From a1cf16038a4c05135af71d9bf73f6b110849269c Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Tue, 20 Aug 2019 14:37:44 +0530 Subject: [PATCH 01/43] Added Audit policies --- .../client-management/mdm/policy-csp-audit.md | 3623 +++++++++++++++++ 1 file changed, 3623 insertions(+) create mode 100644 windows/client-management/mdm/policy-csp-audit.md diff --git a/windows/client-management/mdm/policy-csp-audit.md b/windows/client-management/mdm/policy-csp-audit.md new file mode 100644 index 0000000000..08e3891e5b --- /dev/null +++ b/windows/client-management/mdm/policy-csp-audit.md @@ -0,0 +1,3623 @@ +--- +title: Policy CSP - Audit +description: Policy CSP - Audit +ms.author: Heidi.Lohr +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: Heidilohr +ms.date: 08/13/2019 +--- + +# Policy CSP - Audit + +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + + +
+ + +## Audit policies + +
+
+ Audit/AccountLogonLogoff_AuditAccountLockout +
+
+ Audit/AccountLogonLogoff_AuditGroupMembership +
+
+ Audit/AccountLogonLogoff_AuditIPsecExtendedMode +
+
+ Audit/AccountLogonLogoff_AuditIPsecMainMode +
+
+ Audit/AccountLogonLogoff_AuditIPsecQuickMode +
+
+ Audit/AccountLogonLogoff_AuditLogoff +
+
+ Audit/AccountLogonLogoff_AuditLogon +
+
+ Audit/AccountLogonLogoff_AuditNetworkPolicyServer +
+
+ Audit/AccountLogonLogoff_AuditOtherLogonLogoffEvents +
+
+ Audit/AccountLogonLogoff_AuditSpecialLogon +
+
+ Audit/AccountLogonLogoff_AuditUserDeviceClaims +
+
+ Audit/AccountLogon_AuditCredentialValidation +
+
+ Audit/AccountLogon_AuditKerberosAuthenticationService +
+
+ Audit/AccountLogon_AuditKerberosServiceTicketOperations +
+
+ Audit/AccountLogon_AuditOtherAccountLogonEvents +
+
+ Audit/AccountManagement_AuditApplicationGroupManagement +
+
+ Audit/AccountManagement_AuditComputerAccountManagement +
+
+ Audit/AccountManagement_AuditDistributionGroupManagement +
+
+ Audit/AccountManagement_AuditOtherAccountManagementEvents +
+
+ Audit/AccountManagement_AuditSecurityGroupManagement +
+
+ Audit/AccountManagement_AuditUserAccountManagement +
+
+ Audit/DSAccess_AuditDetailedDirectoryServiceReplication +
+
+ Audit/DSAccess_AuditDirectoryServiceAccess +
+
+ Audit/DSAccess_AuditDirectoryServiceChanges +
+
+ Audit/DSAccess_AuditDirectoryServiceReplication +
+
+ Audit/DetailedTracking_AuditDPAPIActivity +
+
+ Audit/DetailedTracking_AuditPNPActivity +
+
+ Audit/DetailedTracking_AuditProcessCreation +
+
+ Audit/DetailedTracking_AuditProcessTermination +
+
+ Audit/DetailedTracking_AuditRPCEvents +
+
+ Audit/DetailedTracking_AuditTokenRightAdjusted +
+
+ Audit/ObjectAccess_AuditApplicationGenerated +
+
+ Audit/ObjectAccess_AuditCentralAccessPolicyStaging +
+
+ Audit/ObjectAccess_AuditCertificationServices +
+
+ Audit/ObjectAccess_AuditDetailedFileShare +
+
+ Audit/ObjectAccess_AuditFileShare +
+
+ Audit/ObjectAccess_AuditFileSystem +
+
+ Audit/ObjectAccess_AuditFilteringPlatformConnection +
+
+ Audit/ObjectAccess_AuditFilteringPlatformPacketDrop +
+
+ Audit/ObjectAccess_AuditHandleManipulation +
+
+ Audit/ObjectAccess_AuditKernelObject +
+
+ Audit/ObjectAccess_AuditOtherObjectAccessEvents +
+
+ Audit/ObjectAccess_AuditRegistry +
+
+ Audit/ObjectAccess_AuditRemovableStorage +
+
+ Audit/ObjectAccess_AuditSAM +
+
+ Audit/PolicyChange_AuditAuthenticationPolicyChange +
+
+ Audit/PolicyChange_AuditAuthorizationPolicyChange +
+
+ Audit/PolicyChange_AuditFilteringPlatformPolicyChange +
+
+ Audit/PolicyChange_AuditMPSSVCRuleLevelPolicyChange +
+
+ Audit/PolicyChange_AuditOtherPolicyChangeEvents +
+
+ Audit/PolicyChange_AuditPolicyChange +
+
+ Audit/PrivilegeUse_AuditNonSensitivePrivilegeUse +
+
+ Audit/PrivilegeUse_AuditOtherPrivilegeUseEvents +
+
+ Audit/PrivilegeUse_AuditSensitivePrivilegeUse +
+
+ Audit/System_AuditIPsecDriver +
+
+ Audit/System_AuditOtherSystemEvents +
+
+ Audit/System_AuditSecurityStateChange +
+
+ Audit/System_AuditSecuritySystemExtension +
+
+ Audit/System_AuditSystemIntegrity +
+
+ + +
+ + +**Audit/AccountLogonLogoff_AuditAccountLockout** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated by a failed attempt to log on to an account that is locked out. + +If you configure this policy setting, an audit event is generated when an account cannot log on to a computer because the account is locked out. Success audits record successful attempts and Failure audits record unsuccessful attempts. + +Logon events are essential for understanding user activity and to detect potential attacks. + + + + + + + + + + + + + +
+ + +**Audit/AccountLogonLogoff_AuditGroupMembership** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy allows you to audit the group memberhsip information in the user's logon token. Events in this subcategory are generated on the computer on which a logon session is created. For an interactive logon, the security audit event is generated on the computer that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. + +When this setting is configured, one or more security audit events are generated for each successful logon. You must also enable the Audit Logon setting under Advanced Audit Policy Configuration\System Audit Policies\Logon/Logoff. Multiple events are generated if the group memberhsip information cannot fit in a single security audit event. + + + + + + + + + + + + + +
+ + +**Audit/AccountLogonLogoff_AuditIPsecExtendedMode** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Extended Mode negotiations. + +If you configure this policy setting, an audit event is generated during an IPsec Extended Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated during an IPsec Extended Mode negotiation. + + + + + + + + + + + + + +
+ + +**Audit/AccountLogonLogoff_AuditIPsecMainMode** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Main Mode negotiations. + +If you configure this policy setting, an audit event is generated during an IPsec Main Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated during an IPsec Main Mode negotiation. + + + + + + + + + + + + + +
+ + +**Audit/AccountLogonLogoff_AuditIPsecQuickMode** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Quick Mode negotiations. + +If you configure this policy setting, an audit event is generated during an IPsec Quick Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts.If + you do not configure this policy setting, no audit event is generated during an IPsec Quick Mode negotiation. + + + + + + + + + + + + + +
+ + +**Audit/AccountLogonLogoff_AuditLogoff** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated by the closing of a logon session. These events occur on the computer that was accessed. For an interactive logoff the security audit event is generated on the computer that the user account logged on to. + +If you configure this policy setting, an audit event is generated when a logon session is closed. Success audits record successful attempts to close sessions and Failure audits record unsuccessful attempts to close sessions. +If you do not configure this policy setting, no audit event is generated when a logon session is closed. + + + + + + + + + + + + + +
+ + +**Audit/AccountLogonLogoff_AuditLogon** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated by user account logon attempts on the computer. +Events in this subcategory are related to the creation of logon sessions and occur on the computer which was accessed. For an interactive logon, the security audit event is generated on the computer that the user account logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. The following events are included: + Successful logon attempts. + Failed logon attempts. + Logon attempts using explicit credentials. This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch logon configurations, such as scheduled tasks or when using the RUNAS command. + Security identifiers (SIDs) were filtered and not allowed to log on. + + + + + + + + + + + + + +
+ + +**Audit/AccountLogonLogoff_AuditNetworkPolicyServer** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated by RADIUS (IAS) and Network Access Protection (NAP) user access requests. These requests can be Grant, Deny, Discard, Quarantine, Lock, and Unlock. +If you configure this policy setting, an audit event is generated for each IAS and NAP user access request. Success audits record successful user access requests and Failure audits record unsuccessful attempts. +If you do not configure this policy settings, IAS and NAP user access requests are not audited. + + + + + + + + + + + + + +
+ + +**Audit/AccountLogonLogoff_AuditOtherLogonLogoffEvents** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit other logon/logoff-related events that are not covered in the “Logon/Logoff” policy setting such as the following: + Terminal Services session disconnections. + New Terminal Services sessions. + Locking and unlocking a workstation. + Invoking a screen saver. + Dismissal of a screen saver. + Detection of a Kerberos replay attack, in which a Kerberos request was received twice with identical information. This condition could be caused by network misconfiguration. + Access to a wireless network granted to a user or computer account. + Access to a wired 802.1x network granted to a user or computer account. + + + + + + + + + + + + + +
+ + +**Audit/AccountLogonLogoff_AuditSpecialLogon** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated by special logons such as the following : + The use of a special logon, which is a logon that has administrator-equivalent privileges and can be used to elevate a process to a higher level. + A logon by a member of a Special Group. Special Groups enable you to audit events generated when a member of a certain group has logged on to your network. You can configure a list of group security identifiers (SIDs) in the registry. If any of those SIDs are added to a token during logon and the subcategory is enabled, an event is logged. For more information about this feature, see article 947223 in the Microsoft Knowledge Base (https://go.microsoft.com/fwlink/?LinkId=121697). + + + + + + + + + + + + + +
+ + +**Audit/AccountLogonLogoff_AuditUserDeviceClaims** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy allows you to audit user and device claims information in the user's logon token. Events in this subcategory are generated on the computer on which a logon session is created. For an interactive logon, the security audit event is generated on the computer that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. + +User claims are added to a logon token when claims are included with a user's account attributes in Active Directory. Device claims are added to the logon token when claims are included with a device's computer account attributes in Active Directory. In addition, compound identity must be enabled for the domain and on the computer where the user logged on. + +When this setting is configured, one or more security audit events are generated for each successful logon. You must also enable the Audit Logon setting under Advanced Audit Policy Configuration\System Audit Policies\Logon/Logoff. Multiple events are generated if the user and device claims information cannot fit in a single security audit event. + + + + + + + + + + + + + +
+ + +**Audit/AccountLogon_AuditCredentialValidation** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated by validation tests on user account logon credentials. + +Events in this subcategory occur only on the computer that is authoritative for those credentials. For domain accounts, the domain controller is authoritative. For local accounts, the local computer is authoritative. + + + + + + + + + + + + + +
+ + +**Audit/AccountLogon_AuditKerberosAuthenticationService** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests. + +If you configure this policy setting, an audit event is generated after a Kerberos authentication TGT request. Success audits record successful requests and Failure audits record unsuccessful requests. +If you do not configure this policy setting, no audit event is generated after a Kerberos authentication TGT request. + + + + + + + + + + + + + +
+ + +**Audit/AccountLogon_AuditKerberosServiceTicketOperations** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests submitted for user accounts. + +If you configure this policy setting, an audit event is generated after a Kerberos authentication TGT is requested for a user account. Success audits record successful requests and Failure audits record unsuccessful requests. +If you do not configure this policy setting, no audit event is generated after a Kerberos authentication TGT is request for a user account. + + + + + + + + + + + + + +
+ + +**Audit/AccountLogon_AuditOtherAccountLogonEvents** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated by responses to credential requests submitted for a user account logon that are not credential validation or Kerberos tickets. + +Currently, there are no events in this subcategory. + + + + + + + + + + + + + +
+ + +**Audit/AccountManagement_AuditApplicationGroupManagement** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated by changes to application groups such as the following: + Application group is created, changed, or deleted. + Member is added or removed from an application group. + +If you configure this policy setting, an audit event is generated when an attempt to change an application group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when an application group changes. + + + + + + + + + + + + + +
+ + +**Audit/AccountManagement_AuditComputerAccountManagement** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated by changes to computer accounts such as when a computer account is created, changed, or deleted. + +If you configure this policy setting, an audit event is generated when an attempt to change a computer account is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a computer account changes. + + + + + + + + + + + + + +
+ + +**Audit/AccountManagement_AuditDistributionGroupManagement** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated by changes to distribution groups such as the following: + Distribution group is created, changed, or deleted. + Member is added or removed from a distribution group. + Distribution group type is changed. + +If you configure this policy setting, an audit event is generated when an attempt to change a distribution group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a distribution group changes. + +Note: Events in this subcategory are logged only on domain controllers. + + + + + + + + + + + + + +
+ + +**Audit/AccountManagement_AuditOtherAccountManagementEvents** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated by other user account changes that are not covered in this category, such as the following: + The password hash of a user account was accessed. This typically happens during an Active Directory Management Tool password migration. + The Password Policy Checking API was called. Calls to this function can be part of an attack when a malicious application tests the policy to reduce the number of attempts during a password dictionary attack. + Changes to the Default Domain Group Policy under the following Group Policy paths: +Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy +Computer Configuration\Windows Settings\Security Settings\Account Policies\Account Lockout Policy + + + + + + + + + + + + + +
+ + +**Audit/AccountManagement_AuditSecurityGroupManagement** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated by changes to security groups such as the following: + Security group is created, changed, or deleted. + Member is added or removed from a security group. + Group type is changed. + +If you configure this policy setting, an audit event is generated when an attempt to change a security group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a security group changes. + + + + + + + + + + + + + +
+ + +**Audit/AccountManagement_AuditUserAccountManagement** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit changes to user accounts. Events include the following: + A user account is created, changed, deleted; renamed, disabled, enabled, locked out, or unlocked. + A user account’s password is set or changed. + A security identifier (SID) is added to the SID History of a user account. + The Directory Services Restore Mode password is configured. + Permissions on administrative user accounts are changed. + Credential Manager credentials are backed up or restored. + +If you configure this policy setting, an audit event is generated when an attempt to change a user account is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a user account changes. + + + + + + + + + + + + + +
+ + +**Audit/DSAccess_AuditDetailedDirectoryServiceReplication** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated by detailed Active Directory Domain Services (AD DS) replication between domain controllers. + + + + + + + + + + + + + +
+ + +**Audit/DSAccess_AuditDirectoryServiceAccess** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated when an Active Directory Domain Services (AD DS) object is accessed. + +Only AD DS objects with a matching system access control list (SACL) are logged. + +Events in this subcategory are similar to the Directory Service Access events available in previous versions of Windows. + + + + + + + + + + + + + +
+ + +**Audit/DSAccess_AuditDirectoryServiceChanges** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated by changes to objects in Active Directory Domain Services (AD DS). Events are logged when an object is created, deleted, modified, moved, or undeleted. + +When possible, events logged in this subcategory indicate the old and new values of the object’s properties. + +Events in this subcategory are logged only on domain controllers, and only objects in AD DS with a matching system access control list (SACL) are logged. + +Note: Actions on some objects and properties do not cause audit events to be generated due to settings on the object class in the schema. + +If you configure this policy setting, an audit event is generated when an attempt to change an object in AD DS is made. Success audits record successful attempts, however unsuccessful attempts are NOT recorded. +If you do not configure this policy setting, no audit event is generated when an attempt to change an object in AD DS object is made. + + + + + + + + + + + + + +
+ + +**Audit/DSAccess_AuditDirectoryServiceReplication** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit replication between two Active Directory Domain Services (AD DS) domain controllers. + +If you configure this policy setting, an audit event is generated during AD DS replication. Success audits record successful replication and Failure audits record unsuccessful replication. +If you do not configure this policy setting, no audit event is generated during AD DS replication. + + + + + + + + + + + + + +
+ + +**Audit/DetailedTracking_AuditDPAPIActivity** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated when encryption or decryption requests are made to the Data Protection application interface (DPAPI). DPAPI is used to protect secret information such as stored password and key information. For more information about DPAPI, see https://go.microsoft.com/fwlink/?LinkId=121720. + +If you configure this policy setting, an audit event is generated when an encryption or decryption request is made to DPAPI. Success audits record successful requests and Failure audits record unsuccessful requests. +If you do not configure this policy setting, no audit event is generated when an encryption or decryption request is made to DPAPI. + + + + + + + + + + + + + +
+ + +**Audit/DetailedTracking_AuditPNPActivity** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit when plug and play detects an external device. + +If you configure this policy setting, an audit event is generated whenever plug and play detects an external device. Only Success audits are recorded for this category. +If you do not configure this policy setting, no audit event is generated when an external device is detected by plug and play. + + + + + + + + + + + + + +
+ + +**Audit/DetailedTracking_AuditProcessCreation** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated when a process is created or starts. The name of the application or user that created the process is also audited. + +If you configure this policy setting, an audit event is generated when a process is created. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a process is created. + + + + + + + + + + + + + +
+ + +**Audit/DetailedTracking_AuditProcessTermination** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated when a process ends. + +If you configure this policy setting, an audit event is generated when a process ends. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a process ends. + + + + + + + + + + + + + +
+ + +**Audit/DetailedTracking_AuditRPCEvents** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit inbound remote procedure call (RPC) connections. + +If you configure this policy setting, an audit event is generated when a remote RPC connection is attempted. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a remote RPC connection is attempted. + + + + + + + + + + + + + +
+ + +**Audit/DetailedTracking_AuditTokenRightAdjusted** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated by adjusting the privileges of a token. + + + + + + + + + + + + + +
+ + +**Audit/ObjectAccess_AuditApplicationGenerated** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit applications that generate events using the Windows Auditing application programming interfaces (APIs). Applications designed to use the Windows Auditing API use this subcategory to log auditing events related to their function. +Events in this subcategory include: + Creation of an application client context. + Deletion of an application client context. + Initialization of an application client context. + Other application operations using the Windows Auditing APIs. + + + + + + + + + + + + + +
+ + +**Audit/ObjectAccess_AuditCentralAccessPolicyStaging** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit access requests where the permission granted or denied by a proposed policy differs from the current central access policy on an object. + +If you configure this policy setting, an audit event is generated each time a user accesses an object and the permission granted by the current central access policy on the object differs from that granted by the proposed policy. The resulting audit event will be generated as follows: +1) Success audits, when configured, records access attempts when the current central access policy grants access but the proposed policy denies access. +2) Failure audits when configured records access attempts when: + a) The current central access policy does not grant access but the proposed policy grants access. + b) A principal requests the maximum access rights they are allowed and the access rights granted by the current central access policy are different than the access rights granted by the proposed policy. + +Volume: Potentially high on a file server when the proposed policy differs significantly from the current central access policy. + + + + + + + + + + + + + +
+ + +**Audit/ObjectAccess_AuditCertificationServices** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit Active Directory Certificate Services (AD CS) operations. +AD CS operations include the following: + AD CS startup/shutdown/backup/restore. + Changes to the certificate revocation list (CRL). + New certificate requests. + Issuing of a certificate. + Revocation of a certificate. + Changes to the Certificate Manager settings for AD CS. + Changes in the configuration of AD CS. + Changes to a Certificate Services template. + Importing of a certificate. + Publishing of a certification authority certificate is to Active Directory Domain Services. + Changes to the security permissions for AD CS. + Archival of a key. + Importing of a key. + Retrieval of a key. + Starting of Online Certificate Status Protocol (OCSP) Responder Service. + Stopping of Online Certificate Status Protocol (OCSP) Responder Service. + + + + + + + + + + + + + +
+ + +**Audit/ObjectAccess_AuditDetailedFileShare** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit attempts to access files and folders on a shared folder. The Detailed File Share setting logs an event every time a file or folder is accessed, whereas the File Share setting only records one event for any connection established between a client and file share. Detailed File Share audit events include detailed information about the permissions or other criteria used to grant or deny access. + +If you configure this policy setting, an audit event is generated when an attempt is made to access a file or folder on a share. The administrator can specify whether to audit only successes, only failures, or both successes and failures. + +Note: There are no system access control lists (SACLs) for shared folders. If this policy setting is enabled, access to all shared files and folders on the system is audited. + + + + + + + + + + + + + +
+ + +**Audit/ObjectAccess_AuditFileShare** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit attempts to access a shared folder. + +If you configure this policy setting, an audit event is generated when an attempt is made to access a shared folder. If this policy setting is defined, the administrator can specify whether to audit only successes, only failures, or both successes and failures. + +Note: There are no system access control lists (SACLs) for shared folders. If this policy setting is enabled, access to all shared folders on the system is audited. + + + + + + + + + + + + + +
+ + +**Audit/ObjectAccess_AuditFileSystem** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit user attempts to access file system objects. A security audit event is generated only for objects that have system access control lists (SACL) specified, and only if the type of access requested, such as Write, Read, or Modify and the account making the request match the settings in the SACL. For more information about enabling object access auditing, see https://go.microsoft.com/fwlink/?LinkId=122083. + +If you configure this policy setting, an audit event is generated each time an account accesses a file system object with a matching SACL. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when an account accesses a file system object with a matching SACL. + +Note: You can set a SACL on a file system object using the Security tab in that object's Properties dialog box. + + + + + + + + + + + + + +
+ + +**Audit/ObjectAccess_AuditFilteringPlatformConnection** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit connections that are allowed or blocked by the Windows Filtering Platform (WFP). The following events are included: + The Windows Firewall Service blocks an application from accepting incoming connections on the network. + The WFP allows a connection. + The WFP blocks a connection. + The WFP permits a bind to a local port. + The WFP blocks a bind to a local port. + The WFP allows a connection. + The WFP blocks a connection. + The WFP permits an application or service to listen on a port for incoming connections. + The WFP blocks an application or service to listen on a port for incoming connections. + +If you configure this policy setting, an audit event is generated when connections are allowed or blocked by the WFP. Success audits record events generated when connections are allowed and Failure audits record events generated when connections are blocked. +If you do not configure this policy setting, no audit event is generated when connected are allowed or blocked by the WFP. + + + + + + + + + + + + + +
+ + +**Audit/ObjectAccess_AuditFilteringPlatformPacketDrop** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit packets that are dropped by Windows Filtering Platform (WFP). + + + + + + + + + + + + + +
+ + +**Audit/ObjectAccess_AuditHandleManipulation** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated when a handle to an object is opened or closed. Only objects with a matching system access control list (SACL) generate security audit events. + +If you configure this policy setting, an audit event is generated when a handle is manipulated. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a handle is manipulated. + +Note: Events in this subcategory generate events only for object types where the corresponding Object Access subcategory is enabled. For example, if File system object access is enabled, handle manipulation security audit events are generated. If Registry object access is not enabled, handle manipulation security audit events will not be generated. + + + + + + + + + + + + + +
+ + +**Audit/ObjectAccess_AuditKernelObject** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit attempts to access the kernel, which include mutexes and semaphores. +Only kernel objects with a matching system access control list (SACL) generate security audit events. + +Note: The Audit: Audit the access of global system objects policy setting controls the default SACL of kernel objects. + + + + + + + + + + + + + +
+ + +**Audit/ObjectAccess_AuditOtherObjectAccessEvents** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated by the management of task scheduler jobs or COM+ objects. +For scheduler jobs, the following are audited: + Job created. + Job deleted. + Job enabled. + Job disabled. + Job updated. +For COM+ objects, the following are audited: + Catalog object added. + Catalog object updated. + Catalog object deleted. + + + + + + + + + + + + + +
+ + +**Audit/ObjectAccess_AuditRegistry** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit attempts to access registry objects. A security audit event is generated only for objects that have system access control lists (SACLs) specified, and only if the type of access requested, such as Read, Write, or Modify, and the account making the request match the settings in the SACL. + +If you configure this policy setting, an audit event is generated each time an account accesses a registry object with a matching SACL. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when an account accesses a registry object with a matching SACL. + +Note: You can set a SACL on a registry object using the Permissions dialog box. + + + + + + + + + + + + + +
+ + +**Audit/ObjectAccess_AuditRemovableStorage** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit user attempts to access file system objects on a removable storage device. A security audit event is generated only for all objects for all types of access requested. + +If you configure this policy setting, an audit event is generated each time an account accesses a file system object on a removable storage. Success audits record successful attempts and Failure audits record unsuccessful attempts. + +If you do not configure this policy setting, no audit event is generated when an account accesses a file system object on a removable storage. + + + + + + + + + + + + + +
+ + +**Audit/ObjectAccess_AuditSAM** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated by attempts to access to Security Accounts Manager (SAM) objects. +SAM objects include the following: + SAM_ALIAS -- A local group. + SAM_GROUP -- A group that is not a local group. + SAM_USER – A user account. + SAM_DOMAIN – A domain. + SAM_SERVER – A computer account. +If you configure this policy setting, an audit event is generated when an attempt to access a kernel object is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when an attempt to access a kernel object is made. +Note: Only the System Access Control List (SACL) for SAM_SERVER can be modified. +Volume: High on domain controllers. For information about reducing the amount of events generated in this subcategory, see article 841001 in the Microsoft Knowledge Base (https://go.microsoft.com/fwlink/?LinkId=121698). + + + + + + + + + + + + + +
+ + +**Audit/PolicyChange_AuditAuthenticationPolicyChange** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated by changes to the authentication policy such as the following: + Creation of forest and domain trusts. + Modification of forest and domain trusts. + Removal of forest and domain trusts. + Changes to Kerberos policy under Computer Configuration\Windows Settings\Security Settings\Account Policies\Kerberos Policy. + Granting of any of the following user rights to a user or group: + Access This Computer From the Network. + Allow Logon Locally. + Allow Logon Through Terminal Services. + Logon as a Batch Job. + Logon a Service. + Namespace collision. For example, when a new trust has the same name as an existing namespace name. + +If you configure this policy setting, an audit event is generated when an attempt to change the authentication policy is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when the authentication policy is changed. + +Note: The security audit event is logged when the group policy is applied. It does not occur at the time when the settings are modified. + + + + + + + + + + + + + +
+ + +**Audit/PolicyChange_AuditAuthorizationPolicyChange** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated by changes to the authorization policy such as the following: + Assignment of user rights (privileges), such as SeCreateTokenPrivilege, that are not audited through the “Authentication Policy Change” subcategory. + Removal of user rights (privileges), such as SeCreateTokenPrivilege, that are not audited through the “Authentication Policy Change” subcategory. + Changes in the Encrypted File System (EFS) policy. + Changes to the Resource attributes of an object. + Changes to the Central Access Policy (CAP) applied to an object. + +If you configure this policy setting, an audit event is generated when an attempt to change the authorization policy is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when the authorization policy changes. + + + + + + + + + + + + + +
+ + +**Audit/PolicyChange_AuditFilteringPlatformPolicyChange** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated by changes to the Windows Filtering Platform (WFP) such as the following: + IPsec services status. + Changes to IPsec policy settings. + Changes to Windows Firewall policy settings. + Changes to WFP providers and engine. + +If you configure this policy setting, an audit event is generated when a change to the WFP is attempted. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a change occurs to the WFP. + + + + + + + + + + + + + +
+ + +**Audit/PolicyChange_AuditMPSSVCRuleLevelPolicyChange** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated by changes in policy rules used by the Microsoft Protection Service (MPSSVC). This service is used by Windows Firewall. Events include the following: + Reporting of active policies when Windows Firewall service starts. + Changes to Windows Firewall rules. + Changes to Windows Firewall exception list. + Changes to Windows Firewall settings. + Rules ignored or not applied by Windows Firewall Service. + Changes to Windows Firewall Group Policy settings. + +If you configure this policy setting, an audit event is generated by attempts to change policy rules used by the MPSSVC. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated by changes in policy rules used by the MPSSVC. + + + + + + + + + + + + + +
+ + +**Audit/PolicyChange_AuditOtherPolicyChangeEvents** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated by other security policy changes that are not audited in the policy change category, such as the following: + Trusted Platform Module (TPM) configuration changes. + Kernel-mode cryptographic self tests. + Cryptographic provider operations. + Cryptographic context operations or modifications. + Applied Central Access Policies (CAPs) changes. + Boot Configuration Data (BCD) modifications. + + + + + + + + + + + + + +
+ + +**Audit/PolicyChange_AuditPolicyChange** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit changes in the security audit policy settings such as the following: + Settings permissions and audit settings on the Audit Policy object. + Changes to the system audit policy. + Registration of security event sources. + De-registration of security event sources. + Changes to the per-user audit settings. + Changes to the value of CrashOnAuditFail. + Changes to the system access control list on a file system or registry object. + Changes to the Special Groups list. + +Note: System access control list (SACL) change auditing is done when a SACL for an object changes and the policy change category is enabled. Discretionary access control list (DACL) and ownership changes are audited when object access auditing is enabled and the object's SACL is configured for auditing of DACL/Owner change. + + + + + + + + + + + + + +
+ + +**Audit/PrivilegeUse_AuditNonSensitivePrivilegeUse** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated by the use of non-sensitive privileges (user rights). +The following privileges are non-sensitive: + Access Credential Manager as a trusted caller. + Access this computer from the network. + Add workstations to domain. + Adjust memory quotas for a process. + Allow log on locally. + Allow log on through Terminal Services. + Bypass traverse checking. + Change the system time. + Create a pagefile. + Create global objects. + + Create permanent shared objects. + Create symbolic links. + Deny access this computer from the network. + Deny log on as a batch job. + Deny log on as a service. + Deny log on locally. + Deny log on through Terminal Services. + Force shutdown from a remote system. + Increase a process working set. + Increase scheduling priority. + Lock pages in memory. + Log on as a batch job. + Log on as a service. + Modify an object label. + Perform volume maintenance tasks. + Profile single process. + Profile system performance. + Remove computer from docking station. + Shut down the system. + Synchronize directory service data. + +If you configure this policy setting, an audit event is generated when a non-sensitive privilege is called. Success audits record successful calls and Failure audits record unsuccessful calls. +If you do not configure this policy setting, no audit event is generated when a non-sensitive privilege is called. + + + + + + + + + + + + + +
+ + +**Audit/PrivilegeUse_AuditOtherPrivilegeUseEvents** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Not used. + + + + + + + + + + + + + +
+ + +**Audit/PrivilegeUse_AuditSensitivePrivilegeUse** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated when sensitive privileges (user rights) are used such as the following: + A privileged service is called. + One of the following privileges are called: + Act as part of the operating system. + Back up files and directories. + Create a token object. + Debug programs. + Enable computer and user accounts to be trusted for delegation. + Generate security audits. + Impersonate a client after authentication. + Load and unload device drivers. + Manage auditing and security log. + Modify firmware environment values. + Replace a process-level token. + Restore files and directories. + Take ownership of files or other objects. + +If you configure this policy setting, an audit event is generated when sensitive privilege requests are made. Success audits record successful requests and Failure audits record unsuccessful requests. +If you do not configure this policy setting, no audit event is generated when sensitive privilege requests are made. + + + + + + + + + + + + + + +
+ + +**Audit/System_AuditIPsecDriver** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated by the IPsec filter driver such as the following: + Startup and shutdown of the IPsec services. + Network packets dropped due to integrity check failure. + Network packets dropped due to replay check failure. + Network packets dropped due to being in plaintext. + Network packets received with incorrect Security Parameter Index (SPI). This may indicate that either the network card is not working correctly or the driver needs to be updated. + Inability to process IPsec filters. + +If you configure this policy setting, an audit event is generated on an IPsec filter driver operation. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated on an IPSec filter driver operation. + + + + + + + + + + + + + +
+ + +**Audit/System_AuditOtherSystemEvents** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit any of the following events: + Startup and shutdown of the Windows Firewall service and driver. + Security policy processing by the Windows Firewall Service. + Cryptography key file and migration operations. + + + + + + + + + + + + + +
+ + +**Audit/System_AuditSecurityStateChange** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated by changes in the security state of the computer such as the following events: + Startup and shutdown of the computer. + Change of system time. + Recovering the system from CrashOnAuditFail, which is logged after a system restarts when the security event log is full and the CrashOnAuditFail registry entry is configured. + + + + + + + + + + + + + +
+ + +**Audit/System_AuditSecuritySystemExtension** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events related to security system extensions or services such as the following: + A security system extension, such as an authentication, notification, or security package is loaded and is registered with the Local Security Authority (LSA). It is used to authenticate logon attempts, submit logon requests, and any account or password changes. Examples of security system extensions are Kerberos and NTLM. + A service is installed and registered with the Service Control Manager. The audit log contains information about the service name, binary, type, start type, and service account. +If you configure this policy setting, an audit event is generated when an attempt is made to load a security system extension. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when an attempt is made to load a security system extension. + + + + + + + + + + + + + +
+ + +**Audit/System_AuditSystemIntegrity** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events that violate the integrity of the security subsystem, such as the following: + Events that could not be written to the event log because of a problem with the auditing system. + A process that uses a local procedure call (LPC) port that is not valid in an attempt to impersonate a client by replying, reading, or writing to or from a client address space. + The detection of a Remote Procedure Call (RPC) that compromises system integrity. + The detection of a hash value of an executable file that is not valid as determined by Code Integrity. + Cryptographic operations that compromise system integrity. + + + + + + + + + + + + +
+ +Footnote: + +- 1 - Added in Windows 10, version 1607. +- 2 - Added in Windows 10, version 1703. +- 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. + + From 581d943598b74fb33cc9bdc1bcb9aae3826f0389 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Tue, 20 Aug 2019 15:32:42 +0530 Subject: [PATCH 02/43] Updated TOC for Audit policies --- windows/client-management/mdm/TOC.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/client-management/mdm/TOC.md b/windows/client-management/mdm/TOC.md index d77896805e..c90eee3566 100644 --- a/windows/client-management/mdm/TOC.md +++ b/windows/client-management/mdm/TOC.md @@ -168,6 +168,7 @@ #### [AppRuntime](policy-csp-appruntime.md) #### [AppVirtualization](policy-csp-appvirtualization.md) #### [AttachmentManager](policy-csp-attachmentmanager.md) +#### [Audit](policy-csp-audit.md) #### [Authentication](policy-csp-authentication.md) #### [Autoplay](policy-csp-autoplay.md) #### [Bitlocker](policy-csp-bitlocker.md) From 5ab29360b2fe1fad60e6a5a735bc6e4f80e27b5f Mon Sep 17 00:00:00 2001 From: Jose Ortega Date: Tue, 10 Sep 2019 01:47:51 -0500 Subject: [PATCH 03/43] Added important note for issue #4836 --- .../information-protection/bitlocker/bitlocker-overview.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/windows/security/information-protection/bitlocker/bitlocker-overview.md b/windows/security/information-protection/bitlocker/bitlocker-overview.md index d15b81c76a..40f47bbe5b 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-overview.md +++ b/windows/security/information-protection/bitlocker/bitlocker-overview.md @@ -60,6 +60,9 @@ A computer with a TPM must also have a Trusted Computing Group (TCG)-compliant B The system BIOS or UEFI firmware (for TPM and non-TPM computers) must support the USB mass storage device class, including reading small files on a USB flash drive in the pre-operating system environment. +> [!IMPORTANT] +> You can use an OS drive encrypted without TPM and USB stick, from windows 7, [check procedure here](https://blogs.technet.microsoft.com/tip_of_the_day/2014/01/22/tip-of-the-day-bitlocker-without-tpm-or-usb/). + > [!NOTE] > TPM 2.0 is not supported in Legacy and CSM Modes of the BIOS. Devices with TPM 2.0 must have their BIOS mode configured as Native UEFI only. The Legacy and Compatibility Support Module (CSM) options must be disabled. For added security Enable the Secure Boot feature. From db75f2d43a9d3222e3e296774bfc1ef4359c1e66 Mon Sep 17 00:00:00 2001 From: Jose Gabriel Ortega Castro Date: Tue, 10 Sep 2019 10:57:02 -0500 Subject: [PATCH 04/43] Update windows/security/information-protection/bitlocker/bitlocker-overview.md Co-Authored-By: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../information-protection/bitlocker/bitlocker-overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/information-protection/bitlocker/bitlocker-overview.md b/windows/security/information-protection/bitlocker/bitlocker-overview.md index 40f47bbe5b..b15072b8b2 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-overview.md +++ b/windows/security/information-protection/bitlocker/bitlocker-overview.md @@ -61,7 +61,7 @@ A computer with a TPM must also have a Trusted Computing Group (TCG)-compliant B The system BIOS or UEFI firmware (for TPM and non-TPM computers) must support the USB mass storage device class, including reading small files on a USB flash drive in the pre-operating system environment. > [!IMPORTANT] -> You can use an OS drive encrypted without TPM and USB stick, from windows 7, [check procedure here](https://blogs.technet.microsoft.com/tip_of_the_day/2014/01/22/tip-of-the-day-bitlocker-without-tpm-or-usb/). +> From Windows 7, you can encrypt an OS drive without a TPM and USB flash drive. For this procedure, see [Tip of the day: Bitlocker without TMP or USB](https://blogs.technet.microsoft.com/tip_of_the_day/2014/01/22/tip-of-the-day-bitlocker-without-tpm-or-usb/). > [!NOTE] > TPM 2.0 is not supported in Legacy and CSM Modes of the BIOS. Devices with TPM 2.0 must have their BIOS mode configured as Native UEFI only. The Legacy and Compatibility Support Module (CSM) options must be disabled. For added security Enable the Secure Boot feature. From 306ff6e371a1c754c53f3d7408fe4b76ba3e5c00 Mon Sep 17 00:00:00 2001 From: Jose Gabriel Ortega Castro Date: Sat, 14 Sep 2019 10:07:39 -0500 Subject: [PATCH 05/43] Update windows/security/information-protection/bitlocker/bitlocker-overview.md Co-Authored-By: Joyce Y. <47188252+mypil@users.noreply.github.com> --- .../information-protection/bitlocker/bitlocker-overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/information-protection/bitlocker/bitlocker-overview.md b/windows/security/information-protection/bitlocker/bitlocker-overview.md index b15072b8b2..f2b5d2dd20 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-overview.md +++ b/windows/security/information-protection/bitlocker/bitlocker-overview.md @@ -61,7 +61,7 @@ A computer with a TPM must also have a Trusted Computing Group (TCG)-compliant B The system BIOS or UEFI firmware (for TPM and non-TPM computers) must support the USB mass storage device class, including reading small files on a USB flash drive in the pre-operating system environment. > [!IMPORTANT] -> From Windows 7, you can encrypt an OS drive without a TPM and USB flash drive. For this procedure, see [Tip of the day: Bitlocker without TMP or USB](https://blogs.technet.microsoft.com/tip_of_the_day/2014/01/22/tip-of-the-day-bitlocker-without-tpm-or-usb/). +> From Windows 7, you can encrypt an OS drive without a TPM and USB flash drive. For this procedure, see [Tip of the Day: Bitlocker without TPM or USB](https://blogs.technet.microsoft.com/tip_of_the_day/2014/01/22/tip-of-the-day-bitlocker-without-tpm-or-usb/). > [!NOTE] > TPM 2.0 is not supported in Legacy and CSM Modes of the BIOS. Devices with TPM 2.0 must have their BIOS mode configured as Native UEFI only. The Legacy and Compatibility Support Module (CSM) options must be disabled. For added security Enable the Secure Boot feature. From 539b9e316cd7db4cdcaff6c5729a43e20763fcf1 Mon Sep 17 00:00:00 2001 From: Ned pyle Date: Mon, 16 Sep 2019 12:46:25 -0700 Subject: [PATCH 06/43] SMB 3.x support AES-128 encryption SMB 3.x is the remote file system protocol of Windows, and has supported AES-128 encryption via BCRYPT since Windows 8/WS2012. --- windows/security/threat-protection/fips-140-validation.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/threat-protection/fips-140-validation.md b/windows/security/threat-protection/fips-140-validation.md index a1ad5ab37c..0f43d2fb1a 100644 --- a/windows/security/threat-protection/fips-140-validation.md +++ b/windows/security/threat-protection/fips-140-validation.md @@ -109,6 +109,7 @@ The following list contains some of the Windows components and Microsoft product - Some Microsoft .NET Framework Applications (.NET also provides cryptographic algorithm implementations that have not been FIPS 140 validated.) - BitLocker® Drive Full-volume Encryption - IPsec Settings of Windows Firewall +- Server Message Block (SMB) 3.x ## Information for System Integrators From e44c1292b78094f2b875b549b5f1311e69536e85 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Thu, 19 Sep 2019 18:00:16 -0700 Subject: [PATCH 07/43] Added content --- .../client-management/mdm/policy-csp-audit.md | 1348 +++++++++++++---- 1 file changed, 1055 insertions(+), 293 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-audit.md b/windows/client-management/mdm/policy-csp-audit.md index 08e3891e5b..0132b893ca 100644 --- a/windows/client-management/mdm/policy-csp-audit.md +++ b/windows/client-management/mdm/policy-csp-audit.md @@ -1,12 +1,12 @@ --- title: Policy CSP - Audit description: Policy CSP - Audit -ms.author: Heidi.Lohr +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: Heidilohr -ms.date: 08/13/2019 +author: manikadhiman +ms.date: 09/19/2019 --- # Policy CSP - Audit @@ -245,9 +245,23 @@ If you configure this policy setting, an audit event is generated when an accoun Logon events are essential for understanding user activity and to detect potential attacks. - - +Volume: Low. + + +GP Info: +- GP English name: *Audit Account Lockout* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* + + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default: Success. @@ -299,9 +313,22 @@ This policy allows you to audit the group memberhsip information in the user's l When this setting is configured, one or more security audit events are generated for each successful logon. You must also enable the Audit Logon setting under Advanced Audit Policy Configuration\System Audit Policies\Logon/Logoff. Multiple events are generated if the group memberhsip information cannot fit in a single security audit event. +Volume: Low on a client computer. Medium on a domain controller or a network server. - + +GP Info: +- GP English name: *Audit Group Membership* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default: No Auditing. @@ -354,9 +381,23 @@ This policy setting allows you to audit events generated by Internet Key Exchang If you configure this policy setting, an audit event is generated during an IPsec Extended Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated during an IPsec Extended Mode negotiation. - - +Volume: High. + + +GP Info: +- GP English name: *Audit IPsec Extended Mode* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* + + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default: No Auditing. @@ -409,9 +450,22 @@ This policy setting allows you to audit events generated by Internet Key Exchang If you configure this policy setting, an audit event is generated during an IPsec Main Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated during an IPsec Main Mode negotiation. +Volume: High. - + +GP Info: +- GP English name: *Audit IPsec Main Mode* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default: No Auditing. @@ -464,9 +518,22 @@ This policy setting allows you to audit events generated by Internet Key Exchang If you configure this policy setting, an audit event is generated during an IPsec Quick Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts.If you do not configure this policy setting, no audit event is generated during an IPsec Quick Mode negotiation. +Volume: High. - + +GP Info: +- GP English name: *Audit IPsec Quick Mode* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default: No Auditing. @@ -519,9 +586,22 @@ This policy setting allows you to audit events generated by the closing of a log If you configure this policy setting, an audit event is generated when a logon session is closed. Success audits record successful attempts to close sessions and Failure audits record unsuccessful attempts to close sessions. If you do not configure this policy setting, no audit event is generated when a logon session is closed. +Volume: Low. - + +GP Info: +- GP English name: *Audit Logoff* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default: Success. @@ -570,15 +650,31 @@ If you do not configure this policy setting, no audit event is generated when a This policy setting allows you to audit events generated by user account logon attempts on the computer. -Events in this subcategory are related to the creation of logon sessions and occur on the computer which was accessed. For an interactive logon, the security audit event is generated on the computer that the user account logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. The following events are included: - Successful logon attempts. - Failed logon attempts. - Logon attempts using explicit credentials. This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch logon configurations, such as scheduled tasks or when using the RUNAS command. - Security identifiers (SIDs) were filtered and not allowed to log on. +Events in this subcategory are related to the creation of logon sessions and occur on the computer which was accessed. For an interactive logon, the security audit event is generated on the computer that the user account logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. +The following events are included: +- Successful logon attempts. +- Failed logon attempts. +- Logon attempts using explicit credentials. This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch logon configurations, such as scheduled tasks or when using the RUNAS command. +- Security identifiers (SIDs) were filtered and not allowed to log on. +Volume: Low on a client computer. Medium on a domain controller or a network server. - + +GP Info: +- GP English name: *Audit Logon* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default on Client editions: Success. + +Default on Server editions: Success, Failure. @@ -630,9 +726,22 @@ This policy setting allows you to audit events generated by RADIUS (IAS) and Net If you configure this policy setting, an audit event is generated for each IAS and NAP user access request. Success audits record successful user access requests and Failure audits record unsuccessful attempts. If you do not configure this policy settings, IAS and NAP user access requests are not audited. +Volume: Medium or High on NPS and IAS server. No volume on other computers. - + +GP Info: +- GP English name: *Audit Network Policy Server* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default: Success, Failure. @@ -680,19 +789,32 @@ If you do not configure this policy settings, IAS and NAP user access requests a -This policy setting allows you to audit other logon/logoff-related events that are not covered in the “Logon/Logoff” policy setting such as the following: - Terminal Services session disconnections. - New Terminal Services sessions. - Locking and unlocking a workstation. - Invoking a screen saver. - Dismissal of a screen saver. - Detection of a Kerberos replay attack, in which a Kerberos request was received twice with identical information. This condition could be caused by network misconfiguration. - Access to a wireless network granted to a user or computer account. - Access to a wired 802.1x network granted to a user or computer account. +This policy setting allows you to audit other logon/logoff-related events that are not covered in the “Logon/Logoff” policy setting, such as the following: +- Terminal Services session disconnections. +- New Terminal Services sessions. +- Locking and unlocking a workstation. +- Invoking a screen saver. +- Dismissal of a screen saver. +- Detection of a Kerberos replay attack, in which a Kerberos request was received twice with identical information. This condition could be caused by network misconfiguration. +- Access to a wireless network granted to a user or computer account. +- Access to a wired 802.1x network granted to a user or computer account. +Volume: Low. - + +GP Info: +- GP English name: *Audit Other Logon Logoff Events* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default: No Auditing. @@ -740,13 +862,26 @@ This policy setting allows you to audit other logon/logoff-related events that a -This policy setting allows you to audit events generated by special logons such as the following : - The use of a special logon, which is a logon that has administrator-equivalent privileges and can be used to elevate a process to a higher level. - A logon by a member of a Special Group. Special Groups enable you to audit events generated when a member of a certain group has logged on to your network. You can configure a list of group security identifiers (SIDs) in the registry. If any of those SIDs are added to a token during logon and the subcategory is enabled, an event is logged. For more information about this feature, see article 947223 in the Microsoft Knowledge Base (https://go.microsoft.com/fwlink/?LinkId=121697). +This policy setting allows you to audit events generated by special logons, such as the following: +- The use of a special logon, which is a logon that has administrator-equivalent privileges and can be used to elevate a process to a higher level. +- A logon by a member of a Special Group. Special Groups enable you to audit events generated when a member of a certain group has logged on to your network. You can configure a list of group security identifiers (SIDs) in the registry. If any of those SIDs are added to a token during logon and the subcategory is enabled, an event is logged. For more information about this feature, see [article 947223 in the Microsoft Knowledge Base](https://go.microsoft.com/fwlink/?LinkId=121697). +Volume: Low. - + +GP Info: +- GP English name: *Audit Special Logon* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default: Success. @@ -800,9 +935,22 @@ User claims are added to a logon token when claims are included with a user's ac When this setting is configured, one or more security audit events are generated for each successful logon. You must also enable the Audit Logon setting under Advanced Audit Policy Configuration\System Audit Policies\Logon/Logoff. Multiple events are generated if the user and device claims information cannot fit in a single security audit event. +Volume: Low on a client computer. Medium on a domain controller or a network server. - + +GP Info: +- GP English name: *Audit User Device Claims* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default: No Auditing. @@ -854,9 +1002,24 @@ This policy setting allows you to audit events generated by validation tests on Events in this subcategory occur only on the computer that is authoritative for those credentials. For domain accounts, the domain controller is authoritative. For local accounts, the local computer is authoritative. +Volume: High on domain controllers. - + +GP Info: +- GP English name: *Audit Credential Validation* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Logon* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default on Client editions: No Auditing. + +Default on Server editions: Success. @@ -909,9 +1072,24 @@ This policy setting allows you to audit events generated by Kerberos authenticat If you configure this policy setting, an audit event is generated after a Kerberos authentication TGT request. Success audits record successful requests and Failure audits record unsuccessful requests. If you do not configure this policy setting, no audit event is generated after a Kerberos authentication TGT request. +Volume: High on Kerberos Key Distribution Center servers. - + +GP Info: +- GP English name: *Audit Kerberos Authentication Service* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Logon* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default on Client editions: No Auditing + +Default on Server editions: Success. @@ -964,9 +1142,24 @@ This policy setting allows you to audit events generated by Kerberos authenticat If you configure this policy setting, an audit event is generated after a Kerberos authentication TGT is requested for a user account. Success audits record successful requests and Failure audits record unsuccessful requests. If you do not configure this policy setting, no audit event is generated after a Kerberos authentication TGT is request for a user account. +Volume: Low. - + +GP Info: +- GP English name: *Audit Kerberos Service Ticket Operations* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Logon* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default on Client editions: No Auditing. + +Default on Server editions: Success. @@ -1019,8 +1212,20 @@ This policy setting allows you to audit events generated by responses to credent Currently, there are no events in this subcategory. - + +GP Info: +- GP English name: *Audit Other Account Logon Events* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Logon* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default: No Auditing. @@ -1068,16 +1273,29 @@ Currently, there are no events in this subcategory. -This policy setting allows you to audit events generated by changes to application groups such as the following: - Application group is created, changed, or deleted. - Member is added or removed from an application group. +This policy setting allows you to audit events generated by changes to application groups, such as the following: +- Application group is created, changed, or deleted. +- Member is added or removed from an application group. If you configure this policy setting, an audit event is generated when an attempt to change an application group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when an application group changes. +Volume: Low. - + +GP Info: +- GP English name: *Audit Application Group Management* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Management* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default: No Auditing. @@ -1130,9 +1348,24 @@ This policy setting allows you to audit events generated by changes to computer If you configure this policy setting, an audit event is generated when an attempt to change a computer account is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a computer account changes. +Volume: Low. - + +GP Info: +- GP English name: *Audit Computer Account Management* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Management* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default on Client editions: No Auditing. + +Default on Server editions: Success. @@ -1180,19 +1413,33 @@ If you do not configure this policy setting, no audit event is generated when a -This policy setting allows you to audit events generated by changes to distribution groups such as the following: - Distribution group is created, changed, or deleted. - Member is added or removed from a distribution group. - Distribution group type is changed. +This policy setting allows you to audit events generated by changes to distribution groups, such as the following: +- Distribution group is created, changed, or deleted. +- Member is added or removed from a distribution group. +- Distribution group type is changed. If you configure this policy setting, an audit event is generated when an attempt to change a distribution group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a distribution group changes. -Note: Events in this subcategory are logged only on domain controllers. +> [!Note] +> Events in this subcategory are logged only on domain controllers. +Volume: Low. - + +GP Info: +- GP English name: *Audit Distributio Group Management* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Management* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default: No Auditing. @@ -1240,16 +1487,32 @@ Note: Events in this subcategory are logged only on domain controllers. -This policy setting allows you to audit events generated by other user account changes that are not covered in this category, such as the following: - The password hash of a user account was accessed. This typically happens during an Active Directory Management Tool password migration. - The Password Policy Checking API was called. Calls to this function can be part of an attack when a malicious application tests the policy to reduce the number of attempts during a password dictionary attack. - Changes to the Default Domain Group Policy under the following Group Policy paths: +This policy setting allows you to audit events generated by other user account changes that are not covered in this category, such as the following: +- The password hash of a user account was accessed. This typically happens during an Active Directory Management Tool password migration. +- The Password Policy Checking API was called. Calls to this function can be part of an attack when a malicious application tests the policy to reduce the number of attempts during a password dictionary attack. +- Changes to the Default Domain Group Policy under the following Group Policy paths: Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy -Computer Configuration\Windows Settings\Security Settings\Account Policies\Account Lockout Policy +Computer Configuration\Windows Settings\Security Settings\Account Policies\Account Lockout Policy. +> [!Note] +> The security audit event is logged when the policy setting is applied. It does not occur at the time when the settings are modified. + +Volume: Low. - + +GP Info: +- GP English name: *Audit Other Account Management Events* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Management* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default: No Auditing. @@ -1297,17 +1560,30 @@ Computer Configuration\Windows Settings\Security Settings\Account Policies\Accou -This policy setting allows you to audit events generated by changes to security groups such as the following: - Security group is created, changed, or deleted. - Member is added or removed from a security group. - Group type is changed. +This policy setting allows you to audit events generated by changes to security groups, such as the following: +- Security group is created, changed, or deleted. +- Member is added or removed from a security group. +- Group type is changed. If you configure this policy setting, an audit event is generated when an attempt to change a security group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a security group changes. +Volume: Low. - + +GP Info: +- GP English name: *Audit Security Group Management* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Management* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default: Success. @@ -1355,19 +1631,34 @@ If you do not configure this policy setting, no audit event is generated when a -This policy setting allows you to audit changes to user accounts. Events include the following: - A user account is created, changed, deleted; renamed, disabled, enabled, locked out, or unlocked. - A user account’s password is set or changed. - A security identifier (SID) is added to the SID History of a user account. - The Directory Services Restore Mode password is configured. - Permissions on administrative user accounts are changed. - Credential Manager credentials are backed up or restored. +This policy setting allows you to audit changes to user accounts. +Events include the following: +- A user account is created, changed, deleted; renamed, disabled, enabled, locked out, or unlocked. +- A user account’s password is set or changed. +- A security identifier (SID) is added to the SID History of a user account. +- The Directory Services Restore Mode password is configured. +- Permissions on administrative user accounts are changed. +- Credential Manager credentials are backed up or restored. -If you configure this policy setting, an audit event is generated when an attempt to change a user account is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a user account changes. +If you configure this policy setting, an audit event is generated when an attempt to change a user account is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a user account changes. +Volume: Low. - + +GP Info: +- GP English name: *Audit User Account Management* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Management* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default: Success. @@ -1417,9 +1708,23 @@ If you configure this policy setting, an audit event is generated when an attemp This policy setting allows you to audit events generated by detailed Active Directory Domain Services (AD DS) replication between domain controllers. - - +Volume: High. + + +GP Info: +- GP English name: *Audit Detailed Directory Service Replication* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/DS Access* + + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default: No Auditing. @@ -1473,9 +1778,24 @@ Only AD DS objects with a matching system access control list (SACL) are logged. Events in this subcategory are similar to the Directory Service Access events available in previous versions of Windows. +Volume: High on domain controllers. None on client computers. - + +GP Info: +- GP English name: *Audit Directory Service Access* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/DS Access* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default on Client editions: No Auditing. + +Default on Server editions: Success. @@ -1529,14 +1849,28 @@ When possible, events logged in this subcategory indicate the old and new values Events in this subcategory are logged only on domain controllers, and only objects in AD DS with a matching system access control list (SACL) are logged. -Note: Actions on some objects and properties do not cause audit events to be generated due to settings on the object class in the schema. +> [!Note] +> Actions on some objects and properties do not cause audit events to be generated due to settings on the object class in the schema. If you configure this policy setting, an audit event is generated when an attempt to change an object in AD DS is made. Success audits record successful attempts, however unsuccessful attempts are NOT recorded. If you do not configure this policy setting, no audit event is generated when an attempt to change an object in AD DS object is made. +Volume: High on domain controllers only. - + +GP Info: +- GP English name: *Audit Directory Service Changes* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/DS Access* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default: No Auditing @@ -1589,9 +1923,25 @@ This policy setting allows you to audit replication between two Active Directory If you configure this policy setting, an audit event is generated during AD DS replication. Success audits record successful replication and Failure audits record unsuccessful replication. If you do not configure this policy setting, no audit event is generated during AD DS replication. - - +>[!Note] +> Events in this subcategory are logged only on domain controllers. +Volume: Medium on domain controllers. None on client computers. + + +GP Info: +- GP English name: *Audit Directory Service Replication* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/DS Access* + + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default: No Auditing. @@ -1644,9 +1994,20 @@ This policy setting allows you to audit events generated when encryption or decr If you configure this policy setting, an audit event is generated when an encryption or decryption request is made to DPAPI. Success audits record successful requests and Failure audits record unsuccessful requests. If you do not configure this policy setting, no audit event is generated when an encryption or decryption request is made to DPAPI. +Volume: Low. - + +GP Info: +- GP English name: *Audit DPAPI Activity* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Detailed Tracking* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure @@ -1699,9 +2060,20 @@ This policy setting allows you to audit when plug and play detects an external d If you configure this policy setting, an audit event is generated whenever plug and play detects an external device. Only Success audits are recorded for this category. If you do not configure this policy setting, no audit event is generated when an external device is detected by plug and play. +Volume: Low. - + +GP Info: +- GP English name: *Audit PNP Activity* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Detailed Tracking* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure @@ -1754,9 +2126,20 @@ This policy setting allows you to audit events generated when a process is creat If you configure this policy setting, an audit event is generated when a process is created. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a process is created. +Volume: Depends on how the computer is used. - + +GP Info: +- GP English name: *Audit Process Creation* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Detailed Tracking* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure @@ -1809,9 +2192,20 @@ This policy setting allows you to audit events generated when a process ends. If you configure this policy setting, an audit event is generated when a process ends. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a process ends. +Volume: Depends on how the computer is used. - + +GP Info: +- GP English name: *Audit Process Termination* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Detailed Tracking* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure @@ -1864,9 +2258,20 @@ This policy setting allows you to audit inbound remote procedure call (RPC) conn If you configure this policy setting, an audit event is generated when a remote RPC connection is attempted. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a remote RPC connection is attempted. +Volume: High on RPC servers. - + +GP Info: +- GP English name: *Audit RPC Events* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Detailed Tracking* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure @@ -1916,9 +2321,22 @@ If you do not configure this policy setting, no audit event is generated when a This policy setting allows you to audit events generated by adjusting the privileges of a token. +Volume: High. - + +GP Info: +- GP English name: *Audit Token Right Adjusted* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Detailed Tracking* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default: No Auditing. @@ -1967,15 +2385,26 @@ This policy setting allows you to audit events generated by adjusting the privil This policy setting allows you to audit applications that generate events using the Windows Auditing application programming interfaces (APIs). Applications designed to use the Windows Auditing API use this subcategory to log auditing events related to their function. -Events in this subcategory include: - Creation of an application client context. - Deletion of an application client context. - Initialization of an application client context. - Other application operations using the Windows Auditing APIs. +Events in this subcategory include: +- Creation of an application client context. +- Deletion of an application client context. +- Initialization of an application client context. +- Other application operations using the Windows Auditing APIs. +Volume: Depends on the applications that are generating them. - + +GP Info: +- GP English name: *Audit Application Generated* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure @@ -2025,17 +2454,29 @@ Events in this subcategory include: This policy setting allows you to audit access requests where the permission granted or denied by a proposed policy differs from the current central access policy on an object. -If you configure this policy setting, an audit event is generated each time a user accesses an object and the permission granted by the current central access policy on the object differs from that granted by the proposed policy. The resulting audit event will be generated as follows: -1) Success audits, when configured, records access attempts when the current central access policy grants access but the proposed policy denies access. -2) Failure audits when configured records access attempts when: - a) The current central access policy does not grant access but the proposed policy grants access. - b) A principal requests the maximum access rights they are allowed and the access rights granted by the current central access policy are different than the access rights granted by the proposed policy. +If you configure this policy setting, an audit event is generated each time a user accesses an object and the permission granted by the current central access policy on the object differs from that granted by the proposed policy. The resulting audit event will be generated as follows: +1. Success audits, when configured, records access attempts when the current central access policy grants access but the proposed policy denies access. +2. Failure audits when configured records access attempts when: + - The current central access policy does not grant access but the proposed policy grants access. + - A principal requests the maximum access rights they are allowed and the access rights granted by the current central access policy are different than the access rights granted by the proposed policy. Volume: Potentially high on a file server when the proposed policy differs significantly from the current central access policy. - + +GP Info: +- GP English name: *Audit Central Access Policy Staging* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default: No Auditing. @@ -2084,27 +2525,38 @@ Volume: Potentially high on a file server when the proposed policy differs signi This policy setting allows you to audit Active Directory Certificate Services (AD CS) operations. -AD CS operations include the following: - AD CS startup/shutdown/backup/restore. - Changes to the certificate revocation list (CRL). - New certificate requests. - Issuing of a certificate. - Revocation of a certificate. - Changes to the Certificate Manager settings for AD CS. - Changes in the configuration of AD CS. - Changes to a Certificate Services template. - Importing of a certificate. - Publishing of a certification authority certificate is to Active Directory Domain Services. - Changes to the security permissions for AD CS. - Archival of a key. - Importing of a key. - Retrieval of a key. - Starting of Online Certificate Status Protocol (OCSP) Responder Service. - Stopping of Online Certificate Status Protocol (OCSP) Responder Service. +AD CS operations include the following: +- AD CS startup/shutdown/backup/restore. +- Changes to the certificate revocation list (CRL). +- New certificate requests. +- Issuing of a certificate. +- Revocation of a certificate. +- Changes to the Certificate Manager settings for AD CS. +- Changes in the configuration of AD CS. +- Changes to a Certificate Services template. +- Importing of a certificate. +- Publishing of a certification authority certificate is to Active Directory Domain Services. +- Changes to the security permissions for AD CS. +- Archival of a key. +- Importing of a key. +- Retrieval of a key. +- Starting of Online Certificate Status Protocol (OCSP) Responder Service. +- Stopping of Online Certificate Status Protocol (OCSP) Responder Service. +Volume: Medium or Low on computers running Active Directory Certificate Services. - + +GP Info: +- GP English name: *Audit Certification Services* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure @@ -2156,11 +2608,23 @@ This policy setting allows you to audit attempts to access files and folders on If you configure this policy setting, an audit event is generated when an attempt is made to access a file or folder on a share. The administrator can specify whether to audit only successes, only failures, or both successes and failures. -Note: There are no system access control lists (SACLs) for shared folders. If this policy setting is enabled, access to all shared files and folders on the system is audited. +> [!Note] +> There are no system access control lists (SACLs) for shared folders. If this policy setting is enabled, access to all shared files and folders on the system is audited. +Volume: High on a file server or domain controller because of SYSVOL network access required by Group Policy. - + +GP Info: +- GP English name: *Audit Detailed File Share* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure @@ -2212,11 +2676,23 @@ This policy setting allows you to audit attempts to access a shared folder. If you configure this policy setting, an audit event is generated when an attempt is made to access a shared folder. If this policy setting is defined, the administrator can specify whether to audit only successes, only failures, or both successes and failures. -Note: There are no system access control lists (SACLs) for shared folders. If this policy setting is enabled, access to all shared folders on the system is audited. +> [!Note] +> There are no system access control lists (SACLs) for shared folders. If this policy setting is enabled, access to all shared folders on the system is audited. +Volume: High on a file server or domain controller because of SYSVOL network access required by Group Policy. - + +GP Info: +- GP English name: *Audit File Share* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure @@ -2269,11 +2745,23 @@ This policy setting allows you to audit user attempts to access file system obje If you configure this policy setting, an audit event is generated each time an account accesses a file system object with a matching SACL. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when an account accesses a file system object with a matching SACL. -Note: You can set a SACL on a file system object using the Security tab in that object's Properties dialog box. +> [!Note] +> You can set a SACL on a file system object using the Security tab in that object's Properties dialog box. +Volume: Depends on how the file system SACLs are configured. - + +GP Info: +- GP English name: *Audit File System* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure @@ -2321,23 +2809,36 @@ Note: You can set a SACL on a file system object using the Security tab in that -This policy setting allows you to audit connections that are allowed or blocked by the Windows Filtering Platform (WFP). The following events are included: - The Windows Firewall Service blocks an application from accepting incoming connections on the network. - The WFP allows a connection. - The WFP blocks a connection. - The WFP permits a bind to a local port. - The WFP blocks a bind to a local port. - The WFP allows a connection. - The WFP blocks a connection. - The WFP permits an application or service to listen on a port for incoming connections. - The WFP blocks an application or service to listen on a port for incoming connections. +This policy setting allows you to audit connections that are allowed or blocked by the Windows Filtering Platform (WFP). +The following events are included: +- The Windows Firewall Service blocks an application from accepting incoming connections on the network. +- The WFP allows a connection. +- The WFP blocks a connection. +- The WFP permits a bind to a local port. +- The WFP blocks a bind to a local port. +- The WFP allows a connection. +- The WFP blocks a connection. +- The WFP permits an application or service to listen on a port for incoming connections. +- The WFP blocks an application or service to listen on a port for incoming connections. If you configure this policy setting, an audit event is generated when connections are allowed or blocked by the WFP. Success audits record events generated when connections are allowed and Failure audits record events generated when connections are blocked. + If you do not configure this policy setting, no audit event is generated when connected are allowed or blocked by the WFP. +Volume: High. - + +GP Info: +- GP English name: *Audit Filtering Platform Connection* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure @@ -2387,9 +2888,21 @@ If you do not configure this policy setting, no audit event is generated when co This policy setting allows you to audit packets that are dropped by Windows Filtering Platform (WFP). - - +Volume: High. + + +GP Info: +- GP English name: *Audit Filtering Platform Packet Drop* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure @@ -2442,11 +2955,23 @@ This policy setting allows you to audit events generated when a handle to an obj If you configure this policy setting, an audit event is generated when a handle is manipulated. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a handle is manipulated. -Note: Events in this subcategory generate events only for object types where the corresponding Object Access subcategory is enabled. For example, if File system object access is enabled, handle manipulation security audit events are generated. If Registry object access is not enabled, handle manipulation security audit events will not be generated. +> [!Note] +> Events in this subcategory generate events only for object types where the corresponding Object Access subcategory is enabled. For example, if File system object access is enabled, handle manipulation security audit events are generated. If Registry object access is not enabled, handle manipulation security audit events will not be generated. +Volume: Depends on how SACLs are configured. - + +GP Info: +- GP English name: *Audit Handle Manipulation* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure @@ -2497,11 +3022,23 @@ Note: Events in this subcategory generate events only for object types where the This policy setting allows you to audit attempts to access the kernel, which include mutexes and semaphores. Only kernel objects with a matching system access control list (SACL) generate security audit events. -Note: The Audit: Audit the access of global system objects policy setting controls the default SACL of kernel objects. +> [!Note] +> The Audit: Audit the access of global system objects policy setting controls the default SACL of kernel objects. +Volume: High if auditing access of global system objects is enabled. - + +GP Info: +- GP English name: *Audit Kernel Object* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure @@ -2550,20 +3087,32 @@ Note: The Audit: Audit the access of global system objects policy setting contro This policy setting allows you to audit events generated by the management of task scheduler jobs or COM+ objects. -For scheduler jobs, the following are audited: - Job created. - Job deleted. - Job enabled. - Job disabled. - Job updated. -For COM+ objects, the following are audited: - Catalog object added. - Catalog object updated. - Catalog object deleted. +For scheduler jobs, the following are audited: +- Job created. +- Job deleted. +- Job enabled. +- Job disabled. +- Job updated. +For COM+ objects, the following are audited: +- Catalog object added. +- Catalog object updated. +- Catalog object deleted. + +Volume: Low. - + +GP Info: +- GP English name: *Audit Other Object Access Events* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure @@ -2616,11 +3165,23 @@ This policy setting allows you to audit attempts to access registry objects. A s If you configure this policy setting, an audit event is generated each time an account accesses a registry object with a matching SACL. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when an account accesses a registry object with a matching SACL. -Note: You can set a SACL on a registry object using the Permissions dialog box. +> [!Note] +> You can set a SACL on a registry object using the Permissions dialog box. +Volume: Depends on how registry SACLs are configured. - + +GP Info: +- GP English name: *Audit Registry* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure @@ -2675,8 +3236,18 @@ If you configure this policy setting, an audit event is generated each time an a If you do not configure this policy setting, no audit event is generated when an account accesses a file system object on a removable storage. - + +GP Info: +- GP English name: *Audit Removable Storage* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure @@ -2725,20 +3296,34 @@ If you do not configure this policy setting, no audit event is generated when an This policy setting allows you to audit events generated by attempts to access to Security Accounts Manager (SAM) objects. -SAM objects include the following: - SAM_ALIAS -- A local group. - SAM_GROUP -- A group that is not a local group. - SAM_USER – A user account. - SAM_DOMAIN – A domain. - SAM_SERVER – A computer account. +SAM objects include the following: +- SAM_ALIAS -- A local group. +- SAM_GROUP -- A group that is not a local group. +- SAM_USER – A user account. +- SAM_DOMAIN – A domain. +- SAM_SERVER – A computer account. + If you configure this policy setting, an audit event is generated when an attempt to access a kernel object is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when an attempt to access a kernel object is made. -Note: Only the System Access Control List (SACL) for SAM_SERVER can be modified. -Volume: High on domain controllers. For information about reducing the amount of events generated in this subcategory, see article 841001 in the Microsoft Knowledge Base (https://go.microsoft.com/fwlink/?LinkId=121698). + +> [!Note] +> Only the System Access Control List (SACL) for SAM_SERVER can be modified. + +Volume: High on domain controllers. For information about reducing the amount of events generated in this subcategory, see [article 841001 in the Microsoft Knowledge Base](https://go.microsoft.com/fwlink/?LinkId=121698). - + +GP Info: +- GP English name: *Audit SAM* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure @@ -2786,27 +3371,41 @@ Volume: High on domain controllers. For information about reducing the amount of -This policy setting allows you to audit events generated by changes to the authentication policy such as the following: - Creation of forest and domain trusts. - Modification of forest and domain trusts. - Removal of forest and domain trusts. - Changes to Kerberos policy under Computer Configuration\Windows Settings\Security Settings\Account Policies\Kerberos Policy. - Granting of any of the following user rights to a user or group: - Access This Computer From the Network. - Allow Logon Locally. - Allow Logon Through Terminal Services. - Logon as a Batch Job. - Logon a Service. - Namespace collision. For example, when a new trust has the same name as an existing namespace name. +This policy setting allows you to audit events generated by changes to the authentication policy, such as the following: +- Creation of forest and domain trusts. +- Modification of forest and domain trusts. +- Removal of forest and domain trusts. +- Changes to Kerberos policy under Computer Configuration\Windows Settings\Security Settings\Account Policies\Kerberos Policy. +- Granting of any of the following user rights to a user or group: + - Access This Computer From the Network. + - Allow Logon Locally. + - Allow Logon Through Terminal Services. + - Logon as a Batch Job. + - Logon a Service. +- Namespace collision. For example, when a new trust has the same name as an existing namespace name. If you configure this policy setting, an audit event is generated when an attempt to change the authentication policy is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when the authentication policy is changed. -Note: The security audit event is logged when the group policy is applied. It does not occur at the time when the settings are modified. +> [!Note] +> The security audit event is logged when the group policy is applied. It does not occur at the time when the settings are modified. +Volume: Low. - + +GP Info: +- GP English name: *Audit Authentication Policy Change* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Policy Change* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default: Success. @@ -2854,19 +3453,32 @@ Note: The security audit event is logged when the group policy is applied. It do -This policy setting allows you to audit events generated by changes to the authorization policy such as the following: - Assignment of user rights (privileges), such as SeCreateTokenPrivilege, that are not audited through the “Authentication Policy Change” subcategory. - Removal of user rights (privileges), such as SeCreateTokenPrivilege, that are not audited through the “Authentication Policy Change” subcategory. - Changes in the Encrypted File System (EFS) policy. - Changes to the Resource attributes of an object. - Changes to the Central Access Policy (CAP) applied to an object. +This policy setting allows you to audit events generated by changes to the authorization policy, such as the following: +- Assignment of user rights (privileges), such as SeCreateTokenPrivilege, that are not audited through the “Authentication Policy Change” subcategory. +- Removal of user rights (privileges), such as SeCreateTokenPrivilege, that are not audited through the “Authentication Policy Change” subcategory. +- Changes in the Encrypted File System (EFS) policy. +- Changes to the Resource attributes of an object. +- Changes to the Central Access Policy (CAP) applied to an object. If you configure this policy setting, an audit event is generated when an attempt to change the authorization policy is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when the authorization policy changes. +Volume: Low. - + +GP Info: +- GP English name: *Audit Authorization Policy Change* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Policy Change* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default: No Auditing. @@ -2914,18 +3526,31 @@ If you do not configure this policy setting, no audit event is generated when th -This policy setting allows you to audit events generated by changes to the Windows Filtering Platform (WFP) such as the following: - IPsec services status. - Changes to IPsec policy settings. - Changes to Windows Firewall policy settings. - Changes to WFP providers and engine. +This policy setting allows you to audit events generated by changes to the Windows Filtering Platform (WFP), such as the following: +- IPsec services status. +- Changes to IPsec policy settings. +- Changes to Windows Firewall policy settings. +- Changes to WFP providers and engine. If you configure this policy setting, an audit event is generated when a change to the WFP is attempted. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a change occurs to the WFP. +Volume: Low. - + +GP Info: +- GP English name: *Audit Filtering Platform Policy Change* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Policy Change* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default: No Auditing. @@ -2973,20 +3598,34 @@ If you do not configure this policy setting, no audit event is generated when a -This policy setting allows you to audit events generated by changes in policy rules used by the Microsoft Protection Service (MPSSVC). This service is used by Windows Firewall. Events include the following: - Reporting of active policies when Windows Firewall service starts. - Changes to Windows Firewall rules. - Changes to Windows Firewall exception list. - Changes to Windows Firewall settings. - Rules ignored or not applied by Windows Firewall Service. - Changes to Windows Firewall Group Policy settings. +This policy setting allows you to audit events generated by changes in policy rules used by the Microsoft Protection Service (MPSSVC). This service is used by Windows Firewall. +Events include the following: +- Reporting of active policies when Windows Firewall service starts. +- Changes to Windows Firewall rules. +- Changes to Windows Firewall exception list. +- Changes to Windows Firewall settings. +- Rules ignored or not applied by Windows Firewall Service. +- Changes to Windows Firewall Group Policy settings. If you configure this policy setting, an audit event is generated by attempts to change policy rules used by the MPSSVC. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated by changes in policy rules used by the MPSSVC. +Volume: Low. - + +GP Info: +- GP English name: *Audit MPSSVC Rule Level Policy Change* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Policy Change* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default: No Auditing. @@ -3034,17 +3673,30 @@ If you do not configure this policy setting, no audit event is generated by chan -This policy setting allows you to audit events generated by other security policy changes that are not audited in the policy change category, such as the following: - Trusted Platform Module (TPM) configuration changes. - Kernel-mode cryptographic self tests. - Cryptographic provider operations. - Cryptographic context operations or modifications. - Applied Central Access Policies (CAPs) changes. - Boot Configuration Data (BCD) modifications. +This policy setting allows you to audit events generated by other security policy changes that are not audited in the policy change category, such as the following: +- Trusted Platform Module (TPM) configuration changes. +- Kernel-mode cryptographic self tests. +- Cryptographic provider operations. +- Cryptographic context operations or modifications. +- Applied Central Access Policies (CAPs) changes. +- Boot Configuration Data (BCD) modifications. +Volume: Low. - + +GP Info: +- GP English name: *Audit Other Policy Change Events* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Policy Change* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default: No Auditing. @@ -3092,21 +3744,35 @@ This policy setting allows you to audit events generated by other security polic -This policy setting allows you to audit changes in the security audit policy settings such as the following: - Settings permissions and audit settings on the Audit Policy object. - Changes to the system audit policy. - Registration of security event sources. - De-registration of security event sources. - Changes to the per-user audit settings. - Changes to the value of CrashOnAuditFail. - Changes to the system access control list on a file system or registry object. - Changes to the Special Groups list. +This policy setting allows you to audit changes in the security audit policy settings, such as the following: +- Settings permissions and audit settings on the Audit Policy object. +- Changes to the system audit policy. +- Registration of security event sources. +- De-registration of security event sources. +- Changes to the per-user audit settings. +- Changes to the value of CrashOnAuditFail. +- Changes to the system access control list on a file system or registry object. +- Changes to the Special Groups list. -Note: System access control list (SACL) change auditing is done when a SACL for an object changes and the policy change category is enabled. Discretionary access control list (DACL) and ownership changes are audited when object access auditing is enabled and the object's SACL is configured for auditing of DACL/Owner change. +> [!Note] +> System access control list (SACL) change auditing is done when a SACL for an object changes and the policy change category is enabled. Discretionary access control list (DACL) and ownership changes are audited when object access auditing is enabled and the object's SACL is configured for auditing of DACL/Owner change. +Volume: Low. - + +GP Info: +- GP English name: *Audit Policy Change* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Policy Change* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default: Success. @@ -3155,45 +3821,55 @@ Note: System access control list (SACL) change auditing is done when a SACL for This policy setting allows you to audit events generated by the use of non-sensitive privileges (user rights). -The following privileges are non-sensitive: - Access Credential Manager as a trusted caller. - Access this computer from the network. - Add workstations to domain. - Adjust memory quotas for a process. - Allow log on locally. - Allow log on through Terminal Services. - Bypass traverse checking. - Change the system time. - Create a pagefile. - Create global objects. - - Create permanent shared objects. - Create symbolic links. - Deny access this computer from the network. - Deny log on as a batch job. - Deny log on as a service. - Deny log on locally. - Deny log on through Terminal Services. - Force shutdown from a remote system. - Increase a process working set. - Increase scheduling priority. - Lock pages in memory. - Log on as a batch job. - Log on as a service. - Modify an object label. - Perform volume maintenance tasks. - Profile single process. - Profile system performance. - Remove computer from docking station. - Shut down the system. - Synchronize directory service data. +The following privileges are non-sensitive: +- Access Credential Manager as a trusted caller. +- Access this computer from the network. +- Add workstations to domain. +- Adjust memory quotas for a process. +- Allow log on locally. +- Allow log on through Terminal Services. +- Bypass traverse checking. +- Change the system time. +- Create a pagefile. +- Create global objects. +- Create permanent shared objects. +- Create symbolic links. +- Deny access this computer from the network. +- Deny log on as a batch job. +- Deny log on as a service. +- Deny log on locally. +- Deny log on through Terminal Services. +- Force shutdown from a remote system. +- Increase a process working set. +- Increase scheduling priority. +- Lock pages in memory. +- Log on as a batch job. +- Log on as a service. +- Modify an object label. +- Perform volume maintenance tasks. +- Profile single process. +- Profile system performance. +- Remove computer from docking station. +- Shut down the system. +- Synchronize directory service data. If you configure this policy setting, an audit event is generated when a non-sensitive privilege is called. Success audits record successful calls and Failure audits record unsuccessful calls. If you do not configure this policy setting, no audit event is generated when a non-sensitive privilege is called. +Volume: Very High. - + +GP Info: +- GP English name: *Audit Non Sensitive Privilege Use* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Privilege Use* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure @@ -3244,8 +3920,18 @@ If you do not configure this policy setting, no audit event is generated when a Not used. - + +GP Info: +- GP English name: *Audit Other Privilege Use Events* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Privilege Use* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure @@ -3293,30 +3979,40 @@ Not used. -This policy setting allows you to audit events generated when sensitive privileges (user rights) are used such as the following: - A privileged service is called. - One of the following privileges are called: - Act as part of the operating system. - Back up files and directories. - Create a token object. - Debug programs. - Enable computer and user accounts to be trusted for delegation. - Generate security audits. - Impersonate a client after authentication. - Load and unload device drivers. - Manage auditing and security log. - Modify firmware environment values. - Replace a process-level token. - Restore files and directories. - Take ownership of files or other objects. +This policy setting allows you to audit events generated when sensitive privileges (user rights) are used, such as the following: +- A privileged service is called. +- One of the following privileges are called: + - Act as part of the operating system. + - Back up files and directories. + - Create a token object. + - Debug programs. + - Enable computer and user accounts to be trusted for delegation. + - Generate security audits. + - Impersonate a client after authentication. + - Load and unload device drivers. + - Manage auditing and security log. + - Modify firmware environment values. + - Replace a process-level token. + - Restore files and directories. + - Take ownership of files or other objects. If you configure this policy setting, an audit event is generated when sensitive privilege requests are made. Success audits record successful requests and Failure audits record unsuccessful requests. If you do not configure this policy setting, no audit event is generated when sensitive privilege requests are made. - +Volume: High. - + +GP Info: +- GP English name: *Audit Sensitive Privilege Use* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Privilege Use* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure @@ -3364,20 +4060,33 @@ If you do not configure this policy setting, no audit event is generated when se -This policy setting allows you to audit events generated by the IPsec filter driver such as the following: - Startup and shutdown of the IPsec services. - Network packets dropped due to integrity check failure. - Network packets dropped due to replay check failure. - Network packets dropped due to being in plaintext. - Network packets received with incorrect Security Parameter Index (SPI). This may indicate that either the network card is not working correctly or the driver needs to be updated. - Inability to process IPsec filters. +This policy setting allows you to audit events generated by the IPsec filter driver, such as the following: +- Startup and shutdown of the IPsec services. +- Network packets dropped due to integrity check failure. +- Network packets dropped due to replay check failure. +- Network packets dropped due to being in plaintext. +- Network packets received with incorrect Security Parameter Index (SPI). This may indicate that either the network card is not working correctly or the driver needs to be updated. +- Inability to process IPsec filters. If you configure this policy setting, an audit event is generated on an IPsec filter driver operation. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated on an IPSec filter driver operation. +Volume: Low. - + +GP Info: +- GP English name: *Audit IPsec Driver* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/System* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default: No Auditing. @@ -3425,14 +4134,27 @@ If you do not configure this policy setting, no audit event is generated on an I -This policy setting allows you to audit any of the following events: - Startup and shutdown of the Windows Firewall service and driver. - Security policy processing by the Windows Firewall Service. - Cryptography key file and migration operations. +This policy setting allows you to audit any of the following events: +- Startup and shutdown of the Windows Firewall service and driver. +- Security policy processing by the Windows Firewall Service. +- Cryptography key file and migration operations. +Volume: Low. - + +GP Info: +- GP English name: *Audit Other System Events* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/System* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default: Success, Failure. @@ -3480,14 +4202,27 @@ This policy setting allows you to audit any of the following events: -This policy setting allows you to audit events generated by changes in the security state of the computer such as the following events: - Startup and shutdown of the computer. - Change of system time. - Recovering the system from CrashOnAuditFail, which is logged after a system restarts when the security event log is full and the CrashOnAuditFail registry entry is configured. +This policy setting allows you to audit events generated by changes in the security state of the computer, such as the following events: +- Startup and shutdown of the computer. +- Change of system time. +- Recovering the system from CrashOnAuditFail, which is logged after a system restarts when the security event log is full and the CrashOnAuditFail registry entry is configured. +Volume: Low. - + +GP Info: +- GP English name: *Audit Security State Change* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/System* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default: Success. @@ -3535,15 +4270,29 @@ This policy setting allows you to audit events generated by changes in the secur -This policy setting allows you to audit events related to security system extensions or services such as the following: - A security system extension, such as an authentication, notification, or security package is loaded and is registered with the Local Security Authority (LSA). It is used to authenticate logon attempts, submit logon requests, and any account or password changes. Examples of security system extensions are Kerberos and NTLM. - A service is installed and registered with the Service Control Manager. The audit log contains information about the service name, binary, type, start type, and service account. +This policy setting allows you to audit events related to security system extensions or services, such as the following: +- A security system extension, such as an authentication, notification, or security package is loaded and is registered with the Local Security Authority (LSA). It is used to authenticate logon attempts, submit logon requests, and any account or password changes. Examples of security system extensions are Kerberos and NTLM. +- A service is installed and registered with the Service Control Manager. The audit log contains information about the service name, binary, type, start type, and service account. + If you configure this policy setting, an audit event is generated when an attempt is made to load a security system extension. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when an attempt is made to load a security system extension. +Volume: Low. Security system extension events are generated more often on a domain controller than on client computers or member servers. - + +GP Info: +- GP English name: *Audit Security System Extension* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/System* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default: No Auditing. @@ -3591,16 +4340,29 @@ If you do not configure this policy setting, no audit event is generated when an -This policy setting allows you to audit events that violate the integrity of the security subsystem, such as the following: - Events that could not be written to the event log because of a problem with the auditing system. - A process that uses a local procedure call (LPC) port that is not valid in an attempt to impersonate a client by replying, reading, or writing to or from a client address space. - The detection of a Remote Procedure Call (RPC) that compromises system integrity. - The detection of a hash value of an executable file that is not valid as determined by Code Integrity. - Cryptographic operations that compromise system integrity. +This policy setting allows you to audit events that violate the integrity of the security subsystem, such as the following: +- Events that could not be written to the event log because of a problem with the auditing system. +- A process that uses a local procedure call (LPC) port that is not valid in an attempt to impersonate a client by replying, reading, or writing to or from a client address space. +- The detection of a Remote Procedure Call (RPC) that compromises system integrity. +- The detection of a hash value of an executable file that is not valid as determined by Code Integrity. +- Cryptographic operations that compromise system integrity. +Volume: Low. - + +GP Info: +- GP English name: *Audit System Integrity* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/System* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default: Success, Failure. @@ -3611,7 +4373,7 @@ This policy setting allows you to audit events that violate the integrity of the
-Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. From 46faa86cd9c4317526fc573af2ef7af37dfb6146 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Thu, 19 Sep 2019 18:24:44 -0700 Subject: [PATCH 08/43] minor update --- windows/client-management/mdm/policy-csp-audit.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/client-management/mdm/policy-csp-audit.md b/windows/client-management/mdm/policy-csp-audit.md index 0132b893ca..7f3ffd9290 100644 --- a/windows/client-management/mdm/policy-csp-audit.md +++ b/windows/client-management/mdm/policy-csp-audit.md @@ -14,7 +14,6 @@ ms.date: 09/19/2019 > [!WARNING] > Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. -
From f323699b88f93988030fa7f5f214103b62c8dd22 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Mon, 23 Sep 2019 14:41:14 -0700 Subject: [PATCH 09/43] Added new policy --- .../mdm/policy-csp-education.md | 63 ++++++++++++++++++- 1 file changed, 61 insertions(+), 2 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-education.md b/windows/client-management/mdm/policy-csp-education.md index 56e547eb48..2fbf4b7af1 100644 --- a/windows/client-management/mdm/policy-csp-education.md +++ b/windows/client-management/mdm/policy-csp-education.md @@ -6,14 +6,15 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 03/12/2018 +ms.date: 09/23/2019 ms.reviewer: manager: dansimp --- # Policy CSP - Education - +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here.
@@ -21,6 +22,9 @@ manager: dansimp ## Education policies
+
+ Education/AllowGraphingCalculator +
Education/DefaultPrinterName
@@ -32,6 +36,60 @@ manager: dansimp
+
+ + +**Education/AllowGraphingCalculator** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
check mark7check mark7check mark7check mark7check mark7cross markcross mark
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Added in next major release of Windows 10. This policy setting allows you to control whether graphing functionality is available in the Windows Calculator app. If you disable this policy setting, graphing functionality will not be accessible in the Windows Calculator app. If you enable or don't configure this policy setting, you will be able to access graphing functionality. + + +ADMX Info: +- GP English name: *Allow Graphing Calculator* +- GP name: *AllowGraphingCalculator* +- GP path: *Windows Components/Calculator* +- GP ADMX file name: *Programs.admx* + + + +The following list shows the supported values: +- 0 - Disabled +- 1 (default) - Enabled + +
@@ -190,6 +248,7 @@ Footnotes: - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. - 6 - Added in Windows 10, version 1903. +- 7 - Added in next major release of Windows 10. From b8678af8fe0cd7c6c3b4bcf69a7539d62ae05b47 Mon Sep 17 00:00:00 2001 From: John Liu <49762389+ShenLanJohn@users.noreply.github.com> Date: Tue, 24 Sep 2019 10:01:24 -0700 Subject: [PATCH 10/43] CAT Auto Pulish for Windows Release Messages - 20190924095118 (#1179) * Update networkproxy-csp.md * Update windows/client-management/mdm/networkproxy-csp.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> * Update windows/client-management/mdm/networkproxy-csp.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> * Update windows/client-management/mdm/networkproxy-csp.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> * Update windows/client-management/mdm/networkproxy-csp.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> * Update windows/client-management/mdm/networkproxy-csp.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> * Update windows/client-management/mdm/networkproxy-csp.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> * Update windows/client-management/mdm/networkproxy-csp.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> * Update windows/client-management/mdm/networkproxy-csp.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> * Update windows/client-management/mdm/networkproxy-csp.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> * Update windows/client-management/mdm/networkproxy-csp.md Co-Authored-By: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> * Update windows/client-management/mdm/networkproxy-csp.md Co-Authored-By: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> * Update windows/client-management/mdm/networkproxy-csp.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> * Update windows/client-management/mdm/networkproxy-csp.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> * Update windows/client-management/mdm/networkproxy-csp.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> * Update windows/client-management/mdm/networkproxy-csp.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> * Update windows/client-management/mdm/networkproxy-csp.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> * Update windows/client-management/mdm/networkproxy-csp.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> * Update windows/client-management/mdm/networkproxy-csp.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> * Update windows/client-management/mdm/networkproxy-csp.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> * Update windows/client-management/mdm/networkproxy-csp.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> * Update windows/client-management/mdm/networkproxy-csp.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> * Update windows/client-management/mdm/networkproxy-csp.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> * Update windows/client-management/mdm/networkproxy-csp.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> * Update windows/client-management/mdm/networkproxy-csp.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> * Update windows/client-management/mdm/networkproxy-csp.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> * Update windows/client-management/mdm/networkproxy-csp.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> * Update windows/client-management/mdm/networkproxy-csp.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> * Update windows/client-management/mdm/networkproxy-csp.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> * Update windows/client-management/mdm/networkproxy-csp.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> * Update windows/client-management/mdm/networkproxy-csp.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> * Update windows/client-management/mdm/networkproxy-csp.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> * Update windows/client-management/mdm/networkproxy-csp.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> * Update windows/client-management/mdm/networkproxy-csp.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> * Update windows/client-management/mdm/networkproxy-csp.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> * Update windows/client-management/mdm/networkproxy-csp.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> * Update windows/client-management/mdm/networkproxy-csp.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> * Update windows/client-management/mdm/networkproxy-csp.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> * Update windows/client-management/mdm/networkproxy-csp.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> * Update windows/client-management/mdm/networkproxy-csp.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> * Update windows/client-management/mdm/networkproxy-csp.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> * Update windows/client-management/mdm/networkproxy-csp.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> * Update windows/client-management/mdm/networkproxy-csp.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> * Update windows/client-management/mdm/networkproxy-csp.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> * Update windows/client-management/mdm/networkproxy-csp.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> * Update windows/client-management/mdm/networkproxy-csp.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> * Update windows/client-management/mdm/networkproxy-csp.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> * Update windows/client-management/mdm/networkproxy-csp.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> * Update windows/client-management/mdm/networkproxy-csp.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> * Update windows/client-management/mdm/networkproxy-csp.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> * Update windows/client-management/mdm/networkproxy-csp.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> * Update windows/client-management/mdm/networkproxy-csp.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> * Update windows/client-management/mdm/networkproxy-csp.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> * Update windows/client-management/mdm/networkproxy-csp.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> * Update windows/client-management/mdm/networkproxy-csp.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> * Update windows/client-management/mdm/networkproxy-csp.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> * Update windows/client-management/mdm/networkproxy-csp.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> * mdatp_custom_detections_refresh * custom-detections-toc * Update windows/client-management/mdm/networkproxy-csp.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> * Update windows/client-management/mdm/networkproxy-csp.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> * Update windows/client-management/mdm/networkproxy-csp.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> * Update networkproxy-csp.md Remove the xml word at the final of each code portion * Update windows/client-management/mdm/networkproxy-csp.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> * Merge branch 'master' into lomayor-mdatp-ah-sync * Merge branch 'master' into lomayor-mdatp-ah-sync * Update custom-detection-rules.md * custom-detections-manage * Last check * custom-detections * custom_detections * Added note * AH_no_freq * Update networkproxy-csp.md * Added a reference link * Update surface-dock-firmware-update.md * CAT Auto Pulish for Windows Release Messages - CAT_AutoPublish_20190924085026 (#1178) --- .../surface/surface-dock-firmware-update.md | 2 +- .../client-management/mdm/networkproxy-csp.md | 63 +++++++++-- .../mdm/policy-csp-storage.md | 14 +-- ...indows-10-1809-and-windows-server-2019.yml | 2 + ...ndows-7-and-windows-server-2008-r2-sp1.yml | 10 ++ ...windows-8.1-and-windows-server-2012-r2.yml | 10 ++ ...indows-10-1809-and-windows-server-2019.yml | 4 +- ...ndows-7-and-windows-server-2008-r2-sp1.yml | 4 +- ...windows-8.1-and-windows-server-2012-r2.yml | 4 +- .../status-windows-server-2008-sp2.yml | 4 +- .../windows-message-center.yml | 2 + windows/security/threat-protection/TOC.md | 2 +- .../custom-detection-rules.md | 101 ++++++++++++------ .../atp-custom-detection-rule-details.png | Bin 0 -> 118743 bytes .../overview-custom-detections.md | 24 ++--- 15 files changed, 177 insertions(+), 69 deletions(-) create mode 100644 windows/security/threat-protection/microsoft-defender-atp/images/atp-custom-detection-rule-details.png diff --git a/devices/surface/surface-dock-firmware-update.md b/devices/surface/surface-dock-firmware-update.md index cfc0b7cbc8..fe5824c65a 100644 --- a/devices/surface/surface-dock-firmware-update.md +++ b/devices/surface/surface-dock-firmware-update.md @@ -26,7 +26,7 @@ This article explains how to use Microsoft Surface Dock Firmware Update, newly r - The file is released in the following naming format: **Surface_Dock_FwUpdate_X.XX.XXX_Win10_XXXXX_XX.XXX.XXXXX_X.MSI** and installs by default to C:\Program Files\SurfaceUpdate. - Requires Surface devices running at least Windows 10 version 1803 or later. -2. Click **Start > All Apps > Microsoft Surface Dock Updater.** After you connect Surface Dock to your Surface device, the tool checks the firmware status while running in the background. +2. After you connect Surface Dock to your Surface device, the tool checks the firmware status while running in the background. 4. After several seconds, disconnect your Surface Dock from your device and then wait for 5 seconds before reconnecting. The Surface Dock Firmware Update will normally update the dock silently in background after you disconnect from the dock and reconnect. The process can take a few minutes to complete and will continue even if interrupted. diff --git a/windows/client-management/mdm/networkproxy-csp.md b/windows/client-management/mdm/networkproxy-csp.md index 12cc7ab347..8d7aa80999 100644 --- a/windows/client-management/mdm/networkproxy-csp.md +++ b/windows/client-management/mdm/networkproxy-csp.md @@ -40,10 +40,10 @@ Added in Windows 10, version 1803. When set to 0, it enables proxy configuration Supported operations are Add, Get, Replace, and Delete. -> [!NOTE] -> Per user proxy configuration setting is not supported. +> [!Note] +> Per user proxy configuration setting is not supported using a configuration file, only modifying registry settings on a local machine. -**AutoDetect** +**AutoDetect** Automatically detect settings. If enabled, the system tries to find the path to a PAC script. Valid values: @@ -52,9 +52,9 @@ Valid values:
  • 1 (default) - Enabled
    • -The data type is int. Supported operations are Get and Replace. Starting in Windows 10, version 1803, the Delete operation is also supported. +The data type is integer. Supported operations are Get and Replace. Starting in Windows 10, version 1803, the Delete operation is also supported. -**SetupScriptUrl** +**SetupScriptUrl** Address to the PAC script you want to use. The data type is string. Supported operations are Get and Replace. Starting in Windows 10, version 1803, the Delete operation is also supported. @@ -82,4 +82,55 @@ Valid values:
  • 1 - Do not use proxy server for local addresses
    • -The data type is int. Supported operations are Get and Replace. Starting in Windows 10, version 1803, the Delete operation is also supported. +The data type is integer. Supported operations are Get and Replace. Starting in Windows 10, version 1803, the Delete operation is also supported. + +# Configuration Example + +These generic code portions for the options **ProxySettingsPerUser**, **Autodetect**, and **SetupScriptURL** can be used for a specific operation, for example Replace. Only enter the portion of code needed in the **Replace** section. +```xml + + 1 + + + ./Vendor/MSFT/NetworkProxy/ProxySettingsPerUser + + + int + text/plain + + 0 + + +``` + +```xml + + 2 + + + ./Vendor/MSFT/NetworkProxy/AutoDetect + + + int + text/plain + + 1 + + +``` + +```xml + + 3 + + + ./Vendor/MSFT/NetworkProxy/SetupScriptUrl + + + chr + text/plain + + Insert the proxy PAC URL location here: + + +``` diff --git a/windows/client-management/mdm/policy-csp-storage.md b/windows/client-management/mdm/policy-csp-storage.md index 09a9bad5ae..d6ed85073e 100644 --- a/windows/client-management/mdm/policy-csp-storage.md +++ b/windows/client-management/mdm/policy-csp-storage.md @@ -6,17 +6,13 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 01/14/2019 +ms.date: 09/23/2019 ms.reviewer: manager: dansimp --- # Policy CSP - Storage -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - -
    @@ -627,7 +623,10 @@ ADMX Info: -If you enable this policy setting, write access is denied to this removable storage class. If you disable or do not configure this policy setting, write access is allowed to this removable storage class. Note: To require that users write data to BitLocker-protected storage, enable the policy setting "Deny write access to drives not protected by BitLocker," which is located in "Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives." +If you enable this policy setting, write access is denied to this removable storage class. If you disable or do not configure this policy setting, write access is allowed to this removable storage class. + +> [!Note] +> To require that users write data to BitLocker-protected storage, enable the policy setting "Deny write access to drives not protected by BitLocker," which is located in "Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives." Supported values: - 0 - Disable @@ -647,7 +646,10 @@ ADMX Info: +Example for setting the device custom OMA-URI setting to enable this policy: +To deny write access to removable storage within Intune’s custom profile, set OMA-URI to ```.\[device|user]\vendor\msft\policy\[config|result]\Storage/RemovableDiskDenyWriteAccess```, Data type to Integer, and Value to 1. +See [Use custom settings for Windows 10 devices in Intune](https://docs.microsoft.com/en-us/intune/custom-settings-windows-10) for information on how to create custom profiles. diff --git a/windows/release-information/resolved-issues-windows-10-1809-and-windows-server-2019.yml b/windows/release-information/resolved-issues-windows-10-1809-and-windows-server-2019.yml index f1ad1fd6a6..29d533154d 100644 --- a/windows/release-information/resolved-issues-windows-10-1809-and-windows-server-2019.yml +++ b/windows/release-information/resolved-issues-windows-10-1809-and-windows-server-2019.yml @@ -32,6 +32,7 @@ sections: - type: markdown text: " + @@ -80,6 +81,7 @@ sections: - type: markdown text: "
    SummaryOriginating updateStatusDate resolved
    Apps and scripts using the NetQueryDisplayInformation API may fail with error
    Applications and scripts that call the NetQueryDisplayInformation API or the WinNT provider equivalent may fail to return results after the first page of data.

