervisor helps enforce the default kernel-mode code integrity policy, which protects against unsigned drivers or system files.
• Code integrity policies, with UMCI enabled, but running in audit mode only. This means applications are not blocked—the policy just logs an event whenever an application outside the policy is started. | | **Bring Your Own Device**: Employees are allowed to bring their own devices, and also use those devices away from work. | Device Guard does not apply. Instead, you can explore other hardening and security features with MDM-based conditional access solutions, such as Microsoft Intune. | N/A | ## Device Guard deployment in virtual machines diff --git a/windows/keep-secure/tpm-fundamentals.md b/windows/keep-secure/tpm-fundamentals.md index efb080c89c..044bb0c1be 100644 --- a/windows/keep-secure/tpm-fundamentals.md +++ b/windows/keep-secure/tpm-fundamentals.md @@ -67,11 +67,7 @@ The TPM can be used to protect certificates and RSA keys. The TPM key storage pr ## TPM Cmdlets -If you are using PowerShell to script and manage your computers, you can now manage the TPM using Windows PowerShell as well. To install the TPM cmdlets use the following command: - -`dism /online /enable-feature /FeatureName:tpm-psh-cmdlets` - -For details about the individual cmdlets, see [TPM Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/jj603116.aspx). +You can manage the TPM using Windows PowerShell. For details, see [TPM Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/jj603116.aspx). ## Physical presence interface diff --git a/windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md index 4cb0a35b53..088a82e8d9 100644 --- a/windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md @@ -26,40 +26,15 @@ This section addresses issues that might arise as you use the Windows Defender A If you encounter a server error when trying to access the service, you’ll need to change your browser cookie settings. Configure your browser to allow cookies. -### No data is shown on the portal -If no data is displayed on the Dashboard portal even if no errors were encountered in the portal logs or in the browser console, you'll need to whitelist the threat intelligence, data access, and detonation endpoints that also use this protocol. +### Elements or data missing on the portal +If some UI elements or data is missing on the Windows Defender ATP portal it’s possible that proxy settings are blocking it. + +Make sure that `*.securitycenter.windows.com` is included the proxy whitelist. + > [!NOTE] > You must use the HTTPS protocol when adding the following endpoints. -Depending on your region, add the following endpoints to the whitelist: - -U.S. region: - -- daasmon-cus-prd.cloudapp.net -- daasmon-eus-prd.cloudapp.net -- dataaccess-cus-prd.cloudapp.net -- dataaccess-eus-prd.cloudapp.net -- threatintel-cus-prd.cloudapp.net -- threatintel-eus-prd.cloudapp.net -- winatpauthorization.windows.com -- winatpfeedback.windows.com -- winatpmanagement.windows.com -- winatponboarding.windows.com -- winatpservicehealth.windows.com - -EU region: - -- dataaccess-neu-prd.cloudapp.net -- dataaccess-weu-prd.cloudapp.net -- threatintel-neu-prd.cloudapp.net -- threatintel-weu-prd.cloudapp.net -- winatpauthorization.windows.com -- winatpfeedback.windows.com -- winatpmanagement.windows.com -- winatponboarding.windows.com -- winatpservicehealth.windows.com - ### Windows Defender ATP service shows event or error logs in the Event Viewer See the topic [Review events and errors on endpoints with Event Viewer](event-error-codes-windows-defender-advanced-threat-protection.md) for a list of event IDs that are reported by the Windows Defender ATP service. The topic also contains troubleshooting steps for event errors. diff --git a/windows/keep-secure/troubleshoot-windows-defender-in-windows-10.md b/windows/keep-secure/troubleshoot-windows-defender-in-windows-10.md index ac8772f7b7..3730d58e83 100644 --- a/windows/keep-secure/troubleshoot-windows-defender-in-windows-10.md +++ b/windows/keep-secure/troubleshoot-windows-defender-in-windows-10.md @@ -2222,7 +2222,20 @@ Description of the error.
The support for your operating system has expired. Windows Defender is no longer supported on your operating system, has stopped functioning, and is not protecting against malware threats.
Symbolic name:
MALWAREPROTECTION_SAMPLESUBMISSION_UPLOADED
Message:
The antimalware engine has uploaded a file for further analysis.
Filename <uploaded filename>
Sha256: <file SHA>
Description:
A file was uploaded to the Windows Defender Antimalware cloud for further analysis or processing.
Symbolic name:
MALWAREPROTECTION_SAMPLESUBMISSION_UPLOAD
Message:
The antimalware engine has uploaded a file for further analysis.
Filename <uploaded filename>
Sha256: <file SHA>
Description:
A file was uploaded to the Windows Defender Antimalware cloud for further analysis or processing.
Symbolic name:
MALWAREPROTECTION_SAMPLESUBMISSION_UPLOADED_FAILED
Message:
The antimalware engine has encountered an error trying to upload a suspicious file for further analysis.
+Filename: <uploaded filename>
+Sha256: <file SHA>
+Current Signature Version: <signature version number>
+Current Engine Version: <engine version number>
+Error code: <error code>
Description:
A file could not be uploaded to the Windows Defender Antimalware cloud.
User action:
You can attempt to manually submit the file.
- Create a domain (such as mail.contoso.com, redirecting to outlook.office.com) that can be used by your employees to access work email.
- Add the new domain to the Enterprise Cloud Resources network element in your WIP policy.
- Add the following URLs to the Neutral Resources network element in your WIP policy:
- outlook.office365.com
- outlook.office.com
- outlook-sdf.office.com
- attachment.outlook.office.net
[Control the health of Windows 10-based devices](protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md)
This article details an end-to-end solution that helps you protect high-value assets by enforcing, controlling, and reporting the health of Windows 10-based devices.
