merging master

.localization-config

@@ -0,0 +1,8 @@
+{
+  "locales": [ "zh-cn" ],
+  "files": ["!/*.md", "**/**/*.md", "**/*.md"],
+  "includeDependencies": true,
+  "autoPush": true,
+  "xliffVersion": "2.0",
+  "useJavascriptMarkdownTransformer": true
+}

.openpublishing.publish.config.json

@@ -61,6 +61,16 @@
             "type_mapping": {
                 "Conceptual": "Content"
             }
+        },
+        {
+            "docset_name": "education",
+            "build_output_subfolder": "education",
+            "locale": "en-us",
+            "version": 0,
+            "open_to_public_contributors": "false",
+            "type_mapping": {
+                "Conceptual": "Content"
+            }
         }
     ],
     "notification_subscribers": ["brianlic@microsoft.com"],

browsers/edge/Index.md

@@ -25,6 +25,7 @@ Microsoft Edge lets you stay up-to-date through the Windows Store and to manage
 
 | Topic                  | Description                         |
 | -----------------------| ----------------------------------- |
+|[Change history for Microsoft Edge](change-history-for-microsoft-edge.md) |Lists new and updated topics in the Microsoft Edge documentation for both Windows 10 and Windows 10 Mobile. |
 | [Microsoft Edge requirements and language support](hardware-and-software-requirements.md) | Microsoft Edge is pre-installed on all Windows 10-capable devices that meet the minimum system requirements and are on the supported language list.|
 | [Available policies for Microsoft Edge](available-policies.md)  | Microsoft Edge works with Group Policy and Microsoft Intune to help you manage your organization's computer settings. <p>Group Policy objects (GPO's) can include registry-based Administrative Template policy settings, security settings, software deployment information, scripts, folder redirection, and preferences. By using Group Policy and Intune, you can set up a policy setting once, and then copy that setting onto many computers. For example, you can set up multiple security settings in a GPO that's linked to a domain, and then apply all of those settings to every computer in the domain. |
 | [Use Enterprise Mode to improve compatibility](emie-to-improve-compatibility.md) | If you have specific web sites and apps that you know have compatibility problems with Microsoft Edge, you can use the Enterprise Mode site list so that the web sites will automatically open using Internet Explorer 11. Additionally, if you know that your intranet sites aren't going to work properly with Microsoft Edge, you can set all intranet sites to automatically open using IE11. <p>Using Enterprise Mode means that you can continue to use Microsoft Edge as your default browser, while also ensuring that your apps continue working on IE11. |

browsers/edge/TOC.md

@@ -1,4 +1,5 @@
 #[Microsoft Edge - Deployment Guide for IT Pros](index.md)
+##[Change History for Microsoft Edge](change-history-for-microsoft-edge.md)
 ##[Microsoft Edge requirements and language support](hardware-and-software-requirements.md)
 ##[Available policies for Microsoft Edge](available-policies.md)
 ##[Use Enterprise Mode to improve compatibility](emie-to-improve-compatibility.md)

browsers/edge/available-policies.md

@@ -12,45 +12,43 @@ title: Available policies for Microsoft Edge (Microsoft Edge for IT Pros)
 
 **Applies to:**
 
--   Windows 10
+-   Windows 10 Insider Preview
 -   Windows 10 Mobile
 
+<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
+
 Microsoft Edge works with Group Policy and Microsoft Intune to help you manage your organization's computer settings. Group Policy objects (GPO's) can include registry-based Administrative Template policy settings, security settings, software deployment information, scripts, folder redirection, and preferences.
 
 By using Group Policy and Intune, you can set up a policy setting once, and then copy that setting onto many computers. For example, you can set up multiple security settings in a GPO that's linked to a domain, and then apply all of those settings to every computer in the domain.
 <p>**Note**<br>For more info about Group Policy, see the [Group Policy TechCenter](http://go.microsoft.com/fwlink/p/?LinkId=214514). This site provides links to the latest technical documentation, videos, and downloads for Group Policy. For more info about the tools you can use to change your Group Policy objects, see the Internet Explorer 11 topics, [Group Policy and the Group Policy Management Console (GPMC)](http://go.microsoft.com/fwlink/p/?LinkId=617921), [Group Policy and the Local Group Policy Editor](http://go.microsoft.com/fwlink/p/?LinkId=617922), [Group Policy and the Advanced Group Policy Management (AGPM)](http://go.microsoft.com/fwlink/p/?LinkId=617923), and [Group Policy and Windows Powershell](http://go.microsoft.com/fwlink/p/?LinkId=617924).
 
- 
-
 ## Group Policy settings
-
 Microsoft Edge works with these Group Policy settings (`Computer Configuration\Administrative Templates\Windows Components\Microsoft Edge\`) to help you manage your company's web browser configurations:
 
-| Policy name                                  | Description                   | Options                                                |
+| Policy name |Supported versions |Description |Options |
-| -------------------------------------------- | ----------------------------- | ------------------------------------------------------- |
+|-------------|------------|-------------|--------|
-| Allow employees to send Do Not Track headers | Whether employees can send Do Not Track headers to websites that request tracking info. | **Enable:** Employees can send Do Not Track headers to websites requesting tracking info.<p> **Disable or not configured (default):** Stops employees from sending Do Not Track headers to websites requesting tracking info. |
+|Allow Developer Tools |Windows 10, Version 1511 or later |This policy setting lets you decide whether F12 Developer Tools are available on Microsoft Edge.<p>If you enable or don’t configure this setting, the F12 Developer Tools are available in Microsoft Edge.<p>If you disable this setting, the F12 Developer Tools aren’t available in Microsoft Edge. |**Enabled or not configured (default):** Shows the F12 Developer Tools on Microsoft Edge.<p>**Disabled:** Hides the F12 Developer Tools on Microsoft Edge. |
-| Turn off web content in new tab page | Decide what Microsoft Edge shows when opening a new tab. | **Enable or not configured (default):** Employees can see the new tab page with Top Sites, Top Sites with suggested content, or a blank page. <p> **Disable:** Employees see an empty tab and are unable to change the **Open new tabs with** setting. |
+|Allow InPrivate browsing |Windows 10, Version 1511 or later |This policy setting lets you decide whether employees can browse using InPrivate website browsing.<p>If you enable or don’t configure this setting, employees can use InPrivate website browsing.<p>If you disable this setting, employees can’t use InPrivate website browsing. |**Enabled or not configured (default):** Lets employees use InPrivate website browsing.<p>**Disabled:** Stops employees from using InPrivate website browsing. |
-| Configure cookies | Decide how your company deals with cookies. | **Enable or not configured (default):** Lets you decide how your company treats cookies. If you use this option, you must also choose whether to <ul><li>**Allow all cookies (default)**. Allows all cookies from all websites</li><li>**Block all cookies**. Blocks all cookies from all websites.</li><li>**Block only 3rd-party cookies**. Blocks only cookies from 3rd-party websites.</li></ul><p> **Disable:** Allows all cookies from all websites. |
+|Allow web content on New Tab page |Windows 10 or later |This policy setting lets you configure what appears when Microsoft Edge opens a new tab. By default, Microsoft Edge opens the New Tab page. If you use this setting, employees can’t change it.<p>If you enable this setting, Microsoft Edge opens a new tab with the New Tab page.<p>If you disable this setting, Microsoft Edge opens a new tab with a blank page.<p>If you don’t configure this setting, employees can choose how new tabs appears. |**Not configured (default):** Employees see web content on New Tab page, but can change it.<p>**Enabled:** Employees see web content on New Tab page.<p>**Disabled:** Employees always see an empty new tab. |
-| Configure corporate Home pages | Choose which corporate Home pages should appear for domain-joined devices. | **Enable:** Configure corporate Home pages for domain-joined devices. If you use this option, you must also include site URLs.<p>**Example**<br>```<support.contoso.com><support.fabrikam.com>```<p>**Note**<br>You must use this format and the angle brackets if you have multiple pages.<p> **Disable or not configured (default):** Uses the corporate Home pages and URLs specified in the App settings. |  
+|Configure Autofill |Windows 10 or later |This policy setting lets you decide whether employees can use Autofill to automatically fill in form fields while using Microsoft Edge. By default, employees can choose whether to use Autofill.<p>If you enable this setting, employees can use Autofill to automatically fill in forms while using Microsoft Edge.<p>If you disable this setting, employees can’t use Autofill to automatically fill in forms while using Microsoft Edge.<p>If you don’t configure this setting, employees can choose whether to use Autofill to automatically fill in forms while using Microsoft Edge. |**Not configured (default):** Employees can choose to turn Autofill on or off.<p>**Enabled:** Employees can use Autofill to complete form fields.<p>**Disabled:** Employees can’t use Autofill to complete form fields. |
-| Configure the Enterprise Mode Site List | Whether your company uses Enterprise Mode and the Enterprise Mode Site List to address common compatibility problems with legacy apps. | **Enable:** Lets you use the Enterprise Mode Site List to address common compatibility problems with legacy apps, if it’s configured. If you use this option, you must also add the location to your site list in the **{URI}** box. When configured, any site on the list will always open in IE11.<p> **Disable or not configured:** You won't be able to use the Enterprise Mode Site List. |
+|Configure cookies |Windows 10 or later|This setting lets you configure how to work with cookies.<p>If you enable this setting, you must also decide whether to:<br><ul><li>**Allow all cookies (default):** Allows all cookies from all websites.</li><li>**Block all cookies:** Blocks all cookies from all websites.</li><li>**Block only 3rd-party cookies:** Blocks only cookies from 3rd-party websites.</li></ul><p>If you disable or don't configure this setting, all cookies are allowed from all sites. |**Enabled:** Lets you decide how your company treats cookies.<br>If you use this option, you must also choose whether to:<br><ul><li>**Allow all cookies (default):** Allows all cookies from all websites.</li><li>**Block all cookies:** Blocks all cookies from all websites.</li><li>**Block only 3rd-party cookies:** Blocks only cookies from 3rd-party websites.</li></ul><p>**Disabled or not configured:** All cookies are allowed from all sites.|
-| Configure Favorites | Decide what sites appear on the default **Favorites** list. | **Enable:** Configure the default list of **Favorite** sites for your employees. If you use this option, you must also add the actual names and URLs for the sites. <p> **Disable or not configured (default):** Uses the **Favorites** list names and URLs specified in the **Favorites** hub. |
+|Configure Do Not Track |Windows 10 or later |This policy setting lets you decide whether employees can send Do Not Track requests to websites that ask for tracking info.  By default, Do Not Track requests aren’t sent, but employees can choose to turn on and send requests.<p>If you enable this setting, Do Not Track requests are always sent to websites asking for tracking info.<p>If you disable this setting, Do Not Track requests are never sent to websites asking for tracking info.<p>If you don’t configure this setting, employees can choose whether to send Do Not Track requests to websites asking for tracking info. |**Not configured (default):** Employees can choose to send Do Not Track headers on or off.<p>**Enabled:** Employees can send Do Not Track requests to websites requesting tracking info.<p>**Disabled:** Employees can’t send Do Not Track requests to websites requesting tracking info. |
-| Don’t allow SmartScreen Filter warning overrides | Whether employees can override the SmartScreen Filter warnings about potentially malicious websites. | **Enable:** Stops employees from ignoring the SmartScreen Filter warnings and blocks them from visiting the site.<p> **Disable or not configured (default):** Lets employees ignore the SmartScreen Filter warnings about potentially malicious sites and continue to the site.<p>**Note**<br>You can also turn on the SmartScreen Filter, using the **Turn off the SmartScreen Filter** setting and stop employees from ignoring the SmartScreen Filter warnings about unverified file downloads, using the **Don’t allow SmartScreen Filter warning overrides for unverified files** setting. |
+|Configure Edge Extensions |Windows 10 Insider Preview |This policy setting lets you decide whether employees can use Edge Extensions.<p>If you enable or don’t configure this setting, employees can use Edge Extensions.<p>If you disable this setting, employees can’t use Edge Extensions. |**Enabled or not configured:** Lets employees use Edge Extensions.<p>**Disabled:** Stops employees from using Edge Extensions. |
-| Don’t allow SmartScreen Filter warning overrides for unverified files | Whether employees can override the SmartScreen Filter warnings about downloading unverified files. | **Enable:** Stops employees from ignoring the SmartScreen Filter warnings and stops them from downloading unverified files.<p>**Disable or not configured (default):** Lets employees ignore the SmartScreen Filter warnings about unverified files and lets them continue the download process. <p>**Note**<br>You can also turn on the SmartScreen Filter, using the **Turn off the SmartScreen Filter** setting and stop employees from ignoring the SmartScreen Filter warnings about potentially dangerous websites, using the **Don’t allow SmartScreen Filter warning overrides** setting. |
+|Configure Favorites |Windows 10, Version 1511 or later |This policy setting lets you configure the default list of Favorites that appear for your employees. Employees can change their Favorites by adding or removing items at any time.<p>If you enable this setting, you can configure what default Favorites appear for your employees. If this setting is enabled, you must also provide a list of Favorites in the Options section. This list is imported after your policy is deployed.<p>If you disable or don’t configure this setting, employees will see the Favorites that they set in the Favorites hub. |**Enabled:** Configure the default list of Favorites for your employees. If you use this option, you must also add the URLs to the sites.<p>**Disabled or not configured:** Uses the Favorites list and URLs specified in the Favorites hub. |
-| Don't allow WebRTC to share the LocalHost IP address | Whether an employee’s LocalHost IP address shows while using the WebRTC protocol | **Enable:** Hides the LocalHost IP address while using the WebRTC protocol. <p> **Disable or not configured (default):** Shows the LocalHost IP address while using the WebRTC protocol. | 
+|Configure Home pages |Windows 10, Version 1511 or later |This policy setting lets you configure one or more Home pages. for domain-joined devices. Your employees won't be able to change this after you set it.<p>If you enable this setting, you can configure one or more Home pages. If this setting is enabled, you must also include URLs to the pages, separating multiple pages by using angle brackets in this format: <br>`<support.contoso.com><support.microsoft.com>`<p>If you disable or don’t configure this setting, your default Home page is the webpage specified in App settings. |**Enabled:** Configure your Home pages. If you use this option, you must also include site URLs.<p>**Disabled or not configured (default):** Uses the Home pages and URLs specified in the App settings. |
-| Send all intranet sites to IE11 | Whether your intranet sites should all open using IE11. <p> **Important:** This setting should only be used if there are known compatibility problems with Microsoft Edge. | **Enable:** Automatically opens all intranet sites using IE11. <p> **Disable or not configured (default):** Automatically opens all intranet sites using Microsoft Edge. |
+|Configure Password Manager |Windows 10 or later |This policy setting lets you decide whether employees can save their passwords locally, using Password Manager. By default, Password Manager is turned on.<p>If you enable this setting, employees can use Password Manager to save their passwords locally.<p>If you disable this setting, employees can’t use Password Manager to save their passwords locally.<p>If you don’t configure this setting, employees can choose whether to use Password Manager to save their passwords locally. |**Not configured:** Employees can choose whether to use Password Manager.<p>**Enabled (default):** Employees can use Password Manager to save passwords locally.<p>**Disabled:** Employees can't use Password Manager to save passwords locally. |
-| Turn off **Address** bar search suggestions | Whether search suggestions should appear in the **Address** bar of Microsoft Edge. | **Enable or not configured (default):** Employees can see search suggestions in the **Address** bar of Microsoft Edge. <p> **Disable:** Employees can’t see search suggestions in the **Address** bar of Microsoft Edge. |
+|Configure Pop-up Blocker |Windows 10 or later |This policy setting lets you decide whether to turn on Pop-up Blocker. By default, Pop-up Blocker is turned on.<p>If you enable this setting, Pop-up Blocker is turned on, stopping pop-up windows from appearing.<p>If you disable this setting, Pop-up Blocker is turned off, letting pop-ups windows appear.<p>If you don’t configure this setting, employees can choose whether to use Pop-up Blocker. |**Enabled or not configured (default):** Turns on Pop-up Blocker, stopping pop-up windows.<p>**Disabled:** Turns off Pop-up Blocker, allowing pop-up windows. |
-| Turn off Autofill | Whether employees can use Autofill to automatically fill in form fields while using Microsoft Edge. | **Enable or not configured (default):** Employees can use Autofill to complete form fields. <p> **Disable:** Employees can’t use Autofill to complete form fields. |
+|Configure search suggestions in Address bar |Windows 10 or later |This policy setting lets you decide whether search suggestions appear in the Address bar of Microsoft Edge. By default, employees can choose whether search suggestions appear in the Address bar of Microsoft Edge.<p>If you enable this setting, employees can see search suggestions in the Address bar of Microsoft Edge.<p>If you disable this setting, employees can't see search suggestions in the Address bar of Microsoft Edge.<p>If you don’t configure this setting, employees can choose whether search suggestions appear in the Address bar of Microsoft Edge. |**Not configured (default):** Employees can choose whether search suggestions appear in the Address bar of Microsoft Edge.<p>**Enabled:** Employees can see search suggestions in the Address bar of Microsoft Edge.<p>**Disabled:** Employees can’t see search suggestions in the Address bar of Microsoft Edge. |
-| Turn off Developer Tools | Whether the F12 Developer Tools are available on Microsoft Edge. | **Enable or not configured (default):** Shows the F12 Developer Tools on Microsoft Edge. <p> **Disable:** Hides the F12 Developer Tools on Microsoft Edge. |
+|Configure SmartScreen Filter |Windows 10 or later |This policy setting lets you configure whether to turn on SmartScreen Filter. SmartScreen Filter provides warning messages to help protect your employees from potential phishing scams and malicious software. By default, SmartScreen Filter is turned on.<p>If you enable this setting, SmartScreen Filter is turned on and employees can’t turn it off.<p>If you disable this setting, SmartScreen Filter is turned off and employees can’t turn it on.<p>If you don’t configure this setting, employees can choose whether to use SmartScreen Filter. |**Not configured (default):** Employees can choose whether to use SmartScreen Filter.<p>**Enabled:** Turns on SmartScreen Filter, providing warning messages to your employees about potential phishing scams and malicious software.<p>**Disabled:** Turns off SmartScreen Filter. |
-| Turn off InPrivate browsing | Whether employees can browse using InPrivate website browsing. | **Enable or not configured (default):** Lets employees use InPrivate browsing while on the corporate network. <p> **Disable:** Stops employees from using inPrivate browsing on the corporate network. |
+|Configure the Enterprise Mode Site List |Windows 10 or later| This policy setting lets you configure whether to use Enterprise Mode and the Enterprise Mode Site List to address common compatibility problems with legacy apps.<p>If you enable this setting, Microsoft Edge looks for the Enterprise Mode Site List XML file. This file includes the sites and domains that need to be viewed using Internet Explorer 11 and Enterprise Mode.<p>If you disable or don’t configure this setting, Microsoft Edge won’t use the Enterprise Mode Site List XML file. In this case, employees might experience compatibility problems while using legacy apps. |**Enabled:** Lets you use the Enterprise Mode Site List to address common compatibility problems with legacy apps, if it’s configured.<br>If you use this option, you must also add the location to your site list in the `{URI}` box. When configured, any site on the list will always open in Internet Explorer 11.<p>**Disabled or not configured (default):** You won't be able to use the Enterprise Mode Site List. |
-| Turn off Password Manager | Whether employees can save their passwords locally, using Password Manager. | **Enable or not configured (default):** Employees can use Password Manager to save passwords locally. <p> **Disable:** Employees can't use Password Manager to save passwords locally. |
+|Prevent access to the about:flags page |Windows 10 Insider Preview |This policy setting lets you decide whether employees can access the about:flags page, which is used to change developer settings and to enable experimental features.<p>If you enable this policy setting, employees can’t access the about:flags page.<p>If you disable or don’t configure this setting, employees can access the about:flags page. |**Enabled:** Stops employees from using the about:flags page.<p>**Disabled or not configured (default):** Lets employees use the about:flags page. |
-| Turn off Pop-up Blocker | Whether to turn on Pop-up Blocker and allow pop-ups to appear in secondary windows. | **Enable or not configured (default):** Turns on Pop-up Blocker, stopping pop-up windows. <p> **Disable:** Turns off Pop-up Blocker, allowing pop-up windows. |
+|Prevent bypassing SmartScreen prompts for files |Windows 10, Version 1511 or later	|This policy setting lets you decide whether employees can override the SmartScreen Filter warnings about downloading unverified files.<p>If you enable this setting, employees can’t ignore SmartScreen Filter warnings and they’re blocked from downloading the unverified files.<p>If you disable or don’t configure this setting, employees can ignore SmartScreen Filter warnings and continue the download process. |**Enabled:** Stops employees from ignoring the SmartScreen Filter warnings about unverified files.<p>**Disabled or not configured (default):** Lets employees ignore the SmartScreen Filter warnings about unverified files and lets them continue the download process. |
-|Turn off the SmartScreen Filter | Whether to turn on SmartScreen Filter to help protect your employees from potential phishing scams and malicious software. | **Enable or not configured (default):** Turns on SmartScreen Filter, providing warning messages to your employees about potential phishing scams and malicious software. <p> **Disable:** Turns off SmartScreen Filter.<p>**Note**<br>You can also stop employees from ignoring the SmartScreen Filter warnings about potentially dangerous websites, using the **Don’t allow SmartScreen Filter warning overrides** setting and stop employees from ignoring the SmartScreen Filter warnings about unverified file downloads, using the **Don’t allow SmartScreen Filter warning overrides for unverified files** setting. |
+|Prevent bypassing SmartScreen prompts for sites |Windows 10, Version 1511 or later |This policy setting lets you decide whether employees can override the SmartScreen Filter warnings about potentially malicious websites.<p>If you enable this setting, employees can’t ignore SmartScreen Filter warnings and they’re blocked from continuing to the site.<p>If you disable or don’t configure this setting, employees can ignore SmartScreen Filter warnings and continue to the site. |**Enabled:** Stops employees from ignoring the SmartScreen Filter warnings about potentially malicious sites.<p>**Disabled or not configured (default):** Lets employees ignore the SmartScreen Filter warnings about potentially malicious sites and continue to the site. |
-
+|Prevent using Localhost IP address for WebRTC |Windows 10, Version 1511 or later |This policy setting lets you decide whether an employee’s Localhost IP address shows while making calls using the WebRTC protocol. By default, this setting is turned off.<p>If you enable this setting, Localhost IP addresses are hidden while making calls using the WebRTC protocol.<p>If you disable or don’t configure this setting, Localhost IP addresses are shown while making calls using the WebRTC protocol. |**Enabled:** Hides the Localhost IP address during calls using the WebRTC protocol.<p>**Disabled or not configured (default):** Shows the Localhost IP address during phone calls using the WebRTC protocol. |
- 
+|Send all intranet sites to Internet Explorer 11 |Windows 10 or later |This policy setting lets you decide whether your intranet sites should all open using Internet Explorer 11. This setting should only be used if there are known compatibility problems with Microsoft Edge.<p>If you enable this setting, all intranet sites are automatically opened using Internet Explorer 11.<p>If you disable or don’t configure this setting, all websites, including intranet sites, are automatically opened using Microsoft Edge. |**Enabled:** Automatically opens all intranet sites using Internet Explorer 11.<p>**Disabled or not configured (default):** Automatically opens all websites, including intranet sites, using Microsoft Edge. |
+|Show message when opening sites in Internet Explorer |Windows 10 Insider Preview |This policy setting lets you decide whether employees see an additional page in Microsoft Edge, stating that a site has been opened using Internet Explorer 11.<p>If you enable this setting, employees see an additional page in Microsoft Edge, stating that a site has been opened using Internet Explorer 11.<p>If you disable or don’t configure this setting, the default app behavior occurs and no additional page appears. |**Enabled:** Shows an additional page in Microsoft Edge, stating that a site has been opened using Internet Explorer 11.<p>**Disabled or not configured (default):** Doesn’t show an additional page in Microsoft Edge, stating that a site has been opened using Internet Explorer 11. |
 
 ##  Using Microsoft Intune to manage your Mobile Data Management (MDM) settings for Microsoft Edge
-
-
 If you manage your policies using Intune, you'll want to use these MDM policy settings. You can see the full list of available policies, on the [Policy CSP]( http://go.microsoft.com/fwlink/p/?LinkId=722885) page.
 
 <p>**Note**<br>The **Supports** column uses these options:
@@ -63,43 +61,46 @@ If you manage your policies using Intune, you'll want to use these MDM policy se
 
 All devices must be enrolled with Intune if you want to use the Windows Custom URI Policy.
 
-| Policy name                                  | Supports            | Details                                                 |
+| Policy name |Supported versions |Supported device |Details |
-| -------------------------------------------- | --------------------| ------------------------------------------------------- |
+|-------------|-------------------|-----------------|--------|
-| AllowAutofill                                | Desktop             | <ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/AllowAutofill</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0.** Employees can’t use Autofill to complete form fields.</li><li>**1 (default).** Employees can use Autofill to complete form fields.</li></ul></li></ul> |
+|AllowAutofill|Windows 10 or later |Desktop |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/AllowAutofill</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0.** Employees can’t use Autofill to complete form fields.</li><li>**1 (default).** Employees can use Autofill to complete form fields.</li></ul></li></ul>
-| AllowBrowser                                 | Mobile              | <ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/AllowBrowser</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0.** Employees can’t use Microsoft Edge.</li><li>**1 (default).** Employees can use Microsoft Edge.</li></ul></li></ul> |
+|AllowBrowser |Windows 10 or later |Mobile |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/AllowBrowser</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0.** Employees can’t use Microsoft Edge.</li><li>**1 (default).** Employees can use Microsoft Edge.</li></ul></li></ul>| 
-| AllowCookies                                 | Both              | <ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/AllowCookies</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0.** Block all cookies from all sites.</li><li>**1.** Block only 3rd party cookies.<li>**2 (default).** Don't block. Allow all cookies from all sites.</li></ul></li></ul> |
+|AllowDeveloperTools |Windows 10, Version 1511 or later |Desktop |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/AllowDeveloperTools</li><li>**Data type:** Integer</li><li>**Allowed values:**<ul><li>**0.** Employees can't use the F12 Developer Tools</li><li>**1 (default).** Employees can use the F12 Developer Tools</li></ul></li></ul> |
-| AllowDeveloperTools                          | Desktop             | <ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/AllowDeveloperTools</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0.** Employees can't use the F12 Developer Tools on Microsoft Edge.</li><li>**1  (default).** Employees can use the F12 Developer Tools on Microsoft Edge.</li></ul></li></ul> |
+|AllowDoNotTrack |Windows 10 or later |Both |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/AllowDoNotTrack</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Stops employees from sending Do Not Track headers to websites requesting tracking info.</li><li>**1.** Employees can send Do Not Track headers to websites requesting tracking info.</li></ul></li></ul> |
-| AllowDoNotTrack                              | Both                | <ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/AllowDoNotTrack</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Stops employees from sending Do Not Track headers to websites requesting tracking info.</li><li>**1.** Employees can send Do Not Track headers to websites requesting tracking info.</li></ul></li></ul> |
+|AllowExtensions |Windows 10 Insider Preview |Desktop |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/AllowExtensions</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0.** Employees can’t use Edge Extensions.</li><li>**1 (default).** Employees can use Edge Extensions.</li></ul></li></ul> |
-|  AllowPasswordManager                         | Both                | <ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/AllowPasswordManager</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0.** Employees can use Password Manager to save passwords locally.</li><li>**1 (default).** Employees can't use Password Manager to save passwords locally.</li></ul></li></ul>
+|AllowInPrivate |Windows 10, Version 1511 or later |Both |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/AllowInPrivate</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0.** Employees can’t use InPrivate browsing.</li><li>**1 (default).** Employees can use InPrivate browsing.</li></ul></li></ul> |
-| AllowPopups                                  | Desktop             | <ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/AllowPopups</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Turns off Pop-up Blocker, stopping pop-up windows</li><li>**1.** Turns on Pop-up Blocker, allowing pop-up windows.</li></ul></li></ul> |
+|AllowPasswordManager |Windows 10 or later |Both |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/AllowPasswordManager</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Employees can't use Password Manager to save passwords locally.</li><li>**1.** Employees can use Password Manager to save passwords locally.</li></ul></li></ul> |
-| AllowSearchSuggestions<br>inAddressBar           | Both                | <ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/AllowSearchSuggestions<br>inAddressBar</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0.** Employees can see search suggestions in the **Address** bar of Microsoft Edge.</li><li>**1 (default).** Employees can’t see search suggestions in the **Address** bar of Microsoft Edge.</li></ul></li></ul> |
+|AllowPopups |Windows 10 or later |Desktop |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/AllowPopups</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Turns off Pop-up Blocker, allowing pop-up windows.</li><li>**1.** Turns on Pop-up Blocker, stopping pop-up windows.</li></ul></li></ul> |
-| AllowSmartScreen                             | Both                | <ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/AllowSmartScreen</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0.** Turns on SmartScreen Filter, providing warning messages to your employees about potential phishing scams and malicious software.</li><li>**1 (default).** Turns off SmartScreen Filter.</li></ul></li></ul> |
+|AllowSearchSuggestions<br>inAddressBar |Windows 10 or later |Both |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/AllowSearchSuggestionsinAddressBar/</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Employees can’t see search suggestions in the Address bar of Microsoft Edge.</li><li>**1.** Employees can see search suggestions in the Address bar of Microsoft Edge.</li></ul></li></ul> |
-| EnterpriseModeSiteList                       | Desktop             | <ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/EnterpriseModeSiteList</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**Not configured (default).**</li><li>**1.** Use Enterprise Mode site list, if configured.</li><li>**2.** Specify the location to the site list.</li></ul></li></ul> |
+|AllowSmartScreen |Windows 10 or later |Both |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/AllowSmartScreen</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Turns off SmartScreen Filter.</li><li>**1.** Turns on SmartScreen Filter, providing warning messages to your employees about potential phishing scams and malicious software.</li></ul></li></ul> |
-| Favorites                                    | Both                | <ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/Favorites</li><li>**Data type.** String</li><li>**Allowed values:**<ul><li>URLs to favorite webpages.</li>**Example:**<br>```<contoso.com>```<br>```<fabrikam.com>```<p>**Note** URLs must be on separate lines.</ul></li></ul> |
+|Cookies |Windows 10 or later |Both |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/Cookies</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Allows all cookies from all sites.</li><li>**1.** Blocks only cookies from 3rd party websites</li><li>**2.** Blocks all cookies from all sites.</li></ul></li></ul> |
-| FirstRunURL                                  | Mobile              | <ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/FirstRunURL</li><li>**Data type.** String</li><li>**Allowed values:**<ul><li>URL to first run webpage.</li><p>**Example:**<br>```<contoso.com>```</ul></li></ul> |
+|EnterpriseModeSiteList |Windows 10 or later |Desktop |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/EnterpriseModeSiteList</li><li>**Data type.** String</li><li>**Allowed values:**<ul><li>Not configured.</li><li>**1 (default).** Use the Enterprise Mode Site List, if configured.</li><li>**2.** Specify the location to the site list.</li></ul></li></ul> |
-| HomePages                                    | Desktop             | <ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/HomePages</li><li>**Data type.** String</li><li>**Allowed values:**<ul><li>URLs to home pages.</li><p>**Example:**<br>```<contoso.com/support><fabrikam.com/support>```</ul></li></ul> |
+|Favorites |Windows 10, Version 1511 or later |Both |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/Favorites</li><li>**Data type.** String</li><li>**Allowed values:**<ul><li>Configure the **Favorite** URLs for your employees.<p>**Example:**<br>`<contoso.com>`<br>`<fabrikam.com>`<p>**Note**<br> URLs must be on separate lines and aren't shared between Microsoft Edge and Internet Explorer 11.</li></ul> |
-| PreventSmartScreen<br>PromptOverride             | Both                | <ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/PreventSmartScreen<br>PromptOverride</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Employees can ignore SmartScreen warnings.</li><li>**1.** Employees can't override SmartScreen warnings.</li></ul></li></ul> |
+|FirstRunURL |Windows 10, Version 1511 or later |Mobile |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/ Browser/FirstRunURL</li><li>**Data type.** String</li><li>**Allowed values:**<ul><li>Configure the first run URL for your employees.<p>**Example:**<br>`<contoso.one>`</li></ul></li></ul> |
-| PreventSmartScreen<br>PromptOverrideForFiles     | Both                | <ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/PreventSmartScreen<br>PromptOverrideForFiles</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Employees can ignore SmartScreen warnings for files.</li><li>**1.** Employees can't override SmartScreen warnings for files.</li></ul></li></ul> |
+|HomePages |Windows 10, Version 1511 or later |Desktop |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/HomePages</li><li>**Data type.** String</li><li>**Allowed values:**<ul><li>Configure the Home page URLs for your employees.<p>**Example:**<br>`<contoso.com/support><fabrikam.com/support>`</li></ul></li></ul> |
-| PreventUsingLocalHost<br>IPAddressforWebRTC      | Desktop             | <ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/PreventUsingLocal<br>HostIPAddressForWebRTC</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Shows an employee's LocalHost IP address while using the WebRTC protocol.</li><li>**1.** Hides an employee's LocalHost IP address while using the WebRTC protocol.</li></ul></li></ul> |
+|PreventAccessToAbout<br>FlagsInMicrosoftEdge |Windows 10 Insider Preview |Desktop |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/PreventAccessToAboutFlagsInMicrosoftEdge</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Employees can access the about:flags page in Microsoft Edge.</li><li>**1.** Employees can't access the about:flags page in Microsoft Edge.</li></ul></li></ul> |
+|PreventSmartScreen<br>PromptOverride |Windows 10, Version 1511 or later |Both |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/PreventSmartscreenPromptOverride</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Employees can ignore SmartScreen warnings.</li><li>**1.** Employees can't ignore SmartScreen warnings.</li></ul></li></ul> |
+|PreventSmartScreen<br>PromptOverrideForFiles |Windows 10, Version 1511 or later |Both |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/PreventSmartScreenPromptOverrideForFiles </li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Employees can ignore SmartScreen warnings for files.</li><li>**1.** Employees can't ignore SmartScreen warnings for files.</li></ul></li></ul> |
+|PreventUsingLocalHostIP<br>AddressForWebRTC |Windows 10, Version 1511 or later |Desktop |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/PreventUsingLocalHostIPAddressForWebRTC</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Shows an employee's LocalHost IP address while using the WebRTC protocol.</li><li>**1.** Doesn't show an employee's LocalHost IP address while using the WebRTC protocol.</li></ul></li></ul> |
+|SendIntranetTraffic<br>toInternetExplorer |Windows 10 or later |Both |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/SendIntranetTraffictoInternetExplorer/</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Automatically opens all websites, including intranet sites, using Microsoft Edge.</li><li>**1.** Automatically opens all intranet sites using Internet Explorer 11.</li></ul></li></ul> |
+|ShowMessageWhenOpening<br>InteretExplorerSites |Windows 10 Insider Preview |Desktop |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/ShowMessageWhenOpeningSitesInInteretExplorer</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Doesn’t show an additional page in Microsoft Edge, stating that a site has been opened using Internet Explorer 11.</li><li>**1.** Shows an additional page in Microsoft Edge, stating that a site has been opened using Internet Explorer 11.</li></ul></li></ul> |
 
+## Microsoft Edge and Windows 10-specific Group Policy settings
+These are additional Windows 10-specific Group Policy settings that work with Microsoft Edge.
 
-## Microsoft Edge and Windows 10-specific Group Policy and MDM settings
+|Group Policy setting |Description   |Options  |
+| --------------------|--------------|---------|
+|Computer Configuration\Administrative Templates\Windows Components\Search\Allow Cortana |Whether employees can use Cortana. |**Enabled or not configured:** Employees can use Cortana on their devices.<p>**Disabled:** Stops employees from using Cortana on their devices.<p>**Note** Employees can still perform searches even with Cortana turned off. |
+|Computer Configuration\Administrative Templates\Windows Components\sync your settings\Do not sync |Whether employees can use the **Sync your Settings** options to sync their settings to and from their device. |**Enabled:** Turns off the **Sync your Settings** options and none of the **Sync your Setting** groups are synced on the device. You can use the **Allow users to turn syncing on** option to turn the feature off by default, but to let the employee change this setting.<p>**Disabled or not configured (default):** Turns on the **Sync your Settings** area by default, letting employees pick what can sync on their device. |
+|Computer Configuration\Administrative Templates\Windows Components\sync your settings\Do not sync browser settings |Whether a browser group can use the **Sync your Settings** options to sync their info to and from their device. This includes settings and info like **History** and Favorites. |**Enabled:** Turns off the **Sync your Settings** options so that browser groups are unable to sync their settings and info. You can use the **Allow users to turn browser syncing on** option to turn the feature off by default, but to let the employee change this setting.<p>**Disabled or not configured (default):** Turns on the **Sync your Settings** area by default, letting browser groups pick what can sync on their device. |
 
-These are additional Windows 10-specific settings that work with Microsoft Edge.
+## Microsoft Edge and Windows 10-specific MDM policy settings
-
-| Group Policy setting                    | Description                               | Options                                                 |
-| --------------------------------------- | ----------------------------------------- | ------------------------------------------------------- |
-| Computer Configuration\Administrative Templates\Windows Components\Search\Allow Cortana | Whether employees can use Cortana. | **Enable or not configured:** Employees can use Cortana on their devices.<p>**Disable:** Stops employees from using Cortana on their devices.<p>**Note** Employees can still perform searches even with Cortana turned off. |
-| Computer Configuration\Administrative Templates\Windows Components\sync your settings\Do not sync | Whether employees can use the **Sync your Settings** options to sync their settings to and from their device. | **Enable:** Turns off the **Sync your Settings** options and none of the **Sync your Setting** groups are synced on the device. You can use the **Allow users to turn syncing on** option to turn the feature off by default, but to let the employee change this setting.<p>**Disable or not configured (default):** Turns on the **Sync your Settings** area by default, letting employees pick what can sync on their device. |
-| Computer Configuration\Administrative Templates\Windows Components\sync your settings\Do not sync browser settings | Whether a browser group can use the **Sync your Settings** options to sync their info to and from their device. This includes settings and info like **History** and **Favorites**. | **Enable:** Turns off the **Sync your Settings** options so that browser groups are unable to sync their settings and info. You can use the **Allow users to turn browser syncing on** option to turn the feature off by default, but to let the employee change this setting.<p>**Disable or not configured (default):** Turns on the **Sync your Settings** area by default, letting browser groups pick what can sync on their device. |
-
-## Additional Windows 10-specific MDM policy settings
 These are additional Windows 10-specific MDM policy settings that work with Microsoft Edge.
 
-| MDM Policy name                        | Supports            | Details                                                                        |
+|MDM Policy name |Supports      |Details             |
-| ---------------------------------------| ------------------- | ------------------------------------------------------------------------------ |
+|----------------|--------------|------------------- |
-| AllowCortana                           | Both                | <ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Experience/AllowCortana</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0.** Employees can’t use Cortana on their devices.</li><li>**1 (default).** Employees can use Cortana on their devices.</li></ul></li></ul> |
+|AllowCortana |Both | <ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Experience/AllowCortana</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0.** Employees can’t use Cortana on their devices.</li><li>**1 (default).** Employees can use Cortana on their devices.</li></ul></li></ul> |
-| AllowSyncMySettings                    | Desktop             | <ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Experience/AllowSyncMySettings</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0.** Employees can’t sync settings between PCs.</li><li>**1 (default).** Employees can sync between PCs.</li></ul></li></ul> |
+|AllowSyncMySettings |Desktop |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Experience/AllowSyncMySettings</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0.** Employees can’t sync settings between PCs.</li><li>**1 (default).** Employees can sync between PCs.</li></ul></li></ul> |
 
 ## Related topics
 * [Group Policy TechCenter](http://go.microsoft.com/fwlink/p/?LinkId=214514)

browsers/edge/change-history-for-microsoft-edge.md

@@ -0,0 +1,16 @@
+---
+title: Change history for Microsoft Edge (Microsoft Edge for IT Pros)
+description: This topic lists new and updated topics in the Microsoft Edge documentation for Windows 10 and Windows 10 Mobile.
+ms.prod: edge
+ms.mktglfcycl: explore
+ms.sitesec: library
+---
+
+# Change history for Microsoft Edge
+This topic lists new and updated topics in the Microsoft Edge documentation for both Windows 10 and Windows 10 Mobile.
+
+## May 2016
+
+|New or changed topic | Description |
+|----------------------|-------------|
+|[Available Policies for Microsoft Edge](available-policies.md) | Added new policies and the Supported versions column for Windows 10 Insider Preview. |

browsers/internet-explorer/ie11-deploy-guide/change-history-for-internet-explorer-11.md

@@ -0,0 +1,16 @@
+---
+title: Change history for Internet Explorer 11 (Internet Explorer 11 for IT Pros)
+description: This topic lists new and updated topics in the Internet Explorer 11 documentation for Windows 10 and Windows 10 Mobile.
+ms.prod: IE11
+ms.mktglfcycl: deploy
+ms.sitesec: library
+---
+
+# Change history for Internet Explorer 11
+This topic lists new and updated topics in the Internet Explorer 11 documentation for both Windows 10 and Windows 10 Mobile.
+
+## May 2016
+
+|New or changed topic | Description |
+|----------------------|-------------|
+|[Enterprise Mode schema v.1 guidance for Windows 7 and Windows 8.1 Update devices](enterprise-mode-schema-version-1-guidance.md) | Added info about using <emie> and <docMode> together. |

browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-1-guidance.md

@@ -168,6 +168,23 @@ Where http://fabrikam.com doesn't use IE8 Enterprise Mode, but http://fabrikam.c
 </tr>
 </table>
 
+### Using Enterprise Mode and document mode together
+If you want to use both Enterprise Mode and document mode together, you need to be aware that  &lt;emie&gt; entries override &lt;docMode&gt; entries for the same domain. 
+
+For example, say you want all of the sites in the contoso.com domain to open using IE8 Enterprise Mode, except test.contoso.com, which needs to open in document mode 11. Because Enterprise Mode takes precedence over document mode, if you want test.contoso.com to open using document mode, you'll need to explicitly add it as an exclusion to the &lt;emie&gt; parent node.
+
+```xml
+<rules version="1">
+  <emie>
+    <domain exclude="false">contoso.com</domain>
+    <domain exclude="true">test.contoso.com</domain>
+  </emie>
+  <docMode>
+    <domain docMode="11">test.contoso.com</domain>
+  </docMode>
+</rules>
+```
+
 ### What not to include in your schema
 We recommend that you not add any of the following items to your schema because they can make your compatibility list behave in unexpected ways:
 - Don’t use protocols. For example, `http://`, `https://`, or custom protocols. They break parsing.
@@ -265,5 +282,3 @@ If you want to target specific sites in your organization.
 </ul>
 </td></tr>
 </table>
-
-

browsers/internet-explorer/ie11-deploy-guide/index.md

@@ -26,6 +26,7 @@ Because this content isn't intended to be a step-by-step guide, not all of the s
 ## In this guide
 |Topic |Description |
 |------|------------|
+|[Change history for Internet Explorer 11](change-history-for-internet-explorer-11.md) |Lists new and updated topics in the Internet Explorer 11 documentation for both Windows 10 and Windows 10 Mobile. |
 |[System requirements and language support for Internet Explorer 11 (IE11)](system-requirements-and-language-support-for-ie11.md) |IE11 is available for a number of systems and languages. This topic provides info about the minimum system requirements and language support. |
 |[List of updated features and tools - Internet Explorer 11 (IE11)](updated-features-and-tools-with-ie11.md) |IE11 includes several new features and tools. This topic includes high-level info about the each of them. |
 |[Install and Deploy Internet Explorer 11 (IE11)](install-and-deploy-ie11.md) |Use the topics in this section to learn how to customize your Internet Explorer installation package, how to choose the right method for installation, and how to deploy IE into your environment. You can also find more info about your virtualization options for legacy apps. |

browsers/internet-explorer/ie11-deploy-guide/out-of-date-activex-control-blocking.md

@@ -84,9 +84,11 @@ IE opens the app’s website.
 **Security Note:**<br>If you don’t fully trust a site, you shouldn’t allow it to launch an outdated app. However, although we don’t recommend it, you can let the webpage launch the app by tapping or clicking **Allow**. This option opens the app without updating or fixing the problem. The next time you visit a webpage running the same outdated app, you’ll get the notification again.
 
 ## How does IE decide which ActiveX controls to block?
-IE uses Microsoft’s versionlist.xml file to determine whether an ActiveX control should be stopped from loading. This file is updated with newly-discovered out-of-date ActiveX controls, which IE automatically downloads to your local copy of the file.
+IE uses Microsoft’s versionlist.xml or versionlistWin7.xml file to determine whether an ActiveX control should be stopped from loading. These files are updated with newly-discovered out-of-date ActiveX controls, which IE automatically downloads to your local copy of the file.
 
-You can see your copy of the versionlist.xml file here `%LOCALAPPDATA%\Microsoft\Internet Explorer\VersionManager\versionlist.xml`, or you can view Microsoft’s version at [Internet Explorer version list](http://go.microsoft.com/fwlink/p/?LinkId=403864).
+You can see your copy of the file here `%LOCALAPPDATA%\Microsoft\Internet Explorer\VersionManager\versionlist.xml` or you can view Microsoft’s version, based on your operating system and version of IE, here:
+- [Internet Explorer 11 on Windows 7 SP1 or Windows Server 2008 R2](http://go.microsoft.com/fwlink/p/?LinkId=798230)
+- [All other configurations](https://go.microsoft.com/fwlink/p/?LinkId=403864)
 
 **Security Note:**<br>Although we strongly recommend against it, if you don’t want your computer to automatically download the updated version list from Microsoft, run the following command from a command prompt:
 
@@ -171,7 +173,7 @@ Here’s a detailed example and description of what’s included in the VersionA
 ### Inventory your ActiveX controls by using a local WMI class
 For Windows 10 you also have the option to log your inventory info to a local WMI class. Info logged to this class includes all of info you get from the .csv file, plus the CLSID of the loaded ActiveX control or the name of any apps started from an ActiveX control.
 
