Merge remote-tracking branch 'refs/remotes/origin/master' into jdsb

2025-05-19 16:57:23 +00:00 · 2018-12-11 07:15:31 -08:00 · 2018-12-11 07:15:31 -08:00 · 13e40c6fe2
commit 13e40c6fe2
parent c0feb9cad7 d4554296db
55 changed files with 337 additions and 348 deletions
--- a/devices/surface-hub/create-a-device-account-using-office-365.md
+++ b/devices/surface-hub/create-a-device-account-using-office-365.md
@ -75,10 +75,16 @@ From here on, you'll need to finish the account creation process using PowerShel
 In order to run cmdlets used by these PowerShell scripts, the following must be installed for the admin PowerShell console:
-   [Microsoft Online Services Sign-In Assistant for IT Professionals BETA](https://go.microsoft.com/fwlink/?LinkId=718149)
+-   [Microsoft Online Services Sign-In Assistant for IT Professionals RTW](https://www.microsoft.com/en-us/download/details.aspx?id=41950)
 -   [Windows Azure Active Directory Module for Windows PowerShell](https://www.microsoft.com/web/handlers/webpi.ashx/getinstaller/WindowsAzurePowershellGet.3f.3f.3fnew.appids)
 -   [Skype for Business Online, Windows PowerShell Module](https://www.microsoft.com/download/details.aspx?id=39366)
 Install the following module in Powershell
 ``` syntax
    install-module AzureAD
    Install-module MsOnline
    ```
 ### Connecting to online services
 1.  Run Windows PowerShell as Administrator.
@ -200,8 +206,7 @@ In order to enable Skype for Business, your environment will need to meet the fo
 2.  To enable your Surface Hub account for Skype for Business Server, run this cmdlet:
    ```PowerShell
-    Enable-CsMeetingRoom -Identity $strEmail -RegistrarPool
+    Enable-CsMeetingRoom -Identity $strEmail -RegistrarPool "sippoolbl20a04.infra.lync.com" -SipAddressType EmailAddress
    "sippoolbl20a04.infra.lync.com" -SipAddressType EmailAddress
    ```
    If you aren't sure what value to use for the `RegistrarPool` parameter in your environment, you can get the value from an existing Skype for Business user using this cmdlet:
@ -356,12 +361,7 @@ In order to enable Skype for Business, your environment will need to meet the fo
    Import-PSSession $cssess -AllowClobber
    ```
-2.  To enable your Surface Hub account for Skype for Business Server, run this cmdlet:
+2. Retrieve your Surface Hub account Registrar Pool
    ```PowerShell
    Enable-CsMeetingRoom -Identity $strEmail -RegistrarPool
    "sippoolbl20a04.infra.lync.com" -SipAddressType EmailAddress
    ```
 If you aren't sure what value to use for the `RegistrarPool` parameter in your environment, you can get the value from an existing Skype for Business user using this cmdlet:
@ -369,6 +369,15 @@ In order to enable Skype for Business, your environment will need to meet the fo
    Get-CsOnlineUser -Identity ‘alice@contoso.microsoft.com’| fl *registrarpool*
    ```
 3.  To enable your Surface Hub account for Skype for Business Server, run this cmdlet:
    ```PowerShell
    Enable-CsMeetingRoom -Identity $strEmail -RegistrarPool
    "sippoolbl20a04.infra.lync.com" -SipAddressType EmailAddress
    ```
--- a/devices/surface/microsoft-surface-data-eraser.md
+++ b/devices/surface/microsoft-surface-data-eraser.md
@ -150,6 +150,22 @@ After you create a Microsoft Surface Data Eraser USB stick, you can boot a suppo
 Microsoft Surface Data Eraser is periodically updated by Microsoft. For information about the changes provided in each new version, see the following:
 ### Version 3.2.78.0
 *Release Date: 4 Dec 2018*
 This version of Surface Data Eraser:
 - Includes bug fixes
 ### Version 3.2.75.0
 *Release Date: 12 November 2018*
 This version of Surface Data Eraser:
 - Adds support to Surface Studio 2
 - Fixes issues with SD card
 ### Version 3.2.69.0
 *Release Date: 12 October 2018*
--- a/devices/surface/surface-enterprise-management-mode.md
+++ b/devices/surface/surface-enterprise-management-mode.md
@ -191,8 +191,10 @@ For use with SEMM and Microsoft Surface UEFI Configurator, the certificate must
 ## Version History
 ### Version 2.26.136.0
 * Add support to Surface Studio 2
-### Version 2.21.136.9
+### Version 2.21.136.0
 * Add support to Surface Pro 6
 * Add support to Surface Laptop 2
--- a/mdop/mbam-v2/understanding-mbam-reports-mbam-2.md
+++ b/mdop/mbam-v2/understanding-mbam-reports-mbam-2.md
@ -159,7 +159,7 @@ Removable Data Volume encryption status will not be shown in the report.
 </tr>
 <tr class="even">
 <td align="left"><p>Policy-Fixed Data Drive</p></td>
-<td align="left"><p>Indicates if encryption is required for the dixed data drive.</p></td>
+<td align="left"><p>Indicates if encryption is required for the fixed data drive.</p></td>
 </tr>
 <tr class="odd">
 <td align="left"><p>Policy Removable Data Drive</p></td>
--- a/windows/client-management/TOC.md
+++ b/windows/client-management/TOC.md
@ -12,16 +12,18 @@
 ## [Windows 10 Mobile deployment and management guide](windows-10-mobile-and-mdm.md)
 ## [Windows libraries](windows-libraries.md)
 ## [Troubleshoot Windows 10 clients](windows-10-support-solutions.md)
-### [Data collection for troubleshooting 802.1x Authentication](data-collection-for-802-authentication.md)
+### [Advanced troubleshooting for Windows networking issues](troubleshoot-networking.md)
-### [Advanced troubleshooting 802.1x authentication](advanced-troubleshooting-802-authentication.md)
+#### [Advanced troubleshooting Wireless Network Connectivity](advanced-troubleshooting-wireless-network-connectivity.md)
-### [Advanced troubleshooting for Windows boot problems](advanced-troubleshooting-boot-problems.md)
+#### [Data collection for troubleshooting 802.1x Authentication](data-collection-for-802-authentication.md)
-### [Advanced troubleshooting Wireless Network Connectivity](advanced-troubleshooting-wireless-network-connectivity.md)
+#### [Advanced troubleshooting 802.1x authentication](advanced-troubleshooting-802-authentication.md)
 ### [Advanced troubleshooting for Windows-based computer freeze issues](troubleshoot-windows-freeze.md)
 ### [Advanced troubleshooting for Stop error or blue screen error issue](troubleshoot-stop-errors.md)
 ### [Advanced troubleshooting for TCP/IP](troubleshoot-tcpip.md)
 #### [Collect data using Network Monitor](troubleshoot-tcpip-netmon.md)
 #### [Troubleshoot TCP/IP connectivity](troubleshoot-tcpip-connectivity.md)
 #### [Troubleshoot port exhaustion issues](troubleshoot-tcpip-port-exhaust.md)
 #### [Troubleshoot Remote Procedure Call (RPC) errors](troubleshoot-tcpip-rpc-errors.md)
 ### [Advanced troubleshooting for Windows start-up issues](troubleshoot-windows-startup.md)
 #### [Advanced troubleshooting for Windows boot problems](advanced-troubleshooting-boot-problems.md)
 #### [Advanced troubleshooting for Windows-based computer freeze issues](troubleshoot-windows-freeze.md)
 #### [Advanced troubleshooting for Stop error or blue screen error issue](troubleshoot-stop-errors.md)
 ## [Mobile device management for solution providers](mdm/index.md)
 ## [Change history for Client management](change-history-for-client-management.md)
--- a/windows/client-management/mdm/images/block-untrusted-processes.png
+++ b/windows/client-management/mdm/images/block-untrusted-processes.png
--- a/windows/client-management/mdm/images/device-manager-disk-drives.png
+++ b/windows/client-management/mdm/images/device-manager-disk-drives.png
--- a/windows/client-management/mdm/images/disk-drive-hardware-id.png
+++ b/windows/client-management/mdm/images/disk-drive-hardware-id.png
--- a/windows/client-management/mdm/policy-csp-deviceinstallation.md
+++ b/windows/client-management/mdm/policy-csp-deviceinstallation.md
@ -463,10 +463,13 @@ If you disable or do not configure this policy setting, devices can be installed
 For more information about hardware IDs and compatible IDs, see [Device Identification Strings](https://docs.microsoft.com/windows-hardware/drivers/install/device-identification-strings).
-To get the hardware ID for a device, open Device Manager, right-click the name of the device and click **Properties**. On the **Details** tab, select **Hardware Ids** from the **Property** menu:
+You can get the hardware ID in Device Manager. For example, USB drives are listed under Disk drives:
-![Hardware IDs](images/hardware-ids.png)
+![Disk drives](images/device-manager-disk-drives.png)
 Right-click the name of the device, click **Properties** > **Details** and select **Hardware Ids** as the **Property**: 
 ![Hardware IDs](images/disk-drive-hardware-id.png)
 <!--/Description-->
 > [!TIP]
--- a/windows/client-management/troubleshoot-networking.md
+++ b/windows/client-management/troubleshoot-networking.md
@ -0,0 +1,20 @@
 ---
 title: Advanced troubleshooting for Windows networking issues
 description: Learn how to troubleshoot networking issues.
 ms.prod: w10
 ms.sitesec: library
 ms.topic: troubleshooting
 author: kaushika-msft
 ms.localizationpriority: medium
 ms.author: kaushika
 ms.date: 
 ---
 # Advanced troubleshooting for Windows networking issues
 In these topics, you will learn how to troubleshoot common problems related to Windows networking.
 - [Advanced troubleshooting Wireless Network](advanced-troubleshooting-wireless-network-connectivity.md)
 - [Data collection for troubleshooting 802.1x authentication](data-collection-for-802-authentication.md)
 - [Advanced troubleshooting 802.1x authentication](advanced-troubleshooting-802-authentication.md)
 - [Advanced troubleshooting for TCP/IP issues](troubleshoot-tcpip.md)
--- a/windows/client-management/troubleshoot-windows-startup.md
+++ b/windows/client-management/troubleshoot-windows-startup.md
@ -0,0 +1,19 @@
 ---
 title: Advanced troubleshooting for Windows start-up issues
 description: Learn how to troubleshoot Windows start-up issues.
 ms.prod: w10
 ms.sitesec: library
 ms.topic: troubleshooting
 author: kaushika-msft
 ms.localizationpriority: medium
 ms.author: kaushika
 ms.date: 
 ---
 # Advanced troubleshooting for Windows start-up issues
 In these topics, you will learn how to troubleshoot common problems related to Windows start-up.
 - [Advanced troubleshooting for Windows boot problems](advanced-troubleshooting-boot-problems.md)
 - [Advanced troubleshooting for Stop error or blue screen error](troubleshoot-stop-errors.md)
 - [Advanced troubleshooting for Windows-based computer freeze issues](troubleshoot-windows-freeze.md)
--- a/windows/deployment/deploy-whats-new.md
+++ b/windows/deployment/deploy-whats-new.md
@ -7,7 +7,7 @@ ms.localizationpriority: medium
 ms.prod: w10
 ms.sitesec: library
 ms.pagetype: deploy
-ms.date: 11/06/2018
+ms.date: 12/07/2018
 author: greg-lindsay
 ---
@ -16,7 +16,6 @@ author: greg-lindsay
 **Applies to**
 -   Windows 10
 ## In this topic
 This topic provides an overview of new solutions and online content related to deploying Windows 10 in your organization.