    See details >    		OS Build 17763.55

    October 09, 2018
    KB4464330    		Resolved
    KB4516077    		September 24, 2019
    10:00 AM PT
    IME may become unresponsive or have High CPU usage
    Some Input Method Editor (IME) including ChsIME.EXE and ChtIME.EXE, may become unresponsive or may have high CPU usage.

    See details >    		OS Build 17763.737

    September 10, 2019
    KB4512578    		Resolved
    		September 19, 2019
    04:08 PM PT
    Domain connected devices that use MIT Kerberos realms will not start up
    Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

    See details >    		OS Build 17763.652

    July 22, 2019
    KB4505658    		Resolved
    KB4511553    		August 13, 2019
    10:00 AM PT
    Devices starting using PXE from a WDS or SCCM servers may fail to start
    Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

    See details >    		OS Build 17763.557

    June 11, 2019
    KB4503327    		Resolved
    KB4512534    		August 17, 2019
    02:00 PM PT
    +
    DetailsOriginating updateStatusHistory
    Apps and scripts using the NetQueryDisplayInformation API may fail with error
     Applications and scripts that call the NetQueryDisplayInformation API or the WinNT provider equivalent may fail to return results after the first page of data, often 50 or 100 entries. When requesting additional pages you may receive the error, “1359: an internal error occurred.”

    Affected platforms:
    • Server: Windows Server 2019; Windows Server 2016
    Resolution: This issue was resolved in KB4516077.

    Back to top    		OS Build 17763.55

    October 09, 2018
    KB4464330    		Resolved
    KB4516077    		Resolved:
    September 24, 2019
    10:00 AM PT

    Opened:
    August 01, 2019
    05:00 PM PT
    Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
    After installing KB4511553, applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and scripts or apps using Visual Basic Scripting Edition (VBScript) may stop responding and you may receive an \"invalid procedure call error.\"

    Affected platforms:
    • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
    • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
    Resolution: This issue was resolved in KB4512534. This ‘optional’ update is available on Microsoft Update Catalog, Windows Update, Microsoft Update and Windows Server Update Services (WSUS). As with any 'optional' update, you will need to Check for updates to receive KB4512534 and install. For instructions, see Update Windows 10.

    Note Windows Update for Business customers should apply the update via Microsoft Update Catalog or Windows Server Update Services (WSUS).

    Back to top    		OS Build 17763.678

    August 13, 2019
    KB4511553    		Resolved
    KB4512534    		Resolved:
    August 17, 2019
    02:00 PM PT

    Opened:
    August 14, 2019
    03:34 PM PT
    MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
    You may receive an error on your Apple MacOS device when trying to access network shares via CIFS or SMBv1 on a Windows devices that has installed updates on June 11, 2019 (KB4503327) or later. When you encounter this issue, in MacOS you may receive the error, “There was a problem connecting to the server “{Server Host Name}”. Check the server name or IP address, and then try again. If you continue to have problems, contact your system administrator.”

    Affected platforms:
    • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
    • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
    Resolution: For guidance on this issue, see the Apple support article If your Mac can't use NTLM to connect to a Windows server. There is no update for Windows needed for this issue.

    Back to top    		OS Build 17763.557

    June 11, 2019
    KB4503327    		Resolved External
    		Last updated:
    August 09, 2019
    07:03 PM PT

    Opened:
    August 09, 2019
    04:25 PM PT
    diff --git a/windows/release-information/resolved-issues-windows-7-and-windows-server-2008-r2-sp1.yml b/windows/release-information/resolved-issues-windows-7-and-windows-server-2008-r2-sp1.yml index aa64a5bbb2..5ac6ed8257 100644 --- a/windows/release-information/resolved-issues-windows-7-and-windows-server-2008-r2-sp1.yml +++ b/windows/release-information/resolved-issues-windows-7-and-windows-server-2008-r2-sp1.yml @@ -32,6 +32,7 @@ sections: - type: markdown text: " + @@ -59,6 +60,15 @@ sections:
    " +- title: September 2019 +- items: + - type: markdown + text: " +
    SummaryOriginating updateStatusDate resolved
    You may receive an error when opening or using the Toshiba Qosmio AV Center
    Toshiba Qosmio AV Center may error when opening and you may also receive an error in Event Log related to cryptnet.dll.

    See details >    		August 13, 2019
    KB4512506    		Resolved
    KB4516048    		September 24, 2019
    10:00 AM PT
    Windows updates that are SHA-2 signed may not be offered for Symantec and Norton AV
    Windows updates that are SHA-2 signed are not available with Symantec or Norton antivirus program installed

    See details >    		August 13, 2019
    KB4512506    		Resolved External
    		August 27, 2019
    02:29 PM PT
    Devices starting using PXE from a WDS or SCCM servers may fail to start
    Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

    See details >    		June 11, 2019
    KB4503292    		Resolved
    KB4512514    		August 17, 2019
    02:00 PM PT
    Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
    Applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and VBScript may stop responding and you may receive an error.

    See details >    		August 13, 2019
    KB4512506    		Resolved
    KB4517297    		August 16, 2019
    02:00 PM PT
    + +
    DetailsOriginating updateStatusHistory
    You may receive an error when opening or using the Toshiba Qosmio AV Center
    After installing KB4512506, you may receive an error when opening or using the Toshiba Qosmio AV Center. You may also receive an error in Event Log related to cryptnet.dll.

    Affected platforms:
    • Client: Windows 7 SP1
    Resolution: This issue was resolved in KB4516048.

    Back to top    		August 13, 2019
    KB4512506    		Resolved
    KB4516048    		Resolved:
    September 24, 2019
    10:00 AM PT

    Opened:
    September 10, 2019
    09:48 AM PT
    + " + - title: August 2019 - items: - type: markdown diff --git a/windows/release-information/resolved-issues-windows-8.1-and-windows-server-2012-r2.yml b/windows/release-information/resolved-issues-windows-8.1-and-windows-server-2012-r2.yml index 685a74bd98..16abec6cc8 100644 --- a/windows/release-information/resolved-issues-windows-8.1-and-windows-server-2012-r2.yml +++ b/windows/release-information/resolved-issues-windows-8.1-and-windows-server-2012-r2.yml @@ -32,6 +32,7 @@ sections: - type: markdown text: " + @@ -59,6 +60,15 @@ sections:
    " +- title: September 2019 +- items: + - type: markdown + text: " +
    SummaryOriginating updateStatusDate resolved
    Windows RT 8.1 devices may have issues opening Internet Explorer 11
    On Windows RT 8.1 devices, Internet Explorer 11 may not open and you may receive an error.

    See details >    		September 10, 2019
    KB4516067    		Resolved
    KB4516041    		September 24, 2019
    10:00 AM PT
    Devices starting using PXE from a WDS or SCCM servers may fail to start
    Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

    See details >    		June 11, 2019
    KB4503276    		Resolved
    KB4512478    		August 17, 2019
    02:00 PM PT
    Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
    Applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and VBScript may stop responding and you may receive an error.

    See details >    		August 13, 2019
    KB4512488    		Resolved
    KB4517298    		August 16, 2019
    02:00 PM PT
    System may be unresponsive after restart with certain McAfee antivirus products
    Devices with McAfee Endpoint Security Threat Prevention 10.x, Host Intrusion Prevention 8.0, or VirusScan Enterprise 8.8 may be slow or unresponsive at startup.

    See details >    		April 09, 2019
    KB4493446    		Resolved External
    		August 13, 2019
    06:59 PM PT
    + +
    DetailsOriginating updateStatusHistory
    Windows RT 8.1 devices may have issues opening Internet Explorer 11
    On Windows 8.1 RT devices, Internet Explorer 11 may not open and you may receive the error, \"C:\\Program Files\\Internet Explorer\\iexplore.exe: A certificate was explicitly revoked by its issuer.\"


    Affected platforms:
    • Client: Windows RT 8.1
    Resolution: This issue was resolved in KB4516041.

    Back to top    		September 10, 2019
    KB4516067    		Resolved
    KB4516041    		Resolved:
    September 24, 2019
    10:00 AM PT

    Opened:
    September 13, 2019
    05:25 PM PT
    + " + - title: August 2019 - items: - type: markdown diff --git a/windows/release-information/status-windows-10-1809-and-windows-server-2019.yml b/windows/release-information/status-windows-10-1809-and-windows-server-2019.yml index 08a23449bc..157e975b35 100644 --- a/windows/release-information/status-windows-10-1809-and-windows-server-2019.yml +++ b/windows/release-information/status-windows-10-1809-and-windows-server-2019.yml @@ -64,10 +64,10 @@ sections: - type: markdown text: "
    This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

    + - @@ -96,7 +96,7 @@ sections: - type: markdown text: "
    SummaryOriginating updateStatusLast updated
    Apps and scripts using the NetQueryDisplayInformation API may fail with error
    Applications and scripts that call the NetQueryDisplayInformation API or the WinNT provider equivalent may fail to return results after the first page of data.

    See details >    		OS Build 17763.55

    October 09, 2018
    KB4464330    		Resolved
    KB4516077    		September 24, 2019
    10:00 AM PT
    IME may become unresponsive or have High CPU usage
    Some Input Method Editor (IME) including ChsIME.EXE and ChtIME.EXE, may become unresponsive or may have high CPU usage.

    See details >    		OS Build 17763.737

    September 10, 2019
    KB4512578    		Resolved
    		September 19, 2019
    04:08 PM PT
    Windows Mixed Reality Portal users may intermittently receive a 15-5 error code
    You may receive a 15-5 error code in Windows Mixed Reality Portal and your headset may not respond to \"wake up\" from sleep.

    See details >    		OS Build 17763.678

    August 13, 2019
    KB4511553    		Mitigated
    		September 11, 2019
    05:32 PM PT
    Domain connected devices that use MIT Kerberos realms will not start up
    Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

    See details >    		OS Build 17763.652

    July 22, 2019
    KB4505658    		Resolved
    KB4511553    		August 13, 2019
    10:00 AM PT
    Apps and scripts using the NetQueryDisplayInformation API may fail with error
    Applications and scripts that call the NetQueryDisplayInformation API or the WinNT provider equivalent may fail to return results after the first page of data.

    See details >    		OS Build 17763.55

    October 09, 2018
    KB4464330    		Investigating
    		August 01, 2019
    05:00 PM PT
    Startup to a black screen after installing updates
    Your device may startup to a black screen during the first logon after installing updates.

    See details >    		OS Build 17763.557

    June 11, 2019
    KB4503327    		Mitigated
    		June 14, 2019
    04:41 PM PT
    Devices with some Asian language packs installed may receive an error
    After installing the KB4493509 devices with some Asian language packs installed may receive the error, \"0x800f0982 - PSFX_E_MATCHING_COMPONENT_NOT_F

    See details >    		OS Build 17763.437

    April 09, 2019
    KB4493509    		Mitigated
    		May 03, 2019
    10:59 AM PT
    Certain operations performed on a Cluster Shared Volume may fail
    Certain operations, such as rename, performed on files or folders on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\".

    See details >    		OS Build 17763.253

    January 08, 2019
    KB4480116    		Mitigated
    		April 09, 2019
    10:00 AM PT
    - +
    DetailsOriginating updateStatusHistory
    Apps and scripts using the NetQueryDisplayInformation API may fail with error
     Applications and scripts that call the NetQueryDisplayInformation API or the WinNT provider equivalent may fail to return results after the first page of data, often 50 or 100 entries. When requesting additional pages you may receive the error, “1359: an internal error occurred.”

    Affected platforms:
    • Server: Windows Server 2019; Windows Server 2016
    Next steps: We are working on a resolution and will provide an update in an upcoming release.

    Back to top    		OS Build 17763.55

    October 09, 2018
    KB4464330    		Investigating
    		Last updated:
    August 01, 2019
    05:00 PM PT

    Opened:
    August 01, 2019
    05:00 PM PT
    Apps and scripts using the NetQueryDisplayInformation API may fail with error
     Applications and scripts that call the NetQueryDisplayInformation API or the WinNT provider equivalent may fail to return results after the first page of data, often 50 or 100 entries. When requesting additional pages you may receive the error, “1359: an internal error occurred.”

    Affected platforms:
    • Server: Windows Server 2019; Windows Server 2016
    Resolution: This issue was resolved in KB4516077.

    Back to top    		OS Build 17763.55

    October 09, 2018
    KB4464330    		Resolved
    KB4516077    		Resolved:
    September 24, 2019
    10:00 AM PT

    Opened:
    August 01, 2019
    05:00 PM PT
    " diff --git a/windows/release-information/status-windows-7-and-windows-server-2008-r2-sp1.yml b/windows/release-information/status-windows-7-and-windows-server-2008-r2-sp1.yml index 912ec5bd55..a3fe4bad82 100644 --- a/windows/release-information/status-windows-7-and-windows-server-2008-r2-sp1.yml +++ b/windows/release-information/status-windows-7-and-windows-server-2008-r2-sp1.yml @@ -60,7 +60,7 @@ sections: - type: markdown text: "
    This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

    - +
    SummaryOriginating updateStatusLast updated
    You may receive an error when opening or using the Toshiba Qosmio AV Center
    Toshiba Qosmio AV Center may error when opening and you may also receive an error in Event Log related to cryptnet.dll.

    See details >    		August 13, 2019
    KB4512506    		Investigating
    		September 13, 2019
    04:25 PM PT
    You may receive an error when opening or using the Toshiba Qosmio AV Center
    Toshiba Qosmio AV Center may error when opening and you may also receive an error in Event Log related to cryptnet.dll.

    See details >    		August 13, 2019
    KB4512506    		Resolved
    KB4516048    		September 24, 2019
    10:00 AM PT
    Windows updates that are SHA-2 signed may not be offered for Symantec and Norton AV
    Windows updates that are SHA-2 signed are not available with Symantec or Norton antivirus program installed

    See details >    		August 13, 2019
    KB4512506    		Resolved External
    		August 27, 2019
    02:29 PM PT
    IA64 and x64 devices may fail to start after installing updates
    After installing updates released on or after August 13, 2019, IA64 and x64 devices using EFI Boot may fail to start.

    See details >    		August 13, 2019
    KB4512506    		Mitigated
    		August 17, 2019
    12:59 PM PT
    @@ -78,7 +78,7 @@ sections: - type: markdown text: " - +
    DetailsOriginating updateStatusHistory
    You may receive an error when opening or using the Toshiba Qosmio AV Center
    After installing KB4512506, you may receive an error when opening or using the Toshiba Qosmio AV Center. You may also receive an error in Event Log related to cryptnet.dll.

    Affected platforms:
    • Client: Windows 7 SP1
    Next steps: Microsoft is working with Dynabook to resolve this issue and estimate a solution will be available late September.

    Back to top    		August 13, 2019
    KB4512506    		Investigating
    		Last updated:
    September 13, 2019
    04:25 PM PT

    Opened:
    September 10, 2019
    09:48 AM PT
    You may receive an error when opening or using the Toshiba Qosmio AV Center
    After installing KB4512506, you may receive an error when opening or using the Toshiba Qosmio AV Center. You may also receive an error in Event Log related to cryptnet.dll.

    Affected platforms:
    • Client: Windows 7 SP1
    Resolution: This issue was resolved in KB4516048.

    Back to top    		August 13, 2019
    KB4512506    		Resolved
    KB4516048    		Resolved:
    September 24, 2019
    10:00 AM PT

    Opened:
    September 10, 2019
    09:48 AM PT
    " diff --git a/windows/release-information/status-windows-8.1-and-windows-server-2012-r2.yml b/windows/release-information/status-windows-8.1-and-windows-server-2012-r2.yml index f30185ca5a..10f5e9dea3 100644 --- a/windows/release-information/status-windows-8.1-and-windows-server-2012-r2.yml +++ b/windows/release-information/status-windows-8.1-and-windows-server-2012-r2.yml @@ -60,7 +60,7 @@ sections: - type: markdown text: "
    This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

    - +
    SummaryOriginating updateStatusLast updated
    Windows RT 8.1 devices may have issues opening Internet Explorer 11
    On Windows RT 8.1 devices, Internet Explorer 11 may not open and you may receive an error.

    See details >    		September 10, 2019
    KB4516067    		Investigating
    		September 13, 2019
    05:25 PM PT
    Windows RT 8.1 devices may have issues opening Internet Explorer 11
    On Windows RT 8.1 devices, Internet Explorer 11 may not open and you may receive an error.

    See details >    		September 10, 2019
    KB4516067    		Resolved
    KB4516041    		September 24, 2019
    10:00 AM PT
    Japanese IME doesn't show the new Japanese Era name as a text input option
    If previous dictionary updates are installed, the Japanese input method editor (IME) doesn't show the new Japanese Era name as a text input option.

    See details >    		April 25, 2019
    KB4493443    		Mitigated
    		May 15, 2019
    05:53 PM PT
    Certain operations performed on a Cluster Shared Volume may fail
    Certain operations, such as rename, performed on files or folders on a Cluster Shared Volume (CSV) may fail with the error, “STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)”.

    See details >    		January 08, 2019
    KB4480963    		Mitigated
    		April 25, 2019
    02:00 PM PT
    @@ -78,7 +78,7 @@ sections: - type: markdown text: " - +
    DetailsOriginating updateStatusHistory
    Windows RT 8.1 devices may have issues opening Internet Explorer 11
    On Windows 8.1 RT devices, Internet Explorer 11 may not open and you may receive the error, \"C:\\Program Files\\Internet Explorer\\iexplore.exe: A certificate was explicitly revoked by its issuer.\"


    Affected platforms:
    • Client: Windows RT 8.1
    Next steps: We are working on a resolution and will provide an update in an upcoming release.

    Back to top    		September 10, 2019
    KB4516067    		Investigating
    		Last updated:
    September 13, 2019
    05:25 PM PT

    Opened:
    September 13, 2019
    05:25 PM PT
    Windows RT 8.1 devices may have issues opening Internet Explorer 11
    On Windows 8.1 RT devices, Internet Explorer 11 may not open and you may receive the error, \"C:\\Program Files\\Internet Explorer\\iexplore.exe: A certificate was explicitly revoked by its issuer.\"


    Affected platforms:
    • Client: Windows RT 8.1
    Resolution: This issue was resolved in KB4516041.

    Back to top    		September 10, 2019
    KB4516067    		Resolved
    KB4516041    		Resolved:
    September 24, 2019
    10:00 AM PT

    Opened:
    September 13, 2019
    05:25 PM PT
    " diff --git a/windows/release-information/status-windows-server-2008-sp2.yml b/windows/release-information/status-windows-server-2008-sp2.yml index 51fe163fe9..344715f1b3 100644 --- a/windows/release-information/status-windows-server-2008-sp2.yml +++ b/windows/release-information/status-windows-server-2008-sp2.yml @@ -60,7 +60,7 @@ sections: - type: markdown text: "
    This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

    - +
    SummaryOriginating updateStatusLast updated
    Issues manually installing updates by double-clicking the .msu file
    You may encounter issues manually installing updates by double-clicking the .msu file and may receive an error.

    See details >    		September 10, 2019
    KB4474419    		Mitigated
    		September 20, 2019
    04:57 PM PT
    Issues manually installing updates by double-clicking the .msu file
    You may encounter issues manually installing updates by double-clicking the .msu file and may receive an error.

    See details >    		September 10, 2019
    KB4474419    		Mitigated
    KB4474419    		September 24, 2019
    08:17 AM PT
    " @@ -76,6 +76,6 @@ sections: - type: markdown text: " - +
    DetailsOriginating updateStatusHistory
    Issues manually installing updates by double-clicking the .msu file
    After installing the SHA-2 update (KB4474419) released on September 10, 2019, you may encounter issues manually installing updates by double-clicking on the .msu file and may receive the error, \"Installer encountered an error: 0x80073afc. The resource loader failed to find MUI file.\"

    Affected platforms:
    • Server: Windows Server 2008 SP2
    Workaround: Open a command prompt and use the following command (replacing <msu location> with the actual location and filename of the update): wusa.exe <msu location> /quiet

    Next steps: We are working on a resolution and estimates a solution will be available in late September.

    Back to top    		September 10, 2019
    KB4474419    		Mitigated
    		Last updated:
    September 20, 2019
    04:57 PM PT

    Opened:
    September 20, 2019
    04:57 PM PT
    Issues manually installing updates by double-clicking the .msu file
    After installing the SHA-2 update (KB4474419) released on September 10, 2019, you may encounter issues manually installing updates by double-clicking on the .msu file and may receive the error, \"Installer encountered an error: 0x80073afc. The resource loader failed to find MUI file.\"

    Affected platforms:
    • Server: Windows Server 2008 SP2
    Workaround: Open a command prompt and use the following command (replacing <msu location> with the actual location and filename of the update): wusa.exe <msu location> /quiet

    Resolution: This issue is resolved in KB4474419 released September 23, 2019. Currently, this version is only available from the Microsoft Update Catalog. To resolve this issue, you will need to manually download the package and use the workaround above to install it.

    Next steps: We estimate a solution will be available in mid-October on Windows Update and Windows Server Update Services (WSUS).

    Back to top    		September 10, 2019
    KB4474419    		Mitigated
    KB4474419    		Last updated:
    September 24, 2019
    08:17 AM PT