-### Before you begin
+#### Before you begin
 Before you can use WMI to inventory your ActiveX controls, you need to [download the configuration package (.zip file)](http://go.microsoft.com/fwlink/p/?LinkId=616971), which includes:
 
 -   **ConfigureWMILogging.ps1**. A Windows PowerShell script.

devices/surface-hub/TOC.md

@@ -25,6 +25,7 @@
 #### [Manage settings with an MDM provider](manage-settings-with-mdm-for-surface-hub.md)
 #### [Monitor your Surface Hub](monitor-surface-hub.md)
 #### [Save your BitLocker key](save-bitlocker-key-surface-hub.md)
+#### [Connect other devices and display with Surface Hub](connect-and-display-with-surface-hub.md)
 #### [Using a room control system](use-room-control-system-with-surface-hub.md)
 #### [Windows updates](manage-windows-updates-for-surface-hub.md)
 #### [Wireless network management](wireless-network-management-for-surface-hub.md)

devices/surface-hub/connect-and-display-with-surface-hub.md

@@ -0,0 +1,426 @@
+---
+title: Connect other devices and display with Surface Hub
+description: You can connect other device to your Surface Hub to display content. This topic describes guest mode and replacement PC modes that is available through a wired connection.
+Robots: noindex, nofollow
+ms.assetid: 8BB80FA3-D364-4A90-B72B-65F0F0FC1F0D
+author: TrudyHa
+---
+
+# Connect other devices and display with Surface Hub
+
+
+You can connect other device to your Surface Hub to display content. This topic describes guest mode and replacement PC modes that is available through a wired connection.
+
+## Guest mode
+
+
+Guest mode uses a wired connection, so people can display content from their devices to the Surface Hub. If the source device is Windows based, that device can also provide Touchback and Inkback. Surface Hub's internal PC takes video and audio from the connected device and displays them on the Surface Hub. If Surface Hub encounters an HDCP signal, the source will be re-routed through an alternate path, allowing the source to be displayed full-screen without violating HDCP requirements.
+
+### Ports
+
+Use these ports on the Surface Hub for the guest mode.
+
+<table>
+<colgroup>
+<col width="25%" />
+<col width="25%" />
+<col width="25%" />
+<col width="25%" />
+</colgroup>
+<thead>
+<tr class="header">
+<th>Interface</th>
+<th>Type</th>
+<th>Description</th>
+<th>Capabilities</th>
+</tr>
+</thead>
+<tbody>
+<tr class="odd">
+<td><p>Display Port 1.1a</p></td>
+<td><p>Video input</p></td>
+<td><p>Guest input #1</p></td>
+<td><ul>
+<li><p>Support simultaneous guest input display with guest input #2 and guest input #3 (one full resolution, two thumbnail).</p></li>
+<li><p>HDCP compliant in bypass mode</p></li>
+<li><p>Touchback enabled</p></li>
+</ul></td>
+</tr>
+<tr class="even">
+<td><p>HDMI 1.4</p></td>
+<td><p>Video input</p></td>
+<td><p>Guest input #2</p></td>
+<td><ul>
+<li><p>Support simultaneous guest input display with guest input #1 and guest input #3 (one full resolution, two thumbnail).</p></li>
+<li><p>HDCP compliant in bypass mode</p></li>
+<li><p>Touchback enabled</p></li>
+</ul></td>
+</tr>
+<tr class="odd">
+<td><p>VGA</p></td>
+<td><p>Video input</p></td>
+<td><p>Guest input #3</p></td>
+<td><ul>
+<li><p>Support simultaneous guest input display with guest input #1 and guest input #2 (one full resolution, two thumbnail).</p></li>
+<li><p>HDCP compliant in bypass mode</p></li>
+<li><p>Touchback enabled</p></li>
+</ul></td>
+</tr>
+<tr class="even">
+<td><p>3.5 mm jack</p></td>
+<td><p>Audio input</p></td>
+<td><p>Analog audio input</p></td>
+<td><ul>
+<li><p>Ingest into Surface Hub PC, usually with the VGA video input.</p></li>
+</ul></td>
+</tr>
+<tr class="odd">
+<td><p>USB 2.0, type B</p></td>
+<td><p>USB out</p></td>
+<td><p>Touchback</p></td>
+<td><ul>
+<li><p>Provides access to the HID input devices mouse, touch, keyboard, and stylus back to the guest PC.</p></li>
+</ul></td>
+</tr>
+</tbody>
+</table>
+
+ 
+
+### Port locations
+
+These are the port connections used for guest mode on the 55" and 84" Surface Hubs.
+
+![image showing guest ports on 55" surface hub. ](images/sh-55-guest-ports.png)
+
+Wired port connections on 55" Surface Hub
+
+![image showing guest ports on 84" surface hub. ](images/sh-84-guest-ports.png)
+
+Wired port connections on 84" Surface Hub
+
+### Port enumeration
+
+When a Surface hub is connected to guest computer with the wired connect USB port, a number of USB devices are discovered and configured. These peripheral devices are created for touchback and inkback. The peripheral devices can viewed in Device Manager. Device Manager will show duplicate names for some devices.
+
+**Human interface devices**
+
+-   HID-compliant consumer control device
+
+-   HID-compliant pen
+
+-   HID-compliant pen (duplicate item)
+
+-   HID-compliant pen (duplicate item)
+
+-   HID-compliant touch screen
+
+-   USB Input Device
+
+-   USB Input Device (duplicate item)
+
+**Keyboards**
+
+-   Standard PS/2 keyboard
+
+**Mice and other pointing devices**
+
+-   HID-compliant mouse
+
+**Universal serial bus conntrollers**
+
+-   Generic USB hub
+
+-   USB composite device
+
+### Guest mode connectivity
+
+Your choice of video cable will be determined by what is available from your source input. The Surface Hub has three choices of video input, DisplayPort, HDMI and VGA. Please refer to the below chart for available resolutions.
+
+<table style="width:100%;">
+<colgroup>
+<col width="16%" />
+<col width="16%" />
+<col width="16%" />
+<col width="16%" />
+<col width="16%" />
+<col width="16%" />
+</colgroup>
+<thead>
+<tr class="header">
+<th>Signal Type</th>
+<th>Resolution</th>
+<th>Frame rate</th>
+<th>HDMI - RGB</th>
+<th>DisplayPort</th>
+<th>VGA</th>
+</tr>
+</thead>
+<tbody>
+<tr class="odd">
+<td><p>PC</p></td>
+<td><p>640 x 480</p></td>
+<td><p>59.94/60</p></td>
+<td><p>X</p></td>
+<td><p>X</p></td>
+<td><p>X</p></td>
+</tr>
+<tr class="even">
+<td><p>PC</p></td>
+<td><p>720 x 480</p></td>
+<td><p>59.94/60</p></td>
+<td><p>X</p></td>
+<td><p>X</p></td>
+<td></td>
+</tr>
+<tr class="odd">
+<td><p>PC</p></td>
+<td><p>1024 x 768</p></td>
+<td><p>60</p></td>
+<td><p>X</p></td>
+<td><p>X</p></td>
+<td><p>X</p></td>
+</tr>
+<tr class="even">
+<td><p>HDTV</p></td>
+<td><p>720p</p></td>
+<td><p>59.94/60</p></td>
+<td><p>X</p></td>
+<td><p>X</p></td>
+<td><p>X</p></td>
+</tr>
+<tr class="odd">
+<td><p>HDTV</p></td>
+<td><p>1080p</p></td>
+<td><p>59.94/60</p></td>
+<td><p>X</p></td>
+<td><p>X</p></td>
+<td><p>X</p></td>
+</tr>
+</tbody>
+</table>
+
+ 
+
+Source audio is provided by DisplayPort and HDMI cables. If you must use VGA, Surface Hub has an audio input port that uses a 3.5 mm plug. Surface Hub also uses a USB cable that provides touch and inkback from the Surface Hub to compatible Windows 10 devices. The USB cable can be used with any video input that is already connected with a cable.
+
+Someone using guest mode to connect a PC would use one of these options:
+
+**DisplayPort** -- DisplayPort cable and USB 2.0 cable
+
+**HDMI** -- HDMI cable and USB 2.0 cable
+
+**VGA** -- VGA cable, 3.5 mm audio cable, and USB 2.0 cable
+
+If the computer you are using for guest mode is not compatible with Touch and Inkback, then you won't need the USB cable.
+
+## Replacement PC mode
+
+
+In replacement PC mode, the embedded computer of the Surface Hub is turned off and an external PC is connected to the Surface Hub. Connections to replacement PC ports give access to key peripherals on the Surface Hub, including the screen, pen, and touch features. This does mean that your Surface Hub won’t have the benefit of the Windows Team experience, but you will have the flexibility offered by providing and managing your own Windows computer.
+
+### Software requirements
+
+You can run Surface Hub in replacement PC mode with 64-bit versions of Windows 10 Home, Windows 10 Pro and Windows 10 Enterprise. You can download the  [Surface Hub Replacement PC driver package](https://www.microsoft.com/en-us/download/details.aspx?id=52210) from the Microsoft download center. We recommend that you install these drivers on any computer you plan to use as a replacement PC.
+
+### Hardware requirements
+
+Surface Hub is compatible with a range of hardware. Choose the processor and memory confirmation for your replacement PC so that it supports the programs you'll be using. Your replacement PC hardware needs to support 64-bit versions of Windows 10.
+
+### Graphics adapter
+
+In replacement PC mode, Surface Hub supports any graphics adapter that can produce a DisplayPort signal. You'll improve your experience with a graphics adapter that can match Surface Hub's resolution and refresh rate. For example, though the best and recommended replacement PC experience on the Surface Hub is with a 120Hz video signal, 60Hz video signals are also supported.
+
+**55" Surface Hubs** - For best experience, use a graphics card capable of 1080p resolution at 120Hz.
+
+**84" Surface Hubs** - For best experience, use a graphics card capable of outputting four DisplayPort 1.2 streams to produce 2160p at 120Hz (3840 x 2160 at 120Hz vertical refresh). We've verified that this works with the NVIDIA Quadro K2200, NVIDIA Quadro K4200, and NVIDIA Quadro M6000. These are not the only graphics cards - others are available from other vendors. 
+
+Check directly with graphics card vendors for the latest drivers.
+
+<table>
+<colgroup>
+<col width="50%" />
+<col width="50%" />
+</colgroup>
+<thead>
+<tr class="header">
+<th>Graphics vendor</th>
+<th>Driver download page</th>
+</tr>
+</thead>
+<tbody>
+<tr class="odd">
+<td><p>NVIDIA</p></td>
+<td><p>[http://nvidia.com/Download/index.aspx](http://nvidia.com/Download/index.aspx)</p></td>
+</tr>
+<tr class="even">
+<td><p>AMD</p></td>
+<td><p>[http://support.amd.com/download](http://support.amd.com/download)</p></td>
+</tr>
+<tr class="odd">
+<td><p>Intel</p></td>
+<td><p>[https://downloadcenter.intel.com/](https://downloadcenter.intel.com/)</p></td>
+</tr>
+</tbody>
+</table>
+
+ 
+
+### Ports
+
+Replacement PC ports on 55" Surface Hub.
+
+![image showing replacement pc ports on 55" surface hub. ](images/sh-55-rpc-ports.png)
+
+<table>
+<colgroup>
+<col width="25%" />
+<col width="25%" />
+<col width="25%" />
+<col width="25%" />
+</colgroup>
+<thead>
+<tr class="header">
+<th>Description</th>
+<th>Type</th>
+<th>Interface</th>
+<th>Details</th>
+</tr>
+</thead>
+<tbody>
+<tr class="odd">
+<td><p>PC video</p></td>
+<td><p>Video input</p></td>
+<td><p>DisplayPort 1.2</p></td>
+<td><ul>
+<li><p>Full screen display of 1080p at 120 Hz, plus audio</p></li>
+<li><p>HDCP compliant</p></li>
+</ul></td>
+</tr>
+<tr class="even">
+<td><p>Internal peripherals</p></td>
+<td><p>USB output</p></td>
+<td><p>USB 2.0 type B</p></td>
+<td><ul>
+<li><p>Touch</p></li>
+<li><p>Pen</p></li>
+<li><p>Speakers</p></li>
+<li><p>Microphone</p></li>
+<li><p>Cameras</p></li>
+<li><p>NFC sensor</p></li>
+<li><p>Ambient light sensor</p></li>
+<li><p>Passive infrared sensor</p></li>
+</ul></td>
+</tr>
+<tr class="odd">
+<td><p>USB hub</p></td>
+<td><p>USB output</p></td>
+<td><p>USB 2.0 type B</p></td>
+<td><ul>
+<li><p>Underneath USB ports</p></li>
+</ul></td>
+</tr>
+</tbody>
+</table>
+
+ 
+
+Replacement PC ports on 84" Surface Hub.
+
+![image showing replacement pc ports on 84" surface hub. ](images/sh-84-rpc-ports.png)
+
+<table>
+<colgroup>
+<col width="25%" />
+<col width="25%" />
+<col width="25%" />
+<col width="25%" />
+</colgroup>
+<thead>
+<tr class="header">
+<th>Description</th>
+<th>Type</th>
+<th>Interface</th>
+<th>Details</th>
+</tr>
+</thead>
+<tbody>
+<tr class="odd">
+<td><p>PC video</p></td>
+<td><p>Video input</p></td>
+<td><p>DisplayPort 1.2 (2x)</p></td>
+<td><ul>
+<li><p>Full screen display of 2160p at 120 Hz, plus audio</p></li>
+<li><p>HDCP compliant</p></li>
+</ul></td>
+</tr>
+<tr class="even">
+<td><p>Internal peripherals</p></td>
+<td><p>USB output</p></td>
+<td><p>USB 2.0 type B</p></td>
+<td><ul>
+<li><p>Touch</p></li>
+<li><p>Pen</p></li>
+<li><p>Speakers</p></li>
+<li><p>Microphone</p></li>
+<li><p>Cameras</p></li>
+<li><p>NFC sensor</p></li>
+<li><p>Ambient light sensor</p></li>
+<li><p>Passive infrared sensor</p></li>
+</ul></td>
+</tr>
+<tr class="odd">
+<td><p>USB hub</p></td>
+<td><p>USB output</p></td>
+<td><p>USB 2.0 type B</p></td>
+<td><ul>
+<li><p>Underneath USB ports</p></li>
+</ul></td>
+</tr>
+</tbody>
+</table>
+
+ 
+
+### Replacement PC setup instructions
+
+**To use replacement PC mode**
+
+1.  Download and install the [Surface Hub Replacement PC driver package](https://www.microsoft.com/en-us/download/details.aspx?id=52210) on the replacement PC.
+
+    **Note**  We recommend that you set sleep or hibernation on the replacement PC so the Surface Hub will turn off the display when it isn't being used.
+
+     
+
+2.  Turn off the Surface Hub using the power switch next to the power cable.
+
+3.  Connect the cables from the Surface Hub's replacement PC ports to the replacement PC. These ports are usually covered by a removable plastic cover.
+
+    55" Surface Hub -- connect one DisplayPort cable, and two USB cables.
+
+    84" Surface Hub -- connect two DisplayPort cables, and two USB cables.
+
+4.  Toggle the Mode switch to **Replacement PC**. The Mode switch is next to the Replacement PC ports.
+
+5.  Turn on the Surface Hub using the power switch next to the power cable.
+
+6.  Press the power button on the right side of the Surface Hub.
+
+You can switch the Surface Hub to use the internal PC.
+
+**To switch back to internal PC**
+
+1.  Turn off the Surface Hub using the power switch next to the power cable.
+
+2.  Toggle the Mode switch to Internal PC. The Mode switch is next to the Replacement PC ports.
+
+3.  Turn on the Surface Hub using the power switch next to the power cable.
+
+ 
+
+ 
+
+
+
+
+

devices/surface/TOC.md

@@ -0,0 +1,14 @@
+# [Surface](index.md)
+## [Advanced UEFI security features for Surface](advanced-uefi-security-features-for-surface.md)
+## [Customize the OOBE for Surface deployments](customize-the-oobe-for-surface-deployments.md)
+## [Download the latest firmware and drivers for Surface devices](deploy-the-latest-firmware-and-drivers-for-surface-devices.md)
+## [Enable PEAP, EAP-FAST, and Cisco LEAP on Surface devices](enable-peap-eap-fast-and-cisco-leap-on-surface-devices.md)
+## [Ethernet adapters and Surface deployment](ethernet-adapters-and-surface-device-deployment.md)
+## [Manage Surface Dock firmware updates](manage-surface-dock-firmware-updates.md)
+## [Manage Surface driver and firmware updates](manage-surface-pro-3-firmware-updates.md)
+## [Surface Data Eraser](microsoft-surface-data-eraser.md)
+## [Surface Deployment Accelerator](microsoft-surface-deployment-accelerator.md)
+### [Step by step: Surface Deployment Accelerator](step-by-step-surface-deployment-accelerator.md)
+## [Surface Diagnostic Toolkit](surface-diagnostic-toolkit.md)
+## [Surface Dock Updater](surface-dock-updater.md)
+

devices/surface/advanced-uefi-security-features-for-surface.md

@@ -0,0 +1,165 @@
+---
+title: Advanced UEFI security features for Surface (Surface)
+description: This article describes how to install and configure the v3.11.760.0 UEFI update to enable additional security options for Surface Pro 3 devices.
+ms.assetid: 90F790C0-E5FC-4482-AD71-60589E3C9C93
+keywords: ["Surface, Surface Pro 3, security, features, configure, hardware, device, custom, script, update"]
+ms.prod: W10
+ms.mktglfcycl: manage
+ms.sitesec: library
+author: heatherpoulsen
+---
+
+# Advanced UEFI security features for Surface
+
+
+This article describes how to install and configure the v3.11.760.0 UEFI update to enable additional security options for Surface Pro 3 devices.
+
+To address more granular control over the security of Surface devices, the v3.11.760.0 UEFI update provides additional security options that allow you to disable specific hardware devices or to prevent starting from those devices. After the UEFI update is installed on a device, you can configure it manually or automatically by running a script.
+
+## Manually install the UEFI update
+
+
+Before you can configure the advanced security features of your Surface device, you must first install the v3.11.760.0 UEFI update. This update is installed automatically if you receive your updates from Windows Update. For more information about how to configure Windows to update automatically using Windows Update, see [How to configure and use Automatic Updates in Windows]( http://go.microsoft.com/fwlink/p/?LinkID=618030). Otherwise, you can download the UEFI update from the Microsoft Download Center; see [SurfacePro3\_ 150326.msi (105 MB)](http://go.microsoft.com/fwlink/p/?LinkID=618033) or [SurfacePro3\_ 150326.zip (156 MB)](http://go.microsoft.com/fwlink/p/?LinkID=618035).
+
+## Manually configure additional security settings
+
+
+**Note**  To enter firmware setup on a Surface device, begin with the device powered off, press and hold the **Volume Up** button, then press and release the **Power** button, then release the **Volume Up** button after the device has begun to boot.
+
+ 
+
+After the v3.11.760.0 UEFI update is installed on a Surface device, an additional UEFI menu named **Advanced Device Security** becomes available. If you click this menu, the following options are displayed:
+
+| Option         | Description                                                                                                                                                                          | Available settings (default listed in bold) |
+|----------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------|
+| Network Boot   | Enables or disables the ability of your Surface device to boot from the network (also known as PXE boot).                                                                            | **Enabled**, Not Bootable                   |
+| Side USB       | Enables or disables the USB port on the side of the Surface device. Additionally, the USB port can be enabled, but not allow booting.                                                | **Enabled**, Not Bootable, Disabled         |
+| Docking Port   | Enables or disables the ports on the Surface docking station. Additionally, the docking port can be enabled, but block booting from any USB or Ethernet port in the docking station. | **Enabled**, Not Bootable, Disabled         |
+| Front Camera   | Enables or disables the camera on the front of the Surface device.                                                                                                                   | **Enabled**, Disabled                       |
+| Rear Camera    | Enables or disables the camera on the rear of the Surface device.                                                                                                                    | **Enabled**, Disabled                       |
+| On Board Audio | Enables or disables audio on the Surface device.                                                                                                                                     | **Enabled**, Disabled                       |
+| microSD        | Enables or disables the microSD slot on the Surface device.                                                                                                                          | **Enabled**, Disabled                       |
+| WiFi           | Enables or disables the built-in Wi-Fi transceiver in the Surface device. This also disables Bluetooth.                                                                              | **Enabled**, Disabled                       |
+| Bluetooth      | Enables or disables the built-in Bluetooth transceiver in the Surface device.                                                                                                        | **Enabled**, Disabled                       |
+
+ 
+
+## Automate additional security settings
+
+
+As an IT professional with administrative privileges, you can automate the configuration of UEFI settings by leveraging [Surface Pro 3 Firmware Tools (476 KB)](http://go.microsoft.com/fwlink/p/?LinkID=618038) available from the Microsoft Download Center. These tools install a .NET assembly that can be called from any custom application or script.
+
+**Prerequisites**
+
+-   The sample scripts below leverage the previously mentioned extension and therefore assume that the tool has been installed on the device being managed.
+-   The scripts must be run with administrative privilege.
+-   The Windows PowerShell command [**Set-ExecutionPolicy Unrestricted**](http://go.microsoft.com/fwlink/p/?LinkID=618039) must be called prior to running sample scripts if they are not digitally signed.
+
+**Sample scripts**
+
+**Note**  The UEFI password used in the sample scripts below is presented in clear text. We strongly recommend saving the scripts in a protected location and running them in a controlled environment.
+
+ 
+
+Show all configurable options:
+
+```
+# Load the extension 
+[System.Reflection.Assembly]::Load("SurfaceUefiManager, Version=1.0.5483.22783, Culture=neutral, PublicKeyToken=20606f4b5276c705")  
+ 
+# Get the collection of all configurable settings 
+$uefiOptions = [Microsoft.Surface.FirmwareOption]::All() 
+ 
+foreach ($uefiOption in $uefiOptions) 
+{ 
+    Write-Host "Name:" $uefiOption.Name 
+    Write-Host " Description =" $uefiOption.Description 
+    Write-Host " Current Value =" $uefiOption.CurrentValue 
+    Write-Host " Default Value =" $uefiOption.DefaultValue 
+    Write-Host " Proposed Value =" $uefiOption.ProposedValue 
+     
+    # This gives usage and validation information 
+    Write-Host " Allowed Values =" $uefiOption.FriendlyRegEx 
+    Write-Host " Regular Expression =" $uefiOption.RegEx 
+     
+    Write-Host 
+}
+```
+
+Set or change UEFI password:
+
+```
+# Load the extension 
+[System.Reflection.Assembly]::Load("SurfaceUefiManager, Version=1.0.5483.22783, Culture=neutral, PublicKeyToken=20606f4b5276c705")  
+ 
+# Must supply UEFI administrator Password if set 
+# If it is not currently set this is ignored 
+[Microsoft.Surface.FirmwareOption]::Unlock("1234") 
+ 
+$Password = [Microsoft.Surface.FirmwareOption]::Find("Password") 
+ 
+# Set New value to 12345 
+$Password.ProposedValue = "12345"
+```
+
+Check status of proposed changes:
+
+```
+# Load the extension 
+[System.Reflection.Assembly]::Load("SurfaceUefiManager, Version=1.0.5483.22783, Culture=neutral, PublicKeyToken=20606f4b5276c705")  
+ 
+# Check update status 
+$updateStatus = [Microsoft.Surface.FirmwareOption]::UpdateStatus 
+$updateIteration = [Microsoft.Surface.FirmwareOption]::UpdateIteration 
+Write-Host "Last Update Status =" $updateStatus 
+Write-Host "Last Update Iteration =" $updateIteration 
+ 
+# Get the individual results for the last proposed update 
+# If the device has never had an update attempt this will be an empty list 
+$details = [Microsoft.Surface.FirmwareOption]::UpdateStatusDetails 
+Write-Host $details.Count "Settings were proposed" 
+if ($details.Count -gt 0) 
+{ 
+    Write-Host "Result Details" 
+    foreach ($detail in $details.GetEnumerator()) 
+    { 
+        Write-Host " " $detail.Key "=" $detail.Value 
+    } 
+}
+```
+
+Revert UEFI to default values:
+
+```
+# Load the extension 
+[System.Reflection.Assembly]::Load("SurfaceUefiManager, Version=1.0.5483.22783, Culture=neutral, PublicKeyToken=20606f4b5276c705")  
+ 
+# Must supply UEFI administrator Password if set 
+# If it is not currently set this is ignored 
+[Microsoft.Surface.FirmwareOption]::Unlock("1234") 
+ 
+# Get the collection of all configurable settings 
+$uefiOptions = [Microsoft.Surface.FirmwareOption]::All() 
+ 
+# Reset all options to the factory default 
+foreach ($uefiOption in $uefiOptions) 
+{ 
+    $uefiOption.ProposedValue = $uefiOption.DefaultValue 
+}
+```
+
+Status code interpretation
+
+-   00 - The proposed update was a success
+-   02 - One of the proposed values had an invalid value
+-   03 - There was a proposed value set that was not recognized
+-   0F - The unlock password did not match currently set password
+
+ 
+
+ 
+
+
+
+
+

devices/surface/customize-the-oobe-for-surface-deployments.md

@@ -0,0 +1,70 @@
+---
+title: Customize the OOBE for Surface deployments (Surface)
+description: This article will walk you through the process of customizing the Surface out-of-box experience for end users in your organization.
+ms.assetid: F6910315-9FA9-4297-8FA8-2C284A4B1D87
+keywords: ["deploy, customize, automate, deployment, network, Pen, pair, boot"]
+ms.prod: W10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+author: heatherpoulsen
+---
+
+# Customize the OOBE for Surface deployments
+
+
+This article will walk you through the process of customizing the Surface out-of-box experience for end users in your organization.
+
+It is common practice in a Windows deployment to customize the user experience for the first startup of deployed computers — the out-of-box experience, or OOBE.
+
+**Note**  
+OOBE is also often used to describe the phase, or configuration pass, of Windows setup during which the user experience is displayed. For more information about the OOBE phase of setup, see [How Configuration Passes Work](http://msdn.microsoft.com/library/windows/hardware/dn898581(v=vs.85).aspx).
+
+ 
+
+In some scenarios, you may want to provide complete automation to ensure that at the end of a deployment, computers are ready for use without any interaction from the user. In other scenarios, you may want to leave key elements of the experience for users to perform necessary actions or select between important choices. For administrators deploying to Surface devices, each of these scenarios presents a unique challenge to overcome.
+
+This article provides a summary of the scenarios where a deployment might require additional steps. It also provides the required information to ensure that the desired experience is achieved on any newly deployed Surface device. This article is intended for administrators who are familiar with the deployment process, as well as concepts such as answer files and [reference images](http://go.microsoft.com/fwlink/p/?LinkID=618042).
+
+**Note**  
+Although the OOBE phase of setup is still run during a deployment with an automated deployment solution such as the [Microsoft Deployment Toolkit (MDT)](http://go.microsoft.com/fwlink/p/?LinkId=618117) or System Center Configuration Manager Operating System Deployment (OSD), it is automated by the settings supplied in the Deployment Wizard and task sequence. For more information see:
+
+-   [Deploy Windows 10 with the Microsoft Deployment Toolkit](http://technet.microsoft.com/en-us/itpro/windows/deploy/deploy-windows-10-with-the-microsoft-deployment-toolkit)
+
+-   [Deploy Windows 10 with System Center 2012 R2 Configuration Manager](http://technet.microsoft.com/en-us/itpro/windows/deploy/deploy-windows-10-with-system-center-2012-r2-configuration-manager)
+
+ 
+
+## Scenario 1: Wireless networking in OOBE with MDT 2013
+
+
+When a wireless network adapter is present during OOBE, the **Join a wireless network** page is displayed, which prompts a user to connect to a wireless network. This page is not automatically hidden by deployment technologies, including MDT 2013, and therefore will be displayed even when a deployment is configured for complete automation.
+
+To ensure that an automated deployment is not stopped by this page, the page must be hidden by configuring an additional setting in the answer file, **HideWirelessSetupInOOBE**. You can find additional information about the **HideWirelessSetupInOOBE** setting in [Unattended Windows Setup Reference](http://go.microsoft.com/fwlink/p/?LinkID=618044).
+
+## Scenario 2: Surface Pen pairing in OOBE
+
+
+When you first take a Surface Pro 3, Surface Pro 4, or Surface Book out of the package and start it up, the first-run experience of the factory image includes a prompt that asks you to pair the included Surface Pen to the device. This prompt is only provided by the factory image that ships with the device and is not included in other images used for deployment, such as the Windows Enterprise installation media downloaded from the Volume Licensing Service Center. Because pairing the Bluetooth Surface Pen outside of this experience requires that you enter the Control Panel or PC Settings and manually pair a Bluetooth device, you may want to have users or a technician use this prompt to perform the pairing operation.
+
+To provide the factory Surface Pen pairing experience in OOBE, you must copy four files from the factory Surface image into the reference image. You can copy these files into the reference environment before you capture the reference image, or you can add them later by using Deployment Image Servicing and Management (DISM) to mount the image. The four required files are:
+
+-   %windir%\\system32\\oobe\\info\\default\\1033\\oobe.xml
+-   %windir%\\system32\\oobe\\info\\default\\1033\\PenPairing\_en-US.png
+-   %windir%\\system32\\oobe\\info\\default\\1033\\PenError\_en-US.png
+-   %windir%\\system32\\oobe\\info\\default\\1033\\PenSuccess\_en-US.png
+
+**Note**  
+You should copy the files from a factory image for the same model Surface device that you intend to deploy to. For example, you should use the files from a Surface Pro 3 to deploy to Surface Pro 3, and the files from Surface Book to deploy Surface Book, but you should not use the files from a Surface Pro 3 to deploy Surface Book or Surface Pro 4.
+
+ 
+
+The step-by-step process for adding these required files to an image is described in [Deploying Surface Pro 3 Pen and OneNote Tips](http://go.microsoft.com/fwlink/p/?LinkID=618045). This blog post also includes tips to ensure that the necessary updates for the Surface Pen Quick Note-Taking Experience are installed, which allows users to send notes to OneNote with a single click.
+
+ 
+
+ 
+
+
+
+
+

devices/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices.md

@@ -0,0 +1,197 @@
+---
+title: Download the latest firmware and drivers for Surface devices (Surface)
+description: This article provides a list of the available downloads for Surface devices and links to download the drivers and firmware for your device.
+ms.assetid: 7662BF68-8BF7-43F7-81F5-3580A770294A
+keywords: ["update Surface, newest, latest, download, firmware, driver, tablet, hardware, device"]
+ms.prod: W10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+author: heatherpoulsen
+---
+
+# Download the latest firmware and drivers for Surface devices
+
+
+This article provides a list of the available downloads for Surface devices and links to download the drivers and firmware for your device.
+
+As easy as it is to keep Surface device drivers and firmware up to date automatically with Windows Update, it is sometimes necessary to download and install updates manually, such as during a Windows deployment. For any situation where you need to install drivers and firmware separately from Windows Update, you can find the files available for download at the Microsoft Download Center.
+
+On the Microsoft Download Center page for your device, you will find several files available. These files allow you to deploy drivers and firmware in various ways. You can read more about the different deployment methods for Surface drivers and firmware in [Manage Surface driver and firmware updates](manage-surface-pro-3-firmware-updates.md).
+
+Driver and firmware updates for Surface devices are released in one of two ways:
+
+-   **Point updates** are released for specific drivers or firmware revisions and provide the latest update for a specific component of the Surface device.
+
+-   **Cumulative updates** provide comprehensive roundups of all of the latest files for the Surface device running that version of Windows.
+
+Installation files for administrative tools, drivers for accessories, and updates for Windows are also available for some devices and are detailed here in this article.
+
+**Note**  
+To simplify the process of locating drivers for your device, downloads for Surface devices have been reorganized to separate pages for each model. Bookmark the Microsoft Download Center page for your device from the links provided on this page. Many of the filenames contain a placeholder denoted with *xxxxxx*, which identifies the current version number or date of the file.
+
+ 
+
+Recent additions to the downloads for Surface devices provide you with options to install Windows 10 on your Surface devices and update LTE devices with the latest Windows 10 drivers and firmware.
+
+**Note**  A battery charge of 40% or greater is required before you install firmware to a Surface device. See [Microsoft Support article KB2909710](http://go.microsoft.com/fwlink/p/?LinkId=618106) for more information.
+
+ 
+
+## Surface Book
+
+
+Download the following updates [for Surface Book from the Microsoft Download Center](http://go.microsoft.com/fwlink/p/?LinkId=691691).
+
+-   SurfaceBook\_Win10\_xxxxxx.msi – Cumulative firmware and driver update package for Windows 10
+
+-   Wintab-xxxxx-64-bit.zip – Tablet driver update for all supported x64-based versions of Windows 8.1
+
+## Surface Pro 4
+
+
+Download the following updates for [Surface Pro 4 from the Microsoft Download Center](http://go.microsoft.com/fwlink/p/?LinkId=691692).
+
+-   SurfacePro4\_Win10\_xxxxxx.msi – Cumulative firmware and driver update package for Windows 10
+
+-   Wintab-xxxxx-64-bit.zip – Tablet driver update for all supported x64-based versions of Windows 8.1
+
+## <a href="" id="surface-pro-3-"></a>Surface Pro 3
+
+
+Download the following updates [for Surface Pro 3 from the Microsoft Download Center](http://go.microsoft.com/fwlink/p/?LinkId=690288).
+
+-   SurfacePro3\_Win10\_xxxxxx.msi – Cumulative firmware and driver update package for Windows 10
+
+-   SurfacePro3\_Win10\_xxxxxx.zip – Cumulative firmware and driver update package for Windows 10
+
+-   SurfacePro3\_xxxxxx.msi – Cumulative firmware and driver update package for Windows 8.1 Pro
+
+-   SurfacePro3\_xxxxxx.zip – Cumulative firmware and driver update package for Windows 8.1 Pro
+
+-   Surface Firmware Tool.msi – Firmware tools for UEFI management
+
+-   Surface Ethernet Adapter.zip – x64 Ethernet adapter drivers
+
+-   Surface Gigabit Ethernet Adapter.zip – x64 Ethernet adapter drivers
+
+-   Surface Pro 3 AssetTag.zip – UEFI Asset Tag management tool
+
+-   Surface Pro 3 Driver Set.ppkg – Deployment Asset Provisioning Package for Windows 10
+
+-   Surface Pro 3 KB2978002.zip – Update for Quick Note-Taking Experience feature in Windows 8.1
+
+-   Wintab-xxxxx-64-bit.zip – Tablet driver update for all supported x64-based versions of Windows 8.1
+
+## Surface 3
+
+
+Download the following updates [for Surface 3 from the Microsoft Download Center](http://go.microsoft.com/fwlink/p/?LinkId=690289).
+
+-   Surface3\_Win10\_xxxxxx.zip – Cumulative firmware and driver update package for Windows 10
+
+-   Surface3\_Win8x\_xxxxxx.msi – Cumulative firmware and driver update package for Windows 8.1 Pro
+
+-   Surface3\_Win8x\_xxxxxx.zip – Cumulative firmware and driver update package for Windows 8.1 Pro
+
+-   Surface Ethernet Adapter.zip – x64 Ethernet adapter drivers
+
+-   Surface Gigabit Ethernet Adapter.zip – x64 Ethernet adapter drivers
+
+-   Wintab-xxxxx-64-bit.zip – Tablet driver update for all supported x64-based versions of Windows 8.1
+
+## Surface 3 LTE
+
+
+Download the following updates [for AT&T 4G LTE versions of Surface 3 from the Microsoft Download Center](http://go.microsoft.com/fwlink/p/?LinkId=690290).
+
+-   Surface3\_US1\_Win10\_xxxxxx.msi – Surface 3 LTE AT&T - Cumulative firmware and driver update for locked carrier dependent AT&T devices in the US, running Windows 10
+
+-   Surface3\_US1\_Win10\_xxxxxx.zip – Surface 3 LTE AT&T - Cumulative firmware and driver update for locked carrier dependent AT&T devices in the US, running Windows 10
+
+-   Surface3\_US1\_Win8x\_xxxxxx.msi – Surface 3 LTE AT&T - Cumulative firmware and driver update for locked carrier dependent AT&T devices in the US, running Windows 8.1 Pro
+
+-   Surface3\_US1\_Win8x\_xxxxxx.zip – Surface 3 LTE AT&T - Cumulative firmware and driver update for locked carrier dependent AT&T devices in the US, running Windows 8.1 Pro
+
+-   Surface Ethernet Adapter.zip – x64 Ethernet adapter drivers
+
+-   Surface Gigabit Ethernet Adapter.zip – x64 Ethernet adapter drivers
+
+-   Wintab-xxxxx-64-bit.zip – Tablet driver update for all supported x64-based versions of Windows 8.1
+
+Download the following updates [for non-AT&T 4G LTE versions of Surface 3 from the Microsoft Download Center](http://go.microsoft.com/fwlink/p/?LinkId=690291).
+
+-   Surface3\_NAG\_Win10\_xxxxxx.msi – Surface 3 LTE North America - Cumulative firmware and driver update for unlocked carrier independent devices in the US, running Windows 10
+
+-   Surface3\_NAG\_Win10\_xxxxxx.zip – Surface 3 LTE North America - Cumulative firmware and driver update for unlocked carrier independent devices in the US, running Windows 10
+
+-   Surface3\_NAG\_Win8x\_xxxxxx.msi – Surface 3 LTE North America - Cumulative firmware and driver update for unlocked carrier independent devices in the US, running Windows 8.1 Pro
+
+-   Surface3\_NAG\_Win8x\_xxxxxx.zip – Surface 3 LTE North America - Cumulative firmware and driver update for unlocked carrier independent devices in the US, running Windows 8.1 Pro
+
+-   Surface Ethernet Adapter.zip – x64 Ethernet adapter drivers
+
+-   Surface Gigabit Ethernet Adapter.zip – x64 Ethernet adapter drivers
+
+-   Wintab-xxxxx-64-bit.zip – Tablet driver update for all supported x64-based versions of Windows 8.1
+
+Download the following updates [for 4G LTE Surface 3 versions for regions outside North America from the Microsoft Download Center](http://go.microsoft.com/fwlink/p/?LinkId=690292).
+
+-   Surface3\_ROW\_Win10\_xxxxxx.msi – Surface 3 LTE rest of the world cumulative - Cumulative firmware and driver update for carrier independent devices outside of the US, as well as for Japan, running Windows 10
+
+-   Surface3\_ROW\_Win10\_xxxxxx.zip – Surface 3 LTE rest of the world cumulative - Cumulative firmware and driver update for carrier independent devices outside of the US, as well as for Japan, running Windows 10
+
+-   Surface3\_ROW\_Win8x\_xxxxxx.msi – Surface 3 LTE rest of the world cumulative - Cumulative firmware and driver update for carrier independent devices outside of the US, as well as for Japan, running Windows 8.1 Pro
+
+-   Surface3\_ROW\_Win8x\_xxxxxx.zip – Surface 3 LTE rest of the world cumulative - Cumulative firmware and driver update for carrier independent devices outside of the US, as well as for Japan, running Windows 8.1 Pro
+
+-   Surface Ethernet Adapter.zip – x64 Ethernet adapter drivers
+
+-   Surface Gigabit Ethernet Adapter.zip – x64 Ethernet adapter drivers
+
+-   Wintab-xxxxx-64-bit.zip – Tablet driver update for all supported x64-based versions of Windows 8.1
+
+## Surface Pro 2
+
+
+Download the following updates [for Surface Pro 2 from the Microsoft Download Center](http://go.microsoft.com/fwlink/p/?LinkId=690293).
+
+-   SurfacePro2\_Win10\_xxxxxx.zip – Cumulative firmware and driver update package for Windows 10
+
+-   SurfacePro2\_Win8x\_xxxxxx.zip – Cumulative firmware and driver update package for Windows 8.1 Pro
+
+-   Surface Ethernet Adapter.zip – x64 Ethernet adapter drivers
+
+-   Surface Gigabit Ethernet Adapter.zip – x64 Ethernet adapter drivers
+
+-   Windows8.1-KB2969817-x64.msu – Fixes an issue that causes Surface devices to reboot twice after firmware updates are installed on all supported x64-based versions of Windows 8.1
+
+## Surface Pro
+
+
+Download the following updates [for Surface Pro from the Microsoft Download Center](http://go.microsoft.com/fwlink/p/?LinkId=690294).
+
+-   SurfacePro\_Win10\_xxxxxx.zip – Cumulative firmware and driver update package for Windows 10
+
+-   Surface Pro 1 - xxxxxx.zip – Cumulative firmware and driver update package for Windows 8.1 Pro
+
+-   Surface Ethernet Adapter.zip – x64 Ethernet adapter drivers
+
+-   Surface Gigabit Ethernet Adapter.zip – x64 Ethernet adapter drivers
+
+-   Windows8.1-KB2969817-x64.msu – Fixes an issue that causes Surface devices to reboot twice after firmware updates are installed on all supported x64-based versions of Windows 8.1
+
+## Surface RT
+
+
+There are no downloadable firmware or driver updates available for Surface RT. Updates can only be applied using Windows Update.
+
+If you have additional questions on the driver pack and updates, please contact [Microsoft Surface support for business](http://go.microsoft.com/fwlink/p/?LinkId=618107).
+
+ 
+
+ 
+
+
+
+
+

devices/surface/enable-peap-eap-fast-and-cisco-leap-on-surface-devices.md

@@ -0,0 +1,89 @@
+---
+title: Enable PEAP, EAP-FAST, and Cisco LEAP on Surface devices (Surface)
+description: Find out how to enable support for PEAP, EAP-FAST, or Cisco LEAP protocols on your Surface device.
+ms.assetid: A281EFA3-1552-467D-8A21-EB151E58856D
+keywords: ["network", "wireless", "device", "deploy", "authenticaion", "protocol"]
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+author: heatherpoulsen
+---
+
+# Enable PEAP, EAP-FAST, and Cisco LEAP on Surface devices
+
+
+Find out how to enable support for PEAP, EAP-FAST, or Cisco LEAP protocols on your Surface device.
+
+If you use PEAP, EAP-FAST, or Cisco LEAP in your enterprise network, you probably already know that these three wireless authentication protocols are not supported by Surface devices out of the box. Some users may discover this when they attempt to connect to your wireless network; others may discover it when they are unable to gain access to resources inside the network, like file shares and internal sites. For more information, see [Extensible Authentication Protocol](http://go.microsoft.com/fwlink/p/?LinkId=716899).
+
+You can add support for each protocol by executing a small MSI package from a USB stick or from a file share. For organizations that want to enable EAP support on their Surface devices, the MSI package format supports deployment with many management and deployment tools, like the Microsoft Deployment Toolkit (MDT) and System Center Configuration Manager.
+
+## <a href="" id="download-peap--eap-fast--or-cisco-leap-installation-files--"></a>Download PEAP, EAP-FAST, or Cisco LEAP installation files
+
+
+You can download the MSI installation files for PEAP, EAP-FAST, or Cisco LEAP in a single zip archive file from the Microsoft Download Center. To download this file, go to the [Surface Tools for IT](http://go.microsoft.com/fwlink/p/?LinkId=618121) page on the Microsoft Download Center, click **Download**, and then select the **Cisco EAP-Supplicant Installer.zip** file.
+
+## Deploy PEAP, EAP-FAST, or Cisco LEAP with MDT
+
+
+If you are already performing a Windows deployment to Surface devices in your organization, it is quick and easy to add the installation files for each protocol to your deployment share and configure automatic installation during deployment. You can even configure a task sequence that updates previously deployed Surface devices to provide support for these protocols using the same process.
+
+To enable support for PEAP, EAP-FAST, or Cisco LEAP on newly deployed Surface devices, follow these steps:
+
+1.  Download and extract the installation files for each protocol to separate folders in an easily accessible location.
+
+2.  Open the MDT Deployment Workbench and expand your deployment share to the **Applications** folder.
+
+3.  Select **New Application** from the **Action** pane.
+
+4.  Choose **Application with source files** to copy the MSI files into the Deployment Share.
+
+5.  Select the folder you created in step 1 for the desired protocol.
+
+6.  Name the folder in the deployment share where the installation files will be stored.
+
+7.  Specify the command line to deploy the application:
+
+    -   For PEAP use **EAP-PEAP.msi /qn /norestart**.
+
+    -   For LEAP use **EAP-LEAP.msi /qn /norestart**.
+
+    -   For EAP-FAST use **EAP-FAST.msi /qn /norestart**.
+
+8.  Use the default options to complete the New Application Wizard.
+
+9.  Repeat steps 3 through 8 for each desired protocol.
+
+After you’ve performed these steps to import the three MSI packages as applications into MDT, they will be available for selection in the Applications page of the Windows Deployment Wizard. Although in some simple deployment scenarios it might be sufficient to have technicians select each package at the time of deployment, it is not recommended. This practice introduces the possibility that a technician could attempt to apply these packages to computers other than Surface devices, or that a Surface device could be deployed without EAP support due to human error.
+
+To hide these applications from the Install Applications page, select the **Hide this application in the Deployment Wizard** checkbox in the properties of each application. After the applications are hidden, they will not be displayed as optional applications during deployment. To deploy them in your Surface deployment task sequence, they must be explicitly defined for installation through a separate step in the task sequence.
+
+To specify the protocol(s) explicitly, follow these steps:
+
+1.  Open your Surface deployment task sequence properties from the MDT Deployment Workbench.
+
+2.  On the **Task Sequence** tab, select the **Install Applications** step under **State Restore**. This is typically found between the pre-application and post-application Windows Update steps.
+
+3.  Use the **Add** button to create a new **Install Application** step from the **General** category.
+
+4.  Select **Install a single application** in the step **Properties** tab.
+
+5.  Select the desired EAP protocol from the list.
+
+6.  Repeat steps 2 through 5 for each desired protocol.
+
+## Deploy PEAP, EAP-FAST, or Cisco LEAP with Configuration Manager
+
+
+For organizations that manage Surface devices with Configuration Manager, it is even easier to deploy PEAP, EAP-FAST, or Cisco LEAP support to Surface devices. Simply import each MSI file as an application from the Software Library and configure a deployment to your Surface device collection.
+
+For more information on how to deploy applications with Configuration Manager see [How to Create Applications in Configuration Manager](http://go.microsoft.com/fwlink/p/?LinkId=761079) and [How to Deploy Applications in Configuration Manager](http://go.microsoft.com/fwlink/p/?LinkId=761080).
+
+ 
+
+ 
+
+
+
+
+

devices/surface/ethernet-adapters-and-surface-device-deployment.md

@@ -0,0 +1,91 @@
+---
+title: Ethernet adapters and Surface deployment (Surface)
+description: This article provides guidance and answers to help you perform a network deployment to Surface devices.
+ms.assetid: 5273C59E-6039-4E50-96B3-426BB38A64C0
+keywords: ["ethernet, deploy, removable, network, connectivity, boot, firmware, device, adapter, PXE boot, USB"]
+ms.prod: W10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+author: heatherpoulsen
+---
+
+# Ethernet adapters and Surface deployment
+
+
+This article provides guidance and answers to help you perform a network deployment to Surface devices.
+
+Network deployment to Surface devices can pose some unique challenges for system administrators. Due to the lack of a native wired Ethernet adapter, administrators must provide connectivity through a removable Ethernet adapter.
+
+## Select an Ethernet adapter for Surface devices
+
+
+Before you can address the concerns of how you will boot to your deployment environment or how devices will be recognized by your deployment solution, you have to use a wired network adapter.
+
+The primary concern when selecting an Ethernet adapter is how that adapter will boot your Surface device from the network. If you are pre-staging clients with Windows Deployment Services (WDS) or if you are using System Center Configuration Manager, you may also want to consider whether the removable Ethernet adapters will be dedicated to a specific Surface device or shared among multiple devices. See the [Manage MAC addresses with removable Ethernet adapters](#manage-mac-addresses) section of this article for more information on potential conflicts with shared adapters.
+
+Booting from the network (PXE boot) is only supported when you use an Ethernet adapter or docking station from Microsoft. To boot from the network, the chipset in the Ethernet adapter or dock must be detected and configured as a boot device in the firmware of the Surface device. Microsoft Ethernet adapters, such as the Surface Ethernet Adapter and the [Surface Dock](http://go.microsoft.com/fwlink/p/?LinkId=722364) use a chipset that is compatible with the Surface firmware.
+
+The following Ethernet devices are supported for network boot with Surface devices:
+
+-   Surface USB to Ethernet adapter
+
+-   Surface USB 3.0 Ethernet adapter
+
+-   Surface Dock
+
+-   Surface 3 Docking Station
+
+-   Surface Pro 3 Docking Station
+
+-   Docking Station for Surface Pro and Surface Pro 2
+
+Third-party Ethernet adapters are also supported for network deployment, although they do not support PXE boot. To use a third-party Ethernet adapter, you must load the drivers into the deployment boot image and you must launch that boot image from a separate storage device, such as a USB stick.
+
+## Boot Surface devices from the network
+
+
+To boot from the network or a connected USB stick, you must instruct the Surface device to boot from an alternate boot device. You can alter the boot order in the system firmware to prioritize USB boot devices, or you can instruct it to boot from an alternate boot device during the boot up process.
+
+To boot a Surface device from an alternative boot device, follow these steps:
+
+1.  Ensure the Surface device is powered off.
+2.  Press and hold the **Volume Down** button.
+3.  Press and release the **Power** button.
+4.  After the system begins to boot from the USB stick or Ethernet adapter, release the **Volume Down** button.
+
+**Note**  In addition to an Ethernet adapter, a keyboard must also be connected to the Surface device to enter the preinstallation environment and navigate the deployment wizard.
+
+ 
+
+To support booting from the network in a Windows Preinstallation Environment (WinPE), such as is used in the Microsoft Deployment Toolkit and Configuration Manager, you must add drivers for the Ethernet adapter to WinPE. You can download the drivers for Surface Ethernet adapters from the Microsoft Download Center page for your specific device. For a list of the available downloads for Surface devices, see [Download the latest firmware and drivers for Surface devices](deploy-the-latest-firmware-and-drivers-for-surface-devices.md).
+
+## <a href="" id="manage-mac-addresses"></a>Manage MAC addresses with removable Ethernet adapters
+
+
+Another consideration for administrators performing Windows deployment over the network is how you will identify computers when you use the same Ethernet adapter to deploy to more than one computer. A common identifier used by deployment technologies is the Media Access Control (MAC) address that is associated with each Ethernet adapter. However, when you use the same Ethernet adapter to deploy to multiple computers, you cannot use a deployment technology that inspects MAC addresses because there is no way to differentiate the MAC address of the removable adapter when used on the different computers.
+
+The simplest solution to avoid MAC address conflicts is to provide a dedicated removable Ethernet adapter for each Surface device. This can make sense in many scenarios where the Ethernet adapter or the additional functionality of the docking station will be used regularly. However, not all scenarios call for the additional connectivity of a docking station or support for wired networks.
+
+Another potential solution to avoid conflict when adapters are shared is to use the [Microsoft Deployment Toolkit (MDT)](http://go.microsoft.com/fwlink/p/?LinkId=618117) to perform deployment to Surface devices. MDT does not use the MAC address to identify individual computers and thus is not subject to this limitation. However, MDT does use Windows Deployment Services to provide PXE boot functionality, and is subject to the limitations regarding pre-staged clients which is covered later in this section.
+
+When you use a shared adapter for deployment, the solution for affected deployment technologies is to use another means to identify unique systems. For Configuration Manager and WDS, both of which can be affected by this issue, the solution is to use the System Universal Unique Identifier (System UUID) that is embedded in the computer firmware by the computer manufacturer. For Surface devices, you can see this entry in the computer firmware under **Device Information**.
+
+To access the firmware of a Surface device, follow these steps:
+
+1.  Ensure the Surface device is powered off.
+2.  Press and hold the **Volume Up** button.
+3.  Press and release the **Power** button.
+4.  After the device begins to boot, release the **Volume Up** button.
+
+When deploying with WDS, the MAC address is only used to identify a computer when the deployment server is configured to respond only to known, pre-staged clients. When pre-staging a client, an administrator creates a computer account in Active Directory and defines that computer by the MAC address or the System UUID. To avoid the identity conflicts caused by shared Ethernet adapters, you should use [System UUID to define pre-staged clients](http://go.microsoft.com/fwlink/p/?LinkId=618118). Alternatively, you can configure WDS to respond to unknown clients that do not require definition by either MAC address or System UUID by selecting the **Respond to all client computers (known and unknown)** option on the [**PXE Response** tab](http://go.microsoft.com/fwlink/p/?LinkId=618119) in **Windows Deployment Server Properties**.
+
+The potential for conflicts with shared Ethernet adapters is much higher with Configuration Manager. Where WDS only uses MAC addresses to define individual systems when configured to do so, Configuration Manager uses the MAC address to define individual systems whenever performing a deployment to new or unknown computers. This can result in improperly configured devices or even the inability to deploy more than one system with a shared Ethernet adapter. There are several potential solutions for this situation that are described in detail in the [How to Use The Same External Ethernet Adapter For Multiple SCCM OSD](http://go.microsoft.com/fwlink/p/?LinkId=618120) blog post on the Ask Premier Field Engineering (PFE) Platforms TechNet blog.
+
+ 
+
+ 
+
+
+
+
+

devices/surface/index.md

@@ -0,0 +1,96 @@
+---
+title: Surface (Surface)
+description: .
+ms.assetid: 2a6aec85-b8e2-4784-8dc1-194ed5126a04
+ms.prod: W10
+ms.mktglfcycl: manage
+ms.sitesec: library
+author: heatherpoulsen
+---
+
+# Surface
+
+
+## Purpose
+
+
+This library provides guidance to help you deploy Windows on Surface devices, keep those devices up to date, and easily manage and support Surface devices in your organization.
+## In this section
+
+
+<table>
+<colgroup>
+<col width="50%" />
+<col width="50%" />
+</colgroup>
+<thead>
+<tr class="header">
+<th>Topic</th>
+<th>Description</th>
+</tr>
+</thead>
+<tbody>
+<tr class="odd">
+<td><p>[Advanced UEFI security features for Surface](advanced-uefi-security-features-for-surface.md)</p></td>
+<td><p>This article describes how to install and configure the v3.11.760.0 UEFI update to enable additional security options for Surface Pro 3 devices.</p></td>
+</tr>
+<tr class="even">
+<td><p>[Customize the OOBE for Surface deployments](customize-the-oobe-for-surface-deployments.md)</p></td>
+<td><p>This article will walk you through the process of customizing the Surface out-of-box experience for end users in your organization.</p></td>
+</tr>
+<tr class="odd">
+<td><p>[Download the latest firmware and drivers for Surface devices](deploy-the-latest-firmware-and-drivers-for-surface-devices.md)</p></td>
+<td><p>This article provides a list of the available downloads for Surface devices and links to download the drivers and firmware for your device.</p></td>
+</tr>
+<tr class="even">
+<td><p>[Enable PEAP, EAP-FAST, and Cisco LEAP on Surface devices](enable-peap-eap-fast-and-cisco-leap-on-surface-devices.md)</p></td>
+<td><p>Find out how to enable support for PEAP, EAP-FAST, or Cisco LEAP protocols on your Surface device.</p></td>
+</tr>
+<tr class="odd">
+<td><p>[Ethernet adapters and Surface deployment](ethernet-adapters-and-surface-device-deployment.md)</p></td>
+<td><p>This article provides guidance and answers to help you perform a network deployment to Surface devices.</p></td>
+</tr>
+<tr class="even">
+<td><p>[Manage Surface Dock firmware updates](manage-surface-dock-firmware-updates.md)</p></td>
+<td><p>Read about the different methods you can use to manage the process of Surface Dock firmware updates.</p></td>
+</tr>
+<tr class="odd">
+<td><p>[Manage Surface driver and firmware updates](manage-surface-pro-3-firmware-updates.md)</p></td>
+<td><p>This article describes the available options to manage firmware and driver updates for Surface devices.</p></td>
+</tr>
+<tr class="even">
+<td><p>[Surface Data Eraser](microsoft-surface-data-eraser.md)</p></td>
+<td><p>Find out how the Microsoft Surface Data Eraser tool can help you securely wipe data from your Surface devices.</p></td>
+</tr>
+<tr class="odd">
+<td><p>[Surface Deployment Accelerator](microsoft-surface-deployment-accelerator.md)</p></td>
+<td><p>Microsoft Surface Deployment Accelerator provides a quick and simple deployment mechanism for organizations to reimage Surface devices.</p></td>
+</tr>
+<tr class="even">
+<td><p>[Surface Diagnostic Toolkit](surface-diagnostic-toolkit.md)</p></td>
+<td><p>Find out how you can use the Microsoft Surface Diagnostic Toolkit to test the hardware of your Surface device.</p></td>
+</tr>
+<tr class="odd">
+<td><p>[Surface Dock Updater](surface-dock-updater.md)</p></td>
+<td><p>This article provides a detailed walkthrough of Microsoft Surface Dock Updater.</p></td>
+</tr>
+</tbody>
+</table>
+
+ 
+
+## Related topics
+
+
+[Surface TechCenter](https://technet.microsoft.com/windows/surface)
+
+[Surface for IT pros blog](http://blogs.technet.com/b/surface/)
+
+ 
+
+ 
+
+
+
+
+