@ -34,6 +33,12 @@ Microsoft is [extending support](https://www.microsoft.com/microsoft-365/blog/20
 ![Support lifecycle](images/support-cycle.png)
 ## Windows 10 servicing and support
 Microsoft is [extending support](https://www.microsoft.com/microsoft-365/blog/2018/09/06/helping-customers-shift-to-a-modern-desktop) for Windows 10 Enterprise and Windows 10 Education editions to 30 months from the version release date. This includes all past versions and future versions that are targeted for release in September (versions ending in 09, ex: 1809). Future releases that are targeted for release in March (versions ending in 03, ex: 1903) will continue to be supported for 18 months from their release date. All releases of Windows 10 Home, Windows 10 Pro, and Office 365 ProPlus will continue to be supported for 18 months (there is no change for these editions).  These support policies are summarized in the table below.
 ![Support lifecycle](images/support-cycle.png)
 ## Windows 10 Enterprise upgrade
 Windows 10 version 1703 includes a Windows 10 Enterprise E3 and E5 benefit to Microsoft customers with Enterprise Agreements (EA) or Microsoft Products & Services Agreements (MPSA). These customers can now subscribe users to Windows 10 Enterprise E3 or E5 and activate their subscriptions on up to five devices. Virtual machines can also be activated. For more information, see [Windows 10 Enterprise Subscription Activation](windows-10-enterprise-subscription-activation.md).
--- a/windows/deployment/update/windows-analytics-privacy.md
+++ b/windows/deployment/update/windows-analytics-privacy.md
@ -8,7 +8,7 @@ ms.sitesec: library
 ms.pagetype: deploy
 author: jaimeo
 ms.author: jaimeo
-ms.date: 07/02/2018
+ms.date: 12/10/2018
 ms.localizationpriority: high
 ---
@ -17,7 +17,7 @@ ms.localizationpriority: high
 Windows Analytics is fully committed to privacy, centering on these tenets:
 - **Transparency:** We fully document the Windows Analytics diagnostic events (see the links for additional information) so you can review them with your company’s security and compliance teams. The Diagnostic Data Viewer lets you see diagnostic data sent from a given device (see [Diagnostic Data Viewer Overview](https://docs.microsoft.com/windows/configuration/diagnostic-data-viewer-overview) for details).
- **Control:** You ultimately control the level of diagnostic data you wish to share. In Windows 10 1709 we added a new policy to Limit enhanced diagnostic data to the minimum required by Windows Analytics
+- **Control:** You ultimately control the level of diagnostic data you wish to share. In Windows 10, version 1709 we added a new policy to Limit enhanced diagnostic data to the minimum required by Windows Analytics
 - **Security:** Your data is protected with strong security and encryption
 - **Trust:** Windows Analytics supports the Microsoft Online Service Terms
@ -39,7 +39,10 @@ See these topics for additional background information about related privacy iss
 - [Windows 10 and the GDPR for IT Decision Makers](https://docs.microsoft.com/windows/privacy/gdpr-it-guidance)
 - [Configure Windows diagnostic data in your organization](https://docs.microsoft.com/windows/configuration/configure-windows-diagnostic-data-in-your-organization)
- [Windows 7, Windows 8, and Windows 8.1 Appraiser Telemetry Events, and Fields](https://go.microsoft.com/fwlink/?LinkID=822965) (link downloads a PDF file)
+- [Windows 7, Windows 8, and Windows 8.1 Appraiser Telemetry Events, and Fields](https://go.microsoft.com/fwlink/?LinkID=822965)
 - [Windows 10, version 1809 basic level Windows diagnostic events and fields](https://docs.microsoft.com/windows/configuration/basic-level-windows-diagnostic-events-and-fields-1809)
 - [Windows 10, version 1803 basic level Windows diagnostic events and fields](https://docs.microsoft.com/windows/configuration/basic-level-windows-diagnostic-events-and-fields-1803)
 - [Windows 10, version 1709 basic level Windows diagnostic events and fields](https://docs.microsoft.com/windows/configuration/basic-level-windows-diagnostic-events-and-fields-1709)
 - [Windows 10, version 1703 basic level Windows diagnostic events and fields](https://docs.microsoft.com/windows/configuration/basic-level-windows-diagnostic-events-and-fields-1703)
 - [Windows 10, version 1709 enhanced diagnostic data events and fields used by Windows Analytics](https://docs.microsoft.com/windows/configuration/enhanced-diagnostic-data-windows-analytics-events-and-fields)
 - [Diagnostic Data Viewer Overview](https://docs.microsoft.com/windows/configuration/diagnostic-data-viewer-overview)
--- a/windows/deployment/upgrade/upgrade-readiness-deployment-script.md
+++ b/windows/deployment/upgrade/upgrade-readiness-deployment-script.md
@ -6,7 +6,7 @@ ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.pagetype: deploy
 author: jaimeo
-ms.date: 10/29/2018
+ms.date: 12/10/2018
 ---
 # Upgrade Readiness deployment script
@ -83,232 +83,71 @@ To run the Upgrade Readiness deployment script:
 The deployment script displays the following exit codes to let you know if it was successful, or if an error was encountered.
-<div font-size='5pt;'>
+| Exit code | Suggested fix |
-<table border='1' cellspacing='0' cellpadding='0' width="100%">
+|-----------|--------------|
-    <tr>
+| 0 - Success | N/A |
-        <td BGCOLOR="#a0e4fa">Exit code and meaning</td>
+| 1 - Unexpected error occurred while executing the script. | The files in the deployment script are likely corrupted. Download the [latest script](https://go.microsoft.com/fwlink/?LinkID=822966) from the download center and try again. |
-        <td BGCOLOR="#a0e4fa">Suggested fix</td>
+| 2 - Error when logging to console. $logMode = 0.  
-    </tr>
+(console only) | Try changing the $logMode value to **1** and try again.  
-    <tr><td>0 - Success</td>
+$logMode value 1 logs to both console and file.  |
-        <td>N/A</td>
+| 3 - Error when logging to console and file. $logMode = 1. | Verify that you have set the logPath parameter in RunConfig.bat, and that the configuration script has access to connect and write to this location. |
-    </tr>
+| 4 - Error when logging to file. $logMode = 2. | Verify that you have set the logPath parameter in RunConfig.bat, and that the configuration script has access to connect and write to this location. |
-    <tr>
+| 5 - Error when logging to console and file. $logMode = unknown. | Verify that you have set the logPath parameter in RunConfig.bat, and that the configuration script has access to connect and write to this location. |
-        <td>1 - Unexpected error occurred while executing the script.</td>
+| 6 - The commercialID parameter is set to unknown. | Modify the runConfig.bat file to set the CommercialID value. The value for parameter in the runconfig.bat file should match the Commercial ID key for your workspace. See [Generate your Commercial ID key](https://technet.microsoft.com/itpro/windows/deploy/upgrade-readiness-get-started#generate-your-commercial-id-key) for instructions on generating a Commercial ID key for your workspace. |
-        <td> The files in the deployment script are likely corrupted. Download the [latest script](https://go.microsoft.com/fwlink/?LinkID=822966) from the download center and try again.</td>
+| 8 - Failure to create registry key path: **HKLM:\SOFTWARE\Microsoft\Windows \CurrentVersion\Policies\DataCollection**. The Commercial Id property is set at the following registry key path: **HKLM:\SOFTWARE\Microsoft\Windows \CurrentVersion\Policies\DataCollection** | Verify that the context under which the script in running has access to the registry key. |
-    </tr>
+| 9 - The script failed to write Commercial Id to registry.  
-    <tr>
+Error creating or updating registry key: **CommercialId** at **HKLM:\SOFTWARE\Microsoft\Windows \CurrentVersion\Policies\DataCollection** | Verify that the context under which the script in running has access to the registry key. |
-        <td>2 - Error when logging to console. $logMode = 0.<BR>(console only)</td>
+| 10 - Error when writing **CommercialDataOptIn** to the registry at **HKLM:\SOFTWARE\Microsoft\Windows \CurrentVersion\Policies\DataCollection** | Verify that the deployment script is running in a context that has access to the registry key. |
-        <td>Try changing the $logMode value to **1** and try again.<BR>$logMode value 1 logs to both console and file.</td>
+| 11 - Function **SetupCommercialId** failed with an unexpected exception. The **SetupCommercialId** function updates the Commercial Id at the registry key path: **HKLM:\SOFTWARE\Microsoft\Windows \CurrentVersion\Policies\DataCollection** | Verify that the configuration script has access to this location. |
-    </tr>
+| 12 - Can’t connect to Microsoft - Vortex. Check your network/proxy settings. | **Http Get** on the end points did not return a success exit code. For Windows 10, connectivity is verified by connecting to https://v10.vortex-win.data.microsoft.com/health/keepalive. For previous operating systems, connectivity is verified by connecting to https://vortex-win.data.microsoft.com/health/keepalive. If there is an error verifying connectivity, this will prevent the collected data from being sent to Upgrade Readiness. To resolve this issue, verify that the required endpoints are correctly whitelisted. For more information, see [Enrolling devices in Windows Analytics](../update/windows-analytics-get-started.md) |
-    <tr>
+| 13 - Can’t connect to Microsoft - setting. | An error occurred connecting to https://settings.data.microsoft.com/qos. This error will prevent the collected data from being sent to Upgrade Readiness. To resolve this issue, verify that the required endpoints are correctly whitelisted. For more information, see [Enrolling devices in Windows Analytics](https://technet.microsoft.com/itpro/windows/deploy/upgrade-readiness-get-started#enable-data-sharing). Verify that the required endpoints are whitelisted correctly. See Whitelist select endpoints for more details. |
-        <td>3 - Error when logging to console and file. $logMode = 1.</td>
+| 14 - Can’t connect to Microsoft - compatexchange. An error occurred connecting to [CompatibilityExchangeService.svc](https://compatexchange1.trafficmanager.net/CompatibilityExchangeService.svc). | This error will prevent the collected data from being sent to Upgrade Readiness. To resolve this issue, verify that the required endpoints are correctly whitelisted. For more information, see [Enrolling devices in Windows Analytics](../update/windows-analytics-get-started.md). |
-        <td>Verify that you have set the logPath parameter in RunConfig.bat, and that the configuration script has access to connect and write to this location.</td>
+| 15 - Function CheckVortexConnectivity failed with an unexpected exception. | This error will prevent the collected data from being sent to Upgrade Readiness. To resolve this issue, verify that the required endpoints are correctly whitelisted. For more information, see [Enrolling devices in Windows Analytics](../update/windows-analytics-get-started.md). Check the logs for the exception message and the HResult. |
-    </tr>
+| 16 - The computer requires a reboot before running the script. | Restart the device to complete the installation of the compatibility update and related updates. Reboot the computer before running the Upgrade Readiness deployment script. |
-    <tr>
+| 17 - Function **CheckRebootRequired** failed with an unexpected exception. | Restart the device to complete installation of the compatibility update and related updates. Check the logs for the exception message and the HResult. |
-        <td>4 - Error when logging to file. $logMode = 2.</td>
+|18 - Appraiser KBs not installed or **appraiser.dll** not found. | Either the Appraiser-related updates are not installed, or the **appraiser.dll** file was not found. For more information, see appraiser diagnostic data events and fields information in the [Data collection](https://technet.microsoft.com/itpro/windows/deploy/upgrade-readiness-get-started#data-collection-and-privacy) and privacy topic. |
-        <td>Verify that you have set the logPath parameter in RunConfig.bat, and that the configuration script has access to connect and write to this location.</td>
+| 19 - Function **CheckAppraiserKB**, which checks the compatibility update KBs, failed with unexpected exception. | Check the logs for the Exception message and HResult. The script will not run further if this error is not fixed. |
-    </tr>
+| 20 - An error occurred when creating or updating the registry key **RequestAllAppraiserVersions** at **HKLM:\SOFTWARE\Microsoft\WindowsNT \CurrentVersion\AppCompatFlags\Appraiser** | The registry key is required for data collection to work correctly. Verify that the script is running in a context that has access to the registry key. |
-    <tr>
+| 21 - Function **SetRequestAllAppraiserVersions** failed with an unexpected exception. | Check the logs for the exception message and HResult. |
-        <td>5 - Error when logging to console and file. $logMode = unknown.</td>
+| 22 - **RunAppraiser** failed with unexpected exception. | Check the logs for the exception message and HResult. Check the **%windir%\System32** directory for the file **CompatTelRunner.exe**. If the file does not exist, reinstall the required compatibility updates which include this file, and check your organization's Group Policy to verify it does not remove this file. |
-        <td>Verify that you have set the logPath parameter in RunConfig.bat, and that the configuration script has access to connect and write to this location.</td>
+| 23 - Error finding system variable **%WINDIR%**. | Verify that this environment variable is configured on the computer. |
-    </tr>
+| 24 - The script failed when writing **IEDataOptIn** to the registry. An error occurred when creating registry key **IEOptInLevel** at **HKLM:\SOFTWARE\Microsoft\Windows \CurrentVersion\Policies\DataCollection** | This is a required registry key for IE data collection to work correctly. Verify that the deployment script in running in a context that has access to the registry key. Check the logs for the exception message and HResult. |
-    <tr>
+| 25 - The function **SetIEDataOptIn** failed with unexpected exception. | Check the logs for the exception message and HResult. |
-        <td>6 - The commercialID parameter is set to unknown. <BR>Modify the runConfig.bat file to set the CommercialID value.</td>
+| 27 - The script is not running under **System** account. | The Upgrade Readiness configuration script must be run as **System**. |
-        <td>The value for parameter in the runconfig.bat file should match the Commercial ID key for your workspace. 
