mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-14 14:27:22 +00:00
Merge branch 'master' into seo-update-lengthy-meta-descriptions
This commit is contained in:
Marty Hernandez Avedon
GitHub
commit
0ff879918f
@ -3,7 +3,7 @@ title: Log files - Windows IT Pro
|
||||
ms.reviewer:
|
||||
manager: laurawi
|
||||
ms.author: greglin
|
||||
description: Resolve Windows 10 upgrade errors for ITPros. Technical information for IT professionals to help diagnose Windows setup errors.
|
||||
description: Learn how to interpret the log files generated during the Windows 10 upgrade process.
|
||||
keywords: deploy, error, troubleshoot, windows, 10, upgrade, code, rollback, ITPro
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
@ -27,7 +27,8 @@ ms.topic: article
|
||||
|
||||
Several log files are created during each phase of the upgrade process. These log files are essential for troubleshooting upgrade problems. By default, the folders that contain these log files are hidden on the upgrade target computer. To view the log files, configure Windows Explorer to view hidden items, or use a tool to automatically gather these logs. The most useful log is **setupact.log**. The log files are located in a different folder depending on the Windows Setup phase. Recall that you can determine the phase from the extend code.
|
||||
|
||||
Note: Also see the [Windows Error Reporting](windows-error-reporting.md) section in this document for help locating error codes and log files.
|
||||
>[!NOTE]
|
||||
>Also see the [Windows Error Reporting](windows-error-reporting.md) section in this document for help locating error codes and log files.
|
||||
|
||||
The following table describes some log files and how to use them for troubleshooting purposes:<br>
|
||||
|
||||
@ -79,7 +80,7 @@ See the following example:
|
||||
|
||||
## Analyze log files
|
||||
|
||||
>The following instructions are meant for IT professionals. Also see the [Upgrade error codes](upgrade-error-codes.md) section in this guide to familiarize yourself with [result codes](upgrade-error-codes.md#result-codes) and [extend codes](upgrade-error-codes.md#extend-codes).
|
||||
The following instructions are meant for IT professionals. Also see the [Upgrade error codes](upgrade-error-codes.md) section in this guide to familiarize yourself with [result codes](upgrade-error-codes.md#result-codes) and [extend codes](upgrade-error-codes.md#extend-codes).
|
||||
|
||||
<br>To analyze Windows Setup log files:
|
||||
|
||||
@ -110,7 +111,7 @@ See the following example:
|
||||
|
||||
For example, assume that the error code for an error is 0x8007042B - 0x2000D. Searching for "8007042B" reveals the following content from the setuperr.log file:
|
||||
|
||||
>Some lines in the text below are shortened to enhance readability. The date and time at the start of each line (ex: 2016-10-05 15:27:08) is shortened to minutes and seconds, and the certificate file name which is a long text string is shortened to just "CN."
|
||||
Some lines in the text below are shortened to enhance readability. The date and time at the start of each line (ex: 2016-10-05 15:27:08) is shortened to minutes and seconds, and the certificate file name which is a long text string is shortened to just "CN."
|
||||
|
||||
<br><B>setuperr.log</B> content:
|
||||
|
||||
|
||||
@ -1,239 +1,243 @@
|
||||
---
|
||||
title: Quick fixes - Windows IT Pro
|
||||
ms.reviewer:
|
||||
manager: laurawi
|
||||
ms.author: greglin
|
||||
description: Resolve Windows 10 upgrade errors for ITPros. Technical information for IT professionals to help diagnose Windows setup errors.
|
||||
keywords: deploy, error, troubleshoot, windows, 10, upgrade, code, rollback, ITPro
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: deploy
|
||||
audience: itpro
author: greg-lindsay
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Quick fixes
|
||||
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
|
||||
>[!NOTE]
|
||||
>This is a 100 level topic (basic).<br>
|
||||
>See [Resolve Windows 10 upgrade errors](resolve-windows-10-upgrade-errors.md) for a full list of topics in this article.
|
||||
|
||||
The following list of fixes can resolve many Windows upgrade problems. You should try these steps before contacting Microsoft support, or attempting a more advanced analysis of a Windows upgrade failure. Also review information at [Windows 10 help](https://support.microsoft.com/products/windows?os=windows-10).
|
||||
|
||||
The Microsoft Virtual Agent provided by [Microsoft Support](https://support.microsoft.com/contactus/) can help you to analyze and correct some Windows upgrade errors. **To talk to a person about your issue**, start the Virtual Agent (click **Get started**) and enter "Talk to a person" two times.
|
||||
|
||||
>You might also wish to try a new tool available from Microsoft that helps to diagnose many Windows upgrade errors. For more information and to download this tool, see [SetupDiag](setupdiag.md). The topic is more advanced (300 level) because several advanced options are available for using the tool. However, you can now just download and then double-click the tool to run it. By default when you click Save, the tool is saved in your **Downloads** folder. Double-click the tool in the folder and wait until it finishes running (it might take a few minutes), then double-click the **SetupDiagResults.log** file and open it using Notepad to see the results of the analysis.
|
||||
|
||||
## List of fixes
|
||||
|
||||
<ol>
|
||||
<li>Remove nonessential external hardware, such as docks and USB devices. <a href="#remove-external-hardware" data-raw-source="[More information](#remove-external-hardware)">More information</a>.</li>
|
||||
<li>Check the system drive for errors and attempt repairs. <a href="#repair-the-system-drive" data-raw-source="[More information](#repair-the-system-drive)">More information</a>.</li>
|
||||
<li>Run the Windows Update troubleshooter. <a href="#windows-update-troubleshooter" data-raw-source="[More information](#windows-update-troubleshooter)">More information</a>.</li>
|
||||
<li>Attempt to restore and repair system files. <a href="#repair-system-files" data-raw-source="[More information](#repair-system-files)">More information</a>.</li>
|
||||
<li>Update Windows so that all available recommended updates are installed, and ensure the computer is rebooted if this is necessary to complete installation of an update. <a href="#update-windows" data-raw-source="[More information](#update-windows)">More information</a>.</li>
|
||||
<li>Temporarily uninstall non-Microsoft antivirus software.
|
||||
<a href="#uninstall-non-microsoft-antivirus-software" data-raw-source="[More information](#uninstall-non-microsoft-antivirus-software)">More information</a>.</li>
|
||||
|
||||
<li>Uninstall all nonessential software. <a href="#uninstall-non-essential-software" data-raw-source="[More information](#uninstall-non-essential-software)">More information</a>.</li>
|
||||
<li>Update firmware and drivers. <a href="#update-firmware-and-drivers" data-raw-source="[More information](#update-firmware-and-drivers)">More information</a></li>
|
||||
<li>Ensure that "Download and install updates (recommended)" is accepted at the start of the upgrade process. <a href="#ensure-that-download-and-install-updates-is-selected" data-raw-source="[More information](#ensure-that-download-and-install-updates-is-selected)">More information</a>.</li>
|
||||
<li>Verify at least 16 GB of free space is available to upgrade a 32-bit OS, or 20 GB for a 64-bit OS. <a href="#verify-disk-space" data-raw-source="[More information](#verify-disk-space)">More information</a>.</li>
|
||||
</ol>
|
||||
|
||||
## Step by step instructions
|
||||
|
||||
### Remove external hardware
|
||||
|
||||
If the computer is portable and it is currently in a docking station, [undock the computer](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc754084(v=ws.11)).
|
||||
|
||||
Unplug nonessential external hardware devices from the computer, such as:
|
||||
- Headphones
|
||||
- Joysticks
|
||||
- Printers
|
||||
- Plotters
|
||||
- Projectors
|
||||
- Scanners
|
||||
- Speakers
|
||||
- USB flash drives
|
||||
- Portable hard drives
|
||||
- Portable CD/DVD/Blu-ray drives
|
||||
- Microphones
|
||||
- Media card readers
|
||||
- Cameras/Webcams
|
||||
- Smart phones
|
||||
- Secondary monitors, keyboards, mice
|
||||
|
||||
For more information about disconnecting external devices, see [Safely remove hardware in Windows 10](https://support.microsoft.com/help/4051300/windows-10-safely-remove-hardware)
|
||||
|
||||
### Repair the system drive
|
||||
|
||||
The system drive is the drive that contains the [system partition](https://docs.microsoft.com/windows-hardware/manufacture/desktop/hard-drives-and-partitions#span-idpartitionsspanspan-idpartitionsspanspan-idpartitionsspanpartitions). This is usually the **C:** drive.