devices/surface/manage-surface-dock-firmware-updates.md

@@ -0,0 +1,118 @@
+---
+title: Manage Surface Dock firmware updates (Surface)
+description: Read about the different methods you can use to manage the process of Surface Dock firmware updates.
+ms.assetid: 86DFC0C0-C842-4CD1-A2D7-4425471FFE3F
+ms.prod: W10
+ms.mktglfcycl: manage
+ms.sitesec: library
+author: heatherpoulsen
+---
+
+# Manage Surface Dock firmware updates
+
+
+Read about the different methods you can use to manage the process of Surface Dock firmware updates.
+
+The Surface Dock provides external connectivity to Surface devices through a single cable connection that includes Power, Ethernet, Audio, USB 3.0, and DisplayPort. The numerous connections provided by the Surface Dock are enabled by a smart chipset within the Surface Dock device. Like a Surface device’s chipset, the chipset that is built into the Surface Dock is controlled by firmware.
+
+Like the firmware for Surface devices, firmware for Surface Dock is also contained within a downloaded driver that is visible in Device Manager. This driver stages the firmware update files on the Surface device. When a Surface Dock is connected and the driver is loaded, the newer version of the firmware staged by the driver is detected and firmware files are copied to the Surface Dock. The Surface Dock then begins a two-phase process to apply the firmware internally. Each phase requires the Surface Dock to be disconnected from the Surface device before the firmware is applied. The driver copies the firmware into the dock, but only applies it when the user disconnects the Surface device from the Surface Dock. This ensures that there are no disruptions because the firmware is only applied when the user leaves their desk with the device.
+
+**Note**  
+You can learn more about the firmware update process for Surface devices and how firmware is updated through driver installation at the following links:
+
+-   [How to manage and update your drivers and firmware for Surface](http://go.microsoft.com/fwlink/p/?LinkId=785353) from Microsoft Mechanics
+
+-   [Windows Update Makes Surface Better](http://go.microsoft.com/fwlink/p/?LinkId=785354)on the Microsoft Devices Blog
+
+ 
+
+The Surface Dock firmware update process shown in Figure 1 follows these steps:
+
+1.  Drivers for Surface Dock are installed on Surface devices that are connected, or have been previously connected, to a Surface Dock.
+
+2.  The drivers for Surface Dock are loaded when a Surface Dock is connected to the Surface device.
+
+3.  The firmware version installed in the Surface Dock is compared with the firmware version staged by the Surface Dock driver.
+
+4.  If the firmware version on the Surface Dock is older than the firmware version contained in the Surface Dock driver, the main chipset firmware update files are copied from the driver to the Surface Dock.
+
+5.  When the Surface Dock is disconnected, the Surface Dock installs the firmware update to the main chipset.
+
+6.  When the Surface Dock is connected again, the main chipset firmware is verified against the firmware present in the Surface Dock driver.
+
+7.  If the firmware update for the main chipset is installed successfully, the Surface Dock driver copies the firmware update for the DisplayPort.
+
+8.  When the Surface Dock is disconnected for a second time, the Surface dock installs the firmware update to the DisplayPort chipset. This process takes up to 3 minutes to apply.
+
+![figure 1](images/manage-surface-dock-fig1-updateprocess.png)
+
+*1- Driver installation can be performed by Windows Update, manual installation, or automatically downloaded with Microsoft Surface Dock Updater*
+
+*2 - The Surface Dock firmware installation process takes approximately 3 minutes*
+
+Figure 1. The Surface Dock firmware update process
+
+If the firmware installation process is interrupted (for example, if power is disconnected from the Surface Dock during firmware installation), the Surface Dock will automatically revert to the prior firmware without disruption to the user, and the update process will restart the next time the Surface Dock is disconnected. For most users this update process should be entirely transparent.
+
+## Methods for updating Surface Dock firmware
+
+
+There are three methods you can use to update the firmware of the Surface Dock:
+
+-   [Automatic installation of drivers with Windows Update](#automatic-installation)
+
+-   [Deployment of drivers downloaded from the Microsoft Download Center](#deployment-dlc)
+
+-   [Manually update with Microsoft Surface Dock Updater](#manual-updater)
+
+## <a href="" id="automatic-installation"></a>Automatic installation with Windows Update
+
+
+Windows Update is the method that most users will use. The drivers for the Surface Dock are downloaded automatically from Windows Update and the dock update process is initiated without additional user interaction. The two-phase dock update process described earlier occurs in the background as the user connects and disconnects the Surface Dock during normal use.
+
+**Note**  
+The driver version that is displayed in Device Manager may be different from the firmware version that the Surface Dock is using.
+
+ 
+
+## <a href="" id="deployment-dlc"></a>Deployment of drivers downloaded from the Microsoft Download Center
+
+
+This method is used mostly in environments where Surface device drivers and firmware are managed separately from Windows Update. See [Manage Surface driver and firmware updates](manage-surface-pro-3-firmware-updates.md) for more information about the different methods to manage Surface device driver and firmware updates. Updating the Surface Dock firmware through this method involves downloading and deploying an MSI package to the Surface device that contains the updated Surface Dock drivers and firmware. This is the same method recommended for updating all other Surface drivers and firmware. The two-phase firmware update process occurs in the background each time the Surface Dock is disconnected, just like it does with the Windows Update method.
+
+For more information about how to deploy MSI packages see [Create and deploy an application with System Center Configuration Manager](http://go.microsoft.com/fwlink/p/?LinkId=785355).
+
+**Note**  
+When drivers are installed through Windows Update or the MSI package, registry keys are added that indicate the version of firmware installed on the Surface Dock and contained within the Surface Dock driver. These registry keys can be found in:
+
+**HLKM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\WUDF\\Services\\SurfaceDockFwUpdate\\Parameters**
+
+Firmware status is displayed for both the main chipset (displayed as **Component10**) and the DisplayPort chipset (displayed as **Component20**). For each chipset there are four keys, where *xx* is **10** or **20** corresponding to each chipset:
+
+-   **Component*xx*CurrentFwVersion** – This key displays the version of firmware that is installed on the currently connected or most recently connected Surface Dock.
+
+-   **Component*xx*OfferFwVersion** – This key displays the version of firmware staged by the Surface Dock driver.
+
+-   **Component*xx*FirmwareUpdateStatus** – This key displays the stage of the Surface Dock firmware update process.
+
+-   **Component*xx*FirmwareUpdateStatusRejectReason** – This key changes as the firmware update is processed. It should result in 0 after the successful installation of Surface Dock firmware.
+
+These registry keys are not present unless you have installed updated Surface Dock drivers through Windows Update or MSI deployment.
+
+ 
+
+## <a href="" id="manual-updater"></a>Manually update with Microsoft Surface Dock Updater
+
+
+The manual method using the Microsoft Surface Dock Updater tool to update the Surface Dock is used mostly in environments where IT prepares Surface Docks prior to delivery to the end user, or for troubleshooting of a Surface Dock. Microsoft Surface Dock Updater is a tool that you can run from any Surface device that is compatible with the Surface Dock, and will walk you through the process of performing the Surface Dock firmware update in the least possible amount of time. You can also use this tool to verify the firmware status of a connected Surface Dock.
+
+For more information about how to use the Microsoft Surface Dock Updater tool, please see [Microsoft Surface Dock Updater](surface-dock-updater.md). You can download the Microsoft Surface Dock Updater tool from the [Surface Tools for IT page](http://go.microsoft.com/fwlink/p/?LinkId=618121) on the Microsoft Download Center.
+
+ 
+
+ 
+
+
+
+
+

devices/surface/manage-surface-pro-3-firmware-updates.md

@@ -0,0 +1,70 @@
+---
+title: Manage Surface driver and firmware updates (Surface)
+description: This article describes the available options to manage firmware and driver updates for Surface devices.
+ms.assetid: CD1219BA-8EDE-4BC8-BEEF-99B50C211D73
+keywords: ["Surface, Surface Pro 3, firmware, update, device, manage, deploy, driver, USB"]
+ms.prod: W10
+ms.mktglfcycl: manage
+ms.sitesec: library
+author: heatherpoulsen
+---
+
+# Manage Surface driver and firmware updates
+
+
+This article describes the available options to manage firmware and driver updates for Surface devices.
+
+For a list of the available downloads for Surface devices and links to download the drivers and firmware for your device, see [Download the latest firmware and drivers for Surface devices](deploy-the-latest-firmware-and-drivers-for-surface-devices.md).
+
+On Surface devices, the firmware is exposed to the operating system as a driver and is visible in Device Manager. This allows a Surface device firmware to be automatically updated along with all drivers through Windows Update. This mechanism provides a seamless, automatic experience to receive the latest firmware and driver updates. Although automatic updating is easy for end users, updating firmware and drivers automatically may not always apply to organizations and businesses. Automatic updates with Windows Update may not be applicable where updates are carefully managed, or when you deploy a new operating system to a Surface device.
+
+## <a href="" id="methods-for-------firmware-deployment"></a>Methods for firmware deployment
+
+
+Although firmware is provided automatically by Windows Update for computers that receive updates directly from Microsoft, in environments where updates are carefully managed by using Windows Server Update Services (WSUS), updating the firmware through Windows Update is not supported. For managed environments, there are a number of options you can use to deploy firmware updates.
+
+**Windows Update**
+
+The simplest solution to ensure that firmware on Surface devices in your organization is kept up to date is to allow Surface devices to receive updates directly from Microsoft. You can implement this solution easily by excluding Surface devices from Group Policy that directs computers to receive updates from WSUS.
+
+Although this solution ensures that firmware will be updated as new releases are made available to Windows Update, it does present potential drawbacks. Each Surface device that receives Windows Updates directly will separately download each update rather than accessing a central location, which increases demand on Internet connectivity and bandwidth. Updates are also provided automatically to devices, without being subjected to testing or review by administrators.
+
+For details about Group Policy for client configuration of WSUS or Windows Update, see [Step 5: Configure Group Policy Settings for Automatic Updates](http://go.microsoft.com/fwlink/p/?LinkId=618172).
+
+**Windows Installer Package**
+
+The firmware and driver downloads for Surface devices now include MSI installation files for firmware and driver updates. These MSI packages can be deployed with utilities that support application deployment, including the Microsoft Deployment Toolkit (MDT) and System Center Configuration Manager. This solution allows for centralized deployment and for administrators to test and review firmware updates before they are deployed. For more information about the MSI package delivery method for firmware and driver updates, including details on what drivers are updated by the package and why certain drivers and firmware are not updated by the MSI package, see the [Surface Pro 3 MSI Now Available](http://go.microsoft.com/fwlink/p/?LinkId=618173) blog post.
+
+For instructions on how to deploy with System Center Configuration Manager, refer to [How to Deploy Applications in Configuration Manager](http://go.microsoft.com/fwlink/p/?LinkId=618175). For deployment of applications with MDT, see [Step 4: Add an application in the Deploy a Windows 8.1 Image Using MDT 2013](http://go.microsoft.com/fwlink/p/?LinkId=618176). Note that you can deploy applications separately from an operating system deployment through MDT by using a Post OS Installation task sequence.
+
+**Provisioning packages**
+
+New in Windows 10, provisioning packages (PPKG files) provide a simple method to apply a configuration to a destination device. You can find out more about provisioning packages, including instructions for how to create your own, in [Provisioning packages](http://go.microsoft.com/fwlink/p/?LinkId=761075). For easy application of a complete set of drivers and firmware to devices running Windows 10, a provisioning package is supplied for Surface Pro 3 devices. This file contains all of the instructions and required assets to update a Surface Pro 3 device with Windows 10 to the latest drivers and firmware.
+
+**Windows PowerShell**
+
+Another method you can use to update the firmware when Windows Updates are managed in the organization is to install the firmware from the firmware and driver pack by using PowerShell. This method allows for a similar deployment experience to the Windows Installer package and can similarly be deployed as a package by using System Center Configuration Manager. You can find the PowerShell script and details on how to perform the firmware deployment in the [Deploying Drivers and Firmware to Surface Pro](http://go.microsoft.com/fwlink/p/?LinkId=618177) blog post.
+
+## Operating system deployment considerations
+
+
+The deployment of firmware updates during an operating system deployment is a straightforward process. The firmware and driver pack can be imported into either System Center Configuration Manager or MDT, and are used to deploy a fully updated environment, complete with firmware, to a target Surface device. For a complete step-by-step guide for deployment to Surface Pro 3 using either Configuration Manager or MDT, download the [Deployment and Administration Guide for Surface Pro 3](http://go.microsoft.com/fwlink/p/?LinkId=618178) from the Microsoft Download Center.
+
+The individual driver files are also made available in the Microsoft Download Center if you are using deployment tools. The driver files are available in the ZIP archive file in the list of available downloads for your device.
+
+**Windows PE and Surface firmware and drivers**
+
+A best practice for deployment with any solution that uses the Windows Preinstallation Environment (WinPE), such as System Center Configuration Manager or MDT, is to configure WinPE with only the drivers that are required during the WinPE stage of deployment. These usually include drivers for network adapters and storage controllers. This best practice helps to prevent errors with more complex drivers that rely on components that are not present in WinPE. For Surface Pro 3 devices, this is especially true of the Touch Firmware. The Touch Firmware should never be loaded in a WinPE environment on Surface Pro 3.
+
+**Update Surface Pro 3 firmware offline through USB**
+
+In some early versions of Surface Pro 3 firmware, PXE boot performance can be quite slow. This has been resolved with updated firmware, but for organizations where firmware will be updated through operating system deployment, this issue is encountered before the updates can be deployed to the device. In this scenario, you can deploy updated firmware through a USB drive to ensure that when the operating system deployment is initiated, the network boot is quick, and deployment can complete in a timely fashion. To create a USB drive to update Surface Pro 3 firmware, see [How to Update the Surface Pro 3 Firmware Offline using a USB Drive](http://go.microsoft.com/fwlink/p/?LinkId=618189) on the Ask Premier Field Engineering (PFE) Platforms TechNet Blog.
+
+ 
+
+ 
+
+
+
+
+

devices/surface/microsoft-surface-data-eraser.md

@@ -0,0 +1,149 @@
+---
+title: Microsoft Surface Data Eraser (Surface)
+description: Find out how the Microsoft Surface Data Eraser tool can help you securely wipe data from your Surface devices.
+ms.assetid: 8DD3F9FE-5458-4467-BE26-E9200341CF10
+keywords: ["tool", "USB", "data", "erase"]
+ms.prod: W10
+ms.mktglfcycl: manage
+ms.sitesec: library
+author: heatherpoulsen
+---
+
+# Microsoft Surface Data Eraser
+
+
+Find out how the Microsoft Surface Data Eraser tool can help you securely wipe data from your Surface devices.
+
+[Microsoft Surface Data Eraser](http://go.microsoft.com/fwlink/p/?LinkId=691148) is a tool that boots from a USB stick and allows you to perform a secure wipe of all data from a compatible Surface device. A Microsoft Surface Data Eraser USB stick requires only the ability to boot from USB. The USB tool is easy to create by using the provided wizard, the Microsoft Surface Data Eraser Wrapper, and is easy to use with a simple graphic interface, no command line needed. To learn more about the data wiping capabilities and practices Microsoft uses during the service process for Surface, see [Protecting your data if you send your Surface in for service](http://go.microsoft.com/fwlink/p/?LinkId=691222).
+
+Compatible Surface devices include:
+
+-   Surface Book
+
+-   Surface Pro 4
+
+-   Surface Pro3
+
+-   Surface 3
+
+-   Surface 3 LTE
+
+-   Surface Pro 2
+
+Some scenarios where Microsoft Surface Data Eraser can be helpful include:
+
+-   Prepare a Surface device to be sent for repair
+
+-   Decommission a Surface device to be removed from corporate or organizational use
+
+-   Repurpose a Surface device for use in a new department or for use by a new user
+
+-   Standard practice when performing reimaging for devices used with sensitive data
+
+**Note**  
+Third-party devices, Surface devices running Windows RT (including Surface and Surface 2), and Surface Pro are not compatible with Microsoft Surface Data Eraser.
+
+ 
+
+**Note**  
+Because the ability to boot to USB is required to run Microsoft Surface Data Eraser, if the device is not configured to boot from USB or if the device is unable to boot or POST successfully, the Microsoft Surface Data Eraser tool will not function.
+
+ 
+
+## How to create a Microsoft Surface Data Eraser USB stick
+
+
+To create a Microsoft Surface Data Eraser USB stick, first install the Microsoft Surface Data Eraser setup tool from the Microsoft Download Center using the link provided at the beginning of this article. You do not need a Surface device to *create* the USB stick. After you have downloaded the installation file to your computer, follow these steps to install the Microsoft Surface Data Eraser creation tool:
+
+1.  Run the DataEraserSetup.msi installation file that you downloaded from the Microsoft Download Center.
+
+2.  Select the check box to accept the terms of the license agreement, and then click **Install**.
+
+3.  Click **Finish** to close the Microsoft Surface Data Eraser setup window.
+
+After the creation tool is installed, follow these steps to create a Microsoft Surface Data Eraser USB stick. Before you begin these steps, ensure that you have a USB 3.0 stick that is 4 GB or larger connected to the computer.
+
+1.  Start Microsoft Surface Data Eraser from the Start menu or Start screen.
+
+2.  Click **Build** to begin the Microsoft Surface Data Eraser USB creation process.
+
+3.  Click **Start** to acknowledge that you have a USB stick of at least 4 GB connected, as shown in Figure 1.
+
+    ![figure 1](images/dataeraser-start-tool.png)
+
+    Figure 1. Start the Microsoft Surface Data Eraser tool
+
+4.  Select the USB drive of your choice from the **USB Thumb Drive Selection** page as shown in Figure 2, and then click **Start** to begin the USB creation process. The drive you select will be formatted and any existing data on this drive will be lost.
+
+    **Note**  
+    If the Start button is disabled, check that your removable drive has a total capacity of at least 4 GB.
+
+     
+
+    ![figure 2](images/dataeraser-usb-selection.png)
+
+    Figure 2. USB thumb drive selection
+
+5.  After the creation process is finished, the USB drive has been formatted and all binaries are copied to the USB drive. Click **Success**.
+
+6.  When the **Congratulations** screen is displayed, you can eject and remove the thumb drive. This thumb drive is now ready to be inserted into a Surface device, booted from, and wipe any data on the device. Click **Complete** to finish the USB creation process, as shown in Figure 3.
+
+    ![figure 3](images/dataeraser-complete-process.png)
+
+    Figure 3. Complete the Microsoft Surface Data Eraser USB creation process
+
+7.  Click **X** to close Microsoft Surface Data Eraser.
+
+## How to use a Microsoft Surface Data Eraser USB stick
+
+
+After you create a Microsoft Surface Data Eraser USB stick, you can boot a supported Surface device from the USB stick by following this procedure:
+
+1.  Insert the bootable Microsoft Surface Data Eraser USB stick into the supported Surface device.
+
+2.  Ensure your system firmware is set to boot to USB. To enter the firmware settings:
+
+    1.  Turn off your Surface device.
+
+    2.  Press and hold the **Volume Up** button.
+
+    3.  Press and release the **Power** button.
+
+    4.  Release the **Volume Up** button.
+
+3.  When the Surface device boots, a **SoftwareLicenseTerms** text file is displayed.
+
+    ![](images/data-eraser-3.png)
+
+    Figure 4. Booting the Microsoft Surface Data Eraser USB stick
+
+4.  Read the software license terms, and then close the notepad file.
+
+5.  Accept or Decline the Software License Terms by typing **Accept** or **Decline**.
+
+6.  Select one of the following three options:
+
+    -   **Enter S to start Data Erase** – Select this option to begin the data erase process. You will have a chance to confirm in the next step.
+
+    -   **Enter D to perform Diskpart** – Select this option to use diskpart.exe to manage partitions on your disk.
+
+    -   **Enter X to shut device down** – Select this option to perform no action and shut down the device.
+
+7.  If you typed **S** to begin the data erase process, the partition that will be erased is displayed, as shown in Figure 5. If this is correct, press **Y** to continue, or **N** to shut down the device.
+
+    ![](images/sda-fig5-erase.png)
+
+    Figure 5. Partition to be erased is displayed in Microsoft Surface Data Eraser
+
+8.  If you pressed **Y** in step 7, due to the destructive nature of the data erasure process, an additional dialog box is displayed to confirm your choice.
+
+9.  Click the **Yes** button to continue erasing data on the Surface device.
+
+ 
+
+ 
+
+
+
+
+

devices/surface/microsoft-surface-deployment-accelerator.md

@@ -0,0 +1,91 @@
+---
+title: Microsoft Surface Deployment Accelerator (Surface)
+description: Microsoft Surface Deployment Accelerator provides a quick and simple deployment mechanism for organizations to reimage Surface devices.
+ms.assetid: E7991E90-4AAE-44B6-8822-58BFDE3EADE4
+keywords: ["deploy", "install", "tool"]
+ms.prod: W10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+author: heatherpoulsen
+---
+
+# Microsoft Surface Deployment Accelerator
+
+
+Microsoft Surface Deployment Accelerator provides a quick and simple deployment mechanism for organizations to reimage Surface devices.
+
+Microsoft Surface Deployment Accelerator includes a wizard that automates the creation and configuration of a Microsoft recommended deployment experience by using free Microsoft deployment tools. The resulting deployment solution is complete with everything you need to immediately begin the deployment of Windows to a Surface device. You can also use Microsoft Surface Deployment Accelerator to create and capture a Windows reference image and then deploy it with the latest Windows Updates.
+
+Microsoft Surface Deployment Accelerator is built on the powerful suite of deployment tools available from Microsoft including the Windows Assessment and Deployment Kit (ADK), the Microsoft Deployment Toolkit (MDT), and Windows Deployment Services (WDS). The resulting deployment share encompasses the recommended best practices for managing drivers during deployment and automating image creation and can serve as a starting point upon which you build your own customized deployment solution.
+
+You can find more information about how to deploy to Surface devices, including step-by-step walkthroughs of customized deployment solution implementation, on the Deploy page of the [Surface TechCenter](http://go.microsoft.com/fwlink/p/?LinkId=691693).
+
+### Download Microsoft Surface Deployment Accelerator
+
+You can download the installation files for Microsoft Surface Deployment Accelerator from the Microsoft Download Center. To download the installation files:
+
+1.  Go to the [Surface Tools for IT](http://go.microsoft.com/fwlink/p/?LinkId=618121) page on the Microsoft Download Center.
+
+2.  Click the **Download** button, select the **Surface\_Deployment\_Accelerator\_xxxx.msi** file, and then click **Next**.
+
+## Microsoft Surface Deployment Accelerator prerequisites
+
+
+Before you install Microsoft Surface Deployment Accelerator, your environment must meet the following prerequisites:
+
+-   Microsoft Surface Deployment Accelerator must be installed on Windows Server 2012 R2 or later
+
+-   PowerShell Script Execution Policy must be set to **Unrestricted**
+
+-   DHCP and DNS must be enabled on the network where the Windows Server 2012 R2 environment is connected
+
+-   To download Surface drivers and apps automatically the Windows Server 2012 R2 environment must have Internet access and Internet Explorer Enhanced Security Configuration must be disabled
+
+-   To support network boot, the Windows Server 2012 R2 environment must have Windows Deployment Services installed and configured to respond to PXE requests
+
+-   Access to Windows source files or installation media is required when you prepare a deployment with Microsoft Surface Deployment Accelerator
+
+-   At least 6 GB of free space for each version of Windows you intend to deploy
+
+## How Microsoft Surface Deployment Accelerator works
+
+
+As you progress through the Microsoft Surface Deployment Accelerator wizard, you will be asked some basic questions about how your deployment solution should be configured. As you select the desired Surface models to be supported and apps to be installed (see Figure 1), the wizard will prepare scripts that download, install, and configure everything needed to perform a complete deployment and capture of a reference image. By using the network boot (PXE) capabilities of Windows Deployment Services (WDS), the resulting solution enables you to boot a Surface device from the network and perform a clean deployment of Windows.
+
+![figure 1](images/sda-fig1-select-steps.png)
+
+Figure 1: Select desired apps and drivers
+
+When the Microsoft Surface Deployment Accelerator completes, you can use the deployment share to deploy over the network immediately. Simply boot your Surface device from the network using a Surface Ethernet Adapter and select the Surface deployment share you created with the Microsoft Surface Deployment Accelerator wizard. Select the **1- Deploy Microsoft Surface** task sequence and the wizard will walk you through an automated deployment of Windows to your Surface device.
+
+You can modify the task sequence in the MDT Deployment Workbench to [include your own apps](http://go.microsoft.com/fwlink/p/?linkid=691700), or to [pause the automated installation routine](http://go.microsoft.com/fwlink/p/?linkid=691701). While the installation is paused, you can make changes to customize your reference image. After the image is captured, you can configure a deployment task sequence and distribute this custom configuration by using the same network boot capabilities as before.
+
+**Note**  
+With Microsoft Surface Deployment Accelerator v1.9.0258, Surface Pro 3, Surface Pro 4, and Surface Book are supported for Windows 10 deployment, and Surface Pro 3 is supported for Windows 8.1 deployment.
+
+ 
+
+## <a href="" id="use-microsoft-surface-deployment-accelerator-without-an-internet-connection--"></a>Use Microsoft Surface Deployment Accelerator without an Internet connection
+
+
+For environments where the Microsoft Surface Deployment Accelerator server will not be able to connect to the Internet, the required Surface files can be downloaded separately. To specify a local source for Surface driver and app files, select the **Copy from a local directory** option and specify the location of your downloaded files (see Figure 2). All of the driver and app files for your selected choices must be placed in the specified folder.
+
+![figure 2](images/sda-fig2-specify-local.png)
+
+Figure 2. Specify a local source for Surface driver and app files
+
+You can find a full list of available driver downloads at [Download the latest firmware and drivers for Surface devices](deploy-the-latest-firmware-and-drivers-for-surface-devices.md)
+
+**Note**  
+Downloaded files do not need to be extracted. The downloaded files can be left as .zip files as long as they are stored in one folder.
+
+ 
+
+ 
+
+ 
+
+
+
+
+

devices/surface/step-by-step-surface-deployment-accelerator.md

@@ -0,0 +1,387 @@
+---
+title: Step by step Surface Deployment Accelerator (Surface)
+description: This article shows you how to install Microsoft Surface Deployment Accelerator (SDA), configure a deployment share for the deployment of Windows to Surface devices, and perform a deployment to Surface devices.
+ms.assetid: A944FB9C-4D81-4868-AFF6-B9D1F5CF1032
+keywords: ["deploy, configure"]
+ms.prod: W10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+author: heatherpoulsen
+---
+
+# Step by step: Surface Deployment Accelerator
+
+
+This article shows you how to install Microsoft Surface Deployment Accelerator (SDA), configure a deployment share for the deployment of Windows to Surface devices, and perform a deployment to Surface devices. This article also contains instructions on how to perform these tasks without an Internet connection or without support for Windows Deployment Services network boot (PXE).
+
+## How to install Surface Deployment Accelerator
+
+
+For information about prerequisites and instructions for how to download and install SDA, see [Microsoft Surface Deployment Accelerator](microsoft-surface-deployment-accelerator.md).
+
+1.  Download SDA, which is included in [Surface Tools for IT](http://go.microsoft.com/fwlink/p/?LinkId=618121) on the Microsoft Download Center.
+
+2.  Run the SDA installation file, named **Surface\_Deployment\_Accelerator\_*xxxx*.msi**, where *xxxx* is the current version number.
+
+3.  Accept the End User License Agreement (EULA) by selecting the check box, and then click **Install**, as shown in Figure 1.
+
+    ![figure 1](images/sdasteps-fig1.png)
+
+    Figure 1. SDA setup
+
+4.  Click **Finish** to complete the installation of SDA.
+
+The tool installs in the Surface Deployment Accelerator program group, as shown in Figure 2.
+
+![figure 2](images/sdasteps-fig2.png)
+
+Figure 2. The Surface Deployment Accelerator program group and icon
+
+**Note**  
+At this point the tool has not yet prepared any deployment environment or downloaded any materials from the Internet.
+
+ 
+
+## Create a deployment share
+
+
+The following steps show how you create a deployment share for Windows 10 that supports Surface Pro 3, Surface Pro 4, Surface Book, the Surface Firmware Tool, and the Surface Asset Tag Tool. As you follow the steps below, make the selections that are applicable for your organization. For example, you could choose to deploy Windows 10 to Surface Book only, without any of the Surface apps.
+
+**Note**  
+SDA lets you create deployment shares for both Windows 8.1 and Windows 10 deployments, but you can only create a single deployment share at a time. Therefore, to create both Windows 8.1 and Windows 10 deployment shares, you will need to run the tool twice.
+
+ 
+
+1.  Open the SDA wizard by double-clicking the icon in the **Surface Deployment Accelerator** program group on the Start screen.
+
+2.  On the **Welcome** page, click **Next** to continue.
+
+3.  On the **Verify System** page, the SDA wizard verifies the prerequisites required for an SDA deployment share. This process also checks for the presence of the Windows Assessment and Deployment Kit (ADK) for Windows 10 and the Microsoft Deployment Toolkit (MDT) 2013 Update 1. If these tools are not detected, they are downloaded and installed automatically. Click **Next** to continue.
+
+4.  On the **Windows 8.1** page, to create a Windows 10 deployment share, do not select the **Would you like to support Windows 8.1** check box. Click **Next** to continue.
+
+5.  On the **Windows 10** page, to create a Windows 10 deployment share, select the **Would you like to support Windows 10** check box. Supply the following information before you click **Next** to continue:
+
+    -   **Configure Deployment Share for Windows 10**
+
+        -   **Local Path** – Specify or browse to a location on the local storage device where you would like to store the deployment share files for the Windows 10 SDA deployment share. For example, **E:\\SDAWin10\\** is the location specified in Figure 3.
+
+        -   **Share Name** – Specify a name for the file share that will be used to access the deployment share on this server from the network. For example, **SDAWin10** is the deployment share name shown in Figure 3. The local path folder is automatically shared by the SDA scripts under this name to the group **Everyone** with a permission level of **Full Control**.
+
+    -   **Windows 10 Deployment Services**
+
+        -   Select the **Import boot media into the local Windows Deployment Service** check box if you would like to boot your Surface devices from the network to perform the Windows deployment. Windows Deployment Services must be installed and configured to respond to PXE boot requests. See [Windows Deployment Services Getting Started Guide for Windows Server 2012](http://go.microsoft.com/fwlink/p/?LinkId=761072) for more information about how to configure Windows Deployment Services for PXE boot.
+
+    -   **Windows 10 Source Files**
+
+        -   **Local Path** – Specify or browse to the root directory of Windows 10 installation files. If you have an ISO file, mount it and browse to the root of the mounted drive. You must have a full set of source files, not just **Install.wim**.
+
+    ![figure 3](images/sdasteps-fig3.png)
+
+    Figure 3. Specify Windows 10 deployment share options
+
+6.  On the **Configure** page, select the check box next to each device or app that you want to include in your deployment share. Note that Surface Pro 4 and Surface Book only support Windows 10 and are not available for the deployment of Windows 8.1. The Surface Firmware Tool is only applicable to Surface Pro 3 and cannot be selected unless Surface Pro 3 drivers are selected, as shown in Figure 4. Click **Next** to continue.
+
+    ![figure 4](images/sdasteps-fig4-select.png)
+
+    Figure 4. Selecting Surface Firmware Tool requires Surface Pro 3 drivers
+
+7.  On the **Summary** page confirm your selections and click **Finish** to begin the creation of your deployment share. The process can take several minutes as files are downloaded, the tools are installed, and the deployment share is created. While the SDA scripts are creating your deployment share, an **Installation Progress** window will be displayed, as shown in Figure 5. A typical SDA process includes:
+
+    -   Download of Windows ADK
+
+    -   Installation of Windows ADK
+
+    -   Download of MDT
+
+    -   Installation of MDT
+
+    -   Download of Surface apps and drivers
+
+    -   Creation of the deployment share
+
+    -   Import of Windows installation files into the deployment share
+
+    -   Import of the apps and drivers into the deployment share
+
+    -   Creation of rules and task sequences for Windows deployment
+
+    ![figure 5](images/sdasteps-fig5-installwindow.png)
+
+    Figure 5. The **Installation Progress** window
+
+8.  When the SDA process completes the creation of your deployment share, a **Success** window is displayed. Click **Finish** to close the window. At this point your deployment share is now ready to perform a Windows deployment to Surface devices.
+
+### Optional: Create a deployment share without an Internet connection
+
+If you are unable to connect to the Internet with your deployment server, or if you want to download the Surface drivers and apps separately, you can specify a local source for the driver an app files at the time of deployment share creation. On the **Configure** page of the SDA wizard, select the **Copy from a Local Directory** check box, as shown in Figure 6. The **Download from the Internet** check box will be automatically deselected. Enter the folder location where you have placed the driver and app files in the **Local Path** field, as shown in Figure 6.
+
+**Note**  
+All of the downloaded driver and applications files must be located in the same folder. The driver and app files do not need to be extracted from the downloaded .zip files.
+
+ 
+
+![figure 6](images/sdasteps-fig6-specify-driver-app-files.png)
+
+Figure 6. Specify the Surface driver and app files from a local path
+
+**Note**  
+The **Copy from a Local Directory** check box is only available in SDA version 1.90.0221 or later.
+
+ 
+
+### <a href="" id="optional"></a>Optional: Prepare offline USB media
+
+You can use USB media to perform an SDA deployment if your Surface device is unable to boot from the network. For example, if you do not have a Microsoft Surface Ethernet Adapter or Microsoft Surface dock to facilitate network boot (PXE boot). The USB drive produced by following these steps includes a complete copy of the SDA deployment share and can be run on a Surface device without a network connection.
+
+**Note**  
+The offline media files for the complete SDA deployment share are approximately 9 GB in size. Your USB drive must be at least 9 GB in size. A 16 GB USB drive is recommended.
+
+ 
+
+Before you can create bootable media files within the MDT Deployment Workbench or copy those files to a USB drive, you must first configure that USB drive to be bootable. Using [DiskPart](http://go.microsoft.com/fwlink/p/?LinkId=761073), create a partition, format the partition as FAT32, and set the partition to be active. To run DiskPart, open an administrative PowerShell or Command Prompt window, and then run the following sequence of commands, as shown in Figure 7:
+
+1.  **diskpart** – Opens DiskPart to manage disks and partitions.
+
+2.  **list disk** – Displays a list of the disks available in your system; use this list to identify the disk number that corresponds with your USB drive.
+
+3.  **sel disk 2** – Selects your USB drive; use the number that corresponds with the disk in your system.
+
+4.  **clean** – Removes all configuration from your USB drive.
+
+    **Warning**  
+    This step will remove all information from your drive. Verify that your USB drive does not contain any needed data before you perform the **clean** command.
+
+     
+
+5.  **create part pri** – Creates a primary partition on the USB drive.
+
+6.  **format fs=fat32 quick** – Formats the partition with the FAT32 file system, performing a quick format. FAT32 is required to boot the device from UEFI systems like Surface devices.
+
+7.  **assign** – Assigns the next available drive letter to the newly created FAT32 volume.
+
+8.  **active** – Sets the partition to be active, which is required to boot the volume.
+
+9.  **exit** – Exits DiskPart, after which you can close the PowerShell or Command Prompt window.
+
+    ![figure 7](images/sdasteps-fig7-diskpart.png)
+
+    Figure 7. Use DiskPart to prepare a USB drive for boot
+
+    **Note**  
+    You can format your USB drive with FAT32 from Disk Management, but you must still use DiskPart to set the partition as active for the drive to boot properly.
+
+     
+
+After you have prepared the USB drive for boot, the next step is to generate offline media from the SDA deployment share. To create this media, follow these steps:
+
+1.  Open the **Deployment Workbench** from the **Microsoft Deployment Toolkit** group on your Start screen.
+
+2.  Expand the **Deployment Shares** node and the **Microsoft Surface Deployment Accelerator** deployment share.
+
+3.  Expand the folder **Advanced Configuration** and select the **Media** folder.
+
+4.  Right-click the **Media** folder and click **New Media** as shown in Figure 8 to start the New Media Wizard.
+
+    ![figure 8](images/sdasteps-fig8-mediafolder.png)
+
+    Figure 8. The Media folder of the SDA deployment share
+
+5.  On the **General Settings** page in the **Media path** field, enter or browse to a folder where you will create the files for the new offline media. See the example **E:\\SDAMedia** in Figure 9. Leave the default profile **Everything** selected in the **Selection profile** drop-down menu, and then click **Next**.
+
+    ![figure 9](images/sdasteps-fig9-location.png)
+
+    Figure 9. Specify a location and selection profile for your offline media
+
+6.  On the **Summary** page verify your selections, and then click **Next** to begin creation of the media.
+
+7.  A **Progress** page is displayed while the media is created.
+
+8.  On the **Confirmation** page, click **Finish** to complete creation of the media.
+
+9.  Right-click the **Microsoft Surface Deployment Accelerator** deployment share folder, click **Properties**, and then click the **Rules** tab as shown in Figure 10.
+
+    ![figure 10](images/sdasteps-fig10-rules.png)
+
+    Figure 10. The Rules of the SDA deployment share
+
+10. Use your mouse to highlight all of the text displayed in the text box of the **Rules** tab, and then press **Ctrl+C** to copy the text.
+
+11. Click **OK** to close the **Microsoft Surface Deployment Accelerator** deployment share properties.
+
+12. Right-click the newly created **MEDIA001** item in the **Media** folder, click **Properties**, and then click the **Rules** tab.
+
+13. Use your mouse to highlight all of the text displayed in the text box of the **Rules** tab, and then press **Ctrl+V** to paste the text you copied from the **Microsoft Surface Deployment Accelerator** deployment share rules.
+
+14. Right-click the **Microsoft Surface Deployment Accelerator** deployment share folder, click **Properties**, and then click the **Rules** tab again. Click the **Bootstrap.ini** button to open Bootstrap.ini in Notepad.
+
+15. Press **Ctrl+A** to select all of the text in the window, and then press **Ctrl+C** to copy the text.
+
+16. Close Bootstrap.ini and click **OK** in **Microsoft Surface Deployment Accelerator** deployment share properties to close the window.
+
+17. Right-click the newly created **MEDIA001** item in the **Media** folder, click **Properties**, and then click the **Rules** tab again. Click the **Bootstrap.ini** button to open Bootstrap.ini in Notepad.
+
+18. Press **Ctrl+A** to select all of the text in the window, then press **Ctrl+V** to paste the text from the SDA deployment share Bootstrap.ini file.
+
+19. Delete the following lines from the Bootstrap.ini as shown in Figure 11, and then save the file:
+
+    ```
+    UserID=
+    UserDomain=
+    UserPassword=
+    DeployRoot=\\SDASERVER\SDAWin10
+    UserID=
+    UserDomain=
+    UserPassword=
+    ```
+
+    ![figure 11](images/sdasteps-fig11-bootstrap.ini.png)
+
+    Figure 11. The Bootstrap.ini file of MEDIA001
+
+20. Close Bootstrap.ini and click **OK** in **MEDIA001** deployment share properties to close the window.
+
+21. In the **Deployment Workbench** under the **Media** folder, right-click the newly created **MEDIA001** and click **Update Media Content**, as shown in Figure 12. This will update the media files with the content of the **Microsoft Surface Deployment Accelerator** deployment share.
+
+    ![figure 12](images/sdasteps-fig12-updatemedia.png)Figure 12. Select **Update Media Content**
+
+22. The **Update Media Content** window is displayed and shows the progress as the media files are created. When the process completes, click **Finish.**
+
+The final step is to copy the offline media files to your USB drive.
+
+1.  In File Explorer, open the path you specified in Step 5, for example **E:\\SDAMedia**.
+
+2.  Copy all of the files from the Content folder to the root of the USB drive.
+
+Your USB drive is now configured as bootable offline media that contains all of the resources required to perform a deployment to a Surface device.
+
+## SDA task sequences
+
+
+The SDA deployment share is configured with all of the resources required to perform a Windows deployment to a Surface device. These resources include Windows source files, image, Surface drivers, and Surface apps. The deployment share also contains two pre-configured task sequences, as shown in Figure 13. These task sequences contain the steps required to perform a deployment to a Surface device using the default Windows image from the installation media or to create a reference image complete with Windows updates and applications. To learn more about task sequences, see [MDT 2013 Update 1 Lite Touch components](http://technet.microsoft.com/en-us/itpro/windows/deploy/mdt-2013-lite-touch-components).
+
+![figure 13](images/sdasteps-fig13-taskseq.png)
+
+Figure 13. Task sequences in the Deployment Workbench
+
+### Deploy Microsoft Surface
+
+The **1 – Deploy Microsoft Surface** task sequence is used to perform a complete deployment of Windows to a Surface device. This task sequence is pre-configured by the SDA wizard and is ready to perform a deployment as soon as the wizard completes. Running this task sequence on a Surface device deploys the unaltered Windows image copied directly from the Windows installation media you specified in the SDA wizard, along with the Surface drivers for your device. The drivers for your Surface device will be automatically selected through the pre-configured deployment share rules.
+
+When you run the task sequence, you will be prompted to provide the following information:
+
+-   A computer name
+
+-   Your domain information and the credentials required to join the domain
+
+-   A product key, if one is required
+
+    **Note**  
+    If you are deploying the same version of Windows as the version that came on your device, no product key is required.
+
+     
+
+-   A time zone
+
+-   An Administrator password
+
+The Surface apps you specified on the **Configure** page of the SDA wizard are automatically installed when you run this task sequence on a Surface device.
+
+### Create Windows reference image
+
+The **2 – Create Windows Reference Image** task sequence is used to perform a deployment to a virtual machine for the purpose of capturing an image complete with Windows Updates for use in a deployment to Surface devices. By installing Windows Updates in your reference image, you eliminate the need to download and install those updates on each deployed Surface device. The deployment process with an up-to-date image is significantly faster and more efficient than performing a deployment first and then installing Windows Updates on each device.
+
+Like the **1 – Deploy Microsoft Surface** task sequence, the **2 – Create Windows Reference Image** task sequence performs a deployment of the unaltered Windows image directly from the installation media. Creation of a reference image should always be performed on a virtual machine. Using a virtual machine as your reference system helps to ensure that the resulting image is compatible with different hardware configurations.
+
+**Note**  
+Using a virtual machine when you create a reference image for Windows deployment is a recommended practice for performing Windows deployments with Microsoft deployment tools including the Microsoft Deployment Toolkit and System Center Configuration Manager. These Microsoft deployment technologies use the hardware agnostic images produced from a virtual machine and a collection of managed drivers to deploy to different configurations of hardware. For more information see [Deploy a Windows 10 image using MDT 2013 Update 1](http://technet.microsoft.com/en-us/itpro/windows/deploy/deploy-a-windows-10-image-using-mdt).
+
+ 
+
+In addition to the information required by the **1 – Deploy Microsoft Surface** task sequence, you will also be prompted to capture an image when you run this task sequence on your reference virtual machine. The **Location** and **File name** fields are automatically populated with the proper information for your deployment share. All that you need to do is select the **Capture an image of this reference computer** option when you are prompted on the **Capture Image** page of the Windows Deployment Wizard.
+
+## Deployment to Surface devices
+
+
+To perform a deployment from the SDA deployment share, follow this process on the Surface device:
+
+1.  Boot the Surface device to MDT boot media for the SDA deployment share. You can do this over the network by using PXE boot, or from a USB drive as described in the [Optional: Prepare offline USB media](#optional) section of this article.
+
+2.  Select the deployment share for the version of Windows you intend to deploy and enter your credentials when you are prompted.
+
+3.  Select the task sequence you want to run, usually the **1 – Deploy Microsoft Surface** task sequence.
+
+4.  Address the task sequence prompts to pick applications, supply a password, and so on.
+
+5.  The task sequence performs the automated deployment using the options specified.
+
+### Boot the Surface device from the network
+
+To boot the Surface device from the network, the Microsoft Surface Deployment Accelerator wizard must have been run on a Windows Server 2012 R2 or later environment that was configured with the Windows Deployment Services (WDS). WDS must have been configured to respond to network boot (PXE boot) requests and the boot files must have been imported into WDS. The SDA wizard will import these file automatically if the **Import boot media into the local Windows Deployment Service** check box was selected on the page for the version of Windows you intend to deploy.
+
+To boot the Surface device from the network, you must also use a Microsoft Surface Ethernet Adapter or the Ethernet port on a Microsoft Surface Dock. Third-party Ethernet adapters are not supported for network boot (PXE boot). A keyboard is also required. Both the Microsoft Surface Type Cover and keyboards connected via USB to the device or dock are supported.
+
+To instruct your Surface device to boot from the network, start with the device powered off and follow these steps:
+
+1.  Press and hold the **Volume Down** button, press and release the **Power** button. Continue holding the **Volume Down** button until the device has begun to boot from the network.
+
+2.  Press **Enter** when prompted by the dialog on the screen. This prompt indicates that your device has found the WDS PXE server over the network.
+
+3.  If you have configured more than one deployment share on this device, you will be prompted to select between the boot images for each deployment share. For example, if you created both a Windows 10 and a Windows 8.1 deployment share, you will be prompted to choose between these two options.
+
+4.  Enter the domain credentials that you use to log on to the server where SDA is installed when you are prompted, as shown in Figure 14.
+
+    ![figure 14](images/sdasteps-fig14-credentials.png)
+
+    Figure 14. The prompt for credentials to the deployment share
+
+5.  The Windows Deployment Wizard will start from the deployment share to walk you through the deployment process.
+
+### Alternatively boot the devices from the USB stick
+
+To boot a device from the USB stick:
+
+1.  Press and hold the **Volume Down** button, press and release the **Power** button. Continue holding the **Volume Down** button until the device has begun to boot from the USB drive.
+
+2.  The Windows Deployment Wizard will start from the deployment share to walk you through the deployment process.
+
+### Run the Deploy Microsoft Surface task sequence
+
+To run the Deploy Microsoft Surface task sequence:
+
+1.  On the **Task Sequence** page, select the **1 – Deploy Microsoft Surface** task sequence as shown in Figure 15, and then click **Next.**
+
+    ![figure 15](images/sdasteps-fig15-deploy.png)
+
+    Figure 15. Select the **1 – Deploy Microsoft Surface** task sequence
+
+2.  On the **Computer Details** page, type a name for the Surface device in the **Computer Name** box. In the **Join a domain** section, type your domain name and credentials as shown in Figure 16, and then click **Next**.
+
+    ![figure 16](images/sdasteps-fig16-computername.png)
+
+    Figure 16. Enter the computer name and domain information
+
+3.  On the **Product Key** page, keep the **No product key is required** check box selected if you are deploying the same version and edition of Windows to your Surface devices as they came with from the factory. If you are deploying a different version or edition of Windows to the device, such as Windows Enterprise, select the licensing option that is applicable to your scenario.
+
+4.  On the **Locale and Time** page, select your desired **Language Settings** and **Time Zone**, and then click **Next.**
+
+5.  On the **Administrator Password** page, type a password for the local Administrator account on the Surface device, and then click **Next.**
+
+6.  On the **BitLocker** page, select the **Enable BitLocker** option along with your desired configuration of BitLocker protectors if you want to encrypt the device. Otherwise, keep the **Do not enable BitLocker for this computer** check box selected, and then click **Next.**
+
+7.  On the **Ready** page, verify your selections and then click **Begin** to start the automated deployment to this device. The deployment will not require user interaction again. The Windows Deployment Wizard will close and an **Installation Progress** window is displayed to show progress of the task sequence as the image is applied and applications are installed (Figure 17).
+
+    ![figure 17](images/sdasteps-fig17-installprogresswindow.png)
+
+    Figure 17. The **Installation Progress** window
+
+8.  When the deployment task sequence completes, a **Success** window is displayed. Click **Finish** to complete the deployment and begin using your Surface device.
+
+ 
+
+ 
+
+
+
+
+