+| 28 - Could not create log file at the specified **logPath**. | Make sure the deployment script has access to the location specified in the **logPath** parameter. |
-        <BR>See [Generate your Commercial ID key](https://technet.microsoft.com/itpro/windows/deploy/upgrade-readiness-get-started#generate-your-commercial-id-key) for instructions on generating a Commercial ID key for your workspace.</td>
+| 29 - Connectivity check failed for proxy authentication. | Install cumulative updates on the device and enable the **DisableEnterpriseAuthProxy** authentication proxy setting. The **DisableEnterpriseAuthProxy** setting is enabled by default for Windows 7\. For Windows 8.1 computers, set the **DisableEnterpriseAuthProxy** setting to **0** (not disabled). For more information on authentication proxy support, see [Authentication proxy support added in new version (12.28.16) of the Upgrade Readiness deployment script](https://go.microsoft.com/fwlink/?linkid=838688). |
-    </tr>
+| 30 - Connectivity check failed. Registry key property **DisableEnterpriseAuthProxy** is not enabled. | The **DisableEnterpriseAuthProxy** setting is enabled by default for Windows 7\. For Windows 8.1 computers, set the **DisableEnterpriseAuthProxy** setting to **0** (not disabled). For more information on authentication proxy support, see [this blog post](https://go.microsoft.com/fwlink/?linkid=838688). |
-    <tr>
+| 31 - There is more than one instance of the Upgrade Readiness data collector running at the same time on this computer. Use Task Manager to check if **CompatTelRunner.exe** is running, and wait until it has completed to rerun the script. The Upgrade Readiness task is scheduled by default to run daily at 0300. |
-        <td>8 - Failure to create registry key path: <font size='1'>**HKLM:\SOFTWARE\Microsoft\Windows
+| 32 - Appraiser version on the machine is outdated. | The configuration script detected a version of the compatibility update module that is older than the minimum required to correctly collect the data required by Upgrade Readiness solution. Use the latest version of the [compatibility update](https://docs.microsoft.com/windows/deployment/update/windows-analytics-get-started#deploy-the-compatibility-update-and-related-updates) for Windows 7 SP1/Windows 8.1. |
-\CurrentVersion\Policies\DataCollection**</font></td>
+| 33 - **CompatTelRunner.exe** exited with an exit code | **CompatTelRunner.exe** runs the appraise task on the device. If it fails, it will provide a specific exit code. The script will return exit code 33 when **CompatTelRunner.exe** itself exits with an exit code. Check the logs for more details. Also see the **Note** following this table for additional steps to follow. |
-        <td>The Commercial Id property is set at the following registry key path: <font size='1'>**HKLM:\SOFTWARE\Microsoft\Windows
+| 34 - Function **CheckProxySettings** failed with an unexpected exception. | Check the logs for the exception message and HResult. |
-\CurrentVersion\Policies\DataCollection**</font>
+| 35 - Function **CheckAuthProxy** failed with an unexpected exception. Check the logs for the exception message and HResult. |
-        <BR>Verify that the context under which the script in running has access to the registry key.</td>
+| 36 - Function **CheckAppraiserEndPointsConnectivity** failed with an unexpected exception. | Check the logs for the exception message and HResult. |
-    </tr>
+| 37 - **Diagnose_internal.cmd** failed with an unexpected exception. | Check the logs for the exception message and HResult. |
-    <tr>
+| 38 - Function **Get-SqmID** failed with an unexpected exception. | Check the logs for the exception message and HResult. |
-        <td>9 - The script failed to write Commercial Id to registry.
+| 39 - For Windows 10: AllowTelemetry property is not set to 1 or higher at registry key path **HKLM:\SOFTWARE\Policies\Microsoft \Windows\DataCollection** or **HKLM:\SOFTWARE\Microsoft\Windows \CurrentVersion\Policies\DataCollection** | For Windows 10 devices, the **AllowTelemetry** property should be set to 1 or greater to enable data collection. The script will return an error if this is not true. For more information, see [Configure Windows diagnostic data in your organization](https://docs.microsoft.com/windows/configuration/configure-windows-diagnostic-data-in-your-organization). |
-        <BR>Error creating or updating registry key: **CommercialId** at <font size='1'>**HKLM:\SOFTWARE\Microsoft\Windows
+| 40 - Function **CheckTelemetryOptIn** failed with an unexpected exception. | Check the logs for the exception message and HResult. |
-\CurrentVersion\Policies\DataCollection**</font>
+| 41 - The script failed to impersonate the currently logged on user. | The script mimics the UTC client to collect upgrade readiness data. When auth proxy is set, the UTC client impersonates the user that is logged on. The script also tries to mimic this, but the process failed. |
-        </td> 
+| 42 - Function **StartImpersonatingLoggedOnUser** failed with an unexpected exception. | Check the logs for the exception message and HResult. |
-        <td>Verify that the context under which the script in running has access to the registry key.</td>
+| 43 - Function **EndImpersonatingLoggedOnUser** failed with an unexpected exception. | Check the logs for the exception message and HResult. |
-    </tr>
+| 44 - Diagtrack.dll version is old, so Auth Proxy will not work. | Update the device using Windows Update or Windows Server Update Services. |
-    <tr>
+| 45 - Diagrack.dll was not found. | Update the device using Windows Update or Windows Server Update Services. |
-        <td>10 - Error when writing **CommercialDataOptIn** to the registry at <font size='1'>**HKLM:\SOFTWARE\Microsoft\Windows
+| 48 - **CommercialID** mentioned in RunConfig.bat should be a GUID. | Copy the commercialID from your workspace. To find the commercialID, in the OMS portal click **Upgrade Readiness > Settings**. |
-\CurrentVersion\Policies\DataCollection**</font></td>
+| 50 - Diagtrack Service is not running. | The Diagtrack service is required to send data to Microsoft. Enable and run the "Connected User Experiences and Telemetry" service. |
-        <td>Verify that the deployment script is running in a context that has access to the registry key.</td>
+| 51 - RunCensus failed with an unexpected exception. | RunCensus explitly runs the process used to collect device information. The method failed with an unexpected exception. Check the ExceptionHResult and ExceptionMessage for more details. |
-    </tr>
+| 52 - DeviceCensus.exe not found on a Windows 10 machine. | On computers running Windows 10, the process devicecensus.exe should be present in the \system32 directory. Error code 52 is returned if the process was not found. Ensure that it exists at the specified location. |
-    <tr>
+| 53 - There is a different CommercialID present at the GPO path: **HKLM:\SOFTWARE\Policies\Microsoft \Windows\DataCollection**. This will take precedence over the CommercialID provided in the script. | Provide the correct CommercialID at the GPO location. |
-        <td>11 - Function **SetupCommercialId** failed with an unexpected exception.</td>
+| 54 - Microsoft Account Sign In Assistant Service is Disabled. | This service is required for devices running Windows 10. The diagnostic data client relies on the Microsoft Account Sign In Assistant (MSA) to get the Global Device ID for the device. Without the MSA service running, the global device ID will not be generated and sent by the client. |
-        <td>The **SetupCommercialId** function updates the Commercial Id at the registry key path: <font size='1'>**HKLM:\SOFTWARE\Microsoft\Windows
+| 55 - SetDeviceNameOptIn function failed to create registry key path: **HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection** | The function SetDeviceNameOptIn sets the registry key value which determines whether to send the device name in diagnostic data. The function tries to create the registry key path if it does not already exist. Verify that the account has the correct permissions to change or add registry keys. |
-\CurrentVersion\Policies\DataCollection**</font> <BR>Verify that the configuration script has access to this location.</td>
+| 56 - SetDeviceNameOptIn function failed to create property AllowDeviceNameInTelemetry at registry key path: **HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection** | Verify that the account has the correct permissions to change or add registry keys.|
-    </tr>
+| 57 - SetDeviceNameOptIn function failed to update AllowDeviceNameInTelemetry property to value 1 at registry key path: **HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection** | Verify that the account has the correct permissions to change or add registry keys. |
-    <tr>
+| 58 - SetDeviceNameOptIn function failed with unexpected exception | The function SetDeviceNameOptIn failed with an unexpected exception. |
-        <td>12 - Can’t connect to Microsoft - Vortex. Check your network/proxy settings.</td>
+| 59 - CleanupOneSettings failed to delete LastPersistedEventTimeOrFirstBoot property at registry key path: **HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Diagnostics\Diagtrack** |The CleanupOneSettings function clears some of the cached values needed by the Appraiser which is the data collector on the monitored device. This helps in the download of the most recent for accurate running of the data collector. Verify that the account has the correct permissions to change or add registry keys. |
-        <td>**Http Get** on the end points did not return a success exit code.<BR>
+| 60 - CleanupOneSettings failed to delete registry key: **HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\ Diagnostics\Diagtrack\SettingsRequests** | Verify that the account has the correct permissions to change or add registry keys. |
-        For Windows 10, connectivity is verified by connecting to https://v10.vortex-win.data.microsoft.com/health/keepalive.<BR>
+| 61 - CleanupOneSettings failed with an exception | CleanupOneSettings failed with an unexpected exception. |
-        For previous operating systems, connectivity is verified by connecting to https://vortex-win.data.microsoft.com/health/keepalive.  
+
-        <BR>If there is an error verifying connectivity, this will prevent the collected data from being sent to Upgrade Readiness. To resolve this issue, verify that the required endpoints are correctly whitelisted. For more information, see [Enrolling devices in Windows Analytics](../update/windows-analytics-get-started.md)
+
-    <tr>
+
        <td>13 - Can’t connect to Microsoft - setting. </td>
        <td>An error occurred connecting to  https://settings.data.microsoft.com/qos. This error will prevent the collected data from being sent to Upgrade Readiness. To resolve this issue, verify that the required endpoints are correctly whitelisted. For more information, see [Enrolling devices in Windows Analytics](https://technet.microsoft.com/itpro/windows/deploy/upgrade-readiness-get-started#enable-data-sharing). Verify that the required endpoints are whitelisted correctly. See Whitelist select endpoints for more details. 
