Merge remote-tracking branch 'refs/remotes/origin/master' into jd-sandbox

education/windows/TOC.md

@@ -0,0 +1,8 @@
+# [Windows 10 for education](index.md)
+## [Change history for Windows 10 for Education](change-history-edu.md)
+## [Take tests in Windows 10](take-tests-in-windows-10.md)
+### [Set up Take a Test on a single PC](take-a-test-single-pc.md)
+### [Set up Take a Test on multiple PCs](take-a-test-multiple-pcs.md)
+### [Take a Test app technical reference](take-a-test-app-technical.md) 
+## [Deploy Windows 10 in a school](deploy-windows-10-in-a-school.md)
+## [Chromebook migration guide](chromebook-migration-guide.md)

education/windows/change-history-edu.md

@@ -0,0 +1,20 @@
+---
+title: Change history for Windows 10 for Education (Windows 10)
+description: New and changed topics in Windows 10 for Education
+ms.prod: W10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+author: jdeckerMS
+---
+
+# Change history for Windows 10 for Education
+
+This topic lists new and updated topics in the [Windows 10 for Education](index.md) documentation.
+
+## May 2016
+
+| New or changed topic | Description |
+|----------------------|-------------|
+| [Take tests in Windows 10](take-tests-in-windows-10.md) </br> [Set up Take a Test on a single PC](take-a-test-single-pc.md) </br> [Set up Take a Test on multiple PCs](take-a-test-multiple-pcs.md) </br> [Take a Test app technical reference](take-a-test-app-technical.md) | New |
+| [Chromebook migration guide](chromebook-migration-guide.md)  | Moved from [Windows 10 and Windows 10 Mobile](https://technet.microsoft.com/en-us/itpro/windows/plan/index) library, originally published in November 2015 |
+| [Deploy Windows 10 in a school](deploy-windows-10-in-a-school.md)  |  Moved from [Windows 10 and Windows 10 Mobile](https://technet.microsoft.com/en-us/itpro/windows/plan/index) library, originally published in May 2016 |

education/windows/chromebook-migration-guide.md

@@ -0,0 +1,962 @@
+---
+title: Chromebook migration guide (Windows 10)
+description: In this guide you will learn how to migrate a Google Chromebook-based learning environment to a Windows 10-based learning environment.
+ms.assetid: 7A1FA48A-C44A-4F59-B895-86D4D77F8BEA
+keywords: ["migrate", "automate", "device"]
+ms.prod: W10
+ms.mktglfcycl: plan
+ms.sitesec: library
+author: craigash
+---
+
+# Chromebook migration guide
+
+
+**Applies to**
+
+-   Windows 10
+
+In this guide you will learn how to migrate a Google Chromebook-based learning environment to a Windows 10-based learning environment. You will learn how to perform the necessary planning steps, including Windows device deployment, migration of user and device settings, app migration or replacement, and cloud storage migration. You will then learn the best method to perform the migration by using automated deployment and migration tools.
+
+## <a href="" id="plan-migration"></a>Plan Chromebook migration
+
+
+Before you begin to migrate Chromebook devices, plan your migration. As with most projects, there can be an urge to immediately start doing before planning. When you plan your Chromebook migration before you perform the migration, you can save countless hours of frustration and mistakes during the migration process.
+
+In the planning portion of this guide, you will identify all the decisions that you need to make and how to make each decision. At the end of the planning section, you will have a list of information you need to collect and what you need to do with the information. You will be ready to perform your Chromebook migration.
+
+## <a href="" id="plan-app-migrate-replace"></a>Plan for app migration or replacement
+
+
+App migration or replacement is an essential part of your Chromebook migration. In this section you will plan how you will migrate or replace Chromebook (Chrome OS) apps that are currently in use with the same or equivalent Windows apps. At the end of this section, you will have a list of the active Chrome OS apps and the Windows app counterparts.
+
+**Identify the apps currently in use on Chromebook devices**
+
+Before you can do any analysis or make decisions about which apps to migrate or replace, you need to identify which apps are currently in use on the Chromebook devices. You will create a list of apps that are currently in use (also called an app portfolio).
+
+**Note**  
+The majority of Chromebook apps are web apps. For these apps you need to first perform Microsoft Edge compatibility testing and then publish the web app URL to the Windows users. For more information, see the [Perform app compatibility testing for web apps](#perform-testing-webapps) section.
+
+ 
+
+You can divide the apps into the following categories:
+
+-   **Apps installed and managed by the institution.** These apps are typically managed in the Apps section in the Google Admin Console. You can record the list of these apps in your app portfolio.
+
+-   **Apps installed by faculty or students.** Faculty or students might have installed these apps as a part of a classroom curriculum. Obtain the list of these apps from faculty or students. Ensure you only record apps that are legitimately used as a part of classroom curriculum (and not for personal entertainment or use).
+
+Record the following information about each app in your app portfolio:
+
+-   App name
+
+-   App type (such as offline app, online app, web app, and so on)
+
+-   App publisher or developer
+
+-   App version currently in use
+
+-   App priority (how necessary is the app to the day-to-day process of the institution or a classroom? Rank as high, medium, or low)
+
+Throughout the entire app migration or replacement process, focus on the higher priority apps. Focus on lower priority apps only after you have determined what you will do with the higher priority apps.
+
+### <a href="" id="select-googleapps"></a>
+
+**Select Google Apps replacements**
+
+Table 1 lists the Windows device app replacements for the common Google Apps on Chromebook devices. If your users rely on any of these Google Apps, use the corresponding app on the Windows device. Use the information in Table 1 to select the Google App replacement on a Windows device.
+
+Table 1. Google App replacements
+
+| If you use this Google app on a Chromebook | Use this app on a Windows device     |
+|--------------------------------------------|--------------------------------------|
+| Google Docs                                | Word 2016 or Word Online             |
+| Google Sheets                              | Excel 2016 or Excel Online           |
+| Google Slides                              | PowerPoint 2016 or PowerPoint Online |
+| Google Apps Gmail                          | Outlook 2016 or Outlook Web App      |
+| Google Hangouts                            | Microsoft Skype for Business         |
+| Chrome                                     | Microsoft Edge                       |
+| Google Drive                               | Microsoft OneDrive for Business      |
+
+ 
+
+It may be that you will decide to replace Google Apps after you deploy Windows devices. For more information on making this decision, see the [Select cloud services migration strategy](#select-cs-migrationstrat) section of this guide.
+
+**Find the same or similar apps in the Windows Store**
+
+In many instances, software vendors will create a version of their app for multiple platforms. You can search the Windows Store to find the same or similar apps to any apps not identified in the [Select Google Apps replacements](#select-googleapps) section.
+
+In other instances, the offline app does not have a version written for the Windows Store or is not a web app. In these cases, look for an app that provides similar functions. For example, you might have a graphing calculator offline Android app published on the Chrome OS, but the software publisher does not have a version for Windows devices. Search the Windows Store for a graphing calculator app that provides similar features and functionality. Use that Windows Store app as a replacement for the graphing calculator offline Android app published on the Chrome OS.
+
+Record the Windows app that replaces the Chromebook app in your app portfolio.
+
+### <a href="" id="perform-testing-webapps"></a>
+
+**Perform app compatibility testing for web apps**
+
+The majority of Chromebook apps are web apps. Because you cannot run native offline Chromebook apps on a Windows device, there is no reason to perform app compatibility testing for offline Chromebook apps. However, you may have a number of web apps that will run on both platforms.
+
+Ensure that you test these web apps in Microsoft Edge. Record the level of compatibility for each web app in Microsoft Edge in your app portfolio.
+
+## <a href="" id="plan-migrate-user-device-settings"></a>Plan for migration of user and device settings
+
+
+Some institutions have configured the Chromebook devices to make the devices easier to use by using the Google Chrome Admin Console. You have also probably configured the Chromebook devices to help ensure the user data access and ensure that the devices themselves are secure by using the Google Chrome Admin Console.
+
+However, in addition to your centralized configuration in the Google Admin Console, Chromebook users have probably customized their device. In some instances, users may have changed the web content that is displayed when the Chrome browser starts. Or they may have bookmarked websites for future reference. Or users may have installed apps for use in the classroom.
+
+In this section, you will identify the user and device configuration settings for your Chromebook users and devices. Then you will prioritize these settings to focus on the configuration settings that are essential to your educational institution.
+
+At the end of this section, you should have a list of Chromebook user and device settings that you want to migrate to Windows, as well as a level of priority for each setting. You may discover at the end of this section that you have few or no higher priority settings to be migrated. If this is the case, you can skip the [Perform migration of user and device settings](#migrate-user-device-settings) section of this guide.
+
+**Identify Google Admin Console settings to migrate**
+
+You use the Google Admin Console (as shown in Figure 1) to manage user and device settings. These settings are applied to all the Chromebook devices in your institution that are enrolled in the Google Admin Console. Review the user and device settings in the Google Admin Console and determine which settings are appropriate for your Windows devices.
+
+![figure 1](images/chromebook-fig1-googleadmin.png)
+
+Figure 1. Google Admin Console
+
+Table 2 lists the settings in the Device Management node in the Google Admin Console. Review the settings and determine which settings you will migrate to Windows.