[Microsoft Passport guide](microsoft-passport-guide.md)
This guide describes the new Windows Hello and Microsoft Passport technologies that are part of the Windows 10 operating system. It highlights specific capabilities of these technologies that help mitigate threats from conventional credentials and provides guidance about how to design and deploy these technologies as part of your Windows 10 rollout.
[Windows 10 Mobile security guide](windows-10-mobile-security-guide.md)
This guide provides a detailed description of the most important security features in the Windows 10 Mobile operating system—identity access and control, data protection, malware resistance, and app platform security.
For more info about the available Group Policies and MDM CSPs, see the [Implement Windows Hello for Business in your organization](implement-microsoft-passport-in-your-organization.md) topic. - -## Where is Microsoft Hello data stored? -The biometric data used to support Windows Hello is stored on the local device only. It doesn’t roam and is never sent to external devices or servers. This separation helps to stop potential attackers by providing no single collection point that an attacker could potentially compromise to steal biometric data. Additionally, even if an attacker was actually able to get the biometric data, it still can’t be easily converted to a form that could be recognized by the biometric sensor. - -## Has Microsoft set any device requirements for Windows Hello? -We’ve been working with the device manufacturers to help ensure a high-level of performance and protection is met by each sensor and device, based on these requirements: - -- **False Accept Rate (FAR).** Represents the instance a biometric identification solution verifies an unauthorized person. This is normally represented as a ratio of number of instances in a given population size, for example 1 in 100 000. This can also be represented as a percentage of occurrence, for example, 0.001%. This measurement is heavily considered the most important with regards to the security of the biometric algorithm. - -- **False Reject Rate (FRR).** Represents the instances a biometric identification solution fails to verify an authorized person correctly. Usually represented as a percentage, the sum of the True Accept Rate and False Reject Rate is 1. Can be with or without anti-spoofing or liveness detection. - -### Fingerprint sensor requirements -To allow fingerprint matching, you must have devices with fingerprint sensors and software. Fingerprint sensors, or sensors that use an employee’s unique fingerprint as an alternative log on option, can be touch sensors (large area or small area) or swipe sensors. Each type of sensor has its own set of detailed requirements that must be implemented by the manufacturer, but all of the sensors must include anti-spoofing measures (required) and a way to configure them (optional). - -**Acceptable performance range for small to large size touch sensors** - -- False Accept Rate (FAR): <0.001 – 0.002% - -- False Reject Rate (FRR) without Anti-spoofing or liveness detection: <5% - -- Effective, real world FRR with Anti-spoofing or liveness detection: <10% - -**Acceptable performance range for swipe sensors** - -- False Accept Rate (FAR): <0.002% - -- False Reject Rate (FRR) without Anti-spoofing or liveness detection: <5% - -- Effective, real world FRR with Anti-spoofing or liveness detection: <10% - -### Facial recognition sensors -To allow facial recognition, you must have devices with integrated special infrared (IR) sensors and software. Facial recognition sensors use special cameras that see in IR light, letting them tell the difference between a photo and a living person while scanning an employee’s facial features. These sensors, like the fingerprint sensors, must also include anti-spoofing measures (required) and a way to configure them (optional). - -- False Accept Rate (FAR): <0.001 - -- False Reject Rate (FRR) without Anti-spoofing or liveness detection: <5% - -- Effective, real world FRR with Anti-spoofing or liveness detection: <10% - -## Related topics -- [Manage identity verification using Windows Hello for Business](manage-identity-verification-using-microsoft-passport.md) -- [Implement Windows Hello for Business in your organization](implement-microsoft-passport-in-your-organization.md) -- [Microsoft Passport guide](microsoft-passport-guide.md) -- [Prepare people to use Windows Hello for Work](prepare-people-to-use-microsoft-passport.md) -- [PassportforWork CSP](https://go.microsoft.com/fwlink/p/?LinkId=708219) - - - - - - - - - diff --git a/windows/manage/TOC.md b/windows/manage/TOC.md index d68415cde7..70f2e9290f 100644 --- a/windows/manage/TOC.md +++ b/windows/manage/TOC.md @@ -20,6 +20,9 @@ ### [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md) ### [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) ### [Assign devices to servicing branches for Windows 10 updates](waas-servicing-branches-windows-10-updates.md) +### [Monitor Windows Updates with Update Compliance](update-compliance-monitor.md) +#### [Get started with Update Compliance](update-compliance-get-started.md) +#### [Use Update Compliance](update-compliance-using.md) ### [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) #### [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md) #### [Configure BranchCache for Windows 10 updates](waas-branchcache.md) @@ -159,6 +162,7 @@ ### [Troubleshooting App-V](appv-troubleshooting.md) ### [Technical Reference for App-V](appv-technical-reference.md) #### [Performance Guidance for Application Virtualization](appv-performance-guidance.md) + #### [Application Publishing and Client Interaction](appv-application-publishing-and-client-interaction.md) #### [Viewing App-V Server Publishing Metadata](appv-viewing-appv-server-publishing-metadata.md) #### [Running a Locally Installed Application Inside a Virtual Environment with Virtualized Applications](appv-running-locally-installed-applications-inside-a-virtual-environment.md) @@ -218,4 +222,5 @@ #### [Update Windows Store for Business account