 14 </td>
    </tr>
    <tr>
        <td>14 - Can’t connect to Microsoft - compatexchange.</td>
        <td>An error occurred connecting to [CompatibilityExchangeService.svc](https://compatexchange1.trafficmanager.net/CompatibilityExchangeService.svc). This error will prevent the collected data from being sent to Upgrade Readiness. To resolve this issue, verify that the required endpoints are correctly whitelisted. For more information, see [Enrolling devices in Windows Analytics](../update/windows-analytics-get-started.md).</td>
    </tr>
    <tr>
        <td>15 - Function CheckVortexConnectivity failed with an unexpected exception.</td>
        <td>This error will prevent the collected data from being sent to Upgrade Readiness. To resolve this issue, verify that the required endpoints are correctly whitelisted. For more information, see [Enrolling devices in Windows Analytics](../update/windows-analytics-get-started.md). Check the logs for the exception message and the HResult.</td>
    </tr>
    <tr>
        <td>16 - The computer requires a reboot before running the script.</td>
        <td>A reboot is required to complete the installation of the compatibility update and related KBs. Reboot the computer before running the Upgrade Readiness deployment script.</td>
    </tr>
    <tr>
        <td>17 - Function **CheckRebootRequired** failed with an unexpected exception.</td>
        <td>A reboot is required to complete installation of the compatibility update and related KBs. Check the logs for the exception message and the HResult.</td>
    </tr>
    <tr>
        <td>18 - Appraiser KBs not installed or **appraiser.dll** not found.</td>
        <td>Either the Appraiser KBs are not installed, or the **appraiser.dll** file was not found. For more information, see appraiser diagnostic data events and fields information in the [Data collection](https://technet.microsoft.com/itpro/windows/deploy/upgrade-readiness-get-started#data-collection-and-privacy) and privacy topic.</td>
    </tr>
    <tr>
        <td>19 - Function **CheckAppraiserKB**, which checks the compatibility update KBs, failed with unexpected exception.</td>
        <td>Check the logs for the Exception message and HResult. The script will not run further if this error is not fixed.</td> 
    </tr>
    <tr>
        <td>20 - An error occurred when creating or updating the registry key **RequestAllAppraiserVersions** at <font size='1'>**HKLM:\SOFTWARE\Microsoft\WindowsNT
 \CurrentVersion\AppCompatFlags\Appraiser**</font> </td>
        <td>The registry key is required for data collection to work correctly. Verify that the script is running in a context that has access to the registry key. </td>
    </tr>
    <tr>
        <td>21 - Function **SetRequestAllAppraiserVersions** failed with an unexpected exception.</td>
        <td>Check the logs for the exception message and HResult.</td>
    </tr>
    <tr>
        <td>22 - **RunAppraiser** failed with unexpected exception.</td>
        <td>Check the logs for the exception message and HResult. Check the **%windir%\System32** directory for the file **CompatTelRunner.exe**. If the file does not exist, reinstall the required compatibility updates which include this file, and check your organization's Group Policy to verify it does not remove this file.</td>
    </tr>
    <tr>
        <td>23 - Error finding system variable **%WINDIR%**.</td>
        <td>Verify that this environment variable is configured on the computer.</td>
    </tr>   
    <tr>
        <td>24 - The script failed when writing **IEDataOptIn** to the registry. An error occurred when creating registry key **IEOptInLevel** at <font size='1'>**HKLM:\SOFTWARE\Microsoft\Windows
 \CurrentVersion\Policies\DataCollection**</font></td>
        <td>This is a required registry key for IE data collection to work correctly. Verify that the deployment script in running in a context that has access to the registry key. Check the logs for the exception message and HResult.</td>
    </tr>
    <tr>
        <td>25 - The function **SetIEDataOptIn** failed with unexpected exception.</td>
        <td>Check the logs for the exception message and HResult.</td>
    </tr>
        <tr>
        <td>27 - The script is not running under **System** account.</td>
        <td>The Upgrade Readiness configuration script must be run as **System**. </td>
    </tr>
    <tr>
        <td>28 - Could not create log file at the specified **logPath**.</td>
        <td> Make sure the deployment script has access to the location specified in the **logPath** parameter.</td>
    </tr>
    <tr>
        <td>29 - Connectivity check failed for proxy authentication. </td>
        <td>Instal cumulative updates on the computer and enable the **DisableEnterpriseAuthProxy** authentication proxy setting.
            <BR>The **DisableEnterpriseAuthProxy** setting is enabled by default for Windows 7.  
            <BR>For Windows 8.1 computers, set the **DisableEnterpriseAuthProxy** setting to **0** (not disabled). 
            <BR>For more information on authentication proxy support, see [Authentication proxy support added in new version (12.28.16) of the Upgrade Readiness deployment script](https://go.microsoft.com/fwlink/?linkid=838688).</td>
    </tr>
    <tr>
        <td>30 - Connectivity check failed. Registry key property **DisableEnterpriseAuthProxy** is not enabled.</td>
        <td>The **DisableEnterpriseAuthProxy** setting is enabled by default for Windows 7.  
        <BR>For Windows 8.1 computers, set the **DisableEnterpriseAuthProxy** setting to **0** (not disabled). 
        <BR>For more information on authentication proxy support, see [this blog post](https://go.microsoft.com/fwlink/?linkid=838688).</td>
    </tr>
    <tr>
        <td>31 - There is more than one instance of the Upgrade Readiness data collector running at the same time on this computer. </td>
        <td>Use the Windows Task Manager to check if **CompatTelRunner.exe** is running, and wait until it has completed to rerun the script. The Upgrade Readiness task is scheduled to run daily at 3 a.m.</td>
    </tr>
    <tr>
        <td>32 - Appraiser version on the machine is outdated. </td>
        <td>The configuration script detected a version of the compatibility update module that is older than the minimum required to correctly collect the data required by Upgrade Readiness solution. Use the latest version of the [compatibility update](https://docs.microsoft.com/windows/deployment/update/windows-analytics-get-started#deploy-the-compatibility-update-and-related-updates) for Windows 7 SP1/Windows 8.1.</td>
    </tr>
    <tr>
        <td>33 - **CompatTelRunner.exe** exited with an exit code </td>
        <td>**CompatTelRunner.exe** runs the appraise task on the machine. If it fails, it will provide a specific exit code. The script will return exit code 33 when **CompatTelRunner.exe** itself exits with an exit code. Check the logs for more details. Also see the **Note** following this table for additional steps to follow.</td>
    </tr>
    <tr>
        <td>34 - Function **CheckProxySettings** failed with an unexpected exception. </td>
        <td>Check the logs for the exception message and HResult.></td>
    </tr>
    <tr>
        <td>35 - Function **CheckAuthProxy** failed with an unexpected exception.</td>
        <td>Check the logs for the exception message and HResult.</td>
    </tr>
    <tr>
        <td>36 - Function **CheckAppraiserEndPointsConnectivity** failed with an unexpected exception.</td>
        <td>Check the logs for the exception message and HResult.</td>
    </tr>
    <tr>
        <td>37 - **Diagnose_internal.cmd** failed with an unexpected exception.</td>
        <td>Check the logs for the exception message and HResult.</td>
    </tr>
    <tr>
        <td>38 - Function **Get-SqmID** failed with an unexpected exception. </td>
        <td>Check the logs for the exception message and HResult.</td>
    </tr>
    <tr>
        <td>39 - For Windows 10: AllowTelemetry property is not set to 1 or higher at registry key path <font size='1'>**HKLM:\SOFTWARE\Policies\Microsoft
 \Windows\DataCollection**</font>
        or <font size='1'>**HKLM:\SOFTWARE\Microsoft\Windows
 \CurrentVersion\Policies\DataCollection**</font></td>
        <td>For Windows 10 machines, the **AllowTelemetry** property should be set to 1 or greater to enable data collection. The script will throw an error if this is not true. For more information, see [Configure Windows diagnostic data in your organization](https://docs.microsoft.com/windows/configuration/configure-windows-diagnostic-data-in-your-organization).</td>
    </tr>
    <tr>
        <td>40 - Function **CheckTelemetryOptIn** failed with an unexpected exception. </td>
        <td>Check the logs for the exception message and HResult.</td>
    </tr>
    <tr>
        <td>41 - The script failed to impersonate the currently logged on user. </td>
        <td>The script mimics the UTC client to collect upgrade readiness data. When auth proxy is set, the UTC client impersonates the logged on user. The script also tries to mimic this, but the process failed.</td>
    </tr>
    <tr>
        <td>42 - Function **StartImpersonatingLoggedOnUser** failed with an unexpected exception. </td> 
        <td>Check the logs for the exception message and HResult.</td>
    </tr>
    <tr>
        <td>43 - Function **EndImpersonatingLoggedOnUser** failed with an unexpected exception.</td>
        <td>Check the logs for the exception message and HResult.</td>
    </tr>
 <tr>
        <td>44 - Diagtrack.dll version is old, so Auth Proxy will not work.</td>
        <td>Update the PC using Windows Update/Windows Server Update Services.</td>
    </tr>
 <tr>
        <td>45 - Diagrack.dll was not found.</td>
        <td>Update the PC using Windows Update/Windows Server Update Services.</td>
    </tr>
 <tr>
        <td>48 - **CommercialID** mentioned in RunConfig.bat should be a GUID.</td>
        <td>**CommercialID** is mentioned in RunConfig.bat, but it is not a GUID. Copy the commercialID from your workspace. To find the commercialID, in the OMS portal click **Upgrade Readiness > Settings**.</td>
    </tr>
 <tr>
        <td>50 - Diagtrack Service is not running.</td>
        <td>Diagtrack Service is required to send data to Microsoft. Enable and run the 'Connected User Experiences and Telemetry' service. </td>
    </tr>
 <tr>
        <td>51 - RunCensus failed with an unexpected exception.</td>
        <td>RunCensus explitly runs the process used to collect device information. The method failed with an unexpected exception. Check the ExceptionHResult and ExceptionMessage for more details. </td>
    </tr>
 <tr>
        <td>52 - DeviceCensus.exe not found on a Windows 10 machine.</td>
        <td>On computers running Windows 10, the process devicecensus.exe should be present in the <windows directory>\system32 folder. Error code 52 is returned if the process was not found. Ensure that it exists at the specified location. </td>
    </tr>
 <tr>
        <td>53 - There is a different CommercialID present at the GPO path:  <font size="1">**HKLM:\SOFTWARE\Policies\Microsoft
 \Windows\DataCollection**</font>. This will take precedence over the CommercialID provided in the script.</td>
        <td>Provide the correct CommercialID at the GPO location. </td>
    </tr>
 </table>
 </div>
 >[!NOTE]
--- a/windows/deployment/volume-activation/active-directory-based-activation-overview.md
+++ b/windows/deployment/volume-activation/active-directory-based-activation-overview.md
@ -7,18 +7,29 @@ ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.pagetype: activation
 author: greg-lindsay
-ms.date: 04/19/2017
+ms.date: 12/07/2018
 ---
-# Active Directory-Based Activation Overview
+# Active Directory-Based Activation overview
 Active Directory-Based Activation (ADBA) enables enterprises to activate computers through a connection to their domain. Many companies have computers at offsite locations that use products that are registered to the company. Previously these computers needed to either use a retail key or a Multiple Activation Key (MAK), or physically connect to the network in order to activate their products by using Key Management Services (KMS). ADBA provides a way to activate these products if the computers can join the company’s domain. When the user joins their computer to the domain, the ADBA object automatically activates Windows installed on their computer, as long as the computer has a Generic Volume License Key (GVLK) installed. No single physical computer is required to act as the activation object, because it is distributed throughout the domain.
-## Active Directory-Based Activation Scenarios
+## ADBA scenarios
-VAMT enables IT Professionals to manage and activate the Active Directory-Based Activation object. Activation can be performed by using a scenario such as the following:
+You might use ADBA if you only want to activate domain joined devices.
-   Online activation: To activate an ADBA forest online, the user selects the **Online activate forest** function, selects a KMS Host key (CSVLK) to use, and gives the Active Directory-Based Activation Object a name.