+
+Table 2. Settings in the Device Management node in the Google Admin Console
+
+<table>
+<colgroup>
+<col width="50%" />
+<col width="50%" />
+</colgroup>
+<thead>
+<tr class="header">
+<th align="left">Section</th>
+<th align="left">Settings</th>
+</tr>
+</thead>
+<tbody>
+<tr class="odd">
+<td align="left">Network</td>
+<td align="left"><p>These settings configure the network connections for Chromebook devices and include the following settings categories:</p>
+<ul>
+<li><p><strong>Wi-Fi.</strong> Configures the Wi-Fi connections that are available. The Windows devices will need these configuration settings to connect to the same Wi-Fi networks.</p></li>
+<li><p><strong>Ethernet.</strong> Configures authentication for secured, wired Ethernet connections (802.1x). The Windows devices will need these configuration settings to connect to the network.</p></li>
+<li><p><strong>VPN.</strong> Specifies the VPN network connections used by devices when not directly connected to your intranet. The Windows devices will need the same VPN network connections for users to remotely connect to your intranet.</p></li>
+<li><p><strong>Certificates.</strong> Contains the certificates used for network authentication. The Windows devices will need these certificates to connect to the network.</p></li>
+</ul></td>
+</tr>
+<tr class="even">
+<td align="left">Mobile</td>
+<td align="left"><p>These settings configure and manage companion devices (such as smartphones or tablets) that are used in conjunction with the Chromebook devices and include the following settings categories:</p>
+<ul>
+<li><p><strong>Device management settings.</strong> Configures settings for mobile (companion) devices, such as device synchronization, password settings, auditing, enable remote wipe, and other settings. Record these settings so that you can ensure the same settings are applied when the devices are being managed by Microsoft Intune or another mobile device management (MDM) provider.</p></li>
+<li><p><strong>Device activation.</strong> Contains a list of mobile (companion) devices that need to be approved for management by using the Google Admin Console. Approve or block any devices in this list so that the list of managed devices accurately reflects active managed devices.</p></li>
+<li><p><strong>Managed devices.</strong> Performs management tasks on mobile (companion) devices that are managed by the Google Admin Console. Record the list of companion devices on this page so that you can ensure the same devices are managed by Intune or another MDM provider.</p></li>
+<li><p><strong>Set Up Apple Push Certificate.</strong> Configures the certificate that is essentially the digital signature that lets the Google Admin Console manage iOS devices. You will need this certificate if you plan to manage iOS devices by using Intune or another MDM provider.</p></li>
+<li><p><strong>Set Up Android for Work.</strong> Authorizes the Google Admin Console to be the MDM provider for Android devices by providing an Enterprise Mobility Management (EMM) token. You will need this token if you plan to manage Android devices by using another MDM provider.</p></li>
+</ul></td>
+</tr>
+<tr class="odd">
+<td align="left">Chrome management</td>
+<td align="left"><p>These settings configure and manage companion devices (such as smartphones or tablets) that are used in conjunction with the Chromebook devices and include the following settings categories:</p>
+<ul>
+<li><p><strong>User settings.</strong> Configures user-based settings for the Chrome browser and Chromebook devices. Most of these Chromebook user-based settings can be mapped to a corresponding setting in Windows. Record the settings and then map them to settings in Group Policy or Intune.</p></li>
+<li><p><strong>Public session settings.</strong> Configures Public Sessions for Chrome devices that are used as kiosks, loaner devices, shared computers, or for any other work or school-related purpose for which users don't need to sign in with their credentials. You can configure Windows devices similarly by using Assigned Access. Record the settings and apps that are available in Public Sessions so that you can provide similar configuration in Assigned Access.</p></li>
+<li><p><strong>Device settings.</strong> Configures device-based settings for the Chrome browser and Chromebook devices. You can map most of these Chromebook device-based settings to a corresponding setting in Windows. Record the settings and then map them to settings in Group Policy or Intune.</p></li>
+<li><p><strong>Devices.</strong> Manages Chrome device management licenses. The number of licenses recorded here should correspond to the number of licenses you will need for your new management system, such as Intune. Record the number of licenses and use those to determine how many licenses you will need to manage your Windows devices.</p></li>
+<li><p><strong>App Management.</strong> Provides configuration settings for Chrome apps. Record the settings for any apps that you have identified that will run on Windows devices.</p></li>
+</ul></td>
+</tr>
+</tbody>
+</table>
+
+ 
+
+Table 3 lists the settings in the Security node in the Google Admin Console. Review the settings and determine which settings you will migrate to Windows.
+
+Table 3. Settings in the Security node in the Google Admin Console
+
+<table>
+<colgroup>
+<col width="50%" />
+<col width="50%" />
+</colgroup>
+<thead>
+<tr class="header">
+<th align="left">Section</th>
+<th align="left">Settings</th>
+</tr>
+</thead>
+<tbody>
+<tr class="odd">
+<td align="left"><p>Basic settings</p></td>
+<td align="left"><p>These settings configure password management and whether or not two-factor authentication (2FA) is configured. You can set the minimum password length, the maximum password length, if non-admin users can recover their own passwords, and enable 2FA.</p>
+<p>Record these settings and use them to help configure your on-premises Active Directory or Azure Active Directory (Azure AD) to mirror the current behavior of your Chromebook environment.</p></td>
+</tr>
+<tr class="even">
+<td align="left"><p>Password monitoring</p></td>
+<td align="left"><p>This section is used to monitor the strength of user passwords. You don’t need to migrate any settings in this section.</p></td>
+</tr>
+<tr class="odd">
+<td align="left"><p>API reference</p></td>
+<td align="left"><p>This section is used to enable access to various Google Apps Administrative APIs. You don’t need to migrate any settings in this section.</p></td>
+</tr>
+<tr class="even">
+<td align="left"><p>Set up single sign-on (SSO)</p></td>
+<td align="left"><p>This section is used to configure SSO for Google web-based apps (such as Google Apps Gmail or Google Apps Calendar). While you don’t need to migrate any settings in this section, you probably will want to configure Azure Active Directory synchronization to replace Google-based SSO.</p></td>
+</tr>
+<tr class="odd">
+<td align="left"><p>Advanced settings</p></td>
+<td align="left"><p>This section is used to configure administrative access to user data and to configure the Google Secure Data Connector (which allows Google Apps to access data on your local network). You don’t need to migrate any settings in this section.</p></td>
+</tr>
+</tbody>
+</table>
+
+ 
+
+**Identify locally-configured settings to migrate**
+
+In addition to the settings configured in the Google Admin Console, users may have locally configured their devices based on their own personal preferences (as shown in Figure 2). Table 4 lists the Chromebook user and device settings that you can locally configure. Review the settings and determine which settings you will migrate to Windows. Some of the settings listed in Table 4 can only be seen when you click the **Show advanced settings** link (as shown in Figure 2).
+
+![figure 2](images/fig2-locallyconfig.png)
+
+Figure 2. Locally-configured settings on Chromebook
+
+Table 4. Locally-configured settings
+
+| Section                | Settings                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
+|------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| Internet connections   | These settings configure the Internet connection for the devices, such as Wi-Fi and VPN connections. Record the network connection currently in use and configure the Windows device to use the same network connection settings.                                                                                                                                                                                                                                                                                            |
+| Appearances            | These settings affect the appearance of the desktop. Record the wallpaper image file that is used. Migrate the image file to the Windows device and configure as the user’s wallpaper to maintain similar user experience.                                                                                                                                                                                                                                                                                                   |
+| Search                 | These settings configure which search engine is used to search for content. Record this setting so that you can use as the search engine on the Windows device.                                                                                                                                                                                                                                                                                                                                                              |
+| Advanced sync settings | These settings configure which user settings are synchronized with the Google cloud, such as Apps, Extensions, History, Passwords, Settings, and so on. Record these settings and configure the Windows device with the same settings if you decide to continue to use Google Apps and other cloud services after you migrate to Windows devices.                                                                                                                                                                            |
+| Date and time          | These settings configure the time zone and if 24-hour clock time should be used. Record these settings and configure the Windows device to use these settings.                                                                                                                                                                                                                                                                                                                                                               |
+| Privacy                | These settings configure Google Chrome web browser privacy settings (such as prediction service, phishing and malware protection, spelling errors, resource pre-fetch, and so on). Record these settings and configure Microsoft Edge, Internet Explorer, or the web browser of your choice with these settings.                                                                                                                                                                                                             |
+| Bluetooth              | This setting configures whether or not Bluetooth is enabled on the device. Record this setting and configure the Windows device similarly.                                                                                                                                                                                                                                                                                                                                                                                   |
+| Passwords and forms    | These settings configure Google Chrome web browser to enable autofill of web forms and to save web passwords. Record these settings and configure Microsoft Edge, Internet Explorer, or the web browser of your choice with these settings.                                                                                                                                                                                                                                                                                  |
+| Smart lock             | These settings configure the Chromebook when the user’s Android phone is nearby and unlocked, which eliminates the need to type a password. You don’t need to migrate settings in this section.                                                                                                                                                                                                                                                                                                                              |
+| Web content            | These settings configure how the Chrome web browser displays content (such as font size and page zoom). Record these settings and configure Microsoft Edge, Internet Explorer, or the web browser of your choice with these settings.                                                                                                                                                                                                                                                                                        |
+| Languages              | These settings configure the language in use for the Chromebook. Record these settings and configure the Windows device to support the same language.                                                                                                                                                                                                                                                                                                                                                                        |
+| Downloads              | These settings configure the default folder for file download, if the user should be prompted where to save files, and if the Google Drive account should be disconnected. Record these settings and configure the Windows device with similar settings.                                                                                                                                                                                                                                                                     |
+| HTTPS/SSL              | These settings configure client-side certificates that are used to authenticate the device. Depending on the services or apps that use these certificates, you may need to export and then migrate these certificates to the Windows device. Contact the service or app provider to determine if you can use the existing certificate or if a new certificate needs to be issued. Record these settings and migrate the certificate to the Windows device or enroll for a new certificate as required by the service or app. |
+| Google Cloud Print     | These settings configure the printers that are available to the user. Record the list of printers available to the user and configure the Windows device to have the same printers available. Ensure that the user-friendly printer names in Windows are the same as for the Chromebook device. For example, if the Chromebook device has a printer named “Laser Printer in Registrar’s Office”, use that same name in Windows.                                                                                              |
+| On startup             | These settings configure which web pages are opened when the Chrome web browser starts. Record these settings and configure Microsoft Edge, Internet Explorer, or the web browser of your choice with these settings.                                                                                                                                                                                                                                                                                                        |
+| Accessibility          | These settings configure the Chromebook ease of use (such as display of large mouse cursor, use of high contrast mode, enablement of the screen magnifier, and so on). Record these settings and configure the Windows device with similar settings.                                                                                                                                                                                                                                                                         |
+| Powerwash              | This action removes all user accounts and resets the Chromebook device back to factory settings. You don’t have to migrate any settings in this section.                                                                                                                                                                                                                                                                                                                                                                     |
+| Reset settings         | This action retains all user accounts, but restores all settings back to their default values. You don’t have to migrate any settings in this section.                                                                                                                                                                                                                                                                                                                                                                       |
+
+ 
+
+Determine how many users have similar settings and then consider managing those settings centrally. For example, a large number of users may have many of the same Chrome web browser settings. You can centrally manage these settings in Windows after migration.