settings](update-windows-store-for-business-account-settings.md) #### [Manage user accounts in Windows Store for Business](manage-users-and-groups-windows-store-for-business.md) ### [Troubleshoot Windows Store for Business](troubleshoot-windows-store-for-business.md) +## [Windows Libraries](windows-libraries.md) ## [Change history for Manage and update Windows 10](change-history-for-manage-and-update-windows-10.md) diff --git a/windows/manage/change-history-for-manage-and-update-windows-10.md b/windows/manage/change-history-for-manage-and-update-windows-10.md index c9e8313b65..13a0de7e4f 100644 --- a/windows/manage/change-history-for-manage-and-update-windows-10.md +++ b/windows/manage/change-history-for-manage-and-update-windows-10.md @@ -14,6 +14,18 @@ This topic lists new and updated topics in the [Manage and update Windows 10](in >If you're looking for **update history** for Windows 10, see [Windows 10 and Windows Server 2016 update history](https://support.microsoft.com/help/12387/windows-10-update-history). +## February 2017 + +| New or changed topic | Description | +| --- | --- | +| [Windows Libraries](windows-libraries.md) | New | +| [Monitor Windows Updates with Update Compliance](update-compliance-monitor.md) | New | +| [Get started with Update Compliance](update-compliance-get-started.md) | New | +| [Use Update Compliance to monitor Windows Updates](update-compliance-using.md) | New | +| [Assign devices to servicing branches for Windows 10 updates](waas-servicing-branches-windows-10-updates.md) | Added Group Policy setting that blocks user access to Windows Update. | +| [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) | Added Express updates. | +| [Distribute offline apps](distribute-offline-apps.md) | General updates to topic. Added links to supporting content for System Center Configuration Manager and Microsoft Intune. | + ## January 2017 | New or changed topic | Description | @@ -22,8 +34,7 @@ This topic lists new and updated topics in the [Manage and update Windows 10](in | [Start layout XML for desktop editions of Windows 10](start-layout-xml-desktop.md) | New (previously published in Hardware Dev Center on MSDN) | | [Start layout XML for mobile editions of Windows 10](start-layout-xml-mobile.md) | New (previously published in Hardware Dev Center on MSDN) | | [Quick guide to Windows as a service](waas-quick-start.md) | Added video that explains how Windows as a service works. | - - +| [Manage device restarts after updates](waas-restart.md) | Added Registry keys for controlling restarts. | ## December 2016 @@ -70,7 +81,7 @@ This topic lists new and updated topics in the [Manage and update Windows 10](in | [Configure Windows 10 taskbar](configure-windows-10-taskbar.md) | Updated sample XML for combined Start and taskbar layout; added note to explain the difference between applying taskbar configuration by Group Policy and by provisioning package | | [Set up a kiosk on Windows 10 Pro, Enterprise, or Education](set-up-a-kiosk-for-windows-10-for-desktop-editions.md) | Updated instructions for exiting assigned access mode. | | Application development for Windows as a service | Topic moved to MSDN: [Application development for Windows as a service](https://msdn.microsoft.com/windows/uwp/get-started/application-development-for-windows-as-a-service) -| Windows 10 servicing options | New content replaced this topic; see [Overview of Windows as a service](https://technet.microsoft.com/en-us/itpro/windows/manage/waas-overview) | +| Windows 10 servicing options | New content replaced this topic; see [Overview of Windows as a service](waas-overview.md) | ## RELEASE: Windows 10, version 1607 @@ -175,4 +186,4 @@ The topics in this library have been updated for Windows 10, version 1607 (also [Change history for Keep Windows 10 secure](../keep-secure/change-history-for-keep-windows-10-secure.md) - \ No newline at end of file + diff --git a/windows/manage/configure-windows-10-taskbar.md b/windows/manage/configure-windows-10-taskbar.md index bd5e26f4ba..dd1108511b 100644 --- a/windows/manage/configure-windows-10-taskbar.md +++ b/windows/manage/configure-windows-10-taskbar.md @@ -42,6 +42,8 @@ To configure the taskbar: >[!IMPORTANT] >If you use a provisioning package to configure the taskbar, your configuration will be reapplied each time the explorer.exe process restarts. If your configuration pins an app and the user then unpins that app, the user's change will be overwritten the next time the configuration is applied. To apply a taskbar configuration that allows users to make changes that will persist, apply your configuration by using Group Policy. +> +>If you use Group Policy and your configuration only contains a taskbar layout, the default Windows tile layout will be applied and cannot be changed by users. If you use Group Policy and your configuration includes taskbar and a full Start layout, users can only make changes to the taskbar. If you use Group Policy and your configuration includes taskbar and a [partial Start layout](https://technet.microsoft.com/itpro/windows/manage/customize-and-export-start-layout#configure-a-partial-start-layout), users can make changes to the taskbar and to tile groups not defined in the partial Start layout. ### Tips for finding AUMID and Desktop Application Link Path diff --git a/windows/manage/cortana-at-work-o365.md b/windows/manage/cortana-at-work-o365.md index d58663dc00..764b5638e0 100644 --- a/windows/manage/cortana-at-work-o365.md +++ b/windows/manage/cortana-at-work-o365.md @@ -57,7 +57,7 @@ Cortana can only access data in your Office 365 org when it’s turned on. If yo **To turn off Cortana with Office 365** 1. [Sign in to Office 365](http://www.office.com/signin) using your Azure AD account. -2. Go to the [Office 365 admin center](https://support.office.com/en-us/article/Office-365-admin-center-58537702-d421-4d02-8141-e128e3703547). +2. Go to the [Office 365 admin center](https://support.office.com/article/Office-365-admin-center-58537702-d421-4d02-8141-e128e3703547). 