+
-   Proxy activation: For a proxy activation, the user first selects the **Proxy activate forest** function, selects a KMS Host key (CSVLK) to use, gives the Active Directory-Based Activation Object a name, and provides a file name to save the CILx file that contains the Installation ID. Next, the user takes that file to a computer that is running VAMT with an Internet connection and then selects the **Acquire confirmation IDs for CILX** function on the VAMT landing page, and provides the original CILx file. When VAMT has loaded the Confirmation IDs into the original CILx file, the user takes this file back to the original VAMT instance, where the user completes the proxy activation process by selecting the **Apply confirmation ID to Active Directory domain** function.
+If you have a server hosting the KMS service, it can be necessary to reactivate licenses if the server is replaced with a new host. This is not necessary When ADBA is used. 
 ADBA can also make load balancing easier when multiple KMS servers are present since the client can connect to any domain controller. This is simpler than using the DNS service to load balance by configuring priority and weight values.
 Some VDI solutions also require that new clients activate during creation before they are added to the pool. In this scenario, ADBA can eliminate potential VDI issues that might arise due to a KMS outage. 
 ## ADBA methods
 VAMT enables IT Professionals to manage and activate the ADBA object. Activation can be performed using the following methods:
 -   Online activation: To activate an ADBA forest online, the user selects the **Online activate forest** function, selects a KMS Host key (CSVLK) to use, and gives the ADBA Object a name.
 -   Proxy activation: For a proxy activation, the user first selects the **Proxy activate forest** function, selects a KMS Host key (CSVLK) to use, gives the ADBA Object a name, and provides a file name to save the CILx file that contains the Installation ID. Next, the user takes that file to a computer that is running VAMT with an Internet connection and then selects the **Acquire confirmation IDs for CILX** function on the VAMT landing page, and provides the original CILx file. When VAMT has loaded the Confirmation IDs into the original CILx file, the user takes this file back to the original VAMT instance, where the user completes the proxy activation process by selecting the **Apply confirmation ID to Active Directory domain** function.
 ## Related topics
--- a/windows/hub/TOC.md
+++ b/windows/hub/TOC.md
@ -1,5 +1,6 @@
 # [Windows 10 and Windows 10 Mobile](index.md)
 ## [What's new](/windows/whats-new)
 ## [Release information](release-information.md)
 ## [Deployment](/windows/deployment)
 ## [Configuration](/windows/configuration)
 ## [Client management](/windows/client-management)
--- a/windows/hub/docfx.json
+++ b/windows/hub/docfx.json
@ -38,7 +38,6 @@
 		"ms.technology": "windows",
 		"ms.topic": "article",
 		"ms.author": "brianlic",
 		"ms.date": "04/05/2017",
 		"feedback_system": "GitHub",
 		"feedback_github_repo": "MicrosoftDocs/windows-itpro-docs",
 		"feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app",
--- a/windows/hub/release-information.md
+++ b/windows/hub/release-information.md
@ -0,0 +1,37 @@
 ---
 title: Windows 10 - release information
 description: Learn release information for Windows 10 releases
 keywords: ["Windows 10", "Windows 10 October 2018 Update"]
 ms.prod: w10
 layout: LandingPage  
 ms.topic: landing-page
 ms.mktglfcycl: deploy
 ms.sitesec: library
 author: lizap
 ms.author: elizapo
 ms.localizationpriority: high
 ---
 # Windows 10 - Release information
 >[!IMPORTANT]
 > The URL for the release information page has changed - update your bookmark!
 Microsoft has updated its servicing model. The Semi-Annual Channel (SAC) offers twice-per-year feature updates that release around March and September, with an 18-month servicing period for each release. Starting with Windows 10, version 1809, feature updates for Windows 10 Enterprise and Education editions with a targeted release month of September will be serviced for 30 months from their release date (more information can be found [here](https://www.microsoft.com/microsoft-365/blog/2018/09/06/helping-customers-shift-to-a-modern-desktop/)). 
 If you are not using Windows Update for Business today, “Semi-Annual Channel (Targeted)” (SAC-T) has no impact on your devices (more information can be found [here](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-10-and-the-disappearing-SAC-T/ba-p/199747)), and we recommend you begin deployment of each Semi-Annual Channel release right away to devices selected for early adoption and ramp up to full deployment at your discretion. This will enable you to gain access to new features, experiences, and integrated security as soon as possible. 
 If you are using Windows Update for Business today, refer to the table below to understand when your device will be updated, based on which deferral period you have configured, SAC -T or SAC.  
 **Notice: November 13, 2018:** All editions of Windows 10 October 2018 Update, version 1809, for Windows client and server have resumed. Customers currently running Windows 10, version 1809, will receive build 17763.134 as part of our regularly scheduled Update Tuesday servicing in November. If you update to the Window 10, version 1809, feature update you will receive build 17763.107. On the next automatic scan for updates, you’ll be taken to the latest cumulative update (build 17763.134 or higher).   
 November 13 marks the revised start of the servicing timeline for the Semi-Annual Channel ("Targeted") and Long-Term Servicing Channel (LTSC) release for Windows 10, version 1809, Windows Server 2019, and Windows Server, version 1809.
 For information about the re-release and updates to the support lifecycle, refer to [John Cable's blog](https://blogs.windows.com/windowsexperience/2018/10/09/updated-version-of-windows-10-october-2018-update-released-to-windows-insiders/), [Windows 10 Update History](https://support.microsoft.com/help/4464619), and the [Windows lifecycle fact sheet](https://support.microsoft.com/help/13853).   
 <div class="m-rich-content-block" data-grid="col-12">
    <div id="winrelinfo" xmlns="http://www.w3.org/1999/xhtml"><iframe width="100%" height="866px" id="winrelinfo_iframe" src="https://winreleaseinfoprod.blob.core.windows.net/winreleaseinfoprod/en-US.html" frameborder="0" marginwidth="0" marginheight="0" scrolling="auto"></iframe></div>
    <script src="https://winreleaseinfoprod.blob.core.windows.net/winreleaseinfoprod/iframe.js" xmlns="http://www.w3.org/1999/xhtml"></script>
    <script xmlns="http://www.w3.org/1999/xhtml">/*<![CDATA[*/winrelinfo_setup("https://winreleaseinfoprod.blob.core.windows.net/winreleaseinfoprod/en-US.html")/*]]>*/</script>
 </div>
--- a/windows/privacy/enhanced-diagnostic-data-windows-analytics-events-and-fields.md
+++ b/windows/privacy/enhanced-diagnostic-data-windows-analytics-events-and-fields.md
@ -7,7 +7,7 @@ ms.mktglfcycl: manage
 ms.sitesec: library
 ms.pagetype: security
 ms.localizationpriority: high
-ms.date: 10/16/2017
+ms.date: 11/9/2018
 author: danihalfin    
 ms.author: daniha
 ---
--- a/windows/security/identity-protection/access-control/local-accounts.md
+++ b/windows/security/identity-protection/access-control/local-accounts.md
@ -5,7 +5,7 @@ ms.prod: w10
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.pagetype: security
-ms.date: 07/30/2018
+ms.date: 12/10/2018
 ---
 # Local Accounts
@ -16,15 +16,8 @@ ms.date: 07/30/2018
 This reference topic for the IT professional describes the default local user accounts for servers, including how to manage these built-in accounts on a member or standalone server. This topic does not describe the default local user accounts for an Active Directory domain controller.
 **Did you mean…**
 -   [Active Directory Accounts](active-directory-accounts.md)
 -   [Microsoft Accounts](microsoft-accounts.md)
 ## <a href="" id="about-local-user-accounts-"></a>About local user accounts
 Local user accounts are stored locally on the server. These accounts can be assigned rights and permissions on a particular server, but on that server only. Local user accounts are security principals that are used to secure and manage access to the resources on a standalone or member server for services or users.
 This topic describes the following:
@ -475,14 +468,9 @@ Passwords can be randomized by:
 -   Purchasing and implementing an enterprise tool to accomplish this task. These tools are commonly referred to as "privileged password management" tools.
-   Configuring, customizing and implementing a free tool to accomplish this task. A sample tool with source code is available at [Solution for management of built-in Administrator account’s password via GPO](https://code.msdn.microsoft.com/windowsdesktop/Solution-for-management-of-ae44e789).
+-   Configuring [Local Administrator Password Solution (LAPS)](https://www.microsoft.com/download/details.aspx?id=46899) to accomplish this task.
-    **Note**  
+-   Creating and implementing a custom script or solution to randomize local account passwords.
    This tool is not supported by Microsoft. There are some important considerations to make before deploying this tool because this tool requires client-side extensions and schema extensions to support password generation and storage.
 -   Create and implement a custom script or solution to randomize local account passwords.
 ## <a href="" id="dhcp-references"></a>See also
--- a/windows/security/information-protection/bitlocker/images/kernel-dma-protection-security-center.png
+++ b/windows/security/information-protection/bitlocker/images/kernel-dma-protection-security-center.png
--- a/windows/security/information-protection/images/kernel-dma-protection-security-center.jpg
+++ b/windows/security/information-protection/images/kernel-dma-protection-security-center.jpg
--- a/windows/security/information-protection/images/kernel-dma-protection-security-center.png
+++ b/windows/security/information-protection/images/kernel-dma-protection-security-center.png
--- a/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md
+++ b/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md
@ -6,7 +6,7 @@ ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.pagetype: security
 author: aadake
-ms.date: 10/03/2018
+ms.date: 12/08/2018
 ---
 # Kernel DMA Protection for Thunderbolt™ 3 
@ -65,11 +65,17 @@ Systems released prior to Windows 10 version 1803 do not support Kernel DMA Prot
 Systems running Windows 10 version 1803 that do support Kernel DMA Protection do have this security feature enabled automatically by the OS with no user or IT admin configuration required.
-**To check if a device supports Kernel DMA Protection**
+### Using Security Center
 Beginning with Wndows 10 version 1809, you can use Security Center to check if Kernel DMA Protection is enabled. Click **Start** > **Settings** > **Update & Security** > **Windows Security** > **Open Windows Security** > **Device security** > **Core isolation details** > **Memory access protection**.
 ![Kernel DMA protection in Security Center](bitlocker/images/kernel-dma-protection-security-center.png)
 ### Using System information
 1. Launch MSINFO32.exe in a command prompt, or in the Windows search bar.
 2. Check the value of **Kernel DMA Protection**.
-   ![Kernel DMA protection](bitlocker/images/kernel-dma-protection.png)
+   ![Kernel DMA protection in System Information](bitlocker/images/kernel-dma-protection.png)
 3. If the current state of **Kernel DMA Protection** is OFF and **Virtualization Technology in Firmware** is NO:
   - Reboot into BIOS settings
   - Turn on Intel Virtualization Technology.