    Opened:
    September 20, 2019
    04:57 PM PT
    " diff --git a/windows/release-information/windows-message-center.yml b/windows/release-information/windows-message-center.yml index 7b62868ba2..e9cda8004c 100644 --- a/windows/release-information/windows-message-center.yml +++ b/windows/release-information/windows-message-center.yml @@ -50,6 +50,8 @@ sections: text: " + + diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index 70736626cc..eaedfb4d15 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -121,7 +121,7 @@ #### [Custom detections]() ##### [Understand custom detection rules](microsoft-defender-atp/overview-custom-detections.md) -##### [Create custom detections rules](microsoft-defender-atp/custom-detection-rules.md) +##### [Create and manage custom detections rules](microsoft-defender-atp/custom-detection-rules.md) ### [Management and APIs]() #### [Overview of management and APIs](microsoft-defender-atp/management-apis.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules.md b/windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules.md index 9561fe831c..0af9f2e7a8 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules.md +++ b/windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules.md @@ -1,16 +1,16 @@ --- -title: Create custom detection rules in Microsoft Defender ATP +title: Create and manage custom detection rules in Microsoft Defender ATP ms.reviewer: -description: Learn how to create custom detections rules based on advanced hunting queries -keywords: create custom detections, detections, advanced hunting, hunt, detect, query +description: Learn how to create and manage custom detections rules based on advanced hunting queries +keywords: custom detections, create, manage, alerts, edit, run on demand, frequency, interval, detection rules, advanced hunting, hunt, query, response actions, mdatp, microsoft defender atp search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -ms.author: macapara -author: mjcaparas +ms.author: lomayor +author: lomayor ms.localizationpriority: medium manager: dansimp audience: ITPro @@ -19,53 +19,86 @@ ms.topic: article --- -# Create custom detections rules +# Create and manage custom detections rules **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -Create custom detection rules from [Advanced hunting](overview-hunting.md) queries to automatically check for threat indicators and generate alerts whenever these indicators are found. +Custom detection rules built from [Advanced hunting](overview-hunting.md) queries let you proactively monitor various events and system states, including suspected breach activity and misconfigured machines. The queries run every 24 hours, generating alerts and taking response actions whenever there are matches. >[!NOTE] ->To create and manage custom detections, [your role](user-roles.md#create-roles-and-assign-the-role-to-an-azure-active-directory-group) needs to have the **manage security settings** permission. For the detection rule to work properly and create alerts, the query must return in each row a set of MachineId, ReportId, EventTime which match to an actual event in advanced hunting. +>To create and manage custom detections, [your role](user-roles.md#create-roles-and-assign-the-role-to-an-azure-active-directory-group) needs to have the **manage security settings** permission. -1. In the navigation pane, select **Advanced hunting**. +## Create a custom detection rule +### 1. Prepare the query. -2. Select an existing query that you'd like to base the monitor on or create a new query. +In Microsoft Defender Security Center, go to **Advanced hunting** and select an existing query or create a new query. When using an new query, run the query to identify errors and understand possible results. -3. Select **Create detection rule**. +>[!NOTE] +>To use a query for a custom detection rule, the query must return the `EventTime`, `MachineId`, and `ReportId` columns in the results. Queries that don’t use the `project` operator to customize results usually return these common columns. -4. Specify the alert details: +### 2. Create new rule and provide alert details. - - Alert title - - Severity - - Category - - Description - - Recommended actions +With the query in the query editor, select **Create detection rule** and specify the following alert details: -5. Click **Create**. +- **Alert title** +- **Severity** +- **Category** +- **Description** +- **Recommended actions** -> [!TIP] -> TIP #1: Running the query for the first time before saving it can help you find any mistakes or errors and give you a preview of the data you can expect to be returned.
    -> When a new detection rule is created, it will run for the first time (it might take a few minutes) and raise any alerts created by this rule. After that, the rule will automatically run every 24 hours.
    -> TIP #2: Since the detection automatically runs every 24 hours, it's best to query data in the last 24 hours. +For more information about these alert details, [read about managing alerts](manage-alerts.md). + +### 3. Specify actions on files or machines. +Your custom detection rule can automatically take actions on files or machines that are returned by the query. + +#### Actions on machines +These actions are applied to machines in the `MachineId` column of the query results: +- **Isolate machine** — applies full network isolation, preventing the machine from connecting to any application or service, except for the Microsoft Defender ATP service. [Learn more about machine isolation](respond-machine-alerts.md#isolate-machines-from-the-network) +- **Collect investigation package** — collects machine information in a ZIP file. [Learn more about the investigation package](respond-machine-alerts.md#collect-investigation-package-from-machines) +- **Run antivirus scan** — performs a full Windows Defender Antivirus scan on the machine +- **Initiate investigation** — initiates an [automated investigation](automated-investigations.md) on the machine + +#### Actions on files +These actions are applied to files in the `SHA1` or the `InitiatingProcessSHA1` column of the query results: +- **Allow/Block** — automatically adds the file to your [custom indicator list](manage-indicators.md) so that it is always allowed to run or blocked from running. You can set the scope of this action so that it is taken only on selected machine groups. This scope is independent of the scope of the rule. +- **Quarantine file** — deletes the file from its current location and places a copy in quarantine + +### 4. Click **Create** to save and turn on the rule. +When saved, the custom detection rule immediately runs. It runs again every 24 hours to check for matches, generate alerts, and take response actions. ## Manage existing custom detection rules -View existing rules in your network, see the last results of each rule, navigate to view all alerts that were created by each rule. You can also modify existing rules. +In **Settings** > **Custom detections**, you can view the list of existing custom detection rules, check their previous runs, and review the alerts they have triggered. You can also run a rule on demand and modify it. -1. In the navigation pane, select **Settings** > **Custom detections**. You'll see all the detections created in the system. +### View existing rules -2. Select one of the rules to take any of the following actions: - - Open related alerts - See all the alerts that were raised based to this rule - - Run - Run the selected detection immediately. +To view all existing custom detection rules, navigate to **Settings** > **Custom detections**. The page lists all the rules with the following run information: - > [!NOTE] - > The next run for the query will be in 24 hours after the last run. - - - Edit - Modify the settings of the rule. - - Modify query - View and edit the query itself. - - Turn off - Stop the query from running. - - Delete +- **Last run** — when a rule was last run to check for query matches and generate alerts +- **Last run status** — whether a rule ran successfully +- **Next run** — the next scheduled run +- **Status** — whether a rule has been turned on or off +### View rule details, modify rule, and run rule + +To view comprehensive information about a custom detection rule, select the name of rule from the list of rules in **Settings** > **Custom detections**. This opens a page about the custom detection rule with the following information: + +- General information about the rule, including the details of the alert, run status, and scope +- List of triggered alerts +- List of triggered actions + +![Custom detection rule page](images/atp-custom-detection-rule-details.png)
    +*Custom detection rule page* + +You can also take the following actions on the rule from this page: + +- **Run** — run the rule immediately. This also resets the interval for the next run. +- **Edit** — modify the rule without changing the query +- **Modify query** — edit the query in Advanced hunting +- **Turn on** / **Turn off** — enable the rule or stop it from running +- **Delete** — turn off the rule and remove it + +>[!TIP] +>To quickly view information and take action on an item in a table, use the selection column [✓] at the left of the table. ## Related topic - [Custom detections overview](overview-custom-detections.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/atp-custom-detection-rule-details.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-custom-detection-rule-details.png new file mode 100644 index 0000000000000000000000000000000000000000..65ecd31a2a93e742e56394f25a30be74822e8751 GIT binary patch literal 118743 zcmd3OcTkhf*EWw>LBIkcT?C|qQl$n#O6Wawluqb`fP|_DC`b!Udat2K3BB0p9YSvc zQbUIjTHp(hk3R4Bn|WuxdEbA&one^Wd+#mhoIQK(wdc-zbyay1B5EQ60s<1C!gEam zf~y?_1cZR=SMep$>f*Ebe>a>J^dSTUq~9<8{)*)!rNI|oa|5c#UR$_vmy++UIm6M& z-$k-|ZqJ}@HcqYt1tr}I_@bL`_@d{Q5OY^sXE$3XM}oUI7@6?pL>J{UPR^dLw$?Uo z1Vv=sqWDtMze`;$UtUyw;AZP!Ng#+NyMcdlcoFHZVNHD ze~GW^N>Kf|G6G+G{h}E3($&${(VE~h%~CMF?AovQp|0kZ1eo&x^zUjiP7V&1j&1}8 z-EqzMva1)>v~At&EeY~B2U!US9uNSZKhu7dygu#eHl%ZQzC-yn+koU@fqPK+V2yGp z;mahmvMaG~-W&#ycADguzazhOIi}^WiI>Fz56a)$Yq8a51@ew@#33oNd2VT}cvQ+B z-Fs^r$rv*9;qz8RwnH6nHh2H>0&O^RT9Vh+a>5y0 zSy@@7kMMU9LH@m=T$LdeL5U0L{7UI{x8Z;N$&4^E|EVoiETeFt&%cwuL2%^F-x&fV zDI?XN446)u?@tCL`qtu4CLekoZx;U~b@VN`F~7ZHV!w&QNlE0e#t>wOIq8lZQX8$i zXHmRb@Vg>G4GOW(*~h%nLN!j=?<-xg*TX#<&qVs5X|O21_D; zVVl(tARCTUwW6Au%wq+&Oxnd9cDRi5D1u+;s^`swP@@d*&4z?Ih$W}1oGWN|<^{+4 zw#NPxdd!(_NfStRKf{FkLr%j);ZgBJiY*v<8OJ$nyee#PVSv4*q4j~56!8@#+34qY zJVb28UcYC>k$;CVL1#~txnBM@(bnN|$)~lr;yssh?fOJ=pLtRX5N})?8P<5+GAw{)w2}8-{6f7*!<4G6~ zuIor-^@-YQ1lOQ-7I!Sox@H{QDgxA9-=<@cF(;ceNcM=M(UAtTY0*o(KpVWgTKmi{ zc6H{!J9n_EdjKM)DPXxL9T>k%Jysl&_E>X|Y$B9iEUjRFIw7QS8HfREbU-+xWUBUM z6cqv4+0d=;;g(GPT0te){^*Lm5EJcU07A`)P4oHRSMmiszy8<5f3-cYX z$iD)@H-4CfF*Hk;^@T^zfqlgRJ_?*3dK7oubcVQuy^c>N8pO126Bb&FlMm*Ho>eK( z6L;3BO{afix@hg$?Vb?Z7fK`hIhrUf`TfHgMN(IGr5g({o8zVs)Lggr*QqK0?xJ^= zE-?0XHp4*+2|*E!@KE-UX|T@WHs71#P~D!0589{i6?><(cyeuyvsH*f(A>?`sTa=g zBK>GpuZ`@E%37~`NzJc0=vg14Z~72|t+v#SyF)jqQ?$ns#s2E8ZrjO9Ej@(1o=yK{ z#n-n3l~aBS>2@1pejApci0r_PzS-k zl@ygmBRxywClTwN$D-J+3?gDzUr}Z5Nj8P|im^Z2(Sx~fHRuE-bl})q#i~?{p@;}$ z{-C-m7FVzA-$%TUQsej(H6U^zo5Tn3G38X%J>DlGO2{QM&S9skT2TB*UobWWId_d8 zRK>(GApR^`di>P5IAw3ply}`$9EXZ4t*IA0>-=)w7qZ5$#%r&vzPs}24GY~yTWlpb zP}g2XcgeHkhn>dZHZWw3dS#-m=m$NpV1RB|)Br9m$TCnYZjpeiskHzd_bwXT#x`jV zI=Hsu*Nd2JqY!8==#5uV3mJHo+RI&2Kp9_aT? z9BHKI0bsHHFJeqXx23%@6NVd-p6yK1!rj?L9J0Bd!J!M(qY^gi%h!5j+v-0?pJPjf zZGAO;pIV0-l{80Gk>6}=RN<>;NKc>uRPa$Lzg`oxD!Oyfqfy7a8p+qE2+lT>w5vU# z2(mTXzooCx{o8X}<{K$kkq$-9^$ydErWI7$GYDdPQ7%_F)Z1bg9ir3@7%fkx^5jhA zy~K+BE$Apui6_66 z&8QT&+JQQPL8o1y_p6l~H>0z~bdbL^Az4s*W6=z9drP?76xa(df$>4lkqp_2Iu z$Ywqf3uE$v;bH_ z7G?N4n4TppuHFs-&m~)r#JA-TRM4hbcd?GikDHoAn)RF<3S{{Ig$5C2&x}Yb&hTHnN|+_MjbdNw6Gwl5=ja zzE<^8bT=;$ycy}Z_xZV!TVEqlRE+1uqmJx`J1)L=ksDz%p0B0Vohbt^f6%O^ibhuL zxs#AS?xdZPTT0Sm21=4uYN&rYDJinaJ@spzxjsfAvJiB?Gbn0Oa#}TEwL(n zN;~a6R)ACE%EI0d6`it&8`qoAuu`bXL-X+z)Q|n6k@aijBU0#Hc8q1*EGB+Nr;$JgL$sO?9ZWJ7NU7 zkM}-JtNIW=RQ~Ss>E|vN<<(jx+DT!TjU!8~)=@`@Z+E7@Yak?b;S(L`E6tt}qMeyt z`Slr`$-%+*MyniQ7MG65!?oZXXhtM>u&aD-3<@o4?A8BW& z@o(Af-3z8BNz-}opdQRRJ37G}%$3E8chWpim9^7TJ$(xuX|PpP`~kHvAMXQ5l`v<% zQo7p{E&cIDS^&3JPoDDrE2&48>`x>$LTC-xrlL`7%5y0>T4}VP*B%|4Y&DU^B^q*0 zo+v*aolU5IJ*6EeL!wqS$8j*^P*Cx3N-2ZUL{UlN;kV`B7~dU^M>dg;Jl0xmqjnhS zyl~h{yacZ%T)JfGe#L&|iVsHN`3JZW#63HQ?F&X!>78uuyl4?^YHQXJYj>3m_lEwCrhrc=M_zd#`>N=mz7A%dF!%({LZVY(NmbNH_0o~8TWI6 zsC>OGqMakS$kWT0Vj){abKp+kCdXjJLehd_?6ZJ?F4NXe;>nP0t(cs*wKLPtpUn&^ z+6ArqbUS)|M{4-jt{_XcHkjC1{7m!spz8eru?e13>uu1VN*z0v*#>Q~C^i`(pl^`S z+8x`Gr5YF5$P-PCzFQ}Y;wRTQ*p>S!C$Ba> z=7F;A#w4VsgHEj2>^9YnU-?9Hx)Et@spk0cfJ160jkw>r`8Fy4)ibQX-m4jDTG|hZ zXlCs)kD?YI`-c4u%YOvv9z}AsO@m}QFl0Ds%i2m~45;KPp3Q^a#>(H7> zwYi0_n5jWrxiE2bp5NE1^SyV2i+P_;Qpy4rDC@JOWV>O&43^m3J$5MNCnBtQwIvXo zCFh~zcCeTbpr3n3Y5k}`LkZ~am9g>lCY)7qA#lo2E=CVXxlyjfQxCN za;8BKGV?KS0JvvyeI@g@c^mt~6^^V&WS1@AZgUoie2t0i%ZE=o0P2*gbRg8*TB7YZ zw?{JUC)uA;?X+~Ia$snk3 z)L$X6+S#j=@G5w7MS#T6xxE&S$y6Dk+Y^AbiBpO74A$uzch)*xoKi1Ry3pR3BHsxh zqMg;k==H7cn$O|fTAJ@7+P<}M==3SUV^%lv(to&4-G+t{tq5r#>ciEo zz;AT9jI)ov!J%9SOg-z`9sF2zsYethz_^S`6e&^S&yffG`kZk~`AW~7rfF94kgG!M z>E3^tN+C%3Y>GKAtBiy^MTmZ=%C8hm5OJ@Tj%|4>8+77jw^YdlbCWhZgKXq27NcDG z3O$|kV}4HD-9Wi=&kV>qxg+Ldtr&;)=e}<9=}u6Q->OyisM7tJGedIz@EmM?l zB^NcHc4Q7ql=e`#{E`oWzn%P|bUE)mTU5Fjv7~iZsqkuVa$;>77)qEZHfe#hyHjt}~mY-;-ZwgXg zdq{N?&Z(~_elRHou4v_u$oZzXePgXlrdvsbAY zlLb<;bY!4b=wUo)sLIBGoR#Ua$kTQGPGuF;yq3fM(t|#^AC~x|r_E2UK)JEl13A;i zPrX#625Pa!suaJat@zgBUf9@Ksw)v71)`u7)SOr8Xio8yyJM0qi&Om5ma;k+`x>^& z!J4!TSF!ztcYlsLl;lF8p}t5CT zF>~x)cnCN2R??l^ef6&~Q*DHm$9rYv0@sJefEg2lEG-nZc-$zd*vG}28`>_k2*^WN zC?)0zhKH{W4?F}o0prVKp}VG@ZG_&X2x#nYHBf67#99PhZ8iJ){xONCq=t_?&qz0w z3BL2zV!0k%G0HSv01l zNIr@_?_dJiz)G7G(X)oe210{stRAa4oh^3E8SwZM!q6*CO3;a!Tc5m`g+#91Of5bO zM*!U}Rsi^}33|m1K73>cn+=~BhUTYwcXLHA#0+Xh$L^t|NqV`*S7x8nF+2GBRCUMK z<)48Pzyb{(H!Rsyh|&a<3T{UWHiG0g)A`;kaDWi|suDo9C`31y?;w9yK&C&M zdc7IQX}v#8%-Y5=&&XiuSFY={PNI%=)I6;!Ke@hgxA==#Fxb+K3?ueby;1a9$Cg>H zI}11HYty5|$g!63?KX?XgMkGOQ)T=L#edBl{J_2(7mz=S#;lvvRHM%w7~{ZNV|k60HA4oOkXoq-nG zJ%;r6)18e%xBt=CTDjRr(Y|3o_YH&Hcvj5(%OqNo?zMiOe5;c6hZP>bnzb>vkJ)GHlJPEHs=?GhvaOP96Jd6W=87O0HY_Dkk7UJ4aqkwt+{4O-&!$ecnm=Vw9vh2x3mo75_522mc3xeoUWdux}W@{mBR zeFg<^Z-4Ecyh&05O;903N_I3V0X4^4!Eu};^FS-~F$rxG z(CMm9&C~3Pu4~s;ic{1&>&&x+SXekQFLKv=nfR_uA(rBtp<6Udb*v;r_sR3f#IkMB zok-aE&^JZEg8IyIo)2YppIW|d(xgqx;3(2FO@;JgQiANxPAAaBT+A23Sa>DSa2BV) zzA6Mdw2C?U@`&jAYUYeYVJRweE>&oaHo16zp)J-^5=&jFr59mBJ(v}yOu=URn~2G8 zTvJXF#VG!N#(Dleq7$V5kI2;&n4rX81o@=P<$Y^bTa#cI^>0^XcbW4KQA2RSuKq83 z`hTZ!|GSQ~N^|k-cfJD;8ufbN*l=Dp$D{;tX1q1LQdK>=pDn(%>*u!Ce#PNPTz7JcSKc>3jrNUeBV&xaJt+d6k4?AuhhM6Pe@y&b|F&0};gg zL?B$%ZusY(D9b+#xxedzwGqMgN6vCTAGzD5I79PeiFDS}Mleiz^kbJO^v7F!?k$~) zCKaTnyx?IMC!B}DfZ?w7mG5E-oi6UNZb#)3z8VczlC_s?>F$eSn3Lx@iWNP?fm7X(Rz19mW_o;#HHH z6>{94q17Q`AkqZ%RX-@MmZoQuryP+5QzA2dKyY!ke%eE3Nesq!G6ln`SCJ);QYN36 zOnU$diy>*6-w=R=-2%U8Rp#WuAEu7*79)^kZJ%jFHfku|vMwiFdk)*5yRlHut{bf= z9uE;~MV#0h4@ce$seZ!#mCg1_j_NAaH~w=jGYPUb9xhfFA_M|k|y|Sv#cSVYy6CcO3B!FA@>bH zZy7uWEjjS$@iXEESd8MrV5D~01L3seew_pFhvH)(T~6fAqfV%yNu?mavvjg>-Q0yL zFk*b-g-_wf$e;N_-I5OqHgwbgea335$e6rc2182QSFOwrDg~{dcML#Vq!Ld~B@43C zyCoi=^|18)l~0yU>>%8RbLv|w@LN!_ zX)TuX$8!@tYJV@$e2Fn~LV`l+#$%%QHYG?pC(YA0Oa_t1S#5QWV;FtRz>Sor=rSHe zzh#Q(HZu3;Rf}4lv!X9b{1(yiA3*h}O#{pVFU$cgVrkL^eDY+-S9_Lv7ptj*sR?r%3m za@@sCU_|T)FZ1*_Yn$fYn{yI;B^#tV#_Q!BlcglR-$|Nu!f!w;YBFieI8jTtFznc& zL5DYA_l#b^l}QiichTSHYa`Y$^-eIsahsX~2BQT=FRu;%@>a>CbY42dEk`t1MTLhblSs zj^f+;82xi>19q$< ztBdU)_auX0EjuS6T$Uw}z-VX`p7n5GrP#={)h?_ODhcAVZZ?XVdtHw@e|=s!*`l;t zcZ9!zJ1;$1v|SDEbf3}oVFgaliWKI#_I;^)RtD2H+=4ej>{h3;x=od|mg+ho^uzQ0 zjt1V|o`)e!;47;FkIFLd%HR!8^{=@p2x``q3)%T&-H{wuGB@s7x?WNfS8>KdC8f zM*Lc>(|W+G1j8GyEud%-kmXa*y>$|m;#W08PWoqLHE~Uex4flhbwtzIyDY~6Vw*?) z%C4KhICvqh1kej9UtO5KhO$ndq}Pv&GMFeW-^0F5B1d6_s5I4VyJ@VE97pnv2TMQ| z1##XJKc1CMju6ZFsP@oY@Un?>dXR<7O5k0?bRoN zK6??fn3zYZ99yYYk0b;?l?s)(lni#!@K%02*<1f>Lu?F0IQ=F%SEGwVow|JGWa<;T zVy$AvAy93b8Ph||!ST47M*p?lyynan;iy*?3U|^v2)g@5*v3hx_;bSuMQwyJR{zPO zTBvswmyh5xuYDIF0$t=)S@!v4@#Z&dPFdpLSI_>1UlsWX^1%o84u%kE!$xXw=TpBU zkQrG?RkRU;uP7A71CF8xx{yhfu=M)dcLR7}k`FisY<)aF6;n6Q&pDQMZtONYE8gv$ z$sBv)(S8(XI#|#Muxa(p%Ej&u-%Sug)+RcHZ^9G_PXcXv!kb{+?U--4sjp!n%|aww z2l4J{{USJ3R=(`k3{cs8+iw0b?P8oeG0wtZom+Oz(0^I8@sO z{Eh|a#}7h%;??8lG{oYwx?z2VhkY`h%S%8XUWS$uOxszb0# zfqR28b54oActZ1aEM{v9nQlPH2Ru%pUM_jtaWXf4M2MsYeQ{pgt&lv^rWSZAd;wv= zs7+n{xYNw;PcTyaKdpB zLvBlnt92N4_3-QIYrDS55_J}O8L>jci{*oWa$Cc>JcPi5Xji`vy}St4U=y=LXq4!}FHk)qNufka7u;Dm%B#OfseFabRu0)Y*(p`&d0in zv__B}XCj1eC3|diYQ|cvr{`|Sjdte64UKz=F499D7F}~+7-?oUc#HdZg+1};pl=52 zfz&zqK|iI0daHqqoo97|(e4?s1fc{_CQCPu(Ojw;F1jCR>q zp$sc&V0P3KWV{SUv?9E06lNfs%SJz6Z8LMHpmeV_AwCPZeyj8CTSMNV5gdLOV`)H} zXzE+C-8k{-gIDd#(OQFJV}&nX>9gg7pqUsuM^HhwKUX{_+umVF`BZF9$)KMDD>r15 zcj!bG-BW@wPyq+1VysCaX9Q`*S{ZTlaAPQZJ{rK@?V(K*l z?E=WSHM9cjpd;RCTb!7j!(BaH^aMxWfA`EpM|=jks69_fH0#H{<)W}KDVRU%19q3^ zHm*D^^|S4)Gab&bCX`sRj>MmATAELy;b(@RZ(b*BPiE@`C1l9(DC5xaxa3mKVsbdx zWo0(yrBiGmL2Qblr?KX-mu?FUE|jc&3U{0(sRxrDH|ARNI}h7G1I1r}vW7QSf*Pw- z5YNfKmyrJimyl3gtOdaj5vYZCKWN8iGp?Y@r`|*oF>M>4owQbH7#Z=9-hugi($4d` z^Kwe!*}A7sq_?Vue*Ex?Dlc?%S|Q-3yMw-$fu9|;-o&?EZ>VDb9YoBEQ#ZO2L(TOC zgn=Ls{(x%K{;oi=M{w%>#o9pxa)@HJT#@&_uYPAi$?7jak2Y{Pp`s)x>~|XG&&*v` z=U-35_P@DYuGCTx7kKQ5Qsp<%o^>XVIh6MXeN$tVMH1tc^3W`^Mkh8TGMMUr*P~PsIbK zU&$Z+%--IX1 z@9YeRowb|$8d$d&XIN;@vq-mfFzEz({`{?D{YDi>67lbL3BbCsK^C*VC&iCcll83X z&D+A+A3e(D$kW{1Nqsec1G7FJ{ckkdkE?REvVUIvj{vknZf39f_pC7~DaD+il9kR_ z&X9-*-W@%iQ+5Y&tofhUYIe%t|6P0=o`MnF_Q6i)i9nVV;Ev5WcTZ2xY4wFadiyb< zW6r4W?EL9XK!DTO&Ywn|H!`Ol{>lAEoZPUk<4ypXWMo8y8kFRZNC{%z;g{F%^dA9q z+J?0)k5m%#L8T^ti_os!RSdSDKfkbG_lFk3^DmEv@4=@beG=4y;27mcT2K;wNAyTB z)4!2@`LcLx{@uraME3OxQo)N2t5uJ#JscA@Tdlk-&dqG4bZV#FKyF z^Zyzpm}jD*mi`nw?UA)bB0#q1&UFz~kjP z)B-l@ba|Km492b<-~W|s*EpX(tr=`{b#<+Dnw6B5m9=dPr^6ed(QEfK@7?!bzkX!~ zl1c1GdV70|d;PwoCm^WFHI8P~w_N=B)8^!0BP1+L$H2g#)?}}PHBEb`=yxXs&c(Ga z517R~ce7Ld&O9ady7?DL+e09yhb}(bU#=ZvMolH2iv6i=qy*+-Hmr6`Swj_M;eB>K zWVyF|+&)(FVB9*b06!^%3M-Y@PZ9;~a>vH>e2y05%O^MLTo*%1jA}E_&#=wMbHNOi zJ}2&&jY*JP){`y4Ss!f5F?Opof!}&9-qg3?nD~z=`GY;COPQ5aREB?i2_TM9xk*Gc zc(5@U8yA-gGVzpENfH`%sGg4VXfSDn?P4%Gqb0^jUmT210;avt7QuTfPF7ytuJr@e z@zHV`0^?0!RR1f&vgO>CYn8yIg2mZK}H-YdgkF|oNF6UpSfXF$PSBjM97*xX) z_Q)tDt%gr^xrbq|k)2knB31C&(fN`u36~qkz%h4vQQwU?zZD)WCYGW_jTXJ|F@=S+ zSkhmza(1XG!7`s5E<|8jC{0(^$16PhE>w5CzX~4v^s@G(b~)8+f5NVmor_D^y!C?y z3|7Z%J5r=yXxiM=8b*@`!<3+vu6!nZlWLk9MV&nYC6>j9$)2Nws zD>!pP9XHB)y3jH4*Yx~ZhxK+Lc-`6dCX2wcC!Ly&O-xKEL=T440JiwJ+T&%wd4h*M zem>M4fs^&O8|J!U-RWrA*Y7$#J?t!m=!933T3zw=|9 zu!jCf(2fZJ9PCky%9iV)AU9G>{xK=*lg1ID;~7KHmL*R)wR5pswSSr%(0nK2q*~d*kl@ zS7KiB>qVWAbv3`^Xy3!R;D+U_%*_4yP~Lkqc*?7K))(>qE-QHc`+G$N1$9+b)v}F5 zA%{Y|X$v||>A@iph>01NXKE#2)W*Y5|8BqC?d|0g~Zs$%~PS+ zP$IkSTF*dE5~kkHWR>CIDUrQK*rBA;c5V*>aGb_d@-{X$(O3sNEd2?^^mm`Z7ahj~Rb&bd$ z(-D=MEESpyqxV*r>?WULLM5|51Gm6xX30S)KQ-P6ql|r}BL~g+rqanr8$;G<5wVMz zI(xySLm^6yNG_MOD%om{r8f#K>u$b&xosrF#7Y$?N4MlEoOvzGcq+f8ASW${iTfF+ zYG8qJqy}G=hMqP1Y8H8H3`m5uZ|Kv@uGk^8gHMfJz13xFo3p)v3Fu7mK%JoI?)OR2 z?IY>HYmx;C_4f+nnKAnL67>hR&-pu=?5a`?osFJpRoV5GY#bZ12Kd(L9UGOJgydSg zqpZ^?v8fX=j|;Qhp~vl>r+d8QRihM}i&bMniV<5khk{EM(j<1HQbQqj&aYAp$l$um z^rn_0`&65ZT5~(aiL)G<28-Zx&*bibfsz*mE8amCt>hoo%1HgP58K0g?}T!Tay%5& zKbgip<`i%HZp&BSsa+BtBb^Bt#CHwK926PtUO7GTzMoRCOthhY53s@%SQ}m%uG|4Q z=f4s1UZ~zUDcmyU7qBEyXB@RusPa4aZN$!a!I`rL@-t+D*Q%Rw#cju>c+^$rzEPMe z;k6`D{qoyY+{x_u!PtEQ$LGG(eBwsF&`>cet+nvyB8g$cALcUnPL4YUA@J6HH@m3B z^z6`kjpY2&8E21c_q2ye2V$RWbLfdq!OqP+1(DWLz_P4ztyhJ z&)&OEa>I24tvmX_Jm9!jqPJnKYwR<-S(`cG=px)`XD+qqf#@jJoDtx9^4` zT{@#<&JFIY1@b6tdoE5)i~Pw`BTsIF55sHir#u(Vk6Dz@kL=UEsKkfZ$in`^V1TA~ zy8wxOlyK%%Ii-5ZvRHG;mNNF2iw3gdaIqlSmr?A!XHyZS)JXvOS?9oNwh67jtTw|I@~4$h z)3~o*#}u$}s|Z%0yJ6YWz%G zmQ5v{$-U~}_QphAvj8s3+@Q|WczF0^%uZMg^{7U17BT(%r`!eYom?FUKDjY(dtA}tFAeVXwz|t6`~Nrr}VV>lJ_@^ zRp!1~d|Vc+{7-_#-` zkMj@K$Fqj=)X?~Cn1z{89r#G_I4j$U&my{of_4nL7Gp>}d#}@2#N6e|^#g_}>cbg? zl+!9I{b}*$OP>DvcnwYW0S(+HS*!)Bdn1~B{$6`QN&JVIV9U5l5q_o4Fg_lfQk61r z>7lX6a&%%ov%bJn_qT6$2ifZf@LN&5E?o)Ao{m?r6-qoeYxsMf0P}G@ZToJ>1a0$)Yc0F-2@P*Uc4%5yG2WCp*in#!Zf?He9i(j4iSWd94zTv}i zgXV7pXjcbHpWOfXE>w5DYN1oq)96NNpRV-#W%Aq zM%8poY|FUt{#n`%X=dmM<%zC2K0>0&3lAGdPMhodc9h@T!3Xlz)aJIbwK_;vISeG0 zJVtV={cwMkI_Y`bL8}=)`pZ-aDAdh4J2vaLBzqG0<>7888`WK1T?nJL-W0Jsyn!mg z&$fdB?QMDUfN0-y9M+)5Im5AbG44_yc4a_@Onh5vW+BO`Nx%6Vx3x!aZEelT$|`?V zhNQ%RzP9WXGTNy1Vd2B5 zm6-`atLTO`MfkJ0<#=>4tb&4OT86Vv>8fd{=*`4z6Bd%SNml^ivW^s)E%P40PAWVS-)%QDC97hU}2cOCpUA zcMj-AfA~wc)isr1;+IxSm4XW=?SoODi%6&23XKauU74FhUt{l7==I5dBuDNuCD8n2 z^VB5k0W3s*8O_{Y34;|p0!4LX#^1?XZQ(guyu+m1!v4_F(>HX0!L~C${AlquKB`pI zwOIG3kj)ca201+3D>hj2py5+t;K6^Waa_3lkvq1zL_}Nb4nD4JG&5c@V(3(tr7zF_ zn@eJ(+d+RV;G6&AvuKsg1+0{ntfbXnp-~KS$1;i}3*@mPVN_{qd!LzR*i= z9oDOrRjYAZh4Yv;87-O<_{$4CUi(@<0CTTWA*He)vdPP5=@NWeYLO1C#(hk0mITOG zg~GoGt7m+Rw;fLx%4|m?+iN+xeIlO7wystT9NkWEm}HZnPnjQi;jbHC)A|FhsYe$??)A1=n5;wek4AEM}- zn387&QQFk$HC5wcKJD7Yts_MLPhA3n!Zs)!95{#vQ$L-b7G`fbH66(n6dXY-&koxF zx*bpdRLnQgF>u^zI@ugb7J-P*Y~i^p3I+yVprWGUApTS?LI1+I&JBoX1cq0K@>qam zfYVQj!cLn5PyV!^&R;0NOiW6ui|2&ePH=08(tSKvusT*|F6zGiair9=^yA0-!-(bD zp`(juy<%HGB}j>hhqnCAy&^DVzuWOogc!#e-n@RjKkfW!1=se|Q=Ka4(b!K8ygV5ndzh=Jb1Yyl<jJ~k>U1Al7eU}IC*YQ&n%lr8ln*`1vpfd{jJ zv8jLBBPcX&OicYeT!$Gk6ojs6;|{8uhw%o(Q9sQCoM`rI#+xQD9)d?k-jX=o{>FFz zrf2EN*~wOHa&poB{{BNB$+N=+gHJDBUm_$#Y>5BX6M?!<$w{O#yrH2%!1bpB(sA10 zg5JP$Pcu*Ir%ST4@ved;c06Lh29>XoCEzmuy`iy};K8VQsgKr>medpXW>-IzUm+U= z1fQWRc&lD1!OszfKb<2zwoDvm8uT|NkepaM8X^09yg7D(kzhQ(cKKhXP`HN1j3uGo z(6Lrl!s`Hq$3n%?tZE$W>_9vky&zif@QE1Mt6t=}w?srrI&z_j^z;YQFm$n?ID}wS zRF~@?Z2LKEA&9ucb=qx61w2(#7DPgm`|?}R@V?uh**cTdzU<`wmvvi|{jUt*fB&6u z3I|ySsd6cvLnAs*C?MPnJ9BDGl+x*dO)_U{|?L{%FM&T#Q?3L%(r8&~*Fr0l?-MRjL)gG0sQb-wId=1f=Z z53*);MjURJ2ecw=pZ9NpE)`3E;8DAtE3zMSS^EwTm3CcswTGR|{PlBBD7(p#g*dS*)#6ptCrur49KC(*EXgV99AJyl)VrF6bt+&rF22P%p zlew=1F8BD&R(!wR;Of%B*XR<#JiK`hq5ks+WhZ$ zSptF%_}d5ihA+I!q|`p;lOi^%d$A#y?$Z~5Pv0Es!~DECl@{s*BR0iO*TMQeBm2c% zVHHL0%C0o3afjR#~>ebYrHjW?8D| z?1&cUrl(uMW7%n!2Wb`SHVsrx3_O;iE?-EDvxnWZ zT-kUFkTt(@@iPm*(r1F`7`M=crKT6*+>i7ZLP=<>a0%v-z|J&=n~$ecoH+NO{3KZ| zLULn|`K2hf#NlQw9!7CUy-`)V`0ojSmU4PEvx9Q^>7sFzm;N+=k3z~J5{;1_rKuau zX>SbEt&_p_Eu_k))qtGb8q?9u_v)E{4}jo!_7erCuA7do?g7@7KuVKtOS~{Dt92i1 z_Pfee|J~i)pO}BIAqcJ(4xM=YMUYEZh!wj`kbmG(XeWJJW}&4!yf=jhS=(C2Y5E1%1$Yr!>~H#yM-7 z@9}*rxW&KxC8hAgo_E!zVXztXi@49@Zf@g%6G{V2G*z=gjc;Fh!n>Q@PUc#vh8A~eGVN= zEeSxKGfr89Wft41_W>VuKBxF_u5i8;B~xM#`I#CeJ5{>e!W3O>vvqvjEkZR>n`pz#_cN5?{BAl|0z$qde7AU<);1& zXvC>R=d!PZKA$031C=+c->Q|wtKrY21;`Qdl{T1>80B|UnrQJ>QSny+S(`Qw#8`Yv zo}zv3Ej$;@zw>E2^t*$(W(7^Y;|O-b?v+%u@t7XukSd(vEm5?HH&skgbfg>JG*rqkR3 zt0#XMsIFBwOulwC5$%Ws#7&IsRpsUkl%gJoiV;cTn+w}QrfYICGupAM13JVii zd;XX?<;jkh!S2Q^VrkXtNKKY)|78W3{=BiN;?we9d_ZbXodWK6u~}Uu@uW>#!Y1?% zD6~`WFv&>MQ>!?~nkJ3X=8dhR4^c+T6gC}Gko~E(3v}($A>aVAKQjAOlDN4B>#a$ zgcB|>mH2YYDQsahERnxu<{pQ9ylkWM3DOeyI#>0{+2$DR^NuHiKIzV>_ZpmAl!r=U ztjN#sVtFVc4J`Lx5PP?I^HxCwY#o0}=|7MX!lqFa@BF&fUAbl|F{-=uM04Dl6m)Rq zOI_sDhdJt~Cxg06MwT@yd5glZO?XZs4U6&gPO*{zvejhr1F`Hk_ zW|AW(fnZQ$|KtOxbhKEDVVQ6h@HQzH%)rnd)J2F@9e?Xo>OH=_$2;h4XNF3x)DBi= z9druQB^xrhTUXTT5zt&+-z=y%^8}Y==oXCTlgH)|FUgU{T)AWc5oD*LcrIVPva0eW z{o}v`+-_uQu!z=D;m&AS2F467eemu7F!$b3O?6+pC^k@0upvqnX#xV$JE$NXDbhAi;@5EYQ#2|X$$Ku7|FBtR%<`~JT7yXTzy&mH%Ud&k{lkU6?o}Xz7{2BD8E~l+_b7yP9 zvl8hoM?HvYm|934#$QOb{oKd`7mgY5yya!n5E{Hl6WRqLw4xU=@}sAlgU zzy6{5y#=U>m2lpgcf=}Nj2KvW9BjM9C3)3-HR z3g^t^y5ii&SjZ14o>)t8=o4Vf;mzhZxA^W#9jjMQi94as*5mBL^=az7P0VfF_NU9g zy^xM>cY*tY>^o`<6oh{2zsZW+Ijl{-Xln*Hblp6=fo@|u`yK2i^Uw?;(S@3$RrcUI zv;eP0jhHwObeBuGMp|32iNnsP6E!P6sr$IZ^okteht7blJc5rMm`?$3fqI%akH8*A zrxnup>0H!mdJ}-TVMW0F(&O)K5*m|`sO%CMU9v1J?sTodFI%Lnr~f&t@cMXpuBCi( zAuQ;NAWEzV-I}AeyT)&o0Di94(}*Z?crRj&J^>25OX=Om{M;y`-kr&yg{f=y2ytN8 zF98XF`uIn>>M!Zbtcq*<)7-6V8-nR=&}7vfeWknJS>2+CUV>Q^=1S-v`=MF`VbasL z+IhTpskm@4!Q<&YFFiUO>lwGx#!m(^F-xKh#c zOZgQERR78G%8%z7BKE$DQ>0gloqs5CRkN!uchR{H_xDAOex0dcK4?MIDfm_4+E>gF z4)oHNr*CqDxE%W}H5w0Z_3GWhRlJRpC~B{N&ZATBo?4FfZJFBMhp%opN)-3pPGu6) zs`p}8hmc=bEIyA3TTu(DYy!$%BGQJk}|)(;k+T7MVpx zFvWkEoXn5PtRCAAbbo!?pH(i$&`Lj>GHca=s}Q`J^>-k2l4N)P3?!Ydoq=n4PU`m5 z4*z+H*I&bDQKhNqic+atlB9f=&vTl2HNoO%BLSBT3aWVw@QCF!)!~*x1dI@4-*=kH zH+|=i#Wz{p1f8`Hw1)hx16p=Xj#VpZy%HyOnHBtw>EYgyTtnj_@Nw4e3(&{onduiR zbMxw;iAkyO;u?+VAk%6?unca6*zr8g&XhS8Vk zkCb`#*MGSnoc3$CP0nX~D8PQ{x}p^seim%v{vsg^5P% z$<99PWX4pXKUwMFkVSUEtq5ORhmEfEbLlQ5pYR8;r&6R5I@W*}P~6a21;*W=4$&C? z_PB%8OZ}7Qbw1UwE-#HNMyBOzv&OC<-yIt)^LWe64sMJo+Oeq7RHirx|Hy4=eG;A@ zB-$gZWp_})W-lPc=P{e5Ko_g=7i)Q{MXw{-qsF&r3zW88QaZ%+QSsKDLCS}?Qzl*n z<(+wlsQ!iJHZjkp4C(wZlQptscudAMC;0W|w`>ZzA@QQzW@qX`q=3lc;_V`F0XoMo z2e<~PPO}=GsM(f1mC0AwO>JP;yF(1_8sQXWjIdt++|3S7P^QFs&_@2(v<8{VE zycN5XN}Ko}U3~d(yfgoPvG>z~)+;-stTMEbx8ABAK53!3wy>$HU3E3OEx*uQX{pmt zcrI+hL=%CN&9;^v?TaGXy(2;EB^>&kdI+Ytixo$+nX3B!EJEj?e ztnVMmoR2Ck6d=S0Ec*AlkOL_-12B;v@SHXg3{~af4;d++Vw?~Y=YA2N=vg~mU^(q7 z{vw82r7|b7cKC(_5Iibd+mR&hGQl&sDN)V$RNro`-&Sy7|4N4e;v32v&i!<^F62|ruLaqanBuM+bCbOb0F0v0ABl}}FK9#VAj%=pL3J2U1xapcgp5Rt>u{0vdBvPI!yc+H@dYjE-U!

    Hy?*vd84|lV zrOn!4zBXZ8DV05#^zo!DVRP%~=^=E#KotZxmlIyflXD}|#)}kuf2h$fI5ko&JQ_3P z^YK87U8?6>JXfLfd*h9CKI7Fs%j19)GbvF3Hr8}F7M;=-oX@;(aWHdJi=b>e?7Bmk<*p-4T7YXn=N+u=3EXAH(Sjf&oX7f*8-BhL7d^d}1w_+!*FfS4S zMlE)wqJ9icn`h_c&)E(oZFU!uj9nN5tl$3OgV4;dN?3Ihz-0~jAcHNR~z~Ow4$)8lx z`7#aApS>H7mT31X*#>0}%!xCJ)(^yR8ULX_AFX5_TJoNdS}2a+M@ByhpIQa)=fq5P zU}A%C>{Zuu)F)09UYs7T))R*=p__y0ALDDrS$S^lX{rb#>C-pvc&sPcKz8M~znyC%V zJ0)vF`$cs@6kd1?OQ}Z@dG^NHJGTbeQjtnkG!&TrpZ~0W(}!6+qldTf-RnAnQ|Yb0 zX3s1b{fEWB^00U#<21S4L({-_m}(^RT&~AH+`i9kKJ`7*qtaW;Pg5k#^&HT=Q1r#j@pUyMajH!k;GaZa3SM|s~83*TQ5?B>-o6fJFh|E(KxfWZ( z327y&Iv=}xXCdM%kNc|jnJfy_{Dh6GxY!I2b?3I=F6OBjnV;E9Co1hBOplrd^+|;0 zkY&E0j%^R21a$au>#TWLTZY6jg3Ha8a`0O{D|^AD%EXTujg2MvJ|}=)aT3(|(9%xL*QNKz4SS>g*4c~Tw+ks(=U~V0 zPUKnTE;7M)c>er=Kp$|bOFkxA=td|Q?QZ8@xT41kStnY%xDKctBkrji_6AA3p=G$3 z6e(yhR&Zi@@7|@E5m?DHT@yR!z5KY5~tSS!`k!PMR78Fm>JOxW!!To+w)ZRBSZ)&2mF* zPlkBih9odfCI;{APKNA-_?lZ$*cx4I>E!}itxKgO*t;hK7h@4sTEt@jO~GEix_thS zY}n_$Ox=f$dR=u%XI|QF;<66^qmfRZe7ua1fdx4P!w{G|L&d>=$e_)q*xO9@^gm}au?*oH{Uo66YPeeCZS)3&s zuQkd6PF-DMsH|M*K$mFC`z>e*m?nh4@g8QvV5oGoPvx}i6*+5Z_LHsZuwN~6&i_`VsQ~Is)VS;wVw{f121%DdANOj6S z)k@G2Gv;RpeJBgr9fPt*gtGHSgJ0$hr?F1j?9t}i z$h*CoKOtM~gnH=x6jdq-(5m4`&c)g<7B^3at`?NzZ2}_#-z11%@R)bO+q+jMTKB^ z3=XQkcW(06>&mS#F}7B5>M*-MMP_*l+g4WlwU(VFOOS%+JHQr5z{Ys2=_4`?0aAf= z(cxTSbA7zj`=dTbZeV`e;^)CP|L7WouMGZ*@0VWtqZ}HPUsZM0MLgsqPA>ZRXGi7I z!E8avz%A&>C$HxoK{LJ!se}fQ+I%m?Dzi7Z;CQ+=hq}?|!!go7^E`6% zNvvSbSF`FD$!keXP0r(kd%{oh{VwlN&!hPfLQiKDm^C#F0lL?-b9s-h2@`%S%Yq?{ ziuMHINs)wS$fdc)DydVp07s9-cU6dYCON){7C?6^rG!mlpOSkT-7ZJ1|$4Gf=0eD+R1M>x9iJA2ODdd+&BI1cS>z?g)EjHo9NcmOxIl{2;9qPVa7 zm8UNj*@IErn75E@`bALV#__lrJTFD04NH}3?m0jwgtlGl~ zj&&x?Q$@$;8fc!3m@PLS6fjpBD+OUujwF`UOx_W@d|p+HutXBrg0@hB=u*DTFQw_P zVeq8I{Szl5%X@Bz1bX*!NmhW>xT**?MC>dEF(aB(G(3MJPXf8k+3(~$)OjYAG@}^N zVKp!$zv7I_u6iFxp?OWK)pWe@EY~P~xv57$!Qz5G)R9ir8THdZdH##E7L5h(aK#MJ z7*uEWrk@P1esL+nB%+a`=~J&ocVvTE-XESnAMitaPYn{y&a=M0HuIfE4csfK# zTfWIMTgrMf%KP0ZLb4v-U~9qMdg{An5^{Vb+E>2H5yIAtr5|H4$as&jjQ2t(hBbsk zjWoo`}jZw{21}a<2O4-CatL8Vr?3**fMusz0)-A1Hp3dzg zOVCjK?;(>n2dcB?3!G6r9CjYGq+2`XxKc?ZWDCj`?Imn*ZKlULUDh^yZpmBj2AIs3 za9N`IWhb3R&xtL`G!pXgT;HgFjQr0Ts#C~zLT&w6>g*1nJn>fP9$G(dp1vFtZ218l$lJJz(UU3M(nK%tnxp2 z)WZex$ub#$Tgjb6e0ZgReDxYsd_33b5uQBaSsqi9%<%^F>EP)0vv=5lN2$>p6O@4H zgxjtNDP3K6QYf9gBcx4Y$O2jMEa8?mCx=FdJUG!%PoMqBy#PPEFO}l#&|UQv^FAE9 zxL{mzptwvN>`RK*jAYpc;24I10`XQ?d?WBt`*r&8K|@8~M1mQS-{d10#QoBL)oM04 zA0FVo+6s?0-}`A-ElJ%W@od1lcC{38jPQ-dGbUoD;43{eP-O4nVk31{yIrW)R^M2d z&)dNpXn!yDzNtJ2_ip=i-m`=rfvt9yM@AEdU$WGSGY-vXy>OjuM6Q*}D1c~K@g^xon z=1%9e*D}a%?)Yv9yPsX>+~vB}h4SN!0r7h5Z3!$$V41Du{_h;wy%m>MWH}agTdUfL zA5*vXm6u~guyObER_EA=a2z>oMfB{SXAUkY)YT(}-+JGKy0n#=>A2d<`zxw&;{?0Od$?KKz2Fn^{C)3oIKP=IRNLewO)dBY+vSR8Y>g%?gw6wooRC|Zn&O8h95j-+ZLyJ7b9=7sF7 zrV*IRdH7uC!Dn|J*OH5s-r0E-oCY|ly2;nJU)T;*?~go)J~Y8|XoN+oy0$H&KtRk9 zT5Nl9GW$%ER=hFFSG&M@^GfNiU}v~PaoUsFZqE^6?yLQnJr1~powF<%e4Xg5D>|@W z!N(!EdXzD6Hi=uOEn{j=vt`a*+}kQza6G>)1HR;X{$skY6wULW`kjt0W(mb<^F=fR zsi+Yvr^KfFXdV3!l`s0Ra)^&9W(3SoX80_30qVh0DexD&b^GeTxSIn=RG<;0K4NE- zWq-*B`>9Q$7FdvgoU^bLKiw!y2GtGEXrX2GzzToB*Tx< zCInE%fpC3FueZD7syM@9Vj=6u!CAzOycAt+oW0rHj&W8aKBKC1;Q`TfuBljyfkD5= zK-4@?(V0DGi?95*md5>a%KvHs@L*&RgQpVxYH+nqdMcROC6XrCuLpXm;e&kL3ppkh zZii~430d^am5{_)S>e5Mz?JzHze$8IGOY0;Bv5#IS9?m_ zsBGLbT5+;bVE;9`PG_MYkW-7#y#b}()f?YS}RXWyw=e)g*5qEgs_l!;Rz%LqRQGK)=KH(SbBsonp5xG+o6@GEqIv9>tDwM*OB2@wPFuU`l#;`X_LJMsM(d8q8CXNEI+_Y<@zlc4Z2ba{S zhOG)*A(O7!dwl$`Kh#6kwx~7TD`gLPyKL0!(|wUNu+e`!eJK6JynPuv$E1LDH=dBK z57Ygi>Z%`=RpvZbm8Eu{?B%7I5g1X|h)uK>z7&Yx2I5OH|qAb}HA@=^>I zpQ(FsrO39``n?^HO6w4!?%z^SVAm)+UG`Sd8-3`tQre;~NSl*EpXrF72 z>iWTbzvnG>mGv;PzyNf+f&P9#{?qY>D-M5$XfqPqWq3D1pg<t?PNUt?L+0A7d1HE}Tz% zDz97pWBamTr(j`*C*Dd?ZitAu2ISx4A2u$HnmT@yPgDV1%8F&WDS5RQ(czsjpUqAk zVj9(Z{{sJa6_>qRU&hRR+@rv@eN%g%=i%Pof$Io27De3FWbYSzNj+itVqsWx*PE