devices/surface/surface-diagnostic-toolkit.md

@@ -0,0 +1,521 @@
+---
+title: Microsoft Surface Diagnostic Toolkit (Surface)
+description: Find out how you can use the Microsoft Surface Diagnostic Toolkit to test the hardware of your Surface device.
+ms.assetid: FC4C3E76-3613-4A84-A384-85FE8809BEF1
+keywords: ["hardware, device, tool, test, component"]
+ms.prod: W8
+ms.mktglfcycl: manage
+ms.sitesec: library
+author: heatherpoulsen
+---
+
+# Microsoft Surface Diagnostic Toolkit
+
+
+Find out how you can use the Microsoft Surface Diagnostic Toolkit to test the hardware of your Surface device.
+
+The [Microsoft Surface Diagnostic Toolkit](http://go.microsoft.com/fwlink/p/?LinkId=618121) is a small, portable diagnostic tool that runs through a suite of tests to diagnose the hardware of Surface devices. The Microsoft Surface Diagnostic Toolkit executable file is less than 3 MB, which allows it to be distributed through email. It does not require installation, so it can be run directly from a USB stick or over the network. The Microsoft Surface Diagnostic Toolkit walks you through several tests of individual components including the touchscreen, cameras, and sensors.
+
+**Note**  
+A Surface device must boot into Windows to run the Microsoft Surface Diagnostic Toolkit. The Microsoft Surface Diagnostic Toolkit will run only on the following Surface devices:
+
+-   Surface Book
+
+-   Surface Pro 4
+
+-   Surface 3 LTE
+
+-   Surface 3
+
+-   Surface Pro 3
+
+-   Surface Pro 2
+
+-   Surface Pro
+
+ 
+
+**Note**  
+Security software and built-in security measures in many email applications and services will block executable files that are transferred through email. To email the Surface Diagnostic Toolkit, attach the .zip archive file as downloaded from the Surface Tools for IT page without extracting it first. You can also create a custom .zip archive that contains the .exe file. (For example, if you want to localize the text as described in the [Localization](#localization) section of this article.)
+
+ 
+
+Running the Microsoft Surface Diagnostic Toolkit is a hands-on activity. The test sequence includes several tests that require you to perform actions or observe the outcome of the test, and then click the applicable **Pass** or **Fail** button. Some tests require connectivity to external devices, like an external display. Other tests use the built in Windows troubleshooters. At the end of testing, a visual report of the test results is displayed and you are given the option to save a log file or copy the results to the clipboard.
+
+To run a full set of tests with the Microsoft Surface Diagnostic Toolkit, you should be prepared with the following items:
+
+-   An external display with the appropriate HDMI or DisplayPort connection
+
+-   A Bluetooth device that can be put into pairing mode
+
+-   A MicroSD or SD card that is compatible with your Surface device
+
+-   A Surface Pen
+
+-   Room to move the Surface device around
+
+-   External speakers or headphones
+
+**Note**  
+The Microsoft Surface Diagnostic Toolkit tests verify only the hardware of a Surface device and do not test or resolve issues with the operating system or software.
+
+ 
+
+## <a href="" id="the-tests--"></a>The tests
+
+
+The Microsoft Surface Diagnostic Toolkit runs several individual tests on a Surface device. Not all tests are applicable to every device. For example, the Home button test is not applicable to Surface Pro 4 where there is no Home button. You can specify which tests to run, or you can choose to run all tests. For tests that require external devices (such as testing output to an external display) but you do not have the required external device at the time of the test, you are given the option to skip the test. If a test fails, you are prompted to continue or stop testing at that time.
+
+### Windows Update
+
+This test checks for any outstanding Windows updates and will prompt you to install those updates before you proceed to other tests. It is important to keep a Surface device up to date with the latest Windows updates, including drivers and firmware for the Surface device. The success of some of the tests that are performed later in the task sequence depend on these updated drivers and firmware. You will be prompted to restart the device if required by Windows Update. If you must restart the device, you will need to start the Microsoft Surface Diagnostic Toolkit again.
+
+### <a href="" id="device-information--"></a>Device information
+
+This test reads the Device ID and serial number in addition to basic system information such as device model, operating system version, processor, memory, and storage. The Device ID is recorded in the name of the log file and can be used to identify a log file for a specific device. Several system log files are also collected, including update and rollback logs, and output from several Windows built-in tools, such as [DirectX Diagnostics](http://go.microsoft.com/fwlink/p/?LinkId=746476) and [System Information](http://go.microsoft.com/fwlink/p/?LinkId=746477), power configuration, disk health, and event logs. See the following list for a full set of collected log files:
+
+-   Output of **Get-WindowsUpdateLog** if the operating system is Windows 10
+
+-   **%windir%\\Logs**
+
+-   **%windir%\\Panther**
+
+-   **%windir%\\System32\\sysprep\\Panther**
+
+-   **%windir%\\System32\\WinEvt\\Logs**
+
+-   **$windows.~bt\\Sources\\Panther**
+
+-   **$windows.~bt\\Sources\\Rollback**
+
+-   **%windir%\\System32\\WinEvt\\Logs**
+
+-   Output of **dxdiag.exe /t**
+
+-   Output of **msinfo32.exe /report**
+
+-   Output of **powercfg.exe /batteryreport**
+
+-   Output of **powercfg.exe /sleepstudy**
+
+-   Output of **wevtutil.exe epl System**
+
+-   Events from:
+
+    -   **Chkdsk**
+
+    -   **Microsoft-Windows-Ntfs**
+
+    -   **Microsoft-Windows-WER-SystemErrorReporting**
+
+    -   **Microsoft-Windows-Startuprepair**
+
+    -   **Microsoft-Windows-kernel-Power**
+
+-   Output of **powercfg.exe /q**
+
+-   Output of **powercfg.exe /qh**
+
+-   **%windir%\\Inf\\SetupApi\*.log**
+
+These files and logs are stored in a .zip file saved by the Microsoft Surface Diagnostic Toolkit when all selected tests have completed alongside the Microsoft Surface Diagnostic Toolkit log file.
+
+### <a href="" id="type-cover--test"></a>Type Cover test
+
+**Note**  
+A Surface Type Cover is required for this test.
+
+ 
+
+If a Surface Type Cover is not detected, the test prompts you to connect the Type Cover. When a Type Cover is detected the test prompts you to use the keyboard and touchpad. The cursor should move while you swipe the touchpad, and the keyboard Windows key should bring up the Start menu or Start screen to successfully pass this test. You can skip this test if a Type Cover is not used with the Surface device.
+
+### Integrated keyboard test
+
+**Note**  
+This test is only applicable to Surface Book and requires that the Surface Book be docked to the keyboard.
+
+ 
+
+This test is essentially the same as the Type Cover test, except the integrated keyboard in the Surface Book base is tested rather than the Type Cover. Move the cursor and use the Windows key to bring up the Start menu to confirm that the touchpad and keyboard are operating successfully. This test will display the status of cursor movement and keyboard input for you to verify. Press **ESC** to complete the test.
+
+### Canvas mode battery test
+
+**Note**  
+This test is only applicable to Surface Book.
+
+ 
+
+Depending on which mode Surface Book is in, different batteries are used to power the device. When Surface Book is in clipboard mode (detached form the keyboard) it uses an internal battery, and when it is connected in either laptop mode or canvas mode it uses different connections to the battery in the keyboard. In canvas mode, the screen is connected to the keyboard so that when the device is closed, the screen remains face-up and visible. Connect the Surface Book to the keyboard in this manner for the test to automatically proceed.
+
+### Clipboard mode battery test
+
+**Note**  
+This test is only applicable to Surface Book.
+
+ 
+
+Disconnect the Surface Book from the keyboard to work in clipboard mode. In clipboard mode the Surface Book operates from an internal battery that is tested when the Surface Book is disconnected from the keyboard. Disconnecting the Surface Book from the keyboard will also disconnect the Surface Book from power and will automatically begin this test.
+
+### Laptop mode battery test
+
+**Note**  
+This test is only applicable to Surface Book.
+
+ 
+
+Connect the Surface Book to the keyboard in the opposite fashion to canvas mode in laptop mode. In laptop mode the screen will face you when the device is open and the device can be used in the same way as any other laptop. Disconnect AC Power from the laptop base when prompted for this test to check the battery status.
+
+### <a href="" id="battery--test"></a>Battery test
+
+In this test the battery is discharged for a few seconds and tested for health and estimated runtime. You are prompted to disconnect the power adapter and then to reconnect the power adapter when the test is complete.
+
+### Discrete graphics (dGPU) test
+
+**Note**  
+This test is only applicable to Surface Book models with a discrete graphics processor.
+
+ 
+
+This test will query the device information of current hardware to check for the presence of both the Intel integrated graphics processor in the Surface Book and the NVIDIA discrete graphics processor in the Surface Book keyboard. The keyboard must be attached for this test to function.
+
+### Discrete graphics (dGPU) fan test
+
+**Note**  
+This test is only applicable to Surface Book models with a discrete graphics processor.
+
+ 
+
+The discrete graphics processor in the Surface Book includes a separate cooling fan. The fan is turned on automatically by the test for 5 seconds. Listen for the sound of the fan in the keyboard and report if the fan is working correctly when prompted.
+
+### Muscle wire test
+
+**Note**  
+This test is only applicable to Surface Book.
+
+ 
+
+To disconnect the Surface Book from the keyboard, software must instruct the muscle wire latch mechanism to open. This is typically accomplished by pressing and holding the undock key on the keyboard. This test sends the same signal to the latch, which unlocks the Surface Book from the Surface Book keyboard. Remove the Surface Book from the keyboard when you are prompted to do so.
+
+### Dead pixel and display artifacts tests
+
+**Note**  
+Before you run this test, be sure to clean the screen of dust or smudges.
+
+ 
+
+This test prompts you to view the display in search of malfunctioning pixels. The test displays full-screen, single-color images including black, white, red, green, and blue. Pixels that remain bright or dark when the screen displays an image of a different color indicate a failed test. You should also look for distortion or variance in the color of the screen.
+
+### <a href="" id="digitizer-edges--"></a>Digitizer edges
+
+The touchscreen of a Surface device should detect when a user swipes in from the left or right side of the screen. This test prompts you to swipe in from the edges of the screen to bring up the Action Center and Task View. Both Action Center and Task View should launch to pass this test.
+
+### <a href="" id="digitizer-pinch--"></a>Digitizer pinch
+
+The pinch gesture (when you bring two fingers closer together or farther apart) is used to manipulate zoom and to position content through the touchscreen. This test displays an image in Windows Picture Viewer and prompts you to zoom in, move, and zoom out of the picture. The picture should zoom in, move, and zoom out as the gestures are performed.
+
+### <a href="" id="digitizer-touch--"></a>Digitizer touch
+
+The Surface touchscreen should detect input across the entire screen of the device equally. To perform this test a series of lines are displayed on the screen for you to trace with a finger in search of unresponsive areas. The lines traced across the screen should appear continuous for the length of the line as drawn with your finger.
+
+### <a href="" id="digitizer-pen--test"></a>Digitizer pen test
+
+**Note**  
+A Microsoft Surface Pen is required for this test.
+
+ 
+
+This test displays the same lines as those that are displayed during the Digitizer Touch test, but your input is performed with a Surface Pen instead of your finger. The lines should remain unbroken for as long as the Pen is pressed to the screen. Trace all of the lines in the image to look for unresponsive areas across the entire screen of the Surface device.
+
+### <a href="" id="digitizer-multi-touch--"></a>Digitizer multi touch
+
+The Surface touchscreen is capable of detecting 10 fingers simultaneously. Place all of your fingers on the screen simultaneously to perform this test. The screen will show the number of points detected, which should match the number of fingers you have on the screen.
+
+### <a href="" id="home-button-test--"></a>Home button test
+
+The Home button or Windows button on your Surface device is used to bring up the Start screen or Start menu. This test is successful if the Start screen or Start menu is displayed when the Windows button is pressed. This test is not displayed on Surface Pro 4 because no Windows button exists.
+
+### <a href="" id="volume-rocker--test"></a>Volume rocker test
+
+This test prompts you to use the volume rocker to turn the volume all the way up, all the way down, and then all the way up again. To pass this test, the volume slider should move up and down as the rocker is pressed.
+
+### <a href="" id="micro-sd-or-sd--slot-test--"></a>Micro SD or SD slot test
+
+**Note**  
+This test requires a micro SD or SD card that is compatible with the slot in your Surface device.
+
+ 
+
+Insert a micro SD or SD card when you are prompted. When the SD card is detected, the test prompts you to remove the SD card to ensure that the card is not left in the device. During this test a small file is written to the SD card and then verified. Detection and verification of the SD card automatically passes this test without additional input.
+
+### <a href="" id="microphone--test"></a>Microphone test
+
+This test displays the **Recording** tab of the Sound item in Control Panel. The test prompts you to monitor the meter that is displayed next to the **Microphone Array** recording device. A recommended test is to speak and watch for your speech to be detected in the meter. If the meter moves when you speak, the microphone is working correctly. For Surface Book you will be prompted to tap locations near the microphones. This tapping should produce noticeable spikes in the audio meter.
+
+### <a href="" id="video-out--test"></a>Video out test
+
+**Note**  
+This test requires an external display with the applicable connection for your Surface device.
+
+ 
+
+Surface devices provide a Mini DisplayPort connection for connecting to an external display. Connect your display through the Mini DisplayPort on the device when prompted. The display should be detected automatically and an image should appear on the external display.
+
+### <a href="" id="bluetooth--test"></a>Bluetooth test
+
+**Note**  
+This test requires a Bluetooth device. The device must be set to pairing mode or made discoverable to perform this test.
+
+ 
+
+After you receive a prompt to put the device in pairing mode, the test opens the **Add a device** window and begins to search for discoverable Bluetooth devices. Watch the **Add a device** window to verify that your Bluetooth device is detected. Select your Bluetooth device from the list and connect to the device to complete the test.
+
+### <a href="" id="camera-test--"></a>Camera test
+
+Use this test to verify that the cameras on your Surface device are operating properly. Images will be displayed from both the front and rear cameras, and the infrared camera on a Surface Pro 4. Continuous autofocus can be enabled on the rear camera. Move the device closer and farther away from an object to verify the operation of continuous autofocus.
+
+### <a href="" id="speaker-test--"></a>Speaker test
+
+**Note**  
+Headphones or external speakers are required to test the headphone jack in this test.
+
+ 
+
+This test plays audio over left and right channels respectively, both for the internal speakers and for speakers or headphones connected to the headphone jack. Mark each channel as a pass or fail as you hear the audio play.
+
+### <a href="" id="network-test--"></a>Network test
+
+**Note**  
+Connect the Surface device to a Wi-Fi network before you run this test. Connections that are made during the test are removed when the test is completed.
+
+ 
+
+This test uses the Windows Network Diagnostics built in troubleshooter to diagnose potential issues with network connectivity, including proxy configuration, DNS problems, and IP address conflicts. An event log is saved by this test in Windows logs and is visible in the Windows Event Viewer. The Event ID is 6100.
+
+### <a href="" id="power-test--"></a>Power test
+
+Settings such as display brightness, the elapsed time until the screen sleeps, and the elapsed time until device sleeps, are checked against default values with the Power built-in troubleshooter. The troubleshooter will automatically correct settings that may prevent the device from conserving power or entering sleep mode.
+
+### <a href="" id="mobile-broadband-test--"></a>Mobile broadband test
+
+This test prompts you to enable mobile broadband and attempts to browse to http://www.bing.com. This test is only applicable to Surface devices that come equipped with mobile broadband, such as Surface 3 LTE.
+
+### Accelerometer test
+
+The accelerometer detects lateral, longitudinal, and vertical movements of the Surface device. This test prompts you to pick up and move the Surface device forward and backward, to the left and to the right, and up and down, to test the sensor for directional movement. The test automatically passes when movement is detected.
+
+### <a href="" id="gyrometer-test--"></a>Gyrometer test
+
+The gyrometer detects pitch, roll, and yaw movements. This test prompts you to pick up and rotate the Surface device to test the sensors for angular movement. The test automatically passes when movement is detected.
+
+### <a href="" id="compass-test--"></a>Compass test
+
+The compass detects which direction the Surface device is facing relative to north, south, east, and west. Turn the Surface device to face in different directions to test the sensor. The test automatically passes when a change in direction is detected.
+
+### <a href="" id="ambient-light-test--"></a>Ambient light test
+
+The ambient light sensor is used to automatically adjust screen brightness relative to the ambient lighting in the environment. Turn the device toward or away from a light source to cause the screen to dim or brighten in response increased or decreased light. The test automatically passes when the screen brightness automatically changes.
+
+### <a href="" id="device-orientation-test--"></a>Device orientation test
+
+**Note**  
+Before you run this test, disable rotation lock from the Action Center if enabled.
+
+ 
+
+The device orientation sensor determines what the angle of the Surface device is, relative to the ground. Rotate the display 90 degrees or 180 degrees to cause the screen orientation to switch between portrait and landscape mode. The test automatically passes when the screen orientation switches.
+
+### <a href="" id="brightness-test--"></a>Brightness test
+
+This test cycles the screen through brightness levels from 0 percent to 100 percent, and then a message is displayed to confirm if the brightness level changed accordingly. You are then prompted to disconnect the power adapter. The screen should automatically dim when power is disconnected.
+
+### <a href="" id="system-assessment--"></a>System assessment
+
+**Note**  
+The Surface device must be connected to AC power before you can run this test.
+
+ 
+
+The Windows System Assessment Tool (WinSAT) runs a series of benchmarks against the processor, memory, video adapter, and storage devices. The results include the processing speed of various algorithms, read and write performance of memory and storage, and performance in several Direct3D graphical tests.
+
+### Performance Monitor test
+
+Performance and diagnostic trace logs are recorded from Performance Monitor for 30 seconds and collected in the .zip file output of the Microsoft Surface Diagnostic Toolkit by this test. You can analyze these trace logs with the [Windows Performance Analyzer](http://go.microsoft.com/fwlink/p/?LinkId=746486) to identify causes of application crashes, performance issues, or other undesirable behavior in Windows.
+
+### Crash dump collection
+
+If your Surface device has encountered an error that caused the device to fail or produce a blue screen error, this stage of the Microsoft Surface Diagnostic Toolkit records the information from the automatically recorded crash dump files in the diagnostic log. You can use these crash dump files to identify a faulty driver, hardware component, or application through analysis. Use the [Windows Debugging Tool](http://go.microsoft.com/fwlink/p/?LinkId=746488) to analyze these files. If you are not familiar with the analysis of crash dump files, you can describe your issue and post a link to your crash dump files (uploaded to OneDrive or another file sharing service) in the [Windows TechNet Forums](http://go.microsoft.com/fwlink/p/?LinkId=746489).
+
+## <a href="" id="command-line--"></a>Command line
+
+
+You can run the Microsoft Surface Diagnostic Toolkit from the command line or as part of a script. The tool supports the following arguments:
+
+**Note**  
+Many of the tests performed by the Microsoft Surface Diagnostic Toolkit require technician interaction. The Microsoft Surface Diagnostic Toolkit cannot run unattended.
+
+ 
+
+### <a href="" id="exclude--"></a>exclude
+
+Use this argument to exclude specific tests.
+
+Example:
+
+```
+Surface_Diagnostic_Toolkit_1.0.60.0.exe “exclude=BatteryTest,CameraTest”
+```
+
+See the following list for test names:
+
+-   AccelerometerTest
+
+-   AmbientLightSensorTest
+
+-   BatteryTest
+
+-   BluetoothTest
+
+-   BrightnessTest
+
+-   CameraTest
+
+-   CanvasModeBatteryTest
+
+-   ChargingTest
+
+-   ClipboardModeBatteryTest
+
+-   CrashDumpCollectionTest
+
+-   DeadPixelDetectionTest
+
+-   DeviceInformationTest
+
+-   DeviceOrientationTest
+
+-   DigitalCompassSensorTest
+
+-   DigitizerEdgeTest
+
+-   DigitizerMultiTouchTest
+
+-   DigitizerPenCoverageTest
+
+-   DigitizerPinchTest
+
+-   DigitizerTouchCoverageTest
+
+-   DisplayArtifactsTest
+
+-   DualGraphicsTest
+
+-   FanTest
+
+-   GyrometerSensorTest
+
+-   HomeButtonTest
+
+-   IntegratedKeyboardTest
+
+-   LaptopModeBatteryTest
+
+-   MicrophoneTest
+
+-   MicroSdCardTest
+
+-   MobileBroadbandTest
+
+-   MuscleWireTest
+
+-   NetworkTest
+
+-   PenTest
+
+-   PerformanceMonitorTest
+
+-   PowerTest
+
+-   SdCardTest
+
+-   SpeakerTest
+
+-   SystemAssessmentTest
+
+-   TypeCoverTest
+
+-   VideoOutTest
+
+-   VolumeRockerTest
+
+-   WindowsUpdateCheckTest
+
+### forceplatformsupport
+
+Use this argument to force tests to run when the make and model of the device is not properly detected by Windows. Surface Diagnostic Toolkit is intended to run only on Surface devices.
+
+Example:
+
+```
+Surface_Diagnostic_Toolkit_1.0.60.0.exe forceplatformsupport
+```
+
+### include
+
+Use this argument to include tests when you run Microsoft Surface Diagnostic Toolkit from the command line. Tests specified by the **Include** command will be run even if the test is not supported on the model of Surface device. In the following example, the Surface Book specific tests for the latch mechanism and discrete graphics will be run, even if the command is run on a Surface Pro 4 or other Surface model.
+
+Example:
+
+```
+Surface_Diagnostic_Toolkit_1.0.60.0.exe “include=DualGraphicsTest,FanTest,MuscleWireTest”
+```
+
+### <a href="" id="logpath--"></a>logpath
+
+Use this argument to specify the path for the log file.
+
+Example 1:
+
+```
+Surface_Diagnostic_Toolkit_1.0.60.0.exe logpath=C:\Folder
+```
+
+Example 2:
+
+```
+Surface_Diagnostic_Toolkit_1.0.60.0.exe “logpath=C:\Folder with spaces”
+```
+
+## Localization
+
+
+By default, the Microsoft Surface Diagnostic Toolkit is available in English only. If you want to localize the text of the Microsoft Surface Diagnostic Toolkit prompts into another language, you can do so by creating a custom localization file. If the localization file exists, the Microsoft Surface Diagnostic Toolkit will override the default English text and use the text contained in the file instead. To create a localization file, follow these steps:
+
+1.  Open Notepad.
+
+2.  Type the following line at the beginning of the file:
+
+    ``` syntax
+    <root />
+    ```
+
+3.  Save the file as SurfaceDiagnosticTool\_v1.0.60.0.locale in the same location where the Microsoft Surface Diagnostic Toolkit executable file is stored.
+
+4.  Run the Microsoft Surface Diagnostic Toolkit executable file, Surface\_Diagnostic\_Toolkit\_v1.0.60.0.exe. The SurfaceDiagnosticTool\_v1.0.60.0.locale file will be populated with all of the text from the default prompts.
+
+5.  Open the SurfaceDiagnosticTool\_v1.0.60.0.locale file in Notepad and change the text of each prompt to your custom or localized text.
+
+6.  Save the SurfaceDiagnosticTool\_v1.0.60.0.locale file.
+
+**Note**  
+The SurfaceDiganosticTool\_v1.0.60.0.locale file must be located in the same folder and have the same name other than the file extension as the Microsoft Surface Diagnostic Toolkit executable file to use the custom prompt text. The SurfaceDiganosticTool\_v1.0.60.0.locale is an .xml file and must use UTF-8 encoding.
+
+ 
+
+ 
+
+ 
+
+
+
+
+

devices/surface/surface-dock-updater.md

@@ -0,0 +1,107 @@
+---
+title: Microsoft Surface Dock Updater (Surface)
+description: This article provides a detailed walkthrough of Microsoft Surface Dock Updater.
+ms.assetid: 1FEFF277-F7D1-4CB4-8898-FDFE8CBE1D5C
+ms.prod: W10
+ms.mktglfcycl: manage
+ms.sitesec: library
+author: heatherpoulsen
+---
+
+# Microsoft Surface Dock Updater
+
+
+This article provides a detailed walkthrough of Microsoft Surface Dock Updater.
+
+The [Microsoft Surface Dock Updater](http://go.microsoft.com/fwlink/p/?LinkId=618121) tool allows you to check the firmware status of a Surface Dock and to manually update the firmware of Surface Dock devices. It is most often used to update Surface Docks prior to deployment of those Surface Docks to end users or as a troubleshooting tool. Microsoft Surface Dock Updater walks you through the process of updating the firmware on one or more Surface Docks, including the required connect and disconnect steps to perform the complete firmware installation.
+
+When you run the Microsoft Surface Dock Updater installer you will be prompted to accept an End User License Agreement (EULA).
+
+**Note**  
+Updating Surface Dock firmware requires connectivity to the Surface Dock, available only on Surface Pro 3, Surface Pro 4, and Surface Book devices. A Surface Pro 3, Surface Pro 4, or Surface Book is required to successfully install Microsoft Surface Dock Updater.
+
+## Update a Surface Dock with Microsoft Surface Dock Updater
+
+
+After you install the [Microsoft Surface Dock Updater](http://go.microsoft.com/fwlink/p/?LinkId=618121) tool, you can find Microsoft Surface Dock Updater under **All Apps** in your Start menu. Click **Microsoft Surface Dock Updater** to start the application.
+
+To update a Surface Dock with Microsoft Surface Dock Updater, follow these steps:
+
+1.  Click Start to begin the firmware update process. If you do not have a Surface Dock connected, you will be prompted to connect a Surface Dock.
+
+2.  Microsoft Surface Dock Updater checks the status of your Surface Dock firmware.
+
+    -   If the tool determines that the firmware of your Surface Dock is up to date, a **You have the latest firmware for this Surface Dock** message is displayed, as shown in Figure 1.
+
+        ![figure 1](images/surfacedockupdater-fig1-uptodate-568pix.png)
+
+        Figure 1. Your Surface Dock firmware is up to date.
+
+    -   If Microsoft Surface Dock Updater determines that the firmware of your Surface Dock is not up to date, a **This Surface Dock is not running the latest firmware** message is displayed, as shown in Figure 2.
+
+        ![figure 2](images/surfacedockupdater-fig2a-needsupdating.png)
+
+        Figure 2. Your Surface Dock firmware needs to be updated
+
+3.  To begin the firmware update process, click **Update** on the **Surface Dock Firmware** page.
+
+4.  Before the firmware update process begins, you will be prompted for confirmation. Click **OK** to proceed or **Cancel** to return to the **Surface Dock Firmware** page displaying the status of your Surface Dock firmware.
+
+5.  As the firmware update is uploaded to the Surface Dock, a **Progress** page is displayed, as shown in Figure 3. Do not disconnect the Surface Dock while firmware is being uploaded.
+
+    ![figure 3](images/surfacedockupdater-fig3-progress.png)
+
+    Figure 3. Progress of firmware update upload to Surface Dock
+
+6.  After the firmware update has successfully uploaded to the Surface Dock, you are prompted to disconnect and then reconnect the Surface Dock from the Surface device, as shown in Figure 4. The main chipset firmware update will be applied while the Surface Dock is disconnected.
+
+    ![figure 4](images/surfacedockupdater-fig4-disconnect.png)
+
+    Figure 4. Disconnect and reconnect Surface Dock when prompted
+
+7.  When the main chipset firmware update is verified, the DisplayPort chipset firmware update will be uploaded to the Surface Dock. Upon completion, a **Success** page is displayed and you will again be prompted to disconnect the Surface Dock, as shown in Figure 5.
+
+    ![figure 5](images/surfacedockupdater-fig5-success.png)
+
+    Figure 5. Successful upload of Surface Dock firmware
+
+8.  After you disconnect the Surface Dock the DisplayPort firmware update will be installed. This process occurs on the Surface Dock hardware while it is disconnected. The Surface Dock must remain powered for up to 3 minutes after it has been disconnected for the firmware update to successfully install. An **Update in Progress** page is displayed (as shown in Figure 6), with a countdown timer to show the estimated time remaining to complete the firmware update installation.
+
+    ![figure 6](images/surfacedockupdater-fig6-countdown.png)
+
+    Figure 6. Countdown timer to complete firmware installation on Surface Dock
+
+9.  If you want to update multiple Surface Docks in one sitting, you can click the **Update another Surface Dock** button to begin the process on the next Surface Dock.
+
+    **Note**  
+    The LED in the Ethernet port of the dock will blink while the update is in progress. Please wait until the LED stops blinking before you unplug your Surface Dock from power.
+
+     
+
+## Troubleshooting Microsoft Surface Dock Updater
+
+
+If the Surface Dock firmware update process encounters an installation error with either firmware update, the **Encountered an unexpected error** page may be displayed, as shown in Figure 7.
+
+![figure 7](images/surfacedockupdater-fig7-error.png)
+
+Figure 7. Firmware update installation has encountered an error
+
+Microsoft Surface Dock Updater logs its progress into the Event Log, as shown in Figure 8. If you need to troubleshoot an update through this tool, you will find Surface Dock events recorded with the following event IDs:
+
+| Event ID | Event type                                               |
+|----------|----------------------------------------------------------|
+| 12100    | Up-to-date confirmation                                  |
+| 12101    | Event in the main chipset firmware update process        |
+| 12102    | Event in the DisplayPort chipset firmware update process |
+| 12105    | Error                                                    |
+
+ 
+![figure 8](images/surfacedockupdater-fig8-737test.png)
+
+Figure 8. Surface Dock Updater events in Event Viewer
+
+## Related topics
+
+
+[Manage Surface Dock firmware updates](manage-surface-dock-firmware-updates.md)

education/docfx.json

@@ -0,0 +1,24 @@
+{
+  "build": {
+    "content":
+      [
+        {
+          "files": ["**/**.md"],
+          "exclude": ["**/obj/**"]
+        }
+      ],
+    "resource": [
+        {
+          "files": ["**/images/**", "**/*.json"],
+          "exclude": ["**/obj/**"]
+        }
+    ],
+    "globalMetadata": {
+        "ROBOTS": "INDEX, FOLLOW"
+    },
+    "externalReference": [
+    ],
+    "template": "op.html",
+    "dest": "education"
+  }
+}

education/index.md

@@ -0,0 +1 @@
+#OP Testing file

mdop/appv-v5/TOC.md

@@ -17,7 +17,7 @@
 ##### [Planning to Deploy App-V 5.1 with an Electronic Software Distribution System](planning-to-deploy-app-v-51-with-an-electronic-software-distribution-system.md)
 ##### [Planning for the App-V 5.1 Server Deployment](planning-for-the-app-v-51-server-deployment.md)
 ##### [Planning for the App-V 5.1 Sequencer and Client Deployment](planning-for-the-app-v-51-sequencer-and-client-deployment.md)
-##### [Planning for Migrating from a Previous Version of App-V 5.1 ](planning-for-migrating-from-a-previous-version-of-app-v51.md)
+##### [Planning for Migrating from a Previous Version of App-V](planning-for-migrating-from-a-previous-version-of-app-v51.md)
 ##### [Planning for Using App-V with Office 5.1](planning-for-using-app-v-with-office51.md)
 ##### [Planning to Use Folder Redirection with App-V 5.1](planning-to-use-folder-redirection-with-app-v51.md)
 #### [App-V 5.1 Planning Checklist](app-v-51-planning-checklist.md)
@@ -79,11 +79,12 @@
 ##### [How to Access the Client Management Console 5.1](how-to-access-the-client-management-console51.md)
 ##### [How to Configure the Client to Receive Package and Connection Groups Updates From the Publishing Server  5.1](how-to-configure-the-client-to-receive-package-and-connection-groups-updates-from-the-publishing-server-51.md)
 #### [Migrating to App-V 5.1 from a Previous Version](migrating-to-app-v-51-from-a-previous-version.md)
+##### [Check Registry Keys before installing App-V 5.x Server](check-reg-key-svr.md)
 ##### [How to Convert a Package Created in a Previous Version of App-V 5.1](how-to-convert-a-package-created-in-a-previous-version-of-app-v51.md)
-##### [How to Migrate Extension Points From an App-V 4.6 SP2 Package to a Converted App-V 5.1 Package for All Users on a Specific Computer](how-to-migrate-extension-points-from-an-app-v-46-sp2-package-to-a-converted-app-v-51-package-for-all-users-on-a-specific-computer.md)
+##### [How to Migrate Extension Points From an App-V 4.6 Package to a Converted App-V 5.1 Package for All Users on a Specific Computer](how-to-migrate-extension-points-from-an-app-v-46-sp2-package-to-a-converted-app-v-51-package-for-all-users-on-a-specific-computer.md)
-##### [How to Migrate Extension Points From an App-V 4.6 SP2 Package to App-V 5.1 for a Specific User](how-to-migrate-extension-points-from-an-app-v-46-sp2-package-to-app-v-51-for-a-specific-user.md)
+##### [How to Migrate Extension Points From an App-V 4.6 Package to App-V 5.1 for a Specific User](how-to-migrate-extension-points-from-an-app-v-46-sp2-package-to-app-v-51-for-a-specific-user.md)
-##### [How to Revert Extension Points from an App-V 5.1 Package to an App-V 4.6 SP2 Package For All Users on a Specific Computer](how-to-revert-extension-points-from-an-app-v-51-package-to-an-app-v-46-sp2-package-for-all-users-on-a-specific-computer.md)
+##### [How to Revert Extension Points from an App-V 5.1 Package to an App-V 4.6 Package For All Users on a Specific Computer](how-to-revert-extension-points-from-an-app-v-51-package-to-an-app-v-46-sp2-package-for-all-users-on-a-specific-computer.md)
-##### [How to Revert Extension Points From an App-V 5.1 Package to an App-V 4.6 SP2 Package for a Specific User](how-to-revert-extension-points-from-an-app-v-51-package-to-an-app-v-46-sp2-package-for-a-specific-user.md)
+##### [How to Revert Extension Points From an App-V 5.1 Package to an App-V 4.6 Package for a Specific User](how-to-revert-extension-points-from-an-app-v-51-package-to-an-app-v-46-sp2-package-for-a-specific-user.md)
 ##### [How to Use an App-V 4.6 SP1 Application From an App-V 5.1 Application](how-to-use-an-app-v-46-sp1-application-from-an-app-v-51-application.md)
 #### [Maintaining App-V 5.1](maintaining-app-v-51.md)
 ##### [How to Move the App-V Server to Another Computer 5.1](how-to-move-the-app-v-server-to-another-computer51.md)

mdop/appv-v5/about-app-v-50-sp3.md

@@ -197,7 +197,7 @@ Complete the following steps to upgrade each component of the App-V infrastructu
 </tbody>
 </table>
 <p> </p></li>
-<li><p>If you are upgrading the App-V Server from App-V SP1 Hotfix Package 3 or later, complete the steps in section [Check registry keys after installing the App-V 5.0 SP3 Server](#bkmk-check-reg-key-svr).</p></li>
+<li><p>If you are upgrading the App-V Server from App-V 5.0 SP1 Hotfix Package 3 or later, complete the steps in section [Check registry keys after installing the App-V 5.0 SP3 Server](#bkmk-check-reg-key-svr).</p></li>
 <li><p>Follow the steps in [How to Deploy the App-V 5.0 Server](how-to-deploy-the-app-v-50-server-50sp3.md).</p></li>
 </ol></td>
 </tr>

mdop/appv-v5/about-app-v-51.md

@@ -63,7 +63,7 @@ See the following links for the App-V 5.1 software prerequisites and supported c
 ## <a href="" id="bkmk-migrate-to-51"></a>Migrating to App-V 5.1
 
 
-Use the following information to upgrade to App-V 5.1 from earlier versions. See [Migrating from a Previous Version](migrating-from-a-previous-version-app-v-50.md) for more information.
+Use the following information to upgrade to App-V 5.1 from earlier versions. See [Migrating to App-V 5.1 from a Previous Version](migrating-to-app-v-51-from-a-previous-version.md) for more information.
 
 ### Before you start the upgrade
 
@@ -90,7 +90,7 @@ Review the following information before you start the upgrade:
 </ol>
 <div class="alert">
 <strong>Note</strong>  
-<p>To use the App-V client user interface, download the existing version from [Application Virtualization 5.0 Client UI Application](http://www.microsoft.com/download/details.aspx?id=41186).</p>
+<p>Prior to App-V 5.0 SP2, the Client Management User Interface (UI) was provided with the App-V Client installation. For App-V 5.0 SP2 installations (or later), you can use the Client Management UI by downloading from [Application Virtualization 5.0 Client UI Application](http://www.microsoft.com/download/details.aspx?id=41186).</p>
 </div>
 <div>
  
@@ -98,7 +98,7 @@ Review the following information before you start the upgrade:
 </tr>
 <tr class="even">
 <td align="left"><p>Upgrading from App-V 4.x</p></td>
-<td align="left"><p>For more information, see:</p>
+<td align="left"><p>You must first upgrade to App-V 5.0. You cannot upgrade directly from App-V 4.x to App-V 5.1. For more information, see:</p>
 <ul>
 <li><p>“Differences between App-V 4.6 and App-V 5.0” in [About App-V 5.0](about-app-v-50.md)</p></li>
 <li><p>[Planning for Migrating from a Previous Version of App-V](planning-for-migrating-from-a-previous-version-of-app-v.md)</p></li>
@@ -147,7 +147,35 @@ Complete the following steps to upgrade each component of the App-V infrastructu
 <div>
  
 </div></td>
-<td align="left"><p>See [How to Deploy the App-V 5.0 Server](how-to-deploy-the-app-v-50-server-50sp3.md)</p></td>
+<td align="left"><p>Follow these steps:</p>
+<ol>
+<li><p>Do one of the following, depending on the method you are using to upgrade the Management database and/or Reporting database:</p>
+<table>
+<colgroup>
+<col width="50%" />
+<col width="50%" />
+</colgroup>
+<thead>
+<tr class="header">
+<th align="left">Database upgrade method</th>
+<th align="left">Step</th>
+</tr>
+</thead>
+<tbody>
+<tr class="odd">
+<td align="left"><p>Windows Installer</p></td>
+<td align="left"><p>Skip this step and go to step 2, “If you are upgrading the App-V Server...”</p></td>
+</tr>
+<tr class="even">
+<td align="left"><p>SQL scripts</p></td>
+<td align="left"><p>Follow the steps in [How to Deploy the App-V Databases by Using SQL Scripts](how-to-deploy-the-app-v-databases-by-using-sql-scripts.md).</p></td>
+</tr>
+</tbody>
+</table>
+<li><p>If you are upgrading the App-V Server from App-V 5.0 SP1 Hotfix Package 3 or later, complete the steps in section [Check registry keys after installing the App-V 5.0 SP3 Server](check-reg-key-svr.md).</p></li>
+<li><p>Follow the steps in [How to Deploy the App-V 5.1 Server](how-to-deploy-the-app-v-51-server.md)</p></li>
+<p> </p></li>
+</ol></td>
 </tr>
 <tr class="even">
 <td align="left"><p>Step 2: Upgrade the App-V Sequencer.</p></td>
@@ -174,7 +202,7 @@ App-V 5.1 packages are exactly the same as App-V 5.0 packages. There has been no
 ## <a href="" id="bkmk-whatsnew"></a>What’s New in App-V 5.1
 
 
-These sections are for users who are already familiar with App-V and want to know what has changed in App-V 5.1. If you are not already familiar with App-V, you should start by reading [Planning for App-V 5.0](planning-for-app-v-50-rc.md).
+These sections are for users who are already familiar with App-V and want to know what has changed in App-V 5.1. If you are not already familiar with App-V, you should start by reading [Planning for App-V 5.1](planning-for-app-v-51.md).
 
 ### <a href="" id="bkmk-win10support"></a>App-V support for Windows 10
 

mdop/appv-v5/check-reg-key-svr.md

@@ -0,0 +1,238 @@
+---
+title: Check Registry Keys before installing App-V 5.x Server
+description: Check Registry Keys before installing App-V 5.x Server
+ms.assetid: 
+author: jamiejdt
+---
+
+# Check Registry Keys before installing App-V 5.x Server
+
+If you are upgrading the App-V Server from App-V 5.0 SP1 Hotfix Package 3 or later, complete the steps in this section before installing the App-V 5.x Server
+
+<table>
+<colgroup>
+<col width="50%" />
+<col width="50%" />
+</colgroup>
+<tbody>
+<tr class="odd">
+<td align="left"><p><strong>When this step is required</strong></p></td>
+<td align="left"><p>You are upgrading from App-V 5.0 SP1 with any subsequent Hotfix Packages that you installed by using an .msp file.</p></td>
+</tr>
+<tr class="even">
+<td align="left"><p><strong>Which components require that you do this step</strong></p></td>
+<td align="left"><p>Only the App-V Server components that you are upgrading.</p></td>
+</tr>
+<tr class="odd">
+<td align="left"><p><strong>When you need to do this step</strong></p></td>
+<td align="left"><p>Before you upgrade the App-V Server to App-V 5.x</p></td>
+</tr>
+<tr class="even">
+<td align="left"><p><strong>What you need to do</strong></p></td>
+<td align="left"><p>Using the information in the following tables, update each registry key value under <code>HKLM\Software\Microsoft\AppV\Server</code> with the value that you provided in your original server installation. Completing this step restores registry values that may have been removed when App-V 5.0 SP1 Hotfix Packages were installed.</p></td>
+</tr>
+</tbody>
+</table>
+
+ 
+
+**ManagementDatabase key**
+
+If you are installing the Management database, set these registry keys under `HKLM\Software\Microsoft\AppV\Server\ManagementDatabase`.
+
+<table>
+<colgroup>
+<col width="50%" />
+<col width="50%" />
+</colgroup>
+<thead>
+<tr class="header">
+<th align="left">Key name</th>
+<th align="left">Description</th>
+</tr>
+</thead>
+<tbody>
+<tr class="odd">
+<td align="left"><p>IS_MANAGEMENT_DB_PUBLIC_ACCESS_ACCOUNT_REQUIRED</p></td>
+<td align="left"><p>Describes whether a public access account is required to access non-local management databases. Value is set to “1” if it is required.</p></td>
+</tr>
+<tr class="even">
+<td align="left"><p>MANAGEMENT_DB_NAME</p></td>
+<td align="left"><p>Name of the Management database.</p></td>
+</tr>
+<tr class="odd">
+<td align="left"><p>MANAGEMENT_DB_PUBLIC_ACCESS_ACCOUNT</p></td>
+<td align="left"><p>Account used for read (public) access to the Management database.</p>
+<p>Used when <code>IS_MANAGEMENT_DB_PUBLIC_ACCESS_ACCOUNT_REQUIRED</code> is set to 1.</p></td>
+</tr>
+<tr class="even">
+<td align="left"><p>MANAGEMENT_DB_PUBLIC_ACCESS_ACCOUNT_SID</p></td>
+<td align="left"><p>Secure identifier (SID) of the account used for read (public) access to the Management database.</p>
+<p>Used when <code>IS_MANAGEMENT_DB_PUBLIC_ACCESS_ACCOUNT_REQUIRED</code> is set to 1.</p></td>
+</tr>
+<tr class="odd">
+<td align="left"><p>MANAGEMENT_DB_SQL_INSTANCE</p></td>
+<td align="left"><p>SQL Server instance for the Management database.</p>
+<p>If the value is blank, the default database instance is used.</p></td>
+</tr>
+<tr class="even">
+<td align="left"><p>MANAGEMENT_DB_WRITE_ACCESS_ACCOUNT</p></td>
+<td align="left"><p>Account used for write (administrator) access to the Management database.</p></td>
+</tr>
+<tr class="odd">
+<td align="left"><p>MANAGEMENT_DB_WRITE_ACCESS_ACCOUNT_SID</p></td>
+<td align="left"><p>Secure identifier (SID) of the account used for write (administrator) access to the Management database.</p></td>
+</tr>
+<tr class="even">
+<td align="left"><p>MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT</p></td>
+<td align="left"><p>Management server remote computer account (domain\account).</p></td>
+</tr>
+<tr class="odd">
+<td align="left"><p>MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT</p></td>
+<td align="left"><p>Installation administrator login for the Management server (domain\account).</p></td>
+</tr>
+<tr class="even">
+<td align="left"><p>MANAGEMENT_SERVER_MACHINE_USE_LOCAL</p></td>
+<td align="left"><p>Valid values are:</p>
+<ul>
+<li><p><strong>1</strong> – the Management service is on the local computer, that is, MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT is blank.</p></li>
+<li><p><strong>0</strong> - the Management service is on a different computer from the local computer.</p></li>
+</ul></td>
+</tr>
+</tbody>
+</table>
+
+ 
+
+**ManagementService key**
+
+If you are installing the Management server, set these registry keys under `HKLM\Software\Microsoft\AppV\Server\ManagementService`.
+
+<table>
+<colgroup>
+<col width="50%" />
+<col width="50%" />
+</colgroup>
+<thead>
+<tr class="header">
+<th align="left">Key name</th>
+<th align="left">Description</th>
+</tr>
+</thead>
+<tbody>
+<tr class="odd">
+<td align="left"><p>MANAGEMENT_ADMINACCOUNT</p></td>
+<td align="left"><p>Active Directory Domain Services (AD DS) group or account that is authorized to manage App-V (domain\account).</p></td>
+</tr>
+<tr class="even">
+<td align="left"><p>MANAGEMENT_DB_SQL_INSTANCE</p></td>
+<td align="left"><p>SQL server instance that contains the Management database.</p>
+<p>If the value is blank, the default database instance is used.</p></td>
+</tr>
+<tr class="odd">
+<td align="left"><p>MANAGEMENT_DB_SQL_SERVER_NAME</p></td>
+<td align="left"><p>Name of the remote SQL server with the Management database.</p>
+<p>If the value is blank, the local computer is used.</p></td>
+</tr>
+</tbody>
+</table>
+
+ 
+
+**ReportingDatabase key**
+
+If you are installing the Reporting database, set these registry keys under `HKLM\Software\Microsoft\AppV\Server\ReportingDatabase`.
+
+<table>
+<colgroup>
+<col width="50%" />
+<col width="50%" />
+</colgroup>
+<thead>
+<tr class="header">
+<th align="left">Key name</th>
+<th align="left">Description</th>
+</tr>
+</thead>
+<tbody>
+<tr class="odd">
+<td align="left"><p>IS_REPORTING_DB_PUBLIC_ACCESS_ACCOUNT_REQUIRED</p></td>
+<td align="left"><p>Describes whether a public access account is required to access non-local reporting databases. Value is set to “1” if it is required.</p></td>
+</tr>
+<tr class="even">
+<td align="left"><p>REPORTING_DB_NAME</p></td>
+<td align="left"><p>Name of the Reporting database.</p></td>
+</tr>
+<tr class="odd">
+<td align="left"><p>REPORTING_DB_PUBLIC_ACCESS_ACCOUNT</p></td>
+<td align="left"><p>Account used for read (public) access to the Reporting database.</p>
+<p>Used when <code>IS_REPORTING_DB_PUBLIC_ACCESS_ACCOUNT_REQUIRED</code> is set to 1.</p></td>
+</tr>
+<tr class="even">
+<td align="left"><p>REPORTING_DB_PUBLIC_ACCESS_ACCOUNT_SID</p></td>
+<td align="left"><p>Secure identifier (SID) of the account used for read (public) access to the Reporting database.</p>
+<p>Used when <code>IS_REPORTING_DB_PUBLIC_ACCESS_ACCOUNT_REQUIRED</code> is set to 1.</p></td>
+</tr>
+<tr class="odd">
+<td align="left"><p>REPORTING_DB_SQL_INSTANCE</p></td>
+<td align="left"><p>SQL Server instance for the Reporting database.</p>
+<p>If the value is blank, the default database instance is used.</p></td>
+</tr>
+<tr class="even">
+<td align="left"><p>REPORTING_DB_WRITE_ACCESS_ACCOUNT</p></td>
+<td align="left"><p></p></td>
+</tr>
+<tr class="odd">
+<td align="left"><p>REPORTING_DB_WRITE_ACCESS_ACCOUNT_SID</p></td>
+<td align="left"><p></p></td>
+</tr>
+<tr class="even">
+<td align="left"><p>REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT</p></td>
+<td align="left"><p>Reporting server remote computer account (domain\account).</p></td>
+</tr>
+<tr class="odd">
+<td align="left"><p>REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT</p></td>
+<td align="left"><p>Installation administrator login for the Reporting server (domain\account).</p></td>
+</tr>
+<tr class="even">
+<td align="left"><p>REPORTING_SERVER_MACHINE_USE_LOCAL</p></td>
+<td align="left"><p>Valid values are:</p>
+<ul>
+<li><p><strong>1</strong> – the Reporting service is on the local computer, that is, REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT is blank.</p></li>
+<li><p><strong>0</strong> - the Reporting service is on a different computer from the local computer.</p></li>
+</ul></td>
+</tr>
+</tbody>
+</table>
+
+ 
+
+**ReportingService key**
+
+If you are installing the Reporting server, set these registry keys under `HKLM\Software\Microsoft\AppV\Server\ReportingService`.
+
+<table>
+<colgroup>
+<col width="50%" />
+<col width="50%" />
+</colgroup>
+<thead>
+<tr class="header">
+<th align="left">Key name</th>
+<th align="left">Description</th>
+</tr>
+</thead>
+<tbody>
+<tr class="odd">
+<td align="left"><p>REPORTING_DB_SQL_INSTANCE</p></td>
+<td align="left"><p>SQL Server instance for the Reporting database.</p>
+<p>If the value is blank, the default database instance is used.</p></td>
+</tr>
+<tr class="even">
+<td align="left"><p>REPORTING_DB_SQL_SERVER_NAME</p></td>
+<td align="left"><p>Name of the remote SQL server with the Reporting database.</p>
+<p>If the value is blank, the local computer is used.</p></td>
+</tr>
+</tbody>
+</table>
+

mdop/appv-v5/how-to-deploy-the-app-v-46x-and-the-app-v--51-client-on-the-same-computer.md

@@ -32,9 +32,9 @@ Use the following information to install the Microsoft Application Virtualizatio
 
 5.  Convert extension points, as needed. For more information, see the following resources:
 
-    -   [How to Migrate Extension Points From an App-V 4.6 SP2 Package to a Converted App-V 5.1 Package for All Users on a Specific Computer](how-to-migrate-extension-points-from-an-app-v-46-sp2-package-to-a-converted-app-v-51-package-for-all-users-on-a-specific-computer.md)
+    -   [How to Migrate Extension Points From an App-V 4.6 Package to a Converted App-V 5.1 Package for All Users on a Specific Computer](how-to-migrate-extension-points-from-an-app-v-46-sp2-package-to-a-converted-app-v-51-package-for-all-users-on-a-specific-computer.md)
 
-    -   [How to Migrate Extension Points From an App-V 4.6 SP2 Package to App-V 5.1 for a Specific User](how-to-migrate-extension-points-from-an-app-v-46-sp2-package-to-app-v-51-for-a-specific-user.md)
+    -   [How to Migrate Extension Points From an App-V 4.6 Package to App-V 5.1 for a Specific User](how-to-migrate-extension-points-from-an-app-v-46-sp2-package-to-app-v-51-for-a-specific-user.md)
 