3. Expand **Service Settings**, and select **Cortana**. diff --git a/windows/manage/cortana-at-work-overview.md b/windows/manage/cortana-at-work-overview.md index 96064364c3..29a9ab3bba 100644 --- a/windows/manage/cortana-at-work-overview.md +++ b/windows/manage/cortana-at-work-overview.md @@ -59,6 +59,6 @@ Cortana is covered under the [Microsoft Privacy Statement](https://privacy.micro - [Cortana and Windows](http://go.microsoft.com/fwlink/?LinkId=717384) -- [Known issues for Windows Desktop Search and Cortana in Windows 10](http://support.microsoft.com/kb/3206883/EN-US) +- [Known issues for Windows Desktop Search and Cortana in Windows 10](https://support.microsoft.com/help/3206883/known-issues-for-windows-desktop-search-and-cortana-in-windows-10) - [Cortana for developers](http://go.microsoft.com/fwlink/?LinkId=717385) diff --git a/windows/manage/cortana-at-work-powerbi.md b/windows/manage/cortana-at-work-powerbi.md index 98b90f572f..979cde3b57 100644 --- a/windows/manage/cortana-at-work-powerbi.md +++ b/windows/manage/cortana-at-work-powerbi.md @@ -19,7 +19,7 @@ localizationpriority: high Integration between Cortana and Power BI shows how Cortana can work with custom business analytics solutions to enable you to get answers directly from your key business data, including introducing new features that let you create custom Cortana “answers” using the full capabilities of Power BI Desktop. >[!Note] ->Cortana for Power BI is currently only available in English. For more info about Cortana and Power BI, see [Use Power BI to create a custom Answer Page for Cortana](https://powerbi.microsoft.com/en-us/documentation/powerbi-service-cortana-desktop-entity-cards/). +>Cortana for Power BI is currently only available in English. For more info about Cortana and Power BI, see [Use Power BI to create a custom Answer Page for Cortana](https://powerbi.microsoft.com/documentation/powerbi-service-cortana-desktop-entity-cards/). ## Before you begin To use this walkthrough, you’ll need: @@ -135,4 +135,4 @@ Now that you’ve set up your device, you can use Cortana to show your info from  >[!NOTE] ->For more info about how to connect your own data, build your own custom Power BI cards and Answer Pages for Cortana, and how to share the cards with everyone in your organization, see [Use Power BI to create a custom Answer Page for Cortana](https://powerbi.microsoft.com/en-us/documentation/powerbi-service-cortana-desktop-entity-cards/). +>For more info about how to connect your own data, build your own custom Power BI cards and Answer Pages for Cortana, and how to share the cards with everyone in your organization, see [Use Power BI to create a custom Answer Page for Cortana](https://powerbi.microsoft.com/documentation/powerbi-service-cortana-desktop-entity-cards/). diff --git a/windows/manage/cortana-at-work-voice-commands.md b/windows/manage/cortana-at-work-voice-commands.md index 766a5914ad..2e2743fa61 100644 --- a/windows/manage/cortana-at-work-voice-commands.md +++ b/windows/manage/cortana-at-work-voice-commands.md @@ -19,7 +19,7 @@ localizationpriority: high Working with a developer, you can create voice commands that use Cortana to perform voice-enabled actions in your line-of-business (LOB) Universal Windows Platform (UWP) apps. These voice-enabled actions can reduce the time necessary to access your apps and to complete simple actions. >[!NOTE] ->For more info about how your developer can extend your current apps to work directly with Cortana, see [Cortana interactions in UWP apps](https://msdn.microsoft.com/en-us/windows/uwp/input-and-devices/cortana-interactions). +>For more info about how your developer can extend your current apps to work directly with Cortana, see [The Cortana Skills Kit](https://docs.microsoft.com/cortana/getstarted). ## High-level process Cortana uses a Voice Command Definition (VCD) file, aimed at an installed app, to define the actions that are to happen during certain vocal commands. A VCD file can be very simple to very complex, supporting anything from a single sound to a collection of more flexible, natural language sounds, all with the same intent. @@ -30,9 +30,9 @@ To enable voice commands in Cortana Cortana can perform actions on apps in the foreground (taking focus from Cortana) or in the background (allowing Cortana to keep focus). We recommend that you decide where an action should happen, based on what your voice command is intended to do. For example, if your voice command requires employee input, it’s best for that to happen in the foreground. However, if the app only uses basic commands and doesn’t require interaction, it can happen in the background. - - **Start Cortana with focus on your app, using specific voice-enabled statements.** [Create and install a VCD file that starts a foreground app using voice commands and Cortana](https://msdn.microsoft.com/en-us/windows/uwp/input-and-devices/launch-a-foreground-app-with-voice-commands-in-cortana). + - **Start Cortana with focus on your app, using specific voice-enabled statements.** [Create and install a VCD file that starts a foreground app using voice commands and Cortana](https://docs.microsoft.com/cortana/voicecommands/launch-a-foreground-app-with-voice-commands-in-cortana). - - **Start Cortana removing focus from your app, using specific voice-enabled statements.** [Create and install a VCD file that starts a background app using voice commands and Cortana](https://msdn.microsoft.com/en-us/windows/uwp/input-and-devices/launch-a-background-app-with-voice-commands-in-cortana). + - **Start Cortana removing focus from your app, using specific voice-enabled statements.** [Create and install a VCD file that starts a background app using voice commands and Cortana](https://docs.microsoft.com/cortana/voicecommands/launch-a-background-app-with-voice-commands-in-cortana). 