|
||||
|
||||
To check and repair errors on the system drive:
|
||||
|
||||
1. Click **Start**.
|
||||
2. Type **command**.
|
||||
3. Right-click **Command Prompt** and then left-click **Run as administrator**.
|
||||
4. If you are prompted by UAC, click **Yes**.
|
||||
5. Type **chkdsk /F** and press ENTER.
|
||||
6. When you are prompted to schedule a check the next time the system restarts, type **Y**.
|
||||
7. See the following example
|
||||
|
||||
```
|
||||
C:\WINDOWS\system32>chkdsk /F
|
||||
The type of the file system is NTFS.
|
||||
Cannot lock current drive.
|
||||
|
||||
Chkdsk cannot run because the volume is in use by another
|
||||
process. Would you like to schedule this volume to be
|
||||
checked the next time the system restarts? (Y/N) Y
|
||||
|
||||
This volume will be checked the next time the system restarts.
|
||||
```
|
||||
|
||||
8. Restart the computer. The computer will pause before loading Windows and perform a repair of your hard drive.
|
||||
|
||||
### Windows Update Troubleshooter
|
||||
|
||||
The Windows Update troubleshooter tool will automatically analyze and fix problems with Windows Update, such as a corrupted download. It will also tell you if there is a pending reboot that is preventing Windows from updating.
|
||||
|
||||
For Windows 7 and 8.1, the tool is [here](https://aka.ms/diag_wu).
|
||||
|
||||
For Windows 10, the tool is [here](https://aka.ms/wudiag).
|
||||
|
||||
To run the tool, click the appropriate link above. Your web browser will prompt you to save or open the file. Select **open** and the tool will automatically start. The tool will walk you through analyzing and fixing some common problems.
|
||||
|
||||
You can also download the Windows Update Troubleshooter by starting the Microsoft [Virtual Agent](https://support.microsoft.com/contact/virtual-agent/), typing **update Windows**, selecting the version of Windows you are running, and then answering **Yes** when asked "Do you need help troubleshooting Windows Update?"
|
||||
|
||||
If any errors are displayed in the Windows Update Troubleshooter, use the Microsoft [Virtual Agent](https://support.microsoft.com/contact/virtual-agent/) to ask about these errors. The Virtual Agent will perform a search and provide a list of helpful links.
|
||||
|
||||
### Repair system files
|
||||
|
||||
This fix is also described in detail at [answers.microsoft.com](https://answers.microsoft.com/en-us/windows/forum/windows_10-update/system-file-check-sfc-scan-and-repair-system-files/bc609315-da1f-4775-812c-695b60477a93).
|
||||
|
||||
To check and repair system files:
|
||||
|
||||
1. Click **Start**.
|
||||
2. Type **command**.
|
||||
3. Right-click **Command Prompt** and then left-click **Run as administrator**.
|
||||
4. If you are prompted by UAC, click **Yes**.
|
||||
5. Type **sfc /scannow** and press ENTER. See the following example:
|
||||
|
||||
```
|
||||
C:\>sfc /scannow
|
||||
|
||||
Beginning system scan. This process will take some time.
|
||||
|
||||
Beginning verification phase of system scan.
|
||||
Verification 100% complete.
|
||||
|
||||
Windows Resource Protection did not find any integrity violations.
|
||||
```
|
||||
6. If you are running Windows 8.1 or later, type **DISM.exe /Online /Cleanup-image /Restorehealth** and press ENTER (the DISM command options are not available for Windows 7). See the following example:
|
||||
|
||||
```
|
||||
C:\>DISM.exe /Online /Cleanup-image /Restorehealth
|
||||
|
||||
Deployment Image Servicing and Management tool
|
||||
Version: 10.0.16299.15
|
||||
|
||||
Image Version: 10.0.16299.309
|
||||
|
||||
[==========================100.0%==========================] The restore operation completed successfully.
|
||||
The operation completed successfully.
|
||||
|
||||
```
|
||||
>It may take several minutes for the command operations to be completed. For more information, see [Repair a Windows Image](https://msdn.microsoft.com/windows/hardware/commercialize/manufacture/desktop/repair-a-windows-image).
|
||||
|
||||
|
||||
### Update Windows
|
||||
|
||||
You should ensure that all important updates are installed before attempting to upgrade. This includes updates to hardware drivers on your computer.
|
||||
|
||||
The Microsoft [Virtual Agent](https://support.microsoft.com/contact/virtual-agent/) can walk you through the process of making sure that Windows is updated.
|
||||
|
||||
Start the [Virtual Agent](https://support.microsoft.com/contact/virtual-agent/) and then type "update windows."
|
||||
|
||||
Answer questions that the agent asks, and follow instructions to ensure that Windows is up to date. You can also run the [Windows Update Troubleshooter](#windows-update-troubleshooter) described above.
|
||||
|
||||
Click **Start**, click power options, and then restart the computer.
|
||||
|
||||
### Uninstall non-Microsoft antivirus software
|
||||
|
||||
Use Windows Defender for protection during the upgrade.
|
||||
|
||||
Verify compatibility information, and if desired re-install antivirus applications after the upgrade. If you plan to re-install the application after upgrading, be sure that you have the installation media and all required activation information before removing the program.
|
||||
|
||||
To remove the application, go to **Control Panel\Programs\Programs and Features** and click the antivirus application, then click Uninstall. Choose **Yes** when you are asked to confirm program removal.
|
||||
|
||||
For more information, see [Windows 7 - How to properly uninstall programs](https://support.microsoft.com/help/2601726) or [Repair or remove programs in Windows 10](https://support.microsoft.com/help/4028054/windows-repair-or-remove-programs-in-windows-10).
|
||||
|
||||
### Uninstall non-essential software
|
||||
|
||||
Outdated applications can cause problems with a Windows upgrade. Removing old or non-essential applications from the computer can therefore help.
|
||||
|
||||
If you plan to reinstall the application later, be sure that you have the installation media and all required activation information before removing it.
|
||||
|
||||
To remove programs, use the same steps as are provided [above](#uninstall-non-microsoft-antivirus-software) for uninstalling non-Microsoft antivirus software, but instead of removing the antivirus application repeat the steps for all your non-essential, unused, or out-of-date software.
|
||||
|
||||
### Update firmware and drivers
|
||||
|
||||
Updating firmware (such as the BIOS) and installing hardware drivers is a somewhat advanced task. Do not attempt to update BIOS if you aren't familiar with BIOS settings or are not sure how to restore the previous BIOS version if there are problems. Most BIOS updates are provided as a "flash" update. Your manufacturer might provide a tool to perform the update, or you might be required to enter the BIOS and update it manually. Be sure to save your working BIOS settings, since some updates can reset your configuration and make the computer fail to boot if (for example) a RAID configuration is changed.
|
||||
|
||||
Most BIOS and other hardware updates can be obtained from a website maintained by your computer manufacturer. For example, Microsoft Surface device drivers can be obtained at: [Download the latest firmware and drivers for Surface devices](https://docs.microsoft.com/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices).
|
||||
|
||||
To obtain the proper firmware drivers, search for the most updated driver version provided by your computer manufacturer. Install these updates and reboot the computer after installation. Request assistance from the manufacturer if you have any questions.
|
||||
|
||||
### Ensure that "Download and install updates" is selected
|
||||
|
||||
When you begin a Windows Update, the setup process will ask you to **Get important updates**. Answer **Yes** if the computer you are updating is connected to the Internet. See the following example:
|
||||
|
||||
|
||||
|
||||
### Verify disk space
|
||||
|
||||
You can see a list of requirements for Windows 10 at [Windows 10 Specifications & System Requirements](https://www.microsoft.com/windows/windows-10-specifications). One of the requirements is that enough hard drive space be available for the installation to take place. At least 16 GB of free space must be available on the system drive to upgrade a 32-bit OS, or 20 GB for a 64-bit OS.
|
||||
|
||||
To view how much hard drive space is available on your computer, open [File Explorer](https://support.microsoft.com/help/4026617/windows-windows-explorer-has-a-new-name). In Windows 7, this was called Windows Explorer.
|
||||
|
||||
In File Explorer, click on **Computer** or **This PC** on the left, then look under **Hard Disk Drives** or under **Devices and drives**. If there are multiple drives listed, the system drive is the drive that includes a Microsoft Windows logo above the drive icon.