     -   [How to Convert a Package Created in a Previous Version of App-V](how-to-convert-a-package-created-in-a-previous-version-of-app-v51.md)
 

mdop/appv-v5/how-to-deploy-the-app-v-51-server.1.md

@@ -0,0 +1,269 @@
+---
+title: How to Deploy the App-V 5.1 Server
+description: How to Deploy the App-V 5.1 Server
+ms.assetid: 4729beda-b98f-481b-ae74-ad71c59b1d69
+author: jamiejdt
+---
+
+# How to Deploy the App-V 5.1 Server
+
+
+Use the following procedure to install the Microsoft Application Virtualization (App-V) 5.1 server. For information about deploying the App-V 5.1 Server, see [About App-V 5.1](about-app-v-51.md#bkmk-migrate-to-51).
+
+**Before you start:**
+
+-   Ensure that you’ve installed prerequisite software. See [App-V 5.1 Prerequisites](app-v-51-prerequisites.md).
+
+-   Review the server section of [App-V 5.1 Security Considerations](app-v-51-security-considerations.md).
+
+-   Specify a port where each component will be hosted.
+
+-   Add firewall rules to allow incoming requests to access the specified ports.
+
+-   If you use SQL scripts, instead of the Windows Installer, to set up the Management database or Reporting database, you must run the SQL scripts before installing the Management Server or Reporting Server. See [How to Deploy the App-V Databases by Using SQL Scripts](how-to-deploy-the-app-v-databases-by-using-sql-scripts51.md).
+
+**To install the App-V 5.1 server**
+
+1.  Copy the App-V 5.1 server installation files to the computer on which you want to install it.
+
+2.  Start the App-V 5.1 server installation by right-clicking and running **appv\_server\_setup.exe** as an administrator, and then click **Install**.
+
+3.  Review and accept the license terms, and choose whether to enable Microsoft updates.
+
+4.  On the **Feature Selection** page, select all of the following components.
+
+    <table>
+    <colgroup>
+    <col width="50%" />
+    <col width="50%" />
+    </colgroup>
+    <thead>
+    <tr class="header">
+    <th align="left">Component</th>
+    <th align="left">Description</th>
+    </tr>
+    </thead>
+    <tbody>
+    <tr class="odd">
+    <td align="left"><p>Management server</p></td>
+    <td align="left"><p>Provides overall management functionality for the App-V infrastructure.</p></td>
+    </tr>
+    <tr class="even">
+    <td align="left"><p>Management database</p></td>
+    <td align="left"><p>Facilitates database predeployments for App-V management.</p></td>
+    </tr>
+    <tr class="odd">
+    <td align="left"><p>Publishing server</p></td>
+    <td align="left"><p>Provides hosting and streaming functionality for virtual applications.</p></td>
+    </tr>
+    <tr class="even">
+    <td align="left"><p>Reporting server</p></td>
+    <td align="left"><p>Provides App-V 5.1 reporting services.</p></td>
+    </tr>
+    <tr class="odd">
+    <td align="left"><p>Reporting database</p></td>
+    <td align="left"><p>Facilitates database predeployments for App-V reporting.</p></td>
+    </tr>
+    </tbody>
+    </table>
+
+     
+
+5.  On the **Installation Location** page, accept the default location where the selected components will be installed, or change the location by typing a new path on the **Installation Location** line.
+
+6.  On the initial **Create New Management Database** page, configure the **Microsoft SQL Server instance** and **Management Server database** by selecting the appropriate option below.
+
+    <table>
+    <colgroup>
+    <col width="50%" />
+    <col width="50%" />
+    </colgroup>
+    <thead>
+    <tr class="header">
+    <th align="left">Method</th>
+    <th align="left">What you need to do</th>
+    </tr>
+    </thead>
+    <tbody>
+    <tr class="odd">
+    <td align="left"><p>You are using a custom Microsoft SQL Server instance.</p></td>
+    <td align="left"><p>Select <strong>Use the custom instance</strong>, and type the name of the instance.</p>
+    <p>Use the format <strong>INSTANCENAME</strong>. The assumed installation location is the local computer.</p>
+    <p>Not supported: A server name using the format <strong>ServerName</strong>\<strong>INSTANCE</strong>.</p></td>
+    </tr>
+    <tr class="even">
+    <td align="left"><p>You are using a custom database name.</p></td>
+    <td align="left"><p>Select <strong>Custom configuration</strong> and type the database name.</p>
+    <p>The database name must be unique, or the installation will fail.</p></td>
+    </tr>
+    </tbody>
+    </table>
+
+     
+
+7.  On the **Configure** page, accept the default value **Use this local computer**.
+
+    **Note**  
+    If you are installing the Management server and Management database side by side, some options on this page are not available. In this case, the appropriate options are selected by default and cannot be changed.
+
+     
+
+8.  On the initial **Create New Reporting Database** page, configure the **Microsoft SQL Server instance** and **Reporting Server database** by selecting the appropriate option below.
+
+    <table>
+    <colgroup>
+    <col width="50%" />
+    <col width="50%" />
+    </colgroup>
+    <thead>
+    <tr class="header">
+    <th align="left">Method</th>
+    <th align="left">What you need to do</th>
+    </tr>
+    </thead>
+    <tbody>
+    <tr class="odd">
+    <td align="left"><p>You are using a custom Microsoft SQL Server instance.</p></td>
+    <td align="left"><p>Select <strong>Use the custom instance</strong>, and type the name of the instance.</p>
+    <p>Use the format <strong>INSTANCENAME</strong>. The assumed installation location is the local computer.</p>
+    <p>Not supported: A server name using the format <strong>ServerName</strong>\<strong>INSTANCE</strong>.</p></td>
+    </tr>
+    <tr class="even">
+    <td align="left"><p>You are using a custom database name.</p></td>
+    <td align="left"><p>Select <strong>Custom configuration</strong> and type the database name.</p>
+    <p>The database name must be unique, or the installation will fail.</p></td>
+    </tr>
+    </tbody>
+    </table>
+
+     
+
+9.  On the **Configure** page, accept the default value: **Use this local computer**.
+
+    **Note**  
+    If you are installing the Management server and Management database side by side, some options on this page are not available. In this case, the appropriate options are selected by default and cannot be changed.
+
+     
+
+10. On the **Configure** (Management Server Configuration) page, specify the following:
+
+    <table>
+    <colgroup>
+    <col width="50%" />
+    <col width="50%" />
+    </colgroup>
+    <thead>
+    <tr class="header">
+    <th align="left">Item to configure</th>
+    <th align="left">Description and examples</th>
+    </tr>
+    </thead>
+    <tbody>
+    <tr class="odd">
+    <td align="left"><p>Type the AD group with sufficient permissions to manage the App-V environment.</p></td>
+    <td align="left"><p>Example: MyDomain\MyUser</p>
+    <p>After installation, you can add additional users or groups by using the Management console. However, global security groups and Active Directory Domain Services (AD DS) distribution groups are not supported. You must use <strong>Domain local</strong> or <strong>Universal</strong> groups are required to perform this action.</p></td>
+    </tr>
+    <tr class="even">
+    <td align="left"><p><strong>Website name</strong>: Specify the custom name that will be used to run the publishing service.</p></td>
+    <td align="left"><p>If you do not have a custom name, do not make any changes.</p></td>
+    </tr>
+    <tr class="odd">
+    <td align="left"><p><strong>Port binding</strong>: Specify a unique port number that will be used by App-V.</p></td>
+    <td align="left"><p>Example: <strong>12345</strong></p>
+    <p>Ensure that the port specified is not being used by another website.</p></td>
+    </tr>
+    </tbody>
+    </table>
+
+     
+
+11. On the **Configure** **Publishing Server Configuration** page, specify the following:
+
+    <table>
+    <colgroup>
+    <col width="50%" />
+    <col width="50%" />
+    </colgroup>
+    <thead>
+    <tr class="header">
+    <th align="left">Item to configure</th>
+    <th align="left">Description and examples</th>
+    </tr>
+    </thead>
+    <tbody>
+    <tr class="odd">
+    <td align="left"><p>Specify the URL for the management service.</p></td>
+    <td align="left"><p>Example: http://localhost:12345</p></td>
+    </tr>
+    <tr class="even">
+    <td align="left"><p><strong>Website name</strong>: Specify the custom name that will be used to run the publishing service.</p></td>
+    <td align="left"><p>If you do not have a custom name, do not make any changes.</p></td>
+    </tr>
+    <tr class="odd">
+    <td align="left"><p><strong>Port binding</strong>: Specify a unique port number that will be used by App-V.</p></td>
+    <td align="left"><p>Example: 54321</p>
+    <p>Ensure that the port specified is not being used by another website.</p></td>
+    </tr>
+    </tbody>
+    </table>
+
+     
+
+12. On the **Reporting Server** page, specify the following:
+
+    <table>
+    <colgroup>
+    <col width="50%" />
+    <col width="50%" />
+    </colgroup>
+    <thead>
+    <tr class="header">
+    <th align="left">Item to configure</th>
+    <th align="left">Description and examples</th>
+    </tr>
+    </thead>
+    <tbody>
+    <tr class="odd">
+    <td align="left"><p><strong>Website name</strong>: Specify the custom name that will be used to run the Reporting Service.</p></td>
+    <td align="left"><p>If you do not have a custom name, do not make any changes.</p></td>
+    </tr>
+    <tr class="even">
+    <td align="left"><p><strong>Port binding</strong>: Specify a unique port number that will be used by App-V.</p></td>
+    <td align="left"><p>Example: 55555</p>
+    <p>Ensure that the port specified is not being used by another website.</p></td>
+    </tr>
+    </tbody>
+    </table>
+
+     
+
+13. To start the installation, click **Install** on the **Ready** page, and then click **Close** on the **Finished** page.
+
+14. To verify that the setup completed successfully, open a web browser, and type the following URL:
+
+    **http://&lt;Management server machine name&gt;:&lt;Management service port number&gt;/Console.html**.
+
+    Example: **http://localhost:12345/console.html**. If the installation succeeded, the App-V Management console is displayed with no errors.
+
+    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+
+## Related topics
+
+
+[Deploying App-V 5.1](deploying-app-v-51.md)
+
+[How to Install the Management and Reporting Databases on Separate Computers from the Management and Reporting Services](how-to-install-the-management-and-reporting-databases-on-separate-computers-from-the-management-and-reporting-services51.md)
+
+[How to Install the Publishing Server on a Remote Computer](how-to-install-the-publishing-server-on-a-remote-computer51.md)
+
+[How to Deploy the App-V 5.1 Server Using a Script](how-to-deploy-the-app-v-51-server-using-a-script.md)
+
+ 
+
+ 
+
+
+
+
+

mdop/appv-v5/how-to-migrate-extension-points-from-an-app-v-46-sp2-package-to-a-converted-app-v-51-package-for-all-users-on-a-specific-computer.md

@@ -1,21 +1,22 @@
 ---
-title: How to Migrate Extension Points From an App-V 4.6 SP2 Package to a Converted App-V 5.1 Package for All Users on a Specific Computer
+title: How to Migrate Extension Points From an App-V 4.6 Package to a Converted App-V 5.1 Package for All Users on a Specific Computer
-description: How to Migrate Extension Points From an App-V 4.6 SP2 Package to a Converted App-V 5.1 Package for All Users on a Specific Computer
+description: How to Migrate Extension Points From an App-V 4.6 Package to a Converted App-V 5.1 Package for All Users on a Specific Computer
 ms.assetid: 4ef823a5-3106-44c5-aecc-29edf69c2fbb
 author: jamiejdt
 ---
 
-# How to Migrate Extension Points From an App-V 4.6 SP2 Package to a Converted App-V 5.1 Package for All Users on a Specific Computer
+# How to Migrate Extension Points From an App-V 4.6 Package to a Converted App-V 5.1 Package for All Users on a Specific Computer
 
 
-Use the following procedure to migrate extension points from an App-V 4.6 SP2 package to a App-V 5.1 package using the deployment configuration file.
+Use the following procedure to migrate extension points from an App-V 4.6 package to a App-V 5.1 package using the deployment configuration file.
 
 **Note**  
+This procedure assumes that you are running the latest version of App-V 4.6.  
 The following procedure does not require an App-V 5.1 management server.
 
  
 
-**To migrate extension points from a package from an App-V 4.6 SP2 package to a converted App-V 5.1 package using the deployment configuration file**
+**To migrate extension points from a package from an App-V 4.6 package to a converted App-V 5.1 package using the deployment configuration file**
 
 1.  Locate the directory that contains the deployment configuration file for the package you want to migrate. To set the policy, make the following update to the **userConfiguration** section:
 
@@ -47,14 +48,14 @@ The following procedure does not require an App-V 5.1 management server.
 
     PS>**Publish-AppVClientPackage $pkg**
 
-3.  To test the migration, open the virtual application using asscoaited FTAs or shortcuts. The application opens with App-V 5.1. Both, the App-V 4.6 SP2 package and the converted App-V 5.1 package are published to the user, but the FTAs and shortcuts for the applications have been assumed by the App-V 5.1 package.
+3.  To test the migration, open the virtual application using associated FTAs or shortcuts. The application opens with App-V 5.1. Both, the App-V 4.6 package and the converted App-V 5.1 package are published to the user, but the FTAs and shortcuts for the applications have been assumed by the App-V 5.1 package.
 
     **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
 
 ## Related topics
 
 
-[How to Revert Extension Points from an App-V 5.1 Package to an App-V 4.6 SP2 Package For All Users on a Specific Computer](how-to-revert-extension-points-from-an-app-v-51-package-to-an-app-v-46-sp2-package-for-all-users-on-a-specific-computer.md)
+[How to Revert Extension Points from an App-V 5.1 Package to an App-V 4.6 Package For All Users on a Specific Computer](how-to-revert-extension-points-from-an-app-v-51-package-to-an-app-v-46-sp2-package-for-all-users-on-a-specific-computer.md)
 
 [Operations for App-V 5.1](operations-for-app-v-51.md)
 

mdop/appv-v5/how-to-migrate-extension-points-from-an-app-v-46-sp2-package-to-app-v-51-for-a-specific-user.md

@@ -1,15 +1,18 @@
 ---
-title: How to Migrate Extension Points From an App-V 4.6 SP2 Package to App-V 5.1 for a Specific User
+title: How to Migrate Extension Points From an App-V 4.6 Package to App-V 5.1 for a Specific User
-description: How to Migrate Extension Points From an App-V 4.6 SP2 Package to App-V 5.1 for a Specific User
+description: How to Migrate Extension Points From an App-V 4.6 Package to App-V 5.1 for a Specific User
 ms.assetid: 19da3776-5ebe-41e1-9890-12b84ef3c1c7
 author: jamiejdt
 ---
 
-# How to Migrate Extension Points From an App-V 4.6 SP2 Package to App-V 5.1 for a Specific User
+# How to Migrate Extension Points From an App-V 4.6 Package to App-V 5.1 for a Specific User
 
 
 Use the following procedure to migrate packages created with App-V using the user configuration file.
 
+**Note**  
+This procedure assumes that you are running the latest version of App-V 4.6.
+
 **To convert a package**
 
 1.  Locate the user configuration file for the package you want to convert. To set the policy, perform the following updates in the **userConfiguration** section: **ManagingAuthority TakeoverExtensionPointsFrom46="true" PackageName=<Package ID>**.
@@ -34,7 +37,7 @@ Use the following procedure to migrate packages created with App-V using the use
 
 3.  Open the application using FTAs or shortcuts now. The application should open using App-V 5.1.
 
-    The App-V SP2 package and the converted App-V 5.1 package are published to the user, but the FTAs and shortcuts for the applications have been assumed by the App-V 5.1 package.
+    The App-V 4.6 package and the converted App-V 5.1 package are published to the user, but the FTAs and shortcuts for the applications have been assumed by the App-V 5.1 package.
 
     **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
 
@@ -43,7 +46,7 @@ Use the following procedure to migrate packages created with App-V using the use
 
 [Operations for App-V 5.1](operations-for-app-v-51.md)
 
-[How to Revert Extension Points From an App-V 5.1 Package to an App-V 4.6 SP2 Package for a Specific User](how-to-revert-extension-points-from-an-app-v-51-package-to-an-app-v-46-sp2-package-for-a-specific-user.md)
+[How to Revert Extension Points From an App-V 5.1 Package to an App-V 4.6 Package for a Specific User](how-to-revert-extension-points-from-an-app-v-51-package-to-an-app-v-46-sp2-package-for-a-specific-user.md)
 
  
 

mdop/appv-v5/how-to-revert-extension-points-from-an-app-v-51-package-to-an-app-v-46-sp2-package-for-a-specific-user.md

@@ -1,18 +1,18 @@
 ---
-title: How to Revert Extension Points From an App-V 5.1 Package to an App-V 4.6 SP2 Package for a Specific User
+title: How to Revert Extension Points From an App-V 5.1 Package to an App-V 4.6 Package for a Specific User
-description: How to Revert Extension Points From an App-V 5.1 Package to an App-V 4.6 SP2 Package for a Specific User
+description: How to Revert Extension Points From an App-V 5.1 Package to an App-V 4.6 Package for a Specific User
 ms.assetid: bd53c5d6-7fd2-4816-b03b-d59da0a35819
 author: jamiejdt
 ---
 
-# How to Revert Extension Points From an App-V 5.1 Package to an App-V 4.6 SP2 Package for a Specific User
+# How to Revert Extension Points From an App-V 5.1 Package to an App-V 4.6 Package for a Specific User
 
 
 Use the following procedure to revert an App-V 5.1 package to the App-V file format using the user configuration file.
 
 **To revert a package**
 
-1.  Ensure that App-V 4.6 SP2 package is published to the users but the FTAs and shortcuts have been assumed by App-V 5.1 package using the following migration method, [How to Migrate Extension Points From an App-V 4.6 SP2 Package to App-V 5.1 for a Specific User](how-to-migrate-extension-points-from-an-app-v-46-sp2-package-to-app-v-51-for-a-specific-user.md).
+1.  Ensure that App-V 4.6 package is published to the users but the FTAs and shortcuts have been assumed by App-V 5.1 package using the following migration method, [How to Migrate Extension Points From an App-V 4.6 Package to App-V 5.1 for a Specific User](how-to-migrate-extension-points-from-an-app-v-46-sp2-package-to-app-v-51-for-a-specific-user.md).
 
     In the **userConfiguration** section of the deployment configuration file for the converted package, to set the policy, make the following update to the **userConfiguration** section: **ManagingAuthority TakeoverExtensionPointsFrom46="false" PackageName=<Package ID>**
 
@@ -20,7 +20,7 @@ Use the following procedure to revert an App-V 5.1 package to the App-V file for
 
     PS>**Publish-AppVClientPackage $pkg –DynamicUserConfigurationPath** <path to user configuration file>
 
-3.  Perform a publishing refresh, or wait for the next scheduled publishing refresh for the App-V 4.6 SP2. Open the application using FTAs or shortcuts. The Application should now open using App-V 4.6 SP2.
+3.  Perform a publishing refresh, or wait for the next scheduled publishing refresh for the App-V 4.6. Open the application using FTAs or shortcuts. The Application should now open using App-V 4.6.
 
     **Note**  
     If you do not need the App-V 5.1 package anymore, you can unpublish the App-V 5.1 package and the extension points will automatically revert to App-V 4.6.

mdop/appv-v5/how-to-revert-extension-points-from-an-app-v-51-package-to-an-app-v-46-sp2-package-for-all-users-on-a-specific-computer.md

@@ -1,18 +1,18 @@
 ---
-title: How to Revert Extension Points from an App-V 5.1 Package to an App-V 4.6 SP2 Package For All Users on a Specific Computer
+title: How to Revert Extension Points from an App-V 5.1 Package to an App-V 4.6 Package For All Users on a Specific Computer
-description: How to Revert Extension Points from an App-V 5.1 Package to an App-V 4.6 SP2 Package For All Users on a Specific Computer
+description: How to Revert Extension Points from an App-V 5.1 Package to an App-V 4.6 Package For All Users on a Specific Computer
 ms.assetid: 64640b8e-de6b-4006-a33e-353d285af15e
 author: jamiejdt
 ---
 
-# How to Revert Extension Points from an App-V 5.1 Package to an App-V 4.6 SP2 Package For All Users on a Specific Computer
+# How to Revert Extension Points from an App-V 5.1 Package to an App-V 4.6 Package For All Users on a Specific Computer
 
 
-Use the following procedure to revert extension points from an App-V 5.1 package to the App-V 4.6 SP2 file format using the deployment configuration file.
+Use the following procedure to revert extension points from an App-V 5.1 package to the App-V 4.6 file format using the deployment configuration file.
 
 **To revert a package**
 
-1.  Ensure that App-V 4.6 SP2 package is published to the users but the FTAs and shortcuts have been assumed by App-V 5.1 package using the following migration method, [How to Migrate Extension Points From an App-V 4.6 SP2 Package to a Converted App-V 5.1 Package for All Users on a Specific Computer](how-to-migrate-extension-points-from-an-app-v-46-sp2-package-to-a-converted-app-v-51-package-for-all-users-on-a-specific-computer.md).
+1.  Ensure that App-V 4.6 package is published to the users but the FTAs and shortcuts have been assumed by App-V 5.1 package using the following migration method, [How to Migrate Extension Points From an App-V 4.6 Package to a Converted App-V 5.1 Package for All Users on a Specific Computer](how-to-migrate-extension-points-from-an-app-v-46-sp2-package-to-a-converted-app-v-51-package-for-all-users-on-a-specific-computer.md).
 
     In the **userConfiguration** section of the deployment configuration file for the converted package, to set the policy, make the following update to the **userConfiguration** section: **ManagingAuthority TakeoverExtensionPointsFrom46="false" PackageName=<Package ID>**
 
@@ -22,9 +22,9 @@ Use the following procedure to revert extension points from an App-V 5.1 package
 
     PS>**Publish-AppVClientPackage $pkg –DynamicUserConfigurationType useDeploymentConfiguration**
 
-3.  Perform a publishing refresh, or wait for the next scheduled publishing refresh for the App-V 4.6 SP2 package.
+3.  Perform a publishing refresh, or wait for the next scheduled publishing refresh for the App-V 4.6 package.
 
-    Open the application using FTAs or shortcuts. The Application should now open using App-V 4.6 SP2.
+    Open the application using FTAs or shortcuts. The Application should now open using App-V 4.6.
 
     **Note**  
     If you do not need the App-V 5.1 package anymore, you can unpublish the App-V 5.1 package and the extension points will automatically revert to App-V 4.6.

mdop/appv-v5/how-to-use-an-app-v-46-sp1-application-from-an-app-v-51-application.md

@@ -1,24 +1,27 @@
 ---
-title: How to Use an App-V 4.6 SP1 Application From an App-V 5.1 Application
+title: How to Use an App-V 4.6 Application From an App-V 5.1 Application
-description: How to Use an App-V 4.6 SP1 Application From an App-V 5.1 Application
+description: How to Use an App-V 4.6 Application From an App-V 5.1 Application
 ms.assetid: 909b4391-762b-4988-b0cf-32b67f1fcf0e
 author: jamiejdt
 ---
 
-# How to Use an App-V 4.6 SP1 Application From an App-V 5.1 Application
+# How to Use an App-V 4.6 Application From an App-V 5.1 Application
 
 
-Use the following procedure to run an App-V 4.6 SP2 application with App-V 5.1 applications on a standalone client.
+Use the following procedure to run an App-V 4.6 application with App-V 5.1 applications on a standalone client.
+
+**Note**  
+This procedure assumes that you are running the latest version of App-V 4.6.
 
 **To run applications on a standalone client**
 
 1.  Select two applications in your environment that can be opened from one another. For example, Microsoft Outlook and Adobe Acrobat Reader. You can access an email attachment created using Adobe Acrobat.
 
-2.  Convert the packages, or create a new package for either of the applications using the App-V 5.1 format. For more information about converting packages see, [How to Migrate Extension Points From an App-V 4.6 SP2 Package to a Converted App-V 5.1 Package for All Users on a Specific Computer](how-to-migrate-extension-points-from-an-app-v-46-sp2-package-to-a-converted-app-v-51-package-for-all-users-on-a-specific-computer.md) or [How to Migrate Extension Points From an App-V 4.6 SP2 Package to App-V 5.1 for a Specific User](how-to-migrate-extension-points-from-an-app-v-46-sp2-package-to-app-v-51-for-a-specific-user.md).
+2.  Convert the packages, or create a new package for either of the applications using the App-V 5.1 format. For more information about converting packages see, [How to Migrate Extension Points From an App-V 4.6 Package to a Converted App-V 5.1 Package for All Users on a Specific Computer](how-to-migrate-extension-points-from-an-app-v-46-sp2-package-to-a-converted-app-v-51-package-for-all-users-on-a-specific-computer.md) or [How to Migrate Extension Points From an App-V 4.6 Package to App-V 5.1 for a Specific User](how-to-migrate-extension-points-from-an-app-v-46-sp2-package-to-app-v-51-for-a-specific-user.md).
 
 3.  Add and provision the package using the App-V 5.1 management console. For more information adding and provisioning packages see, [How to Add or Upgrade Packages by Using the Management Console](how-to-add-or-upgrade-packages-by-using-the-management-console-51-gb18030.md) and [How to Configure Access to Packages by Using the Management Console](how-to-configure-access-to-packages-by-using-the-management-console-51.md).
 
-4.  The converted application now runs using App-V 5.1 and you can open one application from the other. For example, if you converted a Microsoft Office package to an App-V 5.1 package and Adobe Acrobat is still running as an App-V 4.6 SP2 package, you can open an Adobe Acrobat Reader attachment using Microsoft Outlook.
+4.  The converted application now runs using App-V 5.1 and you can open one application from the other. For example, if you converted a Microsoft Office package to an App-V 5.1 package and Adobe Acrobat is still running as an App-V 4.6 package, you can open an Adobe Acrobat Reader attachment using Microsoft Outlook.
 
     **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
 

mdop/appv-v5/migrating-to-app-v-51-from-a-previous-version.md

@@ -8,10 +8,11 @@ author: jamiejdt
 # Migrating to App-V 5.1 from a Previous Version
 
 
-With Microsoft Application Virtualization (App-V) 5.1 you can migrate your existing App-V 4.6 infrastructure to the more flexible, integrated, and easier to manage App-V 5.1 infrastructure.
+With Microsoft Application Virtualization (App-V) 5.1, you can migrate your existing App-V 4.6 or App-V 5.0 infrastructure to the more flexible, integrated, and easier to manage App-V 5.1 infrastructure.
+However, you cannot migrate directly from App-V 4.x to App-V 5.1, you must migrate to App-V 5.0 first. For more information on migrating from App-V 4.x to App-V 5.0, see [Migrating from a Previous Version](migrating-from-a-previous-version-app-v-50.md)  
 
 **Note**  
-App-V 5.1 packages are exactly the same as App-V 5.0 packages. There has been no change in the package format between the versions and so there is no need to convert App-V 5.0 packages to App-V 5.1 packages.
+App-V 5.1 packages are exactly the same as App-V 5.0 packages. There has been no change in the package format between the versions and therefore, there is no need to convert App-V 5.0 packages to App-V 5.1 packages.
 
 For more information about the differences between App-V 4.6 and App-V 5.1, see the **Differences between App-4.6 and App-V 5.0 section** of [About App-V 5.0](about-app-v-50.md).
 
@@ -201,7 +202,7 @@ After you convert an existing package you should test the package prior to deplo
 
  
 
-When converting a package check for failing files or shortcuts. Locate the item in App-V 4.6 package. It could possibly be hard-coded path. Convert the path.
+When converting a package check for failing files or shortcuts. Locate the item in App-V 4.6 package. It could possibly be a hard-coded path. Convert the path.
 
 **Note**  
 It is recommended that you use the App-V 5.1 sequencer for converting critical applications or applications that need to take advantage of features. See, [How to Sequence a New Application with App-V 5.1](how-to-sequence-a-new-application-with-app-v-51-beta-gb18030.md).
@@ -230,7 +231,7 @@ The following table displays the recommended method for upgrading clients.
 </thead>
 <tbody>
 <tr class="odd">
-<td align="left"><p>Upgrade your environment to App-V 4.6 SP2</p></td>
+<td align="left"><p>Upgrade your environment to the latest version of App-V 4.6</p></td>
 <td align="left"><p>[Application Virtualization Deployment and Upgrade Considerations](../appv-v4/application-virtualization-deployment-and-upgrade-considerations-copy.md).</p></td>
 </tr>
 <tr class="even">
@@ -247,7 +248,7 @@ The following table displays the recommended method for upgrading clients.
  
 
 **Important**  
-You must be running App-V 4.6 SP2 to use coexistence mode. Additionally, when you sequence a package, you must configure the Managing Authority setting, which is in the **User Configuration** is located in the **User Configuration** section.
+You must be running the latest version of App-V 4.6 to use coexistence mode. Additionally, when you sequence a package, you must configure the Managing Authority setting, which is in the **User Configuration** is located in the **User Configuration** section.
 
  
 
@@ -269,7 +270,7 @@ There is no direct method to upgrade to a full App-V 5.1 infrastructure. Use the
 </thead>
 <tbody>
 <tr class="odd">
-<td align="left"><p>Upgrade your environment to App-V 4.6 SP2.</p></td>
+<td align="left"><p>Upgrade your environment to the latest version of App-V 4.6.</p></td>
 <td align="left"><p>[Application Virtualization Deployment and Upgrade Considerations](../appv-v4/application-virtualization-deployment-and-upgrade-considerations-copy.md).</p></td>
 </tr>
 <tr class="even">
@@ -294,15 +295,15 @@ There is no direct method to upgrade to a full App-V 5.1 infrastructure. Use the
 
 You can also perform additional migration tasks such as reconfiguring end points as well as opening a package created using a prior version on a computer running the App-V 5.1 client. The following links provide more information about performing these tasks.
 
-[How to Migrate Extension Points From an App-V 4.6 SP2 Package to a Converted App-V 5.1 Package for All Users on a Specific Computer](how-to-migrate-extension-points-from-an-app-v-46-sp2-package-to-a-converted-app-v-51-package-for-all-users-on-a-specific-computer.md)
+[How to Migrate Extension Points From an App-V 4.6 Package to a Converted App-V 5.1 Package for All Users on a Specific Computer](how-to-migrate-extension-points-from-an-app-v-46-sp2-package-to-a-converted-app-v-51-package-for-all-users-on-a-specific-computer.md)
 
-[How to Migrate Extension Points From an App-V 4.6 SP2 Package to App-V 5.1 for a Specific User](how-to-migrate-extension-points-from-an-app-v-46-sp2-package-to-app-v-51-for-a-specific-user.md)
+[How to Migrate Extension Points From an App-V 4.6 Package to App-V 5.1 for a Specific User](how-to-migrate-extension-points-from-an-app-v-46-sp2-package-to-app-v-51-for-a-specific-user.md)
 
-[How to Revert Extension Points from an App-V 5.1 Package to an App-V 4.6 SP2 Package For All Users on a Specific Computer](how-to-revert-extension-points-from-an-app-v-51-package-to-an-app-v-46-sp2-package-for-all-users-on-a-specific-computer.md)
+[How to Revert Extension Points from an App-V 5.1 Package to an App-V 4.6 Package For All Users on a Specific Computer](how-to-revert-extension-points-from-an-app-v-51-package-to-an-app-v-46-sp2-package-for-all-users-on-a-specific-computer.md)
 
-[How to Revert Extension Points From an App-V 5.1 Package to an App-V 4.6 SP2 Package for a Specific User](how-to-revert-extension-points-from-an-app-v-51-package-to-an-app-v-46-sp2-package-for-a-specific-user.md)
+[How to Revert Extension Points From an App-V 5.1 Package to an App-V 4.6 Package for a Specific User](how-to-revert-extension-points-from-an-app-v-51-package-to-an-app-v-46-sp2-package-for-a-specific-user.md)
 
-[How to Use an App-V 4.6 SP1 Application From an App-V 5.1 Application](how-to-use-an-app-v-46-sp1-application-from-an-app-v-51-application.md)
+[How to Use an App-V 4.6 Application From an App-V 5.1 Application](how-to-use-an-app-v-46-sp1-application-from-an-app-v-51-application.md)
 
 ## Got a suggestion for App-V?
 

windows/deploy/activate-forest-by-proxy-vamt.md

@@ -2,65 +2,41 @@
 title: Activate by Proxy an Active Directory Forest (Windows 10)
 description: Activate by Proxy an Active Directory Forest
 ms.assetid: 6475fc87-a6f7-4fa8-b0aa-de19f2dea7e5
+ms.pagetype: activation
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
 author: jdeckerMS
 ---
-
 # Activate by Proxy an Active Directory Forest
 You can use the Volume Activation Management Tool (VAMT) Active Directory-Based Activation (ADBA) function to activate by proxy an Active Directory (AD) forest for an isolated workgroup that does not have Internet access. ADBA enables certain volume products to inherit activation from the domain.
-
 **Important**  
 ADBA is only applicable to Generic Volume License Keys (GVLKs) and KMS Host key (CSVLK). To use ADBA, one or more KMS Host keys (CSVLK) must be installed on the AD forest, and client keys (GVLKs) must be installed on the client products.
-
 In a typical proxy-activation scenario, the VAMT host computer distributes a product key to one or more client computers and collects the installation ID (IID) from each computer. The VAMT host computer sends the IIDs to Microsoft on behalf of the client computers and obtains the corresponding Confirmation IDs (CIDs). The VAMT host computer then installs the CIDs on the client computer to complete the activation. If you use this activation method, only the VAMT host computer needs to have Internet access.
-
 **Note**  
 For workgroups that are isolated from any larger network, you can still perform an AD forest activation. This requires installing a second instance of VAMT on a computer in the isolated group and using removable media to transfer activation data between that computer and another VAMT host computer that has Internet access. You can also activate by proxy a KMS Host key (CSVLK) in the core network if you do not want the host computer to connect to Microsoft over the Internet.
-
 ## Requirements
 Before performing proxy activation, ensure that the network and the VAMT installation meet the following requirements:
 - There is an instance of VAMT that is installed on a computer that has Internet access. If you are performing proxy activation for an isolated workgroup, you must also have VAMT installed on one of the computers in the workgroup.
-
 - VAMT has administrative permissions to the Active Directory domain.
-
 **To perform an Active Directory forest proxy activation**
-
 1.  Open VAMT.
-
 2.  In the left-side pane, click the **Active Directory-Based Activation** node.
-
 3.  In the right-side **Actions** pane, click **Proxy activate forest** to open the **Install Product Key** dialog box.
-
 4.  In the **Install Product Key** dialog box, select the KMS Host key (CSVLK) that you want to activate.
-
 5.  If you want to rename the ADBA object, enter a new Active Directory-Based Activation Object name.
-
     **Important**  
     If you want to rename the ADBA object, you must do it now. After you click **Install Key**, the name cannot be changed.
-
 6.  Enter the name of the file where you want to save the offline installation ID, or browse to the file location and then click **Open**. If you are activating an AD forest in an isolated workgroup, save the .cilx file to a removable media device.
-
 7.  Click **Install Key**.
-
     VAMT displays the **Activating Active Directory** dialog box until it completes the requested action. The activated object and the date that it was created appear in the **Active Directory-Based Activation** node in the center pane.
-
 9.  Insert the removable media into the VAMT host that has Internet access. Make sure that you are on the root node, and that the **Volume Activation Management Tool** view is displayed in the center pane.
-
 10. In the right-side **Actions** pane, click **Acquire confirmation IDs for CILX** to open the **Acquire confirmation IDs for file** dialog box.
-
 11. In the **Acquire confirmation IDs for file** dialog box, browse to where the .cilx file you exported from the isolated workgroup host computer is located. Select the file, and then click **Open**. VAMT displays an **Acquiring Confirmation IDs** message while it contacts Microsoft and acquires the CIDs.
-
 12. When the CID collection process is complete, VAMT displays a **Volume Activation Management Tool** message that shows how many confirmation IDs were successfully acquired, and the name of the file to which the IDs were saved. Click **OK** to close the message.
-
 13. Remove the storage device that contains the .cilx file from the Internet-connected VAMT host computer and insert it into the VAMT host computer in the isolated workgroup.
-
 14. Open VAMT and then click the **Active Directory-Based Activation** node in the left-side pane.
-
 15. In the right-side **Actions** pane, click **Apply confirmation ID to Active Directory domain**, browse to the .cilx file and then click **Open**.
-
 VAMT displays the **Activating Active Directory** dialog box until it completes the requested action. The activated object and the date that it was created appear in the **Active Directory-Based Activation** node in the center pane.
-
 ## Related topics
 - [Add and Remove Computers](add-remove-computers-vamt.md)

windows/deploy/activate-forest-vamt.md

@@ -2,49 +2,32 @@
 title: Activate an Active Directory Forest Online (Windows 10)
 description: Activate an Active Directory Forest Online
 ms.assetid: 9b5bc193-799b-4aa5-9d3e-0e495f7195d3
+ms.pagetype: activation
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
 author: jdeckerMS
 ---
-
 # Activate an Active Directory Forest Online
 You can use the Volume Activation Management Tool (VAMT) Active Directory-Based Activation (ADBA) function to activate an Active Directory (AD) forest over the Internet. ADBA enables certain products to inherit activation from the domain.
-
 **Important**  
 ADBA is only applicable to Generic Volume License Keys (GVLKs) and KMS Host keys (CSVLKs). To use ADBA, one or more KMS Host keys (CSVLKs) must be installed on the AD forest, and client keys (GVLKs) must be installed on the client products.
-
 ## Requirements
 Before performing online activation, ensure that the network and the VAMT installation meet the following requirements:
-
 -   VAMT is installed on a host computer that has Internet access.
-
 -   VAMT has administrative permissions to the Active Directory domain.
-
 -   The KMS Host key (CSVLK) you intend to use is added to VAMT in the **Product Keys** node.
-
-
 **To perform an online Active Directory forest activation**
-
 1.  Open VAMT.
-
 2.  In the left-side pane, click the **Active Directory-Based Activation** node.
-
 3.  In the right-side **Actions** pane, click **Online activate forest** to open the **Install Product Key** dialog box.
-
 4.  In the **Install Product Key** dialog box, select the KMS Host key (CSVLK) that you want to apply to the AD forest.
-
 5.  If required, enter a new Active Directory-Based Activation Object name
-
     **Important**  
     If you want to rename the ADBA object, you must do it now. After you click **Install Key**, the name cannot be changed.
-
 6.  Click **Install Key**.
-
 7.  VAMT displays the **Activating Active Directory** dialog box until it completes the requested action.
-
 The activated object and the date that is was created appear in the **Active Directory-Based Activation** node in the center pane.
-
 ## Related topics
 - [Scenario 1: Online Activation](scenario-online-activation-vamt.md)
 - [Add and Remove Computers](add-remove-computers-vamt.md)

windows/deploy/activate-using-active-directory-based-activation-client.md

@@ -2,16 +2,15 @@
 title: Activate using Active Directory-based activation (Windows 10)
 description: Active Directory-based activation is implemented as a role service that relies on AD DS to store activation objects.
 ms.assetid: 08cce6b7-7b5b-42cf-b100-66c363a846af
+ms.pagetype: activation
 keywords: ["vamt", "volume activation", "activation", "windows activation"]
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
 author: CFaw
 ---
-
 # Activate using Active Directory-based activation
 **Applies to**
-
 -   Windows 10
 -   Windows 8.1
 -   Windows 8
@@ -19,98 +18,53 @@ author: CFaw
 -   Windows Server 2012 R2
 -   Windows Server 2012
 -   Windows Server 2008 R2
-
 **Looking for retail activation?**
-
 -   [Get Help Activating Microsoft Windows](http://go.microsoft.com/fwlink/p/?LinkId=618644)
-
 Active Directory-based activation is implemented as a role service that relies on AD DS to store activation objects. Active Directory-based activation requires that the forest schema be updated by adprep.exe on a computer running Windows Server 2012 R2 or Windows Server 2012, but after the schema is updated, older domain controllers can still activate clients.
-
 Any domain-joined computers running Windows 10, Windows 8.1, Windows 8, Windows Server 2012 R2, or Windows Server 2012 with a GVLK will be activated automatically and transparently. They will stay activated as long as they remain members of the domain and maintain periodic contact with a domain controller. Activation takes place after the Licensing service starts. When this service starts, the computer contacts AD DS automatically, receives the activation object, and is activated without user intervention.
-
 To allow computers with GVLKs to activate themselves, use the Volume Activation Tools console in Windows Server 2012 R2 or the VAMT in earlier versions of Windows Server to create an object in the AD DS forest. You create this activation object by submitting a KMS host key to Microsoft, as shown in Figure 10.
-
 The process proceeds as follows:
-
 1.  Perform one of the following tasks:
-
     -   Install the Volume Activation Services server role on a domain controller running Windows Server 2012 R2, and add a KMS host key by using the Volume Activation Tools Wizard.
-
     -   Extend the domain to the Windows Server 2012 R2 schema level, and add a KMS host key by using the VAMT.
-
 2.  Microsoft verifies the KMS host key, and an activation object is created.
-
 3.  Client computers are activated by receiving the activation object from a domain controller during startup.
-
     ![Active Directory-based activation flow](images/volumeactivationforwindows81-10.jpg)
-
     **Figure 10**. The Active Directory-based activation flow
-
 For environments in which all computers are running Windows 10, Windows 8.1, Windows 8, Windows Server 2012 R2, or Windows Server 2012 R2, and they are joined to a domain, Active Directory-based activation is the best option for activating all client computers and servers, and you may be able to remove any KMS hosts from your environment.
-
 If an environment will continue to contain earlier volume licensing operating systems and applications or if you have workgroup computers outside the domain, you need to maintain a KMS host to maintain activation status for earlier volume licensing editions of Windows and Office.
-
 Clients that are activated with Active Directory-based activation will maintain their activated state for up to 180 days since the last contact with the domain, but they will periodically attempt to reactivate before then and at the end of the 180day period. By default, this reactivation event occurs every seven days.
-
 When a reactivation event occurs, the client queries AD DS for the activation object. Client computers examine the activation object and compare it to the local edition as defined by the GVLK. If the object and GVLK match, reactivation occurs. If the AD DS object cannot be retrieved, client computers use KMS activation. If the computer is removed from the domain, when the computer or the Software Protection service is restarted, the operating system will change the status from activated to not activated, and the computer will try to activate with KMS.
-
 ## Step-by-step configuration: Active Directory-based activation
 **Note**  
 You must be a member of the local Administrators group on all computers mentioned in these steps. You also need to be a member of the Enterprise Administrators group, because setting up Active Directory-based activation changes forest-wide settings.
-
 **To configure Active Directory-based activation on Windows Server 2012 R2, complete the following steps:**
-
 1.  Use an account with Domain Administrator and Enterprise Administrator credentials to sign in to a domain controller.
-
 2.  Launch Server Manager.
-
 3.  Add the Volume Activation Services role, as shown in Figure 11.
-
     ![Adding the Volume Activation Services role](images/volumeactivationforwindows81-11.jpg)
-
     **Figure 11**. Adding the Volume Activation Services role
-
 4.  Click the link to launch the Volume Activation Tools (Figure 12).
-
     ![Launching the Volume Activation Tools](images/volumeactivationforwindows81-12.jpg)
-
     **Figure 12**. Launching the Volume Activation Tools
-
 5.  Select the **Active Directory-Based Activation** option (Figure 13).
-
     ![Selecting Active Directory-Based Activation](images/volumeactivationforwindows81-13.jpg)
-
     **Figure 13**. Selecting Active Directory-Based Activation
-
 6.  Enter your KMS host key and (optionally) a display name (Figure 14).
-
     ![Entering your KMS host key](images/volumeactivationforwindows81-14.jpg)
-
     **Figure 14**. Entering your KMS host key
-
 7.  Activate your KMS host key by phone or online (Figure 15).
-
     ![Choosing how to activate your product](images/volumeactivationforwindows81-15.jpg)
-
     **Figure 15**. Choosing how to activate your product
-
 8.  After activating the key, click **Commit**, and then click **Close**.
-
 ## Verifying the configuration of Active Directory-based activation
 To verify your Active Directory-based activation configuration, complete the following steps:
-
 1.  After you configure Active Directory-based activation, start a computer that is running an edition of Windows that is configured by volume licensing.
-
 2.  If the computer has been previously configured with a MAK key, replace the MAK key with the GVLK by running the **slmgr.vbs /ipk** command and specifying the GLVK as the new product key.
-
 3.  If the computer is not joined to your domain, join it to the domain.
-
 4.  Sign in to the computer.
-
 5.  Open Windows Explorer, right-click **Computer**, and then click **Properties**.
-
 6.  Scroll down to the **Windows activation** section, and verify that this client has been activated.
-
     **Note**<br>
     If you are using both KMS and Active Directory-based activation, it may be difficult to see whether a client has been activated by KMS or by Active Directory-based activation. Consider disabling KMS during the test, or make sure that you are using a client computer that has not already been activated by KMS. The **slmrg.vbs /dlv** command also indicates whether KMS has been used.
     

windows/deploy/activate-using-key-management-service-vamt.md

@@ -1,6 +1,7 @@
 ---
 title: Activate using Key Management Service (Windows 10)
 ms.assetid: f2417bfe-7d25-4e82-bc07-de316caa8dac
+ms.pagetype: activation
 description: 
 keywords: ["vamt", "volume activation", "activation", "windows activation"]
 ms.prod: W10
@@ -8,10 +9,8 @@ ms.mktglfcycl: deploy
 ms.sitesec: library
 author: jdeckerMS
 ---
-
 # Activate using Key Management Service
 **Applies to**
-
 -   Windows 10
 -   Windows 8.1
 -   Windows 8
@@ -19,137 +18,74 @@ author: jdeckerMS
 -   Windows Server 2012 R2
 -   Windows Server 2012
 -   Windows Server 2008 R2
-
 **Looking for retail activation?**
-
 -   [Get Help Activating Microsoft Windows](http://go.microsoft.com/fwlink/p/?LinkId=618644)
-
 There are three possible scenarios for volume activation of Windows 10 or Windows Server 2012 R2 by using a Key Management Service (KMS) host:
-
 -   Host KMS on a computer running Windows 10
-
 -   Host KMS on a computer running Windows Server 2012 R2
-
 -   Host KMS on a computer running an earlier version of Windows
-
 ## Key Management Service in Windows 10
 Installing a KMS host key on a computer running Windows 10 allows you to activate other computers running Windows 10 against this KMS host and earlier versions of the client operating system, such as Windows 8.1 or Windows 7.
-
 Clients locate the KMS server by using resource records in DNS, so some configuration of DNS may be required. This scenario can be beneficial if your organization uses volume activation for clients and MAK-based activation for a smaller number of servers.
-
 To enable KMS functionality, a KMS key is installed on a KMS host; then, the host is activated over the Internet or by phone using Microsoft’s activation services.
-
 **Configure KMS in Windows 10**
-
 1.  Open an elevated command prompt.
-
 2.  Enter one of the following commands.
     -   To install a KMS key, type **slmgr.vbs /ipk <KmsKey>**.
     -   To activate online, type **slmgr.vbs /ato**.
     -   To activate by using the telephone, type **slui.exe 4**.
-
 3.  After activating the KMS key, restart the Software Protection Service.
-
 For more information, see the information for Windows 7 in [Deploy KMS Activation](http://go.microsoft.com/fwlink/p/?LinkId=717032).
-
 ## Key Management Service in Windows Server 2012 R2
 Installing a KMS host key on a computer running Windows Server allows you to activate computers running Windows Server 2012 R2, Windows Sever 2008 R2, Windows Server 2008, Windows 10, Windows 8.1, Windows 7, and Windows Vista.
-
 **Note**  
 You cannot install a client KMS key into the KMS in Windows Server.
-
 This scenario is commonly used in larger organizations that do not find the overhead of using a server a burden.
-
 **Note**  
 If you receive error 0xC004F015 when trying to activate Windows 10 Enterprise, see [KB 3086418](http://go.microsoft.com/fwlink/p/?LinkId=620687).
-
 **Configure KMS in Windows Server 2012 R2**
-
 1.  Sign in to a computer running Windows Server 2012 R2 with an account that has local administrative credentials.
-
 2.  Launch Server Manager.
-
 3.  Add the Volume Activation Services role, as shown in Figure 4.
-
     ![Adding the Volume Activation Services role in Server Manager](images/volumeactivationforwindows81-04.jpg)
-
     **Figure 4**. Adding the Volume Activation Services role in Server Manager
-
 4.  When the role installation is complete, click the link to launch the Volume Activation Tools (Figure 5).
-
     ![Launching the Volume Activation Tools](images/volumeactivationforwindows81-05.jpg)
-
     **Figure 5**. Launching the Volume Activation Tools
-
 5.  Select the **Key Management Service (KMS)** option, and specify the computer that will act as the KMS host (Figure 6).
-
     This can be the same computer on which you installed the role or another computer. For example, it can be a client computer running Windows 10.
-
     ![Configuring the computer as a KMS host](images/volumeactivationforwindows81-06.jpg)
-
     **Figure 6**. Configuring the computer as a KMS host
-
 6.  Install your KMS host key by typing it in the text box, and then click **Commit** (Figure 7).
-
     ![Installing your KMS host key](images/volumeactivationforwindows81-07.jpg)
-
     **Figure 7**. Installing your KMS host key
-
 7.  If asked to confirm replacement of an existing key, click **Yes**.
-
 8.  After the product key is installed, you must activate it. Click **Next** (Figure 8).
-
     ![Activating the software](images/volumeactivationforwindows81-08.jpg)
-
     **Figure 8**. Activating the software
-
 The KMS key can be activated online or by phone. See Figure 9.
-
 ![Choosing to activate online](images/volumeactivationforwindows81-09.jpg)
-
 **Figure 9**. Choosing to activate online
-
 Now that the KMS host is configured, it will begin to listen for activation requests. However, it will not activate clients successfully until the activation threshold is met.
-
 ## Verifying the configuration of Key Management Service
 You can verify KMS volume activation from the KMS host server or from the client computer. KMS volume activation requires a minimum threshold of 25 computers before activation requests will be processed. The verification process described here will increment the activation count each time a client computer contacts the KMS host, but unless the activation threshold is reached, the verification will take the form of an error message rather than a confirmation message.
-
 **Note**  
 If you configured Active Directory-based activation before configuring KMS activation, you must use a client computer that will not first try to activate itself by using Active Directory-based activation. You could use a workgroup computer that is not joined to a domain or a computer running Windows 7 or Windows Server 2008 R2.
-
 To verify that KMS volume activation works, complete the following steps:
-
 1.  On the KMS host, open the event log and confirm that DNS publishing is successful.
-
 2.  On a client computer, open a Command Prompt window, type **Slmgr.vbs /ato**, and then press ENTER.<p>
 The **/ato** command causes the operating system to attempt activation by using whichever key has been installed in the operating system. The response should show the license state and detailed Windows version information.
-
 3.  On a client computer or the KMS host, open an elevated Command Prompt window, type **Slmgr /dlv**, and then press ENTER.<p>
 The **/dlv** command displays the detailed licensing information. The response should return an error that states that the KMS activation count is too low. This confirms that KMS is functioning correctly, even though the client has not been activated.
-
 For more information about the use and syntax of slmgr.vbs, see [Slmgr.vbs Options](http://go.microsoft.com/fwlink/p/?LinkId=733639).
-
 ## Key Management Service in earlier versions of Windows
 If you have already established a KMS infrastructure in your organization for an earlier version of Windows, you may want to continue using that infrastructure to activate computers running Windows 10 or Windows Server 2012 R2. Your existing KMS host must be running Windows 7 or later. To upgrade your KMS host, complete the following steps:
-
 1.  Download and install the correct update for your current KMS host operating system. Restart the computer as directed.
-
 2.  Request a new KMS host key from the Volume Licensing Service Center.
-
 3.  Install the new KMS host key on your KMS host.
-
 4.  Activate the new KMS host key by running the slmrg.vbs script.
-
 For detailed instructions, see [Update that enables Windows 8.1 and Windows 8 KMS hosts to activate a later version of Windows](http://go.microsoft.com/fwlink/p/?LinkId=618265) and [Update that enables Windows 7 and Windows Server 2008 R2 KMS hosts to activate Windows 10](http://go.microsoft.com/fwlink/p/?LinkId=626590).
-
 ## See also
 -   [Volume Activation for Windows 10](volume-activation-windows-10.md)
-
  