+
+Also, as a part of this planning process, consider settings that may not be currently managed centrally, but should be managed centrally. Record the settings that are currently being locally managed, but you want to manage centrally after the migration.
+
+**Prioritize settings to migrate**
+
+After you have collected all the Chromebook user, app, and device settings that you want to migrate, you need to prioritize each setting. Evaluate each setting and assign a priority to the setting based on the levels of high, medium, and low.
+
+Assign the setting-migration priority based on how critical the setting is to the faculty performing their day-to-day tasks and how the setting affects the curriculum in the classrooms. Focus on the migration of higher priority settings and put less effort into the migration of lower priority settings. There may be some settings that are not necessary at all and can be dropped from your list of settings entirely. Record the setting priority in the list of settings you plan to migrate.
+
+## <a href="" id="plan-email-migrate"></a>Plan for email migration
+
+
+Many of your users may be using Google Apps Gmail to manage their email, calendars, and contacts. You need to create the list of users you will migrate and the best time to perform the migration.
+
+Office 365 supports automated migration from Google Apps Gmail to Office 365. For more information, see [Migrate Google Apps mailboxes to Office 365](http://go.microsoft.com/fwlink/p/?LinkId=690252).
+
+**Identify the list of user mailboxes to migrate**
+
+In regards to creating the list of users you will migrate, it might seem that the answer “all the users” might be the best one. However, depending on the time you select for migration, only a subset of the users may need to be migrated. For example, you may not persist student email accounts between semesters or between academic years. In this case you would only need to migrate faculty and staff.
+
+Also, when you perform a migration it is a great time to verify that all user mailboxes are active. In many environments there are a significant number of mailboxes that were provisioned for users that are no longer a part of the institution (such as interns or student assistants). You can eliminate these users from your list of user mailboxes to migrate.
+
+Create your list of user mailboxes to migrate in Excel 2016 based on the format described in step 7 in [Create a list of Gmail mailboxes to migrate](http://go.microsoft.com/fwlink/p/?LinkId=690253). If you follow this format, you can use the Microsoft Excel spreadsheet to perform the actual migration later in the process.
+
+**Identify companion devices that access Google Apps Gmail**
+
+In addition to Chromebook devices, users may have companion devices (smartphones, tablets, desktops, laptops, and so on) that also access the Google Apps Gmail mailbox. You will need to identify those companion devices and identify the proper configuration for those devices to access Office 365 mailboxes.
+
+After you have identified each companion device, verify the settings for the device that are used to access Office 365. You only need to test one type of each companion device. For example, if users use Android phones to access Google Apps Gmail mailboxes, configure the device to access Office 365 and then record those settings. You can publish those settings on a website or to your helpdesk staff so that users will know how to access their Office 365 mailbox.
+
+In most instances, users will only need to provide in their Office 365 email account and password. However, you should verify this on each type of companion device. For more information about how to configure a companion device to work with Office 365, see [Compare how different mobile devices work with Office 365](http://go.microsoft.com/fwlink/p/?LinkId=690254).
+
+**Identify the optimal timing for the migration**
+
+Typically, the best time to perform the migration is between academic years or during semester breaks. Select the time of least activity for your institution. And during that time, the optimal time to perform the migration might be during an evening or over a weekend.
+
+Ensure that you communicate the time the migration will occur to your users well in advance. Also, ensure that users know how to access their Office 365 email after the migration is complete. Finally, ensure that your users know how to perform the common tasks they performed in Google Apps Gmail in Office 365 and/or Outlook 2016.
+
+## <a href="" id="plan-cloud-storage-migration"></a>Plan for cloud storage migration
+
+
+Chromebook devices have limited local storage. So, most of your users will store data in cloud storage, such as Google Drive. You will need to plan how to migrate your cloud storage as a part of the Chromebook migration process.
+
+In this section, you will create a list of the existing cloud services, select the Microsoft cloud services that best meet your needs, and then optimize your cloud storage services migration plan.
+
+**Identify cloud storage services currently in use**
+
+Typically, most Chromebook users use Google Drive for cloud storage services because your educational institution purchased other Google cloud services and Google Drive is a part of those services. However, some users may use cloud storage services from other vendors. For each member of your faculty and staff and for each student, create a list of cloud storage services that includes the following:
+
+-   Name of the cloud storage service
+
+-   Cloud storage service vendor
+
+-   Associated licensing costs or fees
+
+-   Approximate storage currently in use per user
+
+Use this information as the requirements for your cloud storage services after you migrate to Windows devices. If at the end of this discovery you determine there is no essential data being stored in cloud storage services that requires migration, then you can skip to the [Plan for cloud services migration](#plan-cloud-services) section.
+
+**Optimize cloud storage services migration plan**
+
+Now that you know the current cloud storage services configuration, you need to optimize your cloud storage services migration plan for Microsoft OneDrive for Business. Optimization helps ensure that your use only the cloud storage services resources that are necessary for your requirements.
+
+Consider the following to help optimize your cloud storage services migration plan:
+
+-   **Eliminate inactive user storage.** Before you perform the cloud storage services migration, identify cloud storage that is currently allocated to inactive users. Remove this storage from your list of cloud storage to migrate.
+
+-   **Eliminate or archive inactive files.** Review cloud storage to identify files that are inactive (have not been accessed for some period of time). Eliminate or archive these files so that they do not consume cloud storage.
+
+-   **Consolidate cloud storage services.** If multiple cloud storage services are in use, reduce the number of cloud storage services and standardize on one cloud storage service. This will help reduce management complexity, support time, and typically will reduce cloud storage costs.
+
+Record your optimization changes in your cloud storage services migration plan.
+
+## <a href="" id="plan-cloud-services"></a>Plan for cloud services migration
+
+
+Many of your users may use cloud services on their Chromebook device, such as Google Apps, Google Drive, or Google Apps Gmail. You have planned for these individual cloud services in the [Plan for app migration or replacement](#plan-app-migrate-replace), [Plan for Google Apps Gmail to Office 365 migration](#plan-email-migrate), and [Plan for cloud storage migration](#plan-cloud-storage-migration) sections.
+
+In this section, you will create a combined list of these cloud services and then select the appropriate strategy to migrate these cloud services.
+
+### <a href="" id="identify-cloud-services-inuse"></a>
+
+**Identify cloud services currently in use**
+
+You have already identified the individual cloud services that are currently in use in your educational institution in the [Plan for app migration or replacement](#plan-app-migrate-replace), [Plan for Google Apps Gmail to Office 365 migration](#plan-email-migrate), and [Plan for cloud storage migration](#plan-cloud-storage-migration) sections. Create a unified list of these cloud services and record the following about each service:
+
+-   Cloud service name
+
+-   Cloud service provider
+
+-   Number of users that use the cloud service
+
+**Select cloud services to migrate**
+
+One of the first questions you should ask after you identify the cloud services currently in use is, “Why do we need to migrate from these cloud services?” The answer to this question largely comes down to finances and features.
+
+Here is a list of reasons that describe why you might want to migrate from an existing cloud service to Microsoft cloud services:
+
+-   **Better integration with Office 365.** If your long-term strategy is to migrate to Office 365 apps (such as Word 2016 or Excel 2016) then a migration to Microsoft cloud services will provide better integration with these apps. The use of existing cloud services may not be as intuitive for users. For example, Office 365 apps will integrate better with OneDrive for Business compared to Google Drive.
+
+-   **Online apps offer better document compatibility.** Microsoft Office online apps (such as Word Online and Excel Online) provide the highest level of compatibility with Microsoft Office documents. The Office online apps allow you to open and edit documents directly from SharePoint or OneDrive for Business. Users can access the Office online app from any device with Internet connectivity.
+
+-   **Reduce licensing costs.** If you pay for Office 365 licenses, then Office 365 apps and cloud storage are included in those licenses. Although you could keep existing cloud services, you probably would pay more to keep those services.
+
+-   **Improve storage capacity and cross-platform features.** Microsoft cloud services provide competitive storage capacity and provide more Windows-centric features than other cloud services providers. While the Microsoft cloud services user experience is highly optimized for Windows devices, Microsoft cloud services are also highly optimized for companion devices (such as iOS or Android devices).
+
+Review the list of existing cloud services that you created in the [Identify cloud services currently in use](#identify-cloud-services-inuse) section and identify the cloud services that you want to migrate to Microsoft cloud services. If you determine at the end of this task that there are no cloud services to be migrated, then skip to the [Plan for Windows device deployment](#plan-windevice-deploy) section. Also, skip the [Perform cloud services migration](#perform-cloud-services-migration) section later in this guide.
+
+**Prioritize cloud services**
+
+After you have created your aggregated list of cloud services currently in use by Chromebook users, prioritize each cloud service. Evaluate each cloud service and assign a priority based on the levels of high, medium, and low.
+
+Assign the priority based on how critical the cloud service is to the faculty and staff performing their day-to-day tasks and how the cloud service affects the curriculum in the classrooms. Also, make cloud services that are causing pain for the users a higher priority. For example, if users experience outages with a specific cloud service, then make migration of that cloud service a higher priority.
+
+Focus on the migration of higher priority cloud services first and put less effort into the migration of lower priority cloud services. There may be some cloud services that are unnecessary and you can remove them from your list of cloud services to migrate entirely. Record the cloud service migration priority in the list of cloud services you plan to migrate.