|
||||
|
||||
The amount of space available on the system drive will be displayed under the drive. See the following example:
|
||||
|
||||
|
||||
|
||||
In the previous example, there is 703 GB of available free space on the system drive (C:).
|
||||
|
||||
To free up additional space on the system drive, begin by running Disk Cleanup. You can access Disk Cleanup by right-clicking the hard drive icon and then clicking Properties. See the following example:
|
||||
|
||||
|
||||
|
||||
For instructions to run Disk Cleanup and other suggestions to free up hard drive space, see [Tips to free up drive space on your PC](https://support.microsoft.com/help/17421/windows-free-up-drive-space).
|
||||
|
||||
When you run Disk Cleanup and enable the option to Clean up system files, you can remove previous Windows installations which can free a large amount of space. You should only do this if you do not plan to restore the old OS version.
|
||||
|
||||
### Open an elevated command prompt
|
||||
|
||||
>It is no longer necessary to open an elevated command prompt to run the [SetupDiag](setupdiag.md) tool. However, this is still the optimal way to run the tool.
|
||||
|
||||
To launch an elevated command prompt, press the Windows key on your keyboard, type **cmd**, press Ctrl+Shift+Enter, and then Alt+C to confirm the elevation prompt. Screenshots and other steps to open an administrator (aka elevated) command prompt are [here](https://answers.microsoft.com/en-us/windows/forum/windows_7-security/command-prompt-admin-windows-7/6a188166-5e23-461f-b468-f325688ec8c7).
|
||||
|
||||
Note: When you open an elevated command prompt, you will usually start in the **C:\WINDOWS\system32** directory. To run a program that you recently downloaded, you must change to the directory where the program is located. Alternatively, you can move or copy the program to a location on the computer that is automatically searched. These directories are listed in the [PATH variable](https://answers.microsoft.com/en-us/windows/forum/windows_10-other_settings-winpc/adding-path-variable/97300613-20cb-4d85-8d0e-cc9d3549ba23).
|
||||
|
||||
If this is too complicated for you, then use File Explorer to create a new folder under C: with a short name such as "new" then copy or move the programs you want to run (like SetupDiag) to this folder using File Explorer. When you open an elevated command prompt, change to this directory by typing "cd c:\new" and now you can run the programs in that folder.
|
||||
|
||||
If you downloaded the SetupDiag.exe program to your computer, then copied it to the folder C:\new, and you opened an elevated command prompt then typed cd c:\new to change to this directory, you can just type setupdiag and press ENTER to run the program. This program will analyze the files on your computer to see why a Windows Upgrade failed and if the reason was a common one, it will report this reason. It will not fix the problem for you but knowing why the upgrade failed enables you to take steps to fix the problem.
|
||||
|
||||
## Related topics
|
||||
|
||||
[Windows 10 FAQ for IT professionals](https://technet.microsoft.com/windows/dn798755.aspx)
|
||||
<br>[Windows 10 Enterprise system requirements](https://technet.microsoft.com/windows/dn798752.aspx)
|
||||
<br>[Windows 10 Specifications](https://www.microsoft.com/windows/Windows-10-specifications)
|
||||
<br>[Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/en-US/home?category=Windows10ITPro)
|
||||
<br>[Fix Windows Update errors by using the DISM or System Update Readiness tool](https://support.microsoft.com/kb/947821)
|
||||
---
|
||||
title: Quick fixes - Windows IT Pro
|
||||
ms.reviewer:
|
||||
manager: laurawi
|
||||
ms.author: greglin
|
||||
description: Learn how to quickly resolve many problems which may come up during a Windows 10 upgrade.
|
||||
keywords: deploy, error, troubleshoot, windows, 10, upgrade, code, rollback, ITPro
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: deploy
|
||||
audience: itpro
|
||||
author: greg-lindsay
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Quick fixes
|
||||
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
|
||||
>[!NOTE]
|
||||
>This is a 100 level topic (basic).<br>
|
||||
>See [Resolve Windows 10 upgrade errors](resolve-windows-10-upgrade-errors.md) for a full list of topics in this article.
|
||||
|
||||
The following list of fixes can resolve many Windows upgrade problems. You should try these steps before contacting Microsoft support, or attempting a more advanced analysis of a Windows upgrade failure. Also review information at [Windows 10 help](https://support.microsoft.com/products/windows?os=windows-10).
|
||||
|
||||
The Microsoft Virtual Agent provided by [Microsoft Support](https://support.microsoft.com/contactus/) can help you to analyze and correct some Windows upgrade errors. **To talk to a person about your issue**, start the Virtual Agent (click **Get started**) and enter "Talk to a person" two times.
|
||||
|
||||
> [!TIP]
|
||||
> You might also wish to try a new tool available from Microsoft that helps to diagnose many Windows upgrade errors. For more information and to download this tool, see [SetupDiag](setupdiag.md). The topic is more advanced (300 level) because several advanced options are available for using the tool. However, you can now just download and then double-click the tool to run it. By default when you click Save, the tool is saved in your **Downloads** folder. Double-click the tool in the folder and wait until it finishes running (it might take a few minutes), then double-click the **SetupDiagResults.log** file and open it using Notepad to see the results of the analysis.
|
||||
|
||||
## List of fixes
|
||||
|
||||
<ol>
|
||||
<li>Remove nonessential external hardware, such as docks and USB devices. <a href="#remove-external-hardware" data-raw-source="[More information](#remove-external-hardware)">More information</a>.</li>
|
||||
<li>Check the system drive for errors and attempt repairs. <a href="#repair-the-system-drive" data-raw-source="[More information](#repair-the-system-drive)">More information</a>.</li>
|
||||
<li>Run the Windows Update troubleshooter. <a href="#windows-update-troubleshooter" data-raw-source="[More information](#windows-update-troubleshooter)">More information</a>.</li>
|
||||
<li>Attempt to restore and repair system files. <a href="#repair-system-files" data-raw-source="[More information](#repair-system-files)">More information</a>.</li>
|
||||
<li>Update Windows so that all available recommended updates are installed, and ensure the computer is rebooted if this is necessary to complete installation of an update. <a href="#update-windows" data-raw-source="[More information](#update-windows)">More information</a>.</li>
|
||||
<li>Temporarily uninstall non-Microsoft antivirus software.
|
||||
<a href="#uninstall-non-microsoft-antivirus-software" data-raw-source="[More information](#uninstall-non-microsoft-antivirus-software)">More information</a>.</li>
|
||||
|
||||
<li>Uninstall all nonessential software. <a href="#uninstall-non-essential-software" data-raw-source="[More information](#uninstall-non-essential-software)">More information</a>.</li>
|
||||
<li>Update firmware and drivers. <a href="#update-firmware-and-drivers" data-raw-source="[More information](#update-firmware-and-drivers)">More information</a></li>
|
||||
<li>Ensure that "Download and install updates (recommended)" is accepted at the start of the upgrade process. <a href="#ensure-that-download-and-install-updates-is-selected" data-raw-source="[More information](#ensure-that-download-and-install-updates-is-selected)">More information</a>.</li>
|
||||
<li>Verify at least 16 GB of free space is available to upgrade a 32-bit OS, or 20 GB for a 64-bit OS. <a href="#verify-disk-space" data-raw-source="[More information](#verify-disk-space)">More information</a>.</li>
|
||||
</ol>
|
||||
|
||||
## Step by step instructions
|
||||
|
||||
### Remove external hardware
|
||||
|
||||
If the computer is portable and it is currently in a docking station, [undock the computer](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc754084(v=ws.11)).
|
||||
|
||||
Unplug nonessential external hardware devices from the computer, such as:
|
||||
- Headphones
|
||||
- Joysticks
|
||||
- Printers
|
||||
- Plotters
|
||||
- Projectors
|
||||
- Scanners
|
||||
- Speakers
|
||||
- USB flash drives
|
||||
- Portable hard drives
|
||||
- Portable CD/DVD/Blu-ray drives
|
||||
- Microphones
|
||||
- Media card readers
|
||||
- Cameras/Webcams
|
||||
- Smart phones
|
||||
- Secondary monitors, keyboards, mice
|
||||
|
||||
For more information about disconnecting external devices, see [Safely remove hardware in Windows 10](https://support.microsoft.com/help/4051300/windows-10-safely-remove-hardware)
|
||||
|
||||
### Repair the system drive
|
||||
|
||||
The system drive is the drive that contains the [system partition](https://docs.microsoft.com/windows-hardware/manufacture/desktop/hard-drives-and-partitions#span-idpartitionsspanspan-idpartitionsspanspan-idpartitionsspanpartitions). This is usually the **C:** drive.