-
  
-
-
-
-
-

windows/deploy/activate-windows-10-clients-vamt.md

@@ -2,16 +2,15 @@
 title: Activate clients running Windows 10 (Windows 10)
 description: After you have configured Key Management Service (KMS) or Active Directory-based activation on your network, activating a client running Windows 10 is easy.
 ms.assetid: 39446e49-ad7c-48dc-9f18-f85a11ded643
+ms.pagetype: activation
 keywords: ["vamt", "volume activation", "activation", "windows activation"]
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
 author: jdeckerMS
 ---
-
 # Activate clients running Windows 10
 **Applies to**
-
 -   Windows 10
 -   Windows 8.1
 -   Windows 8
@@ -19,110 +18,61 @@ author: jdeckerMS
 -   Windows Server 2012 R2
 -   Windows Server 2012
 -   Windows Server 2008 R2
-
 **Looking for retail activation?**
-
 -   [Get Help Activating Microsoft Windows](http://go.microsoft.com/fwlink/p/?LinkId=618644)
-
 After you have configured Key Management Service (KMS) or Active Directory-based activation on your network, activating a client running Windows 10 is easy. If the computer has been configured with a Generic Volume License Key (GVLK), neither IT nor the user need take any action. It just works.
-
 Enterprise edition images and installation media should already be configured with the GVLK. When the client computer starts, the Licensing service examines the current licensing condition of the computer.
-
 If activation or reactivation is required, the following sequence occurs:
-
 1.  If the computer is a member of a domain, it asks a domain controller for a volume activation object. If Active Directory-based activation is configured, the domain controller returns the object. If the object matches the edition of the software that is installed and the computer has a matching GVLK, the computer is activated (or reactivated), and it will not need to be activated again for 180 days, although the operating system will attempt reactivation at much shorter, regular intervals.
-
 2.  If the computer is not a member of a domain or if the volume activation object is not available, the computer will issue a DNS query to attempt to locate a KMS server. If a KMS server can be contacted, activation occurs if the KMS has a key that matches the computer’s GVLK.
-
 3.  The computer tries to activate against Microsoft servers if it is configured with a MAK.
-
 If the client is not able to activate itself successfully, it will periodically try again. The frequency of the retry attempts depends on the current licensing state and whether the client computer has been successfully activated in the past. For example, if the client computer had been previously activated by Active Directory-based activation, it will periodically try to contact the domain controller at each restart.
-
 ## How Key Management Service works
 KMS uses a client–server topology. KMS client computers can locate KMS host computers by using DNS or a static configuration. KMS clients contact the KMS host by using RPCs carried over TCP/IP.
-
 ### Key Management Service activation thresholds
 You can activate physical computers and virtual machines by contacting a KMS host. To qualify for KMS activation, there must be a minimum number of qualifying computers (called the activation threshold). KMS clients will be activated only after this threshold has been met. Each KMS host counts the number of computers that have requested activation until the threshold is met.
-
 A KMS host responds to each valid activation request from a KMS client with the count of how many computers have already contacted the KMS host for activation. Client computers that receive a count below the activation threshold are not activated. For example, if the first two computers that contact the KMS host are running Windows 10, the first receives an activation count of 1, and the second receives an activation count of 2. If the next computer is a virtual machine on a computer running Windows 10, it receives an activation count of 3, and so on. None of these computers will be activated, because computers running Windows 10, like other client operating system versions, must receive an activation count of 25 or more.
-
 When KMS clients are waiting for the KMS to reach the activation threshold, they will connect to the KMS host every two hours to get the current activation count. They will be activated when the threshold is met.
-
 In our example, if the next computer that contacts the KMS host is running Windows Server 2012 R2, it receives an activation count of 4, because activation counts are cumulative. If a computer running Windows Server 2012 R2 receives an activation count that is 5 or more, it is activated. If a computer running Windows 10 receives an activation count of 25 or more, it is activated.
-
 ### Activation count cache
 To track the activation threshold, the KMS host keeps a record of the KMS clients that request activation. The KMS host gives each KMS client a client ID designation, and the KMS host saves each client ID in a table. By default, each activation request remains in the table for up to 30 days. When a client renews its activation, the cached client ID is removed from the table, a new record is created, and the 30day period begins again. If a KMS client computer does not renew its activation within 30 days, the KMS host removes the corresponding client ID from the table and reduces the activation count by one.
-
 However, the KMS host only caches twice the number of client IDs that are required to meet the activation threshold. Therefore, only the 50 most recent client IDs are kept in the table, and a client ID could be removed much sooner than 30 days.
-
 The total size of the cache is set by the type of client computer that is attempting to activate. If a KMS host receives activation requests only from servers, the cache will hold only 10 client IDs (twice the required 5). If a client computer running Windows 10 contacts that KMS host, KMS increases the cache size to 50 to accommodate the higher threshold. KMS never reduces the cache size.
-
 ### Key Management Service connectivity
 KMS activation requires TCP/IP connectivity. By default, KMS hosts and clients use DNS to publish and find the KMS. The default settings can be used, which require little or no administrative action, or KMS hosts and client computers can be manually configured based on network configuration and security requirements.
-
 ### Key Management Service activation renewal
 KMS activations are valid for 180 days (the *activation validity interval*). To remain activated, KMS client computers must renew their activation by connecting to the KMS host at least once every 180 days. By default, KMS client computers attempt to renew their activation every 7 days. If KMS activation fails, the client computer retries every two hours. After a client computer’s activation is renewed, the activation validity interval begins again.
-
 ### Publication of the Key Management Service
 The KMS uses service (SRV) resource records in DNS to store and communicate the locations of KMS hosts. KMS hosts use the DNS dynamic update protocol, if available, to publish the KMS service (SRV) resource records. If dynamic update is not available or the KMS host does not have rights to publish the resource records, the DNS records must be published manually, or you must configure client computers to connect to specific KMS hosts.
-
 ### Client discovery of the Key Management Service
 By default, KMS client computers query DNS for KMS information. The first time a KMS client computer queries DNS for KMS information, it randomly chooses a KMS host from the list of service (SRV) resource records that DNS returns. The address of a DNS server that contains the service (SRV) resource records can be listed as a suffixed entry on KMS client computers, which allows one DNS server to advertise the service (SRV) resource records for KMS, and KMS client computers with other primary DNS servers to find it.
-
 Priority and weight parameters can be added to the DnsDomainPublishList registry value for KMS. Establishing KMS host priority groupings and weighting within each group allows you to specify which KMS host the client computers should try first and balances traffic among multiple KMS hosts. Only Windows 10, Windows 8.1, Windows 8, Windows 7, Windows Server 2012 R2, Windows Server 2012, and Windows Server 2008 R2 provide these priority and weight parameters.
-
 If the KMS host that a client computer selects does not respond, the KMS client computer removes that KMS host from its list of service (SRV) resource records and randomly selects another KMS host from the list. When a KMS host responds, the KMS client computer caches the name of the KMS host and uses it for subsequent activation and renewal attempts. If the cached KMS host does not respond on a subsequent renewal, the KMS client computer discovers a new KMS host by querying DNS for KMS service (SRV) resource records.
-
 By default, client computers connect to the KMS host for activation by using anonymous RPCs through TCP port 1688. (You can change the default port.) After establishing a TCP session with the KMS host, the client computer sends a single request packet. The KMS host responds with the activation count. If the count meets or exceeds the activation threshold for that operating system, the client computer is activated and the session is closed. The KMS client computer uses this same process for renewal requests. 250 bytes are used for communication each way.
-
 ### Domain Name System server configuration
 The default KMS automatic publishing feature requires the service (SRV) resource record and support for DNS dynamic update protocol. KMS client computer default behavior and the KMS service (SRV) resource record publishing are supported on a DNS server that is running Microsoft software or any other DNS server that supports service (SRV) resource records (per Internet Engineering Task Force \[IETF\] Request for Comments \[RFC\] 2782) and dynamic updates (per IETF RFC 2136). For example, Berkeley Internet Domain Name versions 8.x and 9.x support service (SRV) resource records and dynamic update.
-
 The KMS host must be configured so that it has the credentials needed to create and update the following resource records on the DNS servers: service (SRV), IPv4 host (A), and IPv6 host (AAAA), or the records need to be created manually. The recommended solution for giving the KMS host the needed credentials is to create a security group in AD DS, then add all KMS hosts to that group. On a DNS server that is running Microsoft software, ensure that this security group is given full control over the \_VLMCS.\_TCP record in each DNS domain that will contain the KMS service (SRV) resource records.
-
 ### Activating the first Key Management Service host
 KMS hosts on the network need to install a KMS key, and then be activated with Microsoft. Installation of a KMS key enables the KMS on the KMS host. After installing the KMS key, complete the activation of the KMS host by telephone or online. Beyond this initial activation, a KMS host does not communicate any information to Microsoft. KMS keys are only installed on KMS hosts, never on individual KMS client computers.
-
 ### Activating subsequent Key Management Service hosts
 Each KMS key can be installed on up to six KMS hosts. These hosts can be physical computers or virtual machines. After activating a KMS host, the same host can be reactivated up to nine times with the same key. If the organization needs more than six KMS hosts, you can request additional activations for your organization’s KMS key by calling a Microsoft Volume [Licensing Activation Center](http://go.microsoft.com/fwlink/p/?LinkID=618264) to request an exception.
-
 ## How Multiple Activation Key works
 A MAK is used for one-time activation with Microsoft’s hosted activation services. Each MAK has a predetermined number of allowed activations. This number is based on volume licensing agreements, and it might not match the organization’s exact license count. Each activation that uses a MAK with the Microsoft hosted activation service counts toward the activation limit.
-
 You can activate computers by using a MAK in two ways:
-
 -   **MAK independent activation**. Each computer independently connects and is activated with Microsoft over the Internet or by telephone. MAK independent activation is best suited to computers within an organization that do not maintain a connection to the corporate network. MAK independent activation is shown in Figure 16.
-
     ![MAK independent activation](images/volumeactivationforwindows81-16.jpg)
-
     **Figure 16**. MAK independent activation
-
 -   **MAK proxy activation**. MAK proxy activation enables a centralized activation request on behalf of multiple computers with one connection to Microsoft. You configure MAK proxy activation by using the VAMT. MAK proxy activation is appropriate for environments in which security concerns restrict direct access to the Internet or the corporate network. It is also suited for development and test labs that lack this connectivity. MAK proxy activation with the VAMT is shown in Figure 17.
-
     ![MAK proxy activation with the VAMT](images/volumeactivationforwindows81-17.jpg)
-
     **Figure 17**. MAK proxy activation with the VAMT
-
 A MAK is recommended for computers that rarely or never connect to the corporate network and for environments in which the number of computers that require activation does not meet the KMS activation threshold.
-
 You can use a MAK for individual computers or with an image that can be duplicated or installed by using Microsoft deployment solutions. You can also use a MAK on a computer that was originally configured to use KMS activation. This is useful for moving a computer off the core network to a disconnected environment.
-
 ### Multiple Activation Key architecture and activation
 MAK independent activation installs a MAK product key on a client computer. The key instructs that computer to activate itself with Microsoft servers over the Internet.
-
 In MAK proxy activation, the VAMT installs a MAK product key on a client computer, obtains the installation ID from the target computer, sends the installation ID to Microsoft on behalf of the client, and obtains a confirmation ID. The tool then activates the client computer by installing the confirmation ID.
-
 ## Activating as a standard user
 Windows 10, Windows 8.1, Windows 8, Windows 7, Windows Server 2012 R2, Windows Server 2012, and Windows Server 2008 R2 do not require administrator privileges for activation, but this change does not allow standard user accounts to remove computers running Windows 7 or Windows Server 2008 R2 from the activated state. An administrator account is still required for other activation- or license-related tasks, such as “rearm.”
-
 ## See also
 -   [Volume Activation for Windows 10](volume-activation-windows-10.md)
-
  
-
  
-
-
-
-
-

windows/deploy/active-directory-based-activation-overview.md

@@ -2,31 +2,20 @@
 title: Active Directory-Based Activation Overview (Windows 10)
 description: Active Directory-Based Activation Overview
 ms.assetid: c1dac3bd-6a86-4c45-83dd-421e63a398c0
+ms.pagetype: activation
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
 author: CFaw
 ---
-
 # Active Directory-Based Activation Overview
 Active Directory-Based Activation (ADBA) enables enterprises to activate computers through a connection to their domain. Many companies have computers at offsite locations that use products that are registered to the company. Previously these computers needed to either use a retail key or a Multiple Activation Key (MAK), or physically connect to the network in order to activate their products by using Key Management Services (KMS). ADBA provides a way to activate these products if the computers can join the company’s domain. When the user joins their computer to the domain, the ADBA object automatically activates Windows installed on their computer, as long as the computer has a Generic Volume License Key (GVLK) installed. No single physical computer is required to act as the activation object, because it is distributed throughout the domain.
-
 ## Active Directory-Based Activation Scenarios
 VAMT enables IT Professionals to manage and activate the Active Directory-Based Activation object. Activation can be performed by using a scenario such as the following:
-
 -   Online activation: To activate an ADBA forest online, the user selects the **Online activate forest** function, selects a KMS Host key (CSVLK) to use, and gives the Active Directory-Based Activation Object a name.
-
 -   Proxy activation: For a proxy activation, the user first selects the **Proxy activate forest** function, selects a KMS Host key (CSVLK) to use, gives the Active Directory-Based Activation Object a name, and provides a file name to save the CILx file that contains the Installation ID. Next, the user takes that file to a computer that is running VAMT with an Internet connection and then selects the **Acquire confirmation IDs for CILX** function on the VAMT landing page, and provides the original CILx file. When VAMT has loaded the Confirmation IDs into the original CILx file, the user takes this file back to the original VAMT instance, where the user completes the proxy activation process by selecting the **Apply confirmation ID to Active Directory domain** function.
-
 ## Related topics
 - [How to Activate an Active Directory Forest Online](http://go.microsoft.com/fwlink/p/?LinkId=246565)
 - [How to Proxy Activate an Active Directory Forest](http://go.microsoft.com/fwlink/p/?LinkId=246566)
-
  
-
  
-
-
-
-
-

windows/deploy/add-manage-products-vamt.md

@@ -2,30 +2,20 @@
 title: Add and Manage Products (Windows 10)
 description: Add and Manage Products
 ms.assetid: a48fbc23-917d-40f7-985c-e49702c05e51
+ms.pagetype: activation
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
 author: jdeckerMS
 ---
-
 # Add and Manage Products
 This section describes how to add client computers into the Volume Activation Management Tool (VAMT). After the computers are added, you can manage the products that are installed on your network.
-
 ## In this Section
-
 |Topic |Description |
 |------|------------|
 |[Add and Remove Computers](add-remove-computers-vamt.md) |Describes how to add client computers to VAMT. |
 |[Update Product Status](update-product-status-vamt.md) |Describes how to update the status of product license. |
 |[Remove Products](remove-products-vamt.md) |Describes how to remove a product from the product list. |
-
  
-
  
-
  
-
-
-
-
-

windows/deploy/add-remove-computers-vamt.md

@@ -2,74 +2,44 @@
 title: Add and Remove Computers (Windows 10)
 description: Add and Remove Computers
 ms.assetid: cb6f3a78-ece0-4dc7-b086-cb003d82cd52
+ms.pagetype: activation
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
 author: jdeckerMS
 ---
-
 # Add and Remove Computers
 You can add computers that have any of the supported Windows or Office products installed to a Volume Activation Management Tool (VAMT) database by using the **Discover products** function. You can search for computers in an Active Directory domain, by individual computer name or IP address, in a workgroup, or by a general LDAP query. You can remove computers from a VAMT database by using the **Delete** function. After you add the computers, you can add the products that are installed on the computers by running the **Update license status** function.
-
 Before adding computers, ensure that the Windows Management Instrumentation (WMI) firewall exception required by VAMT has been enabled on all target computers. For more information see [Configure Client Computers](configure-client-computers-vamt.md).
-
 ## To add computers to a VAMT database
 1.  Open VAMT.
-
 2.  Click **Discover products** in the **Actions** menu in the right-side pane to open the **Discover Products** dialog box.
-
 3.  In the **Discover products** dialog box, click **Search for computers in the Active Directory** to display the search options, then click the search option you want to use. You can search for computers in an Active Directory domain, by individual computer name or IP address, in a workgroup, or by a general LDAP query.
-
     -   To search for computers in an Active Directory domain, click **Search for computers in the Active Directory**, then under **Domain Filter Criteria**, in the list of domain names click the name of the domain you want to search. You can narrow the search further by typing a name in the **Filter by computer name** field to search for a specific computer within the domain. This filter supports the asterisk (\*) wildcard. For example, typing "a\*" will display only computer names that start with the letter "a".
-
     -   To search by individual computer name or IP address, click **Manually enter name or IP address**, then enter the full name or IP address in the **One or more computer names or IP addresses separated by commas** text box. Separate multiple entries with a comma. Note that VAMT supports both IPv4 and IPV6 addressing.
-
     -   To search for computers in a workgroup, click **Search for computers in the workgroup**, then under **Workgroup Filter Criteria**, in the list of workgroup names click the name of the workgroup you want to search. You can narrow the search further by typing a name in the **Filter by computer name** field to search for a specific computer within the workgroup. This filter supports the asterisk (\*) wildcard. For example, typing "a\*" will display only computer names that start with the letter "a".
-
     -   To search for computers by using a general LDAP query, click **Search with LDAP query** and enter your query in the text box provided. VAMT will validate only the LDAP query syntax, but will otherwise run the query without further checks.
-
 4.  Click **Search**.
-
 5.  VAMT searches for the specified computers and adds them to the VAMT database. During the search, VAMT displays the **Finding computers** message shown below.
-
     To cancel the search, click **Cancel**. When the search is complete the names of the newly-discovered computers appear in the product list view in the center pane.
-
     ![VAMT, Finding computers dialog box](images/dep-win8-l-vamt-findingcomputerdialog.gif)
     
     **Important**  
     This step adds only the computers to the VAMT database, and not the products that are installed on the computers. To add the products, you need to run the **Update license status** function.
-
 ## To add products to VAMT
 1.  In the **Products** list, select the computers that need to have their product information added to the VAMT database.
-
 2.  You can use the **Filter** function to narrow your search for computers by clicking **Filter** in the right-side pane to open the **Filter Products** dialog box.
-
 3.  In the **Filter Products** dialog box, you can filter the list by computer name, product name, product key type, license status, or by any combination of these options.
-
     -   To filter the list by computer name, enter a name in the **Computer Name** box.
-
     -   To filter the list by Product Name, Product Key Type, or License Status, click the list you want to use for the filter and select an option. If necessary, click **clear all filters** to create a new filter.
-
 4.  Click **Filter**. VAMT displays the filtered list in the center pane.
-
 5.  In the right-side **Actions** pane, click **Update license status** and then click a credential option. Choose **Alternate Credentials** only if you are updating products that require administrator credentials different from the ones you used to log into the computer. If you are supplying alternate credentials, in the **Windows Security** dialog box type the appropriate user name and password and click **OK**.
-
 6.  VAMT displays the **Collecting product information** dialog box while it collects the licensing status of all supported products on the selected computers. When the process is finished, the updated licensing status of each product will appear in the product list view in the center pane.
-
     **Note**  
     If a computer has more than one supported product installed, VAMT adds an entry for each product. The entry appears under the appropriate product heading.
-
 ## To remove computers from a VAMT database
 You can delete a computer by clicking on it in the product list view, and then clicking **Delete** in the **Selected Item** menu in the right-hand pane. In the **Confirm Delete Selected Products** dialog box that appears, click **Yes** to delete the computer. If a computer has multiple products listed, you must delete each product to completely remove the computer from the VAMT database.
-
 ## Related topics
 - [Add and Manage Products](add-manage-products-vamt.md)
-
  
-
  
-
-
-
-
-

windows/deploy/add-remove-product-key-vamt.md

@@ -2,33 +2,24 @@
 title: Add and Remove a Product Key (Windows 10)
 description: Add and Remove a Product Key
 ms.assetid: feac32bb-fb96-4802-81b8-c69220dcfcce
+ms.pagetype: activation
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
 author: jdeckerMS
 ---
-
 # Add and Remove a Product Key
 Before you can use a Multiple Activation Key (MAK), retail, or KMS Host key (CSVLK) product key, you must first add it to the Volume Activation Management Tool (VAMT) database.
-
 ## To Add a Product Key
 1.  Open VAMT.
-
 2.  In the left-side pane, right-click the **Product Keys** node to open the **Actions** menu.
-
 3.  Click **Add product keys** to open the **Add Product Keys** dialog box.
-
 4.  In the **Add Product Keys** dialog box, select from one of the following methods to add product keys:
-
     -   To add product keys manually, click **Enter product key(s) separated by line breaks**, enter one or more product keys separated by line breaks, and click **Add Key(s)**.
-
     -   To import a Comma Separated Values (CSV) file containing a list of product keys, click **Select a product key file to import**, browse to the file location, click **Open** to import the file, and then click **Add Key(s)**.
-
     **Note**  
     If you are activating a large number of products with a MAK, you should refresh the activation count of the MAK, to ensure that the MAK can support the required number of activations. In the product key list in the center pane, select the MAK and click **Refresh product key data online** in the right-side pane to contact Microsoft and retrieve the number of remaining activations for the MAK. This step requires Internet access. You can only retrieve the remaining activation count for MAKs.
-
 ## Remove a Product Key
 -   To remove a product key from the list, simply select the key in the list and click **Delete** on the **Selected Items** menu in the right-side pane. Click **Yes** to confirm deletion of the product key. Removing a product key from the VAMT database will not affect the activation state of any products or computers on the network.
-
 ## Related topics
 - [Manage Product Keys](manage-product-keys-vamt.md)

windows/deploy/appendix-information-sent-to-microsoft-during-activation-client.md

@@ -1,6 +1,7 @@
 ---
 title: Appendix Information sent to Microsoft during activation (Windows 10)
 ms.assetid: 4bfff495-07d0-4385-86e3-7a077cbd64b8
+ms.pagetype: activation
 description: 
 keywords: ["vamt", "volume activation", "activation", "windows activation"]
 ms.prod: W10
@@ -8,10 +9,8 @@ ms.mktglfcycl: deploy
 ms.sitesec: library
 author: jdeckerMS
 ---
-
 # Appendix: Information sent to Microsoft during activation
 **Applies to**
-
 -   Windows 10
 -   Windows 8.1
 -   Windows 8
@@ -19,68 +18,34 @@ author: jdeckerMS
 -   Windows Server 2012 R2
 -   Windows Server 2012
 -   Windows Server 2008 R2
-
 **Looking for retail activation?**
-
 -   [Get Help Activating Microsoft Windows](http://go.microsoft.com/fwlink/p/?LinkId=618644)
-
 When you activate a computer running Windows 10, the following information is sent to Microsoft:
-
 -   The Microsoft product code (a five-digit code that identifies the Windows product you are activating)
-
 -   A channel ID or site code that identifies how the Windows product was originally obtained
-
     For example, a channel ID or site code identifies whether the product was originally purchased from a retail store, obtained as an evaluation copy, obtained through a volume licensing program, or preinstalled by a computer manufacturer.
-
 -   The date of installation and whether the installation was successful
-
 -   Information that helps confirm that your Windows product key has not been altered
-
 -   Computer make and model
-
 -   Version information for the operating system and software
-
 -   Region and language settings
-
 -   A unique number called a *globally unique identifier*, which is assigned to your computer
-
 -   Product key (hashed) and product ID
-
 -   BIOS name, revision number, and revision date
-
 -   Volume serial number (hashed) of the hard disk drive
-
 -   The result of the activation check
-
     This includes error codes and the following information about any activation exploits and related malicious or unauthorized software that was found or disabled:
-
     -   The activation exploit’s identifier
-
     -   The activation exploit’s current state, such as cleaned or quarantined
-
     -   Computer manufacturer’s identification
-
     -   The activation exploit’s file name and hash in addition to a hash of related software components that may indicate the presence of an activation exploit
-
 -   The name and a hash of the contents of your computer’s startup instructions file
-
 -   If your Windows license is on a subscription basis, information about how your subscription works
-
 Standard computer information is also sent, but your computer’s IP address is only retained temporarily.
-
 ## Use of information
 Microsoft uses the information to confirm that you have a licensed copy of the software. Microsoft does not use the information to contact individual consumers.
-
 For additional details, see [Windows 10 Privacy Statement](http://go.microsoft.com/fwlink/p/?LinkId=619879).
-
 ## See also
 -   [Volume Activation for Windows 10](volume-activation-windows-10.md)
-
  
-
  
-
-
-
-
-

windows/deploy/assign-applications-using-roles-in-mdt-2013.md

@@ -2,63 +2,37 @@
 title: Assign applications using roles in MDT (Windows 10)
 description: This topic will show you how to add applications to a role in the MDT database and then assign that role to a computer.
 ms.assetid: d82902e4-de9c-4bc4-afe0-41d649b83ce7
+ms.pagetype: mdt
 keywords: ["settings, database, deploy"]
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
 author: mtniehaus
 ---
-
 # Assign applications using roles in MDT
-
-
 This topic will show you how to add applications to a role in the MDT database and then assign that role to a computer. For the purposes of this topic, the application we are adding is Adobe Reader XI. In addition to using computer-specific entries in the database, you can use roles in MDT to group settings together.
-
 ## <a href="" id="sec01"></a>Create and assign a role entry in the database
-
-
 1.  On MDT01, using Deployment Workbench, in the MDT Production deployment share, expand **Advanced Configuration** and then expand **Database**.
-
 2.  In the **Database** node, right-click **Role**, select **New**, and create a role entry with the following settings:
-
     1.  Role name: Standard PC
-
     2.  Applications / Lite Touch Applications:
-
     3.  Install - Adobe Reader XI - x86
-
 ![figure 12](images/mdt-09-fig12.png)
-
 Figure 12. The Standard PC role with the application added
-
 ## <a href="" id="sec02"></a>Associate the role with a computer in the database
-
-
 After creating the role, you can associate it with one or more computer entries.
-
 1.  Using Deployment Workbench, expand **MDT Production**, expand **Advanced Configuration**, expand **Database**, and select **Computers**.
-
 2.  In the **Computers** node, double-click the **PC00075** entry, and add the following setting:
-
     -   Roles: Standard PC
-
 ![figure 13](images/mdt-09-fig13.png)
-
 Figure 13. The Standard PC role added to PC00075 (having ID 1 in the database).
-
 ## <a href="" id="sec03"></a>Verify database access in the MDT simulation environment
-
-
 When the database is populated, you can use the MDT simulation environment to simulate a deployment. The applications are not installed, but you can see which applications would be installed if you did a full deployment of the computer.
-
 1.  On PC0001, log on as **CONTOSO\\MDT\_BA**.
-
 2.  Modify the C:\\MDT\\CustomSettings.ini file to look like the following:
-
     ``` syntax
     [Settings]
     Priority=CSettings, CRoles, RApplications, Default
-
     [Default]
     _SMSTSORGNAME=Contoso
     OSInstall=Y
@@ -90,7 +64,6 @@ When the database is populated, you can use the MDT simulation environment to si
     SkipCapture=YES
     SkipFinalSummary=NO
     EventService=http://MDT01:9800
-
     [CSettings]
     SQLServer=MDT01
     Instance=SQLEXPRESS
@@ -100,7 +73,6 @@ When the database is populated, you can use the MDT simulation environment to si
     Table=ComputerSettings
     Parameters=UUID, AssetTag, SerialNumber, MacAddress
     ParameterCondition=OR
-
     [CRoles]
     SQLServer=MDT01
     Instance=SQLEXPRESS
@@ -110,7 +82,6 @@ When the database is populated, you can use the MDT simulation environment to si
     Table=ComputerRoles
     Parameters=UUID, AssetTag, SerialNumber, MacAddress
     ParameterCondition=OR
-
     [RApplications]
     SQLServer=MDT01
     Instance=SQLEXPRESS
@@ -121,40 +92,20 @@ When the database is populated, you can use the MDT simulation environment to si
     Parameters=Role
     Order=Sequence
     ```
-
 3.  Using an elevated Windows PowerShell prompt (run as Administrator), run the following commands. Press **Enter** after each command:
-
     ``` syntax
     Set-Location C:\MDT
     .\Gather.ps1
     ```
-
 ![figure 14](images/mdt-09-fig14.png)
-
 Figure 14. ZTIGather.log displaying the application GUID belonging to the Adobe Reader XI application that would have been installed if you deployed this machine.
-
 ## Related topics
-
-
 [Set up MDT for BitLocker](set-up-mdt-2013-for-bitlocker.md)
-
 [Configure MDT deployment share rules](configure-mdt-deployment-share-rules.md)
-
 [Configure MDT for UserExit scripts](configure-mdt-2013-for-userexit-scripts.md)
-
 [Simulate a Windows 10 deployment in a test environment](simulate-a-windows-10-deployment-in-a-test-environment.md)
-
 [Use the MDT database to stage Windows 10 deployment information](use-the-mdt-database-to-stage-windows-10-deployment-information.md)
-
 [Use web services in MDT](use-web-services-in-mdt-2013.md)
-
 [Use Orchestrator runbooks with MDT](use-orchestrator-runbooks-with-mdt-2013.md)
-
  
-
  
-
-
-
-
-

windows/deploy/build-a-distributed-environment-for-windows-10-deployment.md

@@ -2,107 +2,59 @@
 title: Build a distributed environment for Windows 10 deployment (Windows 10)
 description: In this topic, you will learn how to replicate your Windows 10 deployment shares to facilitate the deployment of Windows 10 in remote or branch locations.
 ms.assetid: a6cd5657-6a16-4fff-bfb4-44760902d00c
+ms.pagetype: mdt
 keywords: ["replication, replicate, deploy, configure, remote"]
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
 author: mtniehaus
 ---
-
 # Build a distributed environment for Windows 10 deployment
-
-
 **Applies to**
-
 -   Windows 10
-
 In this topic, you will learn how to replicate your Windows 10 deployment shares to facilitate the deployment of Windows 10 in remote or branch locations. If you work in a distributed environment, replicating the deployment shares is an important part of the deployment solution. With images reaching 5 GB in size or more, you can't deploy machines in a remote office over the wire. You need to replicate the content, so that the clients can do local deployments.
-
 We will use four machines for this topic: DC01, MDT01, MDT02, and PC0006. DC01 is a domain controller, MDT01 is a Windows Server 2012 R2 standard server, and PC0006 is a blank machine to which you will deploy Windows 10. You will configure a second deployment server (MDT02) for a remote site (Stockholm) by replicating the deployment share in the original site (New York). MDT01, MDT02, and PC0006 are members of the domain contoso.com for the fictitious Contoso Corporation. For more details on the setup for this topic, please see [Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-10-with-the-microsoft-deployment-toolkit.md#proof).
-
 ![figure 1](images/mdt-10-fig01.png)
-
 Figure 1. The machines used in this topic.
-
 ## <a href="" id="sec01"></a>Replicate deployment shares
-
-
 Replicating the content between MDT01 (New York) and MDT02 (Stockholm) can be done in a number of different ways. The most common content replication solutions with Microsoft Deployment Toolkit (MDT) 2013 use either the Linked Deployment Shares (LDS) feature or Distributed File System Replication (DFS-R). Some organizations have used a simple robocopy script for replication of the content.
-
 **Note**  
 Robocopy has options that allow for synchronization between folders. It has a simple reporting function; it supports transmission retry; and, by default, it will only copy/remove files from the source that are newer than files on the target.
-
  
-
 ### Linked deployment shares in MDT 2013 Update 2
-
 LDS is a built-in feature in MDT for replicating content. However, LDS works best with strong connections such as LAN connections with low latency. For most WAN links, DFS-R is the better option.
-
 ### Why DFS-R is a better option
-
 DFS-R is not only very fast and reliable, but it also offers central monitoring, bandwidth control, and a great delta replication engine. DFS-R will work equally well whether you have 2 sites or 90. When using DFS-R for MDT, we recommend running your deployment servers on Windows Server 2008 R2 or higher. From that version on, you can configure the replication target(s) as read-only, which is exactly what you want for MDT. This way, you can have your master deployment share centralized and replicate out changes as they happen. DFS-R will quickly pick up changes at the central deployment share in MDT01 and replicate the delta changes to MDT02.
-
 ## <a href="" id="sec02"></a>Set up Distributed File System Replication (DFS-R) for replication
-
-
 Setting up DFS-R for replication is a quick and straightforward process. You prepare the deployment servers and then create a replication group. To complete the setup, you configure some replication settings.
-
 ### Prepare MDT01 for replication
-
 1.  On MDT01, using Server Manager, click **Add roles and features**.
-
 2.  On the **Select installation type** page, select **Role-based or feature-based installation**.
-
 3.  On the **Select destination server** page, select **MDT01.contoso.com** and click **Next**.
-
 4.  On the **Select server roles** page, expand **File and Storage Services (Installed)** and expand **File and iSCSI Services (Installed)**.
-
 5.  In the **Roles** list, select **DFS Replication**. In the **Add Roles and Features Wizard** dialog box, select **Add Features**, and then click **Next**.
-
     ![figure 2](images/mdt-10-fig02.png)
-
     Figure 2. Adding the DFS Replication role to MDT01.
-
 6.  On the **Select features** page, accept the default settings, and click **Next**.
-
 7.  On the **Confirm installation selections** page, click **Install**.
-
 8.  On the **Installation progress** page, click **Close**.
-
 ### Prepare MDT02 for replication
-
 1.  On MDT02, using Server Manager, click **Add roles and features**.
-
 2.  On the **Select installation type** page, select **Role-based or feature-based installation**.
-
 3.  On the **Select destination server** page, select **MDT02.contoso.com** and click **Next**.
-
 4.  On the **Select server roles** page, expand **File and Storage Services (Installed)** and expand **File and iSCSI Services (Installed)**.
-
 5.  In the **Roles** list, select **DFS Replication**. In the **Add Roles and Features Wizard** dialog box, select **Add Features**, and then click **Next**.
-
 6.  On the **Select features** page, accept the default settings, and click **Next**.
-
 7.  On the **Confirm installation selections** page, click **Install**.
-
 8.  On the **Installation progress** page, click **Close**.
-
 ### Create the MDTProduction folder on MDT02
-
 1.  On MDT02, using File Explorer, create the **E:\\MDTProduction** folder.
-
 2.  Share the **E:\\MDTProduction** folder as **MDTProduction$**. Use the default permissions.
-
     ![figure 3](images/mdt-10-fig03.png)
-
     Figure 3. Sharing the **E:\\MDTProduction folder** on MDT02.
-
 ### Configure the deployment share
-
 When you have multiple deployment servers sharing the same content, you need to configure the Bootstrap.ini file with information about which server to connect to based on where the client is located. In MDT, that can be done by using the DefaultGateway property.
-
 1.  On MDT01, using Notepad, navigate to the **E:\\MDTProduction\\Control** folder and modify the Boostrap.ini file to look like this:
-
     ``` syntax
     [Settings]
     Priority=DefaultGateway, Default
@@ -118,194 +70,96 @@ When you have multiple deployment servers sharing the same content, you need to
     UserID=MDT_BA
     SkipBDDWelcome=YES
     ```
-
     **Note**  
     The DeployRoot value needs to go into the Bootstrap.ini file, but you can use the same logic in the CustomSettings.ini file. For example, you can redirect the logs to the local deployment server (SLSHARE), or have the User State Migration Tool (USMT) migration store (UDDIR) local. To learn more about USMT, see [Refresh a Windows 7 computer with Windows 10](refresh-a-windows-7-computer-with-windows-10.md) and [Replace a Windows 7 computer with a Windows 10 computer](replace-a-windows-7-computer-with-a-windows-10-computer.md).
-
      
-
 2.  Save the Bootstrap.ini file.
-
 3.  Using the Deployment Workbench, right-click the **MDT Production** deployment share and select **Update Deployment Share**.
-
     ![figure 4](images/mdt-10-fig04.png)
-
     Figure 4. Updating the MDT Production deployment share.
-
 4.  Use the default settings for the Update Deployment Share Wizard.
-
 5.  After the update is complete, use the Windows Deployment Services console. In the **Boot Images** node, right-click the **MDT Production x64** boot image and select **Replace Image**.
-
     ![figure 5](images/mdt-10-fig05.png)
-
     Figure 5. Replacing the updated boot image in WDS.
-
 6.  Browse and select the **E:\\MDTProduction\\Boot\\LiteTouchPE\_x64.wim** boot image, and then complete Replace Boot Image Wizard using the default settings.
-
 ## <a href="" id="sec03"></a>Replicate the content
-
-
 Once the MDT01 and MDT02 servers are prepared, you are ready to configure the actual replication.
-
 ### Create the replication group
-
 1.  On MDT01, using DFS Management, right-click **Replication**, and select **New Replication Group**.
-
 2.  On the **Replication Group Type** page, select **Multipurpose replication group**, and click **Next**.
-
 3.  On the **Name and Domain** page, assign the **MDTProduction** name, and click **Next**.
-
 4.  On the **Replication Group Members** page, click **Add**, add **MDT01** and **MDT02**, and then click **Next**.
-
     ![figure 6](images/mdt-10-fig06.png)
-
     Figure 6. Adding the Replication Group Members.
-
 5.  On the **Topology Selection** page, select the **Full mesh** option and click **Next**.
-
 6.  On the **Replication Group Schedule and Bandwidth** page, accept the default settings and click **Next**.
-
 7.  On the **Primary Member** page, select **MDT01** and click **Next**.
-
 8.  On the **Folders to Replicate** page, click **Add**, type in **E:\\MDTProduction** as the folder to replicate, click **OK**, and then click **Next**.
-
 9.  On the **Local Path of MDTProduction** on the **Other Members** page, select **MDT02**, and click **Edit**.
-
 10. On the **Edit** page, select the **Enabled** option, type in **E:\\MDTProduction** as the local path of folder, select the **Make the selected replicated folder on this member read-only** check box, click **OK**, and then click **Next**.
-
     ![figure 7](images/mdt-10-fig07.png)
-
     Figure 7. Configure the MDT02 member.
-
 11. On the **Review Settings and Create Replication Group** page, click **Create**.
-
 12. On the **Confirmation** page, click **Close**.
-
 ### Configure replicated folders
-
 1.  On MDT01, using DFS Management, expand **Replication** and then select **MDTProduction**.
-
 2.  In the middle pane, right-click the **MDT01** member and select **Properties**.
-
 3.  On the **MDT01 (MDTProduction) Properties** page, configure the following and then click **OK**:
-
     1.  In the **Staging** tab, set the quota to **20480 MB**.
-
     2.  In the **Advanced** tab, set the quota to **8192 MB**.
-
         In this scenario the size of the deployment share is known, but you might need to change the values for your environment. A good rule of thumb is to get the size of the 16 largest files and make sure they fit in the staging area. Here is a Windows PowerShell example that calculates the size of the 16 largest files in the E:\\MDTProduction deployment share:
-
         ``` syntax
         (Get-ChildItem E:\MDTProduction -Recurse | Sort-Object Length -Descending | Select-Object -First 16 | Measure-Object -Property Length -Sum).Sum /1GB
         ```
-
     ![figure 8](images/mdt-10-fig08.png)
-
     Figure 8. Configure the Staging settings.
-
 4.  In the middle pane, right-click the **MDT02** member and select **Properties**.
-
 5.  On the **MDT02 (MDTProduction) Properties** page, configure the following and then click **OK**:
-
     1.  In the **Staging** tab, set the quota to **20480 MB**.
-
     2.  In the **Advanced** tab, set the quota to **8192 MB**.
-
 **Note**  
 It will take some time for the replication configuration to be picked up by the replication members (MDT01 and MDT02). The time for the initial sync will depend on the WAN link speed between the sites. After that, delta changes are replicated quickly.
-
  
-
 ### Verify replication
-
 1.  On MDT02, wait until you start to see content appear in the **E:\\MDTProduction** folder.
-
 2.  Using DFS Management, expand **Replication**, right-click **MDTProduction**, and select **Create Diagnostics Report**.
-
 3.  In the Diagnostics Report Wizard, on the **Type of Diagnostics Report or Test** page, select **Health report** and click **Next**.
-
 4.  On the **Path and Name** page, accept the default settings and click **Next**.
-
 5.  On the **Members to Include** page, accept the default settings and click **Next**.
-
 6.  On the **Options** page, accept the default settings and click **Next**.
-
 7.  On the **Review Settings and Create Report** page, click **Create**.
-
 8.  Open the report in Internet Explorer, and if necessary, select the **Allow blocked content** option.
-
 ![figure 9](images/mdt-10-fig09.png)
-
 Figure 9. The DFS Replication Health Report.
-
 ## <a href="" id="sec04"></a>Configure Windows Deployment Services (WDS) in a remote site
-
-
 Like you did in the previous topic for MDT01, you need to add the MDT Production Lite Touch x64 Boot image to Windows Deployment Services on MDT02. For the following steps, we assume that WDS has already been installed on MDT02.
-
 1.  On MDT02, using the WDS console, right-click **Boot Images** and select **Add Boot Image**.
-
 2.  Browse to the E:\\MDTProduction\\Boot\\LiteTouchPE\_x64.wim file and add the image with the default settings.
-
 ## <a href="" id="sec05"></a>Deploy the Windows 10 client to the remote site
-
-
 Now you should have a solution ready for deploying the Windows 10 client to the remote site, Stockholm, connecting to the MDT Production deployment share replica on MDT02.
-
 1.  Create a virtual machine with the following settings:
-
     1.  Name: PC0006
-
     2.  Location: C:\\VMs
-
     3.  Generation: 2
-
     4.  Memory: 2048 MB
-
     5.  Hard disk: 60 GB (dynamic disk)
-
 2.  Start the PC0006 virtual machine, and press **Enter** to start the Pre-Boot Execution Environment (PXE) boot. The machine will now load the Windows PE boot image from the WDS server.
-
 3.  After Windows Preinstallation Environment (Windows PE) has booted, complete the Windows Deployment Wizard using the following settings:
-
     1.  Password: P@ssw0rd
-
     2.  Select a task sequence to execute on this computer:
-
         1.  Windows 10 Enterprise x64 RTM Custom Image
-
         2.  Computer Name: PC0006
-
         3.  Applications: Select the Install - Adobe Reader XI - x86 application
-
 4.  The setup will now start and do the following:
-
     1.  Install the Windows 10 Enterprise operating system.
-
     2.  Install the added application.
-
     3.  Update the operating system via your local Windows Server Update Services (WSUS) server.
-
 ## Related topics
-
-
 [Get started with the Microsoft Deployment Toolkit (MDT)](get-started-with-the-microsoft-deployment-toolkit.md)
-
 [Create a Windows 10 reference image](create-a-windows-10-reference-image.md)
-
 [Deploy a Windows 10 image using MDT 2013 Update 2](deploy-a-windows-10-image-using-mdt.md)
-
 [Refresh a Windows 7 computer with Windows 10](refresh-a-windows-7-computer-with-windows-10.md)
-
 [Replace a Windows 7 computer with a Windows 10 computer](replace-a-windows-7-computer-with-a-windows-10-computer.md)
-
 [Configure MDT settings](configure-mdt-2013-settings.md)
-
  
-
  
-
-
-
-
-

windows/deploy/configure-client-computers-vamt.md

@@ -2,113 +2,66 @@
 title: Configure Client Computers (Windows 10)
 description: Configure Client Computers
 ms.assetid: a48176c9-b05c-4dd5-a9ef-83073e2370fc
+ms.pagetype: activation
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
 author: jdeckerMS
 ---
-
 # Configure Client Computers
 To enable the Volume Activation Management Tool (VAMT) to function correctly, certain configuration changes are required on all client computers:
-
 -   An exception must be set in the client computer's firewall.
-
 -   A registry key must be created and set properly, for computers in a workgroup; otherwise, Windows® User Account Control (UAC) will not allow remote administrative operations.
-
 Organizations where the VAMT will be widely used may benefit from making these changes inside the master image for Windows.
-
 **Important**  
 This procedure only applies to clients running Windows Vista or later. For clients running Windows XP Service Pack 1, see [Connecting Through Windows Firewall](http://go.microsoft.com/fwlink/p/?LinkId=182933).
-
 ## Configuring the Windows Firewall to allow VAMT access
 Enable the VAMT to access client computers using the **Windows Firewall** Control Panel:
-
 1.  Open Control Panel and double-click **System and Security**.
-
 2.  Click **Windows Firewall**.
-
 3.  Click **Allow a program or feature through Windows Firewall**.
-
 4.  Click the **Change settings** option.
-
 5.  Select the **Windows Management Instrumentation (WMI)** checkbox.
-
 6.  Click **OK**.
-
     **Warning**  
     By default, Windows Firewall Exceptions only apply to traffic originating on the local subnet. To expand the exception to apply to multiple subnets, you need to change the exception settings in the Windows Firewall with Advanced Security, as described below.
-
 ## Configure Windows Firewall to allow VAMT access across multiple subnets
 Enable the VAMT to access client computers across multiple subnets using the **Windows Firewall with Advanced Security** Control Panel:
-
 ![VAMT Firewall configuration for multiple subnets](images/dep-win8-l-vamt-firewallconfigurationformultiplesubnets.gif)
-
 1.  Open the Control Panel and double-click **Administrative Tools**.
-
 2.  Click **Windows Firewall with Advanced Security**.
-
 3.  Make your changes for each of the following three WMI items, for the applicable Network Profile (Domain, Public, Private):
-
     -   Windows Management Instrumentation (ASync-In)
-
     -   Windows Management Instrumentation (DCOM-In)
-
     -   Windows Management Instrumentation (WMI-In)
-
 4. In the **Windows Firewall with Advanced Security** dialog box, select **Inbound Rules** from the left-hand panel.
         