2. **Install the VCD file on employees' devices**. You can use System Center Configuration Manager or Microsoft Intune to deploy and install the VCD file on your employees' devices, the same way you deploy and install any other package in your organization. diff --git a/windows/manage/customize-windows-10-start-screens-by-using-mobile-device-management.md b/windows/manage/customize-windows-10-start-screens-by-using-mobile-device-management.md index cf6a6dab79..2ccace55f5 100644 --- a/windows/manage/customize-windows-10-start-screens-by-using-mobile-device-management.md +++ b/windows/manage/customize-windows-10-start-screens-by-using-mobile-device-management.md @@ -15,17 +15,18 @@ localizationpriority: medium **Applies to** -- Windows 10 +- Windows 10 +- Windows 10 Mobile **Looking for consumer information?** - [Customize the Start menu](https://go.microsoft.com/fwlink/p/?LinkId=623630) -In Windows 10 Enterprise and Windows 10 Education, you can use a mobile device management (MDM) policy to deploy a customized Start layout to users. No reimaging is required, and the Start layout can be updated simply by overwriting the .xml file that contains the layout. This enables you to customize Start layouts for different departments or organizations, with minimal management overhead. +In Windows 10 Mobile, Windows 10 Enterprise, and Windows 10 Education, you can use a mobile device management (MDM) policy to deploy a customized Start layout to users. No reimaging is required, and the Start layout can be updated simply by overwriting the .xml file that contains the layout. This enables you to customize Start layouts for different departments or organizations, with minimal management overhead. > **Note:** Customized taskbar configuration cannot be applied using MDM at this time. -**Before you begin**: [Customize and export Start layout](customize-and-export-start-layout.md) +**Before you begin**: [Customize and export Start layout](customize-and-export-start-layout.md) for desktop editions or [create a Start layout XML](start-layout-xml-mobile.md) for mobile. **Warning** When a full Start layout is applied with this method, the users cannot pin, unpin, or uninstall apps from Start. Users can view and open all apps in the **All Apps** view, but they cannot pin any apps to Start. When a partial Start layout is applied, the contents of the specified tile groups cannot be changed, but users can move those groups, and can also create and customize their own groups. diff --git a/windows/manage/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md b/windows/manage/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md index 8ec42b3218..7cc8395f8b 100644 --- a/windows/manage/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md +++ b/windows/manage/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md @@ -15,18 +15,19 @@ localizationpriority: medium **Applies to** -- Windows 10 +- Windows 10 +- Windows 10 Mobile **Looking for consumer information?** - [Customize the Start menu](https://go.microsoft.com/fwlink/p/?LinkId=623630) -In Windows 10 Enterprise and Windows 10 Education, version 1607, you can use a provisioning package that you create with Windows Imaging and Configuration Designer (ICD) tool to deploy a customized Start and taskbar layout to users. No reimaging is required, and the Start and taskbar layout can be updated simply by overwriting the .xml file that contains the layout. The provisioning package can be applied to a running device. This enables you to customize Start and taskbar layouts for different departments or organizations, with minimal management overhead. +In Windows 10 Mobile, Windows 10 Enterprise, and Windows 10 Education, version 1607, you can use a provisioning package that you create with Windows Imaging and Configuration Designer (ICD) tool to deploy a customized Start and taskbar layout to users. No reimaging is required, and the Start and taskbar layout can be updated simply by overwriting the .xml file that contains the layout. The provisioning package can be applied to a running device. This enables you to customize Start and taskbar layouts for different departments or organizations, with minimal management overhead. >[!IMPORTANT] >If you use a provisioning package to configure the taskbar, your configuration will be reapplied each time the explorer.exe process restarts. If your configuration pins an app and the user unpins that app, the user's change will be overwritten the next time the configuration is applied. To apply a taskbar configuration and allow users to make changes that will persist, apply your configuration by using Group Policy. -**Before you begin**: [Customize and export Start layout](customize-and-export-start-layout.md) +**Before you begin**: [Customize and export Start layout](customize-and-export-start-layout.md) for desktop editions or [create a Start layout XML](start-layout-xml-mobile.md) for mobile. ## How Start layout control works @@ -48,14 +49,12 @@ Three features enable Start and taskbar layout control: Use the [Imaging and Configuration Designer (ICD) tool](https://go.microsoft.com/fwlink/p/?LinkID=525483) included in the Windows Assessment and Deployment Kit (ADK) for Windows 10 to create a provisioning package that applies a customized Start and taskbar layout. [Install the ADK.](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit) -> **Important** -When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed. +>[!IMPORTANT] +>When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed. 1. Open ICD (by default, %systemdrive%\\Program Files (x86)\\Windows Kits\\10\\Assessment and Deployment Kit\\Imaging and Configuration Designer\\x86\\ICD.exe). 2. Choose **Advanced provisioning**. - - 3. Name your project, and click **Next**. 