deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-06-18 11:53:37 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

Merge branch 'master' into win10-apps-note-update

Browse Source
This commit is contained in:
Heidi Lohr
2018-07-06 09:13:33 -07:00
parent afa677c8bb 223d9ca62f
commit 11eebcdf62
6 changed files with 286 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
windows/client-management/mdm/policy-configuration-service-provider.md
View File

@ -213,6 +213,9 @@ The following diagram shows the Policy configuration service provider in tree fo
<dd>
<a href="./policy-csp-applicationmanagement.md#applicationmanagement-disablestoreoriginatedapps" id="applicationmanagement-disablestoreoriginatedapps">ApplicationManagement/DisableStoreOriginatedApps</a>
</dd>
<dd>
<a href="./policy-csp-applicationmanagement.md#applicationmanagement-launchappafterlogon" id="applicationmanagement-launchappafterlogon">ApplicationManagement/LaunchAppAfterLogOn</a>
</dd>
<dd>
<a href="./policy-csp-applicationmanagement.md#applicationmanagement-msiallowusercontroloverinstall" id="applicationmanagement-msiallowusercontroloverinstall">ApplicationManagement/MSIAllowUserControlOverInstall</a>
</dd>
@ -228,6 +231,9 @@ The following diagram shows the Policy configuration service provider in tree fo
<dd>
<a href="./policy-csp-applicationmanagement.md#applicationmanagement-restrictapptosystemvolume" id="applicationmanagement-restrictapptosystemvolume">ApplicationManagement/RestrictAppToSystemVolume</a>
</dd>
<dd>
<a href="./policy-csp-applicationmanagement.md#applicationmanagement-scheduleforcerestartforupdatefailures" id="applicationmanagement-scheduleforcerestartforupdatefailures">ApplicationManagement/ScheduleForceRestartForUpdateFailures</a>
</dd>
</dl>
### AppRuntime policies
@ -4751,15 +4757,15 @@ The following diagram shows the Policy configuration service provider in tree fo
- [Browser/AllowSearchSuggestionsinAddressBar](#browser-allowsearchsuggestionsinaddressbar)
- [Browser/AllowSmartScreen](#browser-allowsmartscreen)
- [Connectivity/AllowBluetooth](#connectivity-allowbluetooth)
- [DeviceLock/AllowIdleReturnWithoutPassword](#devicelock-allowidlereturnwithoutpassword)
- [DeviceLock/AllowSimpleDevicePassword](#devicelock-allowsimpledevicepassword)
- [DeviceLock/AlphanumericDevicePasswordRequired](#devicelock-alphanumericdevicepasswordrequired)
- [DeviceLock/DevicePasswordEnabled](#devicelock-devicepasswordenabled)
- [DeviceLock/DevicePasswordHistory](#devicelock-devicepasswordhistory)
- [DeviceLock/MaxDevicePasswordFailedAttempts](#devicelock-maxdevicepasswordfailedattempts)
- [DeviceLock/MaxInactivityTimeDeviceLock](#devicelock-maxinactivitytimedevicelock)
- [DeviceLock/MinDevicePasswordComplexCharacters](#devicelock-mindevicepasswordcomplexcharacters)
- [DeviceLock/MinDevicePasswordLength](#devicelock-mindevicepasswordlength)
- [DeviceLock/AllowIdleReturnWithoutPassword](#devicelock-allowidlereturnwithoutpassword)
- [DeviceLock/AllowSimpleDevicePassword](#devicelock-allowsimpledevicepassword)
- [DeviceLock/AlphanumericDevicePasswordRequired](#devicelock-alphanumericdevicepasswordrequired)
- [DeviceLock/DevicePasswordEnabled](#devicelock-devicepasswordenabled)
- [DeviceLock/DevicePasswordHistory](#devicelock-devicepasswordhistory)
- [DeviceLock/MaxDevicePasswordFailedAttempts](#devicelock-maxdevicepasswordfailedattempts)
- [DeviceLock/MaxInactivityTimeDeviceLock](#devicelock-maxinactivitytimedevicelock)
- [DeviceLock/MinDevicePasswordComplexCharacters](#devicelock-mindevicepasswordcomplexcharacters)
- [DeviceLock/MinDevicePasswordLength](#devicelock-mindevicepasswordlength)
- [Experience/AllowCortana](#experience-allowcortana)
- [Experience/AllowManualMDMUnenrollment](#experience-allowmanualmdmunenrollment)
- [Privacy/AllowCrossDeviceClipboard](#privacy-allowcrossdeviceclipboard)