+
+### <a href="" id="select-cs-migrationstrat"></a>
+
+**Select cloud services migration strategy**
+
+When you deploy the Windows devices, should you migrate the faculty, staff, and students to the new cloud services? Perhaps. But, in most instances you will want to select a migration strategy that introduces a number of small changes over a period of time.
+
+Consider the following when you create your cloud services migration strategy:
+
+-   **Introduce small changes.** The move from Chrome OS to Windows will be simple for most users as most will have exposure to Windows from home, friends, or family. However, users may not be as familiar with the apps or cloud services. Consider the move to Windows first, and then make other changes as time progresses.
+
+-   **Start off by using existing apps and cloud services.** Immediately after the migration to Windows devices, you may want to consider running the existing apps and cloud services (such Google Apps, Google Apps Gmail, and Google Drive). This gives users a familiar method to perform their day-to-day tasks.
+
+-   **Resolve pain points.** If some existing apps or cloud services cause problems, you may want to migrate them sooner rather than later. In most instances, users will be happy to go through the learning curve of a new app or cloud service if it is more reliable or intuitive for them to use.
+
+-   **Migrate classrooms or users with common curriculum.** Migrate to Windows devices for an entire classroom or for multiple classrooms that share common curriculum. You must ensure that the necessary apps and cloud services are available for the curriculum prior to the migration of one or more classrooms.
+
+-   **Migrate when the fewest number of active users are affected.** Migrate your cloud services at the end of an academic year or end of a semester. This will ensure you have minimal impact on faculty, staff, and students. Also, a migration during this time will minimize the learning curve for users as they are probably dealing with new curriculum for the next semester. Also, you may not need to migrate student apps and data because many educational institutions do not preserve data between semesters or academic years.
+
+-   **Overlap existing and new cloud services.** For faculty and staff, consider overlapping the existing and new cloud services (having both services available) for one business cycle (end of semester or academic year) after migration. This allows you to easily recover any data that might not have migrated successfully from the existing cloud services. At a minimum, overlap the user of existing and new cloud services until the user can verify the migration. Of course, the tradeoff for using this strategy is the cost of the existing cloud services. However, depending on when license renewal occurs, the cost may be minimal.
+
+## <a href="" id="plan-windevice-deploy"></a>Plan for Windows device deployment
+
+
+You need to plan for Windows device deployment to help ensure that the devices are successfully installed and configured to replace the Chromebook devices. Even if the vendor that provides the devices pre-loads Windows 10 on them, you still will need to perform other tasks.
+
+In this section you will select a Windows device deployment strategy; plan for Active Directory Domain Services (AD DS) and Azure AD services; plan for device, user, and app management; and plan for any necessary network infrastructure remediation.
+
+### <a href="" id="select-windows-device-deploy"></a>
+
+**Select a Windows device deployment strategy**
+
+What decisions need to be made about Windows device deployment? You just put the device on a desk, hook up power, connect to Wi-Fi, and then let the users operate the device, right? That is essentially correct, but depending on the extent of your deployment and other factors, you need to consider different deployment strategies.
+
+For each classroom that has Chromebook devices, select a combination of the following device deployment strategies:
+
+-   **Deploy one classroom at a time.** In most cases you will want to perform your deployment in batches of devices and a classroom is an excellent way to batch devices. You can treat each classroom as a unit and check each classroom off your list after you have deployed the devices.
+
+-   **Deploy based on curriculum.** Deploy the Windows devices after you have confirmed that the curriculum is ready for the Windows devices. If you deploy Windows devices without the curriculum installed and tested, you could significantly reduce the ability for students and teachers to perform effectively in the classroom. Also, deployment based on curriculum has the advantage of letting you move from classroom to classroom quickly if multiple classrooms use the same curriculum.
+
+-   **Deploy side-by-side.** In some instances you may need to have both the Chromebook and Windows devices in one or more classrooms. You can use this strategy if some of the curriculum only works on Chromebook and other parts of the curriculum works on Windows devices. This is a good method to help prevent delays in Windows device deployment, while ensuring that students and teachers can make optimal use of technology in their curriculum.
+
+-   **Deploy after apps and cloud services migration.** If you deploy a Windows device without the necessary apps and cloud services to support the curriculum, this provides only a portion of your complete solution. Ensure that the apps and cloud services are tested, provisioned, and ready for use prior to the deployment of Windows devices.
+
+-   **Deploy after the migration of user and device settings.** Ensure that you have identified the user and device settings that you plan to migrate and that those settings are ready to be applied to the new Windows devices. For example, you would want to create Group Policy Objects (GPOs) to apply the user and device settings to Windows devices.
+
+    If you ensure that Windows devices closely mirror the Chromebook device configuration, you will ease user learning curve and create a sense of familiarity. Also, when you have the settings ready to be applied to the devices, it helps ensure you will deploy your new Windows devices in a secure configuration.
+
+Record the combination of Windows device deployment strategies that you selected.
+
+### <a href="" id="plan-adservices"></a>
+
+**Plan for AD DS and Azure AD services**
+
+The next decision you will need to make concerns AD DS and Azure AD services. You can run AD DS on-premises, in the cloud by using Azure AD, or a combination of both (hybrid). The decision about which of these options is best is closely tied to how you will manage your users, apps, and devices and if you will use Office 365 and other Azure-based cloud services.
+
+In the hybrid configuration, your on-premises AD DS user and group objects are synchronized with Azure AD (including passwords). The synchronization happens both directions so that changes are made in both your on-premises AD DS and Azure AD.
+
+Table 5 is a decision matrix that helps you decide if you can use only on-premises AD DS, only Azure AD, or a combination of both (hybrid). If the requirements you select from the table require on-premises AD DS and Azure AD, then you should select hybrid. For example, if you plan to use Office 365 and use Group Policy for management, then you would select hybrid. However, if you plan to use Office 365 and use Intune for management, then you would select only Azure AD.
+
+Table 5. Select on-premises AD DS, Azure AD, or hybrid
+
+<table>
+<colgroup>
+<col width="25%" />
+<col width="25%" />
+<col width="25%" />
+<col width="25%" />
+</colgroup>
+<thead>
+<tr class="header">
+<th align="left">If you plan to...</th>
+<th align="left">On-premises AD DS</th>
+<th align="left">Azure AD</th>
+<th align="left">Hybrid</th>
+</tr>
+</thead>
+<tbody>
+<tr class="odd">
+<td align="left">Use Office 365</td>
+<td align="left"></td>
+<td align="left">X</td>
+<td align="left">X</td>
+</tr>
+<tr class="even">
+<td align="left">Use Intune for management</td>
+<td align="left"></td>
+<td align="left">X</td>
+<td align="left">X</td>
+</tr>
+<tr class="odd">
+<td align="left">Use System Center 2012 R2 Configuration Manager for management</td>
+<td align="left">X</td>
+<td align="left"></td>
+<td align="left">X</td>
+</tr>
+<tr class="even">
+<td align="left">Use Group Policy for management</td>
+<td align="left">X</td>
+<td align="left"></td>
+<td align="left">X</td>
+</tr>
+<tr class="odd">
+<td align="left">Have devices that are domain-joined</td>
+<td align="left">X</td>
+<td align="left"></td>
+<td align="left">X</td>
+</tr>
+<tr class="even">
+<td align="left">Allow faculty and students to Bring Your Own Device (BYOD) which are not domain-joined</td>
+<td align="left"></td>
+<td align="left">X</td>
+<td align="left">X</td>
+</tr>
+</tbody>
+</table>
+
+ 
+
+### <a href="" id="plan-userdevapp-manage"></a>
+
+**Plan device, user, and app management**
+
+You may ask the question, “Why plan for device, user, and app management before you deploy the device?” The answer is that you will only deploy the device once, but you will manage the device throughout the remainder of the device's lifecycle.
+
+Also, planning management before deployment is essential to being ready to support the devices as you deploy them. You want to have your management processes and technology in place when the first teachers, facility, or students start using their new Windows device.
+
+Table 6 is a decision matrix that lists the device, user, and app management products and technologies and the features supported by each product or technology. The primary device, user, and app management products and technologies include Group Policy, System Center Configuration Manager, Intune, and the Microsoft Deployment Toolkit (MDT). Use this decision matrix to help you select the right combination of products and technologies for your plan.
+
+Table 6. Device, user, and app management products and technologies
+
+<table style="width:100%;">
+<colgroup>
+<col width="14%" />
+<col width="14%" />
+<col width="14%" />
+<col width="14%" />
+<col width="14%" />
+<col width="14%" />
+<col width="14%" />
+</colgroup>
+<thead>
+<tr class="header">
+<th align="left">Desired feature</th>
+<th align="left">Windows provisioning packages</th>
+<th align="left">Group Policy</th>
+<th align="left">Configuration Manager</th>
+<th align="left">Intune</th>
+<th align="left">MDT</th>
+<th align="left">Windows Software Update Services</th>
+</tr>
+</thead>
+<tbody>
+<tr class="odd">
+<td align="left">Deploy operating system images</td>
+<td align="left">X</td>
+<td align="left"></td>
+<td align="left">X</td>
+<td align="left"></td>
+<td align="left">X</td>
+<td align="left"></td>
+</tr>
+<tr class="even">
+<td align="left">Deploy apps during operating system deployment</td>
+<td align="left">X</td>
+<td align="left"></td>
+<td align="left">X</td>
+<td align="left"></td>
+<td align="left">X</td>
+<td align="left"></td>
+</tr>
+<tr class="odd">
+<td align="left">Deploy apps after operating system deployment</td>
+<td align="left">X</td>
+<td align="left">X</td>
+<td align="left">X</td>
+<td align="left"></td>
+<td align="left"></td>
+<td align="left"></td>
+</tr>
+<tr class="even">
+<td align="left">Deploy software updates during operating system deployment</td>
+<td align="left"></td>
+<td align="left"></td>
+<td align="left">X</td>
+<td align="left"></td>
+<td align="left">X</td>
+<td align="left"></td>
+</tr>
+<tr class="odd">
+<td align="left">Deploy software updates after operating system deployment</td>
+<td align="left">X</td>
+<td align="left">X</td>
+<td align="left">X</td>
+<td align="left">X</td>
+<td align="left"></td>
+<td align="left">X</td>
+</tr>
+<tr class="even">
+<td align="left">Support devices that are domain-joined</td>
+<td align="left">X</td>
+<td align="left">X</td>
+<td align="left">X</td>
+<td align="left">X</td>
+<td align="left">X</td>
+<td align="left"></td>
+</tr>
+<tr class="odd">
+<td align="left">Support devices that are not domain-joined</td>
+<td align="left">X</td>
+<td align="left"></td>
+<td align="left"></td>
+<td align="left">X</td>
+<td align="left">X</td>
+<td align="left"></td>
+</tr>
+<tr class="even">
+<td align="left">Use on-premises resources</td>
+<td align="left">X</td>
+<td align="left">X</td>
+<td align="left">X</td>
+<td align="left"></td>
+<td align="left">X</td>
+<td align="left"></td>
+</tr>
+<tr class="odd">
+<td align="left">Use cloud-based services</td>
+<td align="left"></td>
+<td align="left"></td>
+<td align="left"></td>
+<td align="left">X</td>
+<td align="left"></td>
+<td align="left"></td>
+</tr>
+</tbody>
+</table>
+
+ 
+
+You can use Configuration Manager and Intune in conjunction with each other to provide features from both products and technologies. In some instances you may need only one of these products or technologies. In other instances, you may need two or more to meet the device, user, and app management needs for your institution.