|
||||
|
||||
To check and repair errors on the system drive:
|
||||
|
||||
1. Click **Start**.
|
||||
2. Type **command**.
|
||||
3. Right-click **Command Prompt** and then left-click **Run as administrator**.
|
||||
4. If you are prompted by UAC, click **Yes**.
|
||||
5. Type **chkdsk /F** and press ENTER.
|
||||
6. When you are prompted to schedule a check the next time the system restarts, type **Y**.
|
||||
7. See the following example
|
||||
|
||||
```
|
||||
C:\WINDOWS\system32>chkdsk /F
|
||||
The type of the file system is NTFS.
|
||||
Cannot lock current drive.
|
||||
|
||||
Chkdsk cannot run because the volume is in use by another
|
||||
process. Would you like to schedule this volume to be
|
||||
checked the next time the system restarts? (Y/N) Y
|
||||
|
||||
This volume will be checked the next time the system restarts.
|
||||
```
|
||||
|
||||
8. Restart the computer. The computer will pause before loading Windows and perform a repair of your hard drive.
|
||||
|
||||
### Windows Update Troubleshooter
|
||||
|
||||
The Windows Update troubleshooter tool will automatically analyze and fix problems with Windows Update, such as a corrupted download. It will also tell you if there is a pending reboot that is preventing Windows from updating.
|
||||
|
||||
For Windows 7 and 8.1, the tool is [here](https://aka.ms/diag_wu).
|
||||
|
||||
For Windows 10, the tool is [here](https://aka.ms/wudiag).
|
||||
|
||||
To run the tool, click the appropriate link above. Your web browser will prompt you to save or open the file. Select **open** and the tool will automatically start. The tool will walk you through analyzing and fixing some common problems.
|
||||
|
||||
You can also download the Windows Update Troubleshooter by starting the Microsoft [Virtual Agent](https://support.microsoft.com/contact/virtual-agent/), typing **update Windows**, selecting the version of Windows you are running, and then answering **Yes** when asked "Do you need help troubleshooting Windows Update?"
|
||||
|
||||
If any errors are displayed in the Windows Update Troubleshooter, use the Microsoft [Virtual Agent](https://support.microsoft.com/contact/virtual-agent/) to ask about these errors. The Virtual Agent will perform a search and provide a list of helpful links.
|
||||
|
||||
### Repair system files
|
||||
|
||||
This fix is also described in detail at [answers.microsoft.com](https://answers.microsoft.com/en-us/windows/forum/windows_10-update/system-file-check-sfc-scan-and-repair-system-files/bc609315-da1f-4775-812c-695b60477a93).
|
||||
|
||||
To check and repair system files:
|
||||
|
||||
1. Click **Start**.
|
||||
2. Type **command**.
|
||||
3. Right-click **Command Prompt** and then left-click **Run as administrator**.
|
||||
4. If you are prompted by UAC, click **Yes**.
|
||||
5. Type **sfc /scannow** and press ENTER. See the following example:
|
||||
|
||||
```
|
||||
C:\>sfc /scannow
|
||||
|
||||
Beginning system scan. This process will take some time.
|
||||
|
||||
Beginning verification phase of system scan.
|
||||
Verification 100% complete.
|
||||
|
||||
Windows Resource Protection did not find any integrity violations.
|
||||
```
|
||||
6. If you are running Windows 8.1 or later, type **DISM.exe /Online /Cleanup-image /Restorehealth** and press ENTER (the DISM command options are not available for Windows 7). See the following example:
|
||||
|
||||
```
|
||||
C:\>DISM.exe /Online /Cleanup-image /Restorehealth
|
||||
|
||||
Deployment Image Servicing and Management tool
|
||||
Version: 10.0.16299.15
|
||||
|
||||
Image Version: 10.0.16299.309
|
||||
|
||||
[==========================100.0%==========================] The restore operation completed successfully.
|
||||
The operation completed successfully.
|
||||
|
||||
```
|
||||
> [!NOTE]
|
||||
> It may take several minutes for the command operations to be completed. For more information, see [Repair a Windows Image](https://msdn.microsoft.com/windows/hardware/commercialize/manufacture/desktop/repair-a-windows-image).
|
||||
|
||||
|
||||
### Update Windows
|
||||
|
||||
You should ensure that all important updates are installed before attempting to upgrade. This includes updates to hardware drivers on your computer.
|
||||
|
||||
The Microsoft [Virtual Agent](https://support.microsoft.com/contact/virtual-agent/) can walk you through the process of making sure that Windows is updated.
|
||||
|
||||
Start the [Virtual Agent](https://support.microsoft.com/contact/virtual-agent/) and then type "update windows."
|
||||
|
||||
Answer questions that the agent asks, and follow instructions to ensure that Windows is up to date. You can also run the [Windows Update Troubleshooter](#windows-update-troubleshooter) described above.
|
||||
|
||||
Click **Start**, click power options, and then restart the computer.
|
||||
|
||||
### Uninstall non-Microsoft antivirus software
|
||||
|
||||
Use Windows Defender for protection during the upgrade.
|
||||
|
||||
Verify compatibility information, and if desired re-install antivirus applications after the upgrade. If you plan to re-install the application after upgrading, be sure that you have the installation media and all required activation information before removing the program.
|
||||
|
||||
To remove the application, go to **Control Panel\Programs\Programs and Features** and click the antivirus application, then click Uninstall. Choose **Yes** when you are asked to confirm program removal.
|
||||
|
||||
For more information, see [Windows 7 - How to properly uninstall programs](https://support.microsoft.com/help/2601726) or [Repair or remove programs in Windows 10](https://support.microsoft.com/help/4028054/windows-repair-or-remove-programs-in-windows-10).
|
||||
|
||||
### Uninstall non-essential software
|
||||
|
||||
Outdated applications can cause problems with a Windows upgrade. Removing old or non-essential applications from the computer can therefore help.
|
||||
|
||||
If you plan to reinstall the application later, be sure that you have the installation media and all required activation information before removing it.
|
||||
|
||||
To remove programs, use the same steps as are provided [above](#uninstall-non-microsoft-antivirus-software) for uninstalling non-Microsoft antivirus software, but instead of removing the antivirus application repeat the steps for all your non-essential, unused, or out-of-date software.
|
||||
|
||||
### Update firmware and drivers
|
||||
|
||||
Updating firmware (such as the BIOS) and installing hardware drivers is a somewhat advanced task. Do not attempt to update BIOS if you aren't familiar with BIOS settings or are not sure how to restore the previous BIOS version if there are problems. Most BIOS updates are provided as a "flash" update. Your manufacturer might provide a tool to perform the update, or you might be required to enter the BIOS and update it manually. Be sure to save your working BIOS settings, since some updates can reset your configuration and make the computer fail to boot if (for example) a RAID configuration is changed.
|
||||
|
||||
Most BIOS and other hardware updates can be obtained from a website maintained by your computer manufacturer. For example, Microsoft Surface device drivers can be obtained at: [Download the latest firmware and drivers for Surface devices](https://docs.microsoft.com/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices).
|
||||
|
||||
To obtain the proper firmware drivers, search for the most updated driver version provided by your computer manufacturer. Install these updates and reboot the computer after installation. Request assistance from the manufacturer if you have any questions.
|
||||
|
||||
### Ensure that "Download and install updates" is selected
|
||||
|
||||
When you begin a Windows Update, the setup process will ask you to **Get important updates**. Answer **Yes** if the computer you are updating is connected to the Internet. See the following example:
|
||||
|
||||
|
||||
|
||||
### Verify disk space
|
||||
|
||||
You can see a list of requirements for Windows 10 at [Windows 10 Specifications & System Requirements](https://www.microsoft.com/windows/windows-10-specifications). One of the requirements is that enough hard drive space be available for the installation to take place. At least 16 GB of free space must be available on the system drive to upgrade a 32-bit OS, or 20 GB for a 64-bit OS.
|
||||
|
||||
To view how much hard drive space is available on your computer, open [File Explorer](https://support.microsoft.com/help/4026617/windows-windows-explorer-has-a-new-name). In Windows 7, this was called Windows Explorer.