--- a/windows/security/threat-protection/device-control/images/class-guids.png
+++ b/windows/security/threat-protection/device-control/images/class-guids.png
--- a/windows/security/threat-protection/device-control/images/hardware-ids.png
+++ b/windows/security/threat-protection/device-control/images/hardware-ids.png
--- a/windows/security/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md
@ -11,7 +11,7 @@ ms.pagetype: security
 ms.localizationpriority: medium
 author: andreabichsel
 ms.author: v-anbic
-ms.date: 09/03/2018
+ms.date: 12/10/2018
 ---
 # Configure and manage Windows Defender Antivirus with the mpcmdrun.exe command-line tool
@ -37,16 +37,20 @@ MpCmdRun.exe [command] [-options]
 Command | Description 
 :---|:---
-\- ? **or** -h | Displays all available options for the tool
+\-? **or** -h | Displays all available options for this tool
-\-Scan [-ScanType #] [-File <path> [-DisableRemediation] [-BootSectorScan]][-Timeout <days>] | Scans for malicious software
+\-Scan [-ScanType #] [-File <path> [-DisableRemediation] [-BootSectorScan]] [-Timeout <days>] [-Cancel] | Scans for malicious software
-\-Trace  [-Grouping #] [-Level #]| Starts diagnostic tracing
+\-Trace [-Grouping #] [-Level #] | Starts diagnostic tracing
-\-GetFiles | Collects support information
+\-GetFiles | Collects support information
-\-RemoveDefinitions [-All] | Restores the installed signature definitions to a previous backup copy or to the original default set of signatures
+\-GetFilesDiagTrack | Same as Getfiles but outputs to temporary DiagTrack folder
-\-AddDynamicSignature [-Path] | Loads a dynamic signature
+\-RemoveDefinitions [-All] | Restores the installed signature definitions to a previous backup copy or to the original default set of signatures
-\-ListAllDynamicSignature [-Path] | Lists the loaded dynamic signatures
+\-RemoveDefinitions [-DynamicSignatures] | Removes only the dynamically downloaded signatures
-\-RemoveDynamicSignature [-SignatureSetID] | Removes a dynamic signature
+\-SignatureUpdate [-UNC \| -MMPC] | Checks for new definition updates
-\-ValidateMapsConnection | Used to validate connection to the [cloud-delivered protection service](configure-network-connections-windows-defender-antivirus.md)
+\-Restore  [-ListAll \| [[-Name <name>] [-All] \| [-FilePath <filePath>]] [-Path <path>]] | Restores or lists quarantined item(s)
-\-SignatureUpdate [-UNC [-Path <path>]] | Checks for new definition updates
+\-AddDynamicSignature [-Path] | Loads a dynamic signature
 \-ListAllDynamicSignatures | Lists the loaded dynamic signatures
 \-RemoveDynamicSignature [-SignatureSetID] | Removes a dynamic signature
 \-CheckExclusion -path <path> | Checks whether a path is excluded
 ## Related topics
--- a/windows/security/threat-protection/windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus.md
@ -11,7 +11,7 @@ ms.pagetype: security
 ms.localizationpriority: medium
 author: andreabichsel
 ms.author: v-anbic
-ms.date: 09/03/2018
+ms.date: 12/10/2018
 ---
 # Configure and validate exclusions based on file extension and folder location
@ -264,7 +264,7 @@ The following table describes how the wildcards can be used and provides some ex
 ## Review the list of exclusions
-You can retrieve the items in the exclusion list with [Intune](https://docs.microsoft.com/intune/deploy-use/help-secure-windows-pcs-with-endpoint-protection-for-microsoft-intune), [System Center Configuration Manager](https://docs.microsoft.com/sccm/protect/deploy-use/endpoint-antimalware-policies#exclusion-settings), PowerShell, or the [Windows Security app](windows-defender-security-center-antivirus.md#exclusions).
+You can retrieve the items in the exclusion list with [Intune](https://docs.microsoft.com/intune/deploy-use/help-secure-windows-pcs-with-endpoint-protection-for-microsoft-intune), [System Center Configuration Manager](https://docs.microsoft.com/sccm/protect/deploy-use/endpoint-antimalware-policies#exclusion-settings), MpCmdRun, PowerShell, or the [Windows Security app](windows-defender-security-center-antivirus.md#exclusions).
 >[!IMPORTANT]
 >Exclusion list changes made with Group Policy **will show** in the lists in the [Windows Security app](windows-defender-security-center-antivirus.md#exclusions).
@ -276,7 +276,18 @@ If you use PowerShell, you can retrieve the list in two ways:
 - Retrieve the status of all Windows Defender Antivirus preferences. Each of the lists will be displayed on separate lines, but the items within each list will be combined into the same line.
 - Write the status of all preferences to a variable, and use that variable to only call the specific list you are interested in. Each use of `Add-MpPreference` is written to a new line.
-**Review the list of exclusions alongside all other Windows Defender Antivirus preferences:**
+**Validate the exclusion list by using MpCmdRun:**
 To check exclusions with the dedicated [command-line tool mpcmdrun.exe](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus?branch=v-anbic-wdav-new-mpcmdrun-options), use the following command:
 ```DOS
 MpCmdRun.exe -CheckExclusion -path <path>
 ```
 >[!NOTE]
 >Checking exclusions with MpCmdRun requires Windows Defender Antivirus CAMP version 4.18.1812.3 (released in December 2018) or later.
 **Review the list of exclusions alongside all other Windows Defender Antivirus preferences by using PowerShell:**
 Use the following cmdlet:
@ -290,7 +301,7 @@ In the following example, the items contained in the `ExclusionExtension` list a
 See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index) for more information on how to use PowerShell with Windows Defender Antivirus.
-**Retrieve a specific exclusions list:**
+**Retrieve a specific exclusions list by using PowerShell:**
 Use the following code snippet (enter each line as a separate command); replace **WDAVprefs** with whatever label you want to name the variable:
--- a/windows/security/threat-protection/windows-defender-antivirus/configure-process-opened-file-exclusions-windows-defender-antivirus.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/configure-process-opened-file-exclusions-windows-defender-antivirus.md
@ -11,7 +11,7 @@ ms.pagetype: security
 ms.localizationpriority: medium
 author: andreabichsel
 ms.author: v-anbic
-ms.date: 09/03/2018
+ms.date: 12/10/2018
 ---
 # Configure exclusions for files opened by processes
@ -147,14 +147,26 @@ Environment variables | The defined variable will be populated as a path when th
 ## Review the list of exclusions
-You can retrieve the items in the exclusion list with PowerShell, [System Center Configuration Manager](https://docs.microsoft.com/sccm/protect/deploy-use/endpoint-antimalware-policies#exclusion-settings), [Intune](https://docs.microsoft.com/intune/device-restrictions-configure), or the [Windows Security app](windows-defender-security-center-antivirus.md#exclusions).
+You can retrieve the items in the exclusion list with MpCmdRun, PowerShell, [System Center Configuration Manager](https://docs.microsoft.com/sccm/protect/deploy-use/endpoint-antimalware-policies#exclusion-settings), [Intune](https://docs.microsoft.com/intune/device-restrictions-configure), or the [Windows Security app](windows-defender-security-center-antivirus.md#exclusions).
 If you use PowerShell, you can retrieve the list in two ways:
 - Retrieve the status of all Windows Defender Antivirus preferences. Each of the lists will be displayed on separate lines, but the items within each list will be combined into the same line.
 - Write the status of all preferences to a variable, and use that variable to only call the specific list you are interested in. Each use of `Add-MpPreference` is written to a new line.
-**Review the list of exclusions alongside all other Windows Defender Antivirus preferences:**
+**Validate the exclusion list by using MpCmdRun:**
 To check exclusions with the dedicated [command-line tool mpcmdrun.exe](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus?branch=v-anbic-wdav-new-mpcmdrun-options), use the following command:
 ```DOS
 MpCmdRun.exe -CheckExclusion -path <path>
 ```
 >[!NOTE]
 >Checking exclusions with MpCmdRun requires Windows Defender Antivirus CAMP version 4.18.1812.3 (released in December 2018) or later.
 **Review the list of exclusions alongside all other Windows Defender Antivirus preferences by using PowerShell:**
 Use the following cmdlet:
@ -164,7 +176,7 @@ Get-MpPreference
 See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index) for more information on how to use PowerShell with Windows Defender Antivirus.
-**Retrieve a specific exclusions list:**
+**Retrieve a specific exclusions list by using PowerShell:**
 Use the following code snippet (enter each line as a separate command); replace **WDAVprefs** with whatever label you want to name the variable:
--- a/windows/security/threat-protection/windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md
@ -11,7 +11,7 @@ ms.pagetype: security
 ms.localizationpriority: medium
 author: andreabichsel
 ms.author: v-anbic
-ms.date: 09/03/2018
+ms.date: 12/10/2018
 ---
 # Configure scheduled quick or full Windows Defender Antivirus scans
@ -42,7 +42,6 @@ To configure the Group Policy settings described in this topic:
 6. Double-click the policy **Setting** as specified in the table below, and set the option to your desired configuration. Click **OK**, and repeat for any other settings.
 Also see the [Manage when protection updates should be downloaded and applied](manage-protection-update-schedule-windows-defender-antivirus.md) and [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-windows-defender-antivirus.md) topics.
 ## Quick scan versus full scan and custom scan
@ -66,6 +65,8 @@ A custom scan allows you to specify the files and folders to scan, such as a USB
 Scheduled scans will run at the day and time you specify. You can use Group Policy, PowerShell, and WMI to configure scheduled scans.
 >[!NOTE]
 >If a computer is unplugged and running on battery during a scheduled full scan, the scheduled scan will stop with event 1002, which states that the scan stopped before completion. Windows Defender Antivirus will run a full scan at the next scheduled time.
 **Use Group Policy to schedule scans:**
--- a/windows/security/threat-protection/windows-defender-atp/alerts-windows-defender-advanced-threat-protection-new.md
+++ b/windows/security/threat-protection/windows-defender-atp/alerts-windows-defender-advanced-threat-protection-new.md
@ -50,7 +50,6 @@ detectionSource | string | Detection source.
 threatFamilyName | string | Threat family.
 title | string | Alert title.
 description | String | Description of the threat, identified by the alert.
 recommendedAction | String | Action recommended for handling the suspected threat.
 alertCreationTime | DateTimeOffset | The date and time (in UTC) the alert was created.
 lastEventTime | DateTimeOffset | The last occurance of the event that triggered the alert on the same machine.
 firstEventTime | DateTimeOffset | The first occurance of the event that triggered the alert on that machine.
@ -74,7 +73,6 @@ machineId | String | ID of a [machine](machine-windows-defender-advanced-threat-
 	"threatFamilyName": "Mikatz",
 	"title": "Windows Defender AV detected 'Mikatz', high-severity malware",
 	"description": "Some description"
 	"recommendedAction": "Some recommended action"
 	"alertCreationTime": "2018-11-26T16:19:21.8409809Z",
 	"firstEventTime": "2018-11-26T16:17:50.0948658Z",
 	"lastEventTime": "2018-11-26T16:18:01.809871Z",
--- a/windows/security/threat-protection/windows-defender-atp/attack-simulations-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/attack-simulations-windows-defender-advanced-threat-protection.md
@ -26,7 +26,8 @@ ms.date: 11/20/2018
 >Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-attacksimulations-abovefoldlink)
 >[!TIP]
-> Learn about the latest enhancements in Windows Defender ATP: [What's new in Windows Defender ATP](https://cloudblogs.microsoft.com/microsoftsecure/2018/11/15/whats-new-in-windows-defender-atp/).
+>- Learn about the latest enhancements in Windows Defender ATP: [What's new in Windows Defender ATP](https://cloudblogs.microsoft.com/microsoftsecure/2018/11/15/whats-new-in-windows-defender-atp/).
 >- Windows Defender ATP demonstrated industry-leading optics and detection capabilities in the recent MITRE evaluation. Read: [Insights from the MITRE ATT&CK-based evaluation](https://cloudblogs.microsoft.com/microsoftsecure/2018/12/03/insights-from-the-mitre-attack-based-evaluation-of-windows-defender-atp/).
 You might want to experience Windows Defender ATP before you onboard more than a few machines to the service. To do this, you can run controlled attack simulations on a few test machines. After running the simulated attacks, you can review how Windows Defender ATP surfaces malicious activity and explore how it enables an efficient response.