+
+Record the device, user, and app management products and technologies that you selected.
+
+### <a href="" id="plan-network-infra-remediation"></a>
+
+**Plan network infrastructure remediation**
+
+In addition to AD DS, Azure AD, and management components, there are other network infrastructure services that Windows devices need. In most instances, Windows devices have the same network infrastructure requirements as the existing Chromebook devices.
+
+Examine each of the following network infrastructure technologies and services and determine if any remediation is necessary:
+
+-   **Domain Name System (DNS)** provides translation between a device name and its associated IP address. For Chromebook devices, public facing, Internet DNS services are the most important. For Windows devices that only access the Internet, they have the same requirements.
+
+    However, if you intend to communicate between Windows devices (peer-to-peer or client/server) then you will need local DNS services. Windows devices will register their name and IP address with the local DNS services so that Windows devices can locate each other.
+
+-   **Dynamic Host Configuration Protocol (DHCP)** provides automatic IP configuration for devices. Your existing Chromebook devices probably use DHCP for configuration. If you plan to immediately replace the Chromebook devices with Windows devices, then you only need to release all the DHCP reservations for the Chromebook devices prior to the deployment of Windows devices.
+
+    If you plan to run Chromebook and Windows devices side-by-side, then you need to ensure that your DHCP service has adequate IP addresses available for both sets of devices.
+
+-   **Wi-Fi.** Chromebook devices are designed to connect to Wi-Fi networks. Windows devices are the same. Your existing Wi-Fi network for the Chromebook devices should be adequate for the same number of Windows devices.
+
+    If you plan to significantly increase the number of Windows devices or you plan to run Chromebook and Windows devices side-by-side, then you need to ensure that Wi-Fi network can support the number of devices.
+
+-   **Internet bandwidth.** Chromebook devices consume more Internet bandwidth (up to 700 times more) than Windows devices. This means that if your existing Internet bandwidth is adequate for the Chromebook devices, then the bandwidth will be more than adequate for Windows devices.
+
+    However, if you plan to significantly increase the number of Windows devices or you plan to run Chromebook and Windows devices side-by-side, then you need to ensure that your Internet connection can support the number of devices.
+
+    For more information that compares Internet bandwidth consumption for Chromebook and Windows devices, see the following resources:
+
+    -   [Chromebook vs. Windows Notebook Network Traffic Analysis](http://go.microsoft.com/fwlink/p/?LinkId=690255)
+
+    -   [Hidden Cost of Chromebook Deployments](http://go.microsoft.com/fwlink/p/?LinkId=690256)
+
+    -   [Microsoft Windows 8.1 Notebook vs. Chromebooks for Education](http://go.microsoft.com/fwlink/p/?LinkId=690257)
+
+-   **Power.** Although not specifically a network infrastructure, you need to ensure your classrooms have adequate power. Chromebook and Windows devices should consume similar amounts of power. This means that your existing power outlets should support the same number of Windows devices.
+
+    If you plan to significantly increase the number of Windows devices or you plan to run Chromebook and Windows devices side-by-side, you need to ensure that the power outlets, power strips, and other power management components can support the number of devices.
+
+At the end of this process, you may determine that no network infrastructure remediation is necessary. If so, you can skip the [Perform network infrastructure remediation](#network-infra-remediation) section of this guide.
+
+## Perform Chromebook migration
+
+
+Thus far, planning has been the primary focus. Believe it or not most of the work is now done. The rest of the Chromebook migration is just the implementation of the plan you have created.
+
+In this section you will perform the necessary steps for the Chromebook device migration. You will perform the migration based on the planning decision that you made in the [Plan Chromebook migration](#plan-migration) section earlier in this guide.
+
+You must perform some of the steps in this section in a specific sequence. Each section has guidance about when to perform a step. You can perform other steps before, during, or after the migration. Again, each section will tell you if the sequence is important.
+
+## <a href="" id="network-infra-remediation"></a>Perform network infrastructure remediation
+
+
+The first migration task is to perform any network infrastructure remediation. In the [Plan network infrastructure remediation](#plan-network-infra-remediation) section, you determined the network infrastructure remediation (if any) that you needed to perform.
+
+It is important that you perform any network infrastructure remediation first because the remaining migration steps are dependent on the network infrastructure. Table 7 lists the Microsoft network infrastructure products and technologies and deployment resources for each.
+
+Table 7. Network infrastructure products and technologies and deployment resources
+
+<table>
+<colgroup>
+<col width="50%" />
+<col width="50%" />
+</colgroup>
+<thead>
+<tr class="header">
+<th align="left">Product or technology</th>
+<th align="left">Resources</th>
+</tr>
+</thead>
+<tbody>
+<tr class="odd">
+<td align="left">DHCP</td>
+<td align="left"><ul>
+<li><p>[Core Network Guide](http://go.microsoft.com/fwlink/p/?LinkId=733920)</p></li>
+<li><p>[DHCP Deployment Guide](http://go.microsoft.com/fwlink/p/?LinkId=734021)</p></li>
+</ul></td>
+</tr>
+<tr class="even">
+<td align="left">DNS</td>
+<td align="left"><ul>
+<li><p>[Core Network Guide](http://go.microsoft.com/fwlink/p/?LinkId=733920)</p></li>
+<li><p>[Deploying Domain Name System (DNS)](http://go.microsoft.com/fwlink/p/?LinkId=734022)</p></li>
+</ul></td>
+</tr>
+</tbody>
+</table>
+
+ 
+
+If you use network infrastructure products and technologies from other vendors, refer to the vendor documentation on how to perform the necessary remediation. If you determined that no remediation is necessary, you can skip this section.
+
+## Perform AD DS and Azure AD services deployment or remediation
+
+
+It is important that you perform AD DS and Azure AD services deployment or remediation right after you finish network infrastructure remediation. Many of the remaining migration steps are dependent on you having your identity system (AD DS or Azure AD) in place and up to necessary expectations.
+
+In the [Plan for Active Directory services](#plan-adservices) section, you determined the AD DS and/or Azure AD deployment or remediation (if any) that needed to be performed. Table 8 list AD DS, Azure AD, and the deployment resources for both. Use the resources in this table to deploy or remediate on-premises AD DS, Azure AD, or both.
+
+Table 8. AD DS, Azure AD and deployment resources
+
+<table>
+<colgroup>
+<col width="50%" />
+<col width="50%" />
+</colgroup>
+<thead>
+<tr class="header">
+<th align="left">Product or technology</th>
+<th align="left">Resources</th>
+</tr>
+</thead>
+<tbody>
+<tr class="odd">
+<td align="left">AD DS</td>
+<td align="left"><ul>
+<li><p>[Core Network Guide](http://go.microsoft.com/fwlink/p/?LinkId=733920)</p></li>
+<li><p>[Active Directory Domain Services Overview](http://go.microsoft.com/fwlink/p/?LinkId=733909)</p></li>
+</ul></td>
+</tr>
+<tr class="even">
+<td align="left">Azure AD</td>
+<td align="left"><ul>
+<li><p>[Azure Active Directory documentation](http://go.microsoft.com/fwlink/p/?LinkId=690258)</p></li>
+<li><p>[Manage and support Azure Active Directory Premium](http://go.microsoft.com/fwlink/p/?LinkId=690259)</p></li>
+<li><p>[Guidelines for Deploying Windows Server Active Directory on Azure Virtual Machines](http://go.microsoft.com/fwlink/p/?LinkId=690260)</p></li>
+</ul></td>
+</tr>
+</tbody>
+</table>
+
+ 
+
+If you decided not to migrate to AD DS or Azure AD as a part of the migration, or if you determined that no remediation is necessary, you can skip this section. If you use identity products and technologies from another vendor, refer to the vendor documentation on how to perform the necessary steps.
+
+## Prepare device, user, and app management systems
+
+
+In the [Plan device, user, and app management](#plan-userdevapp-manage) section of this guide, you selected the products and technologies that you will use to manage devices, users, and apps on Windows devices. You need to prepare your management systems prior to Windows 10 device deployment. You will use these management systems to manage the user and device settings that you selected to migrate in the [Plan for migration of user and device settings](#plan-migrate-user-device-settings) section. You need to prepare these systems prior to the migration of user and device settings.
+
+Table 9 lists the Microsoft management systems and the deployment resources for each. Use the resources in this table to prepare (deploy or remediate) these management systems.