|
||||
|
||||
In File Explorer, click on **Computer** or **This PC** on the left, then look under **Hard Disk Drives** or under **Devices and drives**. If there are multiple drives listed, the system drive is the drive that includes a Microsoft Windows logo above the drive icon.
|
||||
|
||||
The amount of space available on the system drive will be displayed under the drive. See the following example:
|
||||
|
||||
|
||||
|
||||
In the previous example, there is 703 GB of available free space on the system drive (C:).
|
||||
|
||||
To free up additional space on the system drive, begin by running Disk Cleanup. You can access Disk Cleanup by right-clicking the hard drive icon and then clicking Properties. See the following example:
|
||||
|
||||
|
||||
|
||||
For instructions to run Disk Cleanup and other suggestions to free up hard drive space, see [Tips to free up drive space on your PC](https://support.microsoft.com/help/17421/windows-free-up-drive-space).
|
||||
|
||||
When you run Disk Cleanup and enable the option to Clean up system files, you can remove previous Windows installations which can free a large amount of space. You should only do this if you do not plan to restore the old OS version.
|
||||
|
||||
### Open an elevated command prompt
|
||||
|
||||
> [!TIP]
|
||||
> It is no longer necessary to open an elevated command prompt to run the [SetupDiag](setupdiag.md) tool. However, this is still the optimal way to run the tool.
|
||||
|
||||
To launch an elevated command prompt, press the Windows key on your keyboard, type **cmd**, press Ctrl+Shift+Enter, and then Alt+C to confirm the elevation prompt. Screenshots and other steps to open an administrator (aka elevated) command prompt are [here](https://answers.microsoft.com/en-us/windows/forum/windows_7-security/command-prompt-admin-windows-7/6a188166-5e23-461f-b468-f325688ec8c7).
|
||||
|
||||
Note: When you open an elevated command prompt, you will usually start in the **C:\WINDOWS\system32** directory. To run a program that you recently downloaded, you must change to the directory where the program is located. Alternatively, you can move or copy the program to a location on the computer that is automatically searched. These directories are listed in the [PATH variable](https://answers.microsoft.com/windows/forum/windows_10-other_settings-winpc/adding-path-variable/97300613-20cb-4d85-8d0e-cc9d3549ba23).
|
||||
|
||||
If this is too complicated for you, then use File Explorer to create a new folder under C: with a short name such as "new" then copy or move the programs you want to run (like SetupDiag) to this folder using File Explorer. When you open an elevated command prompt, change to this directory by typing "cd c:\new" and now you can run the programs in that folder.
|
||||
|
||||
If you downloaded the SetupDiag.exe program to your computer, then copied it to the folder C:\new, and you opened an elevated command prompt then typed cd c:\new to change to this directory, you can just type setupdiag and press ENTER to run the program. This program will analyze the files on your computer to see why a Windows Upgrade failed and if the reason was a common one, it will report this reason. It will not fix the problem for you but knowing why the upgrade failed enables you to take steps to fix the problem.
|
||||
|
||||
## Related topics
|
||||
|
||||
[Windows 10 FAQ for IT professionals](https://technet.microsoft.com/windows/dn798755.aspx)
|
||||
<br>[Windows 10 Enterprise system requirements](https://technet.microsoft.com/windows/dn798752.aspx)
|
||||
<br>[Windows 10 Specifications](https://www.microsoft.com/windows/Windows-10-specifications)
|
||||
<br>[Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/en-US/home?category=Windows10ITPro)
|
||||
<br>[Fix Windows Update errors by using the DISM or System Update Readiness tool](https://support.microsoft.com/kb/947821)
|
||||
|
||||
@ -3,7 +3,7 @@ title: Resolution procedures - Windows IT Pro
|
||||
ms.reviewer:
|
||||
manager: laurawi
|
||||
ms.author: greglin
|
||||
description: Resolve Windows 10 upgrade errors for ITPros. Technical information for IT professionals to help diagnose Windows setup errors.
|
||||
description: Discover general troubleshooting procedures for dealing with 0xC1900101, the generic rollback code thrown when something goes wrong during a Windows 10 upgrade.
|
||||
keywords: deploy, error, troubleshoot, windows, 10, upgrade, code, rollback, ITPro
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
|
||||
@ -3,7 +3,7 @@ title: Troubleshoot Windows 10 upgrade errors - Windows IT Pro
|
||||
ms.reviewer:
|
||||
manager: laurawi
|
||||
ms.author: greglin
|
||||
description: Resolve Windows 10 upgrade errors for ITPros. Technical information for IT professionals to help diagnose Windows setup errors.
|
||||
description: Understanding the Windows 10 upgrade process can help you troubleshoot errors when something goes wrong. Find out more with this guide.
|
||||
keywords: deploy, error, troubleshoot, windows, 10, upgrade, code, rollback, ITPro
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
|
||||
@ -3,7 +3,7 @@ title: Upgrade error codes - Windows IT Pro
|
||||
ms.reviewer:
|
||||
manager: laurawi
|
||||
ms.author: greglin
|
||||
description: Resolve Windows 10 upgrade errors for ITPros. Technical information for IT professionals to help diagnose Windows setup errors.
|
||||
description: Understand the error codes that may come up if something goes wrong during the Windows 10 upgrade process.
|
||||
keywords: deploy, error, troubleshoot, windows, 10, upgrade, code, rollback, ITPro
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
@ -30,7 +30,7 @@ If the upgrade process is not successful, Windows Setup will return two codes:
|
||||
1. **A result code**: The result code corresponds to a specific Win32 or NTSTATUS error.
|
||||
2. **An extend code**: The extend code contains information about both the *phase* in which an error occurred, and the *operation* that was being performed when the error occurred.
|
||||
|
||||
>For example, a result code of **0xC1900101** with an extend code of **0x4000D** will be returned as: **0xC1900101 - 0x4000D**.
|
||||
For example, a result code of **0xC1900101** with an extend code of **0x4000D** will be returned as: **0xC1900101 - 0x4000D**.
|
||||
|
||||
Note: If only a result code is returned, this can be because a tool is being used that was not able to capture the extend code. For example, if you are using the [Windows 10 Upgrade Assistant](https://support.microsoft.com/kb/3159635) then only a result code might be returned.
|
||||
|
||||
@ -39,7 +39,7 @@ Note: If only a result code is returned, this can be because a tool is being use
|
||||
|
||||
## Result codes
|
||||
|
||||
>A result code of **0xC1900101** is generic and indicates that a rollback occurred. In most cases, the cause is a driver compatibility issue. <br>To troubleshoot a failed upgrade that has returned a result code of 0xC1900101, analyze the extend code to determine the Windows Setup phase, and see the [Resolution procedures](resolution-procedures.md) section later in this article.
|
||||
A result code of **0xC1900101** is generic and indicates that a rollback occurred. In most cases, the cause is a driver compatibility issue. <br>To troubleshoot a failed upgrade that has returned a result code of 0xC1900101, analyze the extend code to determine the Windows Setup phase, and see the [Resolution procedures](resolution-procedures.md) section later in this article.
|
||||
|
||||
The following set of result codes are associated with [Windows Setup](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-setup-command-line-options) compatibility warnings:
|
||||
|
||||
@ -77,7 +77,8 @@ Some result codes are self-explanatory, whereas others are more generic and requ
|
||||
|
||||
## Extend codes
|
||||
|
||||
>**Important**: Extend codes reflect the current Windows 10 upgrade process, and might change in future releases of Windows 10. The codes discussed in this section apply to Windows 10 version 1607, also known as the Anniversary Update.
|
||||
>[!IMPORTANT]
|
||||
>Extend codes reflect the current Windows 10 upgrade process, and might change in future releases of Windows 10. The codes discussed in this section apply to Windows 10 version 1607, also known as the Anniversary Update.
|
||||
|
||||
Extend codes can be matched to the phase and operation when an error occurred. To match an extend code to the phase and operation:
|
||||
|
||||
|
||||
@ -3,7 +3,7 @@ title: Windows error reporting - Windows IT Pro
|
||||
ms.reviewer:
|
||||
manager: laurawi
|
||||
ms.author: greglin
|
||||
description: Resolve Windows 10 upgrade errors for ITPros. Technical information for IT professionals to help diagnose Windows setup errors.
|
||||
description: Learn how to review the events generated by Windows Error Reporting when something goes wrong during Windows 10 setup.
|
||||
keywords: deploy, error, troubleshoot, windows, 10, upgrade, code, rollback, ITPro
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Windows 10 deployment tools
|
||||
description: Learn about the tools available to deploy Windows 10.