180
windows/client-management/mdm/policy-csp-applicationmanagement.md
View File

@ -6,11 +6,13 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: MariciaAlforque
ms.date: 05/14/2018
ms.date: 07/03/2018
---
# Policy CSP - ApplicationManagement
> [!WARNING]
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
<hr/>
@ -43,6 +45,9 @@ ms.date: 05/14/2018
<dd>
<a href="#applicationmanagement-disablestoreoriginatedapps">ApplicationManagement/DisableStoreOriginatedApps</a>
</dd>
<dd>
<a href="#applicationmanagement-launchappafterlogon">ApplicationManagement/LaunchAppAfterLogOn</a>
</dd>
<dd>
<a href="#applicationmanagement-msiallowusercontroloverinstall">ApplicationManagement/MSIAllowUserControlOverInstall</a>
</dd>
@ -58,6 +63,9 @@ ms.date: 05/14/2018
<dd>
<a href="#applicationmanagement-restrictapptosystemvolume">ApplicationManagement/RestrictAppToSystemVolume</a>
</dd>
<dd>
<a href="#applicationmanagement-scheduleforcerestartforupdatefailures">ApplicationManagement/ScheduleForceRestartForUpdateFailures</a>
</dd>
</dl>
@ -544,6 +552,58 @@ The following list shows the supported values:
<hr/>
<!--Policy-->
<a href="" id="applicationmanagement-launchappafterlogon"></a>**ApplicationManagement/LaunchAppAfterLogOn**
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
<th>Pro</th>
<th>Business</th>
<th>Enterprise</th>
<th>Education</th>
<th>Mobile</th>
<th>Mobile Enterprise</th>
</tr>
<tr>
<td><img src="images/crossmark.png" alt="cross mark" /></td>
<td><img src="images/checkmark.png" alt="check mark" /><sup>5</sup></td>
<td><img src="images/checkmark.png" alt="check mark" /><sup>5</sup></td>
<td><img src="images/checkmark.png" alt="check mark" /><sup>5</sup></td>
<td><img src="images/checkmark.png" alt="check mark" /><sup>5</sup></td>
<td></td>
<td></td>
</tr>
</table>
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
> * Device
<hr/>
<!--/Scope-->
<!--Description-->
List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are launched after logon. This policy allows the IT admin to specify a list of applications that users can run after logging on to the device.
<!--/Description-->
<!--SupportedValues-->
<!--/SupportedValues-->
<!--Example-->
<!--/Example-->
<!--Validation-->
<!--/Validation-->
<!--/Policy-->
<hr/>
<!--Policy-->
<a href="" id="applicationmanagement-msiallowusercontroloverinstall"></a>**ApplicationManagement/MSIAllowUserControlOverInstall**
@ -850,6 +910,123 @@ The following list shows the supported values:
<!--/SupportedValues-->
<!--/Policy-->
<hr/>
<!--Policy-->
<a href="" id="applicationmanagement-scheduleforcerestartforupdatefailures"></a>**ApplicationManagement/ScheduleForceRestartForUpdateFailures**
<!--SupportedSKUs-->
<table>
<tr>
<th>Home</th>
<th>Pro</th>
<th>Business</th>
<th>Enterprise</th>
<th>Education</th>
<th>Mobile</th>
<th>Mobile Enterprise</th>
</tr>
<tr>
<td><img src="images/crossmark.png" alt="cross mark" /></td>
<td><img src="images/crossmark.png" alt="cross mark" /></td>
<td><img src="images/crossmark.png" alt="cross mark" /></td>
<td><img src="images/checkmark.png" alt="check mark" /><sup>5</sup></td>
<td><img src="images/checkmark.png" alt="check mark" /><sup>5</sup></td>
<td></td>
<td></td>
</tr>
</table>
<!--/SupportedSKUs-->
<!--Scope-->
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
> * Device
<hr/>
<!--/Scope-->
<!--Description-->
To ensure apps are up-to-date, this policy allows the admins to set a recurring or one time date to restart apps whose update failed due to the app being in use allowing the update to be applied.
Value type is string.
<!--/Description-->
<!--SupportedValues-->
<!--/SupportedValues-->
<!--Example-->
Sample SyncML:
``` syntax
<SyncML xmlns="SYNCML:SYNCML1.1">
<SyncBody>
<Add>
<CmdID>2</CmdID>
<Item>
<Target>
<LocURI> ./Device/Vendor/MSFT/Policy/Config/ApplicationManagement/ScheduleForceRestartForUpdateFailures
</LocURI>
</Target>
<Meta>
<Format xmlns="syncml:metinf">xml</Format>
</Meta>
<Data>
<ForceRestart StartDateTime="2018-03-28T22:21:52Z"
Recurrence="[none/daily/weekly/monthly]"
DayOfWeek=”1”
DayOfMonth=”12”
RunIfTaskIsMissed=”1”/>
</Data>
</Item>
</Add>
</SyncBody>
</SycnML>
```
XSD:
``` syntax
<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema">
<xs:simpleType name="recurrence" final="restriction">
<xs:restriction base="xs:string">
<xs:enumeration value="None" />
<xs:enumeration value="Daily" />
<xs:enumeration value="Weekly" />
<xs:enumeration value="Monthly" />
</xs:restriction>
</xs:simpleType>
<xs:simpleType name="daysOfWeek" final="restriction">
<xs:restriction base="xs:unsignedByte">
<xs:minInclusive value="1" />
<xs:maxInclusive value="127" />
</xs:restriction>
</xs:simpleType>
<xs:simpleType name="daysOfMonth" final="restriction">
<xs:restriction base="xs:unsignedInt">
<xs:minInclusive value="1" />
</xs:restriction>
</xs:simpleType>
<xs:element name="ForceRestart">
<xs:complexType>
<xs:attribute name="StartDateTime" type="xs:dateTime" use="required"/>
<xs:attribute name="Recurrence" type="recurrence" use="required"/>
<xs:attribute name="RunIfTaskIsMissed" type="xs:boolean" use="required"/>
<xs:attribute name="DaysOfWeek" type="daysOfWeek"/>
<xs:attribute name="DaysOfMonth" type="daysOfMonth"/>
</xs:complexType>
</xs:element>
</xs:schema>
```
<!--/Example-->
<!--Validation-->
<!--/Validation-->
<!--/Policy-->
<hr/>
Footnote:
@ -858,6 +1035,7 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
- 4 - Added in Windows 10, version 1803.
- 5 - Added in the next major release of Windows 10.
<!--/Policies-->