    !)*Kp}}j4HU15FwbWpf*HF?Esy2A^)8y}xCAQg>mOt^3=VCtBlx!Xm*yYAi z5!Z5Jg656LleShFAWAMK;skX2il=*s^*JhP#bMNXX*O0_B&YriRft+*tA^<}jL`sS zOB`c3MAl@-m5E~B%2_|WnhdX;|4I=eR^X2YjU6dsFokV7DF%A)_3CaU4yn`Wc{bjLON;gQj6yo?+KbuqG-=jsb55U>=}-bIK)_&1@@F_ z-hTP2-eRfi8&@(Yvh!_8sz-xP3|5)$(5B7(jS?@>_<9?%&6HLCtS#ev)$Fjd;2gNR zTB2k5;i=Ph5(TdzEx6>&6ue;>=!dSKJM8V$`0heKb8{2O*i%GWR;iiX(5893(xE1Db7#6&!D$C|Z5Z|V%yaVTGG6uWngO2PjECYLb@RJtsi^76$xc*n--Qz-p=Exg zFHVBL0I&Kna}kjfn@;+Neqk`2#Eh{;O31ozl8MJl7W`aKtQUGel1y1FL&=L3kxwMQ zQ@hnu!@TLLT8jDIYStRbN1p>d;!OsOO4Fjdz8|Z(p`2!_mGzTl{l4fD0zkcQ{RE*a z;hOf9n2oo~)At5R?+%a31Yl3Wq$fgci0HbcDZSF-bM{ANZOCbJu4GO~S-mbwB=%qJ zo6WWK22%j35Fa2e#r=s#CJfqNsr1LBhba7X^J0{AJx-S&%Cx*2FoB`%>rQVQEw1SM zxNG?Hll#c?h-Fx`2;6O;)~NzmQ1Mqkm>BHykH25YJvf!ONGuZ&TLVAp+24#>GIXv- zZW@^l*yzA2-GhX5=doI2m5{{pXVrJ@z(;v&*VWFt&<2=P}g-9~&0`ZwUmI%HOSkc)OJnk^e~+cv1a->RRyswZiY8+Zm5pVa(}$NZ4@9>3K-# zb1Z(9EQ1*o16~P{KuJMpx6tl^V@~%&Z=iZQ)&98>VN3dUv4BHb96F1!9=P3iq}PEK zU;lNy{lEGZGNn~DF8p)R&Z@i(RC*DuD!0Es6<4?Q>7o9hXqYTr??bUa z3*NTL2Lskh(PnEaXzL#j2}$0zCVat1-OeHdnfrts+vJuvUZ6oys?nQ&g_WL^iFZof z4<~j`Y5|M!vJCZueN`_-27I#E+LV2|{B~`VWdunTp`UD_8`<4uLzZR4CED+b;N7GW zb6n1|9EYfeTuYOfxpEggp+BJ6(uBT6GaXSzs)~0<<&LuuDu}`Y z5C~5{(F-#UmJ)EOZL}8FKMWTV)G8$0pxWc6KxDTA92tXR)=2@2D+2mNx@A-q`EVFk z_4hkkgzPG3*J4MKqS1OLzz=fO@2JOl7ia ze&5mF*MUF z`@JQEgW}-BV(Dauym9)DN*=2_=4YnOsu}5?8$un9It3O!@)MKDc4yDUdn%hg7-<+K z&u0|61~Nwyov6D-13>-_CR0rk4^DqyZG|Qt9D^A*PVO?6O*VB&ULdH>w;yadp`x93H$e{DLDBaq_T1Pf%Z~eic!qZk44tn!jB4 zF%K+LT%QW;cxvCQD8M?Q1*b7=|62ZdRO91rrbo_C5roeOKYXNo{P1pml>gM^z)kE) zTfG%F?yN0G=U6MF$ePuni+qMEl#Pz@)iDf=efCiS$J8InIG+8 zT1>XqPJ`9sP}KS_Scl(a6>Zq07`rVXK^|oc)%XtGZDq8#V;iNNe+oN-OG!Q8?7XMp z&9WfBbk!V~4Q2{SBKeQrDFIci zomG4&ov?-Q`TuN%ZF{K&e%_D3lOLuAtG9y;~osw`& z{2Taqj(%CMB1JgBR(d<*U@s{J%bC|QlLs2v(apYUvZvB8$64!MZ8e7UUB2B8%aZZ1 zUd#mo90KCQJ$gY^*jaG^Uj|RmFNOR(%&JT7okM3>!8I?jQ z*ugr)-YayA)IG5)(A5hgvfu)Y<7Zz_-Q*P0a)g;KYdPo8u_fPfKKbjXVY&oA^_K|5 zASOtSqGUyihMT>MfewuX=M>!Z~J zm5x+8&-eZ5<6N@Hi>{7;FV#);wnJ+0XrxAnd@9g`_LQ&Yb+G(WHS|y)?E1xXV(hSS zHh*K)<}N0*8=Yil9O}`gPDUec#=AVN>>2W{#YE=4K^8L(3Q>T(AxO9lgvcj_qCFC@ zjk2ypFI+09Y=noTjY-1HHFOQ zj9W|g{Iq!4sas#@^C;w#PDgwVF-~Mz*1z4OywA0O4(#C`yUTd~eNAD<)h>Su$pzu( z=yrabkVjvM=0IBCL0ddR%M%USRtesYCYVMH^2 zt8&yLFdeUc##uLGW%xMY)`>;s#<>ap$yKy6z5Yp>4J8yk!qz~`CBaJ95UG2JD zVw{r?2atOo04h_kX`qv3Ici5Nzir50asxZ0`)X?{aSd5q ztN7aAV$h97a&=IlVMZ>-Glh=YhOL5dXg|zQnC`^E z@|2KF5e$fqI))HYW96n6;w|q6dHLY>IeYr{I|{yK%4~|!rN_CG4f!erFt>ucptiF4 zVM~%sQ3xLQ;>Eo;jt?CjiW7xqqZcPvTNcgnjQqjrvoM#;`3_dCFPi7hjM5s(>z27I z7L_}y91QwD_dQsGUq`b$&$A`a-7XWq_N#taN&a5571?iKA6CAFPrKz1a}#a z-rD^!h`4zg8d-jry^Ws#rFeJasKq2o?lPoOc(-GA$@6jc{D88-V~||s4{5ZjSJr!4TFVZr!(`!jD1 z#mn>x3HEUV$^xer`ad`X{ht?s6xEyDzlqZY+s%(|oV)jLji92ayqt4Z3_*yWW zfZ%V0()jwIPei1%zIx4cBGpE&Xj}mtPIsi?Q1SQ)P?MxS%=Yqg2M+8&yOm;2JDKXA zg=>Ou*EJV9x}rz{HyB-FFYTG~)3^9vEf;Srd?o%PCEE6Nn_gj)?!^t_N;VGvbP+FL zNNLm@BIC50!!+*Als75E)>;a$ZdI^+$V=-eyoaGqDCERClb0IoyorpYw#emHi6qrrfSW(EPA3$4x?=bHt%s# z#kG7r_(*F6g?(9*!X|l9`)ke?eD-5adjbcr;41LwnETGq?^Rj|-lKq9=3O^`@-NpD z9SrwCpX2OS7}O>3B?`LG-!@My&q$6KfeYAY@Qqa+IUhj7jVa{~VnnR- znz-~9r9h6kP58?_Zqrd2X!b;URpz|xa3VSf6^+4UfN|y;rsn^0HRJ46ljWC7j^-1U zr004;6~6aH&Wll{4!i~+m#Fabngopsbj(<5>&zR~!Pu$hRnvlR=d|gwY40m~x1a`| zAv!UA3YOnSeyT15X@pusd2zcyXI9hi*Co0=#?L$3rmv0;-rGk_$`Z>+$xbH<%nfs{ z4S8T_i3$Pl>HY&z=6kS^+9P7iMn9#6KWrGZ$lEk-;udjVi?S~jr%tD)$_;BBJXJaD zd=-$LX__{6wvEJ*BP#zp$>r|G&B^PMHC1LD_Q9RRRU3N7HvPN(Z=|H(*2KlXasn`J z?$HII$~G^dWXE2@JIbe`O2s~=Tr*KzTpnF!fVS||^uThR6?IakfKkBfq%sRmyl!&j z-Bt78HpqyyIq(DksKxd>J~!6T!DX<~JWW3v5Lz0E?2k6@uMQN?eO34cnxck^UNQWO zF+cZ+gEv~HYcf!E?O|-ZnoKjZbgP4HzGhvg;ms_ICw8f5~ zs?Y!lWXihQJPgE}qOgE2g0CY2G^1Z~#Bw1d|J{KMnVxd+U@sw>6sS2;!xVQu=FIX* z9#5^~w*JRf$@(X73+6<97RScazv<=IJhZf>i+JMrYhNWwz++nMK-a}}3fzh%-3d0b zAljXXwffuVD{kPQ(Y)mVSC_G0R)mSq<|yZRE%~v&c(JUQj|@c1xisK1ZcMINFgVhS zC!|r2*+ywNEPel|i00k#7e~MH_pLA>cJ1SfX+m*Ij6VX_yjoJc19dk~#K2NHaSBU? z{WHzdPg%GvV{q(Xq8bMZ!>NJMn4UBgj_DOxRnHE~ixeE+oT%$LyXe^X%{N-+y6Et` z6F;DUv`ZdG8mSEb@OPwhaOzEW>TK`GC_vgO3*D_(oGwsZ@jvITE&8G-60_p$M(-0v zAGbUe*qC@DUP4vVsqB&tp=|%?oY2ij<~@R96M_Z00@|7p#1n6AEDd&p>q?KTC`{ih zN5{ftjV#&Rl-xw0>`H27ibXuX@v^`v<1{u-YXK4*uYgtgq8Zo|GBYKRyqSx%>s}7xgT3V_?U>8LPwgtKsspoveLI#&#(Llws-9bJ!7*6VM=WX8Vk*D^0oyV?XrWO}7F^UOA z``T`W@o2CiDi4;7dT6T9BiqY!-W2Mjxfc>27isQLBGoPzd@Ut0QJNjoA&Q?~E7pB} zbLB%;+mLtia{C{ab5qM{xtn1HRe>t#+GpRLovm`fI-pkx)F z<<;%pxhEI&=*lPC&b2w17I!=c*U_A-0s-#fsux-;k1KQr*dJ&Zm}wf)F;(0qTjkS7 zZL90e@*5=iu+Xk9TP?~bNRvH4nFB&@xmOEo`APN*byuA5rQAJunsk`Vloh^(`9r#j z>uj?i#}pBG*KKq@uXSSfLF{)MUv-C9_4oHLWw|&aaIM(bDhc)3wKIobu)jJ_4#CdozE0?mU)oNE^}ZVUr*mB1?gf zS6psLwg2NPa2w_ydNsmoO$+^l&M<(jm(bf>EAMw-gtzk(!ut3)VdPcvXI^z*;CA;u z&7to5BONrNh^de+njp_L8I?&Q+QX2RwgJVjkUPaUtk`nWciSgzi&Hr~@s3yR$7p+> z_$8*K@D}r$!MsCci>%PHrZw~QVCVyJrn`#w{Mr4HjIwXD?q7NRpNns z^(}X9`e{mu!^)H6!+@=L6>7Qv5SStFlic}TG!3Yzs0+thp%>!f4Q+IrX4#!Dg_SMQ z$HO}+%>5xboV<6Ih)I(aT@$OGyUUmEC$rHzDip+$LEo2$M`zb`k;o_VM@S#ayDYAe(HN9+^xqt*uQMC%SO2=FdX*YvquGbGbJ7xl} zX^uTY1PzvRj>S=S;{Q~8e*NmR8!eRoIw~Jsptmrd{I8}Ou!>ste-W(zqa**1v5)y>v3oPh zS2JPmTcYQNep$StDh&rX#Cz_JSrFeXQQKE38-ms+UO7Ym)d>3QHDy2{|L^g?6~F(L zX8%3z`~f+|66H(<`U|^`#CEQmA)tj zRPWciwtw%jp0T+HRO)N&?)0*g$@jTdfQ~Xa{IffHiU%tRC!oJZC9dnAh4ja#cBi2Q1m$Cd;75zujbG@s4g zM%}2aD9z0S#SGI0an^vi`YxcYn*&C7@6jPX|D@w%!DTH zJU}N-(!`|0oeYF^#)oThXQL-KrUghChh8YHMUx1bwxG^?Sf;p>k%Ob*HLb)0y}XDv~XM1!0je%6|$ibplt>_TeJzQv;mC)IVLeGhgeT-;pF$> zzx=E#ohFX@j9fkw+IF@*sz&=i_u&0~eA63>H3{S-%+%tL0&VQy59Am~2R0!SZr#)R z^jB@)g>tH#zdJAC?Ul9(NK|+Kt%rE4vZvAd>~u|3tohfvrcprGbKfgPZ%`sz4)vry9Yvg>Zcu_%VJqbm$@t`}$su=q$~kMrvFb-nSD4vsZ= zV*KnE9MJzczxo}E)n7$feo4BFmq?a`Rf3Gt92Ajxc_56!KNICK{?!pHF!x^vz7AVK z4ujjo@kLI28|HhT>ZOLW`ThGh&ngs~Pp|Ze%^nGqC!jWGmlK%yFR#`H2kRQuY^})q zPd9uRan;Romr#;|=E2wFzWUu*hrj_LByB%LIWqhCU;UAhVF^zCk<SM%}T|4J**S_f8>CjYAt0%(*nMWfIMDA8Vq z*WqwoTxUylia`ZyiHZ%D=h)e5fXe>%8l0QCgb z64PH=SS~Q=8|wl3^ygJR2e~RzTH!79F@Rx>WEWk9|BeZkA;r~!--B31Ptzp%q+VSs zU4>ueFDZF+&MrQ&C@({EvSvsz8+l8xbN-6KU&YM@gC`%6SNZ{=SR|i|liW(C5BZ<0W_1@g;VPW55Uc|H|k)j?t&j%eaaK9#778>faTdvhUgYGc^A*IaFWUQz$JpAz^ zzU+^MNF!p1O>qLgd>OrO+~setn+WJ%HO5S0D|Zwu-d`Lr zD)GPSKwqi?)L8gG%P=;!+i-wADsP+6QegpVB(#g2h!s%yE6uZFj~c(XL!y_=0KJ`4 z{N0NSO-kQPofPbe{PlOvv}KEse-|(GdJq5!*wv+PHq|o!8SaAi-`~RsQjbrmzK-)c ze)y}0%^nfZP2>DoQ{1mD1273%B1dO;e5^iIr!bOKNGZ~LYS!e`w1fh0yJ8hM#kur$v zhpvebXMsXsnyj>l=rVI_ybvGBP}dcGb~5A|kyvCYIESS@a@UAQ7V~HTr9v49|8yn) zke#J(KMqeDsktr49Oej(Y~ZW~qwrB2}bx-3c!7lXF$bK(C+08N#J}m}4pslaKmszM;!B=hHh48ezQ&IB?X5&I`CBgYQHB6;_f;@R9#=Y5`uc3r z_CI&}UfT1Z9sfbmoFI}j@EYLD?~qnMEYInXCN}aZU(>~O>wZo!$!t)R_j%?gv$Z|3 zk!V}b)>p}Q{g?bj27vtWj+5_6-9Iwj)JQ(E#MyfxQ6j3Tfk)y{zkkgFa*R07-BGFW zziP^@6VSiU#h`jLdKHiVyS4uHbY$tcx6yOS|4%SQ?M73ERkKJ^>K?nH@zc&vxjjZ} zA1qWASjzM+OoxUizNep2Suk^NBVTCHjxZfNliX-fFgea%#zF`#^pK&5@T5XXu^`K2VmHv;H>q0~?~qeE*+g?hJL`r+*ILO;TGkbmy*g*2u3y z*QOd`J)it(A@BBJcln!?TG4;b&P)I56QT0YQF!P>TRV$iuBI-&wkTS?@N{nqJ+`Za zdVIQ1-i}9wOu(Ey?eE{&N{Q_k+P?qb^EFbR3OETH`Nubaxxmm19u?N{%tkuJE=8_LW!mt9;?14a0 z^I+CINg-k`$E99SS*3yTN<7dMzb~leL~CBOG+1jsS*9Zp)i~%lujV%3#@@t!ZE>fe zw{cK}qCE9k{C1Df{jCnW0~;}+gX`~!t$!$))Q760SoQl{pb(hL`9%mhmgjS<^qDJz z_h-t4MCIGvLv>F(h?sO0OE%KCLL8_2Tzx(Ha!(u6J>lqAPVN$ImZR+DJS9k^xw{7U zlCtG4Cr_ed=kA{ePuIV{G5Nma*XSrmIpPn*tsZ4!`mxM!N{{7>>a3?G){i1mwud|# zev3EO?B+{tAG530{vE0urKr*!{4&;>WNQ-RJ4yNEYIA#e4#mO2aZhvV`h)ykP4$b~ zs*{XKmqL5EmDa3GE~BJGuU{c~~ z{CkXC-ZG2``t6ViBPRmH1p&@fG?L9`0=?k%(zJJ9ig%2=%ko|SXy?uJ z&e^5CN+l#niLR zd#)J=2%+eEXH5m3LBx7=>l`DH(J5L#*P{k9!`ZjP5(xWkk64fvE91jp}k zMG0Q^w_MQHZh>mNNiC~dd~>r`mGRtZn;KAHhHtl>DeGS-1SZgd^i1aM(7)+@4*p0~ zF`HIUS-Bn1Pa?5l$4>IL85Y}&HY{A9ICk;fOD!R&{2fD_TtZ*o(#xo~RcpBI9VLe3 z(6dY~FE)iCO!Y)fTbz5&D1 zJxdF=IAeUgp~>s^jMoOr`@wwbnMGH49;!kux+ydWt~p%J)`$#l+@!(eAA9lWkZU5` z0-ZENi3_(J*f6<~L9QD8h`J1H!{VCdVbie_-k~h+`k2V3ITk7W>fL*k_cax)SM^RK z;fe_h4leA9D15OuT)fwrD-}@KrcBn@^}%a{ZImjRBST5I@Hf##BUV$HrixP#YHv~W zXK41NhxBz733;x)e{tuPg8BKq_`!*|G|#!PH|qf#+int@6Lg@+kyC5O?f{RzVJ0CO z%;D`1){RQB%Qri220w61U~V2zpv*5=7>AZb-r!5xh-7wLDN$YpQC(&B?nEcr4S9qc zDeCP{ChScHyR094AJ$-?5r(S+BmD{Ip>k!$R8x~KcAZhJ%yo2%y$>E*1=dk zn9N^27P=w4*rk24SaeY8bC3yikG)&rbA-Csw>WCskSe0`N##I>$rwKpP=WTn=Fdu# zg77tEX=($deeSz#mfzYVA36f&$G$f5ddRX$cF&mKp>Ed^a=Su9nj2M7QfHfc_K3i% zWUz1Xm%O1MT&39y3oi5m`V=JJZFC{O%(DQ(&BJM)sE$4Qt0asFXo*`Zs&3VfVSP1m z&E7r?kfBXrm_j8P$k|aNq_&x*L3S-gOn&%L@)go07zXno@C5P25V-k1=UsVpEWtnCd!>3x~7Jf2fPWzqk_#0DD!6M~Xi3})0c zDr+HE^L2g{0T$Nx;DbYG{wPi9gG_Nv;8a*)0(MHDP|BUVQQL8TWfW5)6&|N8n8Z)3 zY;oZDK-^NVGOXoKCRg8TJI{Kd-e&_tzM?S*Kew{7?yJkS8<>xA0}JJOJyne~&fFaQC|DiRveH0Aj zvULm%6)Yb;s>1pjkK? z-xj{OfT+iOlWgXHL9$&y8l@4B7^~hd--zgE=+lOn?_DNe_|r%^kw&v!*y&-zN`1(_ z!+K%B%(9fN%YY3t{TW9swqjjzF|D~+px9wF7*T&8>UXYp{l!&ePDUp&naGr{8K(kS zTg469YHMbw$dL#~-o3Gid(y`qZTD!1ufv=VT4(ZdL^kt-h@7YHjsshFvNX>eh%?<5 z>8K1duf_ai88SJ(c-Bn7H3&CC=8T`Ax-3(kP#IqftqWgmnlFnv0bg_0UMmMq}LI#|e)doid>s zQb+>R>%LhEVhNsc#N29%%%#LLv5Nc1rtb#GS#$ zCNaiI$h>fxh^`!q#2#`1Ax39w*024f$Ph>M4dgacSRmvB(6zBcpXdueDTq(vM3sD@ z>im&3Q&(kauQt5}H+zC^-t=?5>#qTV@VUf{BVH+0UA%xy$e^iRH5Mj=otd#V<=((r zVE$svrd~GZ2iBiS03~R-(2IG%*LWJ9TIg$`Y;dL<$S@vVVAj-`z4>3g7V(@Z3vu|B ztons5O{w7$d*GT)N?~77CvB%{Fd(3D5OUH>C!cC{HP3~#@k9kRmu)2jEGsaF`l4Mw znSrxJ<5+r7fmR``(i*Erw{8zZ*kZ6`-|M!1=-FDYrcC-K&p=GIH#kKQVEY5GQ%pZ)z>$>XNp~C}@0zuU@6_G=*Zdhtc?*yJZ z6xr0;OyzgiYmfYKm8YNt`^@qlx0a()&JuTvSlrqb2Ywx9lJ3(-ct3D$h;s$>Hg_%hDz#>Q0FrMbWDUN}Q93EKmA2}N zaxoj*VaBEMQlwu0dD9$yCnBQ*SHPp*WxRO@xz!DP^l6;y*JzxCh=_YU0uiVr{=)Y# z?U7OBD%?HI{%Hly7OcdY5e6WI7IXP}jW!;+@yW}5*|YbC@K9^eQDmH13EirI%2Cpu zg0Dj}!%VPV){LSl)A2LYNTPPyFlY`w<=l2v+0fhXt4Dc=^_%Q=Un;-L??ez>!Xl%f zOgA5<8bUq?{Jj5~tEuF!8$?0g;Qtt8PH#f0;2OJMjFfvhgvMbp(6>}yV+NFGa(|dhhXYY`rI!oT4CLx1UIN%vx#fx@k!g$wixN*Mzp20 zYBS!&{aQWRcNi;|Er8?keq2EJVm1E2W%=S=+m+-SXQcb7kl=lF)T|$xi=<^XL5Cv1 zt$J4uj6OLfxRK$|yvetLRel48HK2tvyuzsz7{BIPvNB|joiSux_C5vDAKW=2rLOU@ z(T0MZwY$PtOCC;Qvb0jC7Z8cLeaFQ5N5EyE-?e*^Gsx^b2a3+sHPY_eB@Fp2*PA)d zi_I*6+`E}GxfcuUrvr@YA_d+DF(ASb7Msa1$Cn&{`6s2~cQ8 zjE^7FZ;L^o*%L*1^dK_yu-&tHs&(h?@O-E2akBW7bU%+#hpNJKwOU4f(A}|E=~biU zhW6u_VJ&1Pw)e)Qe@qc;?0LnP>!^vne0K5%hrUjewyNy({5WO>BtG{FZ^^(5;@$MD zGzoplUKpIWY`VNGKhz z3KcjZU^Ec!!R&|*-<0%QoePbDHM`zeU!@y0l_%{8zV#RLf9I>4MR5832>BfaaZGs~Z4V1Q+hRwL6Qj_!KGKmn%)D&xSF;_`3I{VSS75&XkY;0V z1WT`%`>Q%c%FBOBFqBwBT&PQTKUI_+YuOe)jMsVZ08wrqauDxVii9Y+!GcF<^hTdj zD9*Bnsm!Jw`IdpzPXk)jy7I%-?vZ`FfCJ~RT6Jd5%VO5=<(mAXOeHr37%iUKoRz(m z*x2+979u;onKgUb8M?T*xH~vF5F&jLsd?cac!Z1OB;ebfEOaIGwp``78nHQ^OW?Zh z0IxG5@EB_wUXDDOPvE*5ARv@OML~J{3Sm8Nd3(aHA6`oGw>;;#dQ=mD`zxW<#7Q_} z=hCAAFbVOcS}sT#GvP|#k*ssW&$C$0yU**>_1;guNA$;!*TRd;H~iHneU9D_ZC1%> zNO;wBis}ot4;Nf^J#E7~{5FJz4Jtwpo0kTb&J!aZ*F{f`SIx~Ca|u-B5>AJOPtJNe zUku4Tyk&VWQm!rPD@@s?VRSeF~ZC08yphDRc!zWdb5_pCDO3t=8b+ z;=~dQk>o^6S#@MQdhz>J)(xhPX(OGO{orp26$QJg4oYzB>wlts2e)PpZODE`b&@2- zIOmv8mR}#Q%T<|9Dk0`JFucu`ckMEgbaz5A^WQKXE(!=L$Qw?=wLDXf5zMuIF%g z`+7>f=Gs2i7PYdx%kKXAx(VueVWhMQhKoYaWV^f8)x~<@zkeg2R@Cee3cyo7alE^e z01)u^l1=?7IodE82I_%4w`Mjik&(1c>6e_bA7?0bx2t8gI4bes(0Irno$~v&5F<`N zA|XV#!W%ZdNX>yKPV}r7#;~SC`TEOWyNgbHxH%!bq#7f(zcgJYuK*g!t(2@&l8*=z zu_To>R01DGj)M9G6YK@iBTs7xLKGgrBp?L4%n!gl5u!wxOJa1SlB%jeMx<01DdqKs zKHt~hU$EUDodhNX`1VYAU=WPD@%9e+Uk)p{P(5BiVw)2liR_Kq2z)|c*Bk^RV<@&6 z28$wo@Rd|>4ya!N_L++{uB#F3X=*@8yNrVMUs`}Q_HQuyyWL@|p}Hl)F&e@lRh40+ZiAKzqU|b&Th{m8cLCVJmukU*+$Q+_Utk3*1q^gA#z4{)Q`} zbiWCF-1?pD5kWEVs)r35r{G&y1<`nb>#=5=Bo$$V6x#9M@8*2r55VUF9>nrKLrA$1 zctrL446xVM%g#@L(HDVQdFkTJit zxZqAN0kDPrcUsh9{c0{m#D{JEx=umti|CuD*#(o4QCPlzAkH8)9h>QbF!u(?DDkVn zGh**v_pOJ-k)!_b@VZZwx83*rM;vuUx2+|{E&L%8_J4-a%gj*&onCSQ{Vkkipv~)F zhRaWbH^;y5hZpw^Hlrvq0I4F1JfEIt#x?Gu(&LIUi*|+x1PCc9X?#X(>AoRJ(ke0v z`cWtlT7NIo;QYw%fa`3~IT)Cy;I-Ozk^b;vno=D7Pge&A@6Qm!#js_%yI?Fsd*b|a zB1J?T);MR<|8-SF{J*$}KmNKq#wD_c@z1q+-9Mg#mmw&kbo4ubfRwhN{dp)T;Q`S+kN0w*&CBgm%ht)uEhLQhQ^Y5@a{lQ+6>seg8E-Gh zE_fSa@ABW9bueA>!c<}42QRq5ZgDumsPkeE*lE9nNN;p`d&2zbkG3kINhXokuJDCm zu4;4b#{Q0j+3Kfz82Z(#{W=IT#7#!pjRCtQqd8mNZNATEC+pUW8-pT@a}31s zT5FG>VQw4z4#4v*g-kAuhH_c1C$hjPv9I8DVhTfE5oI4GN~-=tg>3t{XO{ zE}w|rxgqqLs~fiAe;fcfmmB_Cx(jHeMU~I|_m@dPH`W7_*whM48*2mxn=%X%kUbEJ zN9f{qpmdz;*t+9RM3X|!5`vxPKmL1A$K$o0Y&|n6KM%80R}{TwU2^6K$FKU4uqR~S#M6Z5%;k!wqn44u5u*3=Aptwv99hT4pNrRx$moHXw< z)V8~D_S8O%PhOW$Z7WE_ZJ0BY|ox8PeWdZ`{NOAgtiF7`kD_sWMmK`MciOU zO4G-n^r094-1{da}As0;JDv+Falv*jny*NT46fu zMQkT4)>mSvGUCvENsUMO|HR;USO3G{U?)Dph&l#vJKrxA-rJI4uk>p$xY!<~(72op z?Z*(d`;@mn$_~QIcfAp5d3J&DzPM7H|IRLLw6W@Hmob_W9Bkg}?)|C7ejvxYK3wNX z?QDcN@@bjf>nv0Uoo@uQ{k9i%Bp-Vu+^A<Z>r*9A6HN*-o@BkpzdL2O-UBln)p{~%xua+dnoaY5#PiVc zB#;$weyage;fCq#?3l@lksl9|yq*r!HFhVILZN0bSI8hlqQJ@dKvei3ttJ5?leCFroZ9d z#tbKY{uNK&z>5!A$GP;1=fuEVY*MKta;V5VHULr>06s{=tnx)%Z-MEt7Gk$zV9@@u zMC?nr2HgabynQBc2kM19cQ7(Jr+U$4aK_lR zWhp}KgvLCfiiO)N^sZj|*+Kv;`&@@Ii#A-U@g?JB!3}rwT%I;A;VE3Qwl+k`r1_Ym zH}v@1G2?p?5hZZ|;IA@U?cF>$O;Z8a1`?uNH3(^W1QiSVLIB(Gu@`2qLwW5^i+(e~ zn^Rijz|qdRNM+#8VCtJcV}Gg#d*)|V#`-IKd#RDDWp^)(D4~L$jzJsTO_UQsO3J2S zkVfh=ED0}0zeFQ${93Y}8ER!XqRaJ^S|YWmcIpV>+h8b%(5qRhs%+99H3X;kvrY%j z=S}GN47lPxpyot}3CepnXOW>V{wp?Zfrl76ZNb>K80EN5+mULaH?@UaM*jz6*`PGj4GHU&;GV-T3w zqX%Bc#%RS&4SS*r9n0*~T63{%Xja}8Yt>8Y_dzpn3i7w&(3P>(%v?Y(D_1`Y5A2MiL&ubyf6SOZ*gl|D-&l1NLs(J#8;NYB90*=DudHzIp7a zpO;(eWq}<(p6RM$eZ{cNSvIY+9tVjz`B0u*n_~tcf z>M3=6L{AlW_MTW-*e5-C!otDO97)NLx|BdAG(g}Xk_8_ZZz|o@!fhx(f5$}Th7xCt z;?G<@-*u-h$yJaqdhwIGh(&Uq%obeFxtZQ5ZbGp_V{vs(^bP&Yh6i;MR2)}@xg#H! z%`QQUg##7-6p_B>`Hm++Ss6TXk5P{(xua=aRuSY-?)*|^9+`0ulz}-aFd9e&l_3Wm zGBRc|P2W~$;G&{}&BpH5Ne*RuQYfnnn~Nz8g-IJ^{d{a?)^VOx9Y`8NM@;1e&D~}n zC;dqR1Hw0QFI!)Dvv&el-fSTN>nV?jsX4dQjW{uRTEH< zd+l9VSWrc{0ZsLFq0$rayAx$8zEly3sR<@*#kUszR9MF}RqS6Y0XBNwtcOLr0Z&fc zww~rhZLvYQXBfl*$uQ=&s(b*Kt5CGtK%IXj~cf#5UsaTC?X?)Y$Q1{y#bw7AP zv)67GYb_W6Rm8Vk%}gqLw8~ojt7Z%rZWX2sY5OD*TDVYlIUM*&sng5wj(}k6JH&;e zdvUQ&LN&vO@ZKvv{nlt|dg_)G)2#&mS`a679E(!2A6 z94O;WaV0xS#@f}h^tT43k!#Ym5L98xX^w-+S={F|qN4nrkwQ-TWJU>n?t$UPU;~ek;#2ieKGABXI=_K;6&=skF zEp!k0%_=TpbLMQ1qnTL}IeUVr8%Sb5B~4}@gcRZ?C(enO)ADTb|MOIvhc>{dc}1!O~B;8N`cqJ$tnFx~5u5gfEes?Tw= z`>j8w{@l4h#N#1LJ@V7Iwh6SkPcxPNu35?W4KF=GK~*}k*Ulmt3ibVIz@V_ZPmGAf zC8;4UrD9q1*j#eUxO$i1v5l$c%SRH7t88)VM_kf^8R9o#SPFvI4)^gERRdgGtC6(V z-%p6YugLn-kt^HowdWxq^9o9M?y5XGD+Ab2#U8#Eo!5=UQkxd<>GJ^zlRF8?0%;It z=ZgHB5HAp)Y8C%62uH(qE@26#M%|DW&aWM+L1l{TRa9@iqdhPGuQU{m(Z+uFmR-!E#2$P$YQ) z+?{ybH|YVa51$dR5gc4vo^RB`rG5+_j8Mg4QqtBM5zD*Ef4gEhvtL;QcRG?*Is6G+WnPtkpj^ zmqyVY9jHD^d2H38HGnB=Xsa!rZnsNh*M4FyhM8f$IAhs78kX~@5C}oM6R*sC;Gyme z5QCUr3mp1>fL(e`c3rsGoI;YM!wcPc*=pbP4P`XHUEUoHzPC=E!0uNC=r8bbn<;BkV9tfiknlIxm|cA4pO{$8G3ZYO2^Zf?FGf9sB0H*pf)UU`|PDe zE&AMrN5p_x0*ajf203+oLQYZ)qB09(Tw~G=#Ho5_H!cBTiK2&tFAVwN!7@ACWeHtC zqMPgJ^?`(py-TqsBiIYQ{(SM^c=G#*2qPh+LO!CC@J7B7ZpSx;0#@e<@ZqauD2InQ zr)+q2Xv|HIz3Cr#j0?VgR`dr=nt%*ld;c?!H7N(yB97y+DY>&X8?+jij!IYTYRFnM zR_|=O`Il2ATz~J=Vl#6954i5&C9y0hAClSg#ZQl0Lp>)fZUh*|E$QMC{-_BC*`wL}%u>HJBNX`kuY z@_=xQiv~jurz4B=+Ipy#!7uKt9SE>ly_yD8CoHUZ2H3<;BJ%~K9Yqh1)p#cBzW$$` z!1l59h>S@bzxm-=jWAR+)}AW1qm?FcI5Af(my#$myRH28jN z(x)GuI>+BX%G%D|=on3uy%4tJ+ z1}MEE-PX+l+%l#K8T1#_y#<)dUWF}9H8Nz9x|n18n3H!m$NG5Mmko)?ZEX;VLfE$5FF=BJvqD<)uus{~(>??7ND7gZo&4jEK@~42<;l z0)ee3Pi`UW2JG^Q_5Y2z^pV4oA@ z!p)o|wfI5~U|Hc2Y0#;NAH5zVffV}*A+*8@m}!2CHW9ShX7acyytEed@@h)|TFHBg zPk`C7UUrZ_=1{i&h;T22JdVmpz$yK41n#*{|E{RKJ-@j_W_^D4)1}4Pp#_Z#`@_9w z%N5w^tv7#O%j3Cdj}FZdCjiT+O|w!Y55As&k0XfT9Hwt=)e;rJ#rl^iglID2U7NQE<#$wNxF`m1oeZ;5*hvzU>+u6YHXE z?4c{C*qxMdL5YilQn@)Lw=`7rBRXN3A{0I?CB>TzAGUX4;;%@4c#OvFHI|Uh&c`V_ z9+%7Whz#4qN^4b#i$>Xadkdr^QAdaI0yrO&XRU;!zw8B!!NMclc_TSGNDu(2!DkfV z?3xoax|0;N$ZqGYlkvM9m9tix8-slljX6n8KrGx`T#5v4(|hLVQ%BmyB7@ZT8oN~Ckb&* z2K_c2KI>RaKa9Db&CVq^w3D8_ywJr&tR$?k5b%zcR=@FCK_y(Rl1J+|z1*K&8#>sP z*R@2tDb_vc!-_sUOu$jd1m?KhG!xV)pHBrB9`ZYH*w-12aE<~1lH0HsZBLOnK_y+a zR#(zj1Mwr=l8j}BtoQEu7^vI_-u74XI8HIdxuC%ZUIzeDuCTMHspcnzMRjMn5kpAK zHl{x?6CK5v#BCCdAeOl8LP0tT8n+`PBatWp=oD`5ejfe#yuA$wT5jZo+Arh0ZEBIALdCEES&}4I@P3~;8dDraC_@x( zjrwBUYU$Y_Xc12!Bo+x%+w)Rn@<$Y2-zbvGu6P!$$~v#%`-ZI#K8}ExIh5GMN2l^~*BAE)@aNg<1*NuTQbo zAsL{5@JNI9_a#qB-Z!oyFAq1!Z3o>tt#cuhmU<}4m9KQSN%0`KA;{_Jhl&zR6!|MV z$8gGvn4=Hye%)IVFDYWYPz_CoQVRI;lc?99iwpS-&_;eu&FTn09zc6y{DxYU&>}L# zcHoIsjZ4U~i?i}lP@#CWIbLn~skt;nz!(9Jng1FR_wOH--4Io|yN{qlO&jlMx#WQ!6pDv!L(Se(i|Ii4p&0m-Ji;~Rd z?!R+>Jsszjfq(bc>xcg{rvK+^K_mRb9}+|)QU!S*7D6-0geaS&ao`OwE7wy*D{3cp z{*4t4k~aEc_zL#I`1=C4v(B=Q5Lvyf{$+t*3BLV37Qa@o2$*kTrK0Cds|mI}la z73GpvkH8a41>Cl86RSR4%4@h;q+y$^C&g_nz||v@u=6*;iN;r#vkG9exHKn!H{Bsg ziC!W>Rjj25oL@W(%&cb%Q8Pho%@4H{?!!?MiUx9AS<(buekCJ2s43~hRA!PCd@%sV z=0I+~+7HUXS{Ga;u)bM{$l=KQX$D%oEozj$1SHsCQJ6ORl<5%a8XzEmVsvb=9|Z6O z{JqHI7adlB*29w&20qfMrc$-b$mzZ(a9xB_gq zF;)Xn;|iQ|`6Frx)AQOcI=}hI3W+%|2oM>SN}^9JO9kOlsb$6kMXY1ym1&!_yh&ob zn*s0~D8kTwkmB8c9k+7(|0|Ic4ezLPA8^hTgyV z>R)sTih`0d-~*5?3g^^z(T&QMmY`#4!jjqnQk3Yb|3-9*iv4|XuLmhlSFGFAi*f7b z`}u_ugSn|U83ur|0l~8{cb^MyOgp?ZQ1$OZ2!%Wj9SkQRgc${yeV0d=nKM5N$v_64Fq$tor)O)u=&) zhGQ%Sc_PbS-4b2U@NT$VX3Bo~{i9vM&oWgToD{&I8((K(W>%PwHiRZ2CPu#^p*+?j zOorL!=xIIrV_iVWThDw#a?el{^Od`ODukkR`wK;O@y(ysq*^15?f)&`C7|%UI|p0H{X)g z>ceHV)q{1;V*gRW%%RJIfyTBfET7WBmwTR_Hh}OZx3K~YMi2*%y*FG4m*JUIPtv4~~hYQHgEAu*SlfIi}vnH3?sP9?Y6iK_Ns9|D^@Up8ntQUf{Lt*;*yyTM0@V zd~xF-PV74Fb(M9~2_WnqI>l0`JvecNb}@gTBPK?+VYq$J zZSyv}Ve7t*UBH{l%WW6%zg}knPRVd{8G75!s|{>bME32A=PS+j1M};QvgN7?of^Vs z@(=X3m+AgcjOMHA#5KH?zA?Qf20-#c@pR%)=UI@bBR>2GpH*i6x)B|}{;|H9dK&2? zxn_HYtO#O&Afud#_Kf7QD4@3bmegNN-(c-omT*$JfM?mPD{#R6$?8|bFLBCZnyJRg z9kJ>1>o0~tK|x;b*%-t6o0B$Lzy&T7kVn9pL|LR?r+0Uf!?Jj*ye83kH3voT)NBP< zlG-WVQW*fsiab@CB^7rlIHy;Y38;A6$KMpV7o5nHL%ugNWZ)^3lnfYy&zfw|)CP6S zRok*x`l3(&!QY2W=t=7I<7*hVZg;`h)B=o5)lGbbZ>?(2lVemY7#WT8Epm%8KD2x# ztoxJ!c%R-OOCBC`Q|f@6MM3!?f~V-tS{oAPN;Jv@zUo_Y+0$77(-7GE=l_qSS!=Z37dn%~f*yl!Z>G_na3X$Yf0x}Bq|{afWA8kP4SU+X|( zTutPWP{G4@hLhLl8*BruI}Y*7#tpKGPnSp$K;)J_h+={EB&qG)L?aF&b)AKmR~{5W z{$?=@#mMRh=mf(pR0lxjejACL+b^?IK$%IsUfJ|%3kx)=lxr>CHpEp|w$mwUeX(z% zW9ZYLYq$O2UV|lvp+TB}JsMNJ6P^)K|L`dn)lcvJ8F zke$Kd5G1&XyQXGJor1&53;RZA?TiQj(xkNfbrj4Q8vjs*Z1_}J37P4?i5p=tZj98+jeH0$#AFqkR-+itUS@)Y zye9gZG+h}juJ5G^(h?hs4-JLR61mfN;8!o{NmJEoWxl-m{+sBz=Wc70ZjMO$Mo@Xm zMbw^dv?wO?D$ep0-9Oo9`(-NyBR=hUod0a;q{tv11a}nAnGagW%;K<)y66X z!mc1R?YxO-)lcHA%LDP_)U+`$fB9PrXSH;}j_ zp#LFFJH>s706f7v}hSq$wj)S3ZM!3kSt z`#bnte=y|4up2dCqF78fA)$^qFy_Qh4ajWLO4n|*m)f;c-5>l#=8WtsJzEmk{oUzV|!7NG9`1lIj<5w+W+Dxja zgF8)%$ru=XMpx ztRLo?3+e(mooq^F3{Am|?=A#bHX-PEB!Fh-{$j1Dg}uDqBG9c(|6;>&*PZfTnH>P* zF61>_`5~+$%pJjtuzT$qKia&_3RF3v*n6n{wVDf&ezTK%ET6?F7)>Q!l7E|wJI`yQtY1ssE~tH5Ivan`oGOd=iHDXqB{n z*}z$|{z}A}FT0r(*aF%^F+KXBCHVB)0(`ua2-X;m4c)0jaYoiwtyO=hZk4v>qmb7l=c3iavB~)K>r8;s6vqU*lY)=sngNgQMDQeO>E59Er}EQ4! znjZVb81OJH40KFc??*O18IBrIEXKqB7BC+{TN%z->m;W93qJ$$5vl*XTk?<4S!zeI zS_&S0vz{^g(N{%BI#gy}sIH@2h991Zm;BJ6#=MA}U7u=*&o5BZ)l4 zN}$RfFp`d}6n1;l&jOb4H*jz2{ zO?5Ys{L^0nYrj>b;q>e1xp0TI0EKbRaQy=CK`k)9@>a7_6$D62P8>rr%vMem?p~eF zJ!C@JgjqsGI$Q8b(GEG-@*Yb1#6Sk1d;jhiyRMgT;!6G8T^c5nHy>G zF_98{mC(G}NyUTYuVg~{q`Vu}5he6MivW5>UI47A3LscS`6{Ex^yP`H7oc^^Mp-i# z3u@4`RD(`hU@|edgO0PbqN3u^$M-4AfXw&fasj~Enm$=GI5yzdN5_xIUeK61%xVUv zq;0-JAlXm41SoYtzEyD9fha5a8TJloS`%Q(&fiTd6H4qQQds}8vpC?={JbZQ`kmHj zXQ&AC4_@V?D&S5ec0+*2{+7#(=o=BtRtxI4AW?zH-^8SGl%8 z7HTYryF3TNLFVs3`uUt+xSJ^fWg?P@(-TT&c_#y??~%y-t6RroU@RI}N@5nISUu=w zKXZ9PC8f-?)&rm(4;JkDp9Dr&1N%lduX?z{xd5rFEsmZ;+!80d&LaJdxpiFPHv$Ur zRgHcTDRee~$S zp82P8LP2*BBi&nV8oMp{C4uP&y}|(r@x*GBvk%L`6@U7B1|Y?&`&o1dCGRB&?XEzi zff9T&&ynPZCv@C>ufua|Ggc5L-!Zv=IYZ|bjV+if0JO6wR8~|Os=X8uIHS04X}C;Y zaF^-qiNE;#^j0a`bR12&ouOe`;@efEASt%^;Q!9vDsn=M8F1vE`5!xT*pjLg3@?cc zx5kc7aoL)68AGU7Zi+E-V)z~c{h=WC?WaU_QZnkgC8{kKgW#v!v~K`(bD>~OxDZTQ z;-vORb&s1jTZFW7ya;J$jz3WMB2_Y^Mi1_^n!jv>tA@v=7ix&Am{5?u~${hc} zZ8SQg3ug;7OJKtSi1@2xz1(bBA6jy-oY>Ke+N7YKgl`5Z!VJtH{v5j~r|>cs_rOhC z?IvMXHlZYFm~=;f1Hd8* zRB6!c_89_pIde@9090VnirWfge=0Y-%s>xY!vbW_p~Zze8kF6|4U8XV)&~JF*Bp+p z*+j<7?O@FE4h|<2U&~QNE2U^u5yJf&(w5k9Do2Tm$1q73tc;4bx&Xja`!H?M`~$u- zN_z&r=LzOxaX-P>=uah6tuqS}*;g?HEJXG`rO<`5bgNUG>siefkbb(s%QR31S2qCV zF)S%5UEhCV1*o#+XdT+oEJx+K7IqQrfy2{DSh^O>}P(=zNuVKvj8-T zZuyo6Eu;l%S91|1rwpDmu0>{(R1<(E;4>D$*q9=XoJ*Le*ZbI8nRESp3b6f*#qcRA zU4WE`6J0y&glHsW|BbF zU4-#dpii=?{Vtxh37C}w&`@+V#$Ir`G+SXFmeQ*&G)!6QlkT6O|GWO4QRmP9>hCdO`hWNL`~jJ) zxOYfs$06IGB}+a<6@@lsu*ZvHw?Q{EF*A2X8v;lEx;S7JQhg{W<`skjLCSz=c0)l? zW>A?8W@eaAuOU)RK)D|Ds3@ah93IrYLke_sLWQ<6=kmsb%K;>Vw%UZYH{|Nm4-1#;N;rJPjt2oRP#p~qC;`tS zwNz^1#{Ek~ZBI#vXD3JouSUGB;C;eLx&-LIHS_UElXMs=-vJt-kY9;&S)X1I&0AXQ zaz(?11~L->s}*&;5zfjJ%QclDjLxAwUYSF3mgzX!hPxloCdN$u8 zD*dIye?=&jc^=9@o3B>dH!vPu#032IDoxI4#aUnf_17{ETA~?sSPA?#sdx2d$?fX( z*t>Mvb9DUbwN1NA)bDOqy6Q8`zhpia(9PDlzw|R0&SGC*T+kqEyTG3uTtANJ>|B%b zIzpbPCb&bF^Bc+2Hy=Z`T%}tVw}~yzHnDJ)Th}Fop_V zx9;0KjK!`a;}bbs|Z@D6yY)=~}Sz*$C%b7B`jo#p(lAgA3qh6DdDl50*EiYFlwvz2%fG#_TA!M=HiEtg%gaYv*=+x|o z@w&fKY_jwAT}ku~_VzfLN8LGT3h?$saye%L(ebJhjM_s_e;TQ7RCzhWc4&DlpM&_k zzk{mndxn?(cwde2FtEDgy?+mx{;Uxaf^@ZttN z>ec@*?NFZh7rJcw#pLAKV3YI2ebt+6sBWVnz#_WNNjWZt3Ie86J%0!8#&Ry3vh|HF zHk>A0Qv(GtPhRX2`0f}iZ8B!mR8+R+2k(lQXt$EkFFotYF=uqTrjfc`aLCNGehFHs zIn4=q!efF$YQMO~6kv-)`0eoT5*=QWl9%V_=hL=M$nU&B?<;vmM}|j6M)*fPGIkzH z+xVa=wCSv(hOegH=dCh1KKC}XUCdNabSMvF@VzWlTYH)lw!y4JlfmoR@CCvR1ASHp& zduRa^rIP@mNJ*knLI?q=k^T(2_kQkkpL3u0`MmQ-B+ew6%w(=v>-Sy1byd&06HO?% z_Qq8_|He#HJKN3HQa|&j3Nm^!tz$>c!nr~ogP){ze(V)a77Ozkm;OCZ7@b{=`A5Gu zVVkcC2HnScMGtn}btdknwQTi%Zu4cp$$n<~CKSopA9|Rb(|d2_Hg9wdq!AESoph)$^E)RqD1y zZ5)FgBo!>4*>l@-y2GZ-PdB_|KGu)IuwddgjjT%Z6c$z%m-|t%WM+jtrBEwh)ufnR z(|`tae@OuL$+Jh3H9U{aGUO~4UoVCccFUD|>1jtdzx7x;VqRY-cPqK$+OXJpXOoO9 z0cohnTUeRz*A149_Sar}vza#kG^ecqiC8y&?#zB0D@(q>8Ph3`yqpaxRII*B)uqYx z3Wt`j*!pQF)M(3H|1O^8ZwpvCTIN{4IVke%X+MwF#|9mHE|*mkLx6<#+b*f2*JI(P z*_(^r_NcJ!boM8cxukHXEz^$}*{CdSvI=d`sKL`X*A(PF?dp9QgQ8vS-<)KaM z9FD1ZLO~m3ZkJA78{Ar-YNXVHOm*vMo^f31I^aPB`r$#Zs721I0F&_PksF(uQXccN zn#2eZWu)vZG%jBGyZa;^<+wFywEFND+jy6H5x*_K^G_e;Hc-`qN`mLsg!`tvwOM@u zli(iaLlWVi!ye&?TKK22u^u_~Ooi_)XD&LHyW(_a*SJI12Q`*IW_l2s1K|NVxl;{b zXZWvnerA%xw8|+H%Zw)iKhVWinb~w!K=Gj6Yx(to`$Fh5;Cts#A;r|S!#&iG|a0j8-sTuOZUT7ixAUa?*H_5AQ*l=Gh*qoXqm0P1P~ zUS)^B3bZc%Yl(n3<2084epVvIE+ejZgieqX_y!TYf`6|VWm$T4^zV)S?e$T9Z+@?F zpCV<4vRNGZ+n7Yaq<2j@fIs@{{($(oDccSaB;z+_#l4w#1L7#4NI;~T{IuV35rZBO zkK6yi{URCIyQJsw4u5~ff7s(Si2Z|tgE;<6u0iJB(Rd3o`q#JWI|A%3u%s4SE|X)P zV{cptR1s?p)Rx&N*R-s3+Kx&v5C?)k^&DHcSSNx7#){Ic+~%BF9l0-^6YK%)-JB zY&m&J@k-;0Q00I)?WMO{OzPm*mFF6x98ArXX>}8cdOxa$DDpy_^P_|!AHF^rV{oHo z@Ys}gI`G8Mz_}H)04rGavRO8ILkkT~8A%5XGMf&Yt4^Ti)F`Ylk1`XdLRD3U>s45G zf@kSz%oaq7)@RThRWpJ}th`O>Kf7@w=NM?*3jHHVNyp^>5f-Atv{Gyid(24Qc9F$xuqNi!aFfu{%(nM z(+P>M5#-T}{4C{!L%!n*-+lrlX@J&{ zuEo2dwOq5mi48~;_NQjsnB-HkV#^w~S?G*TE*}y+(yS-TB=%BGdGA&!E#N^q=V<)> zJm_p~C7P;XD<`Rj^mn%#-=+4K!rV}<2DgaIKT_eFgzm4N3@x1+5@jy}^(&jPB|ju= z1$)g=r`((orP6#V@-Nfpf{2By=Yg)~cCYug%NK7vZXa1hE|WEeGqe#>mc+jQ^G zl)=P;ft-FIZwy+|kAAHL%ODr7?maY2$vAUsZz+r%9_bqmJ??Ky99I{%%`4VisorG3C?F{X_Tvla>8 zXAGUCc+W@jYEKQq0zF++o;y?N%n4FCgyGktTzrvE4ka(?=sbWUKO_Ws5@vX!lh-~z z{M^~<*7c2g!LoOw-@U*eLdKF@z^LteHVHJvv5$qFUu66WtNjYfhhZsF235!D>)-o<_oc7Z8Y~P& zZ*DJCkWs39MCo|38YYy3?_I27F^HB4F=rhqMM`snf$OP)Lt2gf^6HcG%I?=8UN^!& z+0G3W=2mv_O?+Q)O5Izi*4pycRnC}hfVvq=n%?DTD)htcd%SOdf=M(;Nm@ZGN~|Nq zOM~T;@UWus#`&gJ-y(kj6FFqxqQ>&ciU$)1HsJ@$XH)|gf6~IsTfJ@Pdz>X9Qe|ds z{jXdcnh=I5NrTZR;%F|9rD^FOJ3ZZGs7kMI?TptX?Sy}u{yH|JM9llJTGg6kB~#|! z=!zoA@Rgy98{2^%^6p(RlyoLnA{_V5Ef90+$w3A~Ba^PaD;4rn{FL^6~(k@y#C5cs=V)cWqI6 zNZ&We4i}^Af#zvWs7DfIGj0B#LFGd6D@G6~Jn@Gj(V>WM=cw-KqX(}pEZdU~b{^$v zoYlHbi4`Q*bIWM{T?>GSHjBAWbC&2C_A-26;1pyKKc6*KRaBU3D&}UfYQ*cDsN*@- zQfB2{(l`7fA!;Hq(S&sCM+Ukik!|E#EcCQ|_Nw98xu6@{2Io$2#63&2+y@J17<|g; z`IM2)Tb4Wu52U;i6cf>mk9SgTDJInX>1BZp`PM00n7Jc6j=asr%vq7R-($+WHJ0sW zF{F>PIF@&fJL=pm|{f<8GA9+c(i5A zGPD){xlCz)(45ejLoQr3JV&z5*d1HKP5NO17i~-}5U@*k;?KD0daacJZ3g3a6la%u zD<)L^i?+n_bIygdvNLDd_*UXuLgkwKT0{S|n8RV)n|$#iJm~GYopzFtU^y2@ixRu^ ziHnf`M#XGva9KgJXqA?nk#{yg9{UZc;B{c0g zeeM~`@FrD<>NeFj3;zLjEtv3}GD~r|QT8Cns)&}1FEzsnz&rXDUAFoLfWy35eBHRC z#kBqz$ZXS$*&9qhG7BABo&sgIYRe%L-*Hv`R4lB>VxCaR(g*QQ&cKTaM7~uB^8v|JgJj?b7&G zXxhXqlf5V{hf5CrpnbO4=ptM7u;Mk{_a$1UA~0~|VnL}ir_}U9#rDY6V4La>Boo6P zS$+`<%~lvFFEb_DTCd6p#qXGi2YZ({wM;WW99*O@1>aroY#l4UOER2!M(SwleK+*s z)HOtD-LvWQo&>S>=E54+0;YaxNqk4vNcLo%RGDHmNJ;8-N7BtGIP`R4U~Kl}`$C!O zPHp?-2_n}R;eCzpQoztR>HKZ2g1(h%Hjf|S<+~)jIU{Df_tLq{2fW(nti}|JZ8;Na z#Hu!NB0-^>P2YQ$Ug+MlH83{Px3+CN?Ia0-+#@e;@v6%iOB5%_+1BQmNp=_cM!YYPdr?r@#8HWgpG(Xp-Irk-USBwgl`l&L?} zM5QgZ)Dw(s3*==SIyTr3mQ^TEA%~%IpKeW#e*Dv2Vw|fdRupwifuX1HVD1^;OU^Hu zvBeKvD|q{kvI_WG zyD7YFdTQLNDpKoAYB^Sm0A)fUyp4wO9uptjMoJJNGvn%!J769}k6pp^4e8u=^brLf z*IN4SsjNr-FQ?Ff=IbGDUl3id!q-1VBNFA5cu}_;8mD`&n>#wA#SIOD^0f&i;VOFP zaLrj^cO9V&me&$UO-=i}42F$^b@yM6JD0i6vrI>?BHXLR;Q}9Uk}_#3ytNC^%nZG)X{HFvHdHBRByoJL#>7$bT}aR9sT@C z@QA6gVW;eOe4EH0L6<7LywACkf*ws(7&50ESXzkiT<6Pd(AGF8Yus&RzlzQi`n()g zY>CofAcR|9b2>+7_P(edWD)E)?D39Q*+QGO)>mb7N8&|d!kJ`;$e`h{=0P0tN3Ixi z_-hEqO~}k!Lu|R!$WV>p5$2(gyVTL5dL93y%1MG}ic0|k*DijRhN>^K8%{;{TSL3a zGrl}5Mnc7TWI>>X;E2GeWKQB_-D!`%#uN{o#{RPJo)c}M0|4n8De^(+-Yi;l^j9tL z;foDcth6u`S?X#dZvi$gO7~I}4bm%_9(_0ib?*nIYaV5BEE%|C!H-Myk?DINb9nQW zv`d*;A`J(%95OcC_)0pPN_xc_)!f8hof!m zlVN3jWc}2-iAz(jC2oJI+Kwe%3toE*v=B_$m`-6^#fk2RtE2bdy)2t*IW5_=CF+tn~$&8qpMD#zw3^$-U;iYL-dj*fIaW7?5YMgOS=>6w34Hk5@Dv!6- zz}Nwviy4!6lFqE~F#b!2F#v;~`{H2lOV)cm*2E*V`BUcyB^qLjXA7Z}{8|4nR@0AD zWoF2*YswR)Z+goNx8=y{``cQzn{{8Pp9-g#M7P%9rq{#UT$rGB4bLdPe3XDQ$oBq* z7%LcY)NES1Y#o^TsbUll-WS{~zn3hgUDCJo6t-ANlNe#XNZ%OvGy7Cj%o~j-{5^z5?eo|bY|#Wf zRhX~(qFS6#8fUj25*W0lWc2;X%ki+X{;c{*uK`{nmsrDQ-+F$c0t?Je{fNxtDmJ$A z-uHqC@8;ndzfp9~8HVi9l!Kq_K@GGT9a`4t%TwwHli|a}>}d6gB18(?TzGpU!H7s! zfiu+t`OyIfXKEKa+F9ON;}`>V*123Lo%6M2DcU-U8IqFb>89i*^DM7_$1yt7H>>rA z)XUb6n`mry(j%XT=VQz@o?J(vNQ#w?&(jl*wiX!sz-pL!|7=J_cK~**hA_}r`-9iZ z5XmZQvW-vxK8tg-A-?|6hHqIlfy%gJLq&7Vilt$+Zd`!K#eaEf-Cb&%DbnnpV!%As zlCIB3-_equ;H(knTEc~FE_jDt>$43=u+5+e93@b!oIfimDZWVw3F<>#})JLOxO>{$|x@;D!-p-YVV_kq0qZJo}`*gHZKUN9hc zn+B8B%yMBMe|<8d9SDFG!kI|5Z>kppdjFJ#e=?e$I;JCps0dAB1!e4<)ja75rXQX? zn*DB$h=4h>k9!__LP5fX3-{+6!V_tYjvv(ksUX?xbHDoBE9vEw_#TI-4iZuZ^6{O) zJztVqx2{yqbwiQbcSnQ@4K<7XhSdizyF$g(<2I6}Gupm9lUx~#Or#HaMOoc6r}>873{^OPTx7u#K#sK_p#}tRk}6J9@5Kty=mD<@=KX@8KP`H?!fQ9Ob20re6Yh9 z9B2^44^d-`3NKkfhrbsaQ!)q&eYhHQT62knSNxhawm)k_Xvo%3@J==}+1)}rqK_oP z!{XdxQAqSypq2Z=3ke3Rm1Woc<;X!-?B3gChxy!ze#6aYZ4~Ekw2Ape($@VE3IGKAoI-5 zZ6AgOy2#K^oYw9KUL4v|3!gF#v_w!e$%K#x@#XxGMw#XskzCaTo}lI6TT;TaWk<~X zY`^Tj91x$pHhHhtqggCO_*1efH=_u+Jo*+h&GW2xepnbPI&!gYm;T@N?C)^A_o~oH~r2JX!=MWSp7OeW(-`xzVqCQ(^xMnEQ zxab#7676^K<~`U-9)%e=K>F=Hj@OlcB(_g2_TFQ6Qzoale$SgbGI?u#?T0ydnE*&h zPHTI#m&pR<o*>K4r6C@DLgvTvp#le)$hA35T#J-j!S`2Nig zh19sEC9mHCWm|~H-r9W-jUXerdaxUl5MZ%BCMM-7BqIF&S&WeEmCrh+Pa?DuxWXRz z0n_^RFncc5k@zg%f*^h(D%(U>xS>IfY%}lZAN(TUS`5HLIl_|Pekpk^(w@e+H>c>G zijV8v62Gqi0^PitSDkIMNf!ZF;)0uAC6+J{{4#{%lOLB}!(WSlJoS6?=J{W8r7+i! zNU{l%eECQTBOZ@;wAwg)&tFS~RODd@@z?Ud38~{XLvnv_M;Q#wSUM-N_M`oqqhSBS zq&*#l8IUFKjQ>ZvaTR|!Z{Y9c-#$eRb@JE$S9IXf!2y73OzG>0S?_0{Gg1sI{rfd^ z6-$5o-#PZ$8t(&2_umVJ>9-{M>v@S>hDp$``O1K&cBO}{;xv|zLci3{mxZ4 zwSQUrpY`dee?1p4Z6WmE!hOZ4$5hwP<8+07huJ_vVe?-r%xvp<{+S#n0`gy8&p9OW zTgNW($qwCgbxE5%*aTGB81|1lmfi#S9~)CFVVZ7h&(FO`ZrJ$1kmI-{#8bPg8t^d= z%fdauVKJ8z#dTU_t!$y#6Km+O@SWwZN%&X?V zR?6ZikJtNAu=-rg|83XL{iGy9ykixCAolmsi0~xO@k)rmTX$v>O2hP!#O&MF?ot|xRl4`a6=e1jwjej4nIp@T@nuA0sY z<#l-Nt=E#^f1w&X-pQn8nR(}Me|0ehh#|=~nv$fizL4^8)+TswhjIHG6R~c0Qa@vx zAX_*!LEW(4nd4JfTRTx}xwSJrNx8S26~A&XeDfhCF0z*A{gDuf|6$sBfurfa zYvrWmzqE4Fqxl^x?du6ahyaW59n#%^lfGqpxL&9q9yhq*XMHqcc4qHz8lL9Ulvngr ziUC!1*}oZ5HvW)PRP+JCC$@P~cIfGC%;9+0ruW?@ynAJ1R0xx~sUW`(1L`KpJLG{v4s_;F`SKBp&N zhEw))?@k8NqN59JhiPF6*%Ln|C}IoF#OD0<04n5=B&8{5z9h7f2_-Cw9P4T1^=CSuf5h=XbAEPyMHXCu4U2;TdGyYolsRsp>q5RrNDhF@FbHt@LeNtsL5Wx+%C2U}T(UF8y| zFexqTaPdv2f@_8>Nha1|a6pYGA^ZgmB*p?r#sy5p!B>R})m)3UU&q%+BX&s=Dfyu$ zt)U#S6S~9yi`>um#nn#B`TFP`_$cnrf7E_owg%>sk`4}&;mqgOy(KfUHIc^>|D$Mc zf;=kJ7NGMWqiKX?HKCbiP9}xOJ|Yg}V1{5V1_3ssUE)+Gx)Qm=H;_XnKih=y>q+|G z?M~lY=soc=(oypBnu%fa-hBF?ov(oigO=m5E70D;jWS1-=bgF&xFD6#{*lc(3{&q7 z{R16KoyP^mWzo_T^$Eu=8hF}!wc?osO}==$KC~PN4Ue}FfVcuO--lWtKQr+B+9Rl! zMl(pRRjfTp?X1-^wK)FG`Uk0392g&aT;ndjr zM&w#Kt$0I~5N`qewzz9uzizDQ&@Do3Lcdwuee1T;u=9NqW5}?9vmX*Vc*0k{K9BJZ zR_XK{TnopSs<@kN!JEtGxntFdJFjVIQ2E;B;ISbgU|M?qirQKC&UJ;2d2WJ8?SbwB zpKZj_A%mYEP)a$kmbhL_gOskY?jcEN@4)8FuWWQ}l&m$=%5dhY-K@)|HBJVk$W_%{ zN6{Eyrb*#d=tlp|oe}4>Rbm!Yx)Yo0mgA#v(wDBaudAh>K|6f=@eE2UcaF5wjsnJPH$avbT00@7!N5*PZ zxAp+N5TFsEUKPl&I19-lzd`9SK!lP5@0b8t+#v^ers*6>NVL#auEItO$yQi%f*Ifc zoOp(lngm$O*WM!WvSFjVM`soao0{uWs{BRpYE^G*LUhB%hGGjuU}I7-lH9#9L)#-t z?ho(_VLh~GT^HRrLT$(RJbj+Ygg4|Lsk*Rp&9(PnKbkFyFs7}Lrd{x5+qs3d^Yh|F z4((0(0sbLlD$!)(K#}XfP)cfFc;`nCc4uU}U$dnq#&Z3Wj_XYLRAScYQ&w9;vPG4B zHv4f(Ih=WjAi_3ITs7+m-7}BJ`xB4Fe%ihiCRTLmSFz>kr_DGzrsD}t{-0$=1Fc_2 z7ZlkD!(Y(0fYffBB~k6%*U-h?a9aRYSR#6qcVU@ypHH=j9$t907W9J!oC_uZbROo9pabbrl>c6)_yS=H% zq|ma3jCzyZ>jTLoAix-VTBb{yzd^r>XrV$wfAzi<=Yyr4#3r##S>i6s&;UaVG3KVDQvsAq%~zn75E39MV2e5N^iEt@pBD+hd@5ZElK{ve zX}TUF4tlR}6+=_La1KEU1s+ed)qs<3KHG@T9gTeXN%sjv--|kl;mWCE*!3s2N$(oF3)Be=8Sn02!R{JMjW1+ zT*2p3)c0m9x#x@TW9JLXw~pS-Q`la>DI6(x#i4jzw?ku=qNA`IwZl{I@!}qCUtgYJ zJT6asQu67|)Yd00O>zL!1Qre494WJ28$dA*rUKLYXNpfrSMy`Kh}EfHN8QY^>CZL5 zH7(_-5&N0S?r6^fJFm^+>o~=3lPu8Pz^YiI$_wt^v19-Om^2*BDHmV+y)n zS}nv0?*Jm9^Dyc7d7O#mhm}Je1qfLtYH-%S$x+uS*f=n9+AkH&JDTSrHc?V!95fK;QXw-j&|Oa_$x8GE|b^F$`VJp1Ly38a7p2d@v)3T==W{O65$yVV(C7m>nHEh z-8sL1{vkNDx$7*?F9ul-;2nd?V=%|;W z3gLuSZLZWsjTwA%mcEmQMqCXNZ#Z;v;bFRr0dHYnG@?xB2Fx>Le8*fuNSPNK5U?i> z!cThm>#vdyE#_hW3NBYyHo54} zguk%~s~PjI=@Tnt162G>%Dv%>SGv`pPhwxoyyr^GI@@yD_){$)G~X(FF^+iP^1j4E zsDhHhq|lPxTKA1Vs-}H5Mvb<9A%i zMB|i$fcyS?1w(sFs746Ir2AUy9$uV!hOR`_*auRxIbS$_y_;*rez=E~eh&M`go!)xx^wUX3CjeM$1U%SQ{F#p8gwE$`UsvL3|9XbLAo>g(l#W5GrAoPyCbXBm;&pNR>c|REdvU$sd2ftW!C)0A&E#!Guz=0} zwoy%BYxL7MIla4-8#du0Jh)d=+kq>MJSI2Q{AYI%Wt{Az#87IZP3U$i=3p7qZ2K#O zP#RD=SlIf$76a5Fy1y2;+;@qRoH>_kJyxr)PRwlA0g+D}e8ZE@95s?TpkO5%*Cx-f zD_;)$m{q;lq$?=4xLzDS+Eq9_BR^F)tt+oW5Nz1gX zDS*}H3~tVChn7Oc=BI2F?`Bi$FYpEP1}6qHF{`)V=G3e4F!rGqll1{mOs+c0Tldvn zpYJztBKsg)jN)wg3#H{sc$_j2qy&V_mCv|G0?k~X&)`lwZWd!#qn(WI6nz(WI0k1N zYCv{W9rfq{BQR(MQP2LF1tn%mx@hyQT!jp2$_96{Y2!Rhfh}@(Sk~`NSTs!s!20jg-N4@;L`PfgQP1BKv*cu>V_A)JTkm{0yPVQ4nW#6{il2r0t zZ5f*K<{*&FEX~lXC42g%Xc2$*TY{)1X~Pm=>dhr2IVfSkTyiBZK+~e zw8eHnPg%tBVq3hnCQu`8Y1B>9ofcYo_@I=oCKxC$9t83WNGq^658M6G1cmH_ zmIC6~ym)NZv54Aha{T7;K;{vmZXgO$sCb7?&Q*E%`3Bo~8Tr|32#no;KHxAAmNCckY}k0n~RD!tmD;OH9I}Cg0f(Q9~KD$=uqkn4o!MG(#;JfU;IY5El z!5#b)7JT@sc~}KUfB|pGC61N znZ~j^J}NLe6G~{gPA@>=5Zr`W9S6_?QnOt{dp7(!4%s_?#R~}C;2HkCdOvGjK1Z8t zM9*?ffV00`8-!uDc<8yN0WfV52lX3qp~Ul$yu#cKL8=r<8NO_!FiA+RAJ*VUvOXg2JZGzy5zFVFDqex9Hk-V}u4X z+=KJc)VF^qPsRbY6Gh`n<>V7XqeyYp_v7OCos;}fQox1P8I^$Q@}n#BG1p6qwR*J6GW1I*a8=W1t5DEgoHU4>y7CuB(ELHc*iA^XtTz8ey=+WZfz=TaE53 zhEg0z8&fN$Wh84Gw+s9uYL0P{f~4TY?ATjFK^;r|E?N4$E6?4qn}Q-7w;T#`dL@a#7wzF~?ymw1^1S-r!7=Pd?nCmzxAL}?3&3#4@6+_a3$<1)|PSi&?uUGj9 z-~o5B^CXPWkOmbIk|(a&k_>^H;xcmT)0DE}*E(S$vh8L6aGivv3n-y$3~cTOw4MrFyX2Nr0sK_$YTEr0ABWDuQ<0;rU9wY}VTR z)h5i_n_x1hZl5d0x)sEapI!i}I#z9qd)W|rc2B0<^v;2`i zVy9i{Z0p9(POItn=N}u_0$E9<<)s(dq~8dSzz8;f?%?Qm2EY6Dxnqg*7NF-QM*E5V zkO{DQJrpHezdGY00KR7GNsCk}4)Qiwz6b`QyE?j>Zs7u`R6<}|; zbqIL=TK+fYg+U|{ei;IQZO!7ACj9`g8pX{dX6R}{+_8EUir&5PL&}m zZ+h#1{ra`IAMVp%fB!eK)~NhzO@!1E&>RrpWM%e$1Ol z0J2TGxnC5c2RPfCL(T>eAK~~Yt{@k9z(bw+Z^_=Zp<%$5cLWY?CN736=wgRMk4d!9 zKfBu2*nU_C0W1+xv0DMazo+%@|KsrZUs2+JITs!lWX@l21H4hK)3izlKiwVp;Wv2u zVD_&SZQCC?_5a!iIG1w&<@Im9&i`6v7Xx%T2HvM>)7671$0@&6ZGgs9d>+GyeuhW*S! zo$v;&p8p&Gqg2PU3BbkTI((|wQeXD&EqBy*AL#Ic9C)~4PKYo@ZC^{CcsJ>HjeT8E zQsJ@nPDvOvM;Z3HOfbxU)Q>aO#07&m`PPg>{6PF_QVBE0Dp&Tn5x-ruri&(C74g zFiyfCbb|wRnvQ}K;}2)GaM}*XyhtARTlNCHF3X-LMZn&MPe#9Xlz##YEG#WZsYd`c zI45X+Q9c3WSvw9hnUm}R*$r=!y{Oh;8P`RO)M~6p_Mu|~Gw(iC%sam}y!Lh%IlR zfmOCMw*Lata$C>sQ&NJhdxJyECv$Eo<(=f{eH^{0CF~5fl>zJvGXoH6@mDNAkY(ki z?eS3rbC$tUX=)2;1lK)k_VNw$#R(;JiQ1R~r?u`FADx*Ffk^h)!4y}-nhmswj)bjy zby|}CHl8GH)Cs*Q>Fmt-AW|O_Pc)H&)&?IVHtp=AJz23~G3IW|u(Jeg8_o2!Nu6~? zCM4s%KZ3R!Uvs^BO~k$N^DeYCAA#R&-9YGQ(dG+XlYUl-w5a)!#69TgDhU67oG1q; zz5v0kHq|H}u}d>91gs^rdnS7Ei>Du2sTl6BrD+Z+784a?b=t4GrHMy+pD4(s8Yvb?Tr9qMbB^SCR<@JZ`h$$6kZxei6!b7=4Mbw~eeON8 zUW-2@l18HTuN-V?6CwpG^1w>8K@=%S_V#tw;%y65S2FoeR;O?>#mCr+zw|SH?%7t^ zubl5?Gw*V!C;(0u{}orMbzh*12+RO}BLwx@OEt^QoX- zOR#C_6wO8;JqFZ$SZfKjeJ(%#tG5KcK(tT3V2IE$^HF|NJLm-eLJosms+oq?dOm+9 z_0sb$ZBN+^J`882ZlFc?HVci|D+Fgwm9~qp?#OF>#uQ?UFbdArSz~qu8kY(5;g!*{ z$cv?68|Hfpl)hHIL)zxNL3!X|q*}V-I4J_uoP9pw+J28qEZ3z!AHz5s_p{fE%~*1@ z{(+?x{xDHb7C4|HUBL3D`lZl0!B_SyNnR7#jDCM&(+n1>#9PJyNMm%}`@ycxh==t$ z-c}aKHHu+IPX6$K<829PoFD2>QyM#W6sl}ZaUkSO#PBM2ozPZxBp+jO=qH7g zo-L*&BTdTY*JEGLEjbtqSxDpzGphgPJgH6C_Yz3Ft@7J`;wlOQmw(M%x4!60IsJ1H zwH?;<#yWgAuev$zK2CqO04x|L+BxDAl!1|r!&5YRYu+8b;rl@*Jg|)E8ZER3&$5&0 zy?@4a{upsto$W^{>)=o!>XTDPNSGAK+eEv7$ac8dsV+bg7iy`^Tjs9>*l`A5AI^tc+Q;mpsX) zMyHpJ`DMws{eulu#ueykjTE^sJ=I8)X+}p~&H-*SMo{)OmPOgs#^$H2x*81puYj`h z)3K_6!zUexin(8}P}Rr#tVrYT^M3 z4{3UI7yK=7a@$lyyY@B}6F9=nnHBs%=oX|Mh*z7rLlpD6)_!T7SWjz%$BLL|5UHl~ zKR*T<r|I$^;8hc6-AV&d(ugyOkU7K)`(Gi!nw@LeKUz~;r%?uO0Cgs4ER zQY_BRc-f5rREav?uzaT!$wZ2@{ukRz=1g@1`!FZ?-skye zh$ncXA#SdCsrtMYI1Oya@5dOOAJcUt6Z_L+^ z;u7hNpd3FNhI&|0TGB5IOc*O{$*0_~q?=Wt_7@T{Rh6c53)t7RN*^T5UFh8%n~4~s z3N`LM%BDt3G6QSdNH*_IkNpwjG3NK$-B|Lw;&L4YaA{2@UeUX3SJqkhH~P3~A@mD< z09MBffD!9wLt0u^;@~(e<*2W%VMb`bNTu$}vAhTf36fA-&fmc(2Q%Dig^!3oT57Q2 zTy0udJ@9(59$R*)b*Iz|-)LOb`fyKvB+echQm)-GLLnaSv4#wYyg#0 zw}LOpSqtkKMx)xZo&Sg~1{5M+Q2kUFgbfyOrR*qu-5L3{VaHzlTch7&V6`k+x(SMM zJx05`=E`GQ+@YT4TJYUZ4iqEgGqr{sNq6&6WzfME?5A4l`YSb;TOy>}tKdM!ZD+j} zcQS)A{dw+xzz~1tz>J`Ld>L+m1277|K0!X0k8&AfhQ@n)B-Ka=w%*ef zhg_4kSzjaduK2*H#J%xH$E!_`iITDKA2#INfK8W~m^0hkt&@42z13j4in1BT9>C>q zV;^TD+V_XSz4*;MxeHB;vFthuIO(z%4c3*pdk=Ow?VCA^pdLU;f9$A!!F?06$x)$y z0S(|@t;&zgPDiNEay`qwHd=LWL!m=?*Ak)#eF~5pgOCYq&R_I>w+gZ(v zLe;@`{J|p1F&{JB4gnC0RtaV5?W&@Z|5cffpNj>H=0~QEfArUY*75-%=_7`tK>;Jn z$+uP!C!F!V$ul~M!s7xtZbz@XVGgUc%v9P)RYk+g`n|&fd>zni-LgaD4rp4Vpp(zI zSS9(w{e}~UA8z$cb|~{TUv%`wBVLhyIvZ0Bw2~9-mo83gIH`&o6#;P|9?4eV?DFp} z7yn?)R~IkQm+|in{JlHC_lx02no>{4*#m)Jf}3!Y&!Q444*;UpzOnFkT>Q>v$mTUe zsFYEPO&ugd^6@CRWyjWZdyhW64g!@5%tn=~KP~z`F(z5^$;bQHB0^MaLfd-yD}1nRTX(iTZ&-*p6lbqAJn76t)^qO4mhh%TRdQ1-%k%w! zE*_k8qcuK!K|t5M8WiV+T$df6%_;*gv}-IN-M>BWvcFA;9zvc9t~pq&h`kM|@B30; zAPO`kj;!@06#*87ctZ`XB-`w=vuoZgFX|eOF8Dshs;_zDFx4?0sZq?Fw^L1ZMI7&L zsABi>n#V*g9;y`;p9H;h#1HTK(MH$hBo%eh$ctHt7ZT)DHNuKcNu{|VVQ0;rdS?wF zekQD&*~&`vXl;?~ApgkS-OHY5mPD3e!eguu&-RGum?JO`{xT zZqocYM-yGK{XEF8e+Ho*e!8Bd6{s?2{25ZU7PRzJNCqk*CiVI|FwmQS%ggE6;+ie6 zkFLq8R8>iJUY$F}#CFR8OY!eff6kgRc&X;x$jj^~2~hr>5z)_*DO)duvd=%^=&ff} zx*X!gepqMFC7TTRLjuW;(*}*&R5Yee4h@!IwlsOtLTben0LO`7=*I06w0(KYgK@3G zV4M_C1edb$n}7dslk!PV*Je9e&EMvj`Y#0=wY(`UD0{o|s0K&gcOq_=$e4%Af?g5n z9#F2$C|IO_I)?qYTst^k&g5N$coq~9iuuz(nqKE)4R&QJWLmjQl}owx82y+RDSfu7 z>?i4tR5Vp%U4!#;(7+CMOK>M(+NDUJzY*GuxYk?{Kf?nJQ9$C*-{79-6%sfGgNbjD z4+R1k+j4h4&WQo~$K~%Hxt@NBF#IZ8U9N+Z)e(5(%G zK?8929|p~PU&IxP3J0y%lfr;ftyBC12`Q!aeM9kNg_cFmm#tglbqIdD3mc=HGo`x8 zUXvIY45J%AA``U|GD#0E?qx0~j?axFU;+P!wyzG0YTf@G1O=o+8i}D)kZuWSkWOjo zZs|s1P`Vpw1O}v$6cC2)?gr`ZxC{5*?tOme+~+*^KKITa%=oxw)>`j+g-&iuD*6+M8*2AKgK^u3Ent))Ky?ZPYBoH)1( z03lOspF&b(jQs^{GX-5dQ2RG5`@fn{{Fq#<|Iz~de>0>gXaB1q1>|$`U6R7FwguiW z>UbZVSqP*Kxt|*O7$^Nkz8ENoO-vs(izT~$P9?_Nl6m` zxEmMbqw?kdwa?^Ez}=Z_x;=6J697=r$c`ni{ZQ5q`=l7=FRCWL(*Zvp7wdqpl27s@ z@IgHPqbkkP@}Awf)6F4deJDD)8H0wb6}+0oL-nJLnYmds-q@-gU%eK{J46VJL z0nHsw4_EcoKIRNBXW$Ihb*}YFlKi}7W?ez$Zp|=M%*@_Hw8gbgOLR5nBH{0U)qmvv zSMdweSv~MSYo}mAd6U(6;O|oj{_)xx%+Mc`zv)FWhQ&B^dg?kVoT&Bi2Jd(xb0%Y;r6rT1{9amj)yZ{u2)lU z0zK;ALpOS7-Bu-HLe<}2T~cU7Z=s` zJJd&|E4!^fU1ZXg=DaGmIu{e-S9yMw==tN+nd}*;p@!r8OHav)y=_Q3t1G=r_~Ejp zn(}&{>YDqUD>Js!&tVAlt$-hYdAAHGrLJ#I$PAC}4rS~2V=@NUqy*AlHR33E)>SsR zu;jtXT2(|c#gwmVmXI_@gXI?3t!BrQbo(`(pTP>&uiE&~Tn^7QA6D6-*y!}{3S8KO zg!?DRrY&G4;Ej=pv$==Y(i}~dJ3q@OkIqiHqHJJxMOdacbFVGSC#9DUTxf3Yk2E!> zn+_5?UfL^p3w1^F*4~x;sNpQG6Z5f(WT=DU= zKTCZe{uxPgz}X0vLYu$&%*hN_RQn?aSUn-J&PPZ1aoDL|o@Vdz)*(OJO{Cr{AOUGs z=K!P%XlaSGN-}1nDtKPv`IZw(v8gBgV?cxK*uAnDMLL;#_{zfJ>FA?evV{e(#@yWo zG8+-mj`hv-7QrxaZ&8&)4q5XTrrSf!0DCVKd@ugDwz%qz#5HNGTGs1lMMStZi@jJ2 z6V;xgHi>@?9^gG6brH{b@j|V&<~F3)LsjjPg8zdwSJO&2??KBvLF+|B0DjuXW#l^f zpidnzoFPq@#dK6w&4$C_`u(7`nv*U$=8FoX2>g8X6FPxYcNlt7- z`bNG6Ulv-p*!A;oUn|&c#Z6V^^;5bvzzMjEw#cOgj%~16CzNl~Wh%n!G}+_Up@N&O z8|)E)9--sj_r-OSNGBfNWr;h;5JVIXJBZFBtvc&??V&q#cqMM5|DN7wFWqsD;~z~P zso+Z73EH4|q+8JQj4e}3=>#GV{9?rESgKgjpY!*BD8gi-Sc3nwf zI_x1Db=a_omDVHbnX6)(Am1ie9Q@+52e4&2doiBB=HyHxRsn&gA$4+MV$L|)??hNo z{u~=B_q_)?*VV8C4`Y#tsn0_b9weZzTbghP=|5pOHh}$NMt&WOH^29T<5ujl3!Gkk z738958%R1s!gab?+_Pnp?uI{K-4(&kXp<>UnD_WLdUj0=n>@wQYLx|RhE-w zL+bf-0Hmq&lOFT_LByhVUsV9v_)=>~&Vg)v_58sSYL{YV;!hujCAU6HYT4j(!Yv^c z@S{CrBf$1Y3w?2AYiUBV^t3^b+Gk_>O|pYjs@yii&M5y8Qr<`%LA1vynx;X6YgRTO z%H*$paYt}`1~?(fmRLU|#zPs2#YVYTzu+G7lO4HEo*t{$2Z93))Z!VTgS&WhsZ&9@ zHu1F-Z>;h?GR9yEhRTDxO?S7keJz<^gOVrBudaXf{l|K)>2btc%GYx$EIR2T+0z5V z!{r0h(_1O_>RPRz+`T@gwzn7A@BGXGyPQq0&iCsp>!(4+KI-Pp!-R{2)Od)Wga$aX z2I`Olk3F-}f7MgNy6C=aT_;es4h!Vpy11GUUBt5EX8k2At1A!t=&v=tkcp|Q0~t$wOe|T2(%TLSY~uhj zMagPo4~D!)Ph-`qDEj8sLq$1c_Spb4!)*upo762#uX0^v7cPEQ#K3o z554*CPY~Psu={x!49M))wlAXlSm1Uz^FHw}Nq)9fVthuFCkUx5Z9g&Ch}?L0>`LO&H?% z`(CymcI@dv7zE6`Ixxfezb+pohUMR)QjZB>TaK|B04!m+|o?RaNy^Y?-`{Q&tf8V-qRADzxBNjh_dToWx5-Pj@x`^4@2)&h7R@iJuyyBbG?6@F_zAw7t zc7z17@VTcI-VfE6kkNB1XvH!t?x%b*nyaVwXMq5!@}oLE6Xm5`suYZudm0@3O0d zn+|$~7BH*fQWgK|s=IG1{_~F|SJ<1j#fvNzYEp5-e4b&S44fRVbCZ5OF0_R;wCto) zqTP7@im$#sA?v_wkZ(U*?;9h0^D;5T_s(Z*Uzw5OIR>Sn`DlVLi?1b7JVsE`l7uut zRCWpF;^3K5KwR2u5%<&9nQ%w+@?n0GA>!oCv(|8Cs^QZ~{LS)ELLp)BO!-Gq?N)1V z$J{`MYI%z$FnHYB#lrZr>4lVQ0R^gdS8xGK@DEFHz4NF-e3v94p6tT=FnhPU_&;@3OX-gn4U&&x! zCq6-?K(cr9N_O+JxbyDd4eS_*sj`A&<}>_ZPEwn$`gvsAhu9}7$yakCU3(3iTv}J` zF%vG;dW5v{vbI7j-WG|bHd!XbNh5^}g8c9(-bpX+qmIWjzYip$#F&(SwgdM=^{BE2b!5;z zRZw^LrkliG>?Xxtd}B4RumRNu5p!_2WHKTkAg=i|X<+=QqK}*d;rytktjLKQbc=d<)?xWeQqhhMK8pN&E-HNd=$!F$l*iQGJa z-g;VYgt-Aj=40GspT9Qw-Vqe!AoNzn$)!{A>Uda=WZ2`p88OU^pK(cHC@!?`prHS%zNrOOCO!|dR&W&yvfQo25qx9aeKDPHz^UjUq1vh_2@a(66pvNRm-DL zvm=faHht(iCqNjaV0klD;A`=?oD&Wg3r>iT48Gp#!twpO3S9o69D?1m)o%^^9I0aZ zLR}#-YGQq_51t0nmiqUqeAeH3*j}5UqTbi&VM4#WW%P{f8p-I2(W_rC;$ z1$R$Da^Fm{x%rC5flMj-zyRj%uNYHYv}NAWMs_sARx_Gj~13{2@) zD1mf-m_+<~NR^4`WXeahMGg!pUk!3@TW9a9?=`%BPtJxA z`PrzrCO!6wAXLu!!;fvt_@p=_>4?JwK?LpqB5qZOIW7%2k9Qr^SWd}*Y98e!{2j-E4z z*gRmStPTz}^pR=!9;-P{_T5%vhbmq-uAFh6qP&q}hK2?!a!JsFBf#kCJ0*iOilVeuFinfI8%E8VS84a(!sQ-D>+W#)AS%+t9>?=8kvzA~csJeSw1 zTO4iir&~6_ybhu;)e}^Fd|2FH*?)VT*yx@Ap-CllPxtMUSL}8ovIMPMeXkQAMtM$| zP>_mRYHS5aeWG;Qh^^*vNv?3H@kE@-${S=aOV}&L$mq#$nCTxgPF!Z!LxM${0Q31K zlIjT&S16V7=j`>*Jw#`DbJ0aeyPJMz&zqrpnkb84=Leo}A~cq2>M%U_u%gECf^Bv) z{6lB#;6b7BKn-*zYZwcCjA$A{Kd%0cy)0KwidFdWnwCQcipqA;<4jI>DE_VX=xB2? z_amtDvH7{@#Wv^p!Uv4Uw^zL;FH$7|{H$kHIN$LR78D)lHCTk0zr93-Wm@sl@+?OY!Z3iR9tBrI<-^v5P8;-i{ty5 zGV7yJ14y1Y{BToC)rkA*F!ed@49(_(4SUdcK#-};N8*qmdO8{6>aMa+AY{Brnwn{! zci~VNxiBt{m>Z`Em~LsK!`q6~D1XJ%%El=2!ZcGiqc~5b)a*4dwikoNs9puxbq%z> zF&XWaCgfHNn<EUj#1c_eXXI zDV51tpe7V73@WwDzo?ZIA#ta&sM_;!XPYkPd1K|Xzk>DvDxBXM^qE63rU>`fV-igp zuAk2t!U95y97&OE5T#RwZfq;0D{wG`?$z_bFktARY6T2|QqrwN@*#U)Tm)M#K1F|b zqSn0q@^;+rCz)8O_YvOpb>1GXted-l*xe#_;}Ptt)WMZST%@8HsaH=Vxe^};NuN3% z+k5$A@?NZVS#AhHm(4T2I*Dm;D*@rUGMWu@Rvieb*J_^@6iZJc9)rgBD` zZsh^1q3L;h2YGt=!&ytj*%U*C#TibKE`2> zjG0@GgH%WXWYk+}V|JOQcN-er3*d4?Z#CmfMRjpD8J5u!8v^6HfcSzI-;!jut(VoB zHjo&smp$Cu;a%WJAqHn;V9CFvfU6YGpi>1i+oFFwn1Q|+TgMQF4?N-wo*1AM69T#< zwX+aOLr6CN64<$dh;StxY-9*xX2a9w#slJ3rwy=krEBf6f{unu3cZ0%=lwvO)Yir^ zmm58D&6*t<OPVYM8Dk@|Gv;D2v}^E7FRjcboC-QodFEGLivtL$M2Y z#&0f|>WWmp8y`Nd38PAjpX4xv!pRQRuc_lg8JKQT8$uQjn7a=F;xP0F$~=s*UZAz@ z)~Ujo>w2pRlJ4s5yVn%)eJ8e$2Wv2iBUnP$>Db;5oaifkqsgd7 zV1?d^+`89*_ekOW7uSt4(o%m*{z3KHKAjVHim)^>!>aSc_eO8s8U!VKL5Y{% zc1GOYXFk$|FO3WErMXS!i=Xa(Gq#fCXAD%@q{_ps3u+Ln($t z85c}H{G$koY!n$64J{aJa|G8I9I5;>;sGH zyWI6J`~?!wAI`ufX!dNxuuD|D5*K|H!YT81M_59&KjVJPIXTWf8#yOWYU#f8$tFsB z#N=Id+WlA;$93~eXqz{5A%ASRIuEBjDvpetwaJHvG40li;Tp<6jf^j9hDj^#HppN^ zJ7{aN#txEiB1^-WtS`KJ+cX}N^I%=Vlpj@rCv<@hbWYCk^98W7M}tJP#N>IPFFP*K z6jfF|PxWEsLhbT0uB)JvBrG_n9oy$VbvQxGA@}lR+Fa-A)Ai7ivK#c3+4+jANDEG& za+kGa-~@95Ct?9G42BT>x7`NTb&iUkL*@wY_jF}2o=I9A##tsDm@3-1nWUd2%Q1=NrPz@YdEzhkLvo@6m&jMtkYK??mh_Y~U4L*e ztAySTp;F+X z)AcnDjBUF5t`UGvym$CvY$7j=^ya=PY@XuxInGy3NjU8R7m%xt48RfkyZhR=YqFH~ zLcZRep|b7Q9TFT8s5y;&MZsn1{IR0Qjfiis(1W<|N7Jv@7(4^j&&02nPAM#nr za%43oEbC3w(VEG(t%^TkC}oZ=i4vl~GH{R1DNv=lT{$BsNC9!|1Ay(w58VQwhkIbU z`!k@b$uIP5@MA%Dk7iYkk%)07TL&UFhyNN==2m^s%@|adQ4(lSN)5tHHpqqsG56Zx z;>hFvCv`=khJOG&6>67177Au05rqjlvPWru_J%?e@39&Q%s@jb3#t@Lc*@-KSO8#R z22}(ME+vVG@F2>GgRwnX6n%JtOM69Da_c#OwO6N4x{)+;DY0{hKD?7j!I@)6YfkGy zZbHUA;8W?bnnL_HVn#{%9BO1ql`O1i_Ct~z6;2~7p&no1i)=DiHI9N3MkiCIH6gI& zN}*>m(=^|B1VAa~s1xsJC@_>DZ2$)H)ZYhKn};E9Wh^-SIfEsx29J-;zZaEde}m0H zuke|d3h-_@_%IyzIpCzaG7rqJ&};H+OtWeqmkQ*zeeugP2KHj{H9Wr|OW*@T*I}Qe zF_JJ6$aJdk78-BMGWy9{@{xJA9~dUp$uOe9XnSE>AS@>T_&f7)#w;^~)DsOi9<0a* zNDtyNsDA^Tz_sPSk1L6^6hcX*!ze&|2gC@S+xni^+D6&sQ+rPU8Tq^ZgWwr>||{x;jAm!#;P`EY?U33CZdD;gTv3TGmViNIsh2Afaz?mu8q65wa-jy)k0UZO8a-C3=%2jij_V4F$E7X z(z(KnnqCmF!+kC3DQ?--H=h%7oat`b6`@L8snSGtJE8FYjeR5qQm_bn*k4+Jtp%Hh zwUwTAn!Jl8+|}pX$wG8vE#5Rmftv3xZ1bP_KyZWVD#`MacEXK){VsqW>D;5Y->o*Vj@ezGFb5K+fX#c)+0~2jd_A{ssgxM*0gt{QLg@9q0a^ zSasi8Y#-?FFKGNtyx4CeVSTwjT$$$ojJJRR4<(c3+uiMz8V|~+mZ#RnKpCN5F!l3) z1^FYxmZkpL?M!EXAxXbRXC`~t(cV2X@^2{rf4|2rUfM}~&V!P>YXhx%dt@7rYxK3R zr0kj)3*O$_ye?~U$qTi4Meel!oCeC2tHjE}Z<|;*&S7Lrp{~nyoXj@|{meIG{a82g zH|HhZw1`2NZX8U65W$zmIyKwBTc87+Xj zzw-V*fksp)G2xF-ko=+8oXG8?&ggT2+XL|$MY_Rj>g)NYiSYhA4_t5U>YNS+U4S~F zLX`xxtR}=c#SJ6j783!nW;8G6D&vXv%Tw*HSAJT(NPR+?`HH^&Plg%`YtT*ck~Xti z{9x$L)|9+e_Il13B(aclcL2WL+R^9mK*0}_sPTH0#%XRb?jZi6(f4<+y6-;E#XE^R zZ^wyEFjE<0T0ZTOxR8Ry`<8i=;d;`W=Ns&1U4cLlVE90ddt8sVhydjSi2105Y+SlK zY@sC<#YI)~cKb!O{TOp@QvixM(f-ntlaj_>e3VL%&QH$mE2Nk8@w2k>kJ`hoQ1_;D zIQMjWR!+3nfAcxNW{WT>66*t+xx_~0ci-^mx%W{>uI6uXic_wbZx_QZcZr9WB@Ae_ z0yt9L@C`!4DYb0x%(>dPV9OHbp=Q-O+3on6Ca?oj>zcL)Kda4L39Z7wuBtNLJ2{UKN-WNfXg+t7hglc+IBWgta5aCVG9{zQ$SyAX>_mxt|j+x-M$G&U~SwtM_Bzxp1&} zls4@B^Q+BLfpg~DORt;QQeR7fTMx=enFKe)yF%Q$CTy6z0fC+{{CHKKx6fGV_<^yp z{}?~XRpi*aQ-EqTM<5D+qfygtZ6lAiX_*GKAbtL+fXC-35v7khOqkDdoeL@YOuZ(?tD+6#pZ4#*SF~H zuJ|C==}T+SSCkr;EpHt}b5HJW=XWN{nl)(;B6tr`ruR)5Y;Vp|g}9P-CcgEX@BJpi z<0~|Frz!Y85^{_GULk-FZxoiq%2M;~;3eQ{j^_8b=lLNUcNd&4#ml-rp=1-B5#O4E z=N+bw0p-M(Qv4EK?vL8x>a>%mSG>NF&UPqu_C#HP#=;#r$Y8nsq}nId)g6{qDY$jk zeo!xSix+##_erezY_84m?RL^X?-4KO$0AIimny@PhXp*6m64L!u6lM`3Qp zz6X%#$cpQ{0Th^K_Px9$L6}s>{R`PRXn~nb1Lihp@z(1X%`CTYP#>w)Mtphk(6GuS zhwSwv$s>hofR;w(%UaDrdN?d_Nav)FDZon7T?xofCMb_&|9S5hQctZ9&KgI<7Miq# zl+(9PhNF=hU52~@LU+!0t3Q$upG+uF&7T6(${J=sC~Wy08T1Z6&0CX$(FS$7vK-M$ zm<=zhl5k^o_%plwPHU-JzwtU&cjvqXEPSDp4=u3A=&b2pZu5-n$MPlzI-Yd8H$9ZG z8<5br;fo9Xc_oEHm!u)L?p@rZpffU##pJ$*@ZkIhH*1_^Jh>O=(euFH?W2Cu;Th+C zzA&?0dM=vgc<09V(&fm+K;-PX00(0WuW@kzXC6-d$pLE)g?jP3V$a{e$QC~uNHL~e z9VuKp&c;RUHodoAY{4Qc#wQhugghTD8Qxo_7;k-%8mh9V#@b{r9eo+j4P#5jUn3p% zs9ezctTVCw3aB?GR}T=A+Q`rbzyYhQq#n;^Z=WPICK7Roa83293DibY2NglETBjJ{}Fa}1PVT9~V~zHag^ zeMowDE?lpt);Lu|c6ZY6?YlsxY<`ahE11=v&7w_!P857c=Y#I7;r6_pKkOVn1chJ! zZ-`4TP+ZvZwI#z$S{rGyI;oKTxiyD;y+hwE&sg2I%~ z)^uCr@%>W|7E6g~O$-tRIDyYaDrv)Z?@!<;T5s%K9$>nLcWC4~P)U6V@V3$7Pl)F)LC74}Ht)#RW7ChpDJ z>)n%LT}o(r8;Zu+N#@wWlVUD=1z9g+qghyd{5hQwG@oc>SK_Z`(}O!%b|=FGZu)91XEQtmHinuxVp>+YyGUIkbg+2nm(fSIc1AdPrPJ0h_ji$7+)wDMfjv z=g}nTCs6K3f$&PY!2**>V=J|4E1-?NyqU1CHg zWa6|?e_E>5>Fs(P?RfYQChAU%Tv|%mz4wc|y0JFgEiGMtO<+P~3 z!qq zvTCgs6X}}y0Z~ctRl4kVyIayHBiwZ5N{~tbdECt`Zp5F<9hQ)mNQ^wZC-3K4_o?E( zetWEJ+3?*39e}w{S9uKxbs67WEZC&J7D5R(O-Fn?-l|v0cLN!Dq-vw-dsugB3EPUq zB4!`i!PoTa@f7o4O;5_K4>bf9;Or@o<=dK1<2l)U{^2s`BSPZ26zhr{p*rs(sX-c$ zz{pvyQQJ{m^9R84lf}dq^TbS}-PNkY3(zrW9#T+YP$D?$lrO>;KI@q#2}CqRx^2F$ zIW8r1$SBik=~QN{r6zQ1eh)qQ{s5$~DI!Gl-B!47J)bkK>o>3Y9jbN-&~$Ft=M63eXnKYvSk|%AUl68k&u3C_>`W zynGh%KE-X-SvfO!P%crUrbDUNfZ8{1$5KsVX2LiNJBGpQRH*-Vy$3Q82VhDVMl$+K! zmQdDQ*_SG&KM6%pKn>Cp?200=yx=#G3@lo0kadAgFd|h78ASNY+3W8lQNiXUn_v9O z#E3dU$!@+c&PdSTaY3D;x*5ACrp2Df#c%8>%3)hPYNxXPl7oed;hum-eQ8EpH0Tszu*7*jcbwyhoCXT<#rAB;1 zQ*gypaAm|+EFlWB?ENB~pG8#qiJRiJ^_-x&hFG%hsDX0xQvg*@ z)%O8;4*A}t*41`@`p>H%o^#F7^VqPclIkW=PDNBMM33Vgv$qzmB4cf`dbq9d)~!jh=&T7DfowJ zhJ`Q#B0;qQaoRIlIX{!frB2+mDT;kn;%*Mb+@_&gLHL7Ax(^4F8^&ZZ3N8O52O4?= zVg^9X=kXXBV}v3VJkkiEn5+r_PMX$Zvq=&tXG%J_@>*p2vy)Jnw5DK#e*~?jjT930 z%+or|yEg*GN`VT7LJkuVCWUSV8Z;G*SA<=$o_OF9R7ZYC9gad%gu>+i!G)RwoNqge z7U?y#vd{HvVUPiOc?W+ovrWn4r%Dqtm03#4yKLUp?AX_r8{bD1yTT`T3=c~aPNe+7 z_gca(de-WRUm6|8ZU_q$@pNAVjGflXWwf!F!x|tsL&ieehrMkL8JB%En z*UCF3EIIiW^pFw{hoA)cK_Rj9~~x;^g$iiaaiA37wr1aD+i?sN%% ziW*7|vLAMr1M!L9+t0T@4=F}?s{GvwlxBf|(ko*_g$mu8%*39P|nSCuYg$`V;Oyxv`ZnB+c!uC?)rIuuDTE z{aaynfE!ev`%yau|7`gRC%&w-GF0n1;5Y);;tdcE)>}E@jG1FVWN=6d8(R8I z#Nv7=5))WLD&ATY3=Gk{4o>aHtFHzK=i`*s4eoyC05%*XLQw4vxcE}DvB@b-Rd;tTd!a;P;m0}LLc>b;zo==d6Z-yr{ zS?IU6PgCq4=j2xrm}u+^ru)*?rvbrdcP??cYlV z1I+eHBvztTPd)#r9sKK7*Y1$F?{@;7Rojbnw_d6@;S0^9z6zjuth4oz%UfUE>Gr9@ zF~tzRAd}5;pdE{`BPkXr+v{A8L}mRAD1uZaTQ#?C8Xm&nYQJ0g`adzEJ5S}8KbSsd z+=7oXcOm+IJvqhr!b4`|%REZy9-Cj5hTMFLdldga$j}K#)+afyQ%DBaHI%=x9ua{6 z%|(B(<($L%8aeJOaiJqU$dDO=INW!{Qc2y;OZQX+@+B6(Av4F-By9 zaTIb4M^R^{VPE2^_C#b4wH7CoYto=xR@4PCs}ynZRu}rd7UQdu;sTs9T*$Ry~KO1sTL5~^{MG{=T3TrJ9u&64emG$ug%*@mmh{SeQO_7 zjFwmtZO9ki2=OmI1^G?!non9{N4AM{46GR{@+J|9-}dXB|DZ-X73{MQdocOiHu5NcbKd%HEon9U`&ueJDV@t>tg|I1m3Y(5fE^B**Kx2x(gj+Wq>t-*(6;8D zvo*o_AJ~$4283MFIb{ot_>;>9P;X^@=T&X_6tfI-Uc^{<0A(X%b(3x5>6kfqvf*q7 z@b*#PtERuTir%cfq_NVAhIBCXkiOZPO`^N{sieNrXHYHOvdHvX@IUDGIUs^ZX%Wp3 z^!4QR*Ftv;P8BD z{+r|Bdy5HRjWNn8mshZ!Z)^Y@K=)sJP8fG)_6=IaW5>PkuJ#SEheQ?w*2zDt1`=G8 z%OBpo&AeyiIRHVs##AlGI-r}CxvT9nTlilBl0tNlv zu)RU*$N4&`_N{2hdm|z>4HQm85wW$da@XJ23Vg_{lLun!xhmP7DvWo)b_XwBCi9nL zK@kKZ6DqskWk}@thQ0RRJYh4~zg1z^_a;UJiDYvDyq_z0=w2=VB6PpM3nBwRj%Sn< z+JWOthxE@7BQQs;XjegfD5?82vS1FY9{4{ScyOxu!ukGj9LARVD+kGov+Kj#(ZzMs zVwsVBIO`$LJS5K~6#&?XP;yT!WgAm#J95V`WN0=il49@BU z1aER8mWU@WhwPq`guME;0;c)L&1H^e)XzdTsr_G#>EXvlI^0Xu!&nOM@s>cI0%=V~ z4s6(kI&wx^kDl?2G1d&!D)BgT1K#*avKZe#euh%xMHim60 zMgv zWq;&H$cAA`e_7mWb!w^`%+4p5Ze zG~~*PV9;%BCi~unAi((y&}0-g{1W%t{mJ?=ay@1!yvLsWJOM4r&b{0|W*svaqRNhk z{hQD<<(vEy4X+!zAg6p@__y@r_t+FshHF{eX9>91s{Z{dAn(TeJt85h?bp|U+h#i5 z3xIz=Q9h;iJP1B=+Ql8TaX+GgQMqh12c=Y(Cx$lxU8aNR_q_K<)Bbk?_}@H6i#<7i zU0*EC4Z7GJpNg{LFJ7RSWjzSewX_`Wy_K*gwwVj)SZroD6V_V81stW1M&q4HhF^Uh zy@))_bLQaAz1aAGK{C8OJG_t(2-&dyH7R^NEldO!NXZ*mia}B@3b1T8YD_F780(cE z`E0Zc901aymHI+KA@F>xZ?%qrA44~1E2se%^`!!i7-LJj+X!tpm;qgoIDK>icYM3);? zAMRWx^))Jm8Ax=&QT-UQR0D!~1S{Yu$1~zOi%-1Xt9|az`j4)XXk7o&0&M;v1XA}) zaP4>L*K96gs75AiUeTGJ51P4(_tIsB&f|~koMW=2Dn0m0zYZ)DwmKWtO*Yv8`_SYo z{N(xqShhA)(eddExt^|@vpi|V@qBiDF6WFV?R1mwjpW?_pmu!NGZ+xZ5qjsbp73T_ z5-N~z#(W|f+FX?^tgZRtF{)gXmZpiPq#jEf;)rfQI;N#o2@Ois5#Wla`Wh_(+;;%6 zwDY==1)U@car7vk{Uh?PiLe4t0~up7ytKNxN3FB~;l1gEpX$KaI5k!W` zGQ$`|3$jz0-;%QY!(7xzRtM-c?0l}yk_zj{?j=35O zyKcjkLM}ezoi>>&q#IzzFNsdu?^3akzzz z{fd=KK>z7MUP$=seU3PwjD0d48s+mh9iFeK*{;eSs>DYykjrX`mHo8M%@BS?4i{V~ zZ$EZ#voK><)iPh4)H&QPA^F3vldZ-B7E$K-$wetV>WT&^PciPcxl!}rX6k*Fhjm(S zhJx@oA`%ZsfZ0K%IGHoTK7XD%nsuK{o;d8sr6mj%2>f#rw&vO^@&SbpB373foPr{& zt;yy`71M*O2x(co#6`&;fdzJSHY0;n*jbI+R{$IUBZx8s74tyc#2Z9MmJh@FmC&g1 zILAHj1*L3jqj_HrpMl{eTpYx|s$__2xTjM7lC7C?TY@;~XWIT1OUK;VsquyA(``-! z#4t6^Q#GfnH)HydJBtJ#RG!`i)f+%iWz44WFo#=ti`p};%pOYhqSs`onEKyL8oh*T zIX21$3BR^S?-XH2KQVMSc=jiZtGdqJ5&H+i4!E^X4AGerNG0QO+y<6BRsv?a8roSh zm_qf$Li9vD_N(L82i|ny4*f9BPV99aCBOqSUX%Lh_m!*g+&Cz@=W_@VL`7al(=Oh| zk4HQhVCcLrlw~*aHRccF&}PbNpkXJPnmgefI(epN++=^z0LzNM7rR&Z$bUfF#}%39 zn>Efg3!!p?*2}VDPXHl4HYeQ3UciJik+uc(wKg{{m-x2~xzG}53)8B0H20bRb`?GU z)ed*ltkYTg%zr}KHJVD!l{ApZ&!`a$cu}YO<6eIzqdl(AANM#)hXa$XU0W-={B0L{ z`{P#mpIk2q@-*D5T;eV@3ut0LkluRX1Bp;7ap$1;$kKW-`~vqxajjlYNNj(JN+Ubv=n1O_ExViO^XFz}vZz4RdFCGLK8yB_ zD>Yfnrh`yfxaA!-mLyu!(xV8XT3_Kqav_jyN5jij2AZpv>+?<48rsvcOAspF%6@lj ztj_bqNqS)t?ZExw%`zR-^v>dVL5^2a-SAAxvO5Brzg$I4(SNy$;Qw@fjZ;va8Jz!6 zKnPM@_W0DT_iSBaXCX6CkEL5DnnN!w0>@g?WScoHk@v^*qOYV|R|>bKn;Aj0SdlL& zCR4}?-qNP|{%p+LfHvR5g=mIkEr3M7%&f$%=d$YrJCn5C!V9~p?`GE2N|O@}m<=n~ z?oEioYxCi_1+3jbC@NoX6?kY0e5L**BppOoY+p- zE&I~x>Z9;6@sUaZo_A$NAK+31!axLQSb3HD7>bsYX-t=4d<7hpx~yN%QAZ?@e%f{a0@CGr6~jyevdb~@@rQ?H z(Mt8yIu%;YendHdR5ihgb4t<-5nC9HRwa3Xq_*K}VQC4i^kw6Sp99&r1wN}{mv1gu z@r3^HM<|_RVzF6zqzLS4-UJ3anmY-?*;i>IdRs71u5zKhF=kh!&s*2)MWvs?ju+*evhWl9J57y;gN3?VD(FpxwKMZ*L34w#OXc$m@IiyxO&6Alhe9G1 zPrrE}Ri0*Q0!5W)px8f%Ou=RLV1H0MIt75LzGLCdq!WOKx*=y6k}Kt5X;RlvaB*to z00vm@5T$l>+Di{r^hF%jqa;8K66Lm7nf$`__AXvDe;K_?1B(CUUCc{r-LB}jMO*!=4;3y9wpbTraGh+qVMpQw7B>Tc`xN`v zibDe@-b4?Aam`#F;Y6a&Us@L(f?-`C_02C)pwYzey;$&|+VadmV~(I5kgVxXmsy#X9L{ug`i8Q0X>wfo|7*-$`KL_lCEAiX!~D!qo@i%1DYdha$skRrVX z7QOdg0w_`gK{}xXkrH}@00BbCo^dVL^FGgc_ddVZ!W*d`wn}J7gSm5fZeI`euZ=zr7B=|5=Q5^iHnxY zyFC!mZz5XR)bp~+yYZ7ihW;%Oi~T9ouul0Xt=HUCBzCBdlrA-fT67Ri0Hb%U@|yPp z2_e2ppRENvFxS0riH_ZSBRtm7{)#;(AOJFI2l39oN$D2-QQu>y!s}5U=Ys^c>hp`K z#}_UicYnyc!JS{G{Jo+9@cPJIzZ9yp98;wbQ6)?*d~<4FsqW^FO1p#_sf?Eb*ZfF= zLv;0gynMV2=8kimIxXU5Teoy4OExz*JvK8jQY<~rf6zH@>$pT~Pn(K#Z|hWTNE$BM zZQ9{%SILIggJU9l0cwD8IWgn>mi>xI8XZHokrN{h$>xZ1@Ntb7i_lCztutC4zc!wMX%h-? zM=PdL_-g04bC1|5P%$K>f{Gh8#1C`g8^$(jzJGp3Gm?&^O$!i?egs`g4 zOB6o!AeFo+4&StU@eqC@2Wa9_p_yW%gbW1kL(j#}2@Xj}IozCjUx`1+y+xhb>65L^ zp>)oL-eRo6b3wC3Mc4ZUrCPUnIwtapBt(m+jgTgj1w|HZrgm@Z8W&2Mu!BEDbp4Pa z{@>W~y+&A3GW4)URy$8mf#?E;ahh{edwNdCncUO1s>BiE25u=JgHS^K*`K33cgH?r zqq%Woer_Xg*(bfyFVXcM?9o7j3yjqLLFka}y7pb=lJP+g)8wKhDw4ZtR7Pax<3Une z+YB=`&Z-ZXnqJYB8dmL{dkiu>zFAt4(2kDHRE>4rxJK&+7kj%H#CfItR#K?{1#wHxK?4O+Q1hi_4B=%NRVB8=WicTzNxr^J zx^mspDp^!K-n=Jk`XUW!W?rObk_TR?V{yFpeT>l+>l<011*`E5%)AT) zXIbBc71ymXk8tJ;TFi>tI(RO(L|Z_osDp!bNVjA2hFF#dI7_d#K$ON7FSG@^abS^V zN=9;R9N~8Yz)Cs254+owo%DUT+u`Q-_qhp)F($Oq`)|(K&svcih$_6(g%Bz9`r!|m zjZmiU)`qV}S6;C=0cB%67nqhR!XLwKBNq=|Hzm5RxeTkDoVfLPew}%xOgD2PX#pcjjWG3dwhU zWN#`=%;@TU&&!ECVXz6aD!1Dt*4vbFkZcEWm#ka0FokXVEzG;JQ_>s;`>~DSB{N4K zhz*KxmIsMj8?#8dJNVyN#29|*KBgo%&iPJFY~bN7^Y`N7D9uG4vZPOr?QFLVONi=p z*tARstoa)`G!CpwS0+CN=UZltOz~0JJw6OhqRn{d7fw!Vn;k>$Y4gsdL}}RZj}qH9 z4vHd-GdeGkj`i-7*B*(4fb^3#%X&l(P?q!t#NdP9y!p2P!Vun^&MC;@P+Awper0Al z>OsM?Z*uB5TG7n~+|w*voFWqa1P+~R0oyDX)DjDC9!7erR-8QKwza_69HD!2mc;3u zM(Q+_kD-^XD9XOG@%cd=qT;k!*_|CG>-a0DAAzwQMpX9v~6;C zr2E-BID>SNW}C%v>$X_FyG`<5`>HVr@$|y#z>7rS9T2QEkS0W$T%0y_z0e>TX30E^liBGGPT8{agu2HPugHM<}NyQQtR=t}$9A&saHX-JB`@jd^ z1sOL&b&sERde+6UvcAjVVyUHrBxWoQ)jyqc!%$C$iSDB?`;HC%L9&`Nz3dRg96SCj z-uP@|g>RP}ene#i6yMsF}Z?_sOkf-8&>ip5xWs%3ua7QL1$~~Pa$sbQB z=h8w3Ui0*Dh)13dLo{YTD^NA8q?O%;EyT0oT6Bz#;oTxwadGiAK$rFidgdHnDP_TF zRR((8r79(mWx%0p`F)s7eE)-Bx(dtj6UD5Et&$g?No~{oaR!@J0V*=-t6GkAO=bbQ z1_ZjSWr*d~Pk&091y|_zP8rjfEcpo>P>j0- zcRcF2yt;By!&uT$2|}NQ`pv)Cr1IKel!EaPT2&p6DaoveU4UNEv|?{+W7cxQ4}Wxz zpK*SDa+xI6EGO(c9kei^@y|GnO4!{`F89{@etXAaTDtaUoZ6U`#3AfDb&{`+1HzcI zTM(5@U;0(hW%900mGuzlFyGwI$6{?iFq)k~#|7Phx|Xp@sZa-9Xc&Riqxj}Fg(253sek+YyV<^_j$FJz%!@+*kPGF#d8H8>kLr|QX zQ>HTjM4J9V4MAq6@pj1tpDt6EOf`4)XJf8cu`5qf=v7K9mXXhtfa1iO4nt#%*P_Le zs?#T5h=<_9??^wbk3jI@JmUSF5Jg`u0k{|_UpeQ7-xu4+;~e`)6*roeR&Q?_kG3mp z@Xu9gP4;2+e%!^Rmwb!*O}ahvhO!fzgLY!eY~|d|)s9x+F_A7Ilga)dsl40YL7iRW zdD0Rz>p3t+>9sCe5@+eyfI-pIp7r3;{o!*reT}N5#|y|@%x~D8rH|n*?hm;okJv!L z%Cdv_ZTy-Q20nR|w+JnIfB~P{@P}UqE(@3VWQiZFu<1s>b!w0#+W-@gKtP6t!h1gZ zujinLRcJ{_s`+jJb?HvlUYL~+J``{4^5}s(F{Ls4=zawpzRXTzxAnBg>(>_3#}o~i z@iQT564?e1!2w(KIlC9lFd`j6XC0TrMb<;Rsv|ra%otO?6K}cBmLkdF*Q#y-8qFxj zNpw(1u|B>K3>RR1_d-$goVRDvVmeMRWoC8S;qVk)ST6`poOy&-FPb=P6KtJghweMq zM8El`x6~(FnfdR)n__cLCrh;O;JoWf>0Gr&eEmk>@McKI*ZWqC>-|;Zszu1%3E;H3 zoY975YH4-A>h&c;(p#!v#Ndzy7+Zn@6?jjF)4Z$ZAjvTQ!xL#?{Dl4EbhoTbF+gCN zoMM4-wo(BHFAXdvzfTWq#{?l@3w-ZOc3vV-@2ort-~9_T9Q*|Z%a?%xcU*Jw_Ujxr zUP2?tOWGsS>C~+*>@spXaYWpaFsGvpPB|UUUWEvf{W^x{k8DGj5mq22NZNzLP4VT^ z0tsz9m^8l7qbdt&yruk&-tr*d9C0(HW|CfXrW|?w(%MD3&9QNlHi1PCMR6N6OyW0( zGbXaMxU&amwyg_)r1)D)E~fY+4hq4#3(%DTtA#MfG?XaQ@FQs8r?D~<$8pQYYN`=5 zaIDwz>=lR8y@AgW($aa;6+lE$IU?OCHz8!b$;i7i0YfZtFwT`w5Air1^XK*d+TpHk z<546sxT&m+^YLnX^WU%YVMw0C6!u`&JZMFbdg>WRkK_f_p6o}2V#PrQv-Ou;{uV)A zoP5LJ?BKhpwv$2FOND@G@0(Cl$LS-!;aNona)yN)r)(2?bDQ21!q_Y0K zuO3#Do8QQDDWvXX7EW+=+`nj8ne4=$QBiL&c zYSsNuo^_q+|2kljE-6xS0pcU`*TTimBJ!*ETHOvDB5@sZiA#{vU`&*eMDz5x;a^?l zYGr|q{aTXg0R`r-rF#1-&@=Au<&_Qi@EQ2mr{r{?^&OYz-H&~PNyPSed2u&L*7~U} z0&Bh+r6vnIP66Mk3|5#l-4!S9Q&)LTd+bT$%;p!5*J!hi@29_i%l)~=TMFrBV2!)} z%{Im_vl)S(YF=Fp8WP>q4MeNZOtX?uFRT31AFg`)S39}q5mx6wBfD3oi64LM5y^k- zZMec;o%D#`b4dsRrP}{qo+FH)Uw<9(s{-3q6=Hk565;jGNUfb^?p>(NhWmTO#FC=_yZ7i^hJ|UDRCmejkL1pOc zYM52(5OOt)6J^jaqZv-=Iq=TX6u+nZU(W3RVPA8A-TJk_;G3cFzdzKfotwWU2$<`R zMRpcXhj3>spOK{A&JH=xer@j@wRl4f0}W>&Rl{tcEPgL+!4EgRw(lTl{$N_=?J%QC zU8@60UsJ1da&!XrrkR>}b|R0erU}A)!^fSV-wTa`uo}1S(J7{;PF92in& zPbZ9*+l6VSKjD+N6%F(p4(|K7|EU^&T9rQ~qP-=S{b_O=oAPGJDq(Hy_?CWMSTq9R z4E#WAXS614KVWf2Dg$|vvDH4Z=4alnKqWlF`7%vF8|{boyPn!`BJ!eyrN)W2lOh;J zekt0}VIxL@_n`yitw&0Ax|jF_kV)VtZdtUx?43*#Ff@|0_)xdsy%_7k-*RhQXJPpi z*Ey@nhiD*Rd`j&)%Vc329lw)c228MXK*l6ME+^{uEP?OCXPp~BzGU<%jt~SpMc7mh zG?VW#YCq14ahg`Y9bdbZ6AHvxo_5V}R&-B3ri21@zq5&Fd0_f|LGtd_`N@G)hqh2O znEet=Cv>ns%O=5%UXrEZ?pgU-(K*zV_=t7g$1N|;R=E1GR2VLu#i9=LpgxCvon~=9 zExRhQ=iO%bC5jNX=4{6EAK?IsRH3p$C24xu=DZZB9JkUdE#^9JcGoML+-y!EOJr_) zcsouj`y_Zjw;r}xHplOmFGx_+i`}J@dgkJ&9 zuHRw;wbB0mU7Wt*bh~y4I7QuVZJ+GFXnPJ#XmRF#bTPAk2DX}>Z0^%7y&y+PLsz%& ze%u_dF16{z*3=Zj!IP(XGKWanWGcNXIi=NeTBSs{rHx)Gqd*N-TyH&Gj*K4r(Q|F5 zf3qvz7pye9-d1xh75d= zB@Nx$FRy8*vCa19)~_nzz%mK4DG z@m#aXphEhZ4Ge_BuaYD-XNU@!cMfARZjF-rU${u3`S6jDw{UJXX71%Z%4k->t?`I2 zhq_WDc0Ys+rGS=%d`b5^DNaY=UeFqhOJJ4R+06#EQ?Mk7C42|ob%qYqxnT8eRQV-blRVB z!O)W43DQfSFZx$H`6%e|wam;_SJbsQl!Y7J%~!Fx58G zdKpspA|B-n9J1bEEoZA;t^lP94)a9X}F`a+m@uBQiglAf^pD z?i7lCi4YZ1mWx*R@K~?oVEWx8E9;G4M;X$Uhe|y-r|->3orO5oqgGaWihaU`eJ=%6 z_MLF9upCdGHdTA=&@#M0@((ZYV&@s$=t!w}+qD5j<(!ZU2dAA6k#g(kuN$DT{pMA* z8?7(!+RFsvsu@CzYGj$sS7>tN3AuhrjeSs-pyrBjB1$5yI$ij_K+<+oJ|uc9%`nTc zzb+d;963pl>-|Q6T}5w&%{Wf7%Qu)TEiG$w)IOtL!#SBK3C~%3GEP6uzWExF1AqGuHL-^R-qqi<30ip@C((MVE{W_O+eLkj(+a1Fv)-NXz|}+- zK#Nzv%(v(44LTjU==JzVw;lf2ZjI0Ez03560L)r@AXBu;Zo4plBj(Y5Nu6T&)@-zoiA%iH#A~5dN1>s6NZf*d#Aj?t`UYAUA`}kVc&seEtHJP|Y}4Z%i*nCb{7#08(N@EQLU^M#}L`)Th9Kmf!q{ ztX4ihLo2rQ&8CQl75iyKT-FIwpc-yYcIv%mBW>qy^477jjNe-&V&MHVn|K8{r&i~% zw5`u7tq#-)=@_gVGI+jVH(U1-FqM-C>Q&P3T)88hG5N6QZ8*wj)_EJTtaDDUSC4C@ z1wFPo0aAQ@ZJz!0E8gGt;3rgD7FDjAsU5Y$q%QSi(dr3|4#%aoIonb>bwy!!kmETY zzkeEd8QQFo_`QZ-z1wSgEB z*h8f_s=n5iI~}K3uq>Wh8FlQpSRiV|%gXBmM~P!|psQlo@WCOMVAT8E2(6MrQ($E8dFPaXNmpfw6wFXp3lxBv4IfzZ{5zFPB$adI|Ez5L%?JvB;?|LiEwI1r7 z)MAXp*!7gM(7XFK^)09c=c|kz>=N}F@CJJ3+$r7FdgEwyciPvaT(AySTzL~G`WzF~ zczeuHuA=0!G*&tpEckT#>u}(rGApyz@(`__Y=c+4hs9MtTBZ1S4oTFPxj)VMgBJ+q z`P$7CZ4^R47?(js_L8kGph1zM3bvu1+3^UoAR`qW>Brnx1+&}gzj~pitOL=3y4$a_ zi|+@|AHR6n}!%vf!H z3ogp+9M!c7N=m%F*?HB5lHSn=(+IMP)_{2TF6~3fL?|1KjcnS1`wzD9%^j2ZB57`d z^CT*Y)9LAmc6%*MCnsz{;B@2)4-BbrzVApGr?8Sdf=Qu&N}OL|m;&TxJS|23Z0eu^JN!JA^?+qlwY;*nY+|43Lo*NXO%nhS-0n}NYLo_`J)#`=y|jA(~SCRkui%90<_pm^c_v)xQUN}W~_OUmXko`Tid$cqT8j9 zndE+K4?-E`-MdLye9ETxqihoeL8^AR`Xk^7#DE?VK)HXgT>U+<6eEf_Nv4qYP8fn- zS3p9ffYu~(DN%4?M`8Gol-l6Nz9`M~##4LAvbPHlFkvqAe{}wNst7z{vtD05&ezV# zb$lr(dk1ft+oPFE`9WNwS~Knp(@3ajaDdRd>x6PSz{ZtjW`2C!AXC6B0^q%B;O zm~vvbUb!3fjA~0bOR%OA^JEZr-rsU?mAb0-<1>Tt+gDk6$rt9jzurm&BF!bKr&86A zJVoxNEP2EvTr9eysy@{I`{YZ5>+Z@9uOfuXS`-*F>yqc>=VO~^$N;TS=P46~sn{j~((CKXn9YzS&o zk{ZVUuRN{q?2Z@NDoz9bTeo4=(g!!PSexKS%iWBHv~CF(UD&lc)x+MP<*(ZU(K<6; zKrC45kN~{jP^WQ$BR^*b7X>bl6vc2tq(|`MEsP4+1FK}IwvyHx#{hX}<@j65P{)