|
||||
description: Browse through documentation describing Windows 10 deployment tools. Learn how to use these these tools to successfully deploy Windows 10 to your organization.
|
||||
ms.assetid: 5C4B0AE3-B2D0-4628-9E73-606F3FAA17BB
|
||||
ms.reviewer:
|
||||
manager: laurawi
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Prepare & Deploy Windows AD FS certificate trust (Windows Hello for Business)
|
||||
description: How to Prepare and Deploy Windows Server 2016 Active Directory Federation Services (AD FS) for Windows Hello for Business
|
||||
description: How to Prepare and Deploy Windows Server 2016 Active Directory Federation Services (AD FS) for Windows Hello for Business, using certificate trust.
|
||||
keywords: identity, PIN, biometric, Hello, passport
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Prepare & Deploy Windows Active Directory Federation Services with key trust (Windows Hello for Business)
|
||||
description: How to Prepare and Deploy Windows Server 2016 Active Directory Federation Services for Windows Hello for Business
|
||||
description: How to Prepare and Deploy Windows Server 2016 Active Directory Federation Services for Windows Hello for Business using key trust.
|
||||
keywords: identity, PIN, biometric, Hello, passport
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: BitLocker and Active Directory Domain Services (AD DS) FAQ (Windows 10)
|
||||
description: This topic for the IT professional answers frequently asked questions concerning the requirements to use, upgrade, deploy and administer, and key management policies for BitLocker.
|
||||
description: Learn more about how BitLocker and Active Directory Domain Services (AD DS) can work together to keep devices secure.
|
||||
ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee
|
||||
ms.reviewer:
|
||||
ms.prod: w10
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: BitLocker deployment and administration FAQ (Windows 10)
|
||||
description: This topic for the IT professional answers frequently asked questions concerning the requirements to use, upgrade, deploy and administer, and key management policies for BitLocker.
|
||||
description: Browse frequently asked questions about BitLocker deployment and administration, such as, "Can BitLocker deployment be automated in an enterprise environment?"
|
||||
ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee
|
||||
ms.reviewer:
|
||||
ms.prod: w10
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: BitLocker FAQ (Windows 10)
|
||||
description: This topic for the IT professional answers frequently asked questions concerning the requirements to use, upgrade, deploy and administer, and key management policies for BitLocker.
|
||||
description: Find the answers you need by exploring this brief hub page listing FAQ pages for various aspects of BitLocker.
|
||||
ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee
|
||||
ms.reviewer:
|
||||
ms.prod: w10
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: BitLocker Network Unlock FAQ (Windows 10)
|
||||
description: Browse frequently asked questions about the requirements to use, upgrade, deploy and administer, and key management policies for BitLocker.
|
||||
description: Familiarize yourself with BitLocker Network Unlock. Learn how it can make desktop and server management easier within domain environments.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: explore
|
||||
ms.sitesec: library
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: BitLocker Security FAQ (Windows 10)
|
||||
description: This topic for the IT professional answers frequently asked questions concerning the requirements to use, upgrade, deploy and administer, and key management policies for BitLocker.
|
||||
description: Learn more about how BitLocker security works. Browse frequently asked questions, such as, "What form of encryption does BitLocker use?"
|
||||
ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee
|
||||
ms.reviewer:
|
||||
ms.prod: w10
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: BitLocker To Go FAQ (Windows 10)
|
||||
description: This topic for the IT professional answers frequently asked questions concerning the requirements to use, upgrade, deploy and administer, and key management policies for BitLocker.
|
||||
description: Learn more about BitLocker To Go — BitLocker drive encryption for removable drives.
|
||||
ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee
|
||||
ms.reviewer:
|
||||
ms.author: dansimp
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: BitLocker Upgrading FAQ (Windows 10)
|
||||
description: This topic for the IT professional answers frequently asked questions concerning the requirements to use, upgrade, deploy and administer, and key management policies for BitLocker.
|
||||
description: Learn more about upgrading systems that have BitLocker enabled.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: explore
|
||||
ms.sitesec: library
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Using BitLocker with other programs FAQ (Windows 10)
|
||||
description: This topic for the IT professional answers frequently asked questions concerning the requirements to use, upgrade, deploy and administer, and key management policies for BitLocker.
|
||||
description: Learn how to integrate BitLocker with other software on your device.
|
||||
ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee
|
||||
ms.reviewer:
|
||||
ms.prod: w10
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Hello World
|
||||
title: Hello World for Microsoft Defender Advanced Threat Protection API
|
||||
ms.reviewer:
|
||||
description: Use this API to run advanced queries
|
||||
description: Create a practice 'Hello world'-style API call to the Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) API.
|
||||
keywords: apis, supported apis, advanced hunting, query
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Advanced Hunting with Powershell API Guide
|
||||
ms.reviewer:
|
||||
description: Use this API to run advanced queries
|
||||
description: Walk through a practice scenario, complete with code samples, querying several Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) APIs.
|
||||
keywords: apis, supported apis, advanced hunting, query
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
@ -30,7 +30,7 @@ In this section we share PowerShell samples to
|
||||
- Use token to retrieve the latest alerts in Microsoft Defender ATP
|
||||
- For each alert, if the alert has medium or high priority and is still in progress, check how many times the machine has connected to suspicious URL.
|
||||
|
||||
>**Prerequisite**: You first need to [create an app](apis-intro.md).
|
||||
**Prerequisite**: You first need to [create an app](apis-intro.md).
|
||||
|
||||
## Preparation Instructions
|
||||
|
||||
@ -40,16 +40,16 @@ In this section we share PowerShell samples to
|
||||
Set-ExecutionPolicy -ExecutionPolicy Bypass
|
||||
```
|
||||
|
||||
>For more details, refer to [PowerShell documentation](https://docs.microsoft.com/powershell/module/microsoft.powershell.security/set-executionpolicy)
|
||||
For more details, refer to [PowerShell documentation](https://docs.microsoft.com/powershell/module/microsoft.powershell.security/set-executionpolicy)
|
||||
|
||||
## Get token
|
||||
|
||||
- Run the below
|
||||
Run the below:
|
||||
|
||||
> - $tenantId: ID of the tenant on behalf of which you want to run the query (i.e., the query will be run on the data of this tenant)
|
||||
> - $appId: ID of your AAD app (the app must have 'Run advanced queries' permission to Microsoft Defender ATP)
|
||||
> - $appSecret: Secret of your AAD app
|
||||
> - $suspiciousUrl: The URL
|
||||
- $tenantId: ID of the tenant on behalf of which you want to run the query (i.e., the query will be run on the data of this tenant)
|
||||
- $appId: ID of your AAD app (the app must have 'Run advanced queries' permission to Microsoft Defender ATP)
|
||||
- $appSecret: Secret of your AAD app
|
||||
- $suspiciousUrl: The URL
|
||||
|
||||
|
||||
```
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Advanced Hunting API
|
||||
ms.reviewer:
|
||||
description: Use this API to run advanced queries
|
||||
description: Use the Advanced hunting API to run advanced queries on Microsoft Defender Advanced Threat Protection
|
||||
keywords: apis, supported apis, advanced hunting, query
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
|
||||
@ -22,8 +22,8 @@ ms.topic: conceptual
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-supported-response-apis-abovefoldlink)
|
||||
> [!TIP]
|
||||
> Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-supported-response-apis-abovefoldlink)
|
||||
|
||||
Learn about the supported response related API calls you can run and details such as the required request headers, and expected response from the calls.
|
||||
|
||||
@ -46,6 +46,3 @@ Get MachineActions collection | Run this to get MachineAction collection.
|
||||
Get FileActions collection | Run this to get FileActions collection.
|
||||
Get FileMachineAction object | Run this to get FileMachineAction object.
|
||||
Get FileMachineActions collection | Run this to get FileMachineAction collection.
|
||||
|
||||
|
||||
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Audit Windows Defender Application Control policies (Windows 10)
|
||||
description: Windows Defender Application Control (WDAC) restricts which applications users are allowed to run and the code that runs in the system core.
|
||||
description: Audits allow admins to discover apps that were missed during an initial policy scan and to identify new apps that were installed since the policy was created.
|
||||
keywords: whitelisting, security, malware
|
||||
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
|
||||
ms.prod: w10
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Create a code signing cert for Windows Defender Application Control (Windows 10)
|
||||
description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core.