4. Choose **All Windows desktop editions** and click **Next**. diff --git a/windows/manage/distribute-offline-apps.md b/windows/manage/distribute-offline-apps.md index 74afc0928b..b0a6b60bc0 100644 --- a/windows/manage/distribute-offline-apps.md +++ b/windows/manage/distribute-offline-apps.md @@ -33,50 +33,49 @@ Offline-licensed apps offer an alternative to online apps, and provide additiona ## Distribution options for offline-licensed apps +You can't distribute offline-licensed apps directly from the Store for Business. Once you download the items for the offline-licensed app, you have options for distributing the apps: -You can't distribute offline-licensed apps directly from the Store for Business. Once you download the items for the offline-licensed app, you have three options for distributing the apps: +- **Deployment Image Servicing and Management**. DISM is a command-line tool that is used to mount and service Microsoft Windows images before deployment. You can also use DISM to install, uninstall, configure, and update Windows features, packages, drivers, and international settings in a .wim file or VHD using the DISM servicing commands. DISM commands are used on offline images. For more information, see [Deployment Image Servicing and Management](https://msdn.microsoft.com/windows/hardware/commercialize/manufacture/desktop/dism---deployment-image-servicing-and-management-technical-reference-for-windows). -- **Deployment Image Servicing and Management**. DISM is a command-line tool that is used to mount and service Microsoft WindowsWindows images before deployment. You can also use DISM to install, uninstall, configure, and update Windows features, packages, drivers, and international settings in a .wim file or VHD using the DISM servicing commands. DISM commands are used on offline images. For more information, see [Deployment Image Servicing and Management](https://msdn.microsoft.com/windows/hardware/commercialize/manufacture/desktop/dism---deployment-image-servicing-and-management-technical-reference-for-windows). +- **Create provisioning package**. You can use Windows Imaging and Configuration Designer (ICD) to create a provisioning package for your offline app. Once you have the package, there are options to [apply the provisioning package](https://technet.microsoft.com/itpro/windows/deploy/provisioning-apply-package). For more information, see [Provisioning Packages for Windows 10](https://technet.microsoft.com/itpro/windows/deploy/provisioning-packages). -- **Windows ICD**. ICD is GUI tool that you can use to create Windows provisioning answer files, and add third-party drivers, apps, or other assets to an answer file. For more information, see [Windows Imaging and Configuration Designer](https://msdn.microsoft.com/library/windows/hardware/dn916113.aspx). +- **Mobile device management provider or management server.** You can use a mobile device management (MDM) provider or management server to distribute offline apps. For more information, see these topics: + - [Manage apps from Windows Store for Business with System Center Configuration Manager](https://docs.microsoft.com/sccm/apps/deploy-use/manage-apps-from-the-windows-store-for-business) + - [Manage apps from Windows Store for Business with Microsoft Intune](https://docs.microsoft.com/intune/deploy-use/manage-apps-you-purchased-from-the-windows-store-for-business-with-microsoft-intune)
-- **Management server.** +For third-party MDM providers or management servers, check your product documentation. ## Download an offline-licensed app +There are several items to download or create for offline-licensed apps. The app package and app license are required; app metadata and app frameworks are optional. This section includes more info on each item, and tells you how to download an offline-licensed app. -There are several items to download or create for offline-licensed apps. You'll need all of these items to distribute offline apps to your employees. This section includes more info on each item, and tells you how to download an offline-licensed app. +- **App metadata** - App metadata is optional. The metadata includes app details, links to icons, product id, localized product ids, and other items. Devs who plan to use an app as part of another app or tool, might want the app metadata. -- **App metadata** -- App metadata is required for distributing offline apps. The metadata includes app details, links to icons, product id, localized product ids, and other items. +- **App package** - App packages are required for distributing offline apps. There are app packages for different combinations of app platform and device architecture. You'll need to know what device architectures you have in your organization to know if there are app packages to support your devices. -- **App package** -- App packages are required for distributing offline apps. There are app packages for different combinations of app platform and device architecture. You'll need to know what device architectures you have in your organization to know if there are app packages to support your devices. +- **App license** - App licenses are required for distributing offline apps. Use encoded licenses when you distribute offline-licensed apps using a management tool or ICD. Use unencoded licenses when you distribute offline-licensed apps using DISM. -- **App license** -- App licenses are required for distributing offline apps. Use encoded licenses when you distribute offline-licensed apps using a management tool or ICD. Use unencoded licenses when you distribute offline-licensed apps using DISM. - -- **App frameworks** -- App frameworks are required for distributing offline apps, but you might not need to download one. If you already have the required framework, you don't need to download another copy. The Store for Business will select the app framework needed for the app platform and architecture that you selected. +- **App frameworks** - App frameworks are optional. If you already have the required framework, you don't need to download another copy. The Store for Business will select the app framework needed for the app platform and architecture that you selected. **To download an offline-licensed app** -1. Sign in to the Store for Business +1. Sign in to the [Store for Business](http://businessstore.microsoft.com/). 2. Click **Manage**, and then choose **Inventory**. 3. Click **Refine**, and then choose **Offline**. 