    mtW zg-@fMi}}6kOH{*$)+S7jl-|ELhN7o`ajB7JS&in<|H`Ghm1nj+gn+cYq~5oK-tv(& zHXmi|e64JKgXf&b{SzXRdJQ0{4X2ho{HtDVOLm)V&c!&!Re_&KN-fds?r2RTox@(B zi1SEW)K_MWX4n`5ncfhVP4K>zyiV*w#^|=z@=}n4@*&4CJ-;>fjnwYD-S_>)SeUHe zE@~-?d_b$w$Z}`=!8pfKoX)t_aaP|$hThm?i@DyqLJhPJe6{y|RMd}JO7_w6WM}ZA z6S5_3pBn~63Qohc>(mvndk0_U{iNrHzEe@8PFy;FzV3QYvAxBz0yIFT-$Q1 zLk!s_w(6apM2gWxzO9bBHHp{uQ+nms)#}{!ei*(7*vhTcHD^jI4*iN7mHEgH9XWaL zg@;#9lQ9|V$yXGq=r9wq%m~Q*_sBFPIrI4{Pg7Rv{d?N|>ull@Kl246BJ+zUl&V+y zno`c*`vnZX?xEkU`UXTFv^o_LYq~Rgk&kr3oPXzq%@W6pHNk5*|5S4Xe^a>-)T2hX z+|I?Nb8d37;p+(yKpz$j$ZW>dDpHHneLxymTmtGeZjTcu0j=ncE+On9W9HhF!6J~k z!S#2)wg=v3hCmdFqB`2CF|k9qrvy01Uo?w!07c0BkxtyXZiQ09N&h7>Z1A$!>}6g)+Q6Id0H&m4tx31x@eZLgv-269FnxHseTW|Wd2&=8jnaRQ^1`1E+s4TM#L?bKN9l88Sa`vN&fT% zWC^x8H?%9Jju7v81aiJq-*HF{Rlfkc8Es9>j=hrqa*cYKtl;YJuCff&HvnVhW=IP#s>tT8e=>z6s(`8H?|d6@ zM*kxT_+PW8kjd+iU#l6$=vQ>`@(s&UTq%m^doBFQo`Fn5(4+&m z;5SG0*PnjH66X5hf4h}`r5gYL9Pa-lhYK4bLYnV$I@clp(2Q4?g!`hciAo=18k!KP zR>>v_NDe?|O*oeu#NZ1B3^XR#&7nSzHoAW<%Zey?>247cSym(=qdA^Ioiy{^$hAZf zAdtdPKP_IDfwt4%49g&_ybh>xXAc$dk++JBObH}b%!P>ALX8%#{rpo;o&qdEfNywb z4uAxKhpQ-niq8`kz6tpN4;1FB>>`jYKCB=amP`u;splCL;I_9wV((e3C|rr1)X1a zCdqTlA!R1Ss)dg-1hO%zgJ75|iP5nC;j=q$=v~}xz>Dy(r7?kGY{e{ZF1SVqjM!~1 z3;MgEY5c%b?$aIw0o20aLa>90(VS8RD#{mz#|Z5bsnpta7C+*-cpq~k=uf7R8JGoh zr80ruU100pLcO$KhJS#|r>{wAFz{VzfdIN-zk#;)uVQ=mx5`p#vCE5g0OZmpoBZnp z0cYuMhS=36Un8^;sPufH;gU`T{?lbL=w3%*)*QR&YJ=#}CN$ez_dAQ|WFmY!dR-~0 z;LCvekqKk==!X$c`{GI_Xiewq>r*jT{LzlX1Q^R&Cl1uOor^Q5;lBT_ z_Z8!jfCm2>!Ac8hlvwOV$fm=(8a)cQ#U^X9*8)P|{siA0u!`y9G~_9O{P%XsckZ~C zD1s;?3l>cuZ@lzS(J7G(kdD1BjoQ|ZjY3szB>C`ero{Ro=UNS_+5-ggMh|A`0t92^ ziGZxmK&7A#D?Ib@-1O(Iw}3I3AN}W+JWj{QSu=*@JI?;ex*z?}Lr*fNH7C}y8#ARj zIU>+4XkP0nM}HdKM7dQ1*<244@Gyx5a2ZYXlb<4;Ny6Nan_}9WMHxf}tqGyxb?_XU zm?MI7n-!OFRb1kzZaqtGVGj1-T3#;gTWlEg7wUhYt9BZXnY&O|&xT&qBuR1B<<7tZ*^8m-Wa~RxIXJNoO{3Fa!>M zQ1letB+6Vdxw?2%vQb1`7vocrRUChr;G{D9+3>Fs?v}_&0NFXrS4)}mJlCAi@G=H- z@wrCe`ANv-!WRBuLB3%ugFhSJa8Y&$W$N0I=;GzVlXKZmv5B3>-g?i|N2E`f`Gy-S z8i2w6oB2>M6F_I}-U`t91V)GCKaiqqZXuIl%jN%Kf2VY7h;-PeqF<6)s6eoDeJo6r z*EWXMLzaSExD5MQ9?CV~4Dx-wdolr{QJZ>)i3AxQ;w z97^zlX!dM#7Cl`cUr|`;wxOS>OqLWpQ3IXpFAZO#s$MK_Ep?G{{-Ukgw4bO|yY(h3 zkchfEcC$f?%bfDpO?XpBYNIXa#Vmz6#n+W}Wfo8h1uokFF!$hJGMl1;h zAUr_LmW5kIP!1SQU|WquK&XB`9O+^#?4h{r@UAo(0bEazas|A*pEz;9s6X%+F4nw; zGW$2sbxDVW#Mb#47-U4+aJXR@-4u-4x#_7O?dO zDDJqeKwoL@lL@_E&og^ z++laka^HIM08B?kSFrTq_H5i_f5KmYi{JP6qQyFCUF}KL(%Y!* z5#>kr;}$4*QPL7HkS{n)UB3`5wk5Ix=X|8B1IUPEY0%c9kJLBtuPHo7cn*tKRi-lS z%=JLlA|K5naWR2|F2HN+^bc?ckFxji=bVRY-mrM7{oQ>R+_>9E`kYkg z0w6Ay-a=SB{ug!Y|9;C^C@HGPqmuehX7ygG9gA#-E>{}cSlT}17(!WD)WxnnI0F?- zGfGa|FW?5$vSzacQYy4sGbc_WQSW;b(hfJ|zPHk5H%M6DBg=9hUEW%eu5H{33E1~} zmT{)po#ZT4Ybr5|o0#h`OT!!Pv~Ro9WjHjJY00YGDfYOuYY;zJYSRqEZ@Mv|gzjf4 zp!&+4q6{hxiV3Frx=H`QIR2FQi$y~B;S8VjE9uw9KDY~rdc;dL>d-?14iBcFS*}4M z0Z2X|AOLZI#&rh&QrH%n&)=NpUAWw!D&_D0L`9~zjxOCeILJr>(pz5AB;jSPq&*3} z|HTG+dL|6r-<2lBy`TaW!%vgoXAJ>?K!}S8iq9HSG4wr{EKDh%x0(Qc8D;Ul@AH(C zuQuK#b96D&Q=!RhQ|ki@dVtjPWJk~#YwGVgAMMCk>?~W9FPR-)D0H}IToLp#!92Lm zs23B^@Clb@u{k;}jcFnCQaIS87-Q-wMDErru8CFQu`GZvPto6gu^xV%gsYwk9-=>g zNHDknGZ=E`H2QC`WAQQ>eua#EDX0^vYvphWboEVn)*_A6CkSDYib1=c5LvhL@rAQ* zc+X?c5P^~vg|^=kiOlrt(LpUS4>#gyx_^h6HSwN#mD$b)(r}=LGjhj8U(GlZ^~X=} zXx7@4i#|-GNoJCY=ixLBA35p2){+zyUGU7(zdOP@jK=bMPH>+wRZs`Zl1wJqN!HYya!{{G^Hat2zjcN*9x#1524v-g0Byi`eK2G4+uP}0h z0P`gg_RT=h*n{iWxpk0^pUwUo=D4$AGUQXO60N?42R-p#)=+7AmSi9lsG~hBLbK54 z3N;J__Xc}7EGnOWf++$tBIj$~fbc_pd%KSJO)UP?6*PsKpckiaWg!*k8(COL zsC|cc^rc4^l55=coTD6lza(lgvD|W_3EMDo7CjO=6@Iqx z7j8tmYLkY;OL{!F#?n@|S9%_VM!o9iN>I**dm0FN>u6^wRPP1ihAZoej^gxU$BT0p z#&|gMm(J-zF)7m`pyKh(q7k|&x_4e#G3nQM86Szq)cFMlWapqcV zstm;-H~7+29B@Y@e-0o`T!c8XncB09tiSYlwA!}~mP;pWu&xyX`psFC2FKpK4YajE zq^`?I6ml~(<6!@iYL#i1%@JXxU|fzknBXvznf`y_1iKI5ae!3X{#ViZeOOq6Y3`Q4E; zqn=)gv_{L~CYh1wQto*g4i zjs2wsfJXCWeI(aldhyu-F2+b?B10IJRPXh#z$IsIXPvw{w@K#qBD!>%YvhJ{u9p08 zv+f%*n=rp8-D~WSis4g+{1-$qR6QzMmcXz^m=$A3&neOU0`l}B( zRg0O-<G&9X}hn7;gMvBVyCl38(xm9Tx{PiTarGpscgG zMP)r_*npcx5lJlI6p3HHt*s6OBn%KKK*Epz;MUP|!k6H&LVzZ>Pg`ew)QrESzZRq) zpEznY5ApfJTka~Yky<=)n2I)Buwx}=+Y;^i$@I1bG}x9en2$M;RRSb%hMnaR6KT=_ zO%L?{j)Mx;+5&bF0DxPDgVc!9igNh19=nvPG0Q1POxaV*SeOWB`>2Yjh&tevDdXTP zE$Rxc%T3Lv1=otVFmnYsJIm&Av`RUyWWFdJ9~Dp*-D!#ft3#xz3~GCKxi-9M)p_C+ z1lU2)Ke^f}LsY=5I~wjSHZ5nX5(QJdrbUOtZ*8>|vj8{GAt`P+6a`hNG^Ta*+)NbY zkP(+0d4KoCW|){Ga~)tNp^mhl_?h~++ZnCuMz#@=dFW$X?lUI%PH^!^bi-!kYLPmx z*#xf?A={Vzk2zpA;bv*Ec9%DENNpL8PO8=EZ2t&-(0K-4ok(aJI@DOphYevLv1r)x zj4Z@}Ka4hb~&HhFGzB!vJ&&HS)3IW=Vl ziLP{wEXsPNnVBDZA3CTD|7gMH&vU=ym~w3If^z6Cb)cp1-_x6Tsh=1oz&I|Y7`*6c za+*HmL%2Wr^8A24;v(x(m=e)t(eW4oLbW|9L#&Dg*N+lGKv_K&(SoAH?WdJ+-w8 zA6-AUO@UoCu=fpoR?3d`G$qrnqz_P|pGPMyiKaW0SH=JK`3Q#=&9&Ou5XuQ7KNNY~ z=jhEIm@C`c!vi6=5dm@t8+;}2jVsD29e`jjdHmC=ZR_~DHmM-mgx6Jqx=6vG#fzu2 z*7STIGJLHGk=3cOm2qV_KgP6Dh1I%{K5~3#U8r>3a-^tnR5wpT+%*t*{U3O1pZus4 z1$l*uIWuR_rG(5CwTAh|>nw}+ zT?6tWBL>6X!o5fA;_lDyimXWnW=C!Pi74MYy|^h1OQJmgO}dsdY+UnhOOa#1xvy+R zvjP?O3=?8`&#UyFTI`T=9o-)sSnDdyimAr;#<%jc$t)%DQ~@z(9n(Ntyv)S{gjH(L zrZ6O|BQVDzp>5L9PeHKsNAZ`yXANFsB@{{J|DX74f5gp)pgUw}v^x;4jHRL(9*xl( zd;s{X6Y$pCqJqzX^1lXSTsj-uEby(HbgeUNIue2{91PBQhNY(gSY6rla`OOTar z&4f~zwl(&adM{GNz?8v)^)P$?{#-F2K5Oec<@w8)VxRH{l^8V zn~|0G!M|v&>70gdW_@#*AYfPlXMhn>X1BdTlj9c=6s)EHjqx$f=M%&?n8;+ID(+|g zlzt|*|9Bsdu2z?O33g03dY(#RL8#z+!zbJ00MRBwS?tb0vj&C2ol31%H=%~k?X7Nd zMntivSeI~Cdv4^%xd>)FeKm}_$Q`{9O7vK{E7kaf-ErV@|Lp`g+*rso;)86*YWA3$ zYPX{KSD8?YX$dJ@LnrsQDil4G;hYufYHbMUzqd%LzpPBy09v3WAzkM7!<)+9Ey`I} zN$iPWbuBqf(x!2MLU=nlqmbQ_o&qQ-8Pe%S?>Xo?5T^w)f~#Xv92!n1GEOD_kOlM? z*slYXwi!{MmLp@REV6jW1goe4$%tyn&whK0*!;9c}n&PNa&@P87)6dTeqB zFw4nRAhBEO!p`lxbr&R7rXR4*Ka&r#*6=Uqz0cYhppYtny)TwmJa2P&CG!|5LO|{# z2i!fD=Xo`}-!~>ZOC&d=51CzNBHkNAkjX!7g$DHcI^0bK9OmL2;XF0)Zo1loZQ~XH`ziMmj}UiRq*Nj^YxlPZlE{<>8u* zFGI3A5R1a7*&0-j$6}SXl@7BD*ZuD8@zK|nQ9rn;O8m%}0U5*Uk|%N}h-=Yt(BQR) zHCA6{_gz_Zf3c6jKEa%onMS~b^|vB8<{@2=pm3bf#xU(Cd50q)@jP`H|^f{6wEesNfh`KWV=um#2GwqwW8`NCr% z)1tf`zbW=>ozu^^E%nZr3vVxcDsiIne=JhG*m+BT$JCars~iVUM+4x~poWKUcu?EhM)}!Wf@fC(n*J^X! zw{>VG84-U`mXwBG9?S|P(>8_bt>w1v)p)uF1~?zYNa7CR^0fQO^mjC~+5uOTjNTnY zOToLLdUHPL&tb?Z%xjirI<9Qep#Zh43i;3|O<2y-IvK5TgZ63&m#sQX0hV0(fB@V= zWo4z`JPXNCr;Pf!R&1hF>sN%~LB}aav&-iH(R|YNnO1K?vZ@*_sS%odA?>GLUYiVU zMEjHOjtH$?H~k|!Bo_qG4)HR^scwo@i?adN5YqWC+0uAPzG0s?A2v>HSJS@5LD@ z7RXg7vmM&lDktLSOSo*80{CtN<`@>~zs)Mo^&daT*GTlen8qx1P`$o+iKKuN@O(`L zAXOTS!8Y%pQj9N)E$@ni_H-iIvBn} zk|-Tq@y|;CL)XjNUo?58#+}7Vkz@w2x4aVD@1eE;Y&(TE!|B4;A))c^TT>OGaH3I& z&yfvn)xq5;zGwO^z@W8R`a<(xYXEJJd4M%S8JyGZ&Y_4F#5>RY7%|b}REurey@%Jj zdYXZ%kbf^+5=7MuaWVX!8UpxfG;n4j8NjZ#WF~DU~PCnK-zsmZmX+>;nowWFesPV-L3*v z)J}};`0d1)!)WDGYKCZb?zTB}mfCHO)?5aU4iBBpoHTWFXOSPS8_Kr)#UU#6=?y&j zzNNYY`gr~p6ie=u2z&aBZR}A7fKkrrNJY&I$_XkQgllC81o)^C*vk>lZG-{9HLByx z(VpwCK6m#)mf=Glf7y0sc-L&cJotGkU?WY7!GK}7P6j|!wyQwX^%YJ}R$qy-H;l?s zt_1vR`}k$ii{p}KKSHhnTzlH$5`eI<9gL}Kudgs%C3@*p`nE;mlbrMoai0C8Cqlkz z>)T7q+9uilj)@Kv*H(qrqBu6`qXC!Cs;gw)609w{PPD9{dvk!a$vX(r%{6py^5-6htNPR#Z&LW0o2WeQ``GTwB)C{&<9+cjo%d?If|qw!9o`TUV;oen z{2^NItXqMcVcHegpnB2k4PDc)0Q3EtOk=aCI3YhKC#LEx;gl&-n0?aOo#&P61~337b0anwCcRHVnwNH z!mZIVzw*{Y+`xQ7J2%+J|D7(7{4;QwVag}Ur9=K$c%^%Hl)SSy|2NzqBG^c-LS64t zObOsS(J#WpW5k1QK3MVzKsW zzAk^T8CA|skIlo8jvLBUIqn3nT_amICHCBE=D#w4^3kcKSE(GTF>Ke_^XWFG{orYF z^zd2%q2V}_Evms8g};-b@fO8HZw9GK6MLCUxN@zWl8uLKsmLk*5eV?Lt(C_O*$`_j z1gb#c!Xqy3^Ih$M+`Oj*qlk8LX>X@!b{aO)&68^Aj>pU>XM{4MRae z(okQnlKfH>SN-!2k7OoJ#(}-9_{LQbIx10Bv{9W+Out|d433ADdpQny&J5bWbN&6- z>1d`VKKC!!IRxp+-2k_aMUqr{DG-kCE=SS^onxHDh|{fe9dVPnIP!6nk^U$e(Q9oA zb~$}#%2mx9KonAR1Qa9Tr)FE`MiY+}Ir>4>0D^AaykpHiYD-Oe$cw^*aHBbUZ zMd-0dBU$Et`PR}ksM235rRRu@Gw5YPLGv|I4kB&#nvF9jNqjRRLm252676*X*fJ8( zD;1s`V0ZyYd%iZ;CA1jAb{w})y;upj2obE=zZW7J8$f^>IDjvyfj44`xif=Ees!_W*NAW|~K&gD{(Dx;Dd$f920O=s0b>rz2Hbbnkn zTv-chewpvZW#?2<6yWh^$m=oR73ULqAuB(F=$Al^mq-N=cBAAfCT_?HdA5n_MK0xk zj&Gk_dRL%hGA7H+M;7dWIe2{qdSQGI?1`zoz^r*B_*wv;1!3pSRZ`kMbcVuIezR$C zyG0-kCPR#)(x-y&VeO=XZpKISft{v5q?XNjPA|G91YbSF^d1vqrT2A5N;d4}2jCsR zms_$xNHIs`Rrk;l%l}DaY^pm8zj(O#dq#}XsIg#$H}{tsp~aUSwk5ki8qY<&djNBA zz7Y_xg6j0^|M|?BaejYG3(;|-ksGUo*<4L5u#UnM720QJPWQSygIU?(KtQ0)k0-a0 z^BLca%kovaWcC9EzbYd}`S&|9S(UJpPDe0FZqVt@qR)89Rm1qUQ{HASFa+Bs##299O`_dTvyPuWt2oa@tZA;!(t~W3jz-5pVQ2VFOkI4r< zzEXepOmFa1I!=cYrs9gko@{{bf};#HK)ZPN7K98@S(HAJ4+W?CWi>6Dx5r>$iA>s> zt?^R7(D&tx3*Z?Gx+`mHv%fqrm1#1NT1BT-9eQek7Tx_@+Gr=@cQPmAfekR!9w*y zMCR(rb#8KraxWFd&>&fx@VguA%`*-;ubSm~5@Ch~;HFqsW=(I;$JA+h(eW6o0V(rJ zo%)<5zUJhbT=xfGAUs{&a4#L@Ra+k zeKuI%dG@@F7#q0nZlz~<2~KS`o!!;ub=*)PI?>DUULc!-NYYIrd>1|#3e0E$Fs@2k%tyB; zC*HStUfGyC<(c98qB!Y^fU#ZBEIKF`cP@%^d4-UAYeYB{hFeyNlJ5Wr1 z6%QT#LZ_TEOM!Ipcs|X3-<2=BrBwM4hLxrC)s;;e8Is06%``5N!ap zI=^y1!znlfulKeq>|tnX1q9zojYhqwSf1omuGZQUF)Bm(EwjdtDaDh`HYk18+2{o$ zQ@QmvGUc^pt3A!IE!#OOu?AX)P>C?7(8-c-M{e$&iTc|i`Uedp0YN;z0*O8vYECA& zBws>Do+Qa~9wJPbh9RuV^fx&IUA38!B}B9-J?yG5M8c+b5fvYw(_i+hCvM23K=}59cERb*_s4Tpl=W39 zI1gSk=L`q#-c(E89feZv)JMy%qJ?_CA`({<_;iF!U9E%9zPF6BA{BoMH0}=b1dX^a zt${ms*WuPz>G#|(YCxGol9x%h=+l#l;E^E2ZfVfS^@Y~$S@s`bOY_KR*C)(<3A{x- zh7ZORM5Jt@Eg@d`mE9PXc@a<`NS z+F(SrD3q+|-vY_@ztZ;H90^`9ElN0zUKzrgIB)f54PXgmh-MNLt{*H@NvVt6Dm%^{ zaZ!{-lIQ;#(Gk{w9JLk)J zb$UCX5tl{3OX)&w=D7$Hu+dXNJSb8!O>q*p5G^^_H)G|+MJ zO!%l#zAjfmA`J67NYMih?^dXBTz=6Is3`^DU1ozm3eJArPXSeE@iND=71Ruz zjH{R3kWu+Ewe#skIdKn$eqFa9gJ@}c6+E+jUfo#AjZv_!gk=>N5Wy<~O(d&vlYy=+DWVty{nKKhz&)LtFb87nzFKJz;=`D^iE zrgETo>{~NtVH}63RRY0iD8CpiDs>0lS)*1NQoWog=z(Rd6L(e_*TKt%-|FLXu`g@x z3zHLgUo&6Zh=mnEby*attxl*RSbgVKUoqX2NYtjol`mR# zAwQ5gfT44g|LAxkK(HM~c?`E16)tlWi;Ls14zJ^@Uc*=j`~a{r)7}z{I+>s%G@+gY zk()lwmuwuLr?rlq;R#Z>b&rAyLuCYmXt6CvR&2S zo}qZ^eKKAE#U<5ui>S(BQxVx8-OUQAIe0+*A58+|vZQyA*xnV97-cPCWpRm(i5-c0 z&f%#%yQ^8w+}E6z8r0kV_%L&IIYMJ-y;-nS1C%n2z^*z^SS%J*kBz}^3pjx_K5Cxk zklxG27&RG_GhAUg1H1D=#}07@-A|cP0i^SpRN57Kq>c3~^gYMji{$$+lna>=s!|0}G9Ko!1ryf?z=ag#3f>`a$^(1tUKjSQB!yPi<%%@9GxU(GTsM_QQ zqMw;?&ZL&(N)=RBcPdb`VD49VMSi+bPpja&BCIF)O3!6^ypKVHuGr15o5CrdqwaweL}v#uMW=nKBxsfB^LL%I5*EQ`)^Q|w$2v$8``%z zSXjiDPgEZpC@-|;K0v8eY;1tF_CKp86Q$9hEhS{YQb9m<z}9o3(cXc8f2NeSFwEopHOj>@343Ih1J3SVG-`ljmqqtOJmQPX zuD+WAxtKG7Q^r(C(+ZD2)31F#@vQjAe~Ke(mX%~WD0$vFpBXkP>W_M<&9Lt1tu>KO z9{`OfFtqn>8{EZQ^?gA`VF^h)jzD=e@2Wlt3p6qaiX$rLLK z&c%6Mjmo#Afr!c(4nkwF<}KXsz8(8IBg3P{-1pga$pmEJ1##w)*BAT7Es;_)N~c@q z=G98NC0#r)q!XA)BUVRo) zO%dQz0<>DkRSf(2_^MBq>tK&XH~| zSp?TFRNxus!W)q}Ppa(c@ANddslP7H6!+>Bxi6#HKYFwT)b<%V;oaa&oHx8Nud%uE zm1?z(61!!AH=O?XZYk=6&`vZ_-r;u4hZyp?;SgeWuG;H>zT_++}u(CCwJF=D)014T(76S*9(m2NgP97*`MZ5;&DZ%u59+ed~~gT z9ITC*dEb+>#q&NYi%O;Dn~m9fmfW+ocleXlsR8GvIig|ywAEZ5j?5h%$7ySqjyNqd z=N0*M4AZFgvC-nam3IOP0%B$h(Ggt#^pqftn1EJ?l#^El7L_yEhSxsx<&2YTp!X-;dkio6{D5|t;lJ8! zl@-}pK$o+SraU^44WSPpfa52wo3u1{Q$au4M*h7npG zMPZR0a%<3IJ&dJ@$Q6G}p_k>cE(u##88P!zf{$N~E1j%>2zj*Q5QjHGwdk^xN8YQ1 zA&OZjC3=OVFBZp#yL)xlAz`35^Th&)OQyQ(M~9+UUtgzYHFFy&m#-NcQe z3d7^k@?u?!343y>O`hd_NQ2HmvHf71d%SXeaYh18AXCoGV0XuMb7m)G8}5I#&-4kU zw5ymju4`XZJLFthHk2~1u!`}rr+xQqbbZTu{6(Se`Ldk&{@L<0>M*8zi=71d=o2MW z@}bzhNF;mypxW~`-2qcE-y#GkYv`gPZKvyQ9^{er#mBCR`Wt_hT^cvVA6QiJh58CY zlC4&XCs4R%i@nGD&R1M}@i<$0Yn%qULmwnh0@u70-oFkZ__Y_~HRe5i55Z6t3ky|M z{Jt#_zG8~N-SFRZXs335BX6Zo9g;M;C3Y7r97A-2E{2sp z0`bQVI(0<+rZ06verYK}*V@_|&mXh83&<0^CO5}fH9zbx3jkll-Of!5J-Y2{8MR-% zOb2E1HTCA_er@o` z9Y_$oWi$hfhP8}Zvj%UP@5t#WZks!)koUe7SUpp80?e=8?yT0{?B(C0ia)Z=+cVx6 zch$T|u8KBnl>#joe7Q2Paw;Mnwm}ktUkzMpi@?uH(*xxhPHB829zU#*a4R@;7If4N zNA`MS0QkJQ>HmhMnqf)NJWd{Jr&INe7uTn)kXORT(ow`EIRgMHtn$xSD4HH)Y-cIe zE*Ozt8uq*c{KQNpzUdu7ocX5=LYw4&u-06oQ(}SI#Tr{2f4t=WsR;e|6y)SHMY0D- z+ad>r@H2r3rm~!0hmp@+TV~<1u)z8fxZffWdM0KaaUKDn#CE0!T+II zI{ZJ-vH#MGWnNJ7L9gSrgFn$q`}R^@^oTk}0Em@jyy@c{6+ZUS)G~$rYLv@eL|#`F zulfDm%HP)tW=G=p%NM?^x%!)Q=x2un8GfB2*f$BxmBDlvOq_qo04FH}S&dv%5lGAc z0mGJ|J=@@5MuJ>{)s=ty5$!r`p9CIh8J*I($|#p?_Wz>VWc5Kv!;e40Rw6dfj^J}h zynjeXG;Xb@YY^}6oR6VXWh%;8qez1SmYU%Y=Xmd+m^JjfA$sEmf#Gr_fl}xzt5!z&w zyF&tNdl?}zhh~=@yD9q=Tryvc{h*eZp46%*i`C>YCQ7)2&Uob%9nI%4RWgQl>_%9Z z75s6Y}-!k2WUIqr|_qvk}U z`h?I`)qj8oF?Q-#8jr^Ln&`^p#_Rd)u4ew&#Cp=>6yu&@IMM49X#BjnPJ=EbXFo&)o7G;C!|8&qxU|w|&L#_}O}$m!w#pF4AwUPBq0A{5tu@HuNOi2ImE- zL6DI64$~wR*AFX*dED2Qct_~R?>3IEoit=0ZFaHU-0U1<&9%D`IH&wAH-BFZO-x|| zg6MOV_;vgELzV{6?=xnmWPJ+35hMB4J4-hqVc*{i%&=p9IhG9_P+Y?MRNzRWDX@|1 zV)HakS;lb{mV#He|KJpb|M|c(OpKW0pKt5R1f7gYRR-T}8h2kZf!r~|OieERNVa*v zBZiAP%z`77Amccdwdf@xf!W06V-=fyR~@4ikE-w=!Pp|m!@`1u+{)N&Q9dllZfsE{ ztKC#jgjz!|EoG@E*vsJvKgX=n{v`w5VpiDk8b^HMlX9A8f0#JS9`t(T%#e%2DNZ4e zC_Kj0BhpgWC;luS8QUzoki(y0TxayDgIQ=m)FjA=q9P*@&-r9`>MLD_4pjy{pQij9RdMqd->(#l{^3IXUs+B=H{vg z2M1RMGpVXNp6&Lr)^q*rnt62pFZnMp?3EZUgSGxqeTE$?D=XerPyWM)rfv~w%PzVv zTmZ_q4w$!pZD&~5oU=b1-WkKBRFYME>yIME-2W07&B(*xiYBvt$_!kn|4iIjYV_0l z@5#wO4D0JCG%rNeaWbtt8N2;Iut#^KesR6d0Mb&z{)Q7kiTHp~jsFq`5Hl0g+~4HJ z1Yc#x^!3{i&3`{bUMeg62r1%liVc8eQF-0v>Z3%vLfHhZF`ty-gO6aGJ* C^>Qcx literal 0 HcmV?d00001 diff --git a/windows/security/threat-protection/microsoft-defender-atp/overview-custom-detections.md b/windows/security/threat-protection/microsoft-defender-atp/overview-custom-detections.md index 9579771415..8398ee9986 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/overview-custom-detections.md +++ b/windows/security/threat-protection/microsoft-defender-atp/overview-custom-detections.md @@ -1,16 +1,16 @@ --- -title: Custom detections overview +title: Overview of custom detections in Microsoft Defender ATP ms.reviewer: -description: Understand how you can leverage the power of advanced hunting to create custom detections -keywords: custom detections, detections, advanced hunting, hunt, detect, query +description: Understand how you can use Advanced hunting to create custom detections and generate alerts +keywords: custom detections, alerts, detection rules, advanced hunting, hunt, query, response actions, interval, mdatp, microsoft defender atp search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -ms.author: macapara -author: mjcaparas +ms.author: lomayor +author: lomayor ms.localizationpriority: medium manager: dansimp audience: ITPro @@ -23,18 +23,16 @@ ms.topic: conceptual **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +With custom detections, you can proactively monitor for and respond to various events and system states, including suspected breach activity and misconfigured machines. This is made possible by customizable detection rules that automatically trigger alerts as well as response actions. -Alerts in Microsoft Defender ATP are surfaced through the system based on signals gathered from endpoints. With custom detections, you can create custom queries to monitor events for any kind of behavior such as suspicious events or emerging threats. +Custom detections work with [Advanced hunting](overview-hunting.md), which provides a powerful, flexible query language that covers a broad set of event and system information from your network. The queries run every 24 hours, generating alerts and taking response actions whenever there are matches. -This can be done by leveraging the power of [Advanced hunting](overview-hunting.md) through the creation of custom detection rules. -Custom detections are queries that run periodically every 24 hours and can be configured so that when the query meets the criteria you set, alerts are created and are surfaced in Microsoft Defender Security Center. These alerts will be treated like any other alert in the system. - -This capability is particularly useful for scenarios when you want to pro-actively prevent threats and be notified quickly of emerging threats. +Custom detections provide: +- Alerts from rule-based detections built from Advanced hunting queries +- Automatic response actions that apply to files and machines >[!NOTE] >To create and manage custom detections, [your role](user-roles.md#create-roles-and-assign-the-role-to-an-azure-active-directory-group) needs to have the **manage security settings** permission. ## Related topic -- [Create custom detection rules](custom-detection-rules.md) - - +- [Create and manage custom detection rules](custom-detection-rules.md) \ No newline at end of file From 233be01af6468a93b8f77ac8835c1e75133ecee6 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Tue, 24 Sep 2019 10:13:26 -0700 Subject: [PATCH 11/43] Updated supported values for ScheduleScanDay --- ...ew-in-windows-mdm-enrollment-management.md | 7 +++++ .../mdm/policy-csp-defender.md | 26 ++++++++----------- 2 files changed, 18 insertions(+), 15 deletions(-) diff --git a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md index 0e6b603e24..6358a8f497 100644 --- a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md @@ -56,6 +56,7 @@ For details about Microsoft mobile device management protocols for Windows 10 s - [What is dmwappushsvc?](#what-is-dmwappushsvc) - **Change history in MDM documentation** + - [September 2019](#september-2019) - [August 2019](#august-2019) - [July 2019](#july-2019) - [June 2019](#june-2019) @@ -1899,6 +1900,12 @@ How do I turn if off? | The service can be stopped from the "Services" console o ## Change history in MDM documentation +### September 2019 + +|New or updated topic | Description| +|--- | ---| +|[Policy CSP - Defender](policy-csp-defender.md)|Updated the supported value list for Defender/ScheduleScanDay policy.| + ### August 2019 |New or updated topic | Description| diff --git a/windows/client-management/mdm/policy-csp-defender.md b/windows/client-management/mdm/policy-csp-defender.md index 3d598448d3..e88ef95636 100644 --- a/windows/client-management/mdm/policy-csp-defender.md +++ b/windows/client-management/mdm/policy-csp-defender.md @@ -6,17 +6,13 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 08/26/2019 +ms.date: 09/24/2019 ms.reviewer: manager: dansimp --- # Policy CSP - Defender -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - -

    @@ -2335,17 +2331,17 @@ ADMX Info: -The following list shows the supported values: +The following list shows the supported values: -- 0 (default) – Every day -- 1 – Monday -- 2 – Tuesday -- 3 – Wednesday -- 4 – Thursday -- 5 – Friday -- 6 – Saturday -- 7 – Sunday -- 8 – No scheduled scan +- 0 (default) – Every day +- 1 – Sunday +- 2 – Monday +- 3 – Tuesday +- 4 – Wednesday +- 5 – Thursday +- 6 – Friday +- 7 – Saturday +- 8 – No scheduled scan From 1d4bc9423caf1062527812ba0bac455cd0459d80 Mon Sep 17 00:00:00 2001 From: illfated Date: Tue, 24 Sep 2019 20:09:52 +0200 Subject: [PATCH 12/43] Auditing: add MD code block to table keywords Description: This PR aims to block keywords and values from being translated to another language, keeping the values and keywords intact, in response to the windows-itpro-docs issue ticket #4995. Proposed changes: - Surround Logon Type values and Logon Title keywords with MD code block markers (back ticks) to keep them from being translated by MT. - Add XML indentation to the XML for the layout to be shown properly. Thanks to @takondo for pointing out the uselessness in translating these parts of the table when the document is machine translated. Ref. issue ticket #4995 (The ticket can be closed when this commit is successfully migrated and shown to be effective against machine translation.) --- .../threat-protection/auditing/event-4624.md | 120 +++++++++--------- 1 file changed, 60 insertions(+), 60 deletions(-) diff --git a/windows/security/threat-protection/auditing/event-4624.md b/windows/security/threat-protection/auditing/event-4624.md index 2ca7e8267c..1eaf9e6b79 100644 --- a/windows/security/threat-protection/auditing/event-4624.md +++ b/windows/security/threat-protection/auditing/event-4624.md @@ -33,55 +33,55 @@ This event generates when a logon session is created (on destination machine). I
    ***Event XML:*** -``` -- -- - - 4624 - 2 - 0 - 12544 - 0 - 0x8020000000000000 - - 211 - - - Security - WIN-GG82ULGC9GO - - -- - S-1-5-18 - WIN-GG82ULGC9GO$ - WORKGROUP - 0x3e7 - S-1-5-21-1377283216-344919071-3415362939-500 - Administrator - WIN-GG82ULGC9GO - 0x8dcdc - 2 - User32 - Negotiate - WIN-GG82ULGC9GO - {00000000-0000-0000-0000-000000000000} - - - - - 0 - 0x44c - C:\\Windows\\System32\\svchost.exe - 127.0.0.1 - 0 - %%1833 - - - - - - - %%1843 - 0x0 - %%1842 - - - +```xml + + + + + 4624 + 2 + 0 + 12544 + 0 + 0x8020000000000000 + + 211 + + + Security + WIN-GG82ULGC9GO + + + + S-1-5-18 + WIN-GG82ULGC9GO$ + WORKGROUP + 0x3e7 + S-1-5-21-1377283216-344919071-3415362939-500 + Administrator + WIN-GG82ULGC9GO + 0x8dcdc + 2 + User32 + Negotiate + WIN-GG82ULGC9GO + {00000000-0000-0000-0000-000000000000} + - + - + 0 + 0x44c + C:\\Windows\\System32\\svchost.exe + 127.0.0.1 + 0 + %%1833 + - + - + - + %%1843 + 0x0 + %%1842 + + ``` ***Required Server Roles:*** None. @@ -144,17 +144,17 @@ This event generates when a logon session is created (on destination machine). I ## Logon types and descriptions -| Logon Type | Logon Title | Description | -|------------|-------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| 2 | Interactive | A user logged on to this computer. | -| 3 | Network | A user or computer logged on to this computer from the network. | -| 4 | Batch | Batch logon type is used by batch servers, where processes may be executing on behalf of a user without their direct intervention. | -| 5 | Service | A service was started by the Service Control Manager. | -| 7 | Unlock | This workstation was unlocked. | -| 8 | NetworkCleartext | A user logged on to this computer from the network. The user's password was passed to the authentication package in its unhashed form. The built-in authentication packages all hash credentials before sending them across the network. The credentials do not traverse the network in plaintext (also called cleartext). | -| 9 | NewCredentials | A caller cloned its current token and specified new credentials for outbound connections. The new logon session has the same local identity, but uses different credentials for other network connections. | -| 10 | RemoteInteractive | A user logged on to this computer remotely using Terminal Services or Remote Desktop. | -| 11 | CachedInteractive | A user logged on to this computer with network credentials that were stored locally on the computer. The domain controller was not contacted to verify the credentials. | +| Logon Type | Logon Title | Description | +|:----------:|---------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| `2` | `Interactive` | A user logged on to this computer. | +| `3` | `Network` | A user or computer logged on to this computer from the network. | +| `4` | `Batch` | Batch logon type is used by batch servers, where processes may be executing on behalf of a user without their direct intervention. | +| `5` | `Service` | A service was started by the Service Control Manager. | +| `7` | `Unlock` | This workstation was unlocked. | +| `8` | `NetworkCleartext` | A user logged on to this computer from the network. The user's password was passed to the authentication package in its unhashed form. The built-in authentication packages all hash credentials before sending them across the network. The credentials do not traverse the network in plaintext (also called cleartext). | +| `9` | `NewCredentials` | A caller cloned its current token and specified new credentials for outbound connections. The new logon session has the same local identity, but uses different credentials for other network connections. | +| `10` | `RemoteInteractive` | A user logged on to this computer remotely using Terminal Services or Remote Desktop. | +| `11` | `CachedInteractive` | A user logged on to this computer with network credentials that were stored locally on the computer. The domain controller was not contacted to verify the credentials. | - **Restricted Admin Mode** \[Version 2\] \[Type = UnicodeString\]**:** Only populated for **RemoteInteractive** logon type sessions. This is a Yes/No flag indicating if the credentials provided were passed using Restricted Admin mode. Restricted Admin mode was added in Win8.1/2012R2 but this flag was added to the event in Win10. From d8bb8da5087eb5d5ed68004431db54b741d24d8b Mon Sep 17 00:00:00 2001 From: Greg Lindsay Date: Tue, 24 Sep 2019 12:37:44 -0700 Subject: [PATCH 13/43] added note --- .../windows-autopilot/user-driven.md | 202 +++++++++--------- 1 file changed, 103 insertions(+), 99 deletions(-) diff --git a/windows/deployment/windows-autopilot/user-driven.md b/windows/deployment/windows-autopilot/user-driven.md index 7629dc2ba8..aedd4a93ee 100644 --- a/windows/deployment/windows-autopilot/user-driven.md +++ b/windows/deployment/windows-autopilot/user-driven.md @@ -1,99 +1,103 @@ ---- -title: Windows Autopilot User-Driven Mode -description: Windows Autopilot deployment -keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune -ms.reviewer: mniehaus -manager: laurawi -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -ms.pagetype: deploy -audience: itpro author: greg-lindsay -ms.author: greglin -ms.collection: M365-modern-desktop -ms.topic: article ---- - - -# Windows Autopilot user-driven mode - -Windows Autopilot user-driven mode is designed to enable new Windows 10 devices to be transformed from their initial state, directly from the factory, into a ready-to-use state without requiring that IT personnel ever touch the device. The process is designed to be simple so that anyone can complete it, enabling devices to be shipped or distributed to the end user directly with simple instructions: - -- Unbox the device, plug it in, and turn it on. -- Choose a language, locale and keyboard. -- Connect it to a wireless or wired network with internet access. -- Specify your e-mail address and password for your organization account. - -After completing those simple steps, the remainder of the process is completely automated, with the device being joined to the organization, enrolled in Intune (or another MDM service), and fully configured as defined by the organization. Any additional prompts during the Out-of-Box Experience (OOBE) can be supressed; see [Configuring Autopilot Profiles](profiles.md) for options that are available. - -Today, Windows Autopilot user-driven mode supports joining devices to Azure Active Directory. Support for Hybrid Azure Active Directory Join (with devices joined to an on-premises Active Directory domain) will be available in a future Windows 10 release. See [Introduction to device management in Azure Active Directory](https://docs.microsoft.com/azure/active-directory/device-management-introduction) for more information about the differences between these two join options. - -## Available user-driven modes - -The following options are available for user-driven deployment: - -- [Azure Active Directory join](#user-driven-mode-for-azure-active-directory-join) is available if devices do not need to be joined to an on-prem Active Directory domain. -- [Hybrid Azure Active Directory join](#user-driven-mode-for-hybrid-azure-active-directory-join) is available for devices that must be joined to both Azure Active Directory and your on-prem Active Directory domain. - -### User-driven mode for Azure Active Directory join - -In order to perform a user-driven deployment using Windows Autopilot, the following preparation steps need to be completed: - -- Ensure that the users who will be performing user-driven mode deployments are able to join devices to Azure Active Directory. See [Configure device settings](https://docs.microsoft.com/azure/active-directory/device-management-azure-portal#configure-device-settings) in the Azure Active Directory documentation for more information. -- Create an Autopilot profile for user-driven mode with the desired settings. In Microsoft Intune, this mode is explicitly chosen when creating the profile. With Microsoft Store for Business and Partner Center, user-driven mode is the default and does not need to be selected. -- If using Intune, create a device group in Azure Active Directory and assign the Autopilot profile to that group. - -For each device that will be deployed using user-driven deployment, these additional steps are needed: - -- Ensure that the device has been added to Windows Autopilot. This can be done automatically by an OEM or partner at the time the device is purchased, or it can be done through a manual harvesting process later. See [Adding devices to Windows Autopilot](add-devices.md) for more information. -- Ensure an Autopilot profile has been assigned to the device: - - If using Intune and Azure Active Directory dynamic device groups, this can be done automatically. - - If using Intune and Azure Active Directory static device groups, manually add the device to the device group. - - If using other methods (e.g. Microsoft Store for Business or Partner Center), manually assign an Autopilot profile to the device. - -Also see the [Validation](#validation) section below. - -### User-driven mode for hybrid Azure Active Directory join - -Windows Autopilot requires that devices be Azure Active Directory joined. If you have an on-premises Active Directory environment and want to also join devices to your on-premises domain, you can accomplish this by configuring Autopilot devices to be [hybrid Azure Active Directory (AAD) joined](https://docs.microsoft.com/azure/active-directory/devices/hybrid-azuread-join-plan). - -#### Requirements - -To perform a user-driven hybrid AAD joined deployment using Windows Autopilot: - -- A Windows Autopilot profile for user-driven mode must be created and - - **Hybrid Azure AD joined** must be specified as the selected option under **Join to Azure AD as** in the Autopilot profile. -- If using Intune, a device group in Azure Active Directory must exist with the Windows Autopilot profile assigned to that group. -- The device must be running Windows 10, version 1809 or later. -- The device must be able to access an Active Directory domain controller, so it must be connected to the organization's network (where it can resolve the DNS records for the AD domain and the AD domain controller, and communicate with the domain controller to authenticate the user). -- The device must be able to access the Internet, following the [documented Windows Autopilot network requirements](windows-autopilot-requirements.md). -- The Intune Connector for Active Directory must be installed. - - Note: The Intune Connector will perform an on-prem AD join, therefore users do not need on-prem AD-join permission, assuming the Connector is [configured to perform this action](https://docs.microsoft.com/intune/windows-autopilot-hybrid#increase-the-computer-account-limit-in-the-organizational-unit) on the user's behalf. -- If using Proxy, WPAD Proxy settings option must be enabled and configured. - -**AAD device join**: The hybrid AAD join process uses the system context to perform device AAD join, therefore it is not affected by user based AAD join permission settings. In addition, all users are enabled to join devices to AAD by default. - -#### Step by step instructions - -See [Deploy hybrid Azure AD joined devices using Intune and Windows Autopilot](https://docs.microsoft.com/intune/windows-autopilot-hybrid). - -Also see the **Validation** section in the [Windows Autopilot user-driven mode](user-driven.md) topic. - -## Validation - -When performing a user-driven deployment using Windows Autopilot, the following end-user experience should be observed: - -- If multiple languages are preinstalled in Windows 10, the user must pick a language. -- The user must pick a locale and a keyboard layout, and optionally a second keyboard layout. -- If connected via Ethernet, no network prompt is expected. If no Ethernet connection is available and Wi-fi is built in, the user needs to connect to a wireless network. -- Once connected to a network, the Autopilot profile will be downloaded. -- Windows 10 will check for critical OOBE updates, and if any are available they will be automatically installed (rebooting if required). -- The user will be prompted for Azure Active Directory credentials, with a customized user experience showing the Azure AD tenant name, logo, and sign-in text. -- Once correct credentials have been entered, the device will join Azure Active Directory. -- After joining Azure Active Directory, the device will enroll in Intune (or other configured MDM services). -- If configured, the [enrollment status page](enrollment-status.md) will be displayed. -- Once the device configuration tasks have completed, the user will be signed into Windows 10 using the credentials they previously provided. -- Once signed in, the enrollment status page will again be displayed for user-targeted configuration tasks. - -In case the observed results do not match these expectations, consult the [Windows Autopilot Troubleshooting](troubleshooting.md) documentation. +--- +title: Windows Autopilot User-Driven Mode +description: Windows Autopilot deployment +keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune +ms.reviewer: mniehaus +manager: laurawi +ms.prod: w10 +ms.mktglfcycl: deploy +ms.localizationpriority: medium +ms.sitesec: library +ms.pagetype: deploy +audience: itpro +author: greg-lindsay +ms.author: greglin +ms.collection: M365-modern-desktop +ms.topic: article +--- + + +# Windows Autopilot user-driven mode + +Windows Autopilot user-driven mode is designed to enable new Windows 10 devices to be transformed from their initial state, directly from the factory, into a ready-to-use state without requiring that IT personnel ever touch the device. The process is designed to be simple so that anyone can complete it, enabling devices to be shipped or distributed to the end user directly with simple instructions: + +- Unbox the device, plug it in, and turn it on. +- Choose a language, locale and keyboard. +- Connect it to a wireless or wired network with internet access. +- Specify your e-mail address and password for your organization account. + +After completing those simple steps, the remainder of the process is completely automated, with the device being joined to the organization, enrolled in Intune (or another MDM service), and fully configured as defined by the organization. Any additional prompts during the Out-of-Box Experience (OOBE) can be supressed; see [Configuring Autopilot Profiles](profiles.md) for options that are available. + +Today, Windows Autopilot user-driven mode supports joining devices to Azure Active Directory. Support for Hybrid Azure Active Directory Join (with devices joined to an on-premises Active Directory domain) will be available in a future Windows 10 release. See [Introduction to device management in Azure Active Directory](https://docs.microsoft.com/azure/active-directory/device-management-introduction) for more information about the differences between these two join options. + +## Available user-driven modes + +The following options are available for user-driven deployment: + +- [Azure Active Directory join](#user-driven-mode-for-azure-active-directory-join) is available if devices do not need to be joined to an on-prem Active Directory domain. +- [Hybrid Azure Active Directory join](#user-driven-mode-for-hybrid-azure-active-directory-join) is available for devices that must be joined to both Azure Active Directory and your on-prem Active Directory domain. + +### User-driven mode for Azure Active Directory join + +In order to perform a user-driven deployment using Windows Autopilot, the following preparation steps need to be completed: + +- Ensure that the users who will be performing user-driven mode deployments are able to join devices to Azure Active Directory. See [Configure device settings](https://docs.microsoft.com/azure/active-directory/device-management-azure-portal#configure-device-settings) in the Azure Active Directory documentation for more information. +- Create an Autopilot profile for user-driven mode with the desired settings. In Microsoft Intune, this mode is explicitly chosen when creating the profile. With Microsoft Store for Business and Partner Center, user-driven mode is the default and does not need to be selected. +- If using Intune, create a device group in Azure Active Directory and assign the Autopilot profile to that group. + +For each device that will be deployed using user-driven deployment, these additional steps are needed: + +- Ensure that the device has been added to Windows Autopilot. This can be done automatically by an OEM or partner at the time the device is purchased, or it can be done through a manual harvesting process later. See [Adding devices to Windows Autopilot](add-devices.md) for more information. +- Ensure an Autopilot profile has been assigned to the device: + - If using Intune and Azure Active Directory dynamic device groups, this can be done automatically. + - If using Intune and Azure Active Directory static device groups, manually add the device to the device group. + - If using other methods (e.g. Microsoft Store for Business or Partner Center), manually assign an Autopilot profile to the device. + +Also see the [Validation](#validation) section below. + +>[!NOTE] +>If the device reboots during the device enrollment status page (ESP) in the user-driven Azure Active Directoy join scenario, the user will not automatically sign on because the user's credentials cannot be saved across reboots. In this scenario, the user will need to sign in manually after the device ESP completes. + +### User-driven mode for hybrid Azure Active Directory join + +Windows Autopilot requires that devices be Azure Active Directory joined. If you have an on-premises Active Directory environment and want to also join devices to your on-premises domain, you can accomplish this by configuring Autopilot devices to be [hybrid Azure Active Directory (AAD) joined](https://docs.microsoft.com/azure/active-directory/devices/hybrid-azuread-join-plan). + +#### Requirements + +To perform a user-driven hybrid AAD joined deployment using Windows Autopilot: + +- A Windows Autopilot profile for user-driven mode must be created and + - **Hybrid Azure AD joined** must be specified as the selected option under **Join to Azure AD as** in the Autopilot profile. +- If using Intune, a device group in Azure Active Directory must exist with the Windows Autopilot profile assigned to that group. +- The device must be running Windows 10, version 1809 or later. +- The device must be able to access an Active Directory domain controller, so it must be connected to the organization's network (where it can resolve the DNS records for the AD domain and the AD domain controller, and communicate with the domain controller to authenticate the user). +- The device must be able to access the Internet, following the [documented Windows Autopilot network requirements](windows-autopilot-requirements.md). +- The Intune Connector for Active Directory must be installed. + - Note: The Intune Connector will perform an on-prem AD join, therefore users do not need on-prem AD-join permission, assuming the Connector is [configured to perform this action](https://docs.microsoft.com/intune/windows-autopilot-hybrid#increase-the-computer-account-limit-in-the-organizational-unit) on the user's behalf. +- If using Proxy, WPAD Proxy settings option must be enabled and configured. + +**AAD device join**: The hybrid AAD join process uses the system context to perform device AAD join, therefore it is not affected by user based AAD join permission settings. In addition, all users are enabled to join devices to AAD by default. + +#### Step by step instructions + +See [Deploy hybrid Azure AD joined devices using Intune and Windows Autopilot](https://docs.microsoft.com/intune/windows-autopilot-hybrid). + +Also see the **Validation** section in the [Windows Autopilot user-driven mode](user-driven.md) topic. + +## Validation + +When performing a user-driven deployment using Windows Autopilot, the following end-user experience should be observed: + +- If multiple languages are preinstalled in Windows 10, the user must pick a language. +- The user must pick a locale and a keyboard layout, and optionally a second keyboard layout. +- If connected via Ethernet, no network prompt is expected. If no Ethernet connection is available and Wi-fi is built in, the user needs to connect to a wireless network. +- Once connected to a network, the Autopilot profile will be downloaded. +- Windows 10 will check for critical OOBE updates, and if any are available they will be automatically installed (rebooting if required). +- The user will be prompted for Azure Active Directory credentials, with a customized user experience showing the Azure AD tenant name, logo, and sign-in text. +- Once correct credentials have been entered, the device will join Azure Active Directory. +- After joining Azure Active Directory, the device will enroll in Intune (or other configured MDM services). +- If configured, the [enrollment status page](enrollment-status.md) will be displayed. +- Once the device configuration tasks have completed, the user will be signed into Windows 10 using the credentials they previously provided. +- Once signed in, the enrollment status page will again be displayed for user-targeted configuration tasks. + +If your results do not match these expectations, see the [Windows Autopilot Troubleshooting](troubleshooting.md) documentation. From 1f7099ea9c24ef398b7a4165b0c11fcf466b39ca Mon Sep 17 00:00:00 2001 From: John Liu <49762389+ShenLanJohn@users.noreply.github.com> Date: Tue, 24 Sep 2019 12:53:33 -0700 Subject: [PATCH 14/43] CAT Auto Pulish for Windows Release Messages - CAT_AutoPublish_20190924114748 (#1184) (#1186) --- windows/release-information/windows-message-center.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/release-information/windows-message-center.yml b/windows/release-information/windows-message-center.yml index e9cda8004c..e1bdd172ec 100644 --- a/windows/release-information/windows-message-center.yml +++ b/windows/release-information/windows-message-center.yml @@ -50,9 +50,9 @@ sections: text: "
    MessageDate
    Status update: September 2019 Windows \"C\" optional release available
    The September 2019 optional monthly “C” release for all supported versions of Windows is now available. For more information on the different types of monthly quality updates, see our Windows 10 update servicing cadence primer. Follow @WindowsUpdate for the latest on the availability of this release.
    		September 24, 2019
    08:10 AM PT
    Plan for change: Windows Media Center Electronic Program Guide retiring in January 2020
    Starting in January 2020, Microsoft is retiring its Electronic Program Guide (EPG) service for all versions of Windows Media Center. To continue receiving TV Program Guide information on your Windows Media Center, you’ll need to configure an alternate TV listing provider.
    		September 24, 2019
    08:00 AM PT
    Advisory: Scripting Engine Memory Corruption Vulnerability (CVE-2019-1367)
    On September 23, 2019, Microsoft released a security update to address a remote code execution vulnerability in the way the scripting engine handles objects in memory in Internet Explorer. An attacker who successfully exploited the vulnerability could gain the same user permissions as the current user. For example, if a user is logged on with administrative rights, an attacker could take control of an affected system and install programs; view, change, or delete data; or create new accounts with full user rights. Alternatively, an attacker could host a specially crafted website targeting Internet Explorer and then entice a user to open web page or a malicious document attached to an e-mail. For more information about the vulnerability, see the Microsoft Security Guide CVE-2019-1367 | Scripting Engine Memory Corruption Vulnerability. 
     