--- a/windows/security/threat-protection/windows-defender-atp/create-alert-by-reference-windows-defender-advanced-threat-protection-new.md
+++ b/windows/security/threat-protection/windows-defender-atp/create-alert-by-reference-windows-defender-advanced-threat-protection-new.md
@ -84,8 +84,8 @@ Content-Length: application/json
  "machineId": "1e5bc9d7e413ddd7902c2932e418702b84d0cc07",
  "severity": "Low",
  "title": "test alert",
-  "description": "redalert",
+  "description": "test alert",
-  "recommendedAction": "white alert",
+  "recommendedAction": "test alert",
  "eventTime": "2018-08-03T16:45:21.7115183Z",
  "reportId": "20776",
  "category": "None"
--- a/windows/security/threat-protection/windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection.md
@ -11,7 +11,7 @@ ms.pagetype: security
 ms.author: macapara
 author: mjcaparas
 ms.localizationpriority: medium
-ms.date: 10/08/2018
+ms.date: 12/10/2018
 ---
 # Enable SIEM integration in Windows Defender ATP
@ -20,14 +20,21 @@ ms.date: 10/08/2018
 - [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://wincom.blob.core.windows.net/documents/Windows10_Commercial_Comparison.pdf)
 >Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-enablesiem-abovefoldlink) 
 Enable security information and event management (SIEM) integration so you can pull alerts from Windows Defender Security Center using your SIEM solution or by connecting directly to the alerts REST API.
 ## Prerequisites
 - The user who activates the setting must have permissions to create an app in Azure Active Directory (AAD). This is typically someone with a **Global administrator** role.
 - During the initial activation, a pop-up screen is displayed for credentials to be entered. Make sure that you allow pop-ups for this site.
 ## Enabling SIEM integration 
 1. In the navigation pane, select **Settings** > **SIEM**.
-  ![Image of SIEM integration from Settings menu](images/atp-siem-integration.png)
+    ![Image of SIEM integration from Settings menu](images/enable_siem.png)
    >[!TIP]
    >If you encounter an error when trying to enable the SIEM connector application, check the pop-up blocker settings of your browser. It might be blocking the new window being opened when you enable the capability. 
 2. Select **Enable SIEM integration**. This activates the **SIEM connector access details** section with pre-populated values and an application is created under you Azure Active Directory (AAD) tenant.
@ -35,6 +42,8 @@ Enable security information and event management (SIEM) integration so you can p
    >The client secret is only displayed once. Make sure you keep a copy of it in a safe place.<br>
     For more information about getting a new secret see, [Learn how to get a new secret](troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md#learn-how-to-get-a-new-client-secret).
    ![Image of SIEM integration from Settings menu](images/siem_details.png)
 3. Choose the SIEM type you use in your organization.
  > [!NOTE]
--- a/windows/security/threat-protection/windows-defender-atp/exposed-apis-odata-samples.md
+++ b/windows/security/threat-protection/windows-defender-atp/exposed-apis-odata-samples.md
@ -100,8 +100,7 @@ Content-type: application/json
 			"detectionSource": "WindowsDefenderAv",
 			"threatFamilyName": "Mikatz",
 			"title": "Windows Defender AV detected 'Mikatz', high-severity malware",
-			"description": "Some description"
+			"description": "Some description",
 			"recommendedAction": "Some recommended action"
 			"alertCreationTime": "2018-11-26T16:19:21.8409809Z",
 			"firstEventTime": "2018-11-26T16:17:50.0948658Z",
 			"lastEventTime": "2018-11-26T16:18:01.809871Z",
--- a/windows/security/threat-protection/windows-defender-atp/get-alert-info-by-id-windows-defender-advanced-threat-protection-new.md
+++ b/windows/security/threat-protection/windows-defender-atp/get-alert-info-by-id-windows-defender-advanced-threat-protection-new.md
@ -87,8 +87,7 @@ Here is an example of the response.
 	"detectionSource": "WindowsDefenderAv",
 	"threatFamilyName": "Mikatz",
 	"title": "Windows Defender AV detected 'Mikatz', high-severity malware",
-	"description": "Some description"
+	"description": "Some description",
 	"recommendedAction": "Some recommended action"
 	"alertCreationTime": "2018-11-25T16:19:21.8409809Z",
 	"firstEventTime": "2018-11-25T16:17:50.0948658Z",
 	"lastEventTime": "2018-11-25T16:18:01.809871Z",
--- a/windows/security/threat-protection/windows-defender-atp/get-alerts-windows-defender-advanced-threat-protection-new.md
+++ b/windows/security/threat-protection/windows-defender-atp/get-alerts-windows-defender-advanced-threat-protection-new.md
@ -100,8 +100,7 @@ Here is an example of the response.
 			"detectionSource": "WindowsDefenderAv",
 			"threatFamilyName": "Mikatz",
 			"title": "Windows Defender AV detected 'Mikatz', high-severity malware",
-			"description": "Some description"
+			"description": "Some description",
 			"recommendedAction": "Some recommended action"
 			"alertCreationTime": "2018-11-26T16:19:21.8409809Z",
 			"firstEventTime": "2018-11-26T16:17:50.0948658Z",
 			"lastEventTime": "2018-11-26T16:18:01.809871Z",
@ -121,8 +120,7 @@ Here is an example of the response.
 			"detectionSource": "WindowsDefenderAv",
 			"threatFamilyName": "Mikatz",
 			"title": "Windows Defender AV detected 'Mikatz', high-severity malware",
-			"description": "Some description"
+			"description": "Some description",
 			"recommendedAction": "Some recommended action"
 			"alertCreationTime": "2018-11-25T16:19:21.8409809Z",
 			"firstEventTime": "2018-11-25T16:17:50.0948658Z",
 			"lastEventTime": "2018-11-25T16:18:01.809871Z",
--- a/windows/security/threat-protection/windows-defender-atp/get-domain-related-alerts-windows-defender-advanced-threat-protection-new.md
+++ b/windows/security/threat-protection/windows-defender-atp/get-domain-related-alerts-windows-defender-advanced-threat-protection-new.md
@ -96,8 +96,7 @@ Content-type: application/json
 			"detectionSource": "WindowsDefenderAv",
 			"threatFamilyName": "Mikatz",
 			"title": "Windows Defender AV detected 'Mikatz', high-severity malware",
-			"description": "Some description"
+			"description": "Some description",
 			"recommendedAction": "Some recommended action"
 			"alertCreationTime": "2018-11-25T16:19:21.8409809Z",
 			"firstEventTime": "2018-11-25T16:17:50.0948658Z",
 			"lastEventTime": "2018-11-25T16:18:01.809871Z",
@ -117,8 +116,7 @@ Content-type: application/json
 			"detectionSource": "WindowsDefenderAv",
 			"threatFamilyName": "Mikatz",
 			"title": "Windows Defender AV detected 'Mikatz', high-severity malware",
-			"description": "Some description"
+			"description": "Some description",
 			"recommendedAction": "Some recommended action"
 			"alertCreationTime": "2018-11-24T16:19:21.8409809Z",
 			"firstEventTime": "2018-11-24T16:17:50.0948658Z",
 			"lastEventTime": "2018-11-24T16:18:01.809871Z",
--- a/windows/security/threat-protection/windows-defender-atp/get-file-related-alerts-windows-defender-advanced-threat-protection-new.md
+++ b/windows/security/threat-protection/windows-defender-atp/get-file-related-alerts-windows-defender-advanced-threat-protection-new.md
@ -94,8 +94,7 @@ Content-type: application/json
 			"detectionSource": "WindowsDefenderAv",
 			"threatFamilyName": "Mikatz",
 			"title": "Windows Defender AV detected 'Mikatz', high-severity malware",
-			"description": "Some description"
+			"description": "Some description",
 			"recommendedAction": "Some recommended action"
 			"alertCreationTime": "2018-11-26T16:19:21.8409809Z",
 			"firstEventTime": "2018-11-26T16:17:50.0948658Z",
 			"lastEventTime": "2018-11-26T16:18:01.809871Z",
--- a/windows/security/threat-protection/windows-defender-atp/get-ip-related-alerts-windows-defender-advanced-threat-protection-new.md
+++ b/windows/security/threat-protection/windows-defender-atp/get-ip-related-alerts-windows-defender-advanced-threat-protection-new.md
@ -93,8 +93,7 @@ Content-type: application/json
 			"detectionSource": "WindowsDefenderAv",
 			"threatFamilyName": "Mikatz",
 			"title": "Windows Defender AV detected 'Mikatz', high-severity malware",
-			"description": "Some description"
+			"description": "Some description",
 			"recommendedAction": "Some recommended action"
 			"alertCreationTime": "2018-11-25T16:19:21.8409809Z",
 			"firstEventTime": "2018-11-25T16:17:50.0948658Z",
 			"lastEventTime": "2018-11-25T16:18:01.809871Z",
--- a/windows/security/threat-protection/windows-defender-atp/get-machine-related-alerts-windows-defender-advanced-threat-protection-new.md
+++ b/windows/security/threat-protection/windows-defender-atp/get-machine-related-alerts-windows-defender-advanced-threat-protection-new.md
@ -93,8 +93,7 @@ Content-type: application/json
 			"detectionSource": "WindowsDefenderAv",
 			"threatFamilyName": "Mikatz",
 			"title": "Windows Defender AV detected 'Mikatz', high-severity malware",
-			"description": "Some description"
+			"description": "Some description",
 			"recommendedAction": "Some recommended action"
 			"alertCreationTime": "2018-11-25T16:19:21.8409809Z",
 			"firstEventTime": "2018-11-25T16:17:50.0948658Z",
 			"lastEventTime": "2018-11-25T16:18:01.809871Z",
--- a/windows/security/threat-protection/windows-defender-atp/get-started.md
+++ b/windows/security/threat-protection/windows-defender-atp/get-started.md
@ -20,7 +20,8 @@ ms.date: 11/20/2018
 - [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://wincom.blob.core.windows.net/documents/Windows10_Commercial_Comparison.pdf)
 >[!TIP]
-> Learn about the latest enhancements in Windows Defender ATP: [What's new in Windows Defender ATP](https://cloudblogs.microsoft.com/microsoftsecure/2018/11/15/whats-new-in-windows-defender-atp/).
+>- Learn about the latest enhancements in Windows Defender ATP: [What's new in Windows Defender ATP](https://cloudblogs.microsoft.com/microsoftsecure/2018/11/15/whats-new-in-windows-defender-atp/).
 >- Windows Defender ATP demonstrated industry-leading optics and detection capabilities in the recent MITRE evaluation. Read: [Insights from the MITRE ATT&CK-based evaluation](https://cloudblogs.microsoft.com/microsoftsecure/2018/12/03/insights-from-the-mitre-attack-based-evaluation-of-windows-defender-atp/).
 Learn about the minimum requirements and initial steps you need to take to get started with Windows Defender ATP.
--- a/windows/security/threat-protection/windows-defender-atp/get-user-related-alerts-windows-defender-advanced-threat-protection-new.md
+++ b/windows/security/threat-protection/windows-defender-atp/get-user-related-alerts-windows-defender-advanced-threat-protection-new.md
@ -93,8 +93,7 @@ Content-type: application/json
 			"detectionSource": "WindowsDefenderAv",
 			"threatFamilyName": "Mikatz",
 			"title": "Windows Defender AV detected 'Mikatz', high-severity malware",
-			"description": "Some description"
+			"description": "Some description",
 			"recommendedAction": "Some recommended action"
 			"alertCreationTime": "2018-11-25T16:19:21.8409809Z",
 			"firstEventTime": "2018-11-25T16:17:50.0948658Z",
 			"lastEventTime": "2018-11-25T16:18:01.809871Z",
@ -114,8 +113,7 @@ Content-type: application/json
 			"detectionSource": "WindowsDefenderAv",
 			"threatFamilyName": "Mikatz",
 			"title": "Windows Defender AV detected 'Mikatz', high-severity malware",
-			"description": "Some description"
+			"description": "Some description",
 			"recommendedAction": "Some recommended action"
 			"alertCreationTime": "2018-11-24T16:19:21.8409809Z",
 			"firstEventTime": "2018-11-24T16:17:50.0948658Z",
 			"lastEventTime": "2018-11-24T16:18:01.809871Z",
--- a/windows/security/threat-protection/windows-defender-atp/images/enable_siem.png
+++ b/windows/security/threat-protection/windows-defender-atp/images/enable_siem.png
--- a/windows/security/threat-protection/windows-defender-atp/images/siem_details.png
+++ b/windows/security/threat-protection/windows-defender-atp/images/siem_details.png
--- a/windows/security/threat-protection/windows-defender-atp/information-protection-in-windows-overview.md
+++ b/windows/security/threat-protection/windows-defender-atp/information-protection-in-windows-overview.md
@ -31,12 +31,12 @@ Windows Defender ATP applies two methods to discover and protect data:
 ## Data discovery 
-Windows Defender ATP automatically discovers files with Office 365 sensitivity labels on Windows devices when the feature is enabled. You can enable the Azure Information Protection integration feature from Windows Defender Security Center. For more information, see [Configure advanced features](advanced-features-windows-defender-advanced-threat-protection.md#azure-information-protection).