4. Find the app you want to download, click the ellipses under **Actions**, and then choose **Download for offline use**. + - **To download app metadata**: Choose the language for the app metadata, and then click **Download**. Save the downloaded app metadata. This is optional. + - **To download app package**: Click to expand the package details information, choose the Platform and Architecture combination that you need for your organization, and then click **Download**. Save the downloaded app package. This is required. + - **To download an app license**: Choose either **Encoded**, or **Unencoded**, and then click **Generate license**. Save the downloaded license. This is required. + - **To download an app framework**: Find the framework you need to support your app package, and click **Download**. This is optional. + +> [!NOTE] +> You need the framework to support your app package, but if you already have a copy, you don't need to download it again. Frameworks are backward compatible. -5. To download app metadata: choose the language for the app metadata, and then click **Download**. Save the downloaded app metadata. - -6. To download app package for offline use: click to expand the package details information, choose the Platform and Architecture combination that you need for your organization, and then click **Download**. Save the downloaded app package. - -7. To download an app license: choose either **Encoded**, or **Unencoded**, and then click **Generate license**. Save the downloaded license. - -8. To download an app framework: find the framework you need to support your app package, and click **Download**. - **Note** - You need the framework to support your app package, but if you already have a copy, you don't need to download it again. - - Frameworks are backward compatible. + diff --git a/windows/manage/group-policies-for-enterprise-and-education-editions.md b/windows/manage/group-policies-for-enterprise-and-education-editions.md index 40c5250e62..0eb86b635e 100644 --- a/windows/manage/group-policies-for-enterprise-and-education-editions.md +++ b/windows/manage/group-policies-for-enterprise-and-education-editions.md @@ -28,7 +28,7 @@ In Windows 10, version 1607, the following Group Policy settings apply only to W | **Start layout** | User Configuration\Administrative Templates\Start Menu and Taskbar | For more info, see [Manage Windows 10 Start layout options and policies](windows-10-start-layout-options-and-policies.md) | | **Turn off the Store application** | Computer Configuration > Administrative Templates > Windows Components > Store > Turn off the Store application
User Configuration > Administrative Templates > Windows Components > Store > Turn off the Store application | For more info, see [Knowledge Base article# 3135657](https://support.microsoft.com/kb/3135657). | | **Only display the private store within the Windows Store app** | Computer Configuration > Administrative Templates > Windows Components > Store > Only display the private store within the Windows Store app
User Configuration > Administrative Templates > Windows Components > Store > Only display the private store within the Windows Store app | For more info, see [Manage access to private store](manage-access-to-private-store.md) | -| **Don't search the web or display web results** | Computer Configuration\Administrative Templates\Windows Components\Search\Don't search the web or display web results | For more info, see [Cortana integration in your enterprise](manage-cortana-in-enterprise.md) | +| **Don't search the web or display web results** | Computer Configuration\Administrative Templates\Windows Components\Search\Don't search the web or display web results | For more info, see [Cortana integration in your enterprise](cortana-at-work-overview.md) | diff --git a/windows/manage/images/uc-01.png b/windows/manage/images/uc-01.png new file mode 100644 index 0000000000..7f4df9f6d7 Binary files /dev/null and b/windows/manage/images/uc-01.png differ diff --git a/windows/manage/images/uc-02.png b/windows/manage/images/uc-02.png new file mode 100644 index 0000000000..8317f051c3 Binary files /dev/null and b/windows/manage/images/uc-02.png differ diff --git a/windows/manage/images/uc-02a.png b/windows/manage/images/uc-02a.png new file mode 100644 index 0000000000..d12544e3a0 Binary files /dev/null and b/windows/manage/images/uc-02a.png differ diff --git a/windows/manage/images/uc-03.png b/windows/manage/images/uc-03.png new file mode 100644 index 0000000000..58494c4128 Binary files /dev/null and b/windows/manage/images/uc-03.png differ diff --git a/windows/manage/images/uc-03a.png b/windows/manage/images/uc-03a.png new file mode 100644 index 0000000000..39412fc8f3 Binary files /dev/null and b/windows/manage/images/uc-03a.png differ diff --git a/windows/manage/images/uc-04.png b/windows/manage/images/uc-04.png new file mode 100644 index 0000000000..ef9a37d379 Binary files /dev/null and b/windows/manage/images/uc-04.png differ diff --git a/windows/manage/images/uc-04a.png b/windows/manage/images/uc-04a.png new file mode 100644 index 0000000000..537d4bbe72 Binary files /dev/null and b/windows/manage/images/uc-04a.png differ diff --git a/windows/manage/images/uc-05.png b/windows/manage/images/uc-05.png new file mode 100644 index 0000000000..21c8e9f9e0 Binary files /dev/null and b/windows/manage/images/uc-05.png differ diff --git a/windows/manage/images/uc-05a.png b/windows/manage/images/uc-05a.png new file mode 100644 index 0000000000..2271181622 Binary files /dev/null and b/windows/manage/images/uc-05a.png differ diff --git a/windows/manage/images/uc-06.png b/windows/manage/images/uc-06.png new file mode 100644 index 0000000000..03a559800b Binary files /dev/null and b/windows/manage/images/uc-06.png differ diff --git a/windows/manage/images/uc-06a.png b/windows/manage/images/uc-06a.png new file mode 100644 index 0000000000..15df1cfea0 Binary files /dev/null and b/windows/manage/images/uc-06a.png differ diff --git a/windows/manage/images/uc-07.png b/windows/manage/images/uc-07.png new file mode 100644 index 0000000000..de1ae35e82 Binary files /dev/null and b/windows/manage/images/uc-07.png differ diff --git a/windows/manage/images/uc-07a.png b/windows/manage/images/uc-07a.png new file mode 100644 index 0000000000..c0f2d9fd73 Binary files /dev/null and b/windows/manage/images/uc-07a.png differ diff --git a/windows/manage/images/uc-08.png b/windows/manage/images/uc-08.png new file mode 100644 index 0000000000..877fcd64c0 Binary files /dev/null