    Mitigation for this vulnerability is available from the Microsoft Security Update Guide. For the best protection, we recommend you apply the latest Windows updates and follow security best practices and do not open attachments or documents from an untrusted source. For more information about the vulnerability, see the Microsoft Security Guide: CVE-2019-1367 | Scripting Engine Memory Corruption Vulnerability. 
    		September 22, 2019
    11:00 AM PT
    Status of September 2019 “C” release
    The optional monthly “C” release for September 2019 for all supported versions of Windows and Windows Server prior to Windows 10, version 1903 and Windows Server, version 1903 will be available in the near term. For more information on the different types of monthly quality updates, see our Windows 10 update servicing cadence primer. Follow @WindowsUpdate for the latest on the availability of this release.
    		September 19, 2019
    04:11 PM PT
    Plan for change: End of service reminders for Windows 10, versions 1703 and 1803
    The Enterprise and Education editions of Windows 10, version 1703 (the Creators Update) will reach end of service on October 8, 2019. The Home, Pro, Pro for Workstations, and IoT Core editions of Windows 10, version 1803 (the April 2018 Update) will reach end of service on November 12, 2019. We recommend that you update devices running these versions and editions to the latest version of Windows 10—Windows 10, version 1903—as soon as possible to help keep them protected and your environments secure.
    		September 13, 2019
    03:23 PM PT
    + - From 6cc47dc5bb19733a44aa59a48bd45605477e7f30 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Tue, 24 Sep 2019 13:12:58 -0700 Subject: [PATCH 15/43] Added dev comments --- .../client-management/mdm/policy-csp-audit.md | 760 ++++++++---------- 1 file changed, 357 insertions(+), 403 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-audit.md b/windows/client-management/mdm/policy-csp-audit.md index 7f3ffd9290..5d5b50ce4d 100644 --- a/windows/client-management/mdm/policy-csp-audit.md +++ b/windows/client-management/mdm/policy-csp-audit.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 09/19/2019 +ms.date: 09/24/2019 --- # Policy CSP - Audit @@ -218,10 +218,10 @@ ms.date: 09/19/2019 - - - - + + + + @@ -238,7 +238,7 @@ ms.date: 09/19/2019 -This policy setting allows you to audit events generated by a failed attempt to log on to an account that is locked out. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by a failed attempt to log on to an account that is locked out. If you configure this policy setting, an audit event is generated when an account cannot log on to a computer because the account is locked out. Success audits record successful attempts and Failure audits record unsuccessful attempts. @@ -256,11 +256,10 @@ GP Info: The following are the supported values: - 0 — Off/None -- 1 — Success +- 1 (default) — Success - 2 — Failure - 3 — Success+Failure -Default: Success. @@ -288,10 +287,10 @@ Default: Success. - - - - + + + + @@ -308,7 +307,7 @@ Default: Success. -This policy allows you to audit the group memberhsip information in the user's logon token. Events in this subcategory are generated on the computer on which a logon session is created. For an interactive logon, the security audit event is generated on the computer that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. +Available in Windows 10, version 1803 and later. This policy allows you to audit the group memberhsip information in the user's logon token. Events in this subcategory are generated on the computer on which a logon session is created. For an interactive logon, the security audit event is generated on the computer that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. When this setting is configured, one or more security audit events are generated for each successful logon. You must also enable the Audit Logon setting under Advanced Audit Policy Configuration\System Audit Policies\Logon/Logoff. Multiple events are generated if the group memberhsip information cannot fit in a single security audit event. @@ -322,12 +321,11 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure -Default: No Auditing. @@ -355,10 +353,10 @@ Default: No Auditing. - - - - + + + + @@ -375,7 +373,7 @@ Default: No Auditing. -This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Extended Mode negotiations. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Extended Mode negotiations. If you configure this policy setting, an audit event is generated during an IPsec Extended Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated during an IPsec Extended Mode negotiation. @@ -391,12 +389,11 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure -Default: No Auditing. @@ -424,10 +421,10 @@ Default: No Auditing. - - - - + + + + @@ -444,7 +441,7 @@ Default: No Auditing. -This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Main Mode negotiations. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Main Mode negotiations. If you configure this policy setting, an audit event is generated during an IPsec Main Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated during an IPsec Main Mode negotiation. @@ -459,12 +456,11 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure -Default: No Auditing. @@ -492,10 +488,10 @@ Default: No Auditing. - - - - + + + + @@ -512,7 +508,7 @@ Default: No Auditing. -This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Quick Mode negotiations. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Quick Mode negotiations. If you configure this policy setting, an audit event is generated during an IPsec Quick Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts.If you do not configure this policy setting, no audit event is generated during an IPsec Quick Mode negotiation. @@ -527,12 +523,11 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure -Default: No Auditing. @@ -560,10 +555,10 @@ Default: No Auditing. - - - - + + + + @@ -580,7 +575,7 @@ Default: No Auditing. -This policy setting allows you to audit events generated by the closing of a logon session. These events occur on the computer that was accessed. For an interactive logoff the security audit event is generated on the computer that the user account logged on to. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by the closing of a logon session. These events occur on the computer that was accessed. For an interactive logoff the security audit event is generated on the computer that the user account logged on to. If you configure this policy setting, an audit event is generated when a logon session is closed. Success audits record successful attempts to close sessions and Failure audits record unsuccessful attempts to close sessions. If you do not configure this policy setting, no audit event is generated when a logon session is closed. @@ -596,11 +591,10 @@ GP Info: The following are the supported values: - 0 — Off/None -- 1 — Success +- 1 (default) — Success - 2 — Failure - 3 — Success+Failure -Default: Success. @@ -628,10 +622,10 @@ Default: Success. - - - - + + + + @@ -648,7 +642,7 @@ Default: Success. -This policy setting allows you to audit events generated by user account logon attempts on the computer. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by user account logon attempts on the computer. Events in this subcategory are related to the creation of logon sessions and occur on the computer which was accessed. For an interactive logon, the security audit event is generated on the computer that the user account logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. The following events are included: - Successful logon attempts. @@ -667,13 +661,10 @@ GP Info: The following are the supported values: - 0 — Off/None -- 1 — Success +- 1 (default on Client editions) — Success - 2 — Failure -- 3 — Success+Failure +- 3 (default on Server editions) — Success+Failure -Default on Client editions: Success. - -Default on Server editions: Success, Failure. @@ -701,10 +692,10 @@ Default on Server editions: Success, Failure. - - - - + + + + @@ -721,7 +712,7 @@ Default on Server editions: Success, Failure. -This policy setting allows you to audit events generated by RADIUS (IAS) and Network Access Protection (NAP) user access requests. These requests can be Grant, Deny, Discard, Quarantine, Lock, and Unlock. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by RADIUS (IAS) and Network Access Protection (NAP) user access requests. These requests can be Grant, Deny, Discard, Quarantine, Lock, and Unlock. If you configure this policy setting, an audit event is generated for each IAS and NAP user access request. Success audits record successful user access requests and Failure audits record unsuccessful attempts. If you do not configure this policy settings, IAS and NAP user access requests are not audited. @@ -768,10 +759,10 @@ Default: Success, Failure. - - - - + + + + @@ -788,7 +779,7 @@ Default: Success, Failure. -This policy setting allows you to audit other logon/logoff-related events that are not covered in the “Logon/Logoff” policy setting, such as the following: +Available in Windows 10, version 1803 and later. This policy setting allows you to audit other logon/logoff-related events that are not covered in the “Logon/Logoff” policy setting, such as the following: - Terminal Services session disconnections. - New Terminal Services sessions. - Locking and unlocking a workstation. @@ -808,12 +799,11 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure -Default: No Auditing. @@ -841,10 +831,10 @@ Default: No Auditing. - - - - + + + + @@ -861,7 +851,7 @@ Default: No Auditing. -This policy setting allows you to audit events generated by special logons, such as the following: +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by special logons, such as the following: - The use of a special logon, which is a logon that has administrator-equivalent privileges and can be used to elevate a process to a higher level. - A logon by a member of a Special Group. Special Groups enable you to audit events generated when a member of a certain group has logged on to your network. You can configure a list of group security identifiers (SIDs) in the registry. If any of those SIDs are added to a token during logon and the subcategory is enabled, an event is logged. For more information about this feature, see [article 947223 in the Microsoft Knowledge Base](https://go.microsoft.com/fwlink/?LinkId=121697). @@ -876,11 +866,10 @@ GP Info: The following are the supported values: - 0 — Off/None -- 1 — Success +- 1 (default) — Success - 2 — Failure - 3 — Success+Failure -Default: Success. @@ -908,10 +897,10 @@ Default: Success. - - - - + + + + @@ -928,7 +917,7 @@ Default: Success. -This policy allows you to audit user and device claims information in the user's logon token. Events in this subcategory are generated on the computer on which a logon session is created. For an interactive logon, the security audit event is generated on the computer that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. +Available in Windows 10, version 1803 and later. This policy allows you to audit user and device claims information in the user's logon token. Events in this subcategory are generated on the computer on which a logon session is created. For an interactive logon, the security audit event is generated on the computer that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. User claims are added to a logon token when claims are included with a user's account attributes in Active Directory. Device claims are added to the logon token when claims are included with a device's computer account attributes in Active Directory. In addition, compound identity must be enabled for the domain and on the computer where the user logged on. @@ -944,12 +933,11 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure -Default: No Auditing. @@ -977,10 +965,10 @@ Default: No Auditing. - - - - + + + + @@ -997,7 +985,7 @@ Default: No Auditing. -This policy setting allows you to audit events generated by validation tests on user account logon credentials. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by validation tests on user account logon credentials. Events in this subcategory occur only on the computer that is authoritative for those credentials. For domain accounts, the domain controller is authoritative. For local accounts, the local computer is authoritative. @@ -1011,14 +999,11 @@ GP Info: The following are the supported values: -- 0 — Off/None -- 1 — Success +- 0 (default on Client editions) — Off/None +- 1 (default on Server editions) — Success - 2 — Failure - 3 — Success+Failure -Default on Client editions: No Auditing. - -Default on Server editions: Success. @@ -1046,10 +1031,10 @@ Default on Server editions: Success. - - - - + + + + @@ -1066,7 +1051,7 @@ Default on Server editions: Success. -This policy setting allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests. If you configure this policy setting, an audit event is generated after a Kerberos authentication TGT request. Success audits record successful requests and Failure audits record unsuccessful requests. If you do not configure this policy setting, no audit event is generated after a Kerberos authentication TGT request. @@ -1081,14 +1066,11 @@ GP Info: The following are the supported values: -- 0 — Off/None -- 1 — Success +- 0 (default on Client editions) — Off/None +- 1 (default on Server editions) — Success - 2 — Failure - 3 — Success+Failure -Default on Client editions: No Auditing - -Default on Server editions: Success. @@ -1116,10 +1098,10 @@ Default on Server editions: Success. - - - - + + + + @@ -1136,7 +1118,7 @@ Default on Server editions: Success. -This policy setting allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests submitted for user accounts. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests submitted for user accounts. If you configure this policy setting, an audit event is generated after a Kerberos authentication TGT is requested for a user account. Success audits record successful requests and Failure audits record unsuccessful requests. If you do not configure this policy setting, no audit event is generated after a Kerberos authentication TGT is request for a user account. @@ -1151,14 +1133,11 @@ GP Info: The following are the supported values: -- 0 — Off/None -- 1 — Success +- 0 (default on Client editions) — Off/None +- 1 (default on Server editions) — Success - 2 — Failure - 3 — Success+Failure -Default on Client editions: No Auditing. - -Default on Server editions: Success. @@ -1186,10 +1165,10 @@ Default on Server editions: Success. - - - - + + + + @@ -1206,7 +1185,7 @@ Default on Server editions: Success. -This policy setting allows you to audit events generated by responses to credential requests submitted for a user account logon that are not credential validation or Kerberos tickets. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by responses to credential requests submitted for a user account logon that are not credential validation or Kerberos tickets. Currently, there are no events in this subcategory. @@ -1219,12 +1198,11 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure -Default: No Auditing. @@ -1252,10 +1230,10 @@ Default: No Auditing. - - - - + + + + @@ -1272,7 +1250,7 @@ Default: No Auditing. -This policy setting allows you to audit events generated by changes to application groups, such as the following: +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by changes to application groups, such as the following: - Application group is created, changed, or deleted. - Member is added or removed from an application group. @@ -1289,12 +1267,11 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure -Default: No Auditing. @@ -1322,10 +1299,10 @@ Default: No Auditing. - - - - + + + + @@ -1342,7 +1319,7 @@ Default: No Auditing. -This policy setting allows you to audit events generated by changes to computer accounts such as when a computer account is created, changed, or deleted. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by changes to computer accounts such as when a computer account is created, changed, or deleted. If you configure this policy setting, an audit event is generated when an attempt to change a computer account is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a computer account changes. @@ -1357,14 +1334,11 @@ GP Info: The following are the supported values: -- 0 — Off/None -- 1 — Success +- 0 (default on Client editions) — Off/None +- 1 (default on Server editions) — Success - 2 — Failure - 3 — Success+Failure -Default on Client editions: No Auditing. - -Default on Server editions: Success. @@ -1392,10 +1366,10 @@ Default on Server editions: Success. - - - - + + + + @@ -1412,7 +1386,7 @@ Default on Server editions: Success. -This policy setting allows you to audit events generated by changes to distribution groups, such as the following: +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by changes to distribution groups, such as the following: - Distribution group is created, changed, or deleted. - Member is added or removed from a distribution group. - Distribution group type is changed. @@ -1433,12 +1407,11 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure -Default: No Auditing. @@ -1466,10 +1439,10 @@ Default: No Auditing. - - - - + + + + @@ -1486,7 +1459,7 @@ Default: No Auditing. -This policy setting allows you to audit events generated by other user account changes that are not covered in this category, such as the following: +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by other user account changes that are not covered in this category, such as the following: - The password hash of a user account was accessed. This typically happens during an Active Directory Management Tool password migration. - The Password Policy Checking API was called. Calls to this function can be part of an attack when a malicious application tests the policy to reduce the number of attempts during a password dictionary attack. - Changes to the Default Domain Group Policy under the following Group Policy paths: @@ -1506,12 +1479,11 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure -Default: No Auditing. @@ -1539,10 +1511,10 @@ Default: No Auditing. - - - - + + + + @@ -1559,7 +1531,7 @@ Default: No Auditing. -This policy setting allows you to audit events generated by changes to security groups, such as the following: +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by changes to security groups, such as the following: - Security group is created, changed, or deleted. - Member is added or removed from a security group. - Group type is changed. @@ -1578,11 +1550,10 @@ GP Info: The following are the supported values: - 0 — Off/None -- 1 — Success +- 1 (default) — Success - 2 — Failure - 3 — Success+Failure -Default: Success. @@ -1610,10 +1581,10 @@ Default: Success. - - - - + + + + @@ -1630,7 +1601,7 @@ Default: Success. -This policy setting allows you to audit changes to user accounts. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit changes to user accounts. Events include the following: - A user account is created, changed, deleted; renamed, disabled, enabled, locked out, or unlocked. - A user account’s password is set or changed. @@ -1653,11 +1624,10 @@ GP Info: The following are the supported values: - 0 — Off/None -- 1 — Success +- 1 (default) — Success - 2 — Failure - 3 — Success+Failure -Default: Success. @@ -1685,10 +1655,10 @@ Default: Success. - - - - + + + + @@ -1705,7 +1675,7 @@ Default: Success. -This policy setting allows you to audit events generated by detailed Active Directory Domain Services (AD DS) replication between domain controllers. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by detailed Active Directory Domain Services (AD DS) replication between domain controllers. Volume: High. @@ -1718,12 +1688,11 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure -Default: No Auditing. @@ -1751,10 +1720,10 @@ Default: No Auditing. - - - - + + + + @@ -1771,7 +1740,7 @@ Default: No Auditing. -This policy setting allows you to audit events generated when an Active Directory Domain Services (AD DS) object is accessed. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated when an Active Directory Domain Services (AD DS) object is accessed. Only AD DS objects with a matching system access control list (SACL) are logged. @@ -1787,14 +1756,11 @@ GP Info: The following are the supported values: -- 0 — Off/None -- 1 — Success +- 0 (default on Client editions) — Off/None +- 1 (default on Server editions) — Success - 2 — Failure - 3 — Success+Failure -Default on Client editions: No Auditing. - -Default on Server editions: Success. @@ -1822,10 +1788,10 @@ Default on Server editions: Success. - - - - + + + + @@ -1842,7 +1808,7 @@ Default on Server editions: Success. -This policy setting allows you to audit events generated by changes to objects in Active Directory Domain Services (AD DS). Events are logged when an object is created, deleted, modified, moved, or undeleted. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by changes to objects in Active Directory Domain Services (AD DS). Events are logged when an object is created, deleted, modified, moved, or undeleted. When possible, events logged in this subcategory indicate the old and new values of the object’s properties. @@ -1864,12 +1830,11 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure -Default: No Auditing @@ -1897,10 +1862,10 @@ Default: No Auditing - - - - + + + + @@ -1917,7 +1882,7 @@ Default: No Auditing -This policy setting allows you to audit replication between two Active Directory Domain Services (AD DS) domain controllers. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit replication between two Active Directory Domain Services (AD DS) domain controllers. If you configure this policy setting, an audit event is generated during AD DS replication. Success audits record successful replication and Failure audits record unsuccessful replication. If you do not configure this policy setting, no audit event is generated during AD DS replication. @@ -1935,12 +1900,11 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure -Default: No Auditing. @@ -1968,10 +1932,10 @@ Default: No Auditing. - - - - + + + + @@ -1988,7 +1952,7 @@ Default: No Auditing. -This policy setting allows you to audit events generated when encryption or decryption requests are made to the Data Protection application interface (DPAPI). DPAPI is used to protect secret information such as stored password and key information. For more information about DPAPI, see https://go.microsoft.com/fwlink/?LinkId=121720. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated when encryption or decryption requests are made to the Data Protection application interface (DPAPI). DPAPI is used to protect secret information such as stored password and key information. For more information about DPAPI, see https://go.microsoft.com/fwlink/?LinkId=121720. If you configure this policy setting, an audit event is generated when an encryption or decryption request is made to DPAPI. Success audits record successful requests and Failure audits record unsuccessful requests. If you do not configure this policy setting, no audit event is generated when an encryption or decryption request is made to DPAPI. @@ -2003,7 +1967,7 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure @@ -2034,10 +1998,10 @@ The following are the supported values: - - - - + + + + @@ -2054,7 +2018,7 @@ The following are the supported values: -This policy setting allows you to audit when plug and play detects an external device. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit when plug and play detects an external device. If you configure this policy setting, an audit event is generated whenever plug and play detects an external device. Only Success audits are recorded for this category. If you do not configure this policy setting, no audit event is generated when an external device is detected by plug and play. @@ -2069,7 +2033,7 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure @@ -2100,10 +2064,10 @@ The following are the supported values: - - - - + + + + @@ -2120,7 +2084,7 @@ The following are the supported values: -This policy setting allows you to audit events generated when a process is created or starts. The name of the application or user that created the process is also audited. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated when a process is created or starts. The name of the application or user that created the process is also audited. If you configure this policy setting, an audit event is generated when a process is created. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a process is created. @@ -2135,7 +2099,7 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure @@ -2166,10 +2130,10 @@ The following are the supported values: - - - - + + + + @@ -2186,7 +2150,7 @@ The following are the supported values: -This policy setting allows you to audit events generated when a process ends. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated when a process ends. If you configure this policy setting, an audit event is generated when a process ends. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a process ends. @@ -2232,10 +2196,10 @@ The following are the supported values: - - - - + + + + @@ -2252,7 +2216,7 @@ The following are the supported values: -This policy setting allows you to audit inbound remote procedure call (RPC) connections. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit inbound remote procedure call (RPC) connections. If you configure this policy setting, an audit event is generated when a remote RPC connection is attempted. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a remote RPC connection is attempted. @@ -2267,7 +2231,7 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure @@ -2298,10 +2262,10 @@ The following are the supported values: - - - - + + + + @@ -2318,7 +2282,7 @@ The following are the supported values: -This policy setting allows you to audit events generated by adjusting the privileges of a token. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by adjusting the privileges of a token. Volume: High. @@ -2330,12 +2294,11 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure -Default: No Auditing. @@ -2363,10 +2326,10 @@ Default: No Auditing. - - - - + + + + @@ -2383,7 +2346,7 @@ Default: No Auditing. -This policy setting allows you to audit applications that generate events using the Windows Auditing application programming interfaces (APIs). Applications designed to use the Windows Auditing API use this subcategory to log auditing events related to their function. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit applications that generate events using the Windows Auditing application programming interfaces (APIs). Applications designed to use the Windows Auditing API use this subcategory to log auditing events related to their function. Events in this subcategory include: - Creation of an application client context. - Deletion of an application client context. @@ -2400,7 +2363,7 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure @@ -2431,10 +2394,10 @@ The following are the supported values: - - - - + + + + @@ -2451,7 +2414,7 @@ The following are the supported values: -This policy setting allows you to audit access requests where the permission granted or denied by a proposed policy differs from the current central access policy on an object. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit access requests where the permission granted or denied by a proposed policy differs from the current central access policy on an object. If you configure this policy setting, an audit event is generated each time a user accesses an object and the permission granted by the current central access policy on the object differs from that granted by the proposed policy. The resulting audit event will be generated as follows: 1. Success audits, when configured, records access attempts when the current central access policy grants access but the proposed policy denies access. @@ -2470,12 +2433,11 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure -Default: No Auditing. @@ -2503,10 +2465,10 @@ Default: No Auditing. - - - - + + + + @@ -2523,8 +2485,9 @@ Default: No Auditing. -This policy setting allows you to audit Active Directory Certificate Services (AD CS) operations. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit Active Directory Certificate Services (AD CS) operations. AD CS operations include the following: + - AD CS startup/shutdown/backup/restore. - Changes to the certificate revocation list (CRL). - New certificate requests. @@ -2552,7 +2515,7 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure @@ -2583,10 +2546,10 @@ The following are the supported values: - - - - + + + + @@ -2603,7 +2566,7 @@ The following are the supported values: -This policy setting allows you to audit attempts to access files and folders on a shared folder. The Detailed File Share setting logs an event every time a file or folder is accessed, whereas the File Share setting only records one event for any connection established between a client and file share. Detailed File Share audit events include detailed information about the permissions or other criteria used to grant or deny access. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit attempts to access files and folders on a shared folder. The Detailed File Share setting logs an event every time a file or folder is accessed, whereas the File Share setting only records one event for any connection established between a client and file share. Detailed File Share audit events include detailed information about the permissions or other criteria used to grant or deny access. If you configure this policy setting, an audit event is generated when an attempt is made to access a file or folder on a share. The administrator can specify whether to audit only successes, only failures, or both successes and failures. @@ -2620,7 +2583,7 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure @@ -2651,10 +2614,10 @@ The following are the supported values: - - - - + + + + @@ -2671,7 +2634,7 @@ The following are the supported values: -This policy setting allows you to audit attempts to access a shared folder. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit attempts to access a shared folder. If you configure this policy setting, an audit event is generated when an attempt is made to access a shared folder. If this policy setting is defined, the administrator can specify whether to audit only successes, only failures, or both successes and failures. @@ -2688,7 +2651,7 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure @@ -2719,10 +2682,10 @@ The following are the supported values: - - - - + + + + @@ -2739,7 +2702,7 @@ The following are the supported values: -This policy setting allows you to audit user attempts to access file system objects. A security audit event is generated only for objects that have system access control lists (SACL) specified, and only if the type of access requested, such as Write, Read, or Modify and the account making the request match the settings in the SACL. For more information about enabling object access auditing, see https://go.microsoft.com/fwlink/?LinkId=122083. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit user attempts to access file system objects. A security audit event is generated only for objects that have system access control lists (SACL) specified, and only if the type of access requested, such as Write, Read, or Modify and the account making the request match the settings in the SACL. For more information about enabling object access auditing, see [Apply a basic audit policy on a file or folder](https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder). If you configure this policy setting, an audit event is generated each time an account accesses a file system object with a matching SACL. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when an account accesses a file system object with a matching SACL. @@ -2757,7 +2720,7 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure @@ -2788,10 +2751,10 @@ The following are the supported values: - - - - + + + + @@ -2808,7 +2771,7 @@ The following are the supported values: -This policy setting allows you to audit connections that are allowed or blocked by the Windows Filtering Platform (WFP). +Available in Windows 10, version 1803 and later. This policy setting allows you to audit connections that are allowed or blocked by the Windows Filtering Platform (WFP). The following events are included: - The Windows Firewall Service blocks an application from accepting incoming connections on the network. - The WFP allows a connection. @@ -2834,7 +2797,7 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure @@ -2865,10 +2828,10 @@ The following are the supported values: - - - - + + + + @@ -2885,7 +2848,7 @@ The following are the supported values: -This policy setting allows you to audit packets that are dropped by Windows Filtering Platform (WFP). +Available in Windows 10, version 1803 and later. This policy setting allows you to audit packets that are dropped by Windows Filtering Platform (WFP). Volume: High. @@ -2898,7 +2861,7 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure @@ -2929,10 +2892,10 @@ The following are the supported values: - - - - + + + + @@ -2949,7 +2912,7 @@ The following are the supported values: -This policy setting allows you to audit events generated when a handle to an object is opened or closed. Only objects with a matching system access control list (SACL) generate security audit events. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated when a handle to an object is opened or closed. Only objects with a matching system access control list (SACL) generate security audit events. If you configure this policy setting, an audit event is generated when a handle is manipulated. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a handle is manipulated. @@ -2967,7 +2930,7 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure @@ -2998,10 +2961,10 @@ The following are the supported values: - - - - + + + + @@ -3018,7 +2981,7 @@ The following are the supported values: -This policy setting allows you to audit attempts to access the kernel, which include mutexes and semaphores. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit attempts to access the kernel, which include mutexes and semaphores. Only kernel objects with a matching system access control list (SACL) generate security audit events. > [!Note] @@ -3034,7 +2997,7 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure @@ -3065,10 +3028,10 @@ The following are the supported values: - - - - + + + + @@ -3085,7 +3048,7 @@ The following are the supported values: -This policy setting allows you to audit events generated by the management of task scheduler jobs or COM+ objects. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by the management of task scheduler jobs or COM+ objects. For scheduler jobs, the following are audited: - Job created. - Job deleted. @@ -3108,7 +3071,7 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure @@ -3139,10 +3102,10 @@ The following are the supported values: - - - - + + + + @@ -3159,7 +3122,7 @@ The following are the supported values: -This policy setting allows you to audit attempts to access registry objects. A security audit event is generated only for objects that have system access control lists (SACLs) specified, and only if the type of access requested, such as Read, Write, or Modify, and the account making the request match the settings in the SACL. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit attempts to access registry objects. A security audit event is generated only for objects that have system access control lists (SACLs) specified, and only if the type of access requested, such as Read, Write, or Modify, and the account making the request match the settings in the SACL. If you configure this policy setting, an audit event is generated each time an account accesses a registry object with a matching SACL. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when an account accesses a registry object with a matching SACL. @@ -3177,7 +3140,7 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure @@ -3208,10 +3171,10 @@ The following are the supported values: - - - - + + + + @@ -3228,7 +3191,7 @@ The following are the supported values: -This policy setting allows you to audit user attempts to access file system objects on a removable storage device. A security audit event is generated only for all objects for all types of access requested. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit user attempts to access file system objects on a removable storage device. A security audit event is generated only for all objects for all types of access requested. If you configure this policy setting, an audit event is generated each time an account accesses a file system object on a removable storage. Success audits record successful attempts and Failure audits record unsuccessful attempts. @@ -3243,7 +3206,7 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure @@ -3274,10 +3237,10 @@ The following are the supported values: - - - - + + + + @@ -3294,7 +3257,7 @@ The following are the supported values: -This policy setting allows you to audit events generated by attempts to access to Security Accounts Manager (SAM) objects. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by attempts to access to Security Accounts Manager (SAM) objects. SAM objects include the following: - SAM_ALIAS -- A local group. - SAM_GROUP -- A group that is not a local group. @@ -3319,7 +3282,7 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure @@ -3350,10 +3313,10 @@ The following are the supported values: - - - - + + + + @@ -3370,7 +3333,7 @@ The following are the supported values: -This policy setting allows you to audit events generated by changes to the authentication policy, such as the following: +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by changes to the authentication policy, such as the following: - Creation of forest and domain trusts. - Modification of forest and domain trusts. - Removal of forest and domain trusts. @@ -3400,11 +3363,10 @@ GP Info: The following are the supported values: - 0 — Off/None -- 1 — Success +- 1 (default) — Success - 2 — Failure - 3 — Success+Failure -Default: Success. @@ -3432,10 +3394,10 @@ Default: Success. - - - - + + + + @@ -3452,7 +3414,7 @@ Default: Success. -This policy setting allows you to audit events generated by changes to the authorization policy, such as the following: +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by changes to the authorization policy, such as the following: - Assignment of user rights (privileges), such as SeCreateTokenPrivilege, that are not audited through the “Authentication Policy Change” subcategory. - Removal of user rights (privileges), such as SeCreateTokenPrivilege, that are not audited through the “Authentication Policy Change” subcategory. - Changes in the Encrypted File System (EFS) policy. @@ -3472,12 +3434,11 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure -Default: No Auditing. @@ -3505,10 +3466,10 @@ Default: No Auditing. - - - - + + + + @@ -3525,7 +3486,7 @@ Default: No Auditing. -This policy setting allows you to audit events generated by changes to the Windows Filtering Platform (WFP), such as the following: +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by changes to the Windows Filtering Platform (WFP), such as the following: - IPsec services status. - Changes to IPsec policy settings. - Changes to Windows Firewall policy settings. @@ -3544,12 +3505,11 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure -Default: No Auditing. @@ -3577,10 +3537,10 @@ Default: No Auditing. - - - - + + + + @@ -3597,7 +3557,7 @@ Default: No Auditing. -This policy setting allows you to audit events generated by changes in policy rules used by the Microsoft Protection Service (MPSSVC). This service is used by Windows Firewall. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by changes in policy rules used by the Microsoft Protection Service (MPSSVC). This service is used by Windows Firewall. Events include the following: - Reporting of active policies when Windows Firewall service starts. - Changes to Windows Firewall rules. @@ -3619,12 +3579,11 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure -Default: No Auditing. @@ -3652,10 +3611,10 @@ Default: No Auditing. - - - - + + + + @@ -3672,7 +3631,7 @@ Default: No Auditing. -This policy setting allows you to audit events generated by other security policy changes that are not audited in the policy change category, such as the following: +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by other security policy changes that are not audited in the policy change category, such as the following: - Trusted Platform Module (TPM) configuration changes. - Kernel-mode cryptographic self tests. - Cryptographic provider operations. @@ -3690,12 +3649,11 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure -Default: No Auditing. @@ -3723,10 +3681,10 @@ Default: No Auditing. - - - - + + + + @@ -3743,7 +3701,7 @@ Default: No Auditing. -This policy setting allows you to audit changes in the security audit policy settings, such as the following: +Available in Windows 10, version 1803 and later. This policy setting allows you to audit changes in the security audit policy settings, such as the following: - Settings permissions and audit settings on the Audit Policy object. - Changes to the system audit policy. - Registration of security event sources. @@ -3767,11 +3725,10 @@ GP Info: The following are the supported values: - 0 — Off/None -- 1 — Success +- 1 (default) — Success - 2 — Failure - 3 — Success+Failure -Default: Success. @@ -3799,10 +3756,10 @@ Default: Success. - - - - + + + + @@ -3819,7 +3776,7 @@ Default: Success. -This policy setting allows you to audit events generated by the use of non-sensitive privileges (user rights). +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by the use of non-sensitive privileges (user rights). The following privileges are non-sensitive: - Access Credential Manager as a trusted caller. - Access this computer from the network. @@ -3865,7 +3822,7 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure @@ -3896,10 +3853,10 @@ The following are the supported values: - - - - + + + + @@ -3927,7 +3884,7 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure @@ -3958,10 +3915,10 @@ The following are the supported values: - - - - + + + + @@ -3978,7 +3935,7 @@ The following are the supported values: -This policy setting allows you to audit events generated when sensitive privileges (user rights) are used, such as the following: +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated when sensitive privileges (user rights) are used, such as the following: - A privileged service is called. - One of the following privileges are called: - Act as part of the operating system. @@ -4008,7 +3965,7 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure @@ -4039,10 +3996,10 @@ The following are the supported values: - - - - + + + + @@ -4059,7 +4016,7 @@ The following are the supported values: -This policy setting allows you to audit events generated by the IPsec filter driver, such as the following: +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by the IPsec filter driver, such as the following: - Startup and shutdown of the IPsec services. - Network packets dropped due to integrity check failure. - Network packets dropped due to replay check failure. @@ -4080,12 +4037,11 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure -Default: No Auditing. @@ -4113,10 +4069,10 @@ Default: No Auditing. - - - - + + + + @@ -4133,7 +4089,7 @@ Default: No Auditing. -This policy setting allows you to audit any of the following events: +Available in Windows 10, version 1803 and later. This policy setting allows you to audit any of the following events: - Startup and shutdown of the Windows Firewall service and driver. - Security policy processing by the Windows Firewall Service. - Cryptography key file and migration operations. @@ -4181,10 +4137,10 @@ Default: Success, Failure. - - - - + + + + @@ -4201,7 +4157,7 @@ Default: Success, Failure. -This policy setting allows you to audit events generated by changes in the security state of the computer, such as the following events: +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by changes in the security state of the computer, such as the following events: - Startup and shutdown of the computer. - Change of system time. - Recovering the system from CrashOnAuditFail, which is logged after a system restarts when the security event log is full and the CrashOnAuditFail registry entry is configured. @@ -4217,11 +4173,10 @@ GP Info: The following are the supported values: - 0 — Off/None -- 1 — Success +- 1 (default) — Success - 2 — Failure - 3 — Success+Failure -Default: Success. @@ -4249,10 +4204,10 @@ Default: Success. - - - - + + + + @@ -4269,7 +4224,7 @@ Default: Success. -This policy setting allows you to audit events related to security system extensions or services, such as the following: +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events related to security system extensions or services, such as the following: - A security system extension, such as an authentication, notification, or security package is loaded and is registered with the Local Security Authority (LSA). It is used to authenticate logon attempts, submit logon requests, and any account or password changes. Examples of security system extensions are Kerberos and NTLM. - A service is installed and registered with the Service Control Manager. The audit log contains information about the service name, binary, type, start type, and service account. @@ -4286,12 +4241,11 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure -Default: No Auditing. @@ -4319,10 +4273,10 @@ Default: No Auditing. - - - - + + + + @@ -4339,7 +4293,7 @@ Default: No Auditing. -This policy setting allows you to audit events that violate the integrity of the security subsystem, such as the following: +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events that violate the integrity of the security subsystem, such as the following: - Events that could not be written to the event log because of a problem with the auditing system. - A process that uses a local procedure call (LPC) port that is not valid in an attempt to impersonate a client by replying, reading, or writing to or from a client address space. - The detection of a Remote Procedure Call (RPC) that compromises system integrity. From 367b822ef791301854ffd7ed43d1212b7a891a75 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Tue, 24 Sep 2019 13:58:13 -0700 Subject: [PATCH 16/43] Fixed typo --- windows/client-management/mdm/policy-csp-education.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/policy-csp-education.md b/windows/client-management/mdm/policy-csp-education.md index 2fbf4b7af1..a161dad179 100644 --- a/windows/client-management/mdm/policy-csp-education.md +++ b/windows/client-management/mdm/policy-csp-education.md @@ -234,7 +234,7 @@ The following list shows the supported values: Added in Windows 10, version 1709. Allows IT Admins to automatically provision printers based on their names (network host names). -The policy value is expected to be a `````` seperated list of printer names. The OS will attempt to search and install the matching printer driver for each listed printer. +The policy value is expected to be a `````` separated list of printer names. The OS will attempt to search and install the matching printer driver for each listed printer. From 85165d81924673891a4f2ed35d3c7cefec1be3c5 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Tue, 24 Sep 2019 13:59:55 -0700 Subject: [PATCH 17/43] Removed superscript for new policy --- windows/client-management/mdm/policy-csp-education.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-education.md b/windows/client-management/mdm/policy-csp-education.md index a161dad179..40a7ae35c2 100644 --- a/windows/client-management/mdm/policy-csp-education.md +++ b/windows/client-management/mdm/policy-csp-education.md @@ -53,11 +53,11 @@ manager: dansimp - - - - - + + + + + From 2fda7f01a808b1cbffd0153ebf09a15b18fb5806 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Tue, 24 Sep 2019 14:03:53 -0700 Subject: [PATCH 18/43] Updated Policy index page with audit policies --- .../policy-configuration-service-provider.md | 182 ++++++++++++++++++ 1 file changed, 182 insertions(+) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 05ec05440b..914bf6b9a3 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -343,6 +343,188 @@ The following diagram shows the Policy configuration service provider in tree fo +### Audit policies + +
    +
    + Audit/AccountLogonLogoff_AuditAccountLockout +
    +
    + Audit/AccountLogonLogoff_AuditGroupMembership +
    +
    + Audit/AccountLogonLogoff_AuditIPsecExtendedMode +
    +
    + Audit/AccountLogonLogoff_AuditIPsecMainMode +
    +
    + Audit/AccountLogonLogoff_AuditIPsecQuickMode +
    +
    + Audit/AccountLogonLogoff_AuditLogoff +
    +
    + Audit/AccountLogonLogoff_AuditLogon +
    +
    + Audit/AccountLogonLogoff_AuditNetworkPolicyServer +
    +
    + Audit/AccountLogonLogoff_AuditOtherLogonLogoffEvents +
    +
    + Audit/AccountLogonLogoff_AuditSpecialLogon +
    +
    + Audit/AccountLogonLogoff_AuditUserDeviceClaims +
    +
    + Audit/AccountLogon_AuditCredentialValidation +
    +
    + Audit/AccountLogon_AuditKerberosAuthenticationService +
    +
    + Audit/AccountLogon_AuditKerberosServiceTicketOperations +
    +
    + Audit/AccountLogon_AuditOtherAccountLogonEvents +
    +
    + Audit/AccountManagement_AuditApplicationGroupManagement +
    +
    + Audit/AccountManagement_AuditComputerAccountManagement +
    +
    + Audit/AccountManagement_AuditDistributionGroupManagement +
    +
    + Audit/AccountManagement_AuditOtherAccountManagementEvents +
    +
    + Audit/AccountManagement_AuditSecurityGroupManagement +
    +
    + Audit/AccountManagement_AuditUserAccountManagement +
    +
    + Audit/DSAccess_AuditDetailedDirectoryServiceReplication +
    +
    + Audit/DSAccess_AuditDirectoryServiceAccess +
    +
    + Audit/DSAccess_AuditDirectoryServiceChanges +
    +
    + Audit/DSAccess_AuditDirectoryServiceReplication +
    +
    + Audit/DetailedTracking_AuditDPAPIActivity +
    +
    + Audit/DetailedTracking_AuditPNPActivity +
    +
    + Audit/DetailedTracking_AuditProcessCreation +
    +
    + Audit/DetailedTracking_AuditProcessTermination +
    +
    + Audit/DetailedTracking_AuditRPCEvents +
    +
    + Audit/DetailedTracking_AuditTokenRightAdjusted +
    +
    + Audit/ObjectAccess_AuditApplicationGenerated +
    +
    + Audit/ObjectAccess_AuditCentralAccessPolicyStaging +
    +
    + Audit/ObjectAccess_AuditCertificationServices +
    +
    + Audit/ObjectAccess_AuditDetailedFileShare +
    +
    + Audit/ObjectAccess_AuditFileShare +
    +
    + Audit/ObjectAccess_AuditFileSystem +
    +
    + Audit/ObjectAccess_AuditFilteringPlatformConnection +
    +
    + Audit/ObjectAccess_AuditFilteringPlatformPacketDrop +
    +
    + Audit/ObjectAccess_AuditHandleManipulation +
    +
    + Audit/ObjectAccess_AuditKernelObject +
    +
    + Audit/ObjectAccess_AuditOtherObjectAccessEvents +
    +
    + Audit/ObjectAccess_AuditRegistry +
    +
    + Audit/ObjectAccess_AuditRemovableStorage +
    +
    + Audit/ObjectAccess_AuditSAM +
    +
    + Audit/PolicyChange_AuditAuthenticationPolicyChange +
    +
    + Audit/PolicyChange_AuditAuthorizationPolicyChange +
    +
    + Audit/PolicyChange_AuditFilteringPlatformPolicyChange +
    +
    + Audit/PolicyChange_AuditMPSSVCRuleLevelPolicyChange +
    +
    + Audit/PolicyChange_AuditOtherPolicyChangeEvents +
    +
    + Audit/PolicyChange_AuditPolicyChange +
    +
    + Audit/PrivilegeUse_AuditNonSensitivePrivilegeUse +
    +
    + Audit/PrivilegeUse_AuditOtherPrivilegeUseEvents +
    +
    + Audit/PrivilegeUse_AuditSensitivePrivilegeUse +
    +
    + Audit/System_AuditIPsecDriver +
    +
    + Audit/System_AuditOtherSystemEvents +
    +
    + Audit/System_AuditSecurityStateChange +
    +
    + Audit/System_AuditSecuritySystemExtension +
    +
    + Audit/System_AuditSystemIntegrity +
    +
    + ### Authentication policies
    From c2e092aea6d22ace1056c3c26811d87b4b6ccab2 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Tue, 24 Sep 2019 14:05:37 -0700 Subject: [PATCH 19/43] Updated Policy index with new Education policy --- .../mdm/policy-configuration-service-provider.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 05ec05440b..5a8dfa7ec2 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -1131,6 +1131,9 @@ The following diagram shows the Policy configuration service provider in tree fo ### Education policies
    +
    + Education/AllowGraphingCalculator +
    Education/DefaultPrinterName
    From 48156102d55f892330cdd6eface7c864a7c00b23 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Tue, 24 Sep 2019 14:20:54 -0700 Subject: [PATCH 20/43] multiple fixes --- .../mdm/policy-csp-kioskbrowser.md | 2 +- .../mdm/policy-csp-lockdown.md | 2 +- .../mdm/policy-csp-privacy.md | 30 +++++++++---------- 3 files changed, 17 insertions(+), 17 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-kioskbrowser.md b/windows/client-management/mdm/policy-csp-kioskbrowser.md index 351f5e5e34..a83da5f3c2 100644 --- a/windows/client-management/mdm/policy-csp-kioskbrowser.md +++ b/windows/client-management/mdm/policy-csp-kioskbrowser.md @@ -15,7 +15,7 @@ manager: dansimp -These policies currently only apply to Kiosk Browser app. Kiosk Browser is a Microsoft Store app, added in Windows 10 version 1803, that provides IT a way to customize the end user’s browsing experience to fulfill kiosk, signage, and shared device scenarios. Application developers can also create their own kiosk browser and read these policies using [NamedPolicy.GetPolicyFromPath(String, String) Method](https://docs.microsoft.com/uwp/api/windows.management.policies.namedpolicy.getpolicyfrompath#Windows_Management_Policies_NamedPolicy_GetPolicyFromPath_System_String_System_String_). +These policies currently only apply to Kiosk Browser app. Kiosk Browser is a Microsoft Store app, added in Windows 10 version 1803, that provides IT a way to customize the end user's browsing experience to fulfill kiosk, signage, and shared device scenarios. Application developers can also create their own kiosk browser and read these policies using [NamedPolicy.GetPolicyFromPath(String, String) Method](https://docs.microsoft.com/uwp/api/windows.management.policies.namedpolicy.getpolicyfrompath#Windows_Management_Policies_NamedPolicy_GetPolicyFromPath_System_String_System_String_).
    diff --git a/windows/client-management/mdm/policy-csp-lockdown.md b/windows/client-management/mdm/policy-csp-lockdown.md index b775445fbd..960dbecada 100644 --- a/windows/client-management/mdm/policy-csp-lockdown.md +++ b/windows/client-management/mdm/policy-csp-lockdown.md @@ -65,7 +65,7 @@ manager: dansimp -Added in Windows 10, version 1607. Allows the user to invoke any system user interface by swiping in from any screen edge using touch. +Added in Windows 10, version 1607. Allows the user to invoke any system user interface by swiping in from any screen edge using touch. The easiest way to verify the policy is to restart the explorer process or to reboot after the policy is applied. And then try to swipe from the right edge of the screen. The desired result is for Action Center to not be invoked by the swipe. You can also enter tablet mode and attempt to swipe from the top of the screen to rearrange. That will also be disabled. diff --git a/windows/client-management/mdm/policy-csp-privacy.md b/windows/client-management/mdm/policy-csp-privacy.md index d2d5b890fa..de03ff6336 100644 --- a/windows/client-management/mdm/policy-csp-privacy.md +++ b/windows/client-management/mdm/policy-csp-privacy.md @@ -922,11 +922,11 @@ Value type is integer. ADMX Info: -- GP English name: Let Windows apps access background spatial perception -- GP name: LetAppsAccessBackgroundSpatialPerception -- GP element: LetAppsAccessBackgroundSpatialPerception_Enum -- GP path: Windows Components/App Privacy -- GP ADMX file name: AppPrivacy.admx +- GP English name: *Let Windows apps access background spatial perception* +- GP name: *LetAppsAccessBackgroundSpatialPerception* +- GP element: *LetAppsAccessBackgroundSpatialPerception_Enum* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* @@ -989,11 +989,11 @@ Value type is chr. ADMX Info: -- GP English name: Let Windows apps access background spatial perception -- GP name: LetAppsAccessBackgroundSpatialPerception -- GP element: LetAppsAccessBackgroundSpatialPerception_ForceAllowTheseApps_List -- GP path: Windows Components/App Privacy -- GP ADMX file name: AppPrivacy.admx +- GP English name: *Let Windows apps access background spatial perception* +- GP name: *LetAppsAccessBackgroundSpatialPerception* +- GP element: *LetAppsAccessBackgroundSpatialPerception_ForceAllowTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* @@ -1051,11 +1051,11 @@ Value type is chr. ADMX Info: -- GP English name: Let Windows apps access background spatial perception -- GP name: LetAppsAccessBackgroundSpatialPerception -- GP element: LetAppsAccessBackgroundSpatialPerception_ForceDenyTheseApps_List -- GP path: Windows Components/App Privacy -- GP ADMX file name: AppPrivacy.admx +- GP English name: *Let Windows apps access background spatial perception* +- GP name: *LetAppsAccessBackgroundSpatialPerception* +- GP element: *LetAppsAccessBackgroundSpatialPerception_ForceDenyTheseApps_List* +- GP path: Windows *Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* From ff4f7ffe58ac87858ae9eaebe6c91140374b0619 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Tue, 24 Sep 2019 14:22:39 -0700 Subject: [PATCH 21/43] Fixed warning --- .../mdm/policy-configuration-service-provider.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 5a8dfa7ec2..9a03db87e3 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -1132,7 +1132,7 @@ The following diagram shows the Policy configuration service provider in tree fo
    - Education/AllowGraphingCalculator + Education/AllowGraphingCalculator
    Education/DefaultPrinterName From dad8200ce087de0384a7408054676050994abf87 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Tue, 24 Sep 2019 14:58:10 -0700 Subject: [PATCH 22/43] More fixes --- .../mdm/policy-csp-privacy.md | 10 ++-- .../mdm/policy-csp-servicecontrolmanager.md | 7 ++- .../client-management/mdm/policy-csp-start.md | 23 ++++----- .../mdm/policy-csp-system.md | 8 ++- .../mdm/policy-csp-troubleshooting.md | 14 +++--- .../mdm/policy-csp-update.md | 50 +------------------ 6 files changed, 31 insertions(+), 81 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-privacy.md b/windows/client-management/mdm/policy-csp-privacy.md index de03ff6336..3596f45460 100644 --- a/windows/client-management/mdm/policy-csp-privacy.md +++ b/windows/client-management/mdm/policy-csp-privacy.md @@ -1116,11 +1116,11 @@ Value type is chr. ADMX Info: -- GP English name: Let Windows apps access background spatial perception -- GP name: LetAppsAccessBackgroundSpatialPerception -- GP element: LetAppsAccessBackgroundSpatialPerception_UserInControlOfTheseApps_List -- GP path: Windows Components/App Privacy -- GP ADMX file name: AppPrivacy.admx +- GP English name: *Let Windows apps access background spatial perception* +- GP name: *LetAppsAccessBackgroundSpatialPerception* +- GP element: *LetAppsAccessBackgroundSpatialPerception_UserInControlOfTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* diff --git a/windows/client-management/mdm/policy-csp-servicecontrolmanager.md b/windows/client-management/mdm/policy-csp-servicecontrolmanager.md index 15a529a427..43f3e09bab 100644 --- a/windows/client-management/mdm/policy-csp-servicecontrolmanager.md +++ b/windows/client-management/mdm/policy-csp-servicecontrolmanager.md @@ -97,9 +97,6 @@ Supported values: - - -
    Footnotes: @@ -109,4 +106,6 @@ Footnotes: - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. \ No newline at end of file +- 6 - Added in Windows 10, version 1903. + + diff --git a/windows/client-management/mdm/policy-csp-start.md b/windows/client-management/mdm/policy-csp-start.md index bd12c8d9b7..5450d8dc1a 100644 --- a/windows/client-management/mdm/policy-csp-start.md +++ b/windows/client-management/mdm/policy-csp-start.md @@ -668,13 +668,7 @@ The following list shows the supported values: Enabling this policy prevents context menus from being invoked in the Start Menu. - -The following list shows the supported values: -- 0 (default) – False (Do not disable). -- 1 - True (disable). - - ADMX Info: - GP English name: *Disable context menus in the Start Menu* @@ -684,6 +678,10 @@ ADMX Info: +The following list shows the supported values: + +- 0 (default) – False (Do not disable). +- 1 - True (disable). @@ -1100,13 +1098,7 @@ Added in Windows 10, version 1709. Enabling this policy removes the people icon Value type is integer. - -The following list shows the supported values: -- 0 (default) – False (do not hide). -- 1 - True (hide). - - ADMX Info: - GP English name: *Remove the People Bar from the taskbar* @@ -1115,6 +1107,13 @@ ADMX Info: - GP ADMX file name: *StartMenu.admx* + +The following list shows the supported values: + +- 0 (default) – False (do not hide). +- 1 - True (hide). + +
    diff --git a/windows/client-management/mdm/policy-csp-system.md b/windows/client-management/mdm/policy-csp-system.md index eade9cb700..9353e5ca11 100644 --- a/windows/client-management/mdm/policy-csp-system.md +++ b/windows/client-management/mdm/policy-csp-system.md @@ -763,16 +763,14 @@ Specifies whether to allow the user to factory reset the device by using control Most restricted value is 0. - > [!TIP] > This policy is also applicable to Windows 10 and not exclusive to phone. -> -> The following list shows the supported values: -> orted values: + + +The following list shows the supported values: - 0 – Not allowed. - 1 (default) – Allowed to reset to factory default settings. - diff --git a/windows/client-management/mdm/policy-csp-troubleshooting.md b/windows/client-management/mdm/policy-csp-troubleshooting.md index 082308817e..6b1d56a0b6 100644 --- a/windows/client-management/mdm/policy-csp-troubleshooting.md +++ b/windows/client-management/mdm/policy-csp-troubleshooting.md @@ -113,10 +113,11 @@ By default, this policy is not configured and the SKU based defaults are used fo -ADMX Info:
    - GP English name: Troubleshooting: Allow users to access recommended troubleshooting for known problems -- GP name: TroubleshootingAllowRecommendations -- GP path: Troubleshooting and Diagnostics/Microsoft Support Diagnostic Tool -- GP ADMX file name: MSDT.admx +ADMX Info: +- GP English name: *Troubleshooting: Allow users to access recommended troubleshooting for known problems* +- GP name: *TroubleshootingAllowRecommendations* +- GP path: *Troubleshooting and Diagnostics/Microsoft Support Diagnostic Tool* +- GP ADMX file name: *MSDT.admx* @@ -127,8 +128,6 @@ ADMX Info:
    - GP English name: Troubleshooting: Allow users to access r - -
    Footnotes: @@ -138,4 +137,5 @@ Footnotes: - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. \ No newline at end of file +- 6 - Added in Windows 10, version 1903. + diff --git a/windows/client-management/mdm/policy-csp-update.md b/windows/client-management/mdm/policy-csp-update.md index 86359678c2..c29f9811ad 100644 --- a/windows/client-management/mdm/policy-csp-update.md +++ b/windows/client-management/mdm/policy-csp-update.md @@ -13,6 +13,8 @@ manager: dansimp # Policy CSP - Update +> [!NOTE] +> If the MSA service is disabled, Windows Update will no longer offer feature updates to devices running Windows 10 1709 or higher. See [Feature updates are not being offered while other updates are](https://docs.microsoft.com/windows/deployment/update/windows-update-troubleshooting#feature-updates-are-not-being-offered-while-other-updates-are).
    @@ -204,11 +206,6 @@ manager: dansimp
    -> [!NOTE] -> If the MSA service is disabled, Windows Update will no longer offer feature updates to devices running Windows 10 1709 or higher. See [Feature updates are not being offered while other updates are](https://docs.microsoft.com/windows/deployment/update/windows-update-troubleshooting#feature-updates-are-not-being-offered-while-other-updates-are). - -
    - **Update/ActiveHoursEnd** @@ -1379,49 +1376,6 @@ Added in Windows 10, version 1803. Enable IT admin to configure feature update u
    - -**Update/ConfigureFeatureUpdateUninstallPeriod** - - -
    MessageDate
    Advisory: Scripting Engine Memory Corruption Vulnerability (CVE-2019-1367)
    On September 23, 2019, Microsoft released a security update to address a remote code execution vulnerability in the way the scripting engine handles objects in memory in Internet Explorer. An attacker who successfully exploited the vulnerability could gain the same user permissions as the current user. For example, if a user is logged on with administrative rights, an attacker could take control of an affected system and install programs; view, change, or delete data; or create new accounts with full user rights. Alternatively, an attacker could host a specially crafted website targeting Internet Explorer and then entice a user to open web page or a malicious document attached to an e-mail. For more information about the vulnerability, see the Microsoft Security Guide CVE-2019-1367 | Scripting Engine Memory Corruption Vulnerability. 
     
    Mitigation for this vulnerability is available from the Microsoft Security Update Guide. Additionally, on September 24, 2019, mitigation for this vulnerability will be available via Windows Update (WU) and Windows Server Update Services (WSUS) as part of the 9C optional update for all supported versions of Windows, with the exception of Windows 10, version 1903. For devices running Windows 10, version 1903, mitigation for this vulnerability will be available via Windows Update and WSUS as part of the optional 9D update (targeted for September 26, 2019.) You can get the update in Windows via Settings > Windows Update > Check for Updates. (Note: Because this update requires a reboot, we are making it optional to give customers and administrators a choice to install/deploy the update now.)

    For the best protection, we recommend you apply the latest Windows updates and follow security best practices and do not open attachments or documents from an untrusted source. For more information about the vulnerability, see the Microsoft Security Guide: CVE-2019-1367 | Scripting Engine Memory Corruption Vulnerability. 
    		September 24, 2019
    11:00 AM PT
    Status update: September 2019 Windows \"C\" optional release available
    The September 2019 optional monthly “C” release for all supported versions of Windows is now available. For more information on the different types of monthly quality updates, see our Windows 10 update servicing cadence primer. Follow @WindowsUpdate for the latest on the availability of this release.
    		September 24, 2019
    08:10 AM PT
    Plan for change: Windows Media Center Electronic Program Guide retiring in January 2020
    Starting in January 2020, Microsoft is retiring its Electronic Program Guide (EPG) service for all versions of Windows Media Center. To continue receiving TV Program Guide information on your Windows Media Center, you’ll need to configure an alternate TV listing provider.
    		September 24, 2019
    08:00 AM PT
    Advisory: Scripting Engine Memory Corruption Vulnerability (CVE-2019-1367)
    On September 23, 2019, Microsoft released a security update to address a remote code execution vulnerability in the way the scripting engine handles objects in memory in Internet Explorer. An attacker who successfully exploited the vulnerability could gain the same user permissions as the current user. For example, if a user is logged on with administrative rights, an attacker could take control of an affected system and install programs; view, change, or delete data; or create new accounts with full user rights. Alternatively, an attacker could host a specially crafted website targeting Internet Explorer and then entice a user to open web page or a malicious document attached to an e-mail. For more information about the vulnerability, see the Microsoft Security Guide CVE-2019-1367 | Scripting Engine Memory Corruption Vulnerability. 
     
    Mitigation for this vulnerability is available from the Microsoft Security Update Guide. For the best protection, we recommend you apply the latest Windows updates and follow security best practices and do not open attachments or documents from an untrusted source. For more information about the vulnerability, see the Microsoft Security Guide: CVE-2019-1367 | Scripting Engine Memory Corruption Vulnerability. 
    		September 22, 2019
    11:00 AM PT
    Status of September 2019 “C” release
    The optional monthly “C” release for September 2019 for all supported versions of Windows and Windows Server prior to Windows 10, version 1903 and Windows Server, version 1903 will be available in the near term. For more information on the different types of monthly quality updates, see our Windows 10 update servicing cadence primer. Follow @WindowsUpdate for the latest on the availability of this release.
    		September 19, 2019
    04:11 PM PT
    Plan for change: End of service reminders for Windows 10, versions 1703 and 1803
    The Enterprise and Education editions of Windows 10, version 1703 (the Creators Update) will reach end of service on October 8, 2019. The Home, Pro, Pro for Workstations, and IoT Core editions of Windows 10, version 1803 (the April 2018 Update) will reach end of service on November 12, 2019. We recommend that you update devices running these versions and editions to the latest version of Windows 10—Windows 10, version 1903—as soon as possible to help keep them protected and your environments secure.
    		September 13, 2019
    03:23 PM PT
    September 2019 security update available for all supported versions of Windows
    The September 2019 security update release, referred to as our “B” release, is now available for Windows 10, version 1903 and all supported versions of Windows. We recommend that you install these updates promptly. To be informed about the latest updates and releases, follow us on Twitter @WindowsUpdate.
    		September 10, 2019
    09:34 AM PT
    cross markcheck mark6check mark6check mark6check mark6check markcheck markcheck markcheck mark
    cross markcheck mark6check mark6check mark6check mark6check markcheck markcheck markcheck mark
    cross markcheck mark6check mark6check mark6check mark6check markcheck markcheck markcheck mark
    cross markcheck mark6check mark6check mark6check mark6check markcheck markcheck markcheck mark
    cross markcheck mark6check mark6check mark6check mark6check markcheck markcheck markcheck mark
    cross markcheck mark6check mark6check mark6check mark6check markcheck markcheck markcheck mark
    cross markcheck mark6check mark6check mark6check mark6check markcheck markcheck markcheck mark
    cross markcheck mark6check mark6check mark6check mark6check markcheck markcheck markcheck mark
    cross markcheck mark6check mark6check mark6check mark6check markcheck markcheck markcheck mark
    cross markcheck mark6check mark6check mark6check mark6check markcheck markcheck markcheck mark
    cross markcheck mark6check mark6check mark6check mark6check markcheck markcheck markcheck mark
    cross markcheck mark6check mark6check mark6check mark6check markcheck markcheck markcheck mark
    cross markcheck mark6check mark6check mark6check mark6check markcheck markcheck markcheck mark
    cross markcheck mark6check mark6check mark6check mark6check markcheck markcheck markcheck mark
    cross markcheck mark6check mark6check mark6check mark6check markcheck markcheck markcheck mark
    cross markcheck mark6check mark6check mark6check mark6check markcheck markcheck markcheck mark
    cross markcheck mark6check mark6check mark6check mark6check markcheck markcheck markcheck mark
    cross markcheck mark6check mark6check mark6check mark6check markcheck markcheck markcheck mark
    cross markcheck mark6check mark6check mark6check mark6check markcheck markcheck markcheck mark
    cross markcheck mark6check mark6check mark6check mark6check markcheck markcheck markcheck mark
    cross markcheck mark6check mark6check mark6check mark6check markcheck markcheck markcheck mark
    cross markcheck mark6check mark6check mark6check mark6check markcheck markcheck markcheck mark
    cross markcheck mark6check mark6check mark6check mark6check markcheck markcheck markcheck mark
    cross markcheck mark6check mark6check mark6check mark6check markcheck markcheck markcheck mark
    cross markcheck mark6check mark6check mark6check mark6check markcheck markcheck markcheck mark
    cross markcheck mark6check mark6check mark6check mark6check markcheck markcheck markcheck mark
    cross markcheck mark6check mark6check mark6check mark6check markcheck markcheck markcheck mark
    cross markcheck mark6check mark6check mark6check mark6check markcheck markcheck markcheck mark
    cross markcheck mark6check mark6check mark6check mark6check markcheck markcheck markcheck mark
    cross markcheck mark6check mark6check mark6check mark6check markcheck markcheck markcheck mark
    cross markcheck mark6check mark6check mark6check mark6check markcheck markcheck markcheck mark
    cross markcheck mark6check mark6check mark6check mark6check markcheck markcheck markcheck mark
    cross markcheck mark6check mark6check mark6check mark6check markcheck markcheck markcheck mark
    cross markcheck mark6check mark6check mark6check mark6check markcheck markcheck markcheck mark
    cross markcheck mark6check mark6check mark6check mark6check markcheck markcheck markcheck mark
    cross markcheck mark6check mark6check mark6check mark6check markcheck markcheck markcheck mark
    cross markcheck mark6check mark6check mark6check mark6check markcheck markcheck markcheck mark
    cross markcheck mark6check mark6check mark6check mark6check markcheck markcheck markcheck mark
    cross markcheck mark6check mark6check mark6check mark6check markcheck markcheck markcheck mark
    cross markcheck mark6check mark6check mark6check mark6check markcheck markcheck markcheck mark
    cross markcheck mark6check mark6check mark6check mark6check markcheck markcheck markcheck mark
    cross markcheck mark6check mark6check mark6check mark6check markcheck markcheck markcheck mark
    cross markcheck mark6check mark6check mark6check mark6check markcheck markcheck markcheck mark
    cross markcheck mark6check mark6check mark6check mark6check markcheck markcheck markcheck mark
    cross markcheck mark6check mark6check mark6check mark6check markcheck markcheck markcheck mark
    cross markcheck mark6check mark6check mark6check mark6check markcheck markcheck markcheck mark
    cross markcheck mark6check mark6check mark6check mark6check markcheck markcheck markcheck mark
    cross markcheck mark6check mark6check mark6check mark6check markcheck markcheck markcheck mark
    cross markcheck mark6check mark6check mark6check mark6check markcheck markcheck markcheck mark
    cross markcheck mark6check mark6check mark6check mark6check markcheck markcheck markcheck mark
    cross markcheck mark6check mark6check mark6check mark6check markcheck markcheck markcheck mark
    cross markcheck mark6check mark6check mark6check mark6check markcheck markcheck markcheck mark
    cross markcheck mark6check mark6check mark6check mark6check markcheck markcheck markcheck mark
    cross markcheck mark6check mark6check mark6check mark6check markcheck markcheck markcheck mark
    cross markcheck mark6check mark6check mark6check mark6check markcheck markcheck markcheck mark
    cross markcheck mark6check mark6check mark6check mark6check markcheck markcheck markcheck mark
    cross markcheck mark6check mark6check mark6check mark6check markcheck markcheck markcheck mark
    cross markcheck mark6check mark6check mark6check mark6check markcheck markcheck markcheck mark
    cross markcheck mark6check mark6check mark6check mark6check markcheck markcheck markcheck mark
    Mobile Enterprise
    check mark7check mark7check mark7check mark7check mark7check markcheck markcheck markcheck markcheck mark cross mark cross mark
    - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark4check mark4check mark4check mark4cross markcross mark
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1803. Enable IT admin to configure feature update uninstall period. Values range 2 - 60 days. Default is 10 days. - - - - -
    - **Update/DeferFeatureUpdatesPeriodInDays** From 6bea5f1d0e6d46748307a4870b83c7288d00c2e5 Mon Sep 17 00:00:00 2001 From: Thomas Raya Date: Tue, 24 Sep 2019 15:13:29 -0700 Subject: [PATCH 23/43] Update fips-140-validation.md corrected two spelling and one grammar error(s). --- windows/security/threat-protection/fips-140-validation.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/fips-140-validation.md b/windows/security/threat-protection/fips-140-validation.md index 0f43d2fb1a..5f47de9db6 100644 --- a/windows/security/threat-protection/fips-140-validation.md +++ b/windows/security/threat-protection/fips-140-validation.md @@ -1291,7 +1291,7 @@ Validated Editions: Ultimate Edition Algorithms -Base DSS Cryptographic Provider, Base Cryptographic Provider, DSS/Diffie-Hellman Enchanced Cryptographic Provider, and Enhanced Cryptographic Provider +Base DSS Cryptographic Provider, Base Cryptographic Provider, DSS/Diffie-Hellman Enhanced Cryptographic Provider, and Enhanced Cryptographic Provider 5.0.2150.1 76

    FIPS Approved algorithms: Triple-DES (vendor affirmed); DSA/SHA-1 (Certs. #28 and 29); RSA (vendor affirmed)

    @@ -1318,7 +1318,7 @@ Validated Editions: Ultimate Edition Algorithms -Base DSS Cryptographic Provider, Base Cryptographic Provider, DSS/Diffie-Hellman Enchanced Cryptographic Provider, and Enhanced Cryptographic Provider +Base DSS Cryptographic Provider, Base Cryptographic Provider, DSS/Diffie-Hellman Enhanced Cryptographic Provider, and Enhanced Cryptographic Provider 5.0.1877.6 and 5.0.1877.7 75

    FIPS Approved algorithms: Triple-DES (vendor affirmed); SHA-1 (Certs. #20 and 21); DSA/SHA-1 (Certs. #25 and 26); RSA (vendor- affirmed)

    @@ -6220,7 +6220,7 @@ Version 6.3.9600 SHA-256 (BYTE-only)
    SHA-384 (BYTE-only)
    SHA-512 (BYTE-only) -

    Windows 7and SP1 and Windows Server 2008 R2 and SP1 Symmetric Algorithm Implementation #1081

    +

    Windows 7 and SP1 and Windows Server 2008 R2 and SP1 Symmetric Algorithm Implementation #1081

    Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #816

    From 7f1653de94eb191bddd7e0fc98e0a7f9d1af226d Mon Sep 17 00:00:00 2001 From: Thomas Raya Date: Tue, 24 Sep 2019 15:25:01 -0700 Subject: [PATCH 24/43] Update user-driven.md corrected one spelling error in Windows Autopilot User-Driven Mode file. --- windows/deployment/windows-autopilot/user-driven.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/windows-autopilot/user-driven.md b/windows/deployment/windows-autopilot/user-driven.md index aedd4a93ee..ae6ae398bc 100644 --- a/windows/deployment/windows-autopilot/user-driven.md +++ b/windows/deployment/windows-autopilot/user-driven.md @@ -26,7 +26,7 @@ Windows Autopilot user-driven mode is designed to enable new Windows 10 devices - Connect it to a wireless or wired network with internet access. - Specify your e-mail address and password for your organization account. -After completing those simple steps, the remainder of the process is completely automated, with the device being joined to the organization, enrolled in Intune (or another MDM service), and fully configured as defined by the organization. Any additional prompts during the Out-of-Box Experience (OOBE) can be supressed; see [Configuring Autopilot Profiles](profiles.md) for options that are available. +After completing those simple steps, the remainder of the process is completely automated, with the device being joined to the organization, enrolled in Intune (or another MDM service), and fully configured as defined by the organization. Any additional prompts during the Out-of-Box Experience (OOBE) can be suppressed; see [Configuring Autopilot Profiles](profiles.md) for options that are available. Today, Windows Autopilot user-driven mode supports joining devices to Azure Active Directory. Support for Hybrid Azure Active Directory Join (with devices joined to an on-premises Active Directory domain) will be available in a future Windows 10 release. See [Introduction to device management in Azure Active Directory](https://docs.microsoft.com/azure/active-directory/device-management-introduction) for more information about the differences between these two join options. From 061e8b7a87f0ca5857cbf15a0ac7b14613189c03 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Tue, 24 Sep 2019 15:26:26 -0700 Subject: [PATCH 25/43] Fixed typos --- .../new-in-windows-mdm-enrollment-management.md | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md index 6358a8f497..1c11eca4c1 100644 --- a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md @@ -471,7 +471,7 @@ Policy, Policy/Channels, Policy/Channels/ChannelName, Policy/Channels/ChannelNam
  • ShellLauncher
  • StatusConfiguration
    • -

    Updated the AssigneAccessConfiguration schema. Starting in Windows 10, version 1803 AssignedAccess CSP is supported in Windows Holographic for Business edition. Added example for Windows Holographic for Business edition.