|
||||
description: Learn how to set up a publicly-issued code signing certificate, so you can sign catalog files or WDAC policies internally.
|
||||
keywords: whitelisting, security, malware
|
||||
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
|
||||
ms.reviewer:
|
||||
@ -95,7 +95,8 @@ Now that the template is available to be issued, you must request one from the c
|
||||
|
||||
6. Enroll and finish.
|
||||
|
||||
> **Note** If a certificate manager is required to approve any issued certificates and you selected to require management approval on the template, the request will need to be approved in the CA before it will be issued to the client.
|
||||
>[!NOTE]
|
||||
>If a certificate manager is required to approve any issued certificates and you selected to require management approval on the template, the request will need to be approved in the CA before it will be issued to the client.
|
||||
|
||||
This certificate must be installed in the user’s personal store on the computer that will be signing the catalog files and code integrity policies. If the signing is going to be taking place on the computer on which you just requested the certificate, exporting the certificate to a .pfx file will not be required because it already exists in your personal store. If you are signing on another computer, you will need to export the .pfx certificate with the necessary keys and properties. To do so, complete the following steps:
|
||||
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Create a WDAC policy for fixed-workload devices using a reference computer (Windows 10)
|
||||
description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core.
|
||||
description: To create a Windows Defender Application Control (WDAC) policy for fixed-workload devices within your organization, follow this guide.
|
||||
keywords: whitelisting, security, malware
|
||||
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
|
||||
ms.prod: w10
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Deploy catalog files to support Windows Defender Application Control (Windows 10)
|
||||
description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core.
|
||||
description: Catalog files simplify running unsigned applications in the presence of a Windows Defender Application Control (WDAC) policy.
|
||||
keywords: whitelisting, security, malware
|
||||
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
|
||||
ms.prod: w10
|
||||
@ -17,7 +17,7 @@ manager: dansimp
|
||||
ms.date: 02/28/2018
|
||||
---
|
||||
|
||||
# Deploy catalog files to support Windows Defender Application Control
|
||||
# Deploy catalog files to support Windows Defender Application Control
|
||||
|
||||
**Applies to:**
|
||||
|
||||
@ -80,7 +80,8 @@ To create a catalog file, you use a tool called **Package Inspector**. You must
|
||||
|
||||
`PackageInspector.exe Stop C: -Name $CatFileName -cdfpath $CatDefName`
|
||||
|
||||
> **Note** Package Inspector catalogs the hash values for each discovered binary file. If the applications that were scanned are updated, complete this process again to trust the new binaries’ hash values.
|
||||
>[!NOTE]
|
||||
>Package Inspector catalogs the hash values for each discovered binary file. If the applications that were scanned are updated, complete this process again to trust the new binaries’ hash values.
|
||||
|
||||
When finished, the files will be saved to your desktop. You can double-click the \*.cat file to see its contents, and you can view the \*.cdf file with a text editor.
|
||||
|
||||
@ -129,9 +130,10 @@ To sign the existing catalog file, copy each of the following commands into an e
|
||||
|
||||
`<path to signtool.exe> sign /n "ContosoDGSigningCert" /fd sha256 /v $CatFileName`
|
||||
|
||||
> **Note** The *<Path to signtool.exe>* variable should be the full path to the Signtool.exe utility. *ContosoDGSigningCert* represents the subject name of the certificate that you will use to sign the catalog file. This certificate should be imported to your personal certificate store on the computer on which you are attempting to sign the catalog file.
|
||||
>[!NOTE]
|
||||
>The *<Path to signtool.exe>* variable should be the full path to the Signtool.exe utility. *ContosoDGSigningCert* represents the subject name of the certificate that you will use to sign the catalog file. This certificate should be imported to your personal certificate store on the computer on which you are attempting to sign the catalog file.
|
||||
>
|
||||
> **Note** For additional information about Signtool.exe and all additional switches, visit the [Sign Tool page](https://docs.microsoft.com/dotnet/framework/tools/signtool-exe).
|
||||
>For additional information about Signtool.exe and all additional switches, visit the [Sign Tool page](https://docs.microsoft.com/dotnet/framework/tools/signtool-exe).
|
||||
|
||||
4. Verify the catalog file digital signature. Right-click the catalog file, and then click **Properties**. On the **Digital Signatures** tab, verify that your signing certificate exists with a **sha256** algorithm, as shown in Figure 1.
|
||||
|
||||
@ -219,7 +221,8 @@ Before you begin testing the deployed catalog file, make sure that the catalog s
|
||||
|
||||
As an alternative to Group Policy, you can use System Center Configuration Manager to deploy catalog files to the managed computers in your environment. This approach can simplify the deployment and management of multiple catalog files as well as provide reporting around which catalog each client or collection has deployed. In addition to the deployment of these files, System Center Configuration Manager can also be used to inventory the currently deployed catalog files for reporting and compliance purposes. Complete the following steps to create a new deployment package for catalog files:
|
||||
|
||||
> **Note** The following example uses a network share named \\\\Shares\\CatalogShare as a source for the catalog files. If you have collection specific catalog files, or prefer to deploy them individually, use whichever folder structure works best for your organization.
|
||||
>[!NOTE]
|
||||
>The following example uses a network share named \\\\Shares\\CatalogShare as a source for the catalog files. If you have collection specific catalog files, or prefer to deploy them individually, use whichever folder structure works best for your organization.
|
||||
|
||||
1. Open the Configuration Manager console, and select the Software Library workspace.
|
||||
|
||||
@ -293,7 +296,8 @@ Before you begin testing the deployed catalog file, make sure that the catalog s
|
||||
|
||||
When catalog files have been deployed to the computers within your environment, whether by using Group Policy or System Center Configuration Manager, you can inventory them with the software inventory feature of System Center Configuration Manager. The following process walks you through the enablement of software inventory to discover catalog files on your managed systems through the creation and deployment of a new client settings policy.
|
||||
|
||||
> **Note** A standard naming convention for your catalog files will significantly simplify the catalog file software inventory process. In this example, *-Contoso* has been added to all catalog file names.
|
||||
>[!NOTE]
|
||||
>A standard naming convention for your catalog files will significantly simplify the catalog file software inventory process. In this example, *-Contoso* has been added to all catalog file names.
|
||||
|
||||
1. Open the Configuration Manager console, and select the Administration workspace.
|
||||
|
||||
@ -315,7 +319,8 @@ When catalog files have been deployed to the computers within your environment,
|
||||
|
||||
6. In the **Name** box, type a name such as **\*Contoso.cat**, and then click **Set**.
|
||||
|
||||
> **Note** When typing the name, follow your naming convention for catalog files.
|
||||
>[!NOTE]
|
||||
>When typing the name, follow your naming convention for catalog files.
|
||||
|
||||
7. In the **Path Properties** dialog box, select **Variable or path name**, and then type **C:\\Windows\\System32\\catroot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}** in the box, as shown in Figure 10.
|
||||
|
||||
@ -337,7 +342,8 @@ At the time of the next software inventory cycle, when the targeted clients rece
|
||||
|
||||
4. In Resource Explorer, navigate to Software\\File Details to view the inventoried catalog files.
|
||||
|
||||
> **Note** If nothing is displayed in this view, navigate to Software\\Last Software Scan in Resource Explorer to verify that the client has recently completed a software inventory scan.
|
||||
>[!NOTE]
|
||||
>If nothing is displayed in this view, navigate to Software\\Last Software Scan in Resource Explorer to verify that the client has recently completed a software inventory scan.
|
||||
|
||||
## Related topics
|
||||
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Deploy WDAC policies via Group Policy (Windows 10)
|
||||
description: Windows Defender Application Control (WDAC) restricts which applications users are allowed to run and the code that runs in the system core.
|
||||
description: Windows Defender Application Control (WDAC) policies can easily be deployed and managed with Group Policy. Learn how by following this step-by-step guide.
|
||||
keywords: whitelisting, security, malware
|
||||
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
|
||||
ms.prod: w10
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Deploy Windows Defender Application Control (WDAC) policies by using Microsoft Intune (Windows 10)
|
||||
description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core.
|
||||
description: You can use Microsoft Intune to configure Windows Defender Application Control (WDAC). Learn how with this step-by-step guide.