+
+Table 9. Management systems and deployment resources
+
+<table>
+<colgroup>
+<col width="50%" />
+<col width="50%" />
+</colgroup>
+<thead>
+<tr class="header">
+<th align="left">Management system</th>
+<th align="left">Resources</th>
+</tr>
+</thead>
+<tbody>
+<tr class="odd">
+<td align="left">Windows provisioning packages</td>
+<td align="left"><ul>
+<li><p>[Build and apply a provisioning package](http://go.microsoft.com/fwlink/p/?LinkId=733918)</p></li>
+<li><p>[Windows Imaging and Configuration Designer](http://go.microsoft.com/fwlink/p/?LinkId=733911)</p></li>
+<li><p>[Step-By-Step: Building Windows 10 Provisioning Packages](http://go.microsoft.com/fwlink/p/?LinkId=690261)</p></li>
+</ul></td>
+</tr>
+<tr class="even">
+<td align="left">Group Policy</td>
+<td align="left"><ul>
+<li><p>[Core Network Companion Guide: Group Policy Deployment](http://go.microsoft.com/fwlink/p/?LinkId=733915)</p></li>
+<li><p>[Deploying Group Policy](http://go.microsoft.com/fwlink/p/?LinkId=734024)</p></li>
+</ul></td>
+</tr>
+<tr class="odd">
+<td align="left">Configuration Manager</td>
+<td align="left"><ul>
+<li><p>[Site Administration for System Center 2012 Configuration Manager](http://go.microsoft.com/fwlink/p/?LinkId=733914)</p></li>
+<li><p>[Deploying Clients for System Center 2012 Configuration Manager](http://go.microsoft.com/fwlink/p/?LinkId=733919)</p></li>
+</ul></td>
+</tr>
+<tr class="even">
+<td align="left">Intune</td>
+<td align="left"><ul>
+<li><p>[Set up and manage devices with Microsoft Intune](http://go.microsoft.com/fwlink/p/?LinkId=690262)</p></li>
+<li><p>[Smoother Management Of Office 365 Deployments with Windows Intune](http://go.microsoft.com/fwlink/p/?LinkId=690263)</p></li>
+<li><p>[System Center 2012 R2 Configuration Manager &amp; Windows Intune](http://go.microsoft.com/fwlink/p/?LinkId=690264)</p></li>
+</ul></td>
+</tr>
+<tr class="odd">
+<td align="left">MDT</td>
+<td align="left"><ul>
+<li><p>[MDT documentation in the Microsoft Deployment Toolkit (MDT) 2013](http://go.microsoft.com/fwlink/p/?LinkId=690324)</p></li>
+<li><p>[Step-By-Step: Installing Windows 8.1 From A USB Key](http://go.microsoft.com/fwlink/p/?LinkId=690265)</p></li>
+</ul></td>
+</tr>
+</tbody>
+</table>
+
+ 
+
+If you determined that no new management system or no remediation of existing systems is necessary, you can skip this section. If you use a management system from another vendor, refer to the vendor documentation on how to perform the necessary steps.
+
+## <a href="" id="perform-app-migration-or-replacement-"></a>Perform app migration or replacement
+
+
+In the [Plan for app migration or replacement](#plan-app-migrate-replace) section, you identified the apps currently in use on Chromebook devices and selected the Windows apps that will replace the Chromebook apps. You also performed app compatibility testing for web apps to ensure that web apps on the Chromebook devices would run on Microsoft Edge and Internet Explorer.
+
+In this step, you need to configure your management system to deploy the apps to the appropriate Windows users and devices. Table 10 lists the Microsoft management systems and the app deployment resources for each. Use the resources in this table to configure these management systems to deploy the apps that you selected in the [Plan for app migration or replacement](#plan-app-migrate-replace) section of this guide.
+
+Table 10. Management systems and app deployment resources
+
+<table>
+<colgroup>
+<col width="50%" />
+<col width="50%" />
+</colgroup>
+<thead>
+<tr class="header">
+<th align="left">Management system</th>
+<th align="left">Resources</th>
+</tr>
+</thead>
+<tbody>
+<tr class="odd">
+<td align="left">Group Policy</td>
+<td align="left"><ul>
+<li><p>[Editing an AppLocker Policy](http://go.microsoft.com/fwlink/p/?LinkId=734025)</p></li>
+<li><p>[Group Policy Software Deployment Background](http://go.microsoft.com/fwlink/p/?LinkId=734026)</p></li>
+<li><p>[Assigning and Publishing Software](http://go.microsoft.com/fwlink/p/?LinkId=734027)</p></li>
+</ul></td>
+</tr>
+<tr class="even">
+<td align="left">Configuration Manager</td>
+<td align="left"><ul>
+<li><p>[How to Deploy Applications in Configuration Manager](http://go.microsoft.com/fwlink/p/?LinkId=733917)</p></li>
+<li><p>[Application Management in Configuration Manager](http://go.microsoft.com/fwlink/p/?LinkId=733907)</p></li>
+</ul></td>
+</tr>
+<tr class="odd">
+<td align="left">Intune</td>
+<td align="left"><ul>
+<li><p>[Deploy apps to mobile devices in Microsoft Intune](http://go.microsoft.com/fwlink/p/?LinkId=733913)</p></li>
+<li><p>[Manage apps with Microsoft Intune](http://go.microsoft.com/fwlink/p/?LinkId=733910)</p></li>
+</ul></td>
+</tr>
+</tbody>
+</table>
+
+ 
+
+If you determined that no deployment of apps is necessary, you can skip this section. If you use a management system from another vendor, refer to the vendor documentation on how to perform the necessary steps.
+
+## <a href="" id="migrate-user-device-settings"></a>Perform migration of user and device settings
+
+
+In the [Plan for migration of user and device settings](#plan-migrate-user-device-settings) section, you determined the user and device settings that you want to migrate. You selected settings that are configured in the Google Admin Console and locally on the Chromebook device.
+
+Perform the user and device setting migration by using the following steps:
+
+1.  From the list of institution-wide settings that you created in the [Plan for migration of user and device settings](#plan-migrate-user-device-settings) section, configure as many as possible in your management system (such as Group Policy, Configuration Manager, or Intune).
+
+2.  From the list of device-specific settings that you created in the [Plan for migration of user and device settings](#plan-migrate-user-device-settings) section, configure device-specific setting for higher priority settings.
+
+3.  From the list of user-specific settings that you created in the [Plan for migration of user and device settings](#plan-migrate-user-device-settings) section, configure user-specific setting for higher priority settings.
+
+4.  Verify that all higher-priority user and device settings have been configured in your management system.
+
+If you do no want to migrate any user or device settings from the Chromebook devices to the Windows devices, you can skip this section.
+
+## Perform email migration
+
+
+In the [Plan for email migration](#plan-email-migrate) section, you identified the user mailboxes to migrate, identified the companion devices that access Google Apps Gmail, and identified the optimal timing for migration. You can perform this migration before or after you deploy the Windows devices.
+
+Office 365 supports automated migration from Google Apps Gmail to Office 365. For more information on how to automate the migration from Google Apps Gmail to Office 365, see [Migrate Google Apps mailboxes to Office 365](http://go.microsoft.com/fwlink/p/?LinkId=690252).
+
+Alternatively, if you want to migrate to Office 365 from:
+
+-   **On-premises Microsoft Exchange Server.** Use the following resources to migrate to Office 365 from an on-premises Microsoft Exchange Server:
+
+    -   [Cutover Exchange Migration and Single Sign-On](http://go.microsoft.com/fwlink/p/?LinkId=690266)
+
+    -   [Step-By-Step: Migration of Exchange 2003 Server to Office 365](http://go.microsoft.com/fwlink/p/?LinkId=690267)
+
+    -   [Step-By-Step: Migrating from Exchange 2007 to Office 365](http://go.microsoft.com/fwlink/p/?LinkId=690268)
+
+-   **Another on-premises or cloud-based email service.** Follow the guidance from that vendor.
+
+## Perform cloud storage migration
+
+
+In the [Plan for cloud storage migration](#plan-cloud-storage-migration) section, you identified the cloud storage services currently in use, selected the Microsoft cloud storage services that you will use, and optimized your cloud storage services migration plan. You can perform the cloud storage migration before or after you deploy the Windows devices.
+
+Manually migrate the cloud storage migration by using the following steps:
+
+1.  Install both Google Drive app and OneDrive for Business or OneDrive app on a device.
+
+2.  Sign in as the user in the Google Drive app.
+
+3.  Sign in as the user in the OneDrive for Business or OneDrive app.
+
+4.  Copy the data from the Google Drive storage to the OneDrive for Business or OneDrive storage.
+
+5.  Optionally uninstall the Google Drive app.
+
+There are also a number of software vendors who provide software that helps automate the migration from Google Drive to OneDrive for Business, Office 365 SharePoint, or OneDrive. For more information about these automated migration tools, contact the vendors.
+
+## Perform cloud services migration
+
+
+In the [Plan for cloud services migration](#plan-cloud-services)section, you identified the cloud services currently in use, selected the cloud services that you want to migrate, prioritized the cloud services to migrate, and then selected the cloud services migration strategy. You can perform the cloud services migration before or after you deploy the Windows devices.
+
+Migrate the cloud services that you currently use to the Microsoft cloud services that you selected. For example, you could migrate from a collaboration website to Office 365 SharePoint. Perform the cloud services migration based on the existing cloud services and the Microsoft cloud services that you selected.
+
+There are also a number of software vendors who provide software that helps automate the migration from other cloud services to Microsoft cloud services. For more information about these automated migration tools, contact the vendors.
+
+## Perform Windows device deployment
+
+
+In the [Select a Windows device deployment strategy](#select-windows-device-deploy) section, you selected how you wanted to deploy Windows 10 devices. The other migration task that you designed in the [Plan for Windows device deployment](#plan-windevice-deploy) section have already been performed. Now it's time to deploy the actual devices.
+
+For example, if you selected to deploy Windows devices by each classroom, start with the first classroom and then proceed through all of the classrooms until you’ve deployed all Windows devices.