    +

    Updated the AssigneAccessConfiguration schema. Starting in Windows 10, version 1803 AssignedAccess CSP is supported in HoloLens (1st gen) Commercial Suite. Added example for HoloLens (1st gen) Commercial Suite.

    MultiSIM CSP @@ -831,7 +831,7 @@ Policy, Policy/Channels, Policy/Channels/ChannelName, Policy/Channels/ChannelNam Messaging CSP -

    Added new CSP. This CSP is only supported in Windows 10 Mobile and Mobile Enteprise editions.

    +

    Added new CSP. This CSP is only supported in Windows 10 Mobile and Mobile Enterprise editions.

    @@ -941,7 +941,7 @@ Policy, Policy/Channels, Policy/Channels/ChannelName, Policy/Channels/ChannelNam
  • WirelessDisplay/AllowProjectionToPCOverInfrastructure
  • WirelessDisplay/AllowUserInputFromWirelessDisplayReceiver

    • Removed TextInput/AllowLinguisticDataCollection

    -

    Starting in Windows 10, version 1703, Update/UpdateServiceUrl is not supported in Windows 10 Mobile Enteprise and IoT Enterprise

    +

    Starting in Windows 10, version 1703, Update/UpdateServiceUrl is not supported in Windows 10 Mobile Enterprise and IoT Enterprise

    Starting in Windows 10, version 1703, the maximum value of Update/DeferFeatureUpdatesPeriodInDays has been increased from 180 days, to 365 days.

    Starting in Windows 10, version 1703, in Browser/HomePages you can use the "<about:blank>" value if you don’t want to send traffic to Microsoft.

    Starting in Windows 10, version 1703, Start/StartLayout can now be set on a per-device basis in addition to the pre-existing per-user basis.

    @@ -1530,7 +1530,7 @@ Policy, Policy/Channels, Policy/Channels/ChannelName, Policy/Channels/ChannelNam -

    Management tool for the Micosoft Store for Business

    +

    Management tool for the Microsoft Store for Business

    New topics. The Store for Business has a new web service designed for the enterprise to acquire, manage, and distribute applications in bulk. It enables several capabilities that are required for the enterprise to manage the lifecycle of applications from acquisition to updates.

    @@ -2196,8 +2196,8 @@ How do I turn if off? | The service can be stopped from the "Services" console o
  • AccountPoliciesAccountLockoutPolicy/AccountLockoutThreshold - removed from docs. Not supported.
  • AccountPoliciesAccountLockoutPolicy/ResetAccountLockoutCounterAfter - removed from docs. Not supported.
  • LocalPoliciesSecurityOptions/NetworkAccess_LetEveryonePermissionsApplyToAnonymousUsers - removed from docs. Not supported.
    • -
  • System/AllowFontProviders is not supported in Windows Holographic for Business.
    • -
  • Security/RequireDeviceEncryption is suported in the Home SKU.
    • +
  • System/AllowFontProviders is not supported in HoloLens (1st gen) Commercial Suite.
    • +
  • Security/RequireDeviceEncryption is supported in the Home SKU.
  • Start/StartLayout - added a table of SKU support information.
  • Start/ImportEdgeAssets - added a table of SKU support information.
    • @@ -2431,7 +2431,7 @@ How do I turn if off? | The service can be stopped from the "Services" console o
  • ShellLauncher
  • StatusConfiguration
    • -

    Updated the AssigneAccessConfiguration schema. Starting in Windows 10, version 1803 AssignedAccess CSP is supported in Windows Holographic for Business edition. Added example for Windows Holographic for Business edition.

    +

    Updated the AssigneAccessConfiguration schema. Starting in Windows 10, version 1803 AssignedAccess CSP is supported in HoloLens (1st gen) Commercial Suite. Added example for HoloLens (1st gen) Commercial Suite.

    MultiSIM CSP @@ -2746,7 +2746,7 @@ How do I turn if off? | The service can be stopped from the "Services" console o

    For examples, see section 4.3.1 RequestSecurityToken of the MS-MDE2 protocol documentation.

    -EntepriseAPN CSP +EnterpriseAPN CSP

    Added a SyncML example.

    From 1eb45dfc647bebcef40b8487237a11825f4aa49f Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Tue, 24 Sep 2019 15:39:50 -0700 Subject: [PATCH 26/43] Fixed typos --- .../client-management/mdm/policy-csp-kioskbrowser.md | 2 +- windows/client-management/mdm/policy-csp-system.md | 12 ++++++------ 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-kioskbrowser.md b/windows/client-management/mdm/policy-csp-kioskbrowser.md index a83da5f3c2..347736e526 100644 --- a/windows/client-management/mdm/policy-csp-kioskbrowser.md +++ b/windows/client-management/mdm/policy-csp-kioskbrowser.md @@ -224,7 +224,7 @@ Added in Windows 10, version 1803. Configures the default URL kiosk browsers to -Shows the Kiosk Browser's end session button. When the policy is enabled, the Kiosk Browser app shows a button to reset the browser. When the user clicks on the button, the app will prompt the user for confirmation to end the session. When the user confirms, the Kiosk broswser will clear all browsing data (cache, cookies, etc.) and navigate back to the default URL. +Shows the Kiosk Browser's end session button. When the policy is enabled, the Kiosk Browser app shows a button to reset the browser. When the user clicks on the button, the app will prompt the user for confirmation to end the session. When the user confirms, the Kiosk browser will clear all browsing data (cache, cookies, etc.) and navigate back to the default URL. diff --git a/windows/client-management/mdm/policy-csp-system.md b/windows/client-management/mdm/policy-csp-system.md index 9353e5ca11..233d029683 100644 --- a/windows/client-management/mdm/policy-csp-system.md +++ b/windows/client-management/mdm/policy-csp-system.md @@ -395,7 +395,7 @@ The following list shows the supported values: - 0 – Disabled. - 1 (default) – Permits Microsoft to configure device settings only. -- 2 – Allows Microsoft to conduct full experimentations. +- 2 – Allows Microsoft to conduct full experimentation. @@ -532,9 +532,9 @@ ADMX Info: The following list shows the supported values: -- 0 – Force Location Off. All Location Privacy settings are toggled off and greyed out. Users cannot change the settings, and no apps are allowed access to the Location service, including Cortana and Search. +- 0 – Force Location Off. All Location Privacy settings are toggled off and grayed out. Users cannot change the settings, and no apps are allowed access to the Location service, including Cortana and Search. - 1 (default) – Location service is allowed. The user has control and can change Location Privacy settings on or off. -- 2 – Force Location On. All Location Privacy settings are toggled on and greyed out. Users cannot change the settings and all consent permissions will be automatically suppressed. +- 2 – Force Location On. All Location Privacy settings are toggled on and grayed out. Users cannot change the settings and all consent permissions will be automatically suppressed. @@ -1004,10 +1004,10 @@ This policy setting determines whether people can change their own telemetry lev If you set this policy setting to "Disable Telemetry opt-in Settings", telemetry levels are disabled in Settings, preventing people from changing them. -If you set this policy setting to "Enable Telemetry opt-in Setings" or don't configure this policy setting, people can change their own telemetry levels in Settings. +If you set this policy setting to "Enable Telemetry opt-in Settings" or don't configure this policy setting, people can change their own telemetry levels in Settings. -Note: -Set the Allow Telemetry policy setting to prevent people from sending diagnostic data to Microsoft beyond your organization's limit. +> [!Note] +> Set the Allow Telemetry policy setting to prevent people from sending diagnostic data to Microsoft beyond your organization's limit. From 086d26e3654c4f33bd8439e5eb79d943d53ba4e4 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Tue, 24 Sep 2019 16:26:34 -0700 Subject: [PATCH 27/43] Updated links --- .../policy-configuration-service-provider.md | 118 +++++++++--------- 1 file changed, 59 insertions(+), 59 deletions(-) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 914bf6b9a3..fe4dd34601 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -347,181 +347,181 @@ The following diagram shows the Policy configuration service provider in tree fo
    - Audit/AccountLogonLogoff_AuditAccountLockout + Audit/AccountLogonLogoff_AuditAccountLockout
    - Audit/AccountLogonLogoff_AuditGroupMembership + Audit/AccountLogonLogoff_AuditGroupMembership
    - Audit/AccountLogonLogoff_AuditIPsecExtendedMode + Audit/AccountLogonLogoff_AuditIPsecExtendedMode
    - Audit/AccountLogonLogoff_AuditIPsecMainMode + Audit/AccountLogonLogoff_AuditIPsecMainMode
    - Audit/AccountLogonLogoff_AuditIPsecQuickMode + Audit/AccountLogonLogoff_AuditIPsecQuickMode
    - Audit/AccountLogonLogoff_AuditLogoff + Audit/AccountLogonLogoff_AuditLogoff
    - Audit/AccountLogonLogoff_AuditLogon + Audit/AccountLogonLogoff_AuditLogon
    - Audit/AccountLogonLogoff_AuditNetworkPolicyServer + Audit/AccountLogonLogoff_AuditNetworkPolicyServer
    - Audit/AccountLogonLogoff_AuditOtherLogonLogoffEvents + Audit/AccountLogonLogoff_AuditOtherLogonLogoffEvents
    - Audit/AccountLogonLogoff_AuditSpecialLogon + Audit/AccountLogonLogoff_AuditSpecialLogon
    - Audit/AccountLogonLogoff_AuditUserDeviceClaims + Audit/AccountLogonLogoff_AuditUserDeviceClaims
    - Audit/AccountLogon_AuditCredentialValidation + Audit/AccountLogon_AuditCredentialValidation
    - Audit/AccountLogon_AuditKerberosAuthenticationService + Audit/AccountLogon_AuditKerberosAuthenticationService
    - Audit/AccountLogon_AuditKerberosServiceTicketOperations + Audit/AccountLogon_AuditKerberosServiceTicketOperations
    - Audit/AccountLogon_AuditOtherAccountLogonEvents + Audit/AccountLogon_AuditOtherAccountLogonEvents
    - Audit/AccountManagement_AuditApplicationGroupManagement + Audit/AccountManagement_AuditApplicationGroupManagement
    - Audit/AccountManagement_AuditComputerAccountManagement + Audit/AccountManagement_AuditComputerAccountManagement
    - Audit/AccountManagement_AuditDistributionGroupManagement + Audit/AccountManagement_AuditDistributionGroupManagement
    - Audit/AccountManagement_AuditOtherAccountManagementEvents + Audit/AccountManagement_AuditOtherAccountManagementEvents
    - Audit/AccountManagement_AuditSecurityGroupManagement + Audit/AccountManagement_AuditSecurityGroupManagement
    - Audit/AccountManagement_AuditUserAccountManagement + Audit/AccountManagement_AuditUserAccountManagement
    - Audit/DSAccess_AuditDetailedDirectoryServiceReplication + Audit/DSAccess_AuditDetailedDirectoryServiceReplication
    - Audit/DSAccess_AuditDirectoryServiceAccess + Audit/DSAccess_AuditDirectoryServiceAccess
    - Audit/DSAccess_AuditDirectoryServiceChanges + Audit/DSAccess_AuditDirectoryServiceChanges
    - Audit/DSAccess_AuditDirectoryServiceReplication + Audit/DSAccess_AuditDirectoryServiceReplication
    - Audit/DetailedTracking_AuditDPAPIActivity + Audit/DetailedTracking_AuditDPAPIActivity
    - Audit/DetailedTracking_AuditPNPActivity + Audit/DetailedTracking_AuditPNPActivity
    - Audit/DetailedTracking_AuditProcessCreation + Audit/DetailedTracking_AuditProcessCreation
    - Audit/DetailedTracking_AuditProcessTermination + Audit/DetailedTracking_AuditProcessTermination
    - Audit/DetailedTracking_AuditRPCEvents + Audit/DetailedTracking_AuditRPCEvents
    - Audit/DetailedTracking_AuditTokenRightAdjusted + Audit/DetailedTracking_AuditTokenRightAdjusted
    - Audit/ObjectAccess_AuditApplicationGenerated + Audit/ObjectAccess_AuditApplicationGenerated
    - Audit/ObjectAccess_AuditCentralAccessPolicyStaging + Audit/ObjectAccess_AuditCentralAccessPolicyStaging
    - Audit/ObjectAccess_AuditCertificationServices + Audit/ObjectAccess_AuditCertificationServices
    - Audit/ObjectAccess_AuditDetailedFileShare + Audit/ObjectAccess_AuditDetailedFileShare
    - Audit/ObjectAccess_AuditFileShare + Audit/ObjectAccess_AuditFileShare
    - Audit/ObjectAccess_AuditFileSystem + Audit/ObjectAccess_AuditFileSystem
    - Audit/ObjectAccess_AuditFilteringPlatformConnection + Audit/ObjectAccess_AuditFilteringPlatformConnection
    - Audit/ObjectAccess_AuditFilteringPlatformPacketDrop + Audit/ObjectAccess_AuditFilteringPlatformPacketDrop
    - Audit/ObjectAccess_AuditHandleManipulation + Audit/ObjectAccess_AuditHandleManipulation
    - Audit/ObjectAccess_AuditKernelObject + Audit/ObjectAccess_AuditKernelObject
    - Audit/ObjectAccess_AuditOtherObjectAccessEvents + Audit/ObjectAccess_AuditOtherObjectAccessEvents
    - Audit/ObjectAccess_AuditRegistry + Audit/ObjectAccess_AuditRegistry
    - Audit/ObjectAccess_AuditRemovableStorage + Audit/ObjectAccess_AuditRemovableStorage
    - Audit/ObjectAccess_AuditSAM + Audit/ObjectAccess_AuditSAM
    - Audit/PolicyChange_AuditAuthenticationPolicyChange + Audit/PolicyChange_AuditAuthenticationPolicyChange
    - Audit/PolicyChange_AuditAuthorizationPolicyChange + Audit/PolicyChange_AuditAuthorizationPolicyChange
    - Audit/PolicyChange_AuditFilteringPlatformPolicyChange + Audit/PolicyChange_AuditFilteringPlatformPolicyChange
    - Audit/PolicyChange_AuditMPSSVCRuleLevelPolicyChange + Audit/PolicyChange_AuditMPSSVCRuleLevelPolicyChange
    - Audit/PolicyChange_AuditOtherPolicyChangeEvents + Audit/PolicyChange_AuditOtherPolicyChangeEvents
    - Audit/PolicyChange_AuditPolicyChange + Audit/PolicyChange_AuditPolicyChange
    - Audit/PrivilegeUse_AuditNonSensitivePrivilegeUse + Audit/PrivilegeUse_AuditNonSensitivePrivilegeUse
    - Audit/PrivilegeUse_AuditOtherPrivilegeUseEvents + Audit/PrivilegeUse_AuditOtherPrivilegeUseEvents
    - Audit/PrivilegeUse_AuditSensitivePrivilegeUse + Audit/PrivilegeUse_AuditSensitivePrivilegeUse
    - Audit/System_AuditIPsecDriver + Audit/System_AuditIPsecDriver
    - Audit/System_AuditOtherSystemEvents + Audit/System_AuditOtherSystemEvents
    - Audit/System_AuditSecurityStateChange + Audit/System_AuditSecurityStateChange
    - Audit/System_AuditSecuritySystemExtension + Audit/System_AuditSecuritySystemExtension
    - Audit/System_AuditSystemIntegrity + Audit/System_AuditSystemIntegrity
    From 76fbc038bf4388e2bced961e5e7fb8059c718698 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Tue, 24 Sep 2019 17:14:08 -0700 Subject: [PATCH 28/43] Fixed ADMX format --- windows/client-management/mdm/policy-csp-privacy.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/policy-csp-privacy.md b/windows/client-management/mdm/policy-csp-privacy.md index 3596f45460..bd4b7bcb8f 100644 --- a/windows/client-management/mdm/policy-csp-privacy.md +++ b/windows/client-management/mdm/policy-csp-privacy.md @@ -1054,7 +1054,7 @@ ADMX Info: - GP English name: *Let Windows apps access background spatial perception* - GP name: *LetAppsAccessBackgroundSpatialPerception* - GP element: *LetAppsAccessBackgroundSpatialPerception_ForceDenyTheseApps_List* -- GP path: Windows *Components/App Privacy* +- GP path: *Windows Components/App Privacy* - GP ADMX file name: *AppPrivacy.admx* From c8e9a1e962ab07a57b4f90ecd29e6412cff0d0a0 Mon Sep 17 00:00:00 2001 From: Tudor Dobrila Date: Tue, 24 Sep 2019 17:59:14 -0700 Subject: [PATCH 29/43] Add more info around allowed threat management --- .../microsoft-defender-atp-mac-preferences.md | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-preferences.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-preferences.md index ffa0df06d3..1902cc1a3f 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-preferences.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-preferences.md @@ -149,6 +149,16 @@ Used to exclude content from the scan by file name. | **Possible values** | any string | | **Comments** | Applicable only if *$type* is *excludedFileName* | +#### Allowed threats + +List of threats (identified by their name) that are not blocked by the product and are instead allowed to run. + +||| +|:---|:---| +| **Domain** | com.microsoft.wdav | +| **Key** | allowedThreats | +| **Data type** | Array of strings | + #### Threat type settings The *threatTypeSettings* preference in the antivirus engine is used to control how certain threat types are handled by the product. @@ -425,7 +435,7 @@ The following configuration profile contains entries for all settings described allowedThreats - eicar + EICAR-Test-File (not a virus) threatTypeSettings @@ -540,7 +550,7 @@ The following configuration profile contains entries for all settings described allowedThreats - eicar + EICAR-Test-File (not a virus) threatTypeSettings From 635541954d563e6343b16370c07a722f1ba34072 Mon Sep 17 00:00:00 2001 From: John Liu <49762389+ShenLanJohn@users.noreply.github.com> Date: Tue, 24 Sep 2019 18:48:10 -0700 Subject: [PATCH 30/43] CAT Auto Pulish for Windows Release Messages - CAT_AutoPublish_20190924173922 (#1193) --- windows/release-information/windows-message-center.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/release-information/windows-message-center.yml b/windows/release-information/windows-message-center.yml index e1bdd172ec..54f29148ec 100644 --- a/windows/release-information/windows-message-center.yml +++ b/windows/release-information/windows-message-center.yml @@ -50,7 +50,7 @@ sections: text: " - + From ee4c9764b95003a333fd7a4e155920f2434e00e0 Mon Sep 17 00:00:00 2001 From: John Liu <49762389+ShenLanJohn@users.noreply.github.com> Date: Tue, 24 Sep 2019 19:13:46 -0700 Subject: [PATCH 31/43] CAT Auto Pulish for Windows Release Messages - 20190924190106 (#1194) * Updated supported values for ScheduleScanDay * multiple fixes * More fixes * Fixed typos * Fixed typos * CAT Auto Pulish for Windows Release Messages - CAT_AutoPublish_20190924173922 (#1193) --- ...ew-in-windows-mdm-enrollment-management.md | 23 ++++++--- .../mdm/policy-csp-defender.md | 26 ++++------ .../mdm/policy-csp-kioskbrowser.md | 4 +- .../mdm/policy-csp-lockdown.md | 2 +- .../mdm/policy-csp-privacy.md | 40 +++++++-------- .../mdm/policy-csp-servicecontrolmanager.md | 7 ++- .../client-management/mdm/policy-csp-start.md | 23 ++++----- .../mdm/policy-csp-system.md | 20 ++++---- .../mdm/policy-csp-troubleshooting.md | 14 +++--- .../mdm/policy-csp-update.md | 50 +------------------ .../windows-message-center.yml | 2 +- 11 files changed, 82 insertions(+), 129 deletions(-) diff --git a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md index 0e6b603e24..1c11eca4c1 100644 --- a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md @@ -56,6 +56,7 @@ For details about Microsoft mobile device management protocols for Windows 10 s - [What is dmwappushsvc?](#what-is-dmwappushsvc) - **Change history in MDM documentation** + - [September 2019](#september-2019) - [August 2019](#august-2019) - [July 2019](#july-2019) - [June 2019](#june-2019) @@ -470,7 +471,7 @@ Policy, Policy/Channels, Policy/Channels/ChannelName, Policy/Channels/ChannelNam
  • ShellLauncher
  • StatusConfiguration
    • -

    Updated the AssigneAccessConfiguration schema. Starting in Windows 10, version 1803 AssignedAccess CSP is supported in Windows Holographic for Business edition. Added example for Windows Holographic for Business edition.

    +

    Updated the AssigneAccessConfiguration schema. Starting in Windows 10, version 1803 AssignedAccess CSP is supported in HoloLens (1st gen) Commercial Suite. Added example for HoloLens (1st gen) Commercial Suite.

    @@ -830,7 +831,7 @@ Policy, Policy/Channels, Policy/Channels/ChannelName, Policy/Channels/ChannelNam - @@ -940,7 +941,7 @@ Policy, Policy/Channels, Policy/Channels/ChannelName, Policy/Channels/ChannelNam
  • WirelessDisplay/AllowProjectionToPCOverInfrastructure
  • WirelessDisplay/AllowUserInputFromWirelessDisplayReceiver

    • Removed TextInput/AllowLinguisticDataCollection

    -

    Starting in Windows 10, version 1703, Update/UpdateServiceUrl is not supported in Windows 10 Mobile Enteprise and IoT Enterprise

    +

    Starting in Windows 10, version 1703, Update/UpdateServiceUrl is not supported in Windows 10 Mobile Enterprise and IoT Enterprise

    Starting in Windows 10, version 1703, the maximum value of Update/DeferFeatureUpdatesPeriodInDays has been increased from 180 days, to 365 days.

    Starting in Windows 10, version 1703, in Browser/HomePages you can use the "<about:blank>" value if you don’t want to send traffic to Microsoft.

    Starting in Windows 10, version 1703, Start/StartLayout can now be set on a per-device basis in addition to the pre-existing per-user basis.

    @@ -1529,7 +1530,7 @@ Policy, Policy/Channels, Policy/Channels/ChannelName, Policy/Channels/ChannelNam - + @@ -1899,6 +1900,12 @@ How do I turn if off? | The service can be stopped from the "Services" console o ## Change history in MDM documentation +### September 2019 + +|New or updated topic | Description| +|--- | ---| +|[Policy CSP - Defender](policy-csp-defender.md)|Updated the supported value list for Defender/ScheduleScanDay policy.| + ### August 2019 |New or updated topic | Description| @@ -2189,8 +2196,8 @@ How do I turn if off? | The service can be stopped from the "Services" console o
  • AccountPoliciesAccountLockoutPolicy/AccountLockoutThreshold - removed from docs. Not supported.
  • AccountPoliciesAccountLockoutPolicy/ResetAccountLockoutCounterAfter - removed from docs. Not supported.
  • LocalPoliciesSecurityOptions/NetworkAccess_LetEveryonePermissionsApplyToAnonymousUsers - removed from docs. Not supported.
    • -
  • System/AllowFontProviders is not supported in Windows Holographic for Business.
    • -
  • Security/RequireDeviceEncryption is suported in the Home SKU.
    • +
  • System/AllowFontProviders is not supported in HoloLens (1st gen) Commercial Suite.
    • +
  • Security/RequireDeviceEncryption is supported in the Home SKU.
  • Start/StartLayout - added a table of SKU support information.
  • Start/ImportEdgeAssets - added a table of SKU support information.
    • @@ -2424,7 +2431,7 @@ How do I turn if off? | The service can be stopped from the "Services" console o
  • ShellLauncher
  • StatusConfiguration
    • -

    Updated the AssigneAccessConfiguration schema. Starting in Windows 10, version 1803 AssignedAccess CSP is supported in Windows Holographic for Business edition. Added example for Windows Holographic for Business edition.

    +

    Updated the AssigneAccessConfiguration schema. Starting in Windows 10, version 1803 AssignedAccess CSP is supported in HoloLens (1st gen) Commercial Suite. Added example for HoloLens (1st gen) Commercial Suite.

    @@ -2739,7 +2746,7 @@ How do I turn if off? | The service can be stopped from the "Services" console o

    For examples, see section 4.3.1 RequestSecurityToken of the MS-MDE2 protocol documentation.

    - + diff --git a/windows/client-management/mdm/policy-csp-defender.md b/windows/client-management/mdm/policy-csp-defender.md index 3d598448d3..e88ef95636 100644 --- a/windows/client-management/mdm/policy-csp-defender.md +++ b/windows/client-management/mdm/policy-csp-defender.md @@ -6,17 +6,13 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 08/26/2019 +ms.date: 09/24/2019 ms.reviewer: manager: dansimp --- # Policy CSP - Defender -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - -
    @@ -2335,17 +2331,17 @@ ADMX Info: -The following list shows the supported values: +The following list shows the supported values: -- 0 (default) – Every day -- 1 – Monday -- 2 – Tuesday -- 3 – Wednesday -- 4 – Thursday -- 5 – Friday -- 6 – Saturday -- 7 – Sunday -- 8 – No scheduled scan +- 0 (default) – Every day +- 1 – Sunday +- 2 – Monday +- 3 – Tuesday +- 4 – Wednesday +- 5 – Thursday +- 6 – Friday +- 7 – Saturday +- 8 – No scheduled scan diff --git a/windows/client-management/mdm/policy-csp-kioskbrowser.md b/windows/client-management/mdm/policy-csp-kioskbrowser.md index 351f5e5e34..347736e526 100644 --- a/windows/client-management/mdm/policy-csp-kioskbrowser.md +++ b/windows/client-management/mdm/policy-csp-kioskbrowser.md @@ -15,7 +15,7 @@ manager: dansimp -These policies currently only apply to Kiosk Browser app. Kiosk Browser is a Microsoft Store app, added in Windows 10 version 1803, that provides IT a way to customize the end user’s browsing experience to fulfill kiosk, signage, and shared device scenarios. Application developers can also create their own kiosk browser and read these policies using [NamedPolicy.GetPolicyFromPath(String, String) Method](https://docs.microsoft.com/uwp/api/windows.management.policies.namedpolicy.getpolicyfrompath#Windows_Management_Policies_NamedPolicy_GetPolicyFromPath_System_String_System_String_). +These policies currently only apply to Kiosk Browser app. Kiosk Browser is a Microsoft Store app, added in Windows 10 version 1803, that provides IT a way to customize the end user's browsing experience to fulfill kiosk, signage, and shared device scenarios. Application developers can also create their own kiosk browser and read these policies using [NamedPolicy.GetPolicyFromPath(String, String) Method](https://docs.microsoft.com/uwp/api/windows.management.policies.namedpolicy.getpolicyfrompath#Windows_Management_Policies_NamedPolicy_GetPolicyFromPath_System_String_System_String_).
    @@ -224,7 +224,7 @@ Added in Windows 10, version 1803. Configures the default URL kiosk browsers to -Shows the Kiosk Browser's end session button. When the policy is enabled, the Kiosk Browser app shows a button to reset the browser. When the user clicks on the button, the app will prompt the user for confirmation to end the session. When the user confirms, the Kiosk broswser will clear all browsing data (cache, cookies, etc.) and navigate back to the default URL. +Shows the Kiosk Browser's end session button. When the policy is enabled, the Kiosk Browser app shows a button to reset the browser. When the user clicks on the button, the app will prompt the user for confirmation to end the session. When the user confirms, the Kiosk browser will clear all browsing data (cache, cookies, etc.) and navigate back to the default URL. diff --git a/windows/client-management/mdm/policy-csp-lockdown.md b/windows/client-management/mdm/policy-csp-lockdown.md index b775445fbd..960dbecada 100644 --- a/windows/client-management/mdm/policy-csp-lockdown.md +++ b/windows/client-management/mdm/policy-csp-lockdown.md @@ -65,7 +65,7 @@ manager: dansimp -Added in Windows 10, version 1607. Allows the user to invoke any system user interface by swiping in from any screen edge using touch. +Added in Windows 10, version 1607. Allows the user to invoke any system user interface by swiping in from any screen edge using touch. The easiest way to verify the policy is to restart the explorer process or to reboot after the policy is applied. And then try to swipe from the right edge of the screen. The desired result is for Action Center to not be invoked by the swipe. You can also enter tablet mode and attempt to swipe from the top of the screen to rearrange. That will also be disabled. diff --git a/windows/client-management/mdm/policy-csp-privacy.md b/windows/client-management/mdm/policy-csp-privacy.md index d2d5b890fa..3596f45460 100644 --- a/windows/client-management/mdm/policy-csp-privacy.md +++ b/windows/client-management/mdm/policy-csp-privacy.md @@ -922,11 +922,11 @@ Value type is integer. ADMX Info: -- GP English name: Let Windows apps access background spatial perception -- GP name: LetAppsAccessBackgroundSpatialPerception -- GP element: LetAppsAccessBackgroundSpatialPerception_Enum -- GP path: Windows Components/App Privacy -- GP ADMX file name: AppPrivacy.admx +- GP English name: *Let Windows apps access background spatial perception* +- GP name: *LetAppsAccessBackgroundSpatialPerception* +- GP element: *LetAppsAccessBackgroundSpatialPerception_Enum* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* @@ -989,11 +989,11 @@ Value type is chr. ADMX Info: -- GP English name: Let Windows apps access background spatial perception -- GP name: LetAppsAccessBackgroundSpatialPerception -- GP element: LetAppsAccessBackgroundSpatialPerception_ForceAllowTheseApps_List -- GP path: Windows Components/App Privacy -- GP ADMX file name: AppPrivacy.admx +- GP English name: *Let Windows apps access background spatial perception* +- GP name: *LetAppsAccessBackgroundSpatialPerception* +- GP element: *LetAppsAccessBackgroundSpatialPerception_ForceAllowTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* @@ -1051,11 +1051,11 @@ Value type is chr. ADMX Info: -- GP English name: Let Windows apps access background spatial perception -- GP name: LetAppsAccessBackgroundSpatialPerception -- GP element: LetAppsAccessBackgroundSpatialPerception_ForceDenyTheseApps_List -- GP path: Windows Components/App Privacy -- GP ADMX file name: AppPrivacy.admx +- GP English name: *Let Windows apps access background spatial perception* +- GP name: *LetAppsAccessBackgroundSpatialPerception* +- GP element: *LetAppsAccessBackgroundSpatialPerception_ForceDenyTheseApps_List* +- GP path: Windows *Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* @@ -1116,11 +1116,11 @@ Value type is chr. ADMX Info: -- GP English name: Let Windows apps access background spatial perception -- GP name: LetAppsAccessBackgroundSpatialPerception -- GP element: LetAppsAccessBackgroundSpatialPerception_UserInControlOfTheseApps_List -- GP path: Windows Components/App Privacy -- GP ADMX file name: AppPrivacy.admx +- GP English name: *Let Windows apps access background spatial perception* +- GP name: *LetAppsAccessBackgroundSpatialPerception* +- GP element: *LetAppsAccessBackgroundSpatialPerception_UserInControlOfTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* diff --git a/windows/client-management/mdm/policy-csp-servicecontrolmanager.md b/windows/client-management/mdm/policy-csp-servicecontrolmanager.md index 15a529a427..43f3e09bab 100644 --- a/windows/client-management/mdm/policy-csp-servicecontrolmanager.md +++ b/windows/client-management/mdm/policy-csp-servicecontrolmanager.md @@ -97,9 +97,6 @@ Supported values: - - -
    Footnotes: @@ -109,4 +106,6 @@ Footnotes: - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. \ No newline at end of file +- 6 - Added in Windows 10, version 1903. + + diff --git a/windows/client-management/mdm/policy-csp-start.md b/windows/client-management/mdm/policy-csp-start.md index bd12c8d9b7..5450d8dc1a 100644 --- a/windows/client-management/mdm/policy-csp-start.md +++ b/windows/client-management/mdm/policy-csp-start.md @@ -668,13 +668,7 @@ The following list shows the supported values: Enabling this policy prevents context menus from being invoked in the Start Menu. - -The following list shows the supported values: -- 0 (default) – False (Do not disable). -- 1 - True (disable). - - ADMX Info: - GP English name: *Disable context menus in the Start Menu* @@ -684,6 +678,10 @@ ADMX Info: +The following list shows the supported values: + +- 0 (default) – False (Do not disable). +- 1 - True (disable). @@ -1100,13 +1098,7 @@ Added in Windows 10, version 1709. Enabling this policy removes the people icon Value type is integer. - -The following list shows the supported values: -- 0 (default) – False (do not hide). -- 1 - True (hide). - - ADMX Info: - GP English name: *Remove the People Bar from the taskbar* @@ -1115,6 +1107,13 @@ ADMX Info: - GP ADMX file name: *StartMenu.admx* + +The following list shows the supported values: + +- 0 (default) – False (do not hide). +- 1 - True (hide). + +
    diff --git a/windows/client-management/mdm/policy-csp-system.md b/windows/client-management/mdm/policy-csp-system.md index eade9cb700..233d029683 100644 --- a/windows/client-management/mdm/policy-csp-system.md +++ b/windows/client-management/mdm/policy-csp-system.md @@ -395,7 +395,7 @@ The following list shows the supported values: - 0 – Disabled. - 1 (default) – Permits Microsoft to configure device settings only. -- 2 – Allows Microsoft to conduct full experimentations. +- 2 – Allows Microsoft to conduct full experimentation. @@ -532,9 +532,9 @@ ADMX Info: The following list shows the supported values: -- 0 – Force Location Off. All Location Privacy settings are toggled off and greyed out. Users cannot change the settings, and no apps are allowed access to the Location service, including Cortana and Search. +- 0 – Force Location Off. All Location Privacy settings are toggled off and grayed out. Users cannot change the settings, and no apps are allowed access to the Location service, including Cortana and Search. - 1 (default) – Location service is allowed. The user has control and can change Location Privacy settings on or off. -- 2 – Force Location On. All Location Privacy settings are toggled on and greyed out. Users cannot change the settings and all consent permissions will be automatically suppressed. +- 2 – Force Location On. All Location Privacy settings are toggled on and grayed out. Users cannot change the settings and all consent permissions will be automatically suppressed. @@ -763,16 +763,14 @@ Specifies whether to allow the user to factory reset the device by using control Most restricted value is 0. - > [!TIP] > This policy is also applicable to Windows 10 and not exclusive to phone. -> -> The following list shows the supported values: -> orted values: + + +The following list shows the supported values: - 0 – Not allowed. - 1 (default) – Allowed to reset to factory default settings. - @@ -1006,10 +1004,10 @@ This policy setting determines whether people can change their own telemetry lev If you set this policy setting to "Disable Telemetry opt-in Settings", telemetry levels are disabled in Settings, preventing people from changing them. -If you set this policy setting to "Enable Telemetry opt-in Setings" or don't configure this policy setting, people can change their own telemetry levels in Settings. +If you set this policy setting to "Enable Telemetry opt-in Settings" or don't configure this policy setting, people can change their own telemetry levels in Settings. -Note: -Set the Allow Telemetry policy setting to prevent people from sending diagnostic data to Microsoft beyond your organization's limit. +> [!Note] +> Set the Allow Telemetry policy setting to prevent people from sending diagnostic data to Microsoft beyond your organization's limit. diff --git a/windows/client-management/mdm/policy-csp-troubleshooting.md b/windows/client-management/mdm/policy-csp-troubleshooting.md index 082308817e..6b1d56a0b6 100644 --- a/windows/client-management/mdm/policy-csp-troubleshooting.md +++ b/windows/client-management/mdm/policy-csp-troubleshooting.md @@ -113,10 +113,11 @@ By default, this policy is not configured and the SKU based defaults are used fo -ADMX Info:
    - GP English name: Troubleshooting: Allow users to access recommended troubleshooting for known problems -- GP name: TroubleshootingAllowRecommendations -- GP path: Troubleshooting and Diagnostics/Microsoft Support Diagnostic Tool -- GP ADMX file name: MSDT.admx +ADMX Info: +- GP English name: *Troubleshooting: Allow users to access recommended troubleshooting for known problems* +- GP name: *TroubleshootingAllowRecommendations* +- GP path: *Troubleshooting and Diagnostics/Microsoft Support Diagnostic Tool* +- GP ADMX file name: *MSDT.admx* @@ -127,8 +128,6 @@ ADMX Info:
    - GP English name: Troubleshooting: Allow users to access r - -
    Footnotes: @@ -138,4 +137,5 @@ Footnotes: - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. \ No newline at end of file +- 6 - Added in Windows 10, version 1903. + diff --git a/windows/client-management/mdm/policy-csp-update.md b/windows/client-management/mdm/policy-csp-update.md index 86359678c2..c29f9811ad 100644 --- a/windows/client-management/mdm/policy-csp-update.md +++ b/windows/client-management/mdm/policy-csp-update.md @@ -13,6 +13,8 @@ manager: dansimp # Policy CSP - Update +> [!NOTE] +> If the MSA service is disabled, Windows Update will no longer offer feature updates to devices running Windows 10 1709 or higher. See [Feature updates are not being offered while other updates are](https://docs.microsoft.com/windows/deployment/update/windows-update-troubleshooting#feature-updates-are-not-being-offered-while-other-updates-are).
    @@ -204,11 +206,6 @@ manager: dansimp
    -> [!NOTE] -> If the MSA service is disabled, Windows Update will no longer offer feature updates to devices running Windows 10 1709 or higher. See [Feature updates are not being offered while other updates are](https://docs.microsoft.com/windows/deployment/update/windows-update-troubleshooting#feature-updates-are-not-being-offered-while-other-updates-are). - -
    - **Update/ActiveHoursEnd** @@ -1379,49 +1376,6 @@ Added in Windows 10, version 1803. Enable IT admin to configure feature update u
    - -**Update/ConfigureFeatureUpdateUninstallPeriod** - - -
    MessageDate
    Advisory: Scripting Engine Memory Corruption Vulnerability (CVE-2019-1367)
    On September 23, 2019, Microsoft released a security update to address a remote code execution vulnerability in the way the scripting engine handles objects in memory in Internet Explorer. An attacker who successfully exploited the vulnerability could gain the same user permissions as the current user. For example, if a user is logged on with administrative rights, an attacker could take control of an affected system and install programs; view, change, or delete data; or create new accounts with full user rights. Alternatively, an attacker could host a specially crafted website targeting Internet Explorer and then entice a user to open web page or a malicious document attached to an e-mail. For more information about the vulnerability, see the Microsoft Security Guide CVE-2019-1367 | Scripting Engine Memory Corruption Vulnerability. 
     
    Mitigation for this vulnerability is available from the Microsoft Security Update Guide. Additionally, on September 24, 2019, mitigation for this vulnerability will be available via Windows Update (WU) and Windows Server Update Services (WSUS) as part of the 9C optional update for all supported versions of Windows, with the exception of Windows 10, version 1903. For devices running Windows 10, version 1903, mitigation for this vulnerability will be available via Windows Update and WSUS as part of the optional 9D update (targeted for September 26, 2019.) You can get the update in Windows via Settings > Windows Update > Check for Updates. (Note: Because this update requires a reboot, we are making it optional to give customers and administrators a choice to install/deploy the update now.)

    For the best protection, we recommend you apply the latest Windows updates and follow security best practices and do not open attachments or documents from an untrusted source. For more information about the vulnerability, see the Microsoft Security Guide: CVE-2019-1367 | Scripting Engine Memory Corruption Vulnerability. 
    		September 24, 2019
    11:00 AM PT
    Advisory: Scripting Engine Memory Corruption Vulnerability (CVE-2019-1367)
    On September 23, 2019, Microsoft released a security update to address a remote code execution vulnerability in the way the scripting engine handles objects in memory in Internet Explorer. An attacker who successfully exploited the vulnerability could gain the same user permissions as the current user. For example, if a user is logged on with administrative rights, an attacker could take control of an affected system and install programs; view, change, or delete data; or create new accounts with full user rights. Alternatively, an attacker could host a specially crafted website targeting Internet Explorer and then entice a user to open web page or a malicious document attached to an e-mail. For more information about the vulnerability, see the Microsoft Security Guide CVE-2019-1367 | Scripting Engine Memory Corruption Vulnerability. 
     
    Mitigation for this vulnerability is available from the Microsoft Security Update Guide. For the best protection, we recommend you apply the latest Windows updates and follow security best practices and do not open attachments or documents from an untrusted source. For more information about the vulnerability, see the Microsoft Security Guide: CVE-2019-1367 | Scripting Engine Memory Corruption Vulnerability. 

    Update: Starting September 24, 2019, mitigation for this vulnerability is included as part of the 9C optional update, via Windows Update (WU) and Microsoft Update Catalog, for all supported versions of Windows 10, with the exception of Windows 10, version 1903 and Windows 10, version 1507 (LTSB). For devices running Windows 10, version 1903, mitigation for this vulnerability will be included as part of the 9D optional update via WU, WSUS and the Microsoft Update Catalog (targeted for September 26, 2019.) To apply this update, go to Settings > Windows Update > Check for Updates. (Note Because this update requires a reboot, we are making it optional to give customers and administrators a choice to install/deploy the update now.) 

    For customers running Windows 8.1/ Windows Server 2012 R2 or below, the 9C update is also available on Windows Server Update Services (WSUS). For other supported versions, IT admins using WSUS can import this update into WSUS/SCCM manually. See instructions on the WSUS and the Catalog Site.
    		September 24, 2019
    05:00 PM PT
    Status update: September 2019 Windows \"C\" optional release available
    The September 2019 optional monthly “C” release for all supported versions of Windows is now available. For more information on the different types of monthly quality updates, see our Windows 10 update servicing cadence primer. Follow @WindowsUpdate for the latest on the availability of this release.
    		September 24, 2019
    08:10 AM PT
    Plan for change: Windows Media Center Electronic Program Guide retiring in January 2020
    Starting in January 2020, Microsoft is retiring its Electronic Program Guide (EPG) service for all versions of Windows Media Center. To continue receiving TV Program Guide information on your Windows Media Center, you’ll need to configure an alternate TV listing provider.
    		September 24, 2019
    08:00 AM PT
    Status of September 2019 “C” release
    The optional monthly “C” release for September 2019 for all supported versions of Windows and Windows Server prior to Windows 10, version 1903 and Windows Server, version 1903 will be available in the near term. For more information on the different types of monthly quality updates, see our Windows 10 update servicing cadence primer. Follow @WindowsUpdate for the latest on the availability of this release.
    		September 19, 2019
    04:11 PM PT
    MultiSIM CSP
    Messaging CSP

    Added new CSP. This CSP is only supported in Windows 10 Mobile and Mobile Enteprise editions.

    +

    Added new CSP. This CSP is only supported in Windows 10 Mobile and Mobile Enterprise editions.

    Management tool for the Micosoft Store for Business

    Management tool for the Microsoft Store for Business

    New topics. The Store for Business has a new web service designed for the enterprise to acquire, manage, and distribute applications in bulk. It enables several capabilities that are required for the enterprise to manage the lifecycle of applications from acquisition to updates.
    MultiSIM CSP
    EntepriseAPN CSPEnterpriseAPN CSP

    Added a SyncML example.

    - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark4check mark4check mark4check mark4cross markcross mark
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1803. Enable IT admin to configure feature update uninstall period. Values range 2 - 60 days. Default is 10 days. - - - - -
    - **Update/DeferFeatureUpdatesPeriodInDays** diff --git a/windows/release-information/windows-message-center.yml b/windows/release-information/windows-message-center.yml index e1bdd172ec..54f29148ec 100644 --- a/windows/release-information/windows-message-center.yml +++ b/windows/release-information/windows-message-center.yml @@ -50,7 +50,7 @@ sections: text: " - + From fbd9612a3c231c7e4a214e9a5b31bde412c04665 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 25 Sep 2019 10:13:49 -0700 Subject: [PATCH 32/43] add other os --- .../threat-protection/microsoft-defender-atp/machine-tags.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/machine-tags.md b/windows/security/threat-protection/microsoft-defender-atp/machine-tags.md index c9543f40e7..08ab2a0d71 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/machine-tags.md +++ b/windows/security/threat-protection/microsoft-defender-atp/machine-tags.md @@ -61,6 +61,9 @@ You can also delete tags from this view. >- Windows Server, version 1803 or later >- Windows Server 2016 >- Windows Server 2012 R2 +>- Windows Server 2008 R2 SP1 +>- Windows 8.1 +>- Windows 7 SP1 Machines with similar tags can be handy when you need to apply contextual action on a specific list of machines. From 8e7d8ca1fec998da0558d3b204e07bb8e82f0705 Mon Sep 17 00:00:00 2001 From: John Liu <49762389+ShenLanJohn@users.noreply.github.com> Date: Wed, 25 Sep 2019 10:58:14 -0700 Subject: [PATCH 33/43] CAT Auto Pulish for Windows Release Messages - CAT_AutoPublish_20190925101810 (#1197) --- windows/release-information/windows-message-center.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/release-information/windows-message-center.yml b/windows/release-information/windows-message-center.yml index 54f29148ec..b7d54944e0 100644 --- a/windows/release-information/windows-message-center.yml +++ b/windows/release-information/windows-message-center.yml @@ -50,7 +50,7 @@ sections: text: "
    MessageDate
    Advisory: Scripting Engine Memory Corruption Vulnerability (CVE-2019-1367)
    On September 23, 2019, Microsoft released a security update to address a remote code execution vulnerability in the way the scripting engine handles objects in memory in Internet Explorer. An attacker who successfully exploited the vulnerability could gain the same user permissions as the current user. For example, if a user is logged on with administrative rights, an attacker could take control of an affected system and install programs; view, change, or delete data; or create new accounts with full user rights. Alternatively, an attacker could host a specially crafted website targeting Internet Explorer and then entice a user to open web page or a malicious document attached to an e-mail. For more information about the vulnerability, see the Microsoft Security Guide CVE-2019-1367 | Scripting Engine Memory Corruption Vulnerability. 
     
    Mitigation for this vulnerability is available from the Microsoft Security Update Guide. Additionally, on September 24, 2019, mitigation for this vulnerability will be available via Windows Update (WU) and Windows Server Update Services (WSUS) as part of the 9C optional update for all supported versions of Windows, with the exception of Windows 10, version 1903. For devices running Windows 10, version 1903, mitigation for this vulnerability will be available via Windows Update and WSUS as part of the optional 9D update (targeted for September 26, 2019.) You can get the update in Windows via Settings > Windows Update > Check for Updates. (Note: Because this update requires a reboot, we are making it optional to give customers and administrators a choice to install/deploy the update now.)

    For the best protection, we recommend you apply the latest Windows updates and follow security best practices and do not open attachments or documents from an untrusted source. For more information about the vulnerability, see the Microsoft Security Guide: CVE-2019-1367 | Scripting Engine Memory Corruption Vulnerability. 
    		September 24, 2019
    11:00 AM PT
    Advisory: Scripting Engine Memory Corruption Vulnerability (CVE-2019-1367)
    On September 23, 2019, Microsoft released a security update to address a remote code execution vulnerability in the way the scripting engine handles objects in memory in Internet Explorer. An attacker who successfully exploited the vulnerability could gain the same user permissions as the current user. For example, if a user is logged on with administrative rights, an attacker could take control of an affected system and install programs; view, change, or delete data; or create new accounts with full user rights. Alternatively, an attacker could host a specially crafted website targeting Internet Explorer and then entice a user to open web page or a malicious document attached to an e-mail. For more information about the vulnerability, see the Microsoft Security Guide CVE-2019-1367 | Scripting Engine Memory Corruption Vulnerability. 
     
    Mitigation for this vulnerability is available from the Microsoft Security Update Guide. For the best protection, we recommend you apply the latest Windows updates and follow security best practices and do not open attachments or documents from an untrusted source. For more information about the vulnerability, see the Microsoft Security Guide: CVE-2019-1367 | Scripting Engine Memory Corruption Vulnerability. 

    Update: Starting September 24, 2019, mitigation for this vulnerability is included as part of the 9C optional update, via Windows Update (WU) and Microsoft Update Catalog, for all supported versions of Windows 10, with the exception of Windows 10, version 1903 and Windows 10, version 1507 (LTSB). For devices running Windows 10, version 1903, mitigation for this vulnerability will be included as part of the 9D optional update via WU, WSUS and the Microsoft Update Catalog (targeted for September 26, 2019.) To apply this update, go to Settings > Windows Update > Check for Updates. (Note Because this update requires a reboot, we are making it optional to give customers and administrators a choice to install/deploy the update now.) 