|
||||
keywords: whitelisting, security, malware
|
||||
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
|
||||
ms.prod: w10
|
||||
@ -27,7 +27,7 @@ ms.date: 05/17/2018
|
||||
- Windows 10
|
||||
- Windows Server 2016
|
||||
|
||||
You can use Microsoft Intune to configure Windows Defender Application Control (WDAC). You can configure Windows 10 client computers to only run Windows components and Microsoft Store apps, or let them also run reputable apps defined by the Intelligent Security Graph.
|
||||
You can use Microsoft Intune to configure Windows Defender Application Control (WDAC). You can configure Windows 10 client computers to only run Windows components and Microsoft Store apps, or let them also run reputable apps defined by the Intelligent Security Graph.
|
||||
|
||||
1. Open the Microsoft Intune portal and click **Device configuration** > **Profiles** > **Create profile**.
|
||||
|
||||
@ -37,7 +37,7 @@ You can use Microsoft Intune to configure Windows Defender Application Control (
|
||||
|
||||
4. Click **Configure** > **Windows Defender Application Control**, choose from the following settings and then click **OK**:
|
||||
|
||||
- **Application control code intergity policies**: Select **Audit only** to log events but not block any apps from running or select **Enforce** to allow only Windows components and Store apps to run.
|
||||
- **Application control code integrity policies**: Select **Audit only** to log events but not block any apps from running or select **Enforce** to allow only Windows components and Store apps to run.
|
||||
- **Trust apps with good reputation**: Select **Enable** to allow reputable apps as defined by the Intelligent Security Graph to run in addition to Windows components and Store apps.
|
||||
|
||||
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Enforce Windows Defender Application Control (WDAC) policies (Windows 10)
|
||||
description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core.
|
||||
description: Learn how to test a Windows Defender Application Control (WDAC) policy in enforced mode by following these steps in an elevated Windows PowerShell session.
|
||||
keywords: whitelisting, security, malware
|
||||
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
|
||||
ms.prod: w10
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Manage packaged apps with WDAC (Windows 10)
|
||||
description: Windows Defender Application Control (WDAC) restricts which applications users are allowed to run and the code that runs in the system core.
|
||||
description: Packaged apps, also known as Universal Windows apps, allow you to control the entire app by using a single Windows Defender Application Control (WDAC) rule.
|
||||
keywords: whitelisting, security, malware
|
||||
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
|
||||
ms.prod: w10
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Merge Windows Defender Application Control policies (Windows 10)
|
||||
description: Windows Defender Application Control (WDAC) restricts which applications users are allowed to run and the code that runs in the system core.
|
||||
description: Because each computer running Windows 10 can have only one WDAC policy, you will occasionally need to merge two or more policies. Learn how with this guide.
|
||||
keywords: whitelisting, security, malware
|
||||
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
|
||||
ms.prod: w10
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Query Application Control events with Advanced Hunting (Windows 10)
|
||||
description: Learn about Windows Defender Application Guard and how it helps to combat malicious content and malware out on the Internet.
|
||||
description: Learn how to query Windows Defender Application Control events across your entire organization by using Advanced Hunting.
|
||||
keywords: whitelisting, security, malware
|
||||
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
|
||||
ms.prod: w10
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Use code signing to simplify application control for classic Windows applications (Windows 10)
|
||||
description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core.
|
||||
description: With embedded signing, your WDAC policies typically do not have to be updated when an app is updated. To set this up, you can choose from a variety of methods.
|
||||
keywords: whitelisting, security, malware
|
||||
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
|
||||
ms.reviewer:
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Use the Device Guard Signing Portal in the Microsoft Store for Business (Windows 10)
|
||||
description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core.
|
||||
description: You can sign code integrity policies with the Device Guard signing portal to prevent them from being tampered with after they're deployed.
|
||||
keywords: whitelisting, security, malware
|
||||
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
|
||||
ms.reviewer:
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Use a Windows Defender Application Control policy to control specific plug-ins, add-ins, and modules (Windows 10)
|
||||
description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core.
|
||||
description: WDAC policies can be used not only to control applications, but also to control whether specific plug-ins, add-ins, and modules can run from specific apps.
|
||||
keywords: whitelisting, security, malware
|
||||
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
|
||||
ms.reviewer:
|
||||
@ -44,7 +44,7 @@ $rule += New-CIPolicyRule -DriverFilePath '.\temp\addin2.dll' -Level FileName -A
|
||||
New-CIPolicy -Rules $rule -FilePath ".\AllowERPAddins.xml" -UserPEs
|
||||
```
|
||||
|
||||
As another example, to create a WDAC policy that blocks **addin3.dll** from running in Microsoft Word, run the following command. You must include the `-Deny` option to block the specified add-ins in the specifed application:
|
||||
As another example, to create a WDAC policy that blocks **addin3.dll** from running in Microsoft Word, run the following command. You must include the `-Deny` option to block the specified add-ins in the specified application:
|
||||
|
||||
```
|
||||
$rule = New-CIPolicyRule -DriverFilePath '.\temp\addin3.dll' -Level FileName -Deny -AppID '.\winword.exe'
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: What's new in Windows 10, versions 1507 and 1511 (Windows 10)
|
||||
description: This topic lists new and updated topics in the What's new in Windows 10 documentation for Windows 10 and Windows 10 Mobile.
|
||||
description: This topic lists new and updated topics in the What's new in Windows 10 documentation for Windows 10 (versions 1507 and 1511) and Windows 10 Mobile.
|
||||
ms.assetid: 75F285B0-09BE-4821-9B42-37B9BE54CEC6
|
||||
ms.reviewer:
|
||||
ms.prod: w10
|
||||
@ -143,7 +143,7 @@ The logon event ID 4624 has been updated to include more verbose information to
|
||||
A list of all of the groups in the user's token.
|
||||
6. **RestrictedAdminMode** String: yes or no
|
||||
If the user logs into the PC in restricted admin mode with Remote Desktop, this field will be yes.
|
||||
For more info on restricted admin mode, see [Restricted Admin mode for RDP](http://blogs.technet.com/b/kfalde/archive/2013/08/14/restricted-admin-mode-for-rdp-in-windows-8-1-2012-r2.aspx).
|
||||
For more information about restricted admin mode, see [Restricted Admin mode for RDP](https://blogs.technet.com/b/kfalde/archive/2013/08/14/restricted-admin-mode-for-rdp-in-windows-8-1-2012-r2.aspx).
|
||||
|
||||
##### <a href="" id="bkmk-process"></a>New fields in the process creation event
|
||||
|
||||
@ -216,7 +216,8 @@ Some things that you can check on the device are:
|
||||
- Is BitLocker Drive Encryption supported and enabled?
|
||||
- Is SecureBoot supported and enabled?
|
||||
|
||||
> **Note** The device must be running Windows 10 and it must support at least TPM 2.0.
|
||||
>[!NOTE]
|
||||
>The device must be running Windows 10 and it must support at least TPM 2.0.
|
||||
|
||||
[Learn how to deploy and manage TPM within your organization](/windows/device-security/tpm//trusted-platform-module-overview).
|
||||
|
||||
@ -279,8 +280,8 @@ Enterprises have the following identity and management choices.
|
||||
| Grouping | Domain join; Workgroup; Azure AD join |
|
||||
| Device management | Group Policy; System Center Configuration Manager; Microsoft Intune; other MDM solutions; Exchange ActiveSync; Windows PowerShell; Windows Management Instrumentation (WMI) |
|
||||
|
||||
> **Note**
|
||||
With the release of Windows Server 2012 R2, Network Access Protection (NAP) was deprecated and the NAP client has now been removed in Windows 10. For more information about support lifecycles, see [Microsoft Support Lifecycle](https://go.microsoft.com/fwlink/p/?LinkID=613512).
|
||||
>[!NOTE]
|
||||
>With the release of Windows Server 2012 R2, Network Access Protection (NAP) was deprecated and the NAP client has now been removed in Windows 10. For more information about support lifecycles, see [Microsoft Support Lifecycle](https://go.microsoft.com/fwlink/p/?LinkID=613512).
|
||||
|
||||
|
||||
### Device lockdown
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: What's new in Windows 10, version 1607 (Windows 10)
|
||||
description: This topic lists new and updated topics in the What's new in Windows 10 documentation for Windows 10 and Windows 10 Mobile.
|
||||
description: This topic lists new and updated topics in the What's new in Windows 10 documentation for Windows 10 (version 1607) and Windows 10 Mobile.
|
||||
keywords: ["What's new in Windows 10", "Windows 10", "anniversary update"]
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user