+
+In some instances, you may receive the devices with Windows 10 already deployed, and want to use provisioning packages. In other cases, you may have a custom Windows 10 image that you want to deploy to the devices by using Configuration Manager and/or MDT. For information on how to deploy Windows 10 images to the devices, see the following resources:
+
+-   [Windows Imaging and Configuration Designer](http://go.microsoft.com/fwlink/p/?LinkId=733911)
+
+-   [Build and apply a provisioning package](http://go.microsoft.com/fwlink/p/?LinkId=733918)
+
+-   [MDT documentation in the Microsoft Deployment Toolkit (MDT) 2013](http://go.microsoft.com/fwlink/p/?LinkId=690324)
+
+-   [Step-By-Step: Installing Windows 8.1 From A USB Key](http://go.microsoft.com/fwlink/p/?LinkId=690265)
+
+-   [Operating System Deployment in Configuration Manager](http://go.microsoft.com/fwlink/p/?LinkId=733916)
+
+In addition to the Windows 10 image deployment, you may need to perform the following tasks as a part of device deployment:
+
+-   Enroll the device with your management system.
+
+-   Ensure that Windows Defender is enabled and configured to receive updates.
+
+-   Ensure that Windows Update is enabled and configured to receive updates.
+
+-   Deploy any apps that you want the user to immediately be able to access when they start the device (such as Word 2016 or Excel 2016).
+
+After you complete these steps, your management system should take over the day-to-day maintenance tasks for the Windows 10 devices. Verify that the user and device settings migrated correctly as you deploy each batch of Windows 10 devices. Continue this process until you deploy all Windows 10 devices.
+
+## Related topics
+
+
+[Try it out: Windows 10 deployment (for education)](http://go.microsoft.com/fwlink/p/?LinkId=623254)
+
+[Try it out: Windows 10 in the classroom](http://go.microsoft.com/fwlink/p/?LinkId=623255)
+
+ 
+
+ 
+
+
+
+
+

education/windows/index.md

@@ -0,0 +1,26 @@
+---
+title: Windows 10 for Education (Windows 10)
+description: Learn about using Windows 10 in schools.
+ms.prod: W10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+author: jdeckerMS
+---
+
+# Windows 10 for Education
+[Windows 10 Education](https://www.microsoft.com/en-us/education/products/windows/default.aspx) empowers staff, administrators, teachers and students to do great things.
+
+[Find out how to get Windows 10 Education for your school.](https://www.microsoft.com/en-us/education/buy-license/overview-of-how-to-buy/default.aspx?tabshow=schools)
+
+## In this section
+
+|Topic |Description |
+|------|------------|
+| [Take tests in Windows 10](take-tests-in-windows-10.md) | Learn how to configure and use the **Take a Test** app in Windows 10 |
+| [Deploy Windows 10 in a school](deploy-windows-10-in-a-school.md) | Learn how to deploy Windows 10 in classrooms; integrate the school environment with Microsoft Office 365, Active Directory Domain Services (AD DS), and Microsoft Azure Active Directory (Azure AD); and deploy Windows 10 and your apps to new devices or upgrade existing devices to Windows 10. |
+| [Chromebook migration guide](chromebook-migration-guide.md) | Learn how to migrate a Google Chromebook-based learning environment to a Windows 10-based learning environment. |
+
+## Related topics
+
+- [Windows 10 and Windows 10 Mobile](https://technet.microsoft.com/itpro/windows/index)
+- [Try it out: virtual labs for Windows 10 Education](https://technet.microsoft.com/en-us/windows/dn610356)

education/windows/take-a-test-app-technical.md

@@ -0,0 +1,82 @@
+---
+title: Take a Test app technical reference
+description: The policies and settings applied by the Take a Test app.
+keywords: ["shared cart", "shared PC", "school"]
+ms.prod: W10
+ms.mktglfcycl: plan
+ms.sitesec: library
+author: jdeckerMS
+---
+
+# Take a Test app technical reference
+**Applies to:**
+
+-   Windows 10 Insider Preview 
+
+
+> <span style="color:#ED1C24;">[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. ]</span>
+
+Take a Test is an app that locks down the PC and displays an online assessment web page.   
+
+Whether you are a teacher or IT administrator, you can easily configure Take a Test to meet your testing needs. For high-stakes tests, the app creates a browser-based, locked-down environment for more secure online assessments. This means that students taking the tests that don’t have copy/paste privileges, can’t access to files and applications, and are free from distractions. For simple tests and quizzes, Take a Test can be configured to use the teacher’s preferred assessment website to deliver digital assessments
+
+Assessment vendors can use Take a Test as a platform to lock down the operating system. Take a Test supports the [SBAC browser API standard](http://www.smarterapp.org/documents/SecureBrowserRequirementsSpecifications_0-3.pdf) for high stakes common core testing. (Link to Javascript API when available)
+
+## PC lockdown for assessment
+
+ When the assessment page initiates lock down, the student’s desktop will be locked and the app will be launched above the Windows lock screen to provide a sandbox that ensures the student can only interact with the Take a Test app . After transitioning to the lock screen, Take a Test will apply local MDM policies to further lock down the device. The whole process of going above the lock screen and applying policies is what defines lockdown. The lockdown process is atomic, which means that if any part of the lockdown operation fails, the app will not be above lock and won't have any of the policies applied.  
+
+When running above the lock screen:
+- The app runs full screen with no chrome 
+
+- The hardware print screen button is disabled 
+
+- Content within the app will show up as black in screen capturing/sharing software Copy/paste is disabled 
+
+- Web apps can query the processes currently running in the user’s device
+
+- Extended display shows up as black 
+
+- Auto-fill is disabled
+
+## Mobile device management (MDM) policies
+
+When Take a Test is running, the following MDM policies are applied to lock down the PC.
+
+| Policy | Description | Value |
+|---|---|---|
+| AllowToasts | Disables toast notifications from being shown | 0 |
+| AllAppStoreAutoUpdate | Disables automatic updates for Windows Store apps that are installed on the PC | 0 |
+| AllowDeviceDiscovery | Disables UI for screen sharing | 0 |
+| AllowInput Panel | Disables the onscreen keyboard which will disable auto-fill | 0 |
+| AllowCortana | Disables Cortana functionality | 0 |
+| AllAutoupdate | Disables Windows Update from starting OS updates | 5 |
+
+## Allowed functionality
+
+When Take a Test is running, the following functionality is available to students:
+
+- Assistive technology that is configured to run above the lock screen should run as expected 
+
+- Narrator is available through Windows key + Enter 
+
+- Magnifier is available through Windows key + "+" key 
+
+- Full screen mode is compatible  
+
+- The student can press Alt+Tab when locked down. This results in the student being able to switch between the following:
+
+    - Take a Test 
+    - Assistive technology that may be running 
+    - Lock Screen
+    > **Note** The app will exit if the student signs in to an account from the lock screen. Progress made in the test may be lost or invalidated. 
+
+- The student can exit the test by pressing one of the following key combinations: 
+
+    - Ctrl+Alt+Del 
+
+    - Alt+F4
+
+
+
+

education/windows/take-a-test-multiple-pcs.md

@@ -0,0 +1,215 @@
+---
+title: Set up Take a Test on multiple PCs
+description: Learn how to set up and use the Take a Test app on multiple PCs.
+keywords: ["shared cart", "shared PC", "school"]
+ms.prod: W10
+ms.mktglfcycl: plan
+ms.sitesec: library
+author: jdeckerMS
+---
+
+# Set up Take a Test on multiple PCs
+**Applies to:**
+
+-   Windows 10 Insider Preview 
+
+
+> <span style="color:#ED1C24;">[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. ]</span>
+
+Many schools use online testing for formative and summative assessments. It's critical that students use a secure browser that prevents them from using other computer or Internet resources during the test. The **Take a Test** app in Windows 10, Version 1607, creates the right environment for taking a test:
+
+- A Microsoft Edge browser window opens, showing just the test and nothing else.
+- Students aren’t able to go to other websites.
+- Students can’t open or access other apps.
+- Students can't share, print, or record their screens.
+- Students can’t copy or paste.
+- Students can’t change settings, extend their display, see notifications, get updates, or use autofill features.
+- Cortana is turned off.
+
+
+**Take a Test** is included in Windows 10 Education. To add **Take a Test** to other editions of Windows 10, see [Add the Take a Test app to Windows 10](take-tests-in-windows-10.md#add-the-take-a-test-app-to-windows-10)
+
+## How you use Take a Test
+
+![Use test account or test url in Take a Test](images/take-a-test-flow.png)
+
+- **Use a test URL and a [dedicated testing account](#set-up-a-dedicated-test-account)** - A user signs in to the account and the **Take a Test** app automatically launches the pre-configured assessment URL in Microsoft Edge in a single-app, kiosk mode. A student will never have access to the desktop in this configuration. We recommend this configuration for high stakes testing.
+- **[Put a test URL with an included prefix](#provide-link-to-test) on a web page or OneNote for students to click** - This allows teachers and test administrators an easier way to deploy assessments. We recommend this method for lower stakes assessments.
+
+## Set up a dedicated test account
+
+To configure a dedicated test account on multiple PCs, you can use:
+- [Mobile device management (MDM) or Microsoft System Center Configuration Manager](#set-up-test-account-in-mdm-or-configuration-manager)
+- [A provisioning package](#set-up-test-account-in-a-provisioning-package) created in Windows Imaging and Configuration Designer (ICD)
+- [Group Policy](#set-up-test-account-in-group-policy) to deploy a scheduled task that runs a Powershell script
+    
+
+### Set up test account in MDM or Configuration Manager
+
+1. Launch your management console.