 5. Right-click the desired rule and select **Properties** to open the **Properties** dialog box.
         
     - On the **General** tab, select the **Allow the connection** checkbox.
-
     - On the **Scope** tab, change the Remote IP Address setting from "Local Subnet" (default) to allow the specific access you need.
-
     - On the **Advanced** tab, verify selection of all profiles that are applicable to the network (Domain or Private/Public).
-
 In certain scenarios, only a limited set of TCP/IP ports are allowed through a hardware firewall. Administrators must ensure that WMI (which relies on RPC over TCP/IP) is allowed through these types of firewalls. By default, the WMI port is a dynamically allocated random port above 1024. The following Microsoft knowledge article discusses how administrators can limit the range of dynamically-allocated ports. This is useful if, for example, the hardware firewall only allows traffic in a certain range of ports.
-
 For more info, see [How to configure RPC dynamic port allocation to work with firewalls](http://go.microsoft.com/fwlink/p/?LinkId=182911).
-
 ## Create a registry value for the VAMT to access workgroup-joined computer
 **Caution**  
 This section contains information about how to modify the registry. Make sure to back up the registry before you modify it; in addition, ensure that you know how to restore the registry, if a problem occurs. For more information about how to back up, restore, and modify the registry, see [Windows registry information for advanced users](http://go.microsoft.com/fwlink/p/?LinkId=182912).
-
 On the client computer, create the following registry key using regedit.exe.
-
 1.  Navigate to `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system`
-
 2.  Enter the following details:
-
     **Value Name: LocalAccountTokenFilterPolicy**
-
     **Type: DWORD**
-
     **Value Data: 1**
-
     **Note**  
     To discover VAMT-manageable Windows computers in workgroups, you must enable network discovery on each client.
-
 ## Deployment options
 There are several options for organizations to configure the WMI firewall exception for computers:
-
 -   **Image.** Add the configurations to the master Windows image deployed to all clients.
-
 -   **Group Policy.** If the clients are part of a domain, then all clients can be configured using Group Policy. The Group Policy setting for the WMI firewall exception is found in GPMC.MSC at: **Computer Configuration\\Windows Settings\\Security Settings\\Windows Firewall with Advanced Security\\Windows Firewall with Advanced Security\\Inbound Rules**.
-
 -   **Script.** Execute a script using Microsoft System Center Configuration Manager or a third-party remote script execution facility.
-
 -   **Manual.** Configure the WMI firewall exception individually on each client.
-
 The above configurations will open an additional port through the Windows Firewall on target computers and should be performed on computers that are protected by a network firewall. In order to allow VAMT to query the up-to-date licensing status, the WMI exception must be maintained. We recommend administrators consult their network security policies and make clear decisions when creating the WMI exception.
-
 ## Related topics
 - [Install and Configure VAMT](install-configure-vamt.md)
-
  
-
  
-
-
-
-
-

windows/deploy/configure-mdt-2013-for-userexit-scripts.md

@@ -2,23 +2,17 @@
 title: Configure MDT for UserExit scripts (Windows 10)
 description: In this topic, you will learn how to configure the MDT rules engine to use a UserExit script to generate computer names based on a prefix and the computer MAC Address.
 ms.assetid: 29a421d1-12d2-414e-86dc-25b62f5238a7
+ms.pagetype: mdt
 keywords: ["rules, script"]
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
 author: mtniehaus
 ---
-
 # Configure MDT for UserExit scripts
-
-
 In this topic, you will learn how to configure the MDT rules engine to use a UserExit script to generate computer names based on a prefix and the computer MAC Address. MDT supports calling external VBScripts as part of the Gather process; these scripts are referred to as UserExit scripts. The script also removes the colons in the MAC Address.
-
 ## Configure the rules to call a UserExit script
-
-
 You can call a UserExit by referencing the script in your rules. Then you can configure a property to be set to the result of a function of the VBScript. In this example, we have a VBScript named Setname.vbs (provided in the book sample files, in the UserExit folder).
-
 ``` syntax
 [Settings]
 Priority=Default
@@ -27,14 +21,9 @@ OSINSTALL=YES
 UserExit=Setname.vbs
 OSDComputerName=#SetName("%MACADDRESS%")#
 ```
-
 The UserExit=Setname.vbs calls the script and then assigns the computer name to what the SetName function in the script returns. In this sample the %MACADDRESS% variable is passed to the script
-
 ## The Setname.vbs UserExit script
-
-
 The Setname.vbs script takes the MAC Address passed from the rules. The script then does some string manipulation to add a prefix (PC) and remove the semicolons from the MAC Address.
-
 ``` syntax
 Function UserExit(sType, sWhen, sDetail, bSkip) 
   UserExit = Success 
@@ -48,36 +37,17 @@ Function SetName(sMac)
   SetName = "PC" & re.Replace(sMac, "")
 End Function
 ```
-
 The first three lines of the script make up a header that all UserExit scripts have. The interesting part is the lines between Function and End Function. Those lines add a prefix (PC), remove the colons from the MAC Address, and return the value to the rules by setting the SetName value.
-
 **Note**  
 The purpose of this sample is not to recommend that you use the MAC Address as a base for computer naming, but to show you how to take a variable from MDT, pass it to an external script, make some changes to it, and then return the new value to the deployment process.
-
  
-
 ## Related topics
-
-
 [Set up MDT for BitLocker](set-up-mdt-2013-for-bitlocker.md)
-
 [Configure MDT deployment share rules](configure-mdt-deployment-share-rules.md)
-
 [Simulate a Windows 10 deployment in a test environment](simulate-a-windows-10-deployment-in-a-test-environment.md)
-
 [Use the MDT database to stage Windows 10 deployment information](use-the-mdt-database-to-stage-windows-10-deployment-information.md)
-
 [Assign applications using roles in MDT](assign-applications-using-roles-in-mdt-2013.md)
-
 [Use web services in MDT](use-web-services-in-mdt-2013.md)
-
 [Use Orchestrator runbooks with MDT](use-orchestrator-runbooks-with-mdt-2013.md)
-
  
-
  
-
-
-
-
-

windows/deploy/configure-mdt-2013-settings.md

@@ -2,63 +2,33 @@
 title: Configure MDT settings (Windows 10)
 description: One of the most powerful features in Microsoft Deployment Toolkit (MDT) 2013 is its extension capabilities; there is virtually no limitation to what you can do in terms of customization.
 ms.assetid: d3e1280c-3d1b-4fad-8ac4-b65dc711f122
+ms.pagetype: mdt
 keywords: ["customize, customization, deploy, features, tools"]
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
 author: mtniehaus
 ---
-
 # Configure MDT settings
-
-
 One of the most powerful features in Microsoft Deployment Toolkit (MDT) 2013 is its extension capabilities; there is virtually no limitation to what you can do in terms of customization. In this topic, you learn about configuring customizations for your environment.
-
 For the purposes of this topic, we will use four machines: DC01, MDT01, HV01, and PC0001. DC01 is a domain controller, MDT01 is a Windows Server 2012 R2 Standard server, and PC0001 is a Windows 10 Enterprise x64 client used for the MDT simulation environment. OR01 has Microsoft System Center 2012 R2 Orchestrator installed. MDT01, OR01, and PC0001 are members of the domain contoso.com for the fictitious Contoso Corporation. For more details on the setup for this topic, please see [Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-10-with-the-microsoft-deployment-toolkit.md#proof).
-
 ![figure 1](images/mdt-09-fig01.png)
-
 Figure 1. The machines used in this topic.
-
 ## In this section
-
-
 -   [Set up MDT for BitLocker](set-up-mdt-2013-for-bitlocker.md)
-
 -   [Configure MDT deployment share rules](configure-mdt-deployment-share-rules.md)
-
 -   [Configure MDT for UserExit scripts](configure-mdt-2013-for-userexit-scripts.md)
-
 -   [Simulate a Windows 10 deployment in a test environment](simulate-a-windows-10-deployment-in-a-test-environment.md)
-
 -   [Use the MDT database to stage Windows 10 deployment information](use-the-mdt-database-to-stage-windows-10-deployment-information.md)
-
 -   [Assign applications using roles in MDT](assign-applications-using-roles-in-mdt-2013.md)
-
 -   [Use web services in MDT](use-web-services-in-mdt-2013.md)
-
 -   [Use Orchestrator runbooks with MDT](use-orchestrator-runbooks-with-mdt-2013.md)
-
 ## Related topics
-
-
 [Get started with the Microsoft Deployment Toolkit (MDT)](get-started-with-the-microsoft-deployment-toolkit.md)
-
 [Create a Windows 10 reference image](create-a-windows-10-reference-image.md)
-
 [Deploy a Windows 10 image using MDT 2013 Update 2](deploy-a-windows-10-image-using-mdt.md)
-
 [Build a distributed environment for Windows 10 deployment](build-a-distributed-environment-for-windows-10-deployment.md)
-
 [Refresh a Windows 7 computer with Windows 10](refresh-a-windows-7-computer-with-windows-10.md)
-
 [Replace a Windows 7 computer with a Windows 10 computer](replace-a-windows-7-computer-with-a-windows-10-computer.md)
-
  
-
  
-
-
-
-
-

windows/deploy/configure-mdt-deployment-share-rules.md

@@ -2,40 +2,25 @@
 title: Configure MDT deployment share rules (Windows 10)
 description: In this topic, you will learn how to configure the MDT rules engine to reach out to other resources, including external scripts, databases, and web services, for additional information instead of storing settings directly in the rules engine.
 ms.assetid: b5ce2360-33cc-4b14-b291-16f75797391b
+ms.pagetype: mdt
 keywords: ["rules, configuration, automate, deploy"]
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
 author: mtniehaus
 ---
-
 # Configure MDT deployment share rules
-
-
 In this topic, you will learn how to configure the MDT rules engine to reach out to other resources, including external scripts, databases, and web services, for additional information instead of storing settings directly in the rules engine. The rules engine in MDT is powerful: most of the settings used for operating system deployments are retrieved and assigned via the rules engine. In its simplest form, the rules engine is the CustomSettings.ini text file.
-
 ## <a href="" id="sec01"></a>Assign settings
-
-
 When using MDT, you can assign setting in three distinct ways:
-
 -   You can pre-stage the information before deployment.
-
 -   You can prompt the user or technician for information.
-
 -   You can have MDT generate the settings automatically.
-
 In order illustrate these three options, let's look at some sample configurations.
-
 ## <a href="" id="sec02"></a>Sample configurations
-
-
 Before adding the more advanced components like scripts, databases, and web services, consider the commonly used configurations below; they demonstrate the power of the rules engine.
-
 ### Set computer name by MAC Address
-
 If you have a small test environment, or simply want to assign settings to a very limited number of machines, you can edit the rules to assign settings directly for a given MAC Address. If you have many machines, it makes sense to use the database instead.
-
 ``` syntax
 [Settings]
 Priority=MacAddress, Default
@@ -44,13 +29,9 @@ OSInstall=YES
 [00:15:5D:85:6B:00]
 OSDComputerName=PC00075
 ```
-
 In the preceding sample, you set the PC00075 computer name for a machine with a MAC Address of 00:15:5D:85:6B:00.
-
 ### Set computer name by serial number
-
 Another way to assign a computer name is to identify the machine via its serial number.
-
 ``` syntax
 [Settings]
 Priority=SerialNumber, Default
@@ -59,13 +40,9 @@ OSInstall=YES
 [CND0370RJ7]
 OSDComputerName=PC00075
 ```
-
 In this sample, you set the PC00075 computer name for a machine with a serial number of CND0370RJ7.
-
 ### Generate a computer name based on a serial number
-
 You also can configure the rules engine to use a known property, like a serial number, to generate a computer name on the fly.
-
 ``` syntax
 [Settings]
 Priority=Default
@@ -73,18 +50,12 @@ Priority=Default
 OSInstall=YES
 OSDComputerName=PC-%SerialNumber%
 ```
-
 In this sample, you configure the rules to set the computer name to a prefix (PC-) and then the serial number. If the serial number of the machine is CND0370RJ7, the preceding configuration sets the computer name to PC-CND0370RJ7.
-
 **Note**  
 Be careful when using the serial number to assign computer names. A serial number can contain more than 15 characters, but the Windows setup limits a computer name to 15 characters.
-
  
-
 ### Generate a limited computer name based on a serial number
-
 To avoid assigning a computer name longer than 15 characters, you can configure the rules in more detail by adding VBScript functions, as follows:
-
 ``` syntax
 [Settings]
 Priority=Default
@@ -92,13 +63,9 @@ Priority=Default
 OSInstall=YES
 OSDComputerName=PC-#Left("%SerialNumber%",12)#
 ```
-
 In the preceding sample, you still configure the rules to set the computer name to a prefix (PC-) followed by the serial number. However, by adding the Left VBScript function, you configure the rule to use only the first 12 serial-number characters for the name.
-
 ### Add laptops to a different organizational unit (OU) in Active Directory
-
 In the rules, you find built-in properties that use a Windows Management Instrumentation (WMI) query to determine whether the machine you are deploying is a laptop, desktop, or server. In this sample, we assume you want to add laptops to different OUs in Active Directory. Note that ByLaptopType is not a reserved word; rather, it is the name of the section to read.
-
 ``` syntax
 [Settings]
 Priority=ByLaptopType, Default
@@ -109,29 +76,13 @@ Subsection=Laptop-%IsLaptop%
 [Laptop-True]
 MachineObjectOU=OU=Laptops,OU=Contoso,DC=contoso,DC=com
 ```
-
 ## Related topics
-
-
 [Set up MDT for BitLocker](set-up-mdt-2013-for-bitlocker.md)
-
 [Configure MDT for UserExit scripts](configure-mdt-2013-for-userexit-scripts.md)
-
 [Simulate a Windows 10 deployment in a test environment](simulate-a-windows-10-deployment-in-a-test-environment.md)
-
 [Use the MDT database to stage Windows 10 deployment information](use-the-mdt-database-to-stage-windows-10-deployment-information.md)
-
 [Assign applications using roles in MDT](assign-applications-using-roles-in-mdt-2013.md)
-
 [Use web services in MDT](use-web-services-in-mdt-2013.md)
-
 [Use Orchestrator runbooks with MDT](use-orchestrator-runbooks-with-mdt-2013.md)
-
  
-
  
-
-
-
-
-

windows/deploy/create-a-windows-10-reference-image.md

@@ -2,245 +2,131 @@
 title: Create a Windows 10 reference image (Windows 10)
 description: Creating a reference image is important because that image serves as the foundation for the devices in your organization.
 ms.assetid: 9da2fb57-f2ff-4fce-a858-4ae4c237b5aa
+ms.pagetype: mdt
 keywords: ["deploy, deployment, configure, customize, install, installation"]
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
 author: mtniehaus
 ---
-
 # Create a Windows 10 reference image
-
-
 **Applies to**
-
 -   Windows 10
-
 Creating a reference image is important because that image serves as the foundation for the devices in your organization. In this topic, you will learn how to create a Windows 10 reference image using the Microsoft Deployment Toolkit (MDT) 2013 Update 2. You will create a deployment share, configure rules and settings, and import all the applications and operating system files required to build a Windows 10 reference image. After completing the steps outlined in this topic, you will have a Windows 10 reference image that can be used in your deployment solution.
-
 For the purposes of this topic, we will use four machines: DC01, MDT01, HV01, and PC0001. DC01 is a domain controller, PC0001 is a Windows 10 Enterprise x64 client, and MDT01 is a Windows Server 2012 R2 standard server. HV01 is a Hyper-V host server, but HV01 could be replaced by PC0001 as long as PC0001 has enough memory and is capable of running Hyper-V. MDT01, HV01, and PC0001 are members of the domain contoso.com for the fictitious Contoso Corporation.
-
 **Note**  
 For important details about the setup for the steps outlined in this article, please see [Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-10-with-the-microsoft-deployment-toolkit.md#proof).
-
  
-
 ![figure 1](images/mdt-08-fig01.png)
-
 Figure 1. The machines used in this topic.
-
 ## The reference image
-
-
 The reference image described in this documentation is designed primarily for deployment to physical machines. However, the reference image is created on a virtual platform, before being automatically run through the System Preparation (Sysprep) tool process and captured to a Windows Imaging (WIM) file. The reasons for creating the reference image on a virtual platform are the following:
-
 -   You reduce development time and can use snapshots to test different configurations quickly.
-
 -   You rule out hardware issues. You simply get the best possible image, and if you have a problem, it's not likely to be hardware related.
-
 -   It ensures that you won't have unwanted applications that could be installed as part of a driver install but not removed by the Sysprep process.
-
 -   It's easy to move between lab, test, and production.
-
 ## <a href="" id="sec01"></a>Set up the MDT build lab deployment share
-
-
 With Windows 10, there is no hard requirement to create reference images; however, to reduce the time needed for deployment, you may want to create a reference image that contains a few base applications as well as all of the latest updates. This section will show you how to create and configure the MDT Build Lab deployment share to create a Windows 10 reference image. Because reference images will be deployed only to virtual machines during the creation process and have specific settings (rules), you should always create a separate deployment share specifically for this process.
-
 ### Create the MDT build lab deployment share
-
 -   On MDT01, log on as Administrator in the CONTOSO domain using a password of **P@ssw0rd**.
-
 -   Using the Deployment Workbench, right-click **Deployment Shares** and select **New Deployment Share**.
-
 -   Use the following settings for the New Deployment Share Wizard:
-
 -   Deployment share path: E:\\MDTBuildLab
-
 -   Share name: MDTBuildLab$
-
 -   Deployment share description: MDT Build Lab
-
 -   &lt;default&gt;
-
 -   Verify that you can access the \\\\MDT01\\MDTBuildLab$ share.
-
 ![figure 2](images/mdt-08-fig02.png)
-
 Figure 2. The Deployment Workbench with the MDT Build Lab deployment share created.
-
 ### Configure permissions for the deployment share
-
 In order to write the reference image back to the deployment share, you need to assign Modify permissions to the MDT Build Account (MDT\_BA) for the **Captures** subfolder in the **E:\\MDTBuildLab** folder
-
 1.  On MDT01, log on as **CONTOSO\\Administrator**.
-
 2.  Modify the NTFS permissions for the **E:\\MDTBuildLab\\Captures** folder by running the following command in an elevated Windows PowerShell prompt:
-
     ``` syntax
     icacls E:\MDTBuildLab\Captures /grant '"MDT_BA":(OI)(CI)(M)'
     ```
-
 ![figure 3](images/mdt-08-fig03.png)
-
 Figure 3. Permissions configured for the MDT\_BA user.
-
 ## <a href="" id="sec02"></a>Add the setup files
-
-
 This section will show you how to populate the MDT 2013 Update 2 deployment share with the Windows 10 operating system source files, commonly referred to as setup files, which will be used to create a reference image. Setup files are used during the reference image creation process and are the foundation for the reference image.
-
 ### Add the Windows 10 installation files
-
 MDT 2013 supports adding both full source Windows 10 DVDs (ISOs) and custom images that you have created. In this case, you create a reference image, so you add the full source setup files from Microsoft.
-
 **Note**  
 Due to the Windows limits on path length, we are purposely keeping the operating system destination directory short, using the folder name W10EX64RTM rather than a more descriptive name like Windows 10 Enterprise x64 RTM.
-
  
-
 ### Add Windows 10 Enterprise x64 (full source)
-
 In these steps we assume that you have copied the content of a Windows 10 Enterprise x64 ISO to the **E:\\Downloads\\Windows 10 Enterprise x64** folder.
-
 1.  On MDT01, log on as **CONTOSO\\Administrator**.
-
 2.  Using the Deployment Workbench, expand the **Deployment Shares** node, and then expand **MDT Build Lab**.
-
 3.  Right-click the **Operating Systems** node, and create a new folder named **Windows 10**.
-
 4.  Expand the **Operating Systems** node, right-click the **Windows 10** folder, and select **Import Operating System**. Use the following settings for the Import Operating System Wizard:
-
 5.  Full set of source files
-
 6.  Source directory: E:\\Downloads\\Windows 10 Enterprise x64
-
 7.  Destination directory name: W10EX64RTM
-
 8.  After adding the operating system, in the **Operating Systems / Windows 10** folder, double-click the added operating system name in the **Operating System** node and change the name to the following: **Windows 10 Enterprise x64 RTM Default Image**
-
 ![figure 4](images/figure4-deployment-workbench.png)
-
 Figure 4. The imported Windows 10 operating system after renaming it.
-
 ## <a href="" id="sec03"></a>Add applications
-
-
 Before you create an MDT task sequence, you need to add all of the applications and other sample scripts to the MDT Build Lab share.
-
 The steps in this section use a strict naming standard for your MDT applications. You add the "Install - " prefix for typical application installations that run a setup installer of some kind, and you use the "Configure - " prefix when an application configures a setting in the operating system. You also add an " - x86", " - x64", or "- x86-x64" suffix to indicate the application's architecture (some applications have installers for both architectures). Using a script naming standard is always recommended when using MDT as it helps maintain order and consistency.
-
 By storing configuration items as MDT applications, it is easy to move these objects between various solutions, or between test and production environments. In this topic's step-by-step sections, you will add the following applications:
-
 -   Install - Microsoft Office 2013 Pro Plus - x86
-
 -   Install - Microsoft Silverlight 5.0 - x64
-
 -   Install - Microsoft Visual C++ 2005 SP1 - x86
-
 -   Install - Microsoft Visual C++ 2005 SP1 - x64
-
 -   Install - Microsoft Visual C++ 2008 SP1 - x86
-
 -   Install - Microsoft Visual C++ 2008 SP1 - x64
-
 -   Install - Microsoft Visual C++ 2010 SP1 - x86
-
 -   Install - Microsoft Visual C++ 2010 SP1 - x64
-
 -   Install - Microsoft Visual C++ 2012 Update 4 - x86
-
 -   Install - Microsoft Visual C++ 2012 Update 4 - x64
-
 In these examples, we assume that you downloaded the software in this list to the E:\\Downloads folder. The first application is added using the UI, but because MDT supports Windows PowerShell, you add the other applications using Windows PowerShell.
-
 **Note**  
 All the Microsoft Visual C++ downloads can be found on [The latest supported Visual C++ downloads](http://go.microsoft.com/fwlink/p/?LinkId=619523).
-
  
-
 ### Create the install: Microsoft Office Professional Plus 2013 x86
-
 You can customize Office 2013. In the volume license versions of Office 2013, there is an Office Customization Tool you can use to customize the Office installation. In these steps we assume you have copied the Office 2013 installation files to the E:\\Downloads\\Office2013 folder.
-
 ### Add the Microsoft Office Professional Plus 2013 x86 installation files
-
 After adding the Microsoft Office Professional Plus 2013 x86 application, you then automate its setup by running the Office Customization Tool. In fact, MDT 2013 detects that you added the Office Professional Plus 2013 x86 application and creates a shortcut for doing this.
-
 You also can customize the Office installation using a Config.xml file. But we recommend that you use the Office Customization Tool as described in the following steps, as it provides a much richer way of controlling Office 2013 settings.
-
 1.  Using the Deployment Workbench in the MDT Build Lab deployment share, expand the **Applications / Microsoft** node, and double-click **Install - Microsoft Office 2013 Pro Plus x86**.
-
 2.  In the **Office Products** tab, click **Office Customization Tool**, and click **OK** in the **Information** dialog box.
-
     ![figure 5](images/mdt-08-fig05.png)
-
     Figure 5. The Install - Microsoft Office 2013 Pro Plus - x86 application properties.
-
     **Note**  
     If you don't see the Office Products tab, verify that you are using a volume license version of Office. If you are deploying Office 365, you need to download the Admin folder from Microsoft.
-
      
-
 3.  In the Office Customization Tool dialog box, select the Create a new Setup customization file for the following product option, select the Microsoft Office Professional Plus 2013 (32-bit) product, and click OK.
-
 4.  Use the following settings to configure the Office 2013 setup to be fully unattended:
-
     1.  Install location and organization name
-
         -   Organization name: Contoso
-
     2.  Licensing and user interface
-
         1.  Select Use KMS client key
-
         2.  Select I accept the terms in the License Agreement.
-
         3.  Select Display level: None
-
         ![figure 6](images/mdt-08-fig06.png)
-
         Figure 6. The licensing and user interface screen in the Microsoft Office Customization Tool
-
     3.  Modify Setup properties
-
         -   Add the **SETUP\_REBOOT** property and set the value to **Never**.
-
     4.  Modify user settings
-
         -   In the **Microsoft Office 2013** node, expand **Privacy**, select **Trust Center**, and enable the Disable Opt-in Wizard on first run setting.
-
 5.  From the **File** menu, select **Save**, and save the configuration as 0\_Office2013ProPlusx86.msp in the **E:\\MDTBuildLab\\Applications\\Install - Microsoft Office 2013 Pro Plus - x86\\Updates** folder.
-
     **Note**  
     The reason for naming the file with a 0 (zero) at the beginning is that the Updates folder also handles Microsoft Office updates, and they are installed in alphabetical order. The Office 2013 setup works best if the customization file is installed before any updates.
-
      
-
 6.  Close the Office Customization Tool, click Yes in the dialog box, and in the **Install - Microsoft Office 2013 Pro Plus - x86 Properties** window, click **OK**.
-
 ### Connect to the deployment share using Windows PowerShell
-
 If you need to add many applications, you can take advantage of the PowerShell support that MDT has. To start using PowerShell against the deployment share, you must first load the MDT PowerShell snap-in and then make the deployment share a PowerShell drive (PSDrive).
-
 1.  On MDT01, log on as **CONTOSO\\Administrator**.
-
 2.  Import the snap-in and create the PSDrive by running the following commands in an elevated PowerShell prompt:
-
     ``` syntax
     Import-Topic "C:\Program Files\Microsoft Deployment Toolkit\bin\MicrosoftDeploymentToolkit.psd1"
-
     New-PSDrive -Name "DS001" -PSProvider MDTProvider -Root "E:\MDTBuildLab"
     ```
-
 ### Create the install: Microsoft Visual C++ 2005 SP1 x86
-
 In these steps we assume that you have downloaded Microsoft Visual C++ 2005 SP1 x86. You might need to modify the path to the source folder to reflect your current environment. In this example, the source path is set to E:\\Downloads\\VC++2005SP1x86.
-
 1.  On MDT01, log on as **CONTOSO\\Administrator**.
-
 2.  Create the application by running the following commands in an elevated PowerShell prompt:
-
     ``` syntax
     $ApplicationName = "Install - Microsoft Visual C++ 2005 SP1 - x86"
     $CommandLine = "vcredist_x86.exe /Q"
@@ -248,15 +134,10 @@ In these steps we assume that you have downloaded Microsoft Visual C++ 2005 SP1
     Import-MDTApplication -Path "DS001:\Applications\Microsoft" -Enable "True" -Name $ApplicationName -ShortName $ApplicationName -Commandline $Commandline -WorkingDirectory ".\Applications\$ApplicationName" -ApplicationSourcePath $ApplicationSourcePath -DestinationFolder $ApplicationName 
     -Verbose
     ```
-
 ### Create the install: Microsoft Visual C++ 2005 SP1 x64
-
 In these steps we assume that you have downloaded Microsoft Visual C++ 2005 SP1 x64. You might need to modify the path to the source folder to reflect your current environment. In this example, the source path is set to E:\\Downloads\\VC++2005SP1x64.
-
 1.  On MDT01, log on as **CONTOSO\\Administrator**.
-
 2.  Create the application by running the following commands in an elevated PowerShell prompt:
-
     ``` syntax
     $ApplicationName = "Install - Microsoft Visual C++ 2005 SP1 - x64"
     $CommandLine = "vcredist_x64.exe /Q"
@@ -264,15 +145,10 @@ In these steps we assume that you have downloaded Microsoft Visual C++ 2005 SP1
     Import-MDTApplication -Path "DS001:\Applications\Microsoft" -Enable "True" -Name $ApplicationName -ShortName $ApplicationName -Commandline $Commandline -WorkingDirectory ".\Applications\$ApplicationName" -ApplicationSourcePath $ApplicationSourcePath -DestinationFolder $ApplicationName 
     -Verbose
     ```
-
 ### Create the install: Microsoft Visual C++ 2008 SP1 x86
-
 In these steps we assume that you have downloaded Microsoft Visual C++ 2008 SP1 x86. You might need to modify the path to the source folder to reflect your current environment. In this example, the source path is set to E:\\Downloads\\VC++2008SP1x86.
-
 1.  On MDT01, log on as **CONTOSO\\Administrator**.
-
 2.  Create the application by running the following commands in an elevated PowerShell prompt:
-
     ``` syntax
     $ApplicationName = "Install - Microsoft Visual C++ 2008 SP1 - x86"
     $CommandLine = "vcredist_x86.exe /Q"
@@ -280,15 +156,10 @@ In these steps we assume that you have downloaded Microsoft Visual C++ 2008 SP1
     Import-MDTApplication -Path "DS001:\Applications\Microsoft" -Enable "True" -Name $ApplicationName -ShortName $ApplicationName -Commandline $Commandline -WorkingDirectory ".\Applications\$ApplicationName" -ApplicationSourcePath $ApplicationSourcePath -DestinationFolder $ApplicationName 
     -Verbose
     ```
-
 ### Create the install: Microsoft Visual C++ 2008 SP1 x64
-
 In these steps we assume that you have downloaded Microsoft Visual C++ 2008 SP1 x64. You might need to modify the path to the source folder to reflect your current environment. In this example, the source path is set to E:\\Downloads\\VC++2008SP1x64.
-
 1.  On MDT01, log on as **CONTOSO\\Administrator**.
-
 2.  Create the application by running the following commands in an elevated PowerShell prompt:
-
     ``` syntax
     $ApplicationName = "Install - Microsoft Visual C++ 2008 SP1 - x64"
     $CommandLine = "vcredist_x64.exe /Q"
@@ -296,15 +167,10 @@ In these steps we assume that you have downloaded Microsoft Visual C++ 2008 SP1
     Import-MDTApplication -Path "DS001:\Applications\Microsoft" -Enable "True" -Name $ApplicationName -ShortName $ApplicationName -Commandline $Commandline -WorkingDirectory ".\Applications\$ApplicationName" -ApplicationSourcePath $ApplicationSourcePath -DestinationFolder $ApplicationName 
     -Verbose
     ```
-
 ### Create the install: Microsoft Visual C++ 2010 SP1 x86
-
 In these steps we assume that you have downloaded Microsoft Visual C++ 2010 SP1 x86. You might need to modify the path to the source folder to reflect your current environment. In this example, the source path is set to E:\\Downloads\\VC++2010SP1x86.
-
 1.  On MDT01, log on as **CONTOSO\\Administrator**.
-
 2.  Create the application by running the following commands in an elevated PowerShell prompt:
-
     ``` syntax
     $ApplicationName = "Install - Microsoft Visual C++ 2010 SP1 - x86"
     $CommandLine = "vcredist_x86.exe /Q"
@@ -312,15 +178,10 @@ In these steps we assume that you have downloaded Microsoft Visual C++ 2010 SP1
     Import-MDTApplication -Path "DS001:\Applications\Microsoft" -Enable "True" -Name $ApplicationName -ShortName $ApplicationName -CommandLine $CommandLine -WorkingDirectory ".\Applications\$ApplicationName" -ApplicationSourcePath $ApplicationSourcePath -DestinationFolder $ApplicationName 
     -Verbose
     ```
-
 ### Create the install: Microsoft Visual C++ 2010 SP1 x64
-
 In these steps we assume that you have downloaded Microsoft Visual C++ 2010 SP1 x64. You might need to modify the path to the source folder to reflect your current environment. In this example, the source path is set to E:\\Downloads\\VC++2010SP1x64.
-
 1.  On MDT01, log on as **CONTOSO\\Administrator**.
-
 2.  Create the application by running the following commands in an elevated PowerShell prompt:
-
     ``` syntax
     $ApplicationName = "Install - Microsoft Visual C++ 2010 SP1 - x64"
     $CommandLine = "vcredist_x64.exe /Q"
@@ -328,15 +189,10 @@ In these steps we assume that you have downloaded Microsoft Visual C++ 2010 SP1
     Import-MDTApplication -Path "DS001:\Applications\Microsoft" -Enable "True" -Name $ApplicationName -ShortName $ApplicationName -CommandLine $CommandLine -WorkingDirectory ".\Applications\$ApplicationName" -ApplicationSourcePath $ApplicationSourcePath -DestinationFolder $ApplicationName 
     -Verbose
     ```
-
 ### Create the install: Microsoft Visual C++ 2012 Update 4 x86
-
 In these steps we assume that you have downloaded Microsoft Visual C++ 2012 Update 4 x86. You might need to modify the path to the source folder to reflect your current environment. In this example, the source path is set to E:\\Downloads\\VC++2012Ux86.
-
 1.  On MDT01, log on as **CONTOSO\\Administrator**.
-
 2.  Create the application by running the following commands in an elevated PowerShell prompt:
-
     ``` syntax
     $ApplicationName = "Install - Microsoft Visual C++ 2012 Update 4 - x86"
     $CommandLine = "vcredist_x86.exe /Q"
@@ -344,15 +200,10 @@ In these steps we assume that you have downloaded Microsoft Visual C++ 2012 Upda
     Import-MDTApplication -Path "DS001:\Applications\Microsoft" -Enable "True" -Name $ApplicationName -ShortName $ApplicationName -CommandLine $CommandLine -WorkingDirectory ".\Applications\$ApplicationName" -ApplicationSourcePath $ApplicationSourcePath -DestinationFolder $ApplicationName 
     -Verbose
     ```
-
 ### Create the install: Microsoft Visual C++ 2012 Update 4 x64
-
 In these steps we assume that you have downloaded Microsoft Visual C++ 2012 Update 4 x64. You might need to modify the path to the source folder to reflect your current environment. In this example, the source path is set to E:\\Downloads\\VC++2012Ux64.
-
 1.  On MDT01, log on as **CONTOSO\\Administrator**.
-
 2.  Create the application by running the following commands in an elevated PowerShell prompt:
-
     ``` syntax
     $ApplicationName = "Install - Microsoft Visual C++ 2012 Update 4 - x64"
     $CommandLine = "vcredist_x64.exe /Q"
@@ -360,175 +211,91 @@ In these steps we assume that you have downloaded Microsoft Visual C++ 2012 Upda
     Import-MDTApplication -Path "DS001:\Applications\Microsoft" -Enable "True" -Name $ApplicationName -ShortName $ApplicationName -CommandLine $CommandLine -WorkingDirectory ".\Applications\$ApplicationName" -ApplicationSourcePath $ApplicationSourcePath -DestinationFolder $ApplicationName 
     -Verbose
     ```
-
 ## <a href="" id="sec04"></a>Create the reference image task sequence
-
-
 In order to build and capture your Windows 10 reference image for deployment using MDT, you will create a task sequence. The task sequence will reference the operating system and applications that you previously imported into the MDT Build Lab deployment share to build a Windows 10 reference image.
-
 After creating the task sequence, you configure it to enable patching against the Windows Server Update Services (WSUS) server. The Task Sequence Windows Update action supports getting updates directly from Microsoft Update, but you get more stable patching if you use a local WSUS server. WSUS also allows for an easy process of approving the patches that you are deploying.
-
 ### Drivers and the reference image
-
 Because we use modern virtual platforms for creating our reference images, we don’t need to worry about drivers when creating reference images for Windows 10. We use Hyper-V in our environment, and Windows Preinstallation Environment (Windows PE) already has all the needed drivers built-in for Hyper-V.
-
 ### Create a task sequence for Windows 10 Enterprise
-
 To create a Windows 10 reference image task sequence, the process is as follows:
-
 1.  Using the Deployment Workbench in the MDT Build Lab deployment share, right-click **Task Sequences**, and create a new folder named **Windows 10**.
-
 2.  Expand the **Task Sequences** node, right-click the new **Windows 10** folder and select **New Task Sequence**. Use the following settings for the New Task Sequence Wizard:
-
     1.  Task sequence ID: REFW10X64-001
-
     2.  Task sequence name: Windows 10 Enterprise x64 RTM Default Image
-
     3.  Task sequence comments: Reference Build
-
     4.  Template: Standard Client Task Sequence
-
     5.  Select OS: Windows 10 Enterprise x64 RTM Default Image
-
     6.  Specify Product Key: Do not specify a product key at this time
-
     7.  Full Name: Contoso
-
     8.  Organization: Contoso
-
     9.  Internet Explorer home page: http://www.contoso.com
-
     10. Admin Password: Do not specify an Administrator Password at this time
-
 ### Edit the Windows 10 task sequence
-
 The steps below walk you through the process of editing the Windows 10 reference image task sequence to include the actions required to update the reference image with the latest updates from WSUS, install roles and features, and utilities, and install Microsoft Office 2013.
-
 1.  In the Task Sequences / Windows 10 folder, right-click the Windows 10 Enterprise x64 RTM Default Image task sequence, and select Properties.
-
 2.  On the **Task Sequence** tab, configure the Windows 10 Enterprise x64 RTM Default Image task sequence with the following settings:
-
     1.  State Restore. Enable the Windows Update (Pre-Application Installation) action.
-
         **Note**  
         Enable an action by going to the Options tab and clearing the Disable this step check box.
-
          
-
     2.  State Restore. Enable the Windows Update (Post-Application Installation) action.
-
     3.  State Restore. Enable the Windows Update (Post-Application Installation) action. State Restore. After the **Tattoo** action, add a new **Group** action with the following setting:
-
         -   Name: Custom Tasks (Pre-Windows Update)
-
     4.  State Restore. After Windows Update (Post-Application Installation) action, rename Custom Tasks to Custom Tasks (Post-Windows Update).
-
         **Note**  
         The reason for adding the applications after the Tattoo action but before running Windows Update is simply to save time during the deployment. This way we can add all applications that will upgrade some of the built-in components and avoid unnecessary updating.
-
          
-
     5.  State Restore / Custom Tasks (Pre-Windows Update). Add a new Install Roles and Features action with the following settings:
-
         1.  Name: Install - Microsoft NET Framework 3.5.1
-
         2.  Select the operating system for which roles are to be installed: Windows 8.1
-
         3.  Select the roles and features that should be installed: .NET Framework 3.5 (includes .NET 2.0 and 3.0)
-
         **Important**  
         This is probably the most important step when creating a reference image. Many applications need the .NET Framework, and we strongly recommend having it available in the image. The one thing that makes this different from other components is that .NET Framework 3.5.1 is not included in the WIM file. It is installed from the **Sources\\SxS** folder on the media, and that makes it more difficult to add after the image has been deployed.
-
          
-
         ![figure 7](images/fig8-cust-tasks.png)
-
         Figure 7. The task sequence after creating the Custom Tasks (Pre-Windows Update) group and adding the Install - Microsoft NET Framework 3.5.1 action.
-
     6.  State Restore - Custom Tasks (Pre-Windows Update). After the **Install - Microsoft NET Framework 3.5.1** action, add a new **Install Application** action with the following settings:
-
         1.  Name: Install - Microsoft Visual C++ 2005 SP1 - x86
-
         2.  Install a Single Application: Install - Microsoft Visual C++ 2005 SP1 - x86-x64
-
     7.  Repeat the previous step (add a new **Install Application**) to add the following applications:
-
         1.  Install - Microsoft Visual C++ 2005 SP1 - x64
-
         2.  Install - Microsoft Visual C++ 2008 SP1 - x86
-
         3.  Install - Microsoft Visual C++ 2008 SP1 - x64
-
         4.  Install - Microsoft Visual C++ 2010 SP1 - x86
-
         5.  Install - Microsoft Visual C++ 2010 SP1 - x64
-
         6.  Install - Microsoft Visual C++ 2012 Update 4 - x86
-
         7.  Install - Microsoft Visual C++ 2012 Update 4 - x64
-
         8.  Install - Microsoft Office 2013 Pro Plus - x86
-
     8.  After the Install - Microsoft Office 2013 Pro Plus - x86 action, add a new Restart computer action.
-
 3.  Click **OK**.
-
 ### Optional configuration: Add a suspend action
-
 The goal when creating a reference image is of course to automate everything. But sometimes you have a special configuration or application setup that is too time-consuming to automate. If you need to do some manual configuration, you can add a little-known feature called Lite Touch Installation (LTI) Suspend. If you add the LTISuspend.wsf script as a custom action in the task sequence, it will suspend the task sequence until you click the Resume Task Sequence shortcut icon on the desktop. In addition to using the LTI Suspend feature for manual configuration or installation, you can also use it simply for verifying a reference image before you allow the task sequence to continue and use Sysprep and capture the virtual machine.
-
 ![figure 8](images/fig8-suspend.png)
-
 Figure 8. A task sequence with optional Suspend action (LTISuspend.wsf) added.
-
 ![figure 9](images/fig9-resumetaskseq.png)
-
 Figure 9. The Windows 10 desktop with the Resume Task Sequence shortcut.
-
 ### Edit the Unattend.xml file for Windows 10 Enterprise
-
 When using MDT, you don't need to edit the Unattend.xml file very often because most configurations are taken care of by MDT. However if, for example, you want to configure Internet Explorer 11 behavior, then you can edit the Unattend.xml for this. Editing the Unattend.xml for basic Internet Explorer settings is easy, but for more advanced settings, you will want to use Internet Explorer Administration Kit (IEAK).
-
 **Note**  
 You also can use the Unattend.xml to enable components in Windows 10, like the Telnet Client or Hyper-V client. Normally we prefer to do this via the Install Roles and Features action, or using Deployment Image Servicing and Management (DISM) command-line tools, because then we can add that as an application, being dynamic, having conditions, and so forth. Also, if you are adding packages via Unattend.xml, it is version specific, so Unattend.xml must match the exact version of the operating system you are servicing.
-
  
-
 Follow these steps to configure Internet Explorer settings in Unattend.xml for the Windows 10 Enterprise x64 RTM Default Image task sequence:
-
 1.  Using the Deployment Workbench, right-click the **Windows 10 Enterprise x64 RTM Default Image** task sequence and select **Properties**.
-
 2.  In the **OS Info** tab, click **Edit Unattend.xml**. MDT now generates a catalog file. This will take a few minutes, and then Windows System Image Manager (Windows SIM) will start.
-
 3.  In Windows SIM, expand the **4 specialize** node in the **Answer File** pane and select the amd64\_Microsoft-Windows-IE-InternetExplorer\_neutral entry.
-
 4.  In the **amd64\_Microsoft-Windows-IE-InternetExplorer\_neutral properties** window (right-hand window), set the following values:
-
     -   DisableDevTools: true
-
 5.  Save the Unattend.xml file, and close Windows SIM.
-
 6.  On the Windows 10 Enterprise x64 RTM Default Image Properties, click **OK**.
-
 ![figure 10](images/fig10-unattend.png)
-
 Figure 10. Windows System Image Manager with the Windows 10 Unattend.xml.
-
 ## <a href="" id="sec05"></a>Configure the MDT deployment share rules
-
-
 Understanding rules is critical to successfully using MDT. Rules are configured using the Rules tab of the deployment share's properties. The Rules tab is essentially a shortcut to edit the CustomSettings.ini file that exists in the E:\\MDTBuildLab\\Control folder. This section discusses how to configure the MDT deployment share rules as part of your Windows 10 Enterprise deployment.
-
 ### MDT deployment share rules overview
-
 In MDT, there are always two rule files: the CustomSettings.ini file and the Bootstrap.ini file. You can add almost any rule to either; however, the Bootstrap.ini file is copied from the Control folder to the boot image, so the boot image needs to be updated every time you change that file.
-
 For that reason, add only a minimal set of rules to Bootstrap.ini, such as which deployment server and share to connect to - the DEPLOYROOT value. Put the other rules in CustomSettings.ini because that file is updated immediately when you click OK. By taking the following steps, you will configure the rules for the MDT Build Lab deployment share:
-
 1.  Using the Deployment Workbench, right-click the **MDT Build Lab deployment share** and select **Properties**.
-
 2.  Select the **Rules** tab and modify using the following information:
-
     ``` syntax
     [Settings]
     Priority=Default
@@ -561,13 +328,9 @@ For that reason, add only a minimal set of rules to Bootstrap.ini, such as which
     SkipCapture=NO
     SkipFinalSummary=YES
     ```
-
     ![figure 11](images/mdt-08-fig14.png)
-
     Figure 11. The server-side rules for the MDT Build Lab deployment share.
-
 3.  Click **Edit Bootstrap.ini** and modify using the following information:
-
     ``` syntax
     Settings]
     Priority=Default
@@ -578,106 +341,62 @@ For that reason, add only a minimal set of rules to Bootstrap.ini, such as which
     UserPassword=P@ssw0rd
     SkipBDDWelcome=YES
     ```
-
     ![figure 12](images/mdt-08-fig15.png)
-
     Figure 12. The boot image rules for the MDT Build Lab deployment share.
-
     **Note**  
     For security reasons, you normally don't add the password to the Bootstrap.ini file; however, because this deployment share is for creating reference image builds only, and should not be published to the production network, it is acceptable to do so in this situation.
-
      
-
 4.  In the **Windows PE** tab, in the **Platform** drop-down list, select **x86**.
-
 5.  In the **Lite Touch Boot Image Settings** area, configure the following settings:
-
     1.  Image description: MDT Build Lab x86
-
     2.  ISO file name: MDT Build Lab x86.iso
-
 6.  In the **Windows PE** tab, in the **Platform** drop-down list, select **x64**.
-
 7.  In the **Lite Touch Boot Image Settings** area, configure the following settings:
-
     1.  Image description: MDT Build Lab x64
-
     2.  ISO file name: MDT Build Lab x64.iso
-
 8.  Click **OK**.
-
 **Note**  
 In MDT, the x86 boot image can deploy both x86 and x64 operating systems (except on computers based on Unified Extensible Firmware Interface).
-
  
-
 ### Update the deployment share
-
 After the deployment share has been configured, it needs to be updated. This is the process when the Windows Windows PE boot images are created.
-
 1.  Using the Deployment Workbench, right-click the **MDT Build Lab deployment share** and select **Update Deployment Share**.
-
 2.  Use the default options for the Update Deployment Share Wizard.
-
 **Note**  
 The update process will take 5 to 10 minutes.
-
  
-
 ### The rules explained
-
 Now that the MDT Build Lab deployment share (the share used to create the reference images) has been configured, it is time to explain the various settings used in the Bootstrap.ini and CustomSettings.ini files.
-
 The Bootstrap.ini and CustomSettings.ini files work together. The Bootstrap.ini file is always present on the boot image and is read first. The basic purpose for Bootstrap.ini is to provide just enough information for MDT to find the CustomSettings.ini.
-
 The CustomSettings.ini file is normally stored on the server, in the Deployment share\\Control folder, but also can be stored on the media (when using offline media).
-
 **Note**  
 The settings, or properties, that are used in the rules (CustomSettings.ini and Bootstrap.ini) are listed in the MDT documentation, in the Microsoft Deployment Toolkit Reference / Properties / Property Definition section.
-
  
-
 ### The Bootstrap.ini file
-
 The Bootstrap.ini file is available via the deployment share's Properties dialog box, or via the E:\\MDTBuildLab\\Control folder on MDT01.
-
 ``` syntax
 [Settings]
 Priority=Default
-
 [Default]
 DeployRoot=\\MDT01\MDTBuildLab$
 UserDomain=CONTOSO
 UserID=MDT_BA
 UserPassword=P@ssw0rd
-
 SkipBDDWelcome=YES
 ```
-
 So, what are these settings?
-
 -   **Priority.** This determines the order in which different sections are read. This Bootstrap.ini has only one section, named \[Default\].
-
 -   **DeployRoot.** This is the location of the deployment share. Normally, this value is set by MDT, but you need to update the DeployRoot value if you move to another server or other share. If you don't specify a value, the Windows Deployment Wizard prompts you for a location.
-
 -   **UserDomain, UserID, and UserPassword.** These values are used for automatic log on to the deployment share. Again, if they are not specified, the wizard prompts you.
-
     **Note**  
     Caution is advised. These values are stored in clear text on the boot image. Use them only for the MDT Build Lab deployment share and not for the MDT Production deployment share that you learn to create in the next topic.
-
      
-
 -   **SkipBDDWelcome.** Even if it is nice to be welcomed every time we start a deployment, we prefer to skip the initial welcome page of the Windows Deployment Wizard.
-
 **Note**  
 All properties beginning with "Skip" control only whether to display that pane in the Windows Deployment Wizard. Most of the panes also require you to actually set one or more values.
-
  
-
 ### The CustomSettings.ini file
-
 The CustomSettings.ini file, whose content you see on the Rules tab of the deployment share Properties dialog box, contains most of the properties used in the configuration.
-
 ``` syntax
 [Settings]
 Priority=Default
@@ -710,153 +429,76 @@ SkipRoles=YES
 SkipCapture=NO
 SkipFinalSummary=YES
 ```
-
 -   **Priority.** Has the same function as in Bootstrap.ini. Priority determines the order in which different sections are read. This CustomSettings.ini has only one section, named \[Default\]. In general, if you have multiple sections that set the same value, the value from the first section (higher priority) wins. The rare exceptions are listed in the ZTIGather.xml file.
-
 -   **\_SMSTSORGNAME.** The organization name displayed in the task sequence progress bar window during deployment.
-
 -   **UserDataLocation.** Controls the settings for user state backup. You do not need to use when building and capturing a reference image.
-
 -   **DoCapture.** Configures the task sequence to run the System Preparation (Sysprep) tool and capture the image to a file when the operating system is installed.
-
 -   **OSInstall.** Must be set to Y or YES (the code actually just looks for the Y character) for the setup to proceed.
-
 -   **AdminPassword.** Sets the local Administrator account password.
-
 -   **TimeZoneName.** Establishes the time zone to use. Don't confuse this value with TimeZone, which is only for legacy operating systems (Windows 7 and Windows Server 2003).
-
     **Note**  
     The easiest way to find the current time zone name on a Windows 10 machine is to run tzutil /g in a command prompt. You can also run tzutil /l to get a listing of all available time zone names.
-
      
-
 -   **JoinWorkgroup.** Configures Windows to join a workgroup.
-
 -   **HideShell.** Hides the Windows Shell during deployment. This is especially useful for Windows 8.1 deployments in which the deployment wizard will otherwise appear behind the tiles.
-
 -   **FinishAction.** Instructs MDT what to do when the task sequence is complete.
-
 -   **DoNotCreateExtraPartition.** Configures the task sequence not to create the extra partition for BitLocker. There is no need to do this for your reference image.
-
 -   **WSUSServer.** Specifies which Windows Server Update Services (WSUS) server (and port, if needed) to use during the deployment. Without this option MDT will use Microsoft Update directly, which will increase deployment time and limit your options of controlling which updates are applied.
-
 -   **SLSHARE.** Instructs MDT to copy the log files to a server share if something goes wrong during deployment, or when a deployment is successfully completed.
-
 -   **ApplyGPOPack.** Allows you to deploy local group policies created by Microsoft Security Compliance Manager (SCM).
-
 -   **SkipAdminPassword.** Skips the pane that asks for the Administrator password.
-
 -   **SkipProductKey.** Skips the pane that asks for the product key.
-
 -   **SkipComputerName.** Skips the Computer Name pane.
-
 -   **SkipDomainMemberShip.** Skips the Domain Membership pane. If set to Yes, you need to configure either the JoinWorkgroup value or the JoinDomain, DomainAdmin, DomainAdminDomain, and DomainAdminPassword properties.
-
 -   **SkipUserData.** Skips the pane for user state migration.
-
 -   **SkipLocaleSelection.** Skips the pane for selecting language and keyboard settings.
-
 -   **SkipTimeZone.** Skips the pane for setting the time zone.
-
 -   **SkipApplications.** Skips the Applications pane.
-
 -   **SkipBitLocker.** Skips the BitLocker pane.
-
 -   **SkipSummary.** Skips the initial Windows Deployment Wizard summary pane.
-
 -   **SkipRoles.** Skips the Install Roles and Features pane.
-
 -   **SkipCapture.** Skips the Capture pane.
-
 -   **SkipFinalSummary.** Skips the final Windows Deployment Wizard summary. Because you use FinishAction=Shutdown, you don't want the wizard to stop in the end so that you need to click OK before the machine shuts down.
-
 ## <a href="" id="sec06"></a>Build the Windows 10 reference image
-
-
 Once you have created your task sequence, you are ready to create the Windows 10 reference image. This will be performed by launching the task sequence from a virtual machine which will then automatically perform the reference image creation and capture process.
-
 This steps below outline the process used to boot a virtual machine using an ISO boot image created by MDT, and then execute the reference image task sequence image to create and capture the Windows 10 reference image.
-
 1.  Copy the E:\\MDTBuildLab\\Boot\\MDT Build Lab x86.iso on MDT01 to C:\\ISO on the Hyper-V host.
-
     **Note**  
     Remember, in MDT you can use the x86 boot image to deploy both x86 and x64 operating system images. That's why you can use the x86 boot image instead of the x64 boot image.
-
      
-
 2.  Create a virtual machine with the following settings:
-
     1.  Name: REFW10X64-001
-
     2.  Location: C:\\VMs
-
     3.  Memory: 1024 MB
-
     4.  Network: External (The network that is connected to the same infrastructure as MDT01 is)
-
     5.  Hard disk: 60 GB (dynamic disk)
-
     6.  Image file: C:\\ISO\\MDT Build Lab x86.iso
-
 3.  Take a snapshot of the REFW10X64-001 virtual machine, and name it **Clean with MDT Build Lab x86 ISO**.
-
     **Note**  
     Taking a snapshot is useful if you need to restart the process and want to make sure you can start clean.
-
      
-
 4.  Start the REFW10X64-001 virtual machine. After booting into Windows PE, complete the Windows Deployment Wizard using the following settings:
-
     1.  Select a task sequence to execute on this computer: Windows 10 Enterprise x64 RTM Default Image
-
     2.  Specify whether to capture an image: Capture an image of this reference computer
-
         -   Location: \\\\MDT01\\MDTBuildLab$\\Captures
-
     3.  File name: REFW10X64-001.wim
-
         ![figure 13](images/fig13-captureimage.png)
-
         Figure 13. The Windows Deployment Wizard for the Windows 10 reference image.
-
 5.  The setup now starts and does the following:
-
     1.  Installs the Windows 10 Enterprise operating system.
-
     2.  Installs the added applications, roles, and features.
-
     3.  Updates the operating system via your local Windows Server Update Services (WSUS) server.
-
     4.  Stages Windows PE on the local disk.
-
     5.  Runs System Preparation (Sysprep) and reboots into Windows PE.
-
     6.  Captures the installation to a Windows Imaging (WIM) file.
-
     7.  Turns off the virtual machine.
-
 After some time, you will have a Windows 10 Enterprise x64 image that is fully patched and has run through Sysprep, located in the E:\\MDTBuildLab\\Captures folder on your deployment server. The file name is REFW10X64-001.wim.
-
 ## Related topics
-
-
 [Get started with the Microsoft Deployment Toolkit (MDT)](get-started-with-the-microsoft-deployment-toolkit.md)
-
 [Deploy a Windows 10 image using MDT 2013 Update 2](deploy-a-windows-10-image-using-mdt.md)
-
 [Build a distributed environment for Windows 10 deployment](build-a-distributed-environment-for-windows-10-deployment.md)
-
 [Refresh a Windows 7 computer with Windows 10](refresh-a-windows-7-computer-with-windows-10.md)
-
 [Replace a Windows 7 computer with a Windows 10 computer](replace-a-windows-7-computer-with-a-windows-10-computer.md)
-
 [Configure MDT settings](configure-mdt-2013-settings.md)
-
  
-
  
-
-
-
-
-

windows/deploy/deploy-a-windows-10-image-using-mdt.md

@@ -2,455 +2,237 @@
 title: Deploy a Windows 10 image using MDT 2013 Update 2 (Windows 10)
 description: This topic will show you how to take your reference image for Windows 10, and deploy that image to your environment using the Microsoft Deployment Toolkit (MDT), and MDT 2013 Update 2 specifically.
 ms.assetid: 1d70a3d8-1b1d-4051-b656-c0393a93f83c
+ms.pagetype: mdt
 keywords: ["deployment, automate, tools, configure"]
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
 author: mtniehaus
 ---
-
 # Deploy a Windows 10 image using MDT 2013 Update 2
-
-
 **Applies to**
-
 -   Windows 10
-
 This topic will show you how to take your reference image for Windows 10, and deploy that image to your environment using the Microsoft Deployment Toolkit (MDT), and MDT 2013 Update 2 specifically. You will prepare for this by creating a MDT deployment share that is used solely for image deployment. Separating the processes of creating reference images from the processes used to deploy them in production allows greater control of on both processes. You will then configure the deployment share, create a new task sequence, add applications, add drivers, add rules, and configure Active Directory permissions for deployment.
-
 For the purposes of this topic, we will use three machines: DC01, MDT01, and PC0005. DC01 is a domain controller, MDT01 is a Windows Server 2012 R2 standard server, and PC0005 is a blank machine to which you deploy Windows 10. MDT01 and PC0005 are members of the domain contoso.com for the fictitious Contoso Corporation.
-
 **Note**  
 For important details about the setup for the steps outlined in this article, please see [Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-10-with-the-microsoft-deployment-toolkit.md).
-
  