+Windows Defender ATP automatically discovers files with sensitivity labels on Windows devices when the feature is enabled. You can enable the Azure Information Protection integration feature from Windows Defender Security Center. For more information, see [Configure advanced features](advanced-features-windows-defender-advanced-threat-protection.md#azure-information-protection).
 ![Image of settings page with Azure Information Protection](images/atp-settings-aip.png)
-After enabling the Azure Information Protection integration, data discovery signals are immediately forwarded to Azure Information Protection from the device. When a file that has a sensitivity label applied is created or modified on a Windows device, Windows Defender ATP automatically reports the signal to Azure Information Protection.
+After enabling the Azure Information Protection integration, data discovery signals are immediately forwarded to Azure Information Protection from the device. When a labeled file is created or modified on a Windows device, Windows Defender ATP automatically reports the signal to Azure Information Protection.
 The reported signals can be viewed on the Azure Information Protection - Data discovery dashboard.
@ -70,7 +70,7 @@ InformationProtectionLogs_CL
 ```
 **Prerequisites:**
- Customers must have a subscription for Azure Information Protection, and be using a unified labeling client. 
+- Customers must have a subscription for Azure Information Protection.
 - Enable Azure Information Protection integration in Windows Defender Security Center: 
    - Go to **Settings** in Windows Defender Security Center, click on **Advanced Settings** under **General**.
--- a/windows/security/threat-protection/windows-defender-atp/machineaction-windows-defender-advanced-threat-protection-new.md
+++ b/windows/security/threat-protection/windows-defender-atp/machineaction-windows-defender-advanced-threat-protection-new.md
@ -40,7 +40,7 @@ id | Guid | Identity of the [Machine Action](machineaction-windows-defender-adva
 type | Enum | Type of the action. Possible values are: "RunAntiVirusScan", "Offboard", "CollectInvestigationPackage", "Isolate", "Unisolate", "StopAndQuarantineFile", "RestrictCodeExecution" and "UnrestrictCodeExecution"
 requestor | String | Identity of the person that executed the action.
 requestorComment | String | Comment that was written when issuing the action.
-status | Enum | Current status of the command. Possible values are: "InProgress", "Succeeded", "Failed", "TimeOut" and "Cancelled".
+status | Enum | Current status of the command. Possible values are: "Pending", "InProgress", "Succeeded", "Failed", "TimeOut" and "Cancelled".
 machineId | String | Id of the machine on which the action was executed.
 creationDateTimeUtc | DateTimeOffset | The date and time when the action was created.
 lastUpdateTimeUtc | DateTimeOffset | The last date and time when the action status was updated.
--- a/windows/security/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md
@ -25,7 +25,8 @@ There are some minimum requirements for onboarding machines to the service.
 >[!TIP]
-> Learn about the latest enhancements in Windows Defender ATP: [What's new in Windows Defender ATP](https://cloudblogs.microsoft.com/microsoftsecure/2018/11/15/whats-new-in-windows-defender-atp/).
+>- Learn about the latest enhancements in Windows Defender ATP: [What's new in Windows Defender ATP](https://cloudblogs.microsoft.com/microsoftsecure/2018/11/15/whats-new-in-windows-defender-atp/).
 >- Windows Defender ATP demonstrated industry-leading optics and detection capabilities in the recent MITRE evaluation. Read: [Insights from the MITRE ATT&CK-based evaluation](https://cloudblogs.microsoft.com/microsoftsecure/2018/12/03/insights-from-the-mitre-attack-based-evaluation-of-windows-defender-atp/).
 ## Licensing requirements
 Windows Defender Advanced Threat Protection requires one of the following Microsoft Volume Licensing offers:
--- a/windows/security/threat-protection/windows-defender-atp/overview.md
+++ b/windows/security/threat-protection/windows-defender-atp/overview.md
@ -22,7 +22,8 @@ ms.date: 11/20/2018
 Understand the concepts behind the capabilities in Windows Defender ATP so you take full advantage of the complete threat protection platform. 
 >[!TIP]
-> Learn about the latest enhancements in Windows Defender ATP: [What's new in Windows Defender ATP](https://cloudblogs.microsoft.com/microsoftsecure/2018/11/15/whats-new-in-windows-defender-atp/).
+>- Learn about the latest enhancements in Windows Defender ATP: [What's new in Windows Defender ATP](https://cloudblogs.microsoft.com/microsoftsecure/2018/11/15/whats-new-in-windows-defender-atp/).
 >- Windows Defender ATP demonstrated industry-leading optics and detection capabilities in the recent MITRE evaluation. Read: [Insights from the MITRE ATT&CK-based evaluation](https://cloudblogs.microsoft.com/microsoftsecure/2018/12/03/insights-from-the-mitre-attack-based-evaluation-of-windows-defender-atp/).
 ## In this section 
--- a/windows/security/threat-protection/windows-defender-atp/pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md
@ -73,7 +73,7 @@ The response will include an access token and expiry information.
 ```json
 {
  "token_type": "Bearer",
-  "expires_in": "3599"
+  "expires_in": "3599",
  "ext_expires_in": "0",
  "expires_on": "1488720683",
  "not_before": "1488720683",
@ -98,7 +98,7 @@ Authorization | string | Required. The Azure AD access token in the form **Beare
 ### Request parameters
-Use optional query parameters to specify and control the amount of data returned in a response. If you call this method without parameters, the response contains all the alerts in your organization.
+Use optional query parameters to specify and control the amount of data returned in a response. If you call this method without parameters, the response contains all the alerts in your organization in the last 2 hours.
 Name | Value| Description
 :---|:---|:---
@ -107,6 +107,8 @@ DateTime?untilTimeUtc | string | Defines the upper time bound alerts are retriev
 string ago | string | Pulls alerts in the following time range: from `(current_time - ago)` time to `current_time` time. <br><br> Value should be set according to **ISO 8601** duration format <br> E.g. `ago=PT10M` will pull alerts received in the last 10 minutes.
 int?limit | int | Defines the number of alerts to be retrieved. Most recent alerts will be retrieved based on the number defined.<br><br> **NOTE**: When not specified, all alerts available in the time range will be retrieved.
 machinegroups | String | Specifies machine groups to pull alerts from. <br><br> **NOTE**: When not specified, alerts from all machine groups will be retrieved. <br><br> Example: <br><br> ```https://wdatp-alertexporter-eu.securitycenter.windows.com/api/Alerts/?machinegroups=UKMachines&machinegroups=FranceMachines```
 DeviceCreatedMachineTags | string | Single machine tag from the registry.
 CloudCreatedMachineTags | string | Machine tags that were created in Windows Defender Security Center.
 ### Request example
 The following example demonstrates how to retrieve all the alerts in your organization.
--- a/windows/security/threat-protection/windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection.md
@ -236,7 +236,7 @@ For a machine to be considered "well configured", it must comply to a minimum ba
 >This security control is only applicable for machines with Windows 10, version 1803 or later.
 #### Minimum baseline configuration setting for BitLocker
- Ensure all supported internal drives are encrypted
+- Ensure all supported drives are encrypted
 - Ensure that all suspended protection on drives resume protection 
 - Ensure that drives are compatible
--- a/windows/security/threat-protection/windows-defender-atp/update-alert-windows-defender-advanced-threat-protection-new.md
+++ b/windows/security/threat-protection/windows-defender-atp/update-alert-windows-defender-advanced-threat-protection-new.md
@ -98,8 +98,7 @@ Here is an example of the response.
 	"detectionSource": "WindowsDefenderAv",
 	"threatFamilyName": "Mikatz",
 	"title": "Windows Defender AV detected 'Mikatz', high-severity malware",
-	"description": "Some description"
+	"description": "Some description",
 	"recommendedAction": "Some recommended action"
 	"alertCreationTime": "2018-11-26T16:19:21.8409809Z",
 	"firstEventTime": "2018-11-26T16:17:50.0948658Z",
 	"lastEventTime": "2018-11-26T16:18:01.809871Z",
--- a/windows/security/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection.md
@ -68,7 +68,8 @@ Windows Defender ATP uses the following combination of technology built into Win
 >[!TIP]
-> Learn about the latest enhancements in Windows Defender ATP: [What's new in Windows Defender ATP](https://cloudblogs.microsoft.com/microsoftsecure/2018/11/15/whats-new-in-windows-defender-atp/).
+>- Learn about the latest enhancements in Windows Defender ATP: [What's new in Windows Defender ATP](https://cloudblogs.microsoft.com/microsoftsecure/2018/11/15/whats-new-in-windows-defender-atp/).
 >- Windows Defender ATP demonstrated industry-leading optics and detection capabilities in the recent MITRE evaluation. Read: [Insights from the MITRE ATT&CK-based evaluation](https://cloudblogs.microsoft.com/microsoftsecure/2018/12/03/insights-from-the-mitre-attack-based-evaluation-of-windows-defender-atp/).
 **[Attack surface reduction](overview-attack-surface-reduction.md)**<br>
 The attack surface reduction set of capabilities provide the first line of defense in the stack. By ensuring configuration settings are properly set and exploit mitigation techniques are applied, these set of capabilities resist attacks and exploitations. 
--- a/windows/security/threat-protection/windows-defender-exploit-guard/event-views-exploit-guard.md
+++ b/windows/security/threat-protection/windows-defender-exploit-guard/event-views-exploit-guard.md
@ -33,13 +33,13 @@ You can also get detailed reporting into events and blocks as part of Windows Se
 You can create custom views in the Windows Event Viewer to only see events for specific capabilities and settings.
-The easiest way to do this is to import a custom view as an XML file. You can obtain XML files for each of the features in the [Exploit Guard Evaluation Package](https://aka.ms/mp7z2w), or you can copy the XML directly from this page.
+The easiest way to do this is to import a custom view as an XML file. You can copy the XML directly from this page.
 You can also manually navigate to the event area that corresponds to the feature, see the [list of attack surface reduction events](#list-of-attack-surface-reduction-events) section at the end of this topic for more details.
 ### Import an existing XML custom view
-1. Download the [Exploit Guard Evaluation Package](https://aka.ms/mp7z2w) and extract the appropriate file to an easily accessible location. The following filenames are each of the custom views:
+1. Create an empty .txt file and copy the XML for the custom view you want to use into the .txt file. Do this for each of the custom views you want to use. Rename the files as follows (ensure you change the type from .txt to .xml):
    -  Controlled folder access events custom view: *cfa-events.xml*
    -  Exploit protection events custom view: *ep-events.xml*
    -  Attack surface reduction events custom view: *asr-events.xml*
--- a/windows/whats-new/docfx.json
+++ b/windows/whats-new/docfx.json
@ -36,7 +36,6 @@
 		"ms.technology": "windows",
 		"ms.topic": "article",
 		"ms.author": "trudyha",
 		"ms.date": "04/05/2017",
 		"feedback_system": "GitHub",
 		"feedback_github_repo": "MicrosoftDocs/windows-itpro-docs",
 		"feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app",