2
windows/deployment/upgrade/upgrade-readiness-requirements.md
View File

@ -40,7 +40,7 @@ While Upgrade Readiness can be used to assist with updating devices from Windows
Upgrade Readiness is offered as a solution in Microsoft Operations Management Suite (OMS) and Azure Log Analytics, a collection of cloud based services for managing on premises and cloud computing environments. For more information about OMS, see [Operations Management Suite overview](http://azure.microsoft.com/en-us/documentation/articles/operations-management-suite-overview/) or the Azure [Log Analytics overview](https://azure.microsoft.com/services/log-analytics/).
If you’re already using OMS or Azure Log Analytics, you’ll find Upgrade Readiness in the Solutions Gallery. Click the **Upgrade Readiness** tile in the gallery and then click **Add** on the solution’s details page. Upgrade Readiness is now visible in your workspace. You can also
If you’re already using OMS or Azure Log Analytics, you’ll find Upgrade Readiness in the Solutions Gallery. Click the **Upgrade Readiness** tile in the gallery and then click **Add** on the solution’s details page. Upgrade Readiness is now visible in your workspace.
If you are not using OMS or Azure Log Analytics, go to [Log Analytics](https://azure.microsoft.com/services/log-analytics/) on Microsoft.com and select **Start free** to start the setup process. During the process, you’ll create a workspace and add the Upgrade Readiness solution to it.