    For customers running Windows 8.1/ Windows Server 2012 R2 or below, the 9C update is also available on Windows Server Update Services (WSUS). For other supported versions, IT admins using WSUS can import this update into WSUS/SCCM manually. See instructions on the WSUS and the Catalog Site.
    		September 24, 2019
    05:00 PM PT
    Status update: September 2019 Windows \"C\" optional release available
    The September 2019 optional monthly “C” release for all supported versions of Windows is now available. For more information on the different types of monthly quality updates, see our Windows 10 update servicing cadence primer. Follow @WindowsUpdate for the latest on the availability of this release.
    		September 24, 2019
    08:10 AM PT
    Plan for change: Windows Media Center Electronic Program Guide retiring in January 2020
    Starting in January 2020, Microsoft is retiring its Electronic Program Guide (EPG) service for all versions of Windows Media Center. To continue receiving TV Program Guide information on your Windows Media Center, you’ll need to configure an alternate TV listing provider.
    		September 24, 2019
    08:00 AM PT
    Status of September 2019 “C” release
    The optional monthly “C” release for September 2019 for all supported versions of Windows and Windows Server prior to Windows 10, version 1903 and Windows Server, version 1903 will be available in the near term. For more information on the different types of monthly quality updates, see our Windows 10 update servicing cadence primer. Follow @WindowsUpdate for the latest on the availability of this release.
    		September 19, 2019
    04:11 PM PT
    - + From 2527c59e5a27de1fb12cc301009ef4e24061b8a3 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 25 Sep 2019 11:06:17 -0700 Subject: [PATCH 34/43] fix yaml --- .../microsoft-defender-atp/configure-endpoints-non-windows.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-non-windows.md b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-non-windows.md index 7da16a125c..d241c26107 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-non-windows.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-non-windows.md @@ -8,7 +8,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -ms.author macaparas +ms.author: macaparas author: mjcaparas ms.localizationpriority: medium manager: dansimp From c80ef354dc3fe258b142682afe48045e20673a22 Mon Sep 17 00:00:00 2001 From: Raaj Baskaran Date: Wed, 25 Sep 2019 16:01:51 -0500 Subject: [PATCH 35/43] fixed ms alias in metadata --- .../microsoft-defender-atp/configure-endpoints-non-windows.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-non-windows.md b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-non-windows.md index d241c26107..4fd47f3d99 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-non-windows.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-non-windows.md @@ -8,7 +8,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -ms.author: macaparas +ms.author: macapara author: mjcaparas ms.localizationpriority: medium manager: dansimp From ed26cff25f1fa9d982710e6aee4cd9628b604c03 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Wed, 25 Sep 2019 14:08:15 -0700 Subject: [PATCH 36/43] Updated version --- ...ew-in-windows-mdm-enrollment-management.md | 6 +- .../client-management/mdm/policy-csp-audit.md | 590 +++++++++--------- 2 files changed, 300 insertions(+), 296 deletions(-) diff --git a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md index 0e6b603e24..13350f5acf 100644 --- a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md @@ -137,7 +137,11 @@ For details about Microsoft mobile device management protocols for Windows 10 s
  • WindowsLogon/AllowAutomaticRestartSignOn
  • WindowsLogon/ConfigAutomaticRestartSignOn
  • WindowsLogon/EnableFirstLogonAnimation
    • - +     + + + diff --git a/windows/client-management/mdm/policy-csp-audit.md b/windows/client-management/mdm/policy-csp-audit.md index 5d5b50ce4d..094538e285 100644 --- a/windows/client-management/mdm/policy-csp-audit.md +++ b/windows/client-management/mdm/policy-csp-audit.md @@ -218,10 +218,10 @@ ms.date: 09/24/2019 - - - - + + + + @@ -238,7 +238,7 @@ ms.date: 09/24/2019 -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by a failed attempt to log on to an account that is locked out. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by a failed attempt to log on to an account that is locked out. If you configure this policy setting, an audit event is generated when an account cannot log on to a computer because the account is locked out. Success audits record successful attempts and Failure audits record unsuccessful attempts. @@ -287,10 +287,10 @@ The following are the supported values: - - - - + + + + @@ -307,7 +307,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy allows you to audit the group memberhsip information in the user's logon token. Events in this subcategory are generated on the computer on which a logon session is created. For an interactive logon, the security audit event is generated on the computer that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy allows you to audit the group memberhsip information in the user's logon token. Events in this subcategory are generated on the computer on which a logon session is created. For an interactive logon, the security audit event is generated on the computer that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. When this setting is configured, one or more security audit events are generated for each successful logon. You must also enable the Audit Logon setting under Advanced Audit Policy Configuration\System Audit Policies\Logon/Logoff. Multiple events are generated if the group memberhsip information cannot fit in a single security audit event. @@ -353,10 +353,10 @@ The following are the supported values: - - - - + + + + @@ -373,7 +373,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Extended Mode negotiations. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Extended Mode negotiations. If you configure this policy setting, an audit event is generated during an IPsec Extended Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated during an IPsec Extended Mode negotiation. @@ -421,10 +421,10 @@ The following are the supported values: - - - - + + + + @@ -441,7 +441,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Main Mode negotiations. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Main Mode negotiations. If you configure this policy setting, an audit event is generated during an IPsec Main Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated during an IPsec Main Mode negotiation. @@ -488,10 +488,10 @@ The following are the supported values: - - - - + + + + @@ -508,7 +508,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Quick Mode negotiations. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Quick Mode negotiations. If you configure this policy setting, an audit event is generated during an IPsec Quick Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts.If you do not configure this policy setting, no audit event is generated during an IPsec Quick Mode negotiation. @@ -555,10 +555,10 @@ The following are the supported values: - - - - + + + + @@ -575,7 +575,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by the closing of a logon session. These events occur on the computer that was accessed. For an interactive logoff the security audit event is generated on the computer that the user account logged on to. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by the closing of a logon session. These events occur on the computer that was accessed. For an interactive logoff the security audit event is generated on the computer that the user account logged on to. If you configure this policy setting, an audit event is generated when a logon session is closed. Success audits record successful attempts to close sessions and Failure audits record unsuccessful attempts to close sessions. If you do not configure this policy setting, no audit event is generated when a logon session is closed. @@ -622,10 +622,10 @@ The following are the supported values: - - - - + + + + @@ -642,7 +642,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by user account logon attempts on the computer. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by user account logon attempts on the computer. Events in this subcategory are related to the creation of logon sessions and occur on the computer which was accessed. For an interactive logon, the security audit event is generated on the computer that the user account logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. The following events are included: - Successful logon attempts. @@ -692,10 +692,10 @@ The following are the supported values: - - - - + + + + @@ -712,7 +712,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by RADIUS (IAS) and Network Access Protection (NAP) user access requests. These requests can be Grant, Deny, Discard, Quarantine, Lock, and Unlock. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by RADIUS (IAS) and Network Access Protection (NAP) user access requests. These requests can be Grant, Deny, Discard, Quarantine, Lock, and Unlock. If you configure this policy setting, an audit event is generated for each IAS and NAP user access request. Success audits record successful user access requests and Failure audits record unsuccessful attempts. If you do not configure this policy settings, IAS and NAP user access requests are not audited. @@ -759,10 +759,10 @@ Default: Success, Failure. - - - - + + + + @@ -779,7 +779,7 @@ Default: Success, Failure. -Available in Windows 10, version 1803 and later. This policy setting allows you to audit other logon/logoff-related events that are not covered in the “Logon/Logoff” policy setting, such as the following: +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit other logon/logoff-related events that are not covered in the “Logon/Logoff” policy setting, such as the following: - Terminal Services session disconnections. - New Terminal Services sessions. - Locking and unlocking a workstation. @@ -831,10 +831,10 @@ The following are the supported values: - - - - + + + + @@ -851,9 +851,9 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by special logons, such as the following: +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by special logons, such as the following: - The use of a special logon, which is a logon that has administrator-equivalent privileges and can be used to elevate a process to a higher level. -- A logon by a member of a Special Group. Special Groups enable you to audit events generated when a member of a certain group has logged on to your network. You can configure a list of group security identifiers (SIDs) in the registry. If any of those SIDs are added to a token during logon and the subcategory is enabled, an event is logged. For more information about this feature, see [article 947223 in the Microsoft Knowledge Base](https://go.microsoft.com/fwlink/?LinkId=121697). +- A logon by a member of a Special Group. Special Groups enable you to audit events generated when a member of a certain group has logged on to your network. You can configure a list of group security identifiers (SIDs) in the registry. If any of those SIDs are added to a token during logon and the subcategory is enabled, an event is logged. For more information about this feature, see [Audit Special Logon](https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-special-logon). Volume: Low. @@ -897,10 +897,10 @@ The following are the supported values: - - - - + + + + @@ -917,7 +917,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy allows you to audit user and device claims information in the user's logon token. Events in this subcategory are generated on the computer on which a logon session is created. For an interactive logon, the security audit event is generated on the computer that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy allows you to audit user and device claims information in the user's logon token. Events in this subcategory are generated on the computer on which a logon session is created. For an interactive logon, the security audit event is generated on the computer that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. User claims are added to a logon token when claims are included with a user's account attributes in Active Directory. Device claims are added to the logon token when claims are included with a device's computer account attributes in Active Directory. In addition, compound identity must be enabled for the domain and on the computer where the user logged on. @@ -965,10 +965,10 @@ The following are the supported values: - - - - + + + + @@ -985,7 +985,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by validation tests on user account logon credentials. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by validation tests on user account logon credentials. Events in this subcategory occur only on the computer that is authoritative for those credentials. For domain accounts, the domain controller is authoritative. For local accounts, the local computer is authoritative. @@ -1031,10 +1031,10 @@ The following are the supported values: - - - - + + + + @@ -1051,7 +1051,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests. If you configure this policy setting, an audit event is generated after a Kerberos authentication TGT request. Success audits record successful requests and Failure audits record unsuccessful requests. If you do not configure this policy setting, no audit event is generated after a Kerberos authentication TGT request. @@ -1098,10 +1098,10 @@ The following are the supported values: - - - - + + + + @@ -1118,7 +1118,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests submitted for user accounts. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests submitted for user accounts. If you configure this policy setting, an audit event is generated after a Kerberos authentication TGT is requested for a user account. Success audits record successful requests and Failure audits record unsuccessful requests. If you do not configure this policy setting, no audit event is generated after a Kerberos authentication TGT is request for a user account. @@ -1165,10 +1165,10 @@ The following are the supported values: - - - - + + + + @@ -1185,7 +1185,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by responses to credential requests submitted for a user account logon that are not credential validation or Kerberos tickets. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by responses to credential requests submitted for a user account logon that are not credential validation or Kerberos tickets. Currently, there are no events in this subcategory. @@ -1230,10 +1230,10 @@ The following are the supported values: - - - - + + + + @@ -1250,7 +1250,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by changes to application groups, such as the following: +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by changes to application groups, such as the following: - Application group is created, changed, or deleted. - Member is added or removed from an application group. @@ -1299,10 +1299,10 @@ The following are the supported values: - - - - + + + + @@ -1319,7 +1319,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by changes to computer accounts such as when a computer account is created, changed, or deleted. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by changes to computer accounts such as when a computer account is created, changed, or deleted. If you configure this policy setting, an audit event is generated when an attempt to change a computer account is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a computer account changes. @@ -1366,10 +1366,10 @@ The following are the supported values: - - - - + + + + @@ -1386,7 +1386,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by changes to distribution groups, such as the following: +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by changes to distribution groups, such as the following: - Distribution group is created, changed, or deleted. - Member is added or removed from a distribution group. - Distribution group type is changed. @@ -1439,10 +1439,10 @@ The following are the supported values: - - - - + + + + @@ -1459,7 +1459,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by other user account changes that are not covered in this category, such as the following: +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by other user account changes that are not covered in this category, such as the following: - The password hash of a user account was accessed. This typically happens during an Active Directory Management Tool password migration. - The Password Policy Checking API was called. Calls to this function can be part of an attack when a malicious application tests the policy to reduce the number of attempts during a password dictionary attack. - Changes to the Default Domain Group Policy under the following Group Policy paths: @@ -1511,10 +1511,10 @@ The following are the supported values: - - - - + + + + @@ -1531,7 +1531,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by changes to security groups, such as the following: +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by changes to security groups, such as the following: - Security group is created, changed, or deleted. - Member is added or removed from a security group. - Group type is changed. @@ -1581,10 +1581,10 @@ The following are the supported values: - - - - + + + + @@ -1601,7 +1601,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit changes to user accounts. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit changes to user accounts. Events include the following: - A user account is created, changed, deleted; renamed, disabled, enabled, locked out, or unlocked. - A user account’s password is set or changed. @@ -1655,10 +1655,10 @@ The following are the supported values: - - - - + + + + @@ -1675,7 +1675,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by detailed Active Directory Domain Services (AD DS) replication between domain controllers. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by detailed Active Directory Domain Services (AD DS) replication between domain controllers. Volume: High. @@ -1720,10 +1720,10 @@ The following are the supported values: - - - - + + + + @@ -1740,7 +1740,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated when an Active Directory Domain Services (AD DS) object is accessed. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated when an Active Directory Domain Services (AD DS) object is accessed. Only AD DS objects with a matching system access control list (SACL) are logged. @@ -1788,10 +1788,10 @@ The following are the supported values: - - - - + + + + @@ -1808,7 +1808,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by changes to objects in Active Directory Domain Services (AD DS). Events are logged when an object is created, deleted, modified, moved, or undeleted. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by changes to objects in Active Directory Domain Services (AD DS). Events are logged when an object is created, deleted, modified, moved, or undeleted. When possible, events logged in this subcategory indicate the old and new values of the object’s properties. @@ -1862,10 +1862,10 @@ The following are the supported values: - - - - + + + + @@ -1882,7 +1882,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit replication between two Active Directory Domain Services (AD DS) domain controllers. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit replication between two Active Directory Domain Services (AD DS) domain controllers. If you configure this policy setting, an audit event is generated during AD DS replication. Success audits record successful replication and Failure audits record unsuccessful replication. If you do not configure this policy setting, no audit event is generated during AD DS replication. @@ -1932,10 +1932,10 @@ The following are the supported values: - - - - + + + + @@ -1952,7 +1952,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated when encryption or decryption requests are made to the Data Protection application interface (DPAPI). DPAPI is used to protect secret information such as stored password and key information. For more information about DPAPI, see https://go.microsoft.com/fwlink/?LinkId=121720. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated when encryption or decryption requests are made to the Data Protection application interface (DPAPI). DPAPI is used to protect secret information such as stored password and key information. For more information about DPAPI, see https://go.microsoft.com/fwlink/?LinkId=121720. If you configure this policy setting, an audit event is generated when an encryption or decryption request is made to DPAPI. Success audits record successful requests and Failure audits record unsuccessful requests. If you do not configure this policy setting, no audit event is generated when an encryption or decryption request is made to DPAPI. @@ -1998,10 +1998,10 @@ The following are the supported values: - - - - + + + + @@ -2018,7 +2018,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit when plug and play detects an external device. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit when plug and play detects an external device. If you configure this policy setting, an audit event is generated whenever plug and play detects an external device. Only Success audits are recorded for this category. If you do not configure this policy setting, no audit event is generated when an external device is detected by plug and play. @@ -2064,10 +2064,10 @@ The following are the supported values: - - - - + + + + @@ -2084,7 +2084,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated when a process is created or starts. The name of the application or user that created the process is also audited. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated when a process is created or starts. The name of the application or user that created the process is also audited. If you configure this policy setting, an audit event is generated when a process is created. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a process is created. @@ -2130,10 +2130,10 @@ The following are the supported values: - - - - + + + + @@ -2150,7 +2150,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated when a process ends. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated when a process ends. If you configure this policy setting, an audit event is generated when a process ends. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a process ends. @@ -2196,10 +2196,10 @@ The following are the supported values: - - - - + + + + @@ -2216,7 +2216,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit inbound remote procedure call (RPC) connections. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit inbound remote procedure call (RPC) connections. If you configure this policy setting, an audit event is generated when a remote RPC connection is attempted. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a remote RPC connection is attempted. @@ -2262,10 +2262,10 @@ The following are the supported values: - - - - + + + + @@ -2282,7 +2282,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by adjusting the privileges of a token. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by adjusting the privileges of a token. Volume: High. @@ -2326,10 +2326,10 @@ The following are the supported values: - - - - + + + + @@ -2346,7 +2346,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit applications that generate events using the Windows Auditing application programming interfaces (APIs). Applications designed to use the Windows Auditing API use this subcategory to log auditing events related to their function. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit applications that generate events using the Windows Auditing application programming interfaces (APIs). Applications designed to use the Windows Auditing API use this subcategory to log auditing events related to their function. Events in this subcategory include: - Creation of an application client context. - Deletion of an application client context. @@ -2394,10 +2394,10 @@ The following are the supported values: - - - - + + + + @@ -2414,7 +2414,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit access requests where the permission granted or denied by a proposed policy differs from the current central access policy on an object. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit access requests where the permission granted or denied by a proposed policy differs from the current central access policy on an object. If you configure this policy setting, an audit event is generated each time a user accesses an object and the permission granted by the current central access policy on the object differs from that granted by the proposed policy. The resulting audit event will be generated as follows: 1. Success audits, when configured, records access attempts when the current central access policy grants access but the proposed policy denies access. @@ -2465,10 +2465,10 @@ The following are the supported values: - - - - + + + + @@ -2485,7 +2485,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit Active Directory Certificate Services (AD CS) operations. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit Active Directory Certificate Services (AD CS) operations. AD CS operations include the following: - AD CS startup/shutdown/backup/restore. @@ -2546,10 +2546,10 @@ The following are the supported values: - - - - + + + + @@ -2566,7 +2566,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit attempts to access files and folders on a shared folder. The Detailed File Share setting logs an event every time a file or folder is accessed, whereas the File Share setting only records one event for any connection established between a client and file share. Detailed File Share audit events include detailed information about the permissions or other criteria used to grant or deny access. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit attempts to access files and folders on a shared folder. The Detailed File Share setting logs an event every time a file or folder is accessed, whereas the File Share setting only records one event for any connection established between a client and file share. Detailed File Share audit events include detailed information about the permissions or other criteria used to grant or deny access. If you configure this policy setting, an audit event is generated when an attempt is made to access a file or folder on a share. The administrator can specify whether to audit only successes, only failures, or both successes and failures. @@ -2614,10 +2614,10 @@ The following are the supported values: - - - - + + + + @@ -2634,7 +2634,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit attempts to access a shared folder. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit attempts to access a shared folder. If you configure this policy setting, an audit event is generated when an attempt is made to access a shared folder. If this policy setting is defined, the administrator can specify whether to audit only successes, only failures, or both successes and failures. @@ -2682,10 +2682,10 @@ The following are the supported values: - - - - + + + + @@ -2702,7 +2702,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit user attempts to access file system objects. A security audit event is generated only for objects that have system access control lists (SACL) specified, and only if the type of access requested, such as Write, Read, or Modify and the account making the request match the settings in the SACL. For more information about enabling object access auditing, see [Apply a basic audit policy on a file or folder](https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder). +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit user attempts to access file system objects. A security audit event is generated only for objects that have system access control lists (SACL) specified, and only if the type of access requested, such as Write, Read, or Modify and the account making the request match the settings in the SACL. For more information about enabling object access auditing, see [Apply a basic audit policy on a file or folder](https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder). If you configure this policy setting, an audit event is generated each time an account accesses a file system object with a matching SACL. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when an account accesses a file system object with a matching SACL. @@ -2751,10 +2751,10 @@ The following are the supported values: - - - - + + + + @@ -2771,7 +2771,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit connections that are allowed or blocked by the Windows Filtering Platform (WFP). +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit connections that are allowed or blocked by the Windows Filtering Platform (WFP). The following events are included: - The Windows Firewall Service blocks an application from accepting incoming connections on the network. - The WFP allows a connection. @@ -2828,10 +2828,10 @@ The following are the supported values: - - - - + + + + @@ -2848,7 +2848,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit packets that are dropped by Windows Filtering Platform (WFP). +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit packets that are dropped by Windows Filtering Platform (WFP). Volume: High. @@ -2892,10 +2892,10 @@ The following are the supported values: - - - - + + + + @@ -2912,7 +2912,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated when a handle to an object is opened or closed. Only objects with a matching system access control list (SACL) generate security audit events. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated when a handle to an object is opened or closed. Only objects with a matching system access control list (SACL) generate security audit events. If you configure this policy setting, an audit event is generated when a handle is manipulated. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a handle is manipulated. @@ -2961,10 +2961,10 @@ The following are the supported values: - - - - + + + + @@ -2981,7 +2981,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit attempts to access the kernel, which include mutexes and semaphores. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit attempts to access the kernel, which include mutexes and semaphores. Only kernel objects with a matching system access control list (SACL) generate security audit events. > [!Note] @@ -3028,10 +3028,10 @@ The following are the supported values: - - - - + + + + @@ -3048,7 +3048,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by the management of task scheduler jobs or COM+ objects. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by the management of task scheduler jobs or COM+ objects. For scheduler jobs, the following are audited: - Job created. - Job deleted. @@ -3102,10 +3102,10 @@ The following are the supported values: - - - - + + + + @@ -3122,7 +3122,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit attempts to access registry objects. A security audit event is generated only for objects that have system access control lists (SACLs) specified, and only if the type of access requested, such as Read, Write, or Modify, and the account making the request match the settings in the SACL. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit attempts to access registry objects. A security audit event is generated only for objects that have system access control lists (SACLs) specified, and only if the type of access requested, such as Read, Write, or Modify, and the account making the request match the settings in the SACL. If you configure this policy setting, an audit event is generated each time an account accesses a registry object with a matching SACL. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when an account accesses a registry object with a matching SACL. @@ -3171,10 +3171,10 @@ The following are the supported values: - - - - + + + + @@ -3191,7 +3191,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit user attempts to access file system objects on a removable storage device. A security audit event is generated only for all objects for all types of access requested. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit user attempts to access file system objects on a removable storage device. A security audit event is generated only for all objects for all types of access requested. If you configure this policy setting, an audit event is generated each time an account accesses a file system object on a removable storage. Success audits record successful attempts and Failure audits record unsuccessful attempts. @@ -3237,10 +3237,10 @@ The following are the supported values: - - - - + + + + @@ -3257,7 +3257,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by attempts to access to Security Accounts Manager (SAM) objects. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by attempts to access to Security Accounts Manager (SAM) objects. SAM objects include the following: - SAM_ALIAS -- A local group. - SAM_GROUP -- A group that is not a local group. @@ -3313,10 +3313,10 @@ The following are the supported values: - - - - + + + + @@ -3333,7 +3333,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by changes to the authentication policy, such as the following: +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by changes to the authentication policy, such as the following: - Creation of forest and domain trusts. - Modification of forest and domain trusts. - Removal of forest and domain trusts. @@ -3394,10 +3394,10 @@ The following are the supported values: - - - - + + + + @@ -3414,7 +3414,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by changes to the authorization policy, such as the following: +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by changes to the authorization policy, such as the following: - Assignment of user rights (privileges), such as SeCreateTokenPrivilege, that are not audited through the “Authentication Policy Change” subcategory. - Removal of user rights (privileges), such as SeCreateTokenPrivilege, that are not audited through the “Authentication Policy Change” subcategory. - Changes in the Encrypted File System (EFS) policy. @@ -3466,10 +3466,10 @@ The following are the supported values: - - - - + + + + @@ -3486,7 +3486,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by changes to the Windows Filtering Platform (WFP), such as the following: +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by changes to the Windows Filtering Platform (WFP), such as the following: - IPsec services status. - Changes to IPsec policy settings. - Changes to Windows Firewall policy settings. @@ -3537,10 +3537,10 @@ The following are the supported values: - - - - + + + + @@ -3557,7 +3557,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by changes in policy rules used by the Microsoft Protection Service (MPSSVC). This service is used by Windows Firewall. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by changes in policy rules used by the Microsoft Protection Service (MPSSVC). This service is used by Windows Firewall. Events include the following: - Reporting of active policies when Windows Firewall service starts. - Changes to Windows Firewall rules. @@ -3611,10 +3611,10 @@ The following are the supported values: - - - - + + + + @@ -3631,7 +3631,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by other security policy changes that are not audited in the policy change category, such as the following: +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by other security policy changes that are not audited in the policy change category, such as the following: - Trusted Platform Module (TPM) configuration changes. - Kernel-mode cryptographic self tests. - Cryptographic provider operations. @@ -3681,10 +3681,10 @@ The following are the supported values: - - - - + + + + @@ -3701,7 +3701,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit changes in the security audit policy settings, such as the following: +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit changes in the security audit policy settings, such as the following: - Settings permissions and audit settings on the Audit Policy object. - Changes to the system audit policy. - Registration of security event sources. @@ -3756,10 +3756,10 @@ The following are the supported values: - - - - + + + + @@ -3776,7 +3776,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by the use of non-sensitive privileges (user rights). +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by the use of non-sensitive privileges (user rights). The following privileges are non-sensitive: - Access Credential Manager as a trusted caller. - Access this computer from the network. @@ -3853,10 +3853,10 @@ The following are the supported values: - - - - + + + + @@ -3915,10 +3915,10 @@ The following are the supported values: - - - - + + + + @@ -3935,7 +3935,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated when sensitive privileges (user rights) are used, such as the following: +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated when sensitive privileges (user rights) are used, such as the following: - A privileged service is called. - One of the following privileges are called: - Act as part of the operating system. @@ -3996,10 +3996,10 @@ The following are the supported values: - - - - + + + + @@ -4016,7 +4016,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by the IPsec filter driver, such as the following: +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by the IPsec filter driver, such as the following: - Startup and shutdown of the IPsec services. - Network packets dropped due to integrity check failure. - Network packets dropped due to replay check failure. @@ -4069,10 +4069,10 @@ The following are the supported values: - - - - + + + + @@ -4089,7 +4089,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit any of the following events: +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit any of the following events: - Startup and shutdown of the Windows Firewall service and driver. - Security policy processing by the Windows Firewall Service. - Cryptography key file and migration operations. @@ -4137,10 +4137,10 @@ Default: Success, Failure. - - - - + + + + @@ -4157,7 +4157,7 @@ Default: Success, Failure. -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by changes in the security state of the computer, such as the following events: +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by changes in the security state of the computer, such as the following events: - Startup and shutdown of the computer. - Change of system time. - Recovering the system from CrashOnAuditFail, which is logged after a system restarts when the security event log is full and the CrashOnAuditFail registry entry is configured. @@ -4204,10 +4204,10 @@ The following are the supported values: - - - - + + + + @@ -4224,7 +4224,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events related to security system extensions or services, such as the following: +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events related to security system extensions or services, such as the following: - A security system extension, such as an authentication, notification, or security package is loaded and is registered with the Local Security Authority (LSA). It is used to authenticate logon attempts, submit logon requests, and any account or password changes. Examples of security system extensions are Kerberos and NTLM. - A service is installed and registered with the Service Control Manager. The audit log contains information about the service name, binary, type, start type, and service account. @@ -4273,10 +4273,10 @@ The following are the supported values: - - - - + + + + @@ -4293,7 +4293,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events that violate the integrity of the security subsystem, such as the following: +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events that violate the integrity of the security subsystem, such as the following: - Events that could not be written to the event log because of a problem with the auditing system. - A process that uses a local procedure call (LPC) port that is not valid in an attempt to impersonate a client by replying, reading, or writing to or from a client address space. - The detection of a Remote Procedure Call (RPC) that compromises system integrity. From acf34af800938bb474d84837e3393212440c25bc Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Wed, 25 Sep 2019 15:26:45 -0700 Subject: [PATCH 37/43] Updated default values --- .../client-management/mdm/policy-csp-audit.md | 33 +++++++++---------- 1 file changed, 15 insertions(+), 18 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-audit.md b/windows/client-management/mdm/policy-csp-audit.md index 094538e285..8ca25e3b46 100644 --- a/windows/client-management/mdm/policy-csp-audit.md +++ b/windows/client-management/mdm/policy-csp-audit.md @@ -661,9 +661,9 @@ GP Info: The following are the supported values: - 0 — Off/None -- 1 (default on Client editions) — Success +- 1 (default) — Success - 2 — Failure -- 3 (default on Server editions) — Success+Failure +- 3 — Success+Failure @@ -729,9 +729,8 @@ The following are the supported values: - 0 — Off/None - 1 — Success - 2 — Failure -- 3 — Success+Failure +- 3 (default) — Success+Failure -Default: Success, Failure. @@ -999,8 +998,8 @@ GP Info: The following are the supported values: -- 0 (default on Client editions) — Off/None -- 1 (default on Server editions) — Success +- 0 (default) — Off/None +- 1 — Success - 2 — Failure - 3 — Success+Failure @@ -1066,8 +1065,8 @@ GP Info: The following are the supported values: -- 0 (default on Client editions) — Off/None -- 1 (default on Server editions) — Success +- 0 (default) — Off/None +- 1 — Success - 2 — Failure - 3 — Success+Failure @@ -1133,8 +1132,8 @@ GP Info: The following are the supported values: -- 0 (default on Client editions) — Off/None -- 1 (default on Server editions) — Success +- 0 (default) — Off/None +- 1 — Success - 2 — Failure - 3 — Success+Failure @@ -1334,8 +1333,8 @@ GP Info: The following are the supported values: -- 0 (default on Client editions) — Off/None -- 1 (default on Server editions) — Success +- 0 (default) — Off/None +- 1 — Success - 2 — Failure - 3 — Success+Failure @@ -1756,8 +1755,8 @@ GP Info: The following are the supported values: -- 0 (default on Client editions) — Off/None -- 1 (default on Server editions) — Success +- 0 (default) — Off/None +- 1 — Success - 2 — Failure - 3 — Success+Failure @@ -4107,9 +4106,8 @@ The following are the supported values: - 0 — Off/None - 1 — Success - 2 — Failure -- 3 — Success+Failure +- 3 (default) — Success+Failure -Default: Success, Failure. @@ -4313,9 +4311,8 @@ The following are the supported values: - 0 — Off/None - 1 — Success - 2 — Failure -- 3 — Success+Failure +- 3 (default) — Success+Failure -Default: Success, Failure. From 2492957c1987671760ecf66e9d7cde580f9f6ea9 Mon Sep 17 00:00:00 2001 From: Tudor Dobrila Date: Wed, 25 Sep 2019 15:29:21 -0700 Subject: [PATCH 38/43] Cleanup bash snippets --- ...rosoft-defender-atp-mac-install-manually.md | 18 +++++++++--------- ...oft-defender-atp-mac-install-with-intune.md | 11 ++++++----- ...osoft-defender-atp-mac-install-with-jamf.md | 13 +++++++------ .../microsoft-defender-atp-mac-resources.md | 6 +++--- .../microsoft-defender-atp-mac.md | 2 +- 5 files changed, 26 insertions(+), 24 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-manually.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-manually.md index e3142e03ef..ba4afb804d 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-manually.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-manually.md @@ -48,11 +48,11 @@ Download the installation and onboarding packages from Windows Defender Security Extract the contents of the .zip files: ```bash - ls -l + $ ls -l total 721152 -rw-r--r-- 1 test staff 6185 Mar 15 10:45 WindowsDefenderATPOnboardingPackage.zip -rw-r--r-- 1 test staff 354531845 Mar 13 08:57 wdav.pkg - mavel-macmini:Downloads test$ unzip WindowsDefenderATPOnboardingPackage.zip + $ unzip WindowsDefenderATPOnboardingPackage.zip Archive: WindowsDefenderATPOnboardingPackage.zip inflating: WindowsDefenderATPOnboarding.py ``` @@ -92,7 +92,7 @@ If you did not enable Microsoft's driver during installation, then the applicati You can also run ```mdatp --health```. It reports if Real-Time Protection is enabled but not available: ```bash -mdatp --health +$ mdatp --health ... realTimeProtectionAvailable : false realTimeProtectionEnabled : true @@ -112,7 +112,7 @@ In this case, you need to perform the following steps to enable Real-Time Protec 1. In Terminal, attempt to install the driver. (The operation will fail) ```bash - sudo kextutil /Library/Extensions/wdavkext.kext + $ sudo kextutil /Library/Extensions/wdavkext.kext Kext rejected due to system policy: { URL = "file:///Library/StagedExtensions/Library/Extensions/wdavkext.kext/", ID = "com.microsoft.wdavkext" } Kext rejected due to system policy: { URL = "file:///Library/StagedExtensions/Library/Extensions/wdavkext.kext/", ID = "com.microsoft.wdavkext" } Diagnostics for /Library/Extensions/wdavkext.kext: @@ -125,13 +125,13 @@ In this case, you need to perform the following steps to enable Real-Time Protec 4. In Terminal, install the driver again. This time the operation will succeed: ```bash -sudo kextutil /Library/Extensions/wdavkext.kext +$ sudo kextutil /Library/Extensions/wdavkext.kext ``` The banner should disappear from the Defender application, and ```mdatp --health``` should now report that Real-Time Protection is both enabled and available: ```bash -mdatp --health +$ mdatp --health ... realTimeProtectionAvailable : true realTimeProtectionEnabled : true @@ -145,20 +145,20 @@ realTimeProtectionEnabled : true The client machine is not associated with orgId. Note that the *orgId* attribute is blank. ```bash - mdatp --health orgId + $ mdatp --health orgId ``` 2. Run the Python script to install the configuration file: ```bash - /usr/bin/python WindowsDefenderATPOnboarding.py + $ /usr/bin/python WindowsDefenderATPOnboarding.py Generating /Library/Application Support/Microsoft/Defender/com.microsoft.wdav.atp.plist ... (You may be required to enter sudos password) ``` 3. Verify that the machine is now associated with your organization and reports a valid *orgId*: ```bash - mdatp --health orgId + $ mdatp --health orgId E6875323-A6C0-4C60-87AD-114BBE7439B8 ``` diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-intune.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-intune.md index 21be43c179..1abf3471f5 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-intune.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-intune.md @@ -50,28 +50,29 @@ Download the installation and onboarding packages from Microsoft Defender Securi Extract the contents of the .zip files: ```bash - mavel-macmini:Downloads test$ ls -l + $ ls -l total 721688 -rw-r--r-- 1 test staff 269280 Mar 15 11:25 IntuneAppUtil -rw-r--r-- 1 test staff 11821 Mar 15 09:23 WindowsDefenderATPOnboardingPackage.zip -rw-r--r-- 1 test staff 354531845 Mar 13 08:57 wdav.pkg - mavel-macmini:Downloads test$ unzip WindowsDefenderATPOnboardingPackage.zip + $ unzip WindowsDefenderATPOnboardingPackage.zip Archive: WindowsDefenderATPOnboardingPackage.zip warning: WindowsDefenderATPOnboardingPackage.zip appears to use backslashes as path separators inflating: intune/kext.xml inflating: intune/WindowsDefenderATPOnboarding.xml inflating: jamf/WindowsDefenderATPOnboarding.plist - mavel-macmini:Downloads test$ ``` 7. Make IntuneAppUtil an executable: - ```mavel-macmini:Downloads test$ chmod +x IntuneAppUtil``` + ```bash + $ chmod +x IntuneAppUtil + ``` 8. Create the wdav.pkg.intunemac package from wdav.pkg: ```bash - mavel-macmini:Downloads test$ ./IntuneAppUtil -c wdav.pkg -o . -i "com.microsoft.wdav" -n "1.0.0" + $ ./IntuneAppUtil -c wdav.pkg -o . -i "com.microsoft.wdav" -n "1.0.0" Microsoft Intune Application Utility for Mac OS X Version: 1.0.0.0 Copyright 2018 Microsoft Corporation diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md index 9a52b56369..621dee60a6 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md @@ -51,17 +51,16 @@ Download the installation and onboarding packages from Windows Defender Security 5. From the command prompt, verify that you have the two files. Extract the contents of the .zip files like so: ```bash - mavel-macmini:Downloads test$ ls -l + $ ls -l total 721160 -rw-r--r-- 1 test staff 11821 Mar 15 09:23 WindowsDefenderATPOnboardingPackage.zip -rw-r--r-- 1 test staff 354531845 Mar 13 08:57 wdav.pkg - mavel-macmini:Downloads test$ unzip WindowsDefenderATPOnboardingPackage.zip + $ unzip WindowsDefenderATPOnboardingPackage.zip Archive: WindowsDefenderATPOnboardingPackage.zip warning: WindowsDefenderATPOnboardingPackage.zip appears to use backslashes as path separators inflating: intune/kext.xml inflating: intune/WindowsDefenderATPOnboarding.xml inflating: jamf/WindowsDefenderATPOnboarding.plist - mavel-macmini:Downloads test$ ``` ## Create JAMF policies @@ -166,7 +165,7 @@ Once the policy is applied, you'll see the Microsoft Defender ATP icon in the ma You can monitor policy installation on a device by following the JAMF log file: ```bash - mavel-mojave:~ testuser$ tail -f /var/log/jamf.log + $ tail -f /var/log/jamf.log Thu Feb 21 11:11:41 mavel-mojave jamf[7960]: No patch policies were found. Thu Feb 21 11:16:41 mavel-mojave jamf[8051]: Checking for policies triggered by "recurring check-in" for user "testuser"... Thu Feb 21 11:16:43 mavel-mojave jamf[8051]: Executing Policy WDAV @@ -179,7 +178,7 @@ You can monitor policy installation on a device by following the JAMF log file: You can also check the onboarding status: ```bash -mavel-mojave:~ testuser$ mdatp --health +$ mdatp --health ... licensed : true orgId : "4751b7d4-ea75-4e8f-a1f5-6d640c65bc45" @@ -195,7 +194,7 @@ orgId : "4751b7d4-ea75-4e8f-a1f5-6d640c65bc45" You can check that devices have been correctly onboarded by creating a script. For example, the following script checks enrolled devices for onboarding status: ```bash -mdatp --health healthy +$ mdatp --health healthy ``` The above command prints "1" if the product is onboarded and functioning as expected. @@ -219,6 +218,8 @@ Create a script in **Settings > Computer Management > Scripts**. This script removes Microsoft Defender ATP from the /Applications directory: ```bash + #!/bin/bash + echo "Is WDAV installed?" ls -ld '/Applications/Microsoft Defender ATP.app' 2>/dev/null diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-resources.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-resources.md index e8697f63a3..933282df5d 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-resources.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-resources.md @@ -31,7 +31,7 @@ If you can reproduce a problem, please increase the logging level, run the syste 1. Increase logging level: ```bash - mdatp --log-level verbose + $ mdatp --log-level verbose Creating connection to daemon Connection established Operation succeeded @@ -42,7 +42,7 @@ If you can reproduce a problem, please increase the logging level, run the syste 3. Run `mdatp --diagnostic --create` to backup Microsoft Defender ATP's logs. The files will be stored inside of a .zip archive. This command will also print out the file path to the backup after the operation succeeds. ```bash - mdatp --diagnostic --create + $ mdatp --diagnostic --create Creating connection to daemon Connection established ``` @@ -50,7 +50,7 @@ If you can reproduce a problem, please increase the logging level, run the syste 4. Restore logging level: ```bash - mdatp --log-level info + $ mdatp --log-level info Creating connection to daemon Connection established Operation succeeded diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac.md index 7c18dc31d2..f87f5332c7 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac.md @@ -69,7 +69,7 @@ To test that a connection is not blocked, open [https://x.cp.wd.microsoft.com/ap If you prefer the command line, you can also check the connection by running the following command in Terminal: ```bash -curl -w ' %{url_effective}\n' 'https://x.cp.wd.microsoft.com/api/report' 'https://cdn.x.cp.wd.microsoft.com/ping' +$ curl -w ' %{url_effective}\n' 'https://x.cp.wd.microsoft.com/api/report' 'https://cdn.x.cp.wd.microsoft.com/ping' ``` The output from this command should be similar to the following: From 06563947d6bc76a275acfd74051aa08c6abe56e4 Mon Sep 17 00:00:00 2001 From: Tudor Dobrila Date: Wed, 25 Sep 2019 16:10:33 -0700 Subject: [PATCH 39/43] Wording fixes --- .../microsoft-defender-atp-mac-preferences.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-preferences.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-preferences.md index 1902cc1a3f..80ec6a0f67 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-preferences.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-preferences.md @@ -66,7 +66,7 @@ Whether real-time protection (scan files as they are accessed) is enabled or not Whether the antivirus engine runs in passive mode or not. In passive mode: - Real-time protection is turned off -- On demand scanning is turned on +- On-demand scanning is turned on - Automatic threat remediation is turned off - Security intelligence updates are turned on - Status menu icon is hidden @@ -253,7 +253,7 @@ The *userInterface* section of the configuration profile is used to manage the p #### Show / hide status menu icon -Whether the status menu icon (shown in the top right corner of the screen) is hidden or not. +Whether the status menu icon (shown in the top-right corner of the screen) is hidden or not. ||| |:---|:---| From b76be9b4ec2e03033321acdf88c4ab31bbc0c228 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Wed, 25 Sep 2019 16:32:16 -0700 Subject: [PATCH 40/43] Fixed typos --- windows/client-management/mdm/policy-csp-audit.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-audit.md b/windows/client-management/mdm/policy-csp-audit.md index 8ca25e3b46..710784706c 100644 --- a/windows/client-management/mdm/policy-csp-audit.md +++ b/windows/client-management/mdm/policy-csp-audit.md @@ -307,9 +307,9 @@ The following are the supported values: -Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy allows you to audit the group memberhsip information in the user's logon token. Events in this subcategory are generated on the computer on which a logon session is created. For an interactive logon, the security audit event is generated on the computer that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy allows you to audit the group membership information in the user's logon token. Events in this subcategory are generated on the computer on which a logon session is created. For an interactive logon, the security audit event is generated on the computer that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. -When this setting is configured, one or more security audit events are generated for each successful logon. You must also enable the Audit Logon setting under Advanced Audit Policy Configuration\System Audit Policies\Logon/Logoff. Multiple events are generated if the group memberhsip information cannot fit in a single security audit event. +When this setting is configured, one or more security audit events are generated for each successful logon. You must also enable the Audit Logon setting under Advanced Audit Policy Configuration\System Audit Policies\Logon/Logoff. Multiple events are generated if the group membership information cannot fit in a single security audit event. Volume: Low on a client computer. Medium on a domain controller or a network server. @@ -852,7 +852,7 @@ The following are the supported values: Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by special logons, such as the following: - The use of a special logon, which is a logon that has administrator-equivalent privileges and can be used to elevate a process to a higher level. -- A logon by a member of a Special Group. Special Groups enable you to audit events generated when a member of a certain group has logged on to your network. You can configure a list of group security identifiers (SIDs) in the registry. If any of those SIDs are added to a token during logon and the subcategory is enabled, an event is logged. For more information about this feature, see [Audit Special Logon](https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-special-logon). +- A logon by a member of a Special Group. Special Groups enable you to audit events generated when a member of a certain group has logged on to your network. You can configure a list of group security identifiers (SIDs) in the registry. If any of those SIDs are added to a token during logon and the subcategory is enabled, an event is logged. For more information about this feature, see [Audit Special Logon](https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-special-logon). Volume: Low. @@ -1400,7 +1400,7 @@ Volume: Low. GP Info: -- GP English name: *Audit Distributio Group Management* +- GP English name: *Audit Distribution Group Management* - GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Management* @@ -2701,7 +2701,7 @@ The following are the supported values: -Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit user attempts to access file system objects. A security audit event is generated only for objects that have system access control lists (SACL) specified, and only if the type of access requested, such as Write, Read, or Modify and the account making the request match the settings in the SACL. For more information about enabling object access auditing, see [Apply a basic audit policy on a file or folder](https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder). +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit user attempts to access file system objects. A security audit event is generated only for objects that have system access control lists (SACL) specified, and only if the type of access requested, such as Write, Read, or Modify and the account making the request match the settings in the SACL. For more information about enabling object access auditing, see [Apply a basic audit policy on a file or folder](https://docs.microsoft.com/windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder). If you configure this policy setting, an audit event is generated each time an account accesses a file system object with a matching SACL. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when an account accesses a file system object with a matching SACL. From b6c2428184714db5f9e3a248b818ba205dbd4194 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Wed, 25 Sep 2019 16:38:31 -0700 Subject: [PATCH 41/43] minor updates --- windows/client-management/mdm/policy-csp-audit.md | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-audit.md b/windows/client-management/mdm/policy-csp-audit.md index 710784706c..5d46a69134 100644 --- a/windows/client-management/mdm/policy-csp-audit.md +++ b/windows/client-management/mdm/policy-csp-audit.md @@ -510,8 +510,7 @@ The following are the supported values: Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Quick Mode negotiations. -If you configure this policy setting, an audit event is generated during an IPsec Quick Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts.If - you do not configure this policy setting, no audit event is generated during an IPsec Quick Mode negotiation. +If you configure this policy setting, an audit event is generated during an IPsec Quick Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated during an IPsec Quick Mode negotiation. Volume: High. @@ -2980,7 +2979,7 @@ The following are the supported values: -Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit attempts to access the kernel, which include mutexes and semaphores. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit attempts to access the kernel, which includes mutexes and semaphores. Only kernel objects with a matching system access control list (SACL) generate security audit events. > [!Note] From 8d64a9f6af542029b4995ea6b11f5bee9060edc6 Mon Sep 17 00:00:00 2001 From: Tudor Dobrila Date: Wed, 25 Sep 2019 17:07:40 -0700 Subject: [PATCH 42/43] Update command for diagnostic generation --- .../microsoft-defender-atp-mac-resources.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-resources.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-resources.md index 933282df5d..2f67653ec0 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-resources.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-resources.md @@ -39,10 +39,10 @@ If you can reproduce a problem, please increase the logging level, run the syste 2. Reproduce the problem -3. Run `mdatp --diagnostic --create` to backup Microsoft Defender ATP's logs. The files will be stored inside of a .zip archive. This command will also print out the file path to the backup after the operation succeeds. +3. Run `sudo mdatp --diagnostic --create` to backup Microsoft Defender ATP's logs. The files will be stored inside of a .zip archive. This command will also print out the file path to the backup after the operation succeeds. ```bash - $ mdatp --diagnostic --create + $ sudo mdatp --diagnostic --create Creating connection to daemon Connection established ``` @@ -82,13 +82,13 @@ Important tasks, such as controlling product settings and triggering on-demand s |-------------|-------------------------------------------|-----------------------------------------------------------------------| |Configuration|Turn on/off real-time protection |`mdatp --config realTimeProtectionEnabled [true/false]` | |Configuration|Turn on/off cloud protection |`mdatp --config cloudEnabled [true/false]` | -|Configuration|Turn on/off product diagnostics |`mdatp --config diagnostic [true/false]` | +|Configuration|Turn on/off product diagnostics |`mdatp --config cloudDiagnosticEnabled [true/false]` | |Configuration|Turn on/off automatic sample submission |`mdatp --config cloudAutomaticSampleSubmission [true/false]` | |Configuration|Turn on PUA protection |`mdatp --threat --type-handling potentially_unwanted_application block`| |Configuration|Turn off PUA protection |`mdatp --threat --type-handling potentially_unwanted_application off` | |Configuration|Turn on audit mode for PUA protection |`mdatp --threat --type-handling potentially_unwanted_application audit`| |Diagnostics |Change the log level |`mdatp --log-level [error/warning/info/verbose]` | -|Diagnostics |Generate diagnostic logs |`mdatp --diagnostic` | +|Diagnostics |Generate diagnostic logs |`mdatp --diagnostic --create` | |Health |Check the product's health |`mdatp --health` | |Protection |Scan a path |`mdatp --scan --path [path]` | |Protection |Do a quick scan |`mdatp --scan --quick` | From 2ed1aa565641967f8f605152cba76b3d2d81d303 Mon Sep 17 00:00:00 2001 From: John Liu <49762389+ShenLanJohn@users.noreply.github.com> Date: Thu, 26 Sep 2019 09:21:31 -0700 Subject: [PATCH 43/43] CAT Auto Pulish for Windows Release Messages - CAT_AutoPublish_20190926083738 (#1207) --- .../resolved-issues-windows-10-1903.yml | 2 + .../status-windows-10-1903.yml | 4 +- ...ndows-7-and-windows-server-2008-r2-sp1.yml | 2 - .../windows-message-center.yml | 44 +------------------ 4 files changed, 5 insertions(+), 47 deletions(-) diff --git a/windows/release-information/resolved-issues-windows-10-1903.yml b/windows/release-information/resolved-issues-windows-10-1903.yml index 5178fde6ad..9f94df5b29 100644 --- a/windows/release-information/resolved-issues-windows-10-1903.yml +++ b/windows/release-information/resolved-issues-windows-10-1903.yml @@ -32,6 +32,7 @@ sections: - type: markdown text: "
    MessageDate
    Advisory: Scripting Engine Memory Corruption Vulnerability (CVE-2019-1367)
    On September 23, 2019, Microsoft released a security update to address a remote code execution vulnerability in the way the scripting engine handles objects in memory in Internet Explorer. An attacker who successfully exploited the vulnerability could gain the same user permissions as the current user. For example, if a user is logged on with administrative rights, an attacker could take control of an affected system and install programs; view, change, or delete data; or create new accounts with full user rights. Alternatively, an attacker could host a specially crafted website targeting Internet Explorer and then entice a user to open web page or a malicious document attached to an e-mail. For more information about the vulnerability, see the Microsoft Security Guide CVE-2019-1367 | Scripting Engine Memory Corruption Vulnerability. 
     
    Mitigation for this vulnerability is available from the Microsoft Security Update Guide. For the best protection, we recommend you apply the latest Windows updates and follow security best practices and do not open attachments or documents from an untrusted source. For more information about the vulnerability, see the Microsoft Security Guide: CVE-2019-1367 | Scripting Engine Memory Corruption Vulnerability. 

    Update: Starting September 24, 2019, mitigation for this vulnerability is included as part of the 9C optional update, via Windows Update (WU) and Microsoft Update Catalog, for all supported versions of Windows 10, with the exception of Windows 10, version 1903 and Windows 10, version 1507 (LTSB). For devices running Windows 10, version 1903, mitigation for this vulnerability will be included as part of the 9D optional update via WU, WSUS and the Microsoft Update Catalog (targeted for September 26, 2019.) To apply this update, go to Settings > Windows Update > Check for Updates. (Note Because this update requires a reboot, we are making it optional to give customers and administrators a choice to install/deploy the update now.) 

    For customers running Windows 8.1/ Windows Server 2012 R2 or below, the 9C update is also available on Windows Server Update Services (WSUS). For other supported versions, IT admins using WSUS can import this update into WSUS/SCCM manually. See instructions on the WSUS and the Catalog Site.
    		September 24, 2019
    05:00 PM PT
    Advisory: Scripting Engine Memory Corruption Vulnerability (CVE-2019-1367)
    On September 23, 2019, Microsoft released a security update to address a remote code execution vulnerability in the way the scripting engine handles objects in memory in Internet Explorer. An attacker who successfully exploited the vulnerability could gain the same user permissions as the current user. For example, if a user is logged on with administrative rights, an attacker could take control of an affected system and install programs; view, change, or delete data; or create new accounts with full user rights. Alternatively, an attacker could host a specially crafted website targeting Internet Explorer and then entice a user to open web page or a malicious document attached to an e-mail. For more information about the vulnerability, see the Microsoft Security Guide CVE-2019-1367 | Scripting Engine Memory Corruption Vulnerability. 
     
    Mitigation and more information for this vulnerability is available from the Microsoft Security Update Guide at CVE-2019-1367 | Scripting Engine Memory Corruption Vulnerability. For the best protection, we recommend you apply the latest Windows updates and follow security best practices and do not open attachments or documents from an untrusted source. 

    Update: Starting September 24, 2019, mitigation for this vulnerability is included as part of the 9C optional update, via Windows Update (WU) and Microsoft Update Catalog, for all supported versions of Windows 10, with the exception of Windows 10, version 1903 and Windows 10, version 1507 (LTSB). For devices running Windows 10, version 1903, mitigation for this vulnerability will be included as part of the 9D optional update via WU, WSUS and the Microsoft Update Catalog (targeted for September 26, 2019.) To apply this update, go to Settings > Windows Update > Check for Updates. (Note Because this update requires a reboot, we are making it optional to give customers and administrators a choice to install/deploy the update now.) 

    For customers running Windows 8.1/ Windows Server 2012 R2 or below, the 9C update is also available on Windows Server Update Services (WSUS). For other supported versions of Windows, IT admins using WSUS can import this update into WSUS/SCCM manually from Microsoft Update Catalog. See instructions on the WSUS and the Catalog Site.
    		September 24, 2019
    05:00 PM PT
    Status update: September 2019 Windows \"C\" optional release available
    The September 2019 optional monthly “C” release for all supported versions of Windows is now available. For more information on the different types of monthly quality updates, see our Windows 10 update servicing cadence primer. Follow @WindowsUpdate for the latest on the availability of this release.
    		September 24, 2019
    08:10 AM PT
    Plan for change: Windows Media Center Electronic Program Guide retiring in January 2020
    Starting in January 2020, Microsoft is retiring its Electronic Program Guide (EPG) service for all versions of Windows Media Center. To continue receiving TV Program Guide information on your Windows Media Center, you’ll need to configure an alternate TV listing provider.
    		September 24, 2019
    08:00 AM PT
    Status of September 2019 “C” release
    The optional monthly “C” release for September 2019 for all supported versions of Windows and Windows Server prior to Windows 10, version 1903 and Windows Server, version 1903 will be available in the near term. For more information on the different types of monthly quality updates, see our Windows 10 update servicing cadence primer. Follow @WindowsUpdate for the latest on the availability of this release.
    		September 19, 2019
    04:11 PM PT
    Policy CSP - Audit

    Added new Audit policies in Windows 10, version 1903.

    +
    ApplicationControl CSP
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    + @@ -68,6 +69,7 @@ sections: - type: markdown text: "
    SummaryOriginating updateStatusDate resolved
    Audio in games is quiet or different than expected
    Microsoft has received reports that audio in certain games is quieter or different than expected.

    See details >    		OS Build 18362.356

    September 10, 2019
    KB4515384    		Resolved
    KB4517211    		September 26, 2019
    10:00 AM PT
    IME may become unresponsive or have High CPU usage
    Some Input Method Editor (IME) including ChsIME.EXE and ChtIME.EXE, may become unresponsive or may have high CPU usage.

    See details >    		OS Build 18362.356

    September 10, 2019
    KB4515384    		Resolved
    		September 19, 2019
    04:08 PM PT
    Some users report issues related to the Start menu and Windows Desktop Search
    Microsoft has received reports that a small number of users are having issues related to the Start menu and Windows Desktop Search.

    See details >    		OS Build 18362.356

    September 10, 2019
    KB4515384    		Resolved
    		September 19, 2019
    04:58 PM PT
    Screenshots and Snips have an unnatural orange tint
    Users have reported an orange tint on Screenshots and Snips with the Lenovo Vantage app installed

    See details >    		OS Build 18362.356

    September 10, 2019
    KB4516115    		Resolved External
    		September 11, 2019
    08:54 PM PT
    + diff --git a/windows/release-information/status-windows-10-1903.yml b/windows/release-information/status-windows-10-1903.yml index a6705b085d..6d6d7771bc 100644 --- a/windows/release-information/status-windows-10-1903.yml +++ b/windows/release-information/status-windows-10-1903.yml @@ -65,10 +65,10 @@ sections: - type: markdown text: "
    This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

    DetailsOriginating updateStatusHistory
    Audio in games is quiet or different than expected
    Microsoft has received reports that audio in certain games is quieter or different than expected. At the request of some of our audio partners, we implemented a compatibility change that enabled certain games to query support and render multi-channel audio. Due to customer feedback, we are reverting this change as some games and some devices are not rendering multi-channel audio as expected. This may result in games sounding different than customers are used to and may have missing channels.

    Affected platforms:
    • Client: Windows 10, version 1903
    Resolution: This issue was resolved in KB4517211.

    Back to top    		OS Build 18362.356

    September 10, 2019
    KB4515384    		Resolved
    KB4517211    		Resolved:
    September 26, 2019
    10:00 AM PT

    Opened:
    September 13, 2019
    05:25 PM PT
    IME may become unresponsive or have High CPU usage
    Some Input Method Editor (IME) may become unresponsive or may have high CPU usage. Affected IMEs include Chinese Simplified (ChsIME.EXE) and Chinese Traditional (ChtIME.EXE) with Changjie/Quick keyboard.


    Affected platforms:
    • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
    • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016

    Resolution: Due to security related changes in KB4515384, this issue may occur when Touch Keyboard and Handwriting Panel Service is not configured to its default startup type of Manual. To resolve the issue, perform the following steps:
    1. Select the Start button and type Services.
    2. Locate Touch Keyboard and Handwriting Panel Service and double click on it or long press and select Properties.
    3. Locate Startup type: and change it to Manual
    4. Select Ok
    5. The TabletInputService service is now in the default configuration and IME should work as expected.

    Back to top    		OS Build 18362.356

    September 10, 2019
    KB4515384    		Resolved
    		Resolved:
    September 19, 2019
    04:08 PM PT

    Opened:
    September 13, 2019
    05:25 PM PT
    Some users report issues related to the Start menu and Windows Desktop Search
    Microsoft has received reports that a small number of users are having issues related to the Start menu and Windows Desktop Search.

    Affected platforms:
    • Client: Windows 10, version 1903
    Resolution: At this time, Microsoft has not found a Search or Start issue significantly impacting users originating from KB4515384. We will continue monitoring to ensure users have a high-quality experience when interacting with these areas. If you are currently having issues, we recommend you to take a moment to report it in via the Feedback Hub (Windows + F) then try the Windows 10 Troubleshoot settings (found in Settings). If you are having an issue with search, see Fix problems in Windows Search.

    Back to top    		OS Build 18362.356

    September 10, 2019
    KB4515384    		Resolved
    		Resolved:
    September 19, 2019
    04:58 PM PT

    Opened:
    September 11, 2019
    05:18 PM PT
    Screenshots and Snips have an unnatural orange tint
    When creating screenshots or using similar tools (such as Snipping Tool or Snip & Sketch), the resulting images may have an unnatural orange tint. This issue is caused by the Eye Care mode feature of Lenovo Vantage. This issue started on or around September 5, 2019. 

    Affected platforms:
    • Client: Windows 10, version 1903
    • Server: None
    Resolution: For guidance on this issue, see the Lenovo support article Screenshots and Snips have an unnatural orange tint. There is no update for Windows needed for this issue.

    Back to top    		OS Build 18362.356

    September 10, 2019
    KB4516115    		Resolved External
    		Last updated:
    September 11, 2019
    08:54 PM PT

    Opened:
    September 11, 2019
    08:54 PM PT
    + - @@ -99,10 +99,10 @@ sections: - type: markdown text: "
    SummaryOriginating updateStatusLast updated
    Audio in games is quiet or different than expected
    Microsoft has received reports that audio in certain games is quieter or different than expected.

    See details >    		OS Build 18362.356

    September 10, 2019
    KB4515384    		Resolved
    KB4517211    		September 26, 2019
    10:00 AM PT
    IME may become unresponsive or have High CPU usage
    Some Input Method Editor (IME) including ChsIME.EXE and ChtIME.EXE, may become unresponsive or may have high CPU usage.

    See details >    		OS Build 18362.356

    September 10, 2019
    KB4515384    		Resolved
    		September 19, 2019
    04:08 PM PT
    Some users report issues related to the Start menu and Windows Desktop Search
    Microsoft has received reports that a small number of users are having issues related to the Start menu and Windows Desktop Search.

    See details >    		OS Build 18362.356

    September 10, 2019
    KB4515384    		Resolved
    		September 19, 2019
    04:58 PM PT
    Safeguard on certain devices with some Intel and Broadcom Wi-Fi adapters
    Microsoft and NEC have found incompatibility issues with some devices with Intel Centrino 6205/6235 and Broadcom 802.11ac Wi-Fi cards when running Windows 10, version 1903.

    See details >    		N/A

    		Mitigated
    		September 13, 2019
    05:25 PM PT
    Audio in games is quiet or different than expected
    Microsoft has received reports that audio in certain games is quieter or different than expected.

    See details >    		OS Build 18362.356

    September 10, 2019
    KB4515384    		Mitigated
    		September 13, 2019
    05:25 PM PT
    Screenshots and Snips have an unnatural orange tint
    Users have reported an orange tint on Screenshots and Snips with the Lenovo Vantage app installed

    See details >    		OS Build 18362.356

    September 10, 2019
    KB4516115    		Resolved External
    		September 11, 2019
    08:54 PM PT
    Windows Desktop Search may not return any results and may have high CPU usage
    Windows Desktop Search may not return any results and SearchUI.exe may have high CPU usage after installing KB4512941.

    See details >    		OS Build 18362.329

    August 30, 2019
    KB4512941    		Resolved
    KB4515384    		September 10, 2019
    10:00 AM PT
    Domain connected devices that use MIT Kerberos realms will not start up
    Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

    See details >    		OS Build 18362.145

    May 29, 2019
    KB4497935    		Resolved
    KB4512941    		August 30, 2019
    10:00 AM PT
    + -
    DetailsOriginating updateStatusHistory
    Audio in games is quiet or different than expected
    Microsoft has received reports that audio in certain games is quieter or different than expected. At the request of some of our audio partners, we implemented a compatibility change that enabled certain games to query support and render multi-channel audio. Due to customer feedback, we are reverting this change as some games and some devices are not rendering multi-channel audio as expected. This may result in games sounding different than customers are used to and may have missing channels.

    Affected platforms:
    • Client: Windows 10, version 1903
    Resolution: This issue was resolved in KB4517211.

    Back to top    		OS Build 18362.356

    September 10, 2019
    KB4515384    		Resolved
    KB4517211    		Resolved:
    September 26, 2019
    10:00 AM PT

    Opened:
    September 13, 2019
    05:25 PM PT
    IME may become unresponsive or have High CPU usage
    Some Input Method Editor (IME) may become unresponsive or may have high CPU usage. Affected IMEs include Chinese Simplified (ChsIME.EXE) and Chinese Traditional (ChtIME.EXE) with Changjie/Quick keyboard.


    Affected platforms:
    • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
    • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016

    Resolution: Due to security related changes in KB4515384, this issue may occur when Touch Keyboard and Handwriting Panel Service is not configured to its default startup type of Manual. To resolve the issue, perform the following steps:
    1. Select the Start button and type Services.
    2. Locate Touch Keyboard and Handwriting Panel Service and double click on it or long press and select Properties.
    3. Locate Startup type: and change it to Manual
    4. Select Ok
    5. The TabletInputService service is now in the default configuration and IME should work as expected.

    Back to top    		OS Build 18362.356

    September 10, 2019
    KB4515384    		Resolved
    		Resolved:
    September 19, 2019
    04:08 PM PT

    Opened:
    September 13, 2019
    05:25 PM PT
    Some users report issues related to the Start menu and Windows Desktop Search
    Microsoft has received reports that a small number of users are having issues related to the Start menu and Windows Desktop Search.

    Affected platforms:
    • Client: Windows 10, version 1903
    Resolution: At this time, Microsoft has not found a Search or Start issue significantly impacting users originating from KB4515384. We will continue monitoring to ensure users have a high-quality experience when interacting with these areas. If you are currently having issues, we recommend you to take a moment to report it in via the Feedback Hub (Windows + F) then try the Windows 10 Troubleshoot settings (found in Settings). If you are having an issue with search, see Fix problems in Windows Search.

    Back to top    		OS Build 18362.356

    September 10, 2019
    KB4515384    		Resolved
    		Resolved:
    September 19, 2019
    04:58 PM PT

    Opened:
    September 11, 2019
    05:18 PM PT
    Safeguard on certain devices with some Intel and Broadcom Wi-Fi adapters
    Microsoft and NEC have found incompatibility issues with Intel Centrino 6205/6235 and Broadcom 802.11ac Wi-Fi cards when running Windows 10, version 1903 on specific models of NEC devices. If these devices are updated to Windows 10, version 1903, they will no longer be able to use any Wi-Fi connections. The Wi-Fi driver may have a yellow exclamation point in device manager. The task tray icon for networking may show the icon for no internet and Network & Internet settings may not show any Wi-Fi networks.

    To safeguard your update experience, we have applied a compatibility hold on the affected devices from being offered Windows 10, version 1903.

    Affected platforms:
    • Client: Windows 10, version 1903
    Workaround: If you are using an affected device and you have already installed Windows 10, version 1903, you can mitigate the issue disabling then re-enabling the Wi-Fi adapter in Device Manager. You should now be able to use Wi-Fi until your next reboot.

    Next steps: Microsoft and NEC are working on a resolution and will provide an update in an upcoming release.

    Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until this issue has been resolved.

    Back to top    		N/A

    		Mitigated
    		Last updated:
    September 13, 2019
    05:25 PM PT

    Opened:
    September 13, 2019
    05:25 PM PT
    Audio in games is quiet or different than expected
    Microsoft has received reports that audio in certain games is quieter or different than expected. At the request of some of our audio partners, we implemented a compatibility change that enabled certain games to query support and render multi-channel audio. Due to customer feedback, we are reverting this change as some games and some devices are not rendering multi-channel audio as expected. This may result in games sounding different than customers are used to and may have missing channels.

    Affected platforms:
    • Client: Windows 10, version 1903
    Workaround: To mitigate the issue, open settings in the impacted game and disable multi-channel audio, if this option is available. You can also search in the Windows Control Panel for 3rd party audio device control panels and disable Multi-channel audio or Virtual Surround Sound, if these options are available.  

    Next steps: We are working on a resolution and estimates a solution will be available in late September.

    Back to top    		OS Build 18362.356

    September 10, 2019
    KB4515384    		Mitigated
    		Last updated:
    September 13, 2019
    05:25 PM PT

    Opened:
    September 13, 2019
    05:25 PM PT
    Screenshots and Snips have an unnatural orange tint
    When creating screenshots or using similar tools (such as Snipping Tool or Snip & Sketch), the resulting images may have an unnatural orange tint. This issue is caused by the Eye Care mode feature of Lenovo Vantage. This issue started on or around September 5, 2019. 

    Affected platforms:
    • Client: Windows 10, version 1903
    • Server: None
    Resolution: For guidance on this issue, see the Lenovo support article Screenshots and Snips have an unnatural orange tint. There is no update for Windows needed for this issue.

    Back to top    		OS Build 18362.356

    September 10, 2019
    KB4516115    		Resolved External
    		Last updated:
    September 11, 2019
    08:54 PM PT

    Opened:
    September 11, 2019
    08:54 PM PT
    Windows Desktop Search may not return any results and may have high CPU usage
    Microsoft is getting reports that a small number of users may not receive results when using Windows Desktop Search and may see high CPU usage from SearchUI.exe when searching after installing KB4512941. This issue is only encountered on devices in which searching the web from Windows Desktop Search has been disabled.

    Affected platforms:
    • Client: Windows 10, version 1903
    Resolution: This issue was resolved in KB4515384.

    Back to top    		OS Build 18362.329

    August 30, 2019
    KB4512941    		Resolved
    KB4515384    		Resolved:
    September 10, 2019
    10:00 AM PT

    Opened:
    September 04, 2019
    02:25 PM PT
    diff --git a/windows/release-information/status-windows-7-and-windows-server-2008-r2-sp1.yml b/windows/release-information/status-windows-7-and-windows-server-2008-r2-sp1.yml index a3fe4bad82..88e7011cee 100644 --- a/windows/release-information/status-windows-7-and-windows-server-2008-r2-sp1.yml +++ b/windows/release-information/status-windows-7-and-windows-server-2008-r2-sp1.yml @@ -61,7 +61,6 @@ sections: text: "
    This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

    -
    SummaryOriginating updateStatusLast updated
    You may receive an error when opening or using the Toshiba Qosmio AV Center
    Toshiba Qosmio AV Center may error when opening and you may also receive an error in Event Log related to cryptnet.dll.

    See details >    		August 13, 2019
    KB4512506    		Resolved
    KB4516048    		September 24, 2019
    10:00 AM PT
    Windows updates that are SHA-2 signed may not be offered for Symantec and Norton AV
    Windows updates that are SHA-2 signed are not available with Symantec or Norton antivirus program installed

    See details >    		August 13, 2019
    KB4512506    		Resolved External
    		August 27, 2019
    02:29 PM PT
    IA64 and x64 devices may fail to start after installing updates
    After installing updates released on or after August 13, 2019, IA64 and x64 devices using EFI Boot may fail to start.

    See details >    		August 13, 2019
    KB4512506    		Mitigated
    		August 17, 2019
    12:59 PM PT
    " @@ -87,7 +86,6 @@ sections: - type: markdown text: " -
    DetailsOriginating updateStatusHistory
    Windows updates that are SHA-2 signed may not be offered for Symantec and Norton AV
    Symantec identified the potential for a negative interaction that may occur after Windows Updates code signed with SHA-2 only certificates are installed on devices with Symantec or Norton antivirus programs installed. The software may not correctly identify files included in the update as code signed by Microsoft, putting the device at risk for a delayed or incomplete update.

    Affected platforms:
    • Client: Windows 7 SP1
    • Server: Windows Server 2008 R2 SP1
    Resolution: The safeguard hold has been removed. Symantec has completed its evaluation of the impact of this update and future updates to Windows 7/Windows 2008 R2 and has determined that there is no increased risk of a false positive detection for all in-field versions of Symantec Endpoint Protection and Norton antivirus programs. See the Symantec support article for additional detail and please reach out to Symantec or Norton support if you encounter any issues.

    Back to top    		August 13, 2019
    KB4512506    		Resolved External
    		Last updated:
    August 27, 2019
    02:29 PM PT

    Opened:
    August 13, 2019
    10:05 AM PT
    IA64 and x64 devices may fail to start after installing updates
    IA64 devices (in any configuration) and x64 devices using EFI boot that were provisioned after the July 9th updates and/or skipped the recommended update (KB3133977), may fail to start with the following error:
    \"File: \\Windows\\system32\\winload.efi
    Status: 0xc0000428
    Info: Windows cannot verify the digital signature for this file.\"

    Affected platforms:
    • Client: Windows 7 SP1
    • Server: Windows Server 2008 R2 SP1
    Take Action: To resolve this issue please follow the steps outlined in the SHA-2 support FAQ article for error code 0xc0000428.

    Back to top    		August 13, 2019
    KB4512506    		Mitigated
    		Last updated:
    August 17, 2019
    12:59 PM PT

    Opened:
    August 13, 2019
    08:34 AM PT
    " diff --git a/windows/release-information/windows-message-center.yml b/windows/release-information/windows-message-center.yml index b7d54944e0..06dc6d0c37 100644 --- a/windows/release-information/windows-message-center.yml +++ b/windows/release-information/windows-message-center.yml @@ -50,6 +50,7 @@ sections: text: " + @@ -94,48 +95,5 @@ Given the potential impact to customers and their businesses, we have also relea For more information about the Windows 10 update servicing cadence, please see the Window IT Pro blog. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    MessageDate
    September 2019 Windows 10, version 1903 \"D\" optional release is available
    The September 2019 optional monthly “D” release for Windows 10, version 1903 is now available. For more information on the different types of monthly quality updates, see our Windows 10 update servicing cadence primer. Follow @WindowsUpdate for the latest on the availability of this release.
    		September 26, 2019
    08:00 AM PT
    Advisory: Scripting Engine Memory Corruption Vulnerability (CVE-2019-1367)
    On September 23, 2019, Microsoft released a security update to address a remote code execution vulnerability in the way the scripting engine handles objects in memory in Internet Explorer. An attacker who successfully exploited the vulnerability could gain the same user permissions as the current user. For example, if a user is logged on with administrative rights, an attacker could take control of an affected system and install programs; view, change, or delete data; or create new accounts with full user rights. Alternatively, an attacker could host a specially crafted website targeting Internet Explorer and then entice a user to open web page or a malicious document attached to an e-mail. For more information about the vulnerability, see the Microsoft Security Guide CVE-2019-1367 | Scripting Engine Memory Corruption Vulnerability. 
     
    Mitigation and more information for this vulnerability is available from the Microsoft Security Update Guide at CVE-2019-1367 | Scripting Engine Memory Corruption Vulnerability. For the best protection, we recommend you apply the latest Windows updates and follow security best practices and do not open attachments or documents from an untrusted source. 

    Update: Starting September 24, 2019, mitigation for this vulnerability is included as part of the 9C optional update, via Windows Update (WU) and Microsoft Update Catalog, for all supported versions of Windows 10, with the exception of Windows 10, version 1903 and Windows 10, version 1507 (LTSB). For devices running Windows 10, version 1903, mitigation for this vulnerability will be included as part of the 9D optional update via WU, WSUS and the Microsoft Update Catalog (targeted for September 26, 2019.) To apply this update, go to Settings > Windows Update > Check for Updates. (Note Because this update requires a reboot, we are making it optional to give customers and administrators a choice to install/deploy the update now.) 

    For customers running Windows 8.1/ Windows Server 2012 R2 or below, the 9C update is also available on Windows Server Update Services (WSUS). For other supported versions of Windows, IT admins using WSUS can import this update into WSUS/SCCM manually from Microsoft Update Catalog. See instructions on the WSUS and the Catalog Site.
    		September 24, 2019
    05:00 PM PT
    Status update: September 2019 Windows \"C\" optional release available
    The September 2019 optional monthly “C” release for all supported versions of Windows is now available. For more information on the different types of monthly quality updates, see our Windows 10 update servicing cadence primer. Follow @WindowsUpdate for the latest on the availability of this release.
    		September 24, 2019
    08:10 AM PT
    Plan for change: Windows Media Center Electronic Program Guide retiring in January 2020
    Starting in January 2020, Microsoft is retiring its Electronic Program Guide (EPG) service for all versions of Windows Media Center. To continue receiving TV Program Guide information on your Windows Media Center, you’ll need to configure an alternate TV listing provider.
    		September 24, 2019
    08:00 AM PT
    May 10, 2019
    10:00 AM PT
    Take action: Install servicing stack update for Windows Server 2008 SP2 for SHA-2 code sign support
    A standalone update, KB4493730, that introduce SHA-2 code sign support for the servicing stack (SSU) was released today as a security update.    		April 19, 2019
    10:00 AM PT
    The benefits of Windows 10 Dynamic Update
    Dynamic Update can help organizations and end users alike ensure that their Windows 10 devices have the latest feature update content (as part of an in-place upgrade)—and preserve precious features on demand (FODs) and language packs (LPs) that may have been previously installed.

    - -
    Find out which components are updated by Dynamic Update, how Dynamic Update is initiated, and how to enable or disable it.
    		April 17, 2019
    11:26 AM PT
    Improvements to the Windows 10 update experience are coming
    Find out about the changes coming to the Windows update process that will improve the experience, offer users more control, and improve the quality of Windows updates.    		April 04, 2019
    09:00 AM PT
    Take action: review your Windows Update for Business deferral values
    If devices under your management are still running Windows 10 Pro or Windows 10 Pro for Workstations, version 1709, your devices will reach end of service on April 9, 2019 if you have configured both of the following Windows Update for Business policies:
    -
      -
    • Branch readiness is configured as Semi-Annual Channel (SAC)
      • -
    • Feature update deferral is configured as 274 days or more
      • -
    -In order avoid this, you need to set your feature update deferral policy to 273 days or less.
    		April 03, 2019
    05:47 PM PT
    Find a list of currently supported versions and previous releases
    Every Windows product has a lifecycle. The lifecycle begins when a product is released and ends when it is no longer serviced or supported. Knowing key dates in this lifecycle helps you make informed decisions about when to update, upgrade, or make other changes to your software. Check out the updated Windows 10 release information page for a list of current versions by servicing option as well as end of service dates.    		March 28, 2019
    02:00 PM PT
    Windows 10, version 1809 designated for broad deployment
    Based on the data and the feedback we’ve received from consumers, OEMs, ISVs, partners, and commercial customers, Windows 10, version 1809 has transitioned to broad deployment. With this, the Windows 10 release information page will now reflect Semi-Annual Channel (SAC) for version 1809.    		March 28, 2019
    10:00 AM PT
    Reminder: Additional servicing for the Windows 10 Enterprise, Education, and IoT Enterprise, version 1607 ends April 9, 2019
    The additional servicing for Windows 10 Enterprise, Education, and IoT Enterprise editions ends on April 9, 2019 and doesn't extend beyond this date. To continue receiving security and quality updates, Microsoft recommends updating to the latest version of Windows 10.

    Devices running Windows 10 Enterprise 2016 LTSB will continue to receive updates until October 2026 per the Fixed Lifecycle Policy. Windows 10, version 1607 devices running the Intel “Clovertrail” chipset will continue to receive updates until January 2023.
    		March 12, 2019
    10:00 AM PT
    Reminder: Windows 10 Home, Pro, Pro for Workstations, and IoT Core, version 1709 will reach end of service on April 9, 2019
    Windows 10, version 1709, will reach end of service on April 9, 2019 for devices running Windows 10 Home, Pro, Pro for Workstations, and IoT Core editions. These devices will no longer receive monthly security and quality updates that contain protection from the latest security threats. To continue receiving security and quality updates, Microsoft recommends updating to the latest version of Windows 10.

    Windows 10 Enterprise, Education, and IoT Enterprise editions will continue to receive servicing for 12 months at no cost per the lifecycle announcement on October 2018.
    		March 12, 2019
    10:00 AM PT
    Take action: Install standalone security updates to introduce SHA-2 code sign support for Windows 7 amd Windows Server 2008 R2
    A standalone SHA-2 code signing support update for Windows Server 2008 R2 and Windows 7 is now available, as is a servicing stack update for Windows 7 SP1 and Windows Server 2008 R2 SP1 that includes the SHA-2 code signing support update.    		March 12, 2019
    10:00 AM PT
    Take action: Install standalone update for WSUS 3.0 SP2 to support the delivery of SHA-2 signed updates
    A standalone update, KB4484071 is available on Windows Update Catalog for WSUS 3.0 SP2 that supports delivering SHA-2 signed updates. For those customers using WSUS 3.0 SP2, this update should be manually installed no later than June 18, 2019.    		March 12, 2019
    10:00 AM PT
    Reminder: Final Delta update for Windows 10, version 1607, 1703, 1709, and 1803 will be April 9, 2019
    March 12th and April 9th will be the last two Delta updates for Windows 10, version 1607, 1703, 1709, and 1803. Security and quality updates will continue to be available via the express and full cumulative update packages.    		March 12, 2019
    10:00 AM PT
    How do we measure and improve the quality of Windows?
    Measuring the quality of Windows is a complex undertaking that requires gathering a variety of diagnostic signals from millions of devices within the Windows ecosystem. In addition to rigorous internal testing, we rely heavily on the feedback provided through diagnostic data to detect and fix problems before we release new updates of Windows to the general population, and to monitor the impact of those updates after each release.

    - -
    Get insight into some of the practices we employ to measure and improve the quality of Windows.
    		March 06, 2019
    10:23 AM PT
    Getting to know the Windows update history pages
    Windows update history pages offer detailed information about each Windows update: the type of update, which operating systems it affects, the improvements and fixes included, and how to get the update. See how simple it is to use this important resource to access information for Windows 10, Windows Server 2019, and earlier versions of the Windows and Windows Server operating systems.
    		February 21, 2019
    06:37 PM PT
    Share your feedback: Windows update history
    We read every comment you leave on our update history pages, and are always looking to improve these pages and the monthly knowledge base (KB) articles that accompany each monthly update. Take our survey and let us know how we can improve our transparency further and make these more compelling and useful to you and your organization.    		February 21, 2019
    12:00 PM PT
    Plan for change: Windows Update for Business and the retirement of SAC-T
    Beginning with Windows 10, version 1903 (the next feature update for Windows 10), the Windows 10 release information page will no longer list SAC-T information for version 1903 and future feature updates. Instead, you will find a single entry for each new SAC release. In addition, if you are using Windows Update for Business, you will see new UI and behavior to reflect that there is only one release date for each SAC release. If you use System Center Configuration Manager, Windows Server Update Services (WSUS), or other management tools, there will now only be one feature update published to WSUS, and this will occur at the time of release. Learn how this change will affect Windows Business for Update customers.    		February 14, 2019
    12:00 PM PT
    Champs corner: Classifying Windows updates in common deployment tools
    If you utilize automated update deployment tools, such as Windows Server Update Services (WSUS) or System Center Configuration Manager, you likely use automatic rules to streamline the approval and deployment of Windows updates. Using the correct update classification is, therefore, an important component of your organization’s device update process. Explore the options available and how to approach it in a WSUS or Configuration Manager environment.    		February 05, 2019
    10:34 AM PT
    Update: Delta updates for Windows 10, version 1607, 1703, 1709, and 1803 will be available until April 9, 2019
    Based on customer feedback, we are extending Delta update publication for Windows 10 versions 1607, 1703, 1709, and 1803. We will continue to provide Delta updates via the Microsoft Update Catalog through April 9th, 2019, which will be the last delta update available.    		February 05, 2019
    09:00 AM PT
    Global DNS outage affecting Windows Update customers
    Windows Update customers were affected by a network infrastructure event on January 29, 2019 (21:00 UTC), caused by an external DNS service provider’s global outage. A software update to the external provider’s DNS servers resulted in the distribution of corrupted DNS records that affected connectivity to the Windows Update service. The DNS records were restored by January 30, 2019 (00:10 UTC), and the majority of local Internet Service Providers (ISP) have refreshed their DNS servers and customer services have been restored.

    - -While this was not an issue with Microsoft’s services, we take any service disruption for our customers seriously. We will work with partners to better understand this so we can provide higher quality service in the future even across diverse global network providers.

    - -If you are still unable to connect to Windows Update services due to this problem, please contact your local ISP or network administrator. You can also refer to our new KB4493784 for more information to determine if your network is affected, and to provide your local ISP or network administrator with additional information to assist you.
    		January 29, 2019
    04:15 PM PT
    Application compatibility in the Windows ecosystem
    Our application ecosystem is incredibly diverse, encompassing tens of millions of applications (apps) with numerous versions, languages, architectures, services and configuration options. While our ecosystem is complex, our vision is simple. All apps on Windows devices should just work! Explore the various programs and technologies we use to improve application compatibility.    		January 15, 2019
    10:00 AM PT
    Modern desktop servicing: the year in review
    2018 was a pivotal year for the modern desktop and the servicing transformation journey we have been taking with you and your organization. In this post, John Wilcox takes a look back and recaps the progress that has been made, highlighting significant events, and provideing nsight into what 2019 has in store.    		December 19, 2018
    02:20 PM PT
    Driver quality in the Windows ecosystem
    Ensuring Windows 10 works great with all the devices and accessories our customers use is a top priority. We work closely with this broad mix of partners to test new drivers, monitor health characteristics over time, and make Windows and our ecosystem more resilient architecturally. Our goal is to ensure that all the updates and drivers we deliver to non-Insider populations are validated and at production quality (including monthly optional releases) before pushing drivers broadly to all. Explore the driver distribution chain and learn how we measure driver quality and prevent conflicts.    		December 19, 2018
    10:04 AM PT
    Introducing the Modern Desktop podcast series
    In this new podcast series, we'll explore the good, the bad, and, yes, the ugly of servicing and delivery for Windows 10 and Office 365 ProPlus. We'll talk about modern desktop management through Enterprise Mobility, security, and cloud-attached and co-managed environments. Listen to the first episode, in which we discuss monthly quality updates fpr Windows 10, the Microsoft 365 Stay Current pilot program, and interview a real customer to see how they ingest monthly updates in their organization.    		December 18, 2018
    01:00 PM PT
    Measuring Delivery Optimization and its impact to your network
    If you've familiarized yourself with the configuration options for Delivery Optimization in Windows 10, and have started to configure the settings you feel will be the best fit for your organization’s network topology, now is the time to see how well those settings are working. This article provides tips on how evaluate performance at the device level or organization level.    		December 13, 2018
    03:48 PM PT
    Windows monthly security and quality updates overview
    Today’s global cybersecurity threats are both dynamic and sophisticated, and new vulnerabilities are discovered almost every day. We focus on protecting customers from these security threats by providing security updates on a timely basis and with high quality. Find out how we deliver these critical updates on a massive scale as a key component of our ongoing Windows as a service effort.    		December 10, 2018
    10:00 AM PT
    LTSC: What is it, and when should it be used?
    With the Semi-Annual Channel, devices receive two feature updates per year, and benefit from the best performance, user experience, security, and stability. This servicing option continues to be our recommendation for managing Windows 10 updates; however, we acknowledge that certain devices and use cases (e.g. medical systems and industrial process controllers) dictate that functionality and features don’t change over time. Find out how we designed the Long-Term Servicing Channel (LTSC) with these types of use cases in mind, and what is offered through the LTSC.    		November 29, 2018
    07:02 PM PT
    Plan for change: Local Experience Packs: What are they and when should you use them?
    When we released Windows 10, version 1803, we introduced Local Experience Packs (LXPs), which are modern language packs delivered through the Microsoft Store or Microsoft Store for Business. Learn about the biggest advantage to LXPs, and the retirement of legacy language packs (lp.cab) for all Language Interface Packs (LIP).    		November 14, 2018
    11:10 AM PT
    Windows 10 Quality approach for a complex ecosystem
    While our measurements of quality show improving trends on aggregate for each successive Windows 10 release, if a single customer experiences an issue with any of our updates, we take it seriously. In this blog post, Windows CVP Mike Fortin shares an overview of how we work to continuously improve the quality of Windows and our Windows as a service approach. This blog will be the first in a series of more in-depth explanations of the work we do to deliver quality in our Windows releases.    		November 13, 2018
    10:00 AM PT
    Windows 10, version 1809 rollout resumes; now available on VLSC
    Today we are resuming the rollout of the latest Windows 10 feature update—Windows 10, version 1809—via the Software Download Center (via Update Assistant or the Media Creation Tool), Windows Server Update Services (WSUS), and Windows Update for Business. Windows 10, version 1809 is also now available on the Volume Licensing Service Center (VLSC).    		November 13, 2018
    10:00 AM PT
    Express updates for Windows Server 2016 re-enabled for November 2018 update
    Starting with the November 13, 2018 Update Tuesday release, Windows will again publish Express updates for Windows Server 2016. That means that system administrators for WSUS and System Center Configuration Manager will once again see two packages for the Windows Server 2016 update: a Full update and an Express update. Read this article for more details.    		November 12, 2018
    03:00 PM PT
    Plan for change: 2019 SHA-2 code signing support requirement for Windows and WSUS
    To protect your security, Windows operating system updates are dual-signed using both the SHA-1 and SHA-2 hash algorithms to authenticate that updates come directly from Microsoft and were not tampered with during delivery. Due to weaknesses in the SHA-1 algorithm and to align to industry standards Microsoft will only sign Windows updates using the more secure SHA-2 algorithm exclusively.

    Customers running legacy OS versions (Windows 7 SP1, Windows Server 2008 R2 SP1 and Windows Server 2008 SP2) will be required to have SHA-2 code signing support installed on their devices by July 2019. Any devices without SHA-2 support will not be offered Windows updates after July 2019. To help prepare you for this change, we will release support for SHA-2 signing in 2019. Windows Server Update Services (WSUS) 3.0 SP2 will receive SHA-2 support to properly deliver SHA-2 signed updates. Please make note of the dates in the migration timeline and plan accordingly.
    		November 09, 2018
    10:00 AM PT
    "