-
 ![figure 1](images/mdt-07-fig01.png)
-
 Figure 1. The machines used in this topic.
-
 ## <a href="" id="sec01"></a>Step 1: Configure Active Directory permissions
-
-
 These steps will show you how to configure an Active Directory account with the permissions required to deploy a Windows 10 machine to the domain using MDT. These steps assume you have downloaded the sample [Set-OUPermissions.ps1 script](http://go.microsoft.com/fwlink/p/?LinkId=619362) and copied it to C:\\Setup\\Scripts on DC01. The account is used for Windows Preinstallation Environment (Windows PE) to connect to MDT01. In order for MDT to join machines into the contoso.com domain you need to create an account and configure permissions in Active Directory.
-
 1.  On DC01, using Active Directory User and Computers, browse to **contoso.com / Contoso / Service Accounts**.
-
 2.  Select the **Service Accounts** organizational unit (OU) and create the MDT\_JD account using the following settings:
-
     1.  Name: MDT\_JD
-
     2.  User logon name: MDT\_JD
-
     3.  Password: P@ssw0rd
-
     4.  User must change password at next logon: Clear
-
     5.  User cannot change password: Select
-
     6.  Password never expires: Select
-
 3.  In an elevated Windows PowerShell prompt (run as Administrator), run the following commands and press **Enter** after each command:
-
     ``` syntax
     Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Force
     Set-Location C:\Setup\Scripts
     .\Set-OUPermissions.ps1 -Account MDT_JD 
     -TargetOU "OU=Workstations,OU=Computers,OU=Contoso"
     ```
-
 4.  The Set-OUPermissions.ps1 script allows the MDT\_JD user account permissions to manage computer accounts in the Contoso / Computers OU. Below you find a list of the permissions being granted:
-
     1.  Scope: This object and all descendant objects
-
         1.  Create Computer objects
-
         2.  Delete Computer objects
-
     2.  Scope: Descendant Computer objects
-
         1.  Read All Properties
-
         2.  Write All Properties
-
         3.  Read Permissions
-
         4.  Modify Permissions
-
         5.  Change Password
-
         6.  Reset Password
-
         7.  Validated write to DNS host name
-
         8.  Validated write to service principal name
-
 ## <a href="" id="sec02"></a>Step 2: Set up the MDT production deployment share
-
-
 When you are ready to deploy Windows 10 in a production environment, you will first create a new MDT deployment share. You should not use the same deployment share that you used to create the reference image for a production deployment. For guidance on creating a custom Windows 10 image, see [Create a Windows 10 reference image](create-a-windows-10-reference-image.md).
-
 ### Create the MDT production deployment share
-
 The steps for creating the deployment share for production are the same as when you created the deployment share for creating the custom reference image:
-
 1.  On MDT01, log on as Administrator in the CONTOSO domain using a password of **P@ssw0rd.**
-
 2.  Using the Deployment Workbench, right-click **Deployment Shares** and select **New Deployment Share**.
-
 3.  On the **Path** page, in the **Deployment share path** text box, type **E:\\MDTProduction** and click **Next**.
-
 4.  On the **Share** page, in the **Share name** text box, type **MDTProduction$** and click **Next**.
-
 5.  On the **Descriptive Name** page, in the **Deployment share description** text box, type **MDT Production** and click **Next**.
-
 6.  On the **Options** page, accept the default settings and click **Next** twice, and then click **Finish**.
-
 7.  Using File Explorer, verify that you can access the **\\\\MDT01\\MDTProduction$** share.
-
 ## <a href="" id="sec03"></a>Step 3: Add a custom image
-
-
 The next step is to add a reference image into the deployment share with the setup files required to successfully deploy Windows 10. When adding a custom image, you still need to copy setup files (an option in the wizard) because Windows 10 stores additional components in the Sources\\SxS folder which is outside the image and may be required when installing components.
-
 ### Add the Windows 10 Enterprise x64 RTM custom image
-
 In these steps, we assume that you have completed the steps in the [Create a Windows 10 reference image](create-a-windows-10-reference-image.md) topic, so you have a Windows 10 reference image in the E:\\MDTBuildLab\\Captures folder on MDT01.
-
 1.  Using the Deployment Workbench, expand the **Deployment Shares** node, and then expand **MDT Production**; select the **Operating Systems** node, and create a folder named **Windows 10**.
-
 2.  Right-click the **Windows 10** folder and select **Import Operating System**.
-
 3.  On the **OS Type** page, select **Custom image file** and click **Next**.
-
 4.  On the **Image** page, in the **Source file** text box, browse to **E:\\MDTBuildLab\\Captures\\REFW10X64-001.wim** and click **Next**.
-
 5.  On the **Setup** page, select the **Copy Windows 7, Windows Server 2008 R2, or later setup files from the specified path** option; in the **Setup source directory** text box, browse to **E:\\MDTBuildLab\\Operating Systems\\W10EX64RTM** and click **Next**.
-
 6.  On the **Destination** page, in the **Destination directory name** text box, type **W10EX64RTM**, click **Next** twice, and then click **Finish**.
-
 7.  After adding the operating system, double-click the added operating system name in the **Operating Systems / Windows 10** node and change the name to match the following: **Windows 10 Enterprise x64 RTM Custom Image**.
-
 **Note**  
 The reason for adding the setup files has changed since earlier versions of MDT. MDT 2010 used the setup files to install Windows. MDT uses DISM to apply the image; however, you still need the setup files because some components in roles and features are stored outside the main image.
-
  
-
 ![figure 2](images/fig2-importedos.png)
-
 Figure 2. The imported operating system after renaming it.
-
 ## <a href="" id="sec04"></a>Step 4: Add an application
-
-
 When you configure your MDT Build Lab deployment share, you will also add any applications to the new deployment share before creating your task sequence. This section walks you through the process of adding an application to the MDT Production deployment share using Adobe Reader as an example.
-
 ### Create the install: Adobe Reader XI x86
-
 In this example, we assume that you have downloaded the Adobe Reader XI installation file (AdbeRdr11000\_eu\_ES.msi) to E:\\Setup\\Adobe Reader on MDT01.
-
 1.  Using the Deployment Workbench, expand the **MDT Production** node and navigate to the **Applications** node.
-
 2.  Right-click the **Applications** node, and create a new folder named **Adobe**.
-
 3.  In the **Applications** node, right-click the **Adobe** folder and select **New Application**.
-
 4.  On the **Application Type** page, select the **Application with source files** option and click **Next**.
-
 5.  On the **Details** page, in the **Application** name text box, type **Install - Adobe Reader XI - x86** and click **Next**.
-
 6.  On the **Source** page, in the **Source Directory** text box, browse to **E:\\Setup\\Adobe Reader XI** and click **Next**.
-
 7.  On the **Destination** page, in the **Specify the name of the directory that should be created** text box, type **Install - Adobe Reader XI - x86** and click **Next**.
-
 8.  On the **Command Details** page, in the **Command Line** text box, type **msiexec /i AdbeRdr11000\_eu\_ES.msi /q**, click **Next** twice, and then click **Finish**.
-
 ![figure 3](images/mdt-07-fig03.png)
-
 Figure 3. The Adobe Reader application added to the Deployment Workbench.
-
 ## <a href="" id="sec05"></a>Step 5: Prepare the drivers repository
-
-
 In order to deploy Windows 10 with MDT 2013 Update 2 successfully, you need drivers for the boot images and for the actual operating system. This section will show you how to add drivers for the boot image and operating system, using the following hardware models as examples:
-
 -   Lenovo ThinkPad T420
-
 -   Dell Latitude E6440
-
 -   HP EliteBook 8560w
-
 -   Microsoft Surface Pro
-
 For boot images, you need to have storage and network drivers; for the operating system, you need to have the full suite of drivers.
-
 **Note**  
 You should only add drivers to the Windows PE images if the default drivers don't work. Adding drivers that are not necessary will only make the boot image larger and potentially delay the download time.
-
  
-
 ### Create the driver source structure in the file system
-
 The key to successful management of drivers for MDT 2013 Update 2, as well as for any other deployment solution, is to have a really good driver repository. From this repository, you import drivers into MDT for deployment, but you should always maintain the repository for future use.
-
 1.  On MDT01, using File Explorer, create the **E:\\Drivers** folder.
-
 2.  In the **E:\\Drivers** folder, create the following folder structure:
-
     1.  WinPE x86
-
     2.  WinPE x64
-
     3.  Windows 10 x64
-
 3.  In the new Windows 10 x64 folder, create the following folder structure:
-
     -   Dell
-
         -   Latitude E6440
-
     -   HP
-
         -   HP EliteBook 8560w
-
     -   Lenovo
-
         -   ThinkPad T420 (4178)
-
     -   Microsoft Corporation
-
         -   Surface Pro 3
-
 **Note**  
 Even if you are not going to use both x86 and x64 boot images, we still recommend that you add the support structure for future use.
-
  
-
 ### Create the logical driver structure in MDT 2013 Update 2
-
 When you import drivers to the MDT 2013 Update 2 driver repository, MDT creates a single instance folder structure based on driver class names. However, you can, and should, mimic the driver structure of your driver source repository in the Deployment Workbench. This is done by creating logical folders in the Deployment Workbench.
-
 1.  On MDT01, using Deployment Workbench, select the **Out-of-Box Drivers** node.
-
 2.  In the **Out-Of-Box Drivers** node, create the following folder structure:
-
     1.  WinPE x86
-
     2.  WinPE x64
-
     3.  Windows 10 x64
-
 3.  In the **Windows 10 x64** folder, create the following folder structure:
-
     -   Dell Inc.
-
         -   Latitude E6440
-
     -   Hewlett-Packard
-
         -   HP EliteBook 8560w
-
     -   Lenovo
-
         -   4178
-
     -   Microsoft Corporation
-
         -   Surface Pro 3
-
 The preceding folder names are selected because they match the actual make and model values that MDT reads from the machines during deployment. You can find out the model values for your machines via the following command in Windows PowerShell:
-
 ``` syntax
 Get-WmiObject -Class:Win32_ComputerSystem
 ```
-
 Or, you can use this command in a normal command prompt:
-
 ``` syntax
 wmic csproduct get name
 ```
-
 If you want a more standardized naming convention, try the ModelAliasExit.vbs script from the Deployment Guys blog post entitled [Using and Extending Model Aliases for Hardware Specific Application Installation](http://go.microsoft.com/fwlink/p/?LinkId=619536).
-
 ![figure 4](images/fig4-oob-drivers.png)
-
 Figure 4. The Out-of-Box Drivers structure in Deployment Workbench.
-
 ### Create the selection profiles for boot image drivers
-
 By default, MDT adds any storage and network drivers that you import to the boot images. However, you should add only the drivers that are necessary to the boot image. You can control which drivers are added by using selection profiles.
-
 The drivers that are used for the boot images (Windows PE) are Windows 10 drivers. If you can’t locate Windows 10 drivers for your device, a Windows 7 or Windows 8.1 driver will most likely work, but Windows 10 drivers should be your first choice.
-
 1.  On MDT01, using the Deployment Workbench, in the **MDT Production** node, expand the **Advanced Configuration** node, right-click the **Selection Profiles** node, and select **New Selection Profile**.
-
 2.  In the New Selection Profile Wizard, create a selection profile with the following settings:
-
     1.  Selection Profile name: WinPE x86
-
     2.  Folders: Select the WinPE x86 folder in Out-of-Box Drivers.
-
 3.  Again, right-click the **Selection Profiles** node, and select **New Selection Profile**.
-
 4.  In the New Selection Profile Wizard, create a selection profile with the following settings:
-
     1.  Selection Profile name: WinPE x64
-
     2.  Folders: Select the WinPE x64 folder in Out-of-Box Drivers.
-
 ![figure 5](images/fig5-selectprofile.png)
-
 Figure 5. Creating the WinPE x64 selection profile.
-
 ### Extract and import drivers for the x64 boot image
-
 Windows PE supports all the hardware models that we have, but here you learn to add boot image drivers to accommodate any new hardware that might require additional drivers. In this example, you add the latest Intel network drivers to the x64 boot image.
-
 In these steps, we assume you have downloaded PROWinx64.exe from Intel.com and saved it to a temporary folder.
-
 1.  Extract PROWinx64.exe to a temporary folder - in this example to the **C:\\Tmp\\ProWinx64** folder.
-
 2.  Using File Explorer, create the **E:\\Drivers\\WinPE x64\\Intel PRO1000** folder.
-
 3.  Copy the content of the **C:\\Tmp\\PROWinx64\\PRO1000\\Winx64\\NDIS64** folder to the **E:\\Drivers\\WinPE x64\\Intel PRO1000** folder.
-
 4.  Using Deployment Workbench, expand the **Out-of-Box Drivers** node, right-click the **WinPE x64** node, and select **Import Drivers**. Use the following setting for the Import Drivers Wizard:
-
     -   Driver source directory: **E:\\Drivers\\WinPE x64\\Intel PRO1000**
-
 ### Download, extract, and import drivers
-
 ### For the ThinkPad T420
-
 For the Lenovo T420 model, you use the Lenovo ThinkVantage Update Retriever software to download the drivers. With Update Retriever, you need to specify the correct Lenovo Machine Type for the actual hardware (the first four characters of the model name). As an example, the Lenovo T420 model has the 4178B9G model name, meaning the Machine Type is 4178.
-
 To get the updates, you download the drivers from the Lenovo ThinkVantage Update Retriever using its export function. You can download the drivers from the [Lenovo website](http://go.microsoft.com/fwlink/p/?LinkId=619543).
-
 In these steps, we assume you have downloaded and extracted the drivers using ThinkVantage Update Retriever v5.0 to the E:\\Drivers\\Lenovo\\ThinkPad T420 (4178) folder.
-
 1.  On MDT01, using the Deployment Workbench, in the **MDT Production** node, expand the **Out-Of-Box Drivers** node, and expand the **Lenovo** node.
-
 2.  Right-click the **4178** folder and select **Import Drivers**; use the following setting for the Import Drivers Wizard:
-
     -   Driver source directory: **E:\\Drivers\\Windows 10 x64\\Lenovo\\ThinkPad T420 (4178)**
-
 ### For the Latitude E6440
-
 For the Dell Latitude E6440 model, you use the Dell Driver CAB file, which is accessible via the [Dell TechCenter website](http://go.microsoft.com/fwlink/p/?LinkId=619544).
-
 In these steps, we assume you have downloaded and extracted the CAB file for the Latitude E6440 model to the E:\\Drivers\\Dell\\Latitude E6440 folder.
-
 1.  On **MDT01**, using the **Deployment Workbench**, in the **MDT Production** node, expand the **Out-Of-Box Drivers** node, and expand the **Dell** node.
-
 2.  Right-click the **Latitude E6440** folder and select **Import Drivers**; use the following setting for the Import Drivers Wizard:
-
     -   Driver source directory: **E:\\Drivers\\Windows 10 x64\\Dell\\Latitude E6440**
-
 ### For the HP EliteBook 8560w
-
 For the HP EliteBook 8560w, you use HP SoftPaq Download Manager to get the drivers. The HP SoftPaq Download Manager can be accessed on the [HP Support site](http://go.microsoft.com/fwlink/p/?LinkId=619545).
-
 In these steps, we assume you have downloaded and extracted the drivers for the HP EliteBook 8650w model to the E:\\Drivers\\Windows 10 x64\\HP\\HP EliteBook 8560w folder.
-
 1.  On **MDT01**, using the **Deployment Workbench**, in the **MDT Production** node, expand the **Out-Of-Box Drivers** node, and expand the **Hewlett-Packard** node.
-
 2.  Right-click the **HP EliteBook 8560w** folder and select **Import Drivers**; use the following setting for the Import Drivers Wizard:
-
     -   Driver source directory: **E:\\Drivers\\Windows 10 x64\\HP\\HP EliteBook 8560w**
-
 ### For the Microsoft Surface Pro 3
-
 For the Microsoft Surface Pro model, you find the drivers on the Microsoft website. In these steps we assume you have downloaded and extracted the Surface Pro 3 drivers to the E:\\Drivers\\Windows 10 x64\\Microsoft\\Surface Pro 3 folder.
-
 1.  On MDT01, using the Deployment Workbench, in the **MDT Production** node, expand the **Out-Of-Box Drivers** node, and expand the **Microsoft** node.
-
 2.  Right-click the **Surface Pro 3** folder and select **Import Drivers**; use the following setting for the Import Drivers Wizard:
-
     -   Driver source directory: **E:\\Drivers\\Windows 10 x64\\Microsoft\\Surface Pro 3**
-
 ## <a href="" id="sec06"></a>Step 6: Create the deployment task sequence
-
-
 This section will show you how to create the task sequence used to deploy your production Windows 10 reference image. You will then configure the tasks sequence to enable patching via a Windows Server Update Services (WSUS) server.
-
 ### Create a task sequence for Windows 10 Enterprise
-
 1.  Using the Deployment Workbench, select **Task Sequences** in the **MDT Production** node, and create a folder named **Windows 10**.
-
 2.  Right-click the new **Windows 10** folder and select **New Task Sequence**. Use the following settings for the New Task Sequence Wizard:
-
     1.  Task sequence ID: W10-X64-001
-
     2.  Task sequence name: Windows 10 Enterprise x64 RTM Custom Image
-
     3.  Task sequence comments: Production Image
-
     4.  Template: Standard Client Task Sequence
-
     5.  Select OS: Windows 10 Enterprise x64 RTM Custom Image
-
     6.  Specify Product Key: Do not specify a product key at this time
-
     7.  Full Name: Contoso
-
     8.  Organization: Contoso
-
     9.  Internet Explorer home page: about:blank
-
     10. Admin Password: Do not specify an Administrator Password at this time
-
 ### Edit the Windows 10 task sequence
-
 1.  Right-click the **Windows 10 Enterprise x64 RTM Custom Image** task sequence, and select **Properties**.
-
 2.  On the **Task Sequence** tab, configure the **Windows 10 Enterprise x64 RTM Custom Image** task sequence with the following settings:
-
     1.  Preinstall. After the **Enable BitLocker (Offline)** action, add a **Set Task Sequence Variable** action with the following settings:
-
         1.  Name: Set DriverGroup001
-
         2.  Task Sequence Variable: DriverGroup001
-
         3.  Value: Windows 10 x64\\%Make%\\%Model%
-
     2.  Configure the **Inject Drivers** action with the following settings:
-
         1.  Choose a selection profile: Nothing
-
         2.  Install all drivers from the selection profile
-
             **Note**  
             The configuration above indicates that MDT should only use drivers from the folder specified by the DriverGroup001 property, which is defined by the "Choose a selection profile: Nothing" setting, and that MDT should not use plug and play to determine which drivers to copy, which is defined by the "Install all drivers from the selection profile" setting.
-
              
-
     3.  State Restore. Enable the **Windows Update (Pre-Application Installation)** action.
-
     4.  State Restore. Enable the **Windows Update (Post-Application Installation)** action.
-
 3.  Click **OK**.
-
 ![figure 6](images/fig6-taskseq.png)
-
 Figure 6. The task sequence for production deployment.
-
 ## <a href="" id="sec07"></a>Step 7: Configure the MDT production deployment share
-
-
 In this section, you will learn how to configure the MDT Build Lab deployment share with the rules required to create a simple and dynamic deployment process. This includes configuring commonly used rules and an explanation of how these rules work.
-
 ### Configure the rules
-
 1.  On MDT01, using File Explorer, copy the following files from the **D:\\Setup\\Sample Files\\MDT Production\\Control** folder to **E:\\MDTProduction\\Control**. Overwrite the existing files.
-
     1.  Bootstrap.ini
-
     2.  CustomSettings.ini
-
 2.  Right-click the **MDT Production** deployment share and select **Properties**.
-
 3.  Select the **Rules** tab and modify using the following information:
-
     ``` syntax
     [Settings]
     Priority=Default
@@ -486,9 +268,7 @@ In this section, you will learn how to configure the MDT Build Lab deployment sh
     SkipCapture=YES
     SkipFinalSummary=NO
     ```
-
 4.  Click **Edit Bootstrap.ini** and modify using the following information:
-
     ``` syntax
     [Settings]
     Priority=Default
@@ -498,73 +278,43 @@ In this section, you will learn how to configure the MDT Build Lab deployment sh
     UserID=MDT_BA
     SkipBDDWelcome=YES
     ```
-
 5.  In the **Windows PE** tab, in the **Platform** drop-down list, make sure **x86** is selected.
-
 6.  In the **General** sub tab, configure the following settings:
-
     -   In the **Lite Touch Boot Image Settings** area:
-
         1.  Image description: MDT Production x86
-
         2.  ISO file name: MDT Production x86.iso
-
         **Note**  
         Because you are going to use Pre-Boot Execution Environment (PXE) later to deploy the machines, you do not need the ISO file; however, we recommend creating ISO files because they are useful when troubleshooting deployments and for quick tests.
-
          
-
 7.  In the **Drivers and Patches** sub tab, select the **WinPE x86** selection profile and select the **Include all drivers from the selection profile** option.
-
 8.  In the **Windows PE** tab, in the **Platform** drop-down list, select **x64**.
-
 9.  In the **General** sub tab, configure the following settings:
-
     -   In the **Lite Touch Boot Image Settings** area:
-
         1.  Image description: MDT Production x64
-
         2.  ISO file name: MDT Production x64.iso
-
 10. In the **Drivers and Patches** sub tab, select the **WinPE x64** selection profile and select the **Include all drivers from the selection profile** option.
-
 11. In the **Monitoring** tab, select the **Enable monitoring for this deployment share** check box.
-
 12. Click **OK**.
-
 **Note**  
 It will take a while for the Deployment Workbench to create the monitoring database and web service.
-
  
-
 ![figure 8](images/mdt-07-fig08.png)
-
 Figure 7. The Windows PE tab for the x64 boot image.
-
 ### The rules explained
-
 The rules for the MDT Production deployment share are somewhat different from those for the MDT Build Lab deployment share. The biggest differences are that you deploy the machines into a domain instead of a workgroup and that you do not automate the logon.
-
 ### The Bootstrap.ini file
-
 This is the MDT Production Bootstrap.ini without the user credentials (except domain information):
-
 ``` syntax
 [Settings]
 Priority=Default
 [Default]
 DeployRoot=\\MDT01\MDTProduction$
-
 UserDomain=CONTOSO
 UserID=MDT_BA
-
 SkipBDDWelcome=YES
 ```
-
 ### The CustomSettings.ini file
-
 This is the CustomSettings.ini file with the new join domain information:
-
 ``` syntax
 [Settings]
 Priority=Default
@@ -601,317 +351,156 @@ SkipCapture=YES
 SkipFinalSummary=NO
 EventService=http://MDT01:9800
 ```
-
 The additional properties to use in the MDT Production rules file are as follows:
-
 -   **JoinDomain.** The domain to join.
-
 -   **DomainAdmin.** The account to use when joining the machine to the domain.
-
 -   **DomainAdminDomain.** The domain for the join domain account.
-
 -   **DomainAdminPassword.** The password for the join domain account.
-
 -   **MachineObjectOU.** The organizational unit (OU) to which to add the computer account.
-
 -   **ScanStateArgs.** Arguments for the User State Migration Tool (USMT) ScanState command.
-
 -   **USMTMigFiles(\*).** List of USMT templates (controlling what to backup and restore).
-
 -   **EventService.** Activates logging information to the MDT monitoring web service.
-
 ### Optional deployment share configuration
-
 If your organization has a Microsoft Software Assurance agreement, you also can subscribe to the additional Microsoft Desktop Optimization Package (MDOP) license (at an additional cost). Included in MDOP is Microsoft Diagnostics and Recovery Toolkit (DaRT), which contains tools that can help you troubleshoot MDT deployments, as well as troubleshoot Windows itself.
-
 ### Add DaRT 10 to the boot images
-
 If you have licensing for MDOP and DaRT, you can add DaRT to the boot images using the steps in this section. If you do not have DaRT licensing, or don't want to use it, simply skip to the next section, [Update the Deployment Share](#bkmk-update-deployment). To enable the remote connection feature in MDT 2013 Update 2, you need to do the following:
-
 -   Install DaRT 10 (part of MDOP 2015 R1).
-
 -   Copy the two tools CAB files (Toolsx86.cab and Toolsx64.cab) to the deployment share.
-
 -   Configure the deployment share to add DaRT.
-
 In these steps, we assume that you downloaded MDOP 2015 R1 and copied DaRT 10 to the E:\\Setup\\DaRT 10 folder on MDT01.
-
 1.  On MDT01, install DaRT 10 (MSDaRT10.msi) using the default settings.
-
 2.  Using File Explorer, navigate to the **C:\\Program Files\\Microsoft DaRT\\v10** folder.
-
 3.  Copy the Toolsx64.cab file to **E:\\MDTProduction\\Tools\\x64**.
-
 4.  Copy the Toolsx86.cab file to **E:\\MDTProduction\\Tools\\x86**.
-
 5.  Using the Deployment Workbench, right-click the **MDT Production** deployment share and select **Properties**.
-
 6.  In the **Windows PE** tab, in the **Platform** drop-down list, make sure **x86** is selected.
-
 7.  In the **Features** sub tab, select the **Microsoft Diagnostics and Recovery Toolkit (DaRT)** check box.
-
     ![figure 8](images/mdt-07-fig09.png)
-
     Figure 8. Selecting the DaRT 10 feature in the deployment share.
-
 8.  In the **Windows PE** tab, in the **Platform** drop-down list, select **x64**.
-
 9.  In the **Features** sub tab, in addition to the default selected feature pack, select the **Microsoft Diagnostics and Recovery Toolkit (DaRT)** check box.
-
 10. Click **OK**.
-
 ### <a href="" id="bkmk-update-deployment"></a>Update the deployment share
-
 Like the MDT Build Lab deployment share, the MDT Production deployment share needs to be updated after it has been configured. This is the process during which the Windows PE boot images are created.
-
 1.  Right-click the **MDT Production** deployment share and select **Update Deployment Share**.
-
 2.  Use the default options for the Update Deployment Share Wizard.
-
 **Note**  
 The update process will take 5 to 10 minutes.
-
  
-
 ## <a href="" id="sec08"></a>Step 8: Deploy the Windows 10 client image
-
-
 These steps will walk you throug the process of using task sequences to deploy Windows 10 images through a fully automated process. First, you need to add the boot image to Windows Deployment Services (WDS) and then start the deployment. In contrast with deploying images from the MDT Build Lab deployment share, we recommend using the Pre-Installation Execution Environment (PXE) to start the full deployments in the datacenter, even though you technically can use an ISO/CD or USB to start the process.
-
 ### Configure Windows Deployment Services
-
 You need to add the MDT Production Lite Touch x64 Boot image to WDS in preparation for the deployment. For the following steps, we assume that Windows Deployment Services has already been installed on MDT01.
-
 1.  Using the WDS console, right-click **Boot Images** and select **Add Boot Image**.
-
 2.  Browse to the E:\\MDTProduction\\Boot\\LiteTouchPE\_x64.wim file and add the image with the default settings.
-
 ![figure 9](images/mdt-07-fig10.png)
-
 Figure 9. The boot image added to the WDS console.
-
 ### Deploy the Windows 10 client
-
 At this point, you should have a solution ready for deploying the Windows 10 client. We recommend starting by trying a few deployments at a time until you are confident that your configuration works as expected. We find it useful to try some initial tests on virtual machines before testing on physical hardware. This helps rule out hardware issues when testing or troubleshooting. Here are the steps to deploy your Windows 10 image to a virtual machine:
-
 1.  Create a virtual machine with the following settings:
-
     1.  Name: PC0005
-
     2.  Location: C:\\VMs
-
     3.  Generation: 2
-
     4.  Memory: 2048 MB
-
     5.  Hard disk: 60 GB (dynamic disk)
-
 2.  Start the PC0005 virtual machine, and press **Enter** to start the PXE boot. The machine will now load the Windows PE boot image from the WDS server.
-
     ![figure 10](images/mdt-07-fig11.png)
-
     Figure 10. The initial PXE boot process of PC0005.
-
 3.  After Windows PE has booted, complete the Windows Deployment Wizard using the following setting:
-
     1.  Password: P@ssw0rd
-
     2.  Select a task sequence to execute on this computer: Windows 10 Enterprise x64 RTM Custom Image
-
     3.  Computer Name: PC0005
-
     4.  Applications: Select the Install - Adobe Reader XI - x86 application.
-
 4.  The setup now starts and does the following:
-
     1.  Installs the Windows 10 Enterprise operating system.
-
     2.  Installs the added application.
-
     3.  Updates the operating system via your local Windows Server Update Services (WSUS) server.
-
 ### Use the MDT 2013 monitoring feature
-
 Now that you have enabled the monitoring on the MDT Production deployment share, you can follow your deployment of PC0005 via the monitoring node.
-
 1.  On MDT01, using Deployment Workbench, expand the **MDT Production** deployment share folder.
-
 2.  Select the **Monitoring** node, and wait until you see PC0005.
-
 3.  Double-click PC0005, and review the information.
-
 ![figure 11](images/mdt-07-fig13.png)
-
 Figure 11. The Monitoring node, showing the deployment progress of PC0005.
-
 ### Use information in the Event Viewer
-
 When monitoring is enabled, MDT also writes information to the event viewer on MDT01. This information can be used to trigger notifications via scheduled tasks when deployment is completed. For example, you can configure scheduled tasks to send an email when a certain event is created in the event log.
-
 ![figure 12](images/mdt-07-fig14.png)
-
 Figure 12. The Event Viewer showing a successful deployment of PC0005.
-
 ## <a href="" id="sec09"></a>Multicast deployments
-
-
 Multicast deployment allows for image deployment with reduced network load during simultaneous deployments. Multicast is a useful operating system deployment feature in MDT deployments, however it is important to ensure that your network supports it and is designed for it.
-
 ### Requirements
-
 Multicast requires that Windows Deployment Services (WDS) is running on Windows Server 2008 or later. In addition to the core MDT 2013 setup for multicast, the network needs to be configured to support multicast. In general, this means involving the organization networking team to make sure that Internet Group Management Protocol (IGMP) snooping is turned on and that the network is designed for multicast traffic. The multicast solution uses IGMPv3.
-
 ### Set up MDT for multicast
-
 Setting up MDT for multicast is straightforward. You enable multicast on the deployment share, and MDT takes care of the rest.
-
 1.  On MDT01, right-click the **MDT Production** deployment share folder and select **Properties**.
-
 2.  In the **General** tab, select the **Enable multicast for this deployment share (requires Windows Server 2008 R2 Windows Deployment Services)** check box, and click **OK**.
-
 3.  Right-click the **MDT Production** deployment share folder and select **Update Deployment Share**.
-
 4.  After updating the deployment share, use the Windows Deployment Services console to, verify that the multicast namespace was created.
-
 ![figure 13](images/mdt-07-fig15.png)
-
 Figure 13. The newly created multicast namespace.
-
 ## <a href="" id="sec10"></a>Use offline media to deploy Windows 10
-
-
 In addition to network-based deployments, MDT supports the use of offline media-based deployments of Windows 10. You can very easily generate an offline version of your deployment share - either the full deployment share or a subset of it - by the use of selection profiles. The generated offline media can be burned to a DVD or copied to a USB stick for deployment.
-
 Offline media are useful not only when you do not have network connectivity to the deployment share, but also when you have limited connection to the deployment share and do not want to copy 5 GB of data over the wire. Offline media can still join the domain, but you save the transfer of operating system images, drivers, and applications over the wire.
-
 ### Create the offline media selection profile
-
 To filter what is being added to the media, you create a selection profile. When creating selection profiles, you quickly realize the benefits of having created a good logical folder structure in the Deployment Workbench.
-
 1.  On MDT01, using Deployment Workbench, in the **MDT Production / Advanced Configuration** node, right-click **Selection Profile**, and select **New Selection Profile**.
-
 2.  Use the following settings for the New Selection Profile Wizard:
-
     1.  General Settings
-
         -   Selection profile name: Windows 10 Offline Media
-
     2.  Folders
-
         1.  Applications / Adobe
-
         2.  Operating Systems / Windows 10
-
         3.  Out-Of-Box Drivers / WinPE x64
-
         4.  Out-Of-Box Drivers / Windows 10 x64
-
         5.  Task Sequences / Windows 10
-
 ### Create the offline media
-
 In these steps, you generate offline media from the MDT Production deployment share. To filter what is being added to the media, you use the previously created selection profile.
-
 1.  On MDT01, using File Explorer, create the **E:\\MDTOfflineMedia** folder.
-
     **Note**  
     When creating offline media, you need to create the target folder first. It is crucial that you do not create a subfolder inside the deployment share folder because it will break the offline media.
-
      
-
 2.  Using Deployment Workbench, in the **MDT Production / Advanced Configuration** node, right-click the **Media** node, and select **New Media**.
-
 3.  Use the following settings for the New Media Wizard:
-
     -   General Settings
-
         1.  Media path: **E:\\MDTOfflineMedia**
-
         2.  Selection profile: Windows 10 Offline Media
-
 ### Configure the offline media
-
 Offline media has its own rules, its own Bootstrap.ini and CustomSettings.ini files. These files are stored in the Control folder of the offline media; they also can be accessed via properties of the offline media in the Deployment Workbench.
-
 1.  On MDT01, using File Explorer, copy the CustomSettings.ini file from the **E:\\MDTBuildLab\\Control** folder to **E:\\MDTOfflineMedia\\Content\\Deploy\\Control**. Overwrite the existing files.
-
 2.  Using Deployment Workbench, in the **MDT Production / Advanced Configuration / Media** node, right-click the **MEDIA001** media, and select **Properties**.
-
 3.  In the **General** tab, configure the following:
-
     1.  Clear the Generate x86 boot image check box.
-
     2.  ISO file name: Windows 10 Offline Media.iso
-
 4.  Still in the **Windows PE** tab, in the **Platform** drop-down list, select **x64**.
-
 5.  In the **General** sub tab, configure the following settings:
-
     1.  In the **Lite Touch Boot Image Settings** area:
-
         -   Image description: MDT Production x64
-
     2.  In the **Windows PE Customizations** area, set the Scratch space size to 128.
-
 6.  In the **Drivers and Patches** sub tab, select the **WinPE x64** selection profile and select the **Include all drivers from the selection profile** option.
-
 7.  Click **OK**.
-
 ### Generate the offline media
-
 You have now configured the offline media deployment share however the share has not yet been populated with the files required for deployment. Now everything is ready you populate the deployment share content folder and generate the offline media ISO.
-
 1.  On MDT01, using Deployment Workbench, navigate to the **MDT Production / Advanced Configuration / Media** node.
-
 2.  Right-click the **MEDIA001** media, and select **Update Media Content**. The Update Media Content process now generates the offline media in the **E:\\MDTOfflineMedia\\Content** folder.
-
 ### Create a bootable USB stick
-
 The ISO that you got when updating the offline media item can be burned to a DVD and used directly (it will be bootable), but it is often more efficient to use USB sticks instead since they are faster and can hold more data. (A dual-layer DVD is limited to 8.5 GB.)
-
 Follow these steps to create a bootable USB stick from the offline media content:
-
 1.  On a physical machine running Windows 7 or later, insert the USB stick you want to use.
-
 2.  Copy the content of the **MDTOfflineMedia\\Content** folder to the root of the USB stick.
-
 3.  Start an elevated command prompt (run as Administrator), and start the Diskpart utility by typing **Diskpart** and pressing **Enter**.
-
 4.  In the Diskpart utility, you can type **list volume** (or the shorter **list vol**) to list the volumes, but you really only need to remember the drive letter of the USB stick to which you copied the content. In our example, the USB stick had the drive letter F.
-
 5.  In the Diskpart utility, type **select volume F** (replace F with your USB stick drive letter).
-
 6.  In the Diskpart utility, type **active**, and then type **exit**.
-
 ## <a href="" id="sec11"></a>Unified Extensible Firmware Interface (UEFI)-based deployments
-
-
 As referenced in [Windows 10 deployment tools](http://go.microsoft.com/fwlink/p/?LinkId=619546), Unified Extensible Firmware Interface (UEFI)-based deployments are becoming more common. In fact, when you create a generation 2 virtual machine in Hyper-V, you get a UEFI-based computer. During deployment, MDT automatically detects that you have an UEFI-based machine and creates the partitions UEFI requires. You do not need to update or change your task sequences in any way to accommodate UFEI.
-
 ![figure 14](images/mdt-07-fig16.png)
-
 Figure 14. The partitions when deploying an UEFI-based machine.
-
 ## Related topics
-
-
 [Get started with the Microsoft Deployment Toolkit (MDT)](get-started-with-the-microsoft-deployment-toolkit.md)
-
 [Create a Windows 10 reference image](create-a-windows-10-reference-image.md)
-
 [Build a distributed environment for Windows 10 deployment](build-a-distributed-environment-for-windows-10-deployment.md)
-
 [Refresh a Windows 7 computer with Windows 10](refresh-a-windows-7-computer-with-windows-10.md)
-
 [Replace a Windows 7 computer with a Windows 10 computer](replace-a-windows-7-computer-with-a-windows-10-computer.md)
-
 [Configure MDT settings](configure-mdt-2013-settings.md)
-
  
-
  
-
-
-
-
-

windows/deploy/deploy-windows-10-with-the-microsoft-deployment-toolkit.md

@@ -2,129 +2,65 @@
 title: Deploy Windows 10 with the Microsoft Deployment Toolkit (Windows 10)
 description: This guide will walk you through the process of deploying Windows 10 in an enterprise environment using the Microsoft Deployment Toolkit (MDT), and MDT 2013 Update 2 specifically.
 ms.assetid: 837f009c-617e-4b3f-9028-2246067ee0fb
+ms.pagetype: mdt
 keywords: ["deploy", "tools", "configure", "script"]
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
 author: mtniehaus
 ---
-
 # Deploy Windows 10 with the Microsoft Deployment Toolkit
-
-
 **Applies to**
-
 -   Windows 10
-
 This guide will walk you through the process of deploying Windows 10 in an enterprise environment using the Microsoft Deployment Toolkit (MDT), and MDT 2013 Update 2 specifically.
-
 The Microsoft Deployment Toolkit is a unified collection of tools, processes, and guidance for automating desktop and server deployment. In addition to reducing deployment time and standardizing desktop and server images, MDT enables you to more easily manage security and ongoing configurations. MDT builds on top of the core deployment tools in the Windows Assessment and Deployment Kit (Windows ADK) with additional guidance and features designed to reduce the complexity and time required for deployment in an enterprise environment.
-
 MDT 2013 Update 2 supports the deployment of Windows 10, as well as Windows 7, Windows 8, Windows 8.1, and Windows Server 2012 R2. It also includes support for zero-touch installation (ZTI) with Microsoft System Center 2012 R2 Configuration Manager.
-
 To download the latest version of MDT, visit the [MDT resource page](http://go.microsoft.com/fwlink/p/?LinkId=618117).
-
 ## In this section
-
-
 -   [Get started with the Microsoft Deployment Toolkit (MDT)](get-started-with-the-microsoft-deployment-toolkit.md)
-
 -   [Create a Windows 10 reference image](create-a-windows-10-reference-image.md)
-
 -   [Deploy a Windows 10 image using MDT 2013 Update 2](deploy-a-windows-10-image-using-mdt.md)
-
 -   [Build a distributed environment for Windows 10 deployment](build-a-distributed-environment-for-windows-10-deployment.md)
-
 -   [Refresh a Windows 7 computer with Windows 10](refresh-a-windows-7-computer-with-windows-10.md)
-
 -   [Replace a Windows 7 computer with a Windows 10 computer](replace-a-windows-7-computer-with-a-windows-10-computer.md)
-
 -   [Configure MDT settings](configure-mdt-2013-settings.md)
-
 ## <a href="" id="proof"></a>Proof-of-concept environment
-
-
 For the purposes of this guide, and the topics discussed herein, we will use the following servers and client machines: DC01, MDT01, CM01, PC0001, and PC0002.
-
 ![figure 1](images/mdt-01-fig01.png)
-
 Figure 1. The servers and machines used for examples in this guide.
-
 DC01 is a domain controller; the other servers and client machines are members of the domain contoso.com for the fictitious Contoso Corporation.
-
 ![figure 2](images/mdt-01-fig02.jpg)
-
 Figure 2. The organizational unit (OU) structure used in this guide.
-
 ### Server details
-
 -   **DC01.** A Windows Server 2012 R2 Standard machine, fully patched with the latest security updates, and configured as Active Directory Domain Controller, DNS Server, and DHCP Server in the contoso.com domain.
-
     -   Server name: DC01
-
     -   IP Address: 192.168.1.200
-
     -   Roles: DNS, DHCP, and Domain Controller
-
 -   **MDT01.** A Windows Server 2012 R2 Standard machine, fully patched with the latest security updates, and configured as a member server in the contoso.com domain.
-
     -   Server name: MDT01
-
     -   IP Address: 192.168.1.210
-
 -   **CM01.** A Windows Server 2012 R2 Standard machine, fully patched with the latest security updates, and configured as a member server in the contoso.com domain.
-
     -   Server name: CM01
-
     -   IP Address: 192.168.1.214
-
 ### Client machine details
-
 -   **PC0001.** A Windows 10 Enterprise x64 machine, fully patched with the latest security updates, and configured as a member in the contoso.com domain. This machine is referenced as the admin workstation.
-
     -   Client name: PC0001
-
     -   IP Address: DHCP
-
 -   **PC0002.** A Windows 7 SP1 Enterprise x64 machine, fully patched with the latest security updates, and configured as a member in the contoso.com domain. This machine is referenced during the migration scenarios.
-
     -   Client name: PC0002
-
     -   IP Address: DHCP
-
 ## Sample files
-
-
 The information in this guide is designed to help you deploy Windows 10. In order to help you put the information you learn into practice more quickly, we recommend that you download a small set of sample files for the fictitious Contoso Corporation:
-
 -   [Gather.ps1](http://go.microsoft.com/fwlink/p/?LinkId=619361). This sample Windows PowerShell script performs the MDT Gather process in a simulated MDT environment. This allows you to test the MDT gather process and check to see if it is working correctly without performing a full Windows deployment.
-
 -   [Set-OUPermissions.ps1](http://go.microsoft.com/fwlink/p/?LinkId=619362). This sample Windows PowerShell script creates a domain account and then configures OU permissions to allow the account to join machines to the domain in the specified OU.
-
 -   [MDTSample.zip](http://go.microsoft.com/fwlink/p/?LinkId=619363). This sample web service shows you how to configure a computer name dynamically using MDT.
-
 ## Related topics
-
-
 [Microsoft Deployment Toolkit downloads and resources](http://go.microsoft.com/fwlink/p/?LinkId=618117)
-
 [Windows 10 deployment scenarios](windows-10-deployment-scenarios.md)
-
 [Windows 10 deployment tools](windows-deployment-scenarios-and-tools.md)
-
 [Deploy Windows 10 with System Center 2012 R2 Configuration Manager](deploy-windows-10-with-system-center-2012-r2-configuration-manager.md)
-
 [Deploy Windows To Go in your organization](deploy-windows-to-go.md)
-
 [Sideload apps in Windows 10](sideload-apps-in-windows-10.md)
-
 [Volume Activation for Windows 10](volume-activation-windows-10.md)
-
  
-
  
-
-
-
-
-

windows/deploy/get-started-with-the-microsoft-deployment-toolkit.md

@@ -2,61 +2,32 @@
 title: Get started with the Microsoft Deployment Toolkit (MDT) (Windows 10)
 description: This topic will help you gain a better understanding of how to use the Microsoft Deployment Toolkit (MDT), and MDT 2013 Update 2 in particular, as part of a Windows operating system deployment.
 ms.assetid: a256442c-be47-4bb9-a105-c831f58ce3ee
+ms.pagetype: mdt
 keywords: ["deploy", "image", "feature", "install", "tools"]
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
 author: mtniehaus
 ---
-
 # Get started with the Microsoft Deployment Toolkit (MDT)
-
-
 **Applies to**
-
 -   Windows 10
-
 This topic will help you gain a better understanding of how to use the Microsoft Deployment Toolkit (MDT), and MDT 2013 Update 2 in particular, as part of a Windows operating system deployment. MDT is one of the most important tools available to IT professionals today. You can use it to create reference images or as a complete deployment solution. MDT 2013 Update 2 also can be used to extend the operating system deployment features available in Microsoft System Center 2012 R2 Configuration Manager.
-
 In addition to familiarizing you with the features and options available in MDT 2013 Update 2, this topic will walk you through the process of preparing for deploying Windows 10 using MDT by configuring Active Directory, creating an organizational unit (OU) structure, creating service accounts, configuring log files and folders, and installing the tools needed to view the logs and continue with the deployment process.
-
 For the purposes of this topic, we will use two machines: DC01 and MDT01. DC01 is a domain controller and MDT01 is a Windows Server 2012 R2 standard server. MDT01 is a member of the domain contoso.com for the fictitious Contoso Corporation. For more details on the setup for this topic, please see [Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-10-with-the-microsoft-deployment-toolkit.md#proof).
-
 ![figure 1](images/mdt-05-fig01.png)
-
 Figure 1. The machines used in this topic.
-
 ## In this section
-
-
 -   [Key features in MDT 2013 Update 2](key-features-in-mdt-2013.md)
-
 -   [MDT 2013 Update 2 Lite Touch components](mdt-2013-lite-touch-components.md)
-
 -   [Prepare for deployment with MDT 2013 Update 2](prepare-for-windows-deployment-with-mdt-2013.md)
-
 ## Related topics
-
-
 [Microsoft Deployment Toolkit downloads and documentation](http://go.microsoft.com/fwlink/p/?LinkId=618117)
-
 [Create a Windows 10 reference image](create-a-windows-10-reference-image.md)
-
 [Deploy a Windows 10 image using MDT 2013 Update 2](deploy-a-windows-10-image-using-mdt.md)
-
 [Build a distributed environment for Windows 10 deployment](build-a-distributed-environment-for-windows-10-deployment.md)
-
 [Refresh a Windows 7 computer with Windows 10](refresh-a-windows-7-computer-with-windows-10.md)
-
 [Replace a Windows 7 computer with a Windows 10 computer](replace-a-windows-7-computer-with-a-windows-10-computer.md)
-
 [Configure MDT settings](configure-mdt-2013-settings.md)
-
  
-
  
-
-
-
-
-

windows/deploy/import-export-vamt-data.md

@@ -2,56 +2,35 @@
 title: Import and Export VAMT Data (Windows 10)
 description: Import and Export VAMT Data
 ms.assetid: 09a2c595-1a61-4da6-bd46-4ba8763cfd4f
+ms.pagetype: activation
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
 author: jdeckerMS
 ---
-
 # Import and Export VAMT Data
 You can use the Volume Activation Management Tool (VAMT) to import product-activation data from a Computer Information List (.cilx or .cil) file into SQL Server, and to export product-activation data into a .cilx file. A .cilx file is an XML file that stores computer and product-activation data. You can import data or export data during the following scenarios:
-
 -   Import and merge data from previous versions of VAMT.
-
 -   Export data to use to perform proxy activations.
-
 **Warning**  
 Editing a .cilx file using an application other than VAMT can corrupt the .cilx file and is not supported.
-
 ## Import VAMT Data
-
 **To import data into VAMT**
-
 1.  Open VAMT.
-
 2.  In the right-side **Actions** pane, click **Import list** to open the **Import List** dialog box.
-
 3.  In the **Import List** dialog box, navigate to the .cilx file location, select the file, and click **Open**.
-
 4.  In the **Volume Activation Management Tool** dialog box, click **OK** to begin the import. VAMT displays a progress message while the file is being imported. Click **OK** when a message appears and confirms that the import has completed successfully.
-
 ## Export VAMT Data
 Exporting VAMT data from a non-Internet-connected VAMT host computer is the first step of proxy activation using multiple VAMT hosts. To export product-activation data to a .cilx file:
-
 1.  In the left-side pane, you can click a product you want to export data for, or click **Products** if the list contains data for all products.
-
 2.  If you want to export only part of the data in a product list, in the product list view in the center pane select the products you want to export.
-
 3.  In the right-side **Actions** pane on, click **Export list** to open the **Export List** dialog box.
-
 4.  In the **Export List** dialog box, click **Browse** to navigate to the .cilx file.
-
 5.  Under **Export options**, select one of the following data-type options:
-
     -   Export products and product keys
-
     -   Export products only
-
     -   Export proxy activation data only. Selecting this option ensures that the export contains only the licensing information required for the proxy web service to obtain CIDs from Microsoft. No Personally Identifiable Information (PII) is contained in the exported .cilx file when this selection is checked.
-
 6.  If you have selected products to export, select the **Export selected product rows only** check box.
-
 7.  Click **Save**. VAMT displays a progress message while the data is being exported. Click **OK** when a message appears and confirms that the export has completed successfully.
-
 ## Related topics
 - [Perform Proxy Activation](proxy-activation-vamt.md)

windows/deploy/install-configure-vamt.md

@@ -2,30 +2,21 @@
 title: Install and Configure VAMT (Windows 10)
 description: Install and Configure VAMT
 ms.assetid: 5c7ae9b9-0dbc-4277-bc4f-8b3e4ab0bf50
+ms.pagetype: activation
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
 author: jdeckerMS
 ---
-
 # Install and Configure VAMT
 This section describes how to install and configure the Volume Activation Management Tool (VAMT).
-
 ## In this Section
 |Topic |Description |
 |------|------------|
 |[VAMT Requirements](vamt-requirements.md) |Provides system requirements for installing VAMT on a host computer. |
 |[Install VAMT](install-vamt.md) |Describes how to get and install VAMT. |
 |[Configure Client Computers](configure-client-computers-vamt.md) |Describes how to configure client computers on your network to work with VAMT. |
-
 ## Related topics
 - [Introduction to VAMT](introduction-vamt.md)
-
  
-
  
-
-
-
-
-

windows/deploy/install-kms-client-key-vamt.md

@@ -2,43 +2,28 @@
 title: Install a KMS Client Key (Windows 10)
 description: Install a KMS Client Key
 ms.assetid: d234468e-7917-4cf5-b0a8-4968454f7759
+ms.pagetype: activation
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
 author: jdeckerMS
 ---
-
 # Install a KMS Client Key
 You can use the Volume Activation Management Tool (VAMT) to install Generic Volume License Key (GVLK), or KMS client, product keys. For example, if you are converting a MAK-activated product to KMS activation.
-
 **Note**  
 By default, volume license editions of Windows Vista, Windows® 7, Windows 8, Windows 10, Windows Server 2008, Windows Server 2008 R2, Windows Server® 2012, and Microsoft® Office 2010 use KMS for activation. GVLKs are already installed in volume license editions of these products.
-
 **To install a KMS Client key**
-
 1.  Open VAMT.
-
 2.  In the left-side pane click **Products** to open the product list view in the center pane.
-
 3.  In the products list view in the center pane, select the products that need to have GVLKs installed. You can use the **Filter** function to narrow your search for computers by clicking **Filter** in the right-side pane to open the **Filter Products** dialog box.
-
 4.  In the **Filter Products** dialog box, you can filter the list by computer name, product name, product key type, license status, or by any combination of these options.
-
     -   To filter the list by computer name, enter a name in the **Computer Name** box.
-
     -   To filter the list by Product Name, Product Key Type, or License Status, click the list you want to use for the filter and select an option. If necessary, click **clear all filters** to create a new filter.
-
 5.  Click **Filter**. VAMT displays the filtered list in the center pane.
-
 6.  Click **Install product key** in the **Selected Items** menu in the right-side pane to display the **Install Product Key** dialog box.
-
 7.  The **Install Product Key** dialog box displays the keys that are available to be installed.
-
 8.  Select the **Automatically select an AD or KMS client key** option and then click **Install Key**.
-
     VAMT displays the **Installing product key** dialog box while it attempts to install the product key for the selected products. When the process is finished, the status appears in the **Action Status** column of the dialog box. Click **Close** to close the dialog box. You can also click the **Automatically close when done** check box when the dialog box appears.
-
     The same status is shown under the **Status of Last Action** column in the product list view in the center pane.
-
 ## Related topics
 - [Perform KMS Activation](kms-activation-vamt.md)