91
windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md
View File

@ -6,10 +6,10 @@ ms.prod: w10
ms.mktglfcycl: manage
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
author: eross-msft
ms.author: lizross
ms.date: 03/13/2018
localizationpriority: high
author: danihalfin
ms.author: daniha
ms.date: 06/20/2018
---
@ -2773,11 +2773,92 @@ The following fields are available:
- **UserGuid** The CEIP user ID.
## Remediation events
>[!NOTE]
>Events from this provider are sent with the installation of KB4023057 and any subsequent Windows update. For details, see [this support article](https://support.microsoft.com/help/4023057).
### Microsoft.Windows.Remediation.Applicable
Reports whether a specific remediation to issues preventing security and quality updates is applicable based on detection.
The following fields are available:
- **CV** Correlation vector.
- **DetectedCondition** Boolean true if detect condition is true and perform action will be run.
- **GlobalEventCounter** Client side counter which indicates ordering of events sent by the remediation system.
- **PackageVersion** Current package version of Remediation.
- **PluginName** Name of the remediation plugin specified for each generic plugin event.
- **RemediationShellDeviceManaged** TRUE if the device is WSUS managed or Windows Updated is disabled.
- **RemediationShellDeviceNewOS** TRUE if the device has a recently installed OS.
- **RemediationShellDeviceSccm** TRUE if the device is SCCM managed.
- **RemediationShellDeviceZeroExhaust** TRUE if the device has opted out of Windows Updates completely.
- **Result** Result for detection or perform action phases of the remediation system.
### Microsoft.Windows.Remediation.ChangePowerProfileDetection
Indicates whether the remediation system can put in a request to defer a system-initiated sleep to enable installation of security or quality updates.
The following fields are available:
- **ActionName** A descriptive name for the plugin action.
- **CurrentPowerPlanGUID** The ID of the current power plan configured on the device.
- **CV** Correlation vector.
- **GlobalEventCounter** Counter that indicates the ordering of events on the device.
- **PackageVersion** Current package version of remediation service.
- **RemediationBatteryPowerBatteryLevel** Integer between 0 and 100 indicating % battery power remaining (if not on battery, expect 0).
- **RemediationFUInProcess** Result that shows whether the device is currently installing a feature update.
- **RemediationScanInProcess** Result that shows whether the device is currently scanning for updates.
- **RemediationTargetMachine** Result that shows whether this device is a candidate for remediation(s) that will fix update issues.
- **SetupMutexAvailable** Result that shows whether setup mutex is available or not.
- **SysPowerStatusAC** Result that shows whether system is on AC power or not.
### Microsoft.Windows.Remediation.Completed
Enables tracking the completion of a process that remediates issues preventing security and quality updates.
The following fields are available:
- **CV** Correlation vector.
- **GlobalEventCounter** Client side counter which indicates ordering of events sent by the remediation system.
- **PackageVersion** Current package version of Remediation.
- **PluginName** Name of the specific remediation for each generic plugin event.
- **RemediationNoisyHammerTaskKickOffIsSuccess** Event that indicates the Update Assistant task has been started successfully.
- **Result** Indicates whether the remediation has completed.
### Microsoft.Windows.Remediation.RemediationShellMainExeEventId
Enables tracking the ID of a process that remediates issues preventing security and quality updates.
The following fields are available:
- **CV** Correlation vector.
- **GlobalEventCounter** Client side counter which indicates ordering of events sent by the remediation system.
- **PackageVersion** Current package version of Remediation.
- **RemediationShellCanAcquireSedimentMutex** True if the remediation was able to acquire the sediment mutex. False if it is already running.
- **RemediationShellExecuteShellResult** Indicates if the remediation system completed without errors.
- **RemediationShellFoundDriverDll** Indicates whether the remediation system found its component files to run properly.
- **RemediationShellLoadedShellDriver** Indicates whether the remediation system loaded its component files to run properly.
- **RemediationShellLoadedShellFunction** Indicates whether the remediation system loaded the functions from its component files to run properly.
### Microsoft.Windows.Remediation.Started
Enables tracking the start of a process that remediates issues preventing security and quality updates.
The following fields are available:
- **CV** Correlation vector.
- **GlobalEventCounter** Client side counter which indicates ordering of events sent by the remediation system.
- **PackageVersion** Current package version of Remediation.
- **PluginName** Name of the specific remediation for each generic plugin event.
- **Result** Results of the detection or perform action phases of the remediation system.
## Setup events
### SetupPlatformTel.SetupPlatformTelActivityStarted
"This event sends basic metadata about the update installation process generated by SetupPlatform to help keep Windows up to date. "
This event sends basic metadata about the update installation process generated by SetupPlatform to help keep Windows up to date.
The following fields are available:

7
windows/security/threat-protection/TOC.md
View File

@ -26,6 +26,7 @@
#### [Data storage and privacy](windows-defender-atp\data-storage-privacy-windows-defender-advanced-threat-protection.md)
#### [Assign user access to the portal](windows-defender-atp\assign-portal-access-windows-defender-advanced-threat-protection.md)
### [Onboard machines](windows-defender-atp\onboard-configure-windows-defender-advanced-threat-protection.md)
#### [Onboard previous versions of Windows](windows-defender-atp\onboard-downlevel-windows-defender-advanced-threat-protection.md)
#### [Onboard Windows 10 machines](windows-defender-atp\configure-endpoints-windows-defender-advanced-threat-protection.md)
##### [Onboard machines using Group Policy](windows-defender-atp\configure-endpoints-gp-windows-defender-advanced-threat-protection.md)
##### [Onboard machines using System Center Configuration Manager](windows-defender-atp\configure-endpoints-sccm-windows-defender-advanced-threat-protection.md)
@ -96,7 +97,7 @@
##### [Advanced hunting query language best practices](windows-defender-atp\advanced-hunting-best-practices-windows-defender-advanced-threat-protection.md)
## [Protect users, data, and devices with conditional access](windows-defender-atp\conditional-access-windows-defender-advanced-threat-protection.md)
### [Protect users, data, and devices with conditional access](windows-defender-atp\conditional-access-windows-defender-advanced-threat-protection.md)
###API and SIEM support
#### [Pull alerts to your SIEM tools](windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection.md)
@ -222,8 +223,6 @@
### [Windows Defender Antivirus compatibility with Windows Defender ATP](windows-defender-atp\defender-compatibility-windows-defender-advanced-threat-protection.md)
## [Windows Defender Antivirus in Windows 10](windows-defender-antivirus\windows-defender-antivirus-in-windows-10.md)
### [Windows Defender AV in the Windows Defender Security Center app](windows-defender-antivirus\windows-defender-security-center-antivirus.md)
### [Windows Defender AV on Windows Server 2016](windows-defender-antivirus\windows-defender-antivirus-on-windows-server-2016.md)
### [Windows Defender Antivirus compatibility](windows-defender-antivirus\windows-defender-antivirus-compatibility.md)
@ -287,7 +286,7 @@
#### [Use Windows Management Instrumentation (WMI) to configure and manage Windows Defender AV](windows-defender-antivirus\use-wmi-windows-defender-antivirus.md)
#### [Use the mpcmdrun.exe commandline tool to configure and manage Windows Defender AV](windows-defender-antivirus\command-line-arguments-windows-defender-antivirus.md)
## [Windows Defender AV in the Windows Defender Security Center app](windows-defender-antivirus\windows-defender-security-center-antivirus.md)
## [Windows Defender Exploit Guard](windows-defender-exploit-guard\windows-defender-exploit-guard.md)
### [Evaluate Windows Defender Exploit Guard](windows-defender-exploit-guard\evaluate-windows-defender-exploit-guard.md)

4
windows/security/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection.md
View File

@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: medium
ms.date: 06/13/2018
ms.date: 07/05/2018
---
# Windows Defender ATP data storage and privacy
@ -51,7 +51,7 @@ In all scenarios, data is encrypted using 256-bit [AES encyption](https://en.wik
## Do I have the flexibility to select where to store my data?
When onboarding the service for the first time, you can choose to store your data in Microsoft Azure datacenters in the European Union, the United Kingdom, or the United States. Once configured, you cannot change the location where your data is stored. This provides a convenient way to minimize compliance risk by actively selecting the geographic locations where your data will reside. Customer data in de-identified form may also be stored in the central storage and processing systems in the United States.
When onboarding the service for the first time, you can choose to store your data in Microsoft Azure datacenters in the European Union, the United Kingdom, or the United States. Once configured, you cannot change the location where your data is stored. This provides a convenient way to minimize compliance risk by actively selecting the geographic locations where your data will reside. Customer data in pseudonymized form may also be stored in the central storage and processing systems in the United States.
## Is my data isolated from other customer data?
Yes, your data is isolated through access authentication and logical segregation based on customer identifier. Each customer can only access data collected from its own organization and generic data that Microsoft provides.