and b/windows/manage/images/uc-08.png differ diff --git a/windows/manage/images/uc-08a.png b/windows/manage/images/uc-08a.png new file mode 100644 index 0000000000..89da287d3d Binary files /dev/null and b/windows/manage/images/uc-08a.png differ diff --git a/windows/manage/images/uc-09.png b/windows/manage/images/uc-09.png new file mode 100644 index 0000000000..37d7114f19 Binary files /dev/null and b/windows/manage/images/uc-09.png differ diff --git a/windows/manage/images/uc-09a.png b/windows/manage/images/uc-09a.png new file mode 100644 index 0000000000..f6b6ec5b60 Binary files /dev/null and b/windows/manage/images/uc-09a.png differ diff --git a/windows/manage/images/uc-10.png b/windows/manage/images/uc-10.png new file mode 100644 index 0000000000..3ab72d10d2 Binary files /dev/null and b/windows/manage/images/uc-10.png differ diff --git a/windows/manage/images/uc-10a.png b/windows/manage/images/uc-10a.png new file mode 100644 index 0000000000..1c6b8b01dc Binary files /dev/null and b/windows/manage/images/uc-10a.png differ diff --git a/windows/manage/images/uc-11.png b/windows/manage/images/uc-11.png new file mode 100644 index 0000000000..8b4fc568ea Binary files /dev/null and b/windows/manage/images/uc-11.png differ diff --git a/windows/manage/images/uc-12.png b/windows/manage/images/uc-12.png new file mode 100644 index 0000000000..4198684c99 Binary files /dev/null and b/windows/manage/images/uc-12.png differ diff --git a/windows/manage/images/uc-13.png b/windows/manage/images/uc-13.png new file mode 100644 index 0000000000..117f9b9fd8 Binary files /dev/null and b/windows/manage/images/uc-13.png differ diff --git a/windows/manage/images/uc-14.png b/windows/manage/images/uc-14.png new file mode 100644 index 0000000000..66047984e7 Binary files /dev/null and b/windows/manage/images/uc-14.png differ diff --git a/windows/manage/images/uc-15.png b/windows/manage/images/uc-15.png new file mode 100644 index 0000000000..c241cd9117 Binary files /dev/null and b/windows/manage/images/uc-15.png differ diff --git a/windows/manage/images/uc-16.png b/windows/manage/images/uc-16.png new file mode 100644 index 0000000000..e7aff4d4ed Binary files /dev/null and b/windows/manage/images/uc-16.png differ diff --git a/windows/manage/images/uc-17.png b/windows/manage/images/uc-17.png new file mode 100644 index 0000000000..cb8e42ca5e Binary files /dev/null and b/windows/manage/images/uc-17.png differ diff --git a/windows/manage/images/uc-18.png b/windows/manage/images/uc-18.png new file mode 100644 index 0000000000..5eff59adc9 Binary files /dev/null and b/windows/manage/images/uc-18.png differ diff --git a/windows/manage/images/uc-19.png b/windows/manage/images/uc-19.png new file mode 100644 index 0000000000..791900eafc Binary files /dev/null and b/windows/manage/images/uc-19.png differ diff --git a/windows/manage/images/uc-20.png b/windows/manage/images/uc-20.png new file mode 100644 index 0000000000..7dbb027b9f Binary files /dev/null and b/windows/manage/images/uc-20.png differ diff --git a/windows/manage/images/uc-21.png b/windows/manage/images/uc-21.png new file mode 100644 index 0000000000..418db41fe4 Binary files /dev/null and b/windows/manage/images/uc-21.png differ diff --git a/windows/manage/images/uc-22.png b/windows/manage/images/uc-22.png new file mode 100644 index 0000000000..2ca5c47a61 Binary files /dev/null and b/windows/manage/images/uc-22.png differ diff --git a/windows/manage/images/uc-23.png b/windows/manage/images/uc-23.png new file mode 100644 index 0000000000..58b82db82d Binary files /dev/null and b/windows/manage/images/uc-23.png differ diff --git a/windows/manage/images/uc-24.png b/windows/manage/images/uc-24.png new file mode 100644 index 0000000000..00bc61e3e1 Binary files /dev/null and b/windows/manage/images/uc-24.png differ diff --git a/windows/manage/images/uc-25.png b/windows/manage/images/uc-25.png new file mode 100644 index 0000000000..4e0f0bdb03 Binary files /dev/null and b/windows/manage/images/uc-25.png differ diff --git a/windows/manage/index.md b/windows/manage/index.md index e9e8ac3329..bdb730b559 100644 --- a/windows/manage/index.md +++ b/windows/manage/index.md @@ -7,6 +7,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security +localizationpriority: high author: jdeckerMS --- @@ -34,7 +35,7 @@ Learn about managing and updating Windows 10.
[Cortana integration in your business or enterprise](manage-cortana-in-enterprise.md)
The world’s first personal digital assistant helps users get things done, even at work. Cortana includes powerful configuration options specifically to optimize for unique small to medium-sized business and enterprise environments.
[Manage corporate devices](manage-corporate-devices.md)
You can use the same management tools to manage all device types running Windows 10: desktops, laptops, tablets, and phones. And your current management tools, such as Group Policy, Windows Management Instrumentation (WMI), PowerShell scripts, Orchestrator runbooks, System Center tools, and so on, will continue to work for Windows 10 on desktop editions.
[Windows Store for Business](windows-store-for-business.md)
Welcome to the Windows Store for Business! You can use the Store for Business, to find, acquire, distribute, and manage apps for your organization.
[Windows Libraries](windows-libraries.md)
Libraries are virtual containers for users’ content. A library can contain files and folders stored on the local computer or in a remote storage location. Libraries are built upon the legacy known folders (such as My Documents, My Pictures, and My Music).
[Change history for Manage and update Windows 10](change-history-for-manage-and-update-windows-10.md)
This topic lists new and updated topics in the Manage and update Windows 10 documentation for [Windows 10 and Windows 10 Mobile](../index.md).
| Service | Endpoint + |
| Connected User Experience and Telemetry component | v10.vortex-win.data.microsoft.com
+ settings-win.data.microsoft.com + |
| Windows Error Reporting | watson.telemetry.microsoft.com + |
| Online Crash Analysis | oca.telemetry.microsoft.com + |
+ 
+
|
](images/ua-cg-15.png){kind=link}