+2. Create a policy to set up single app kiosk mode, using the following values:
+
+    - **Custom OMA-DM URI** = ./Vendor/MSFT/AssignedAccess/KioskModeApp
+    - **String value** = {"Account":"*redmond\\kioskuser*","AUMID":” Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy!App "}
+
+    > Account can be in one of the following formats:
+    > - username
+    > - domain\username
+    > - computer name\\username
+    > - username@tenant.com
+
+3. Create a policy to configure the assessment URL, using the following values:
+
+    - **Custom OMA-DM URI** = ./Vendor/MSFT/SecureAssessment/LaunchURI
+    - **String value** = *assessment URL*
+    > See [Assessment URLs](#assessment-urls)
+    
+4. Create a policy that associates the assessment URL to the account, using the following values:
+
+    - **Custom OMA-DM URI** = ./Vendor/MSFT/SecureAssessment/TesterAccount
+    - **String value** = Enter the account that you created in step 2, using the same account format.
+    
+5. To take the test, the student signs in to the test account.
+
+### Set up test account in a provisioning package
+
+Prerequisite: You must first [download the Windows ADK](https://msdn.microsoft.com/en-us/windows/hardware/dn913721.aspx) for Windows 10, Version 1607, and  install Windows Imaging and Configuration Designer (ICD).
+
+**Create a provisioning package to set up a test account
+
+1. Open Windows ICD (by default, %windir%\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86\ICD.exe). 
+2. Select **Advanced provisioning**.
+3. Name your project, and click **Next**.
+4. Select **All Windows desktop editions**, and click **Next**.
+5. Click **Finish**.
+6. Go to **Runtime settings** > **AssignedAccess** > **AssignedAccessSettings**. 
+7. Enter **{"Account":"*redmond\\kioskuser*","AUMID":” Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy!App "}**, using the account that you want to set up, as shown in the following image.
+
+    ![Enter account and app for Assigned Access Settings](images/test-account-icd.png)
+    > Account can be in one of the following formats:
+    > - username
+    > - domain\username
+    > - computer name\\username
+    > - username@tenant.com
+    
+8. Go to **Runtime settings** > **TakeATest**.
+9. Enter the test URL in **LaunchURI**.
+10. Enter the test account from step 7 in **TesterAccount**.
+On the **File** menu, select **Save.**
+
+9.  On the **Export** menu, select **Provisioning package**.
+
+10. Change **Owner** to **IT Admin**, which will set the precedence of this provisioning package higher than provisioning packages applied to this device from other sources, and then select **Next.**
+
+11. Optional. In the **Provisioning package security** window, you can choose to encrypt the package and enable package signing.
+
+    -   **Enable package encryption** - If you select this option, an auto-generated password will be shown on the screen.
+
+    -   **Enable package signing** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by clicking **Select** and choosing the certificate you want to use to sign the package.
+
+12. Click **Next** to specify the output location where you want the provisioning package to go when it's built. By default, Windows ICD uses the project folder as the output location.
+
+    Optionally, you can click **Browse** to change the default output location.
+
+13. Click **Next**.
+
+14. Click **Build** to start building the package. The provisioning package doesn't take long to build. The project information is displayed in the build page and the progress bar indicates the build status.
+
+    If you need to cancel the build, click **Cancel**. This cancels the current build process, closes the wizard, and takes you back to the **Customizations Page**.
+
+15. If your build fails, an error message will show up that includes a link to the project folder. You can scan the logs to determine what caused the error. Once you fix the issue, try building the package again.
+
+    If your build is successful, the name of the provisioning package, output directory, and project directory will be shown.
+
+    -   If you choose, you can build the provisioning package again and pick a different path for the output package. To do this, click **Back** to change the output package name and path, and then click **Next** to start another build.
+    -   If you are done, click **Finish** to close the wizard and go back to the **Customizations Page**. 
+
+ **Apply the provisioning package**
+ 
+ 1.  Select the provisioning package that you want to apply, double-click the file, and then allow admin privileges.
+
+2.  Consent to allow the package to be installed.
+
+    After you allow the package to be installed, the settings will be applied to the device
+
+[Learn how to apply a provisioning package in audit mode or OOBE.](http://go.microsoft.com/fwlink/p/?LinkID=692012)
+
+### Set up test account in Group Policy
+
+To set up a test account using Group Policy, first create a Powershell script that configures the test account and test URL, and then create a scheduled task to run the script.
+
+#### Create a Powershell script
+
+This sample Powershell script configures the test account and the test URL. Edit the sample to: 
+- Use your test account for **$obj.LaunchURI**  
+- Use your test URL for **$obj.TesterAccount**
+- Use your test account for **-UserName** 
+
+```
+$obj = get-wmiobject -namespace root/cimv2/mdm/dmmap -class MDM_SecureAssessment -filter "InstanceID='SecureAssessment' AND ParentID='./Vendor/MSFT'"; 
+$obj.LaunchURI='http://www.foo.com'; 
+$obj.TesterAccount='TestAccount'; 
+$obj.put()
+Set-AssignedAccess -AppUserModelId Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy!App -UserName TestAccount
+```
+
+
+#### Create a scheduled task in Group Policy
+
+1. Open the Group Policy Management Console. 
+2. Right-click the Group Policy object (GPO) that should contain the new preference item, and then click **Edit**.
+3. In the console tree under **Computer Configuration** or **User Configuration**, go to **Preferences** > **Control Panel Settings**.
+4. Right-click **Scheduled Tasks**, point to **New**, and select **Scheduled Task**.
+5. In the **New Scheduled Task Properties** dialog box, click **Change User or Group**.
+6. In the **Select User or Group** dialog box, click **Advanced**.
+7. In the **Advanced** dialog box, click **Find Now**.
+8. Select **System** in the search results
+9. Go back to the **Properties** dialog box and select **Run with highest privileges** under **Security options**.
+9. Specify the operating system in the **Configure for** field.
+9. Navigate to the **Actions** tab.
+9. Create a new **Action**.
+9. Configure the action to **Start a program**.
+9. In the **Program/script** field, enter **powershell**.
+9. In the **Add arguments** field, enter **-file “<path to powershell script>”**.
+9. Click **OK**.
+9. Navigate to the **Triggers** tab and create a new trigger.
+9. Specify the trigger to be **On a schedule**.
+9. Specify the trigger to be **One time**.
+9. Specify the time the trigger should start.
+9. Click **OK**.
+9. In the **Settings** tab, select **Run task as soon as possible after a scheduled start is missed**.
+9. Click **OK**.
+
+
+
+## Provide link to test
+
+Anything hosted on the web can be presented in a locked down manner, not just assessments. To lock down online content, just embed a URL with a specific prefix and devices will be locked down when users follow the link. We recommend using this method for lower stakes assessments. 
+
+1. Create a link to the test URL. Use **ms-edu-secureassessment:** before the URL and **!enforceLockdown** after the URL.
+``` 
+ms-edu-secureassessment:<URL>!enforceLockdown
+ ```
+ > **Note**:   You may want to remove !enforceLockdown for tests that utilizes our lockdown API that checks for running processes before locking down. Removing !enforceLockdown will result in the app not locking down immediately which allows you to close apps that are not allowed to run during lockdown. The test web application may lock down the device once you have closed the apps. 
+
+2. Distribute the link. You can use the web, email, OneNote, or any other method of your choosing.
+3. To take the test, the student clicks on the link and provides user consent.
+
+
+
+## Assessment URLs
+
+This assessment URL uses our lockdown API:
+
+- SBAC/AIR:  [http://mobile.tds.airast.org/launchpad/](http://mobile.tds.airast.org/launchpad/).
+
+
+## Related topics
+
+[Take tests in Windows 10](take-tests-in-windows-10.md)
+
+[Set up Take a Test on a single PC](take-a-test-single-pc.md)
+
+[Set up Take a Test on multiple PCs](take-a-test-multiple-pcs.md)
+
+[Take a Test app technical reference](take-a-test-app-technical.md)

education/windows/take-a-test-single-pc.md

@@ -0,0 +1,85 @@
+---
+title: Set up Take a Test on a single PC
+description: Learn how to set up and use the Take a Test app on a single PC.
+keywords: ["shared cart", "shared PC", "school"]
+ms.prod: W10
+ms.mktglfcycl: plan
+ms.sitesec: library
+author: jdeckerMS
+---
+
+# Set up Take a Test on a single PC
+**Applies to:**
+
+-   Windows 10 Insider Preview 
+
+
+> <span style="color:#ED1C24;">[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. ]</span>
+
+The **Take a Test** app in Windows 10, Version 1607, creates the right environment for taking a test:
+
+- A Microsoft Edge browser window opens, showing just the test and nothing else.
+- Students aren’t able to go to other websites.
+- Students can’t open or access other apps.
+- Students can't share, print, or record their screens.
+- Students can’t copy or paste.
+- Students can’t change settings, extend their display, see notifications, get updates, or use autofill features.
+- Cortana is turned off.
+
+> **Tip!**
+> To exit **Take a Test**, press Ctrl+Alt+Delete. 
+
+**Take a Test** is included in Windows 10 Education. To add **Take a Test** to other editions of Windows 10, see [Add the Take a Test app to Windows 10](take-tests-in-windows-10.md#add-the-take-a-test-app-to-windows-10)
+
+## How you use Take a Test
+
+![Use test account or test url in Take a Test](images/take-a-test-flow.png)
+
+- **Use a test URL and a [dedicated testing account](#set-up-a-dedicated-test-account)** - A user signs in to the account and the **Take a Test** app automatically launches the pre-configured assessment URL in Microsoft Edge in a single-app, kiosk mode. A student will never have access to the desktop in this configuration. We recommend this configuration for high stakes testing.
+- **[Put a test URL with an included prefix](#provide-link-to-test) on a web page or OneNote for students to click** - This allows teachers and test administrators an easier way to deploy assessments. We recommend this method for lower stakes assessments.
+
+## Set up a dedicated test account
+
+
+    
+
+
+
+1. Sign into the device with an administrator account.
+2. Go to **Settings** > **Accounts** > **Work or school access** (final name needs to be updated, still TBD) > **Set up an account for taking tests**.
+3. Select an account to use as the dedicated testing account.
+    >**Note**: If you don't have an account on the device, you can create a new account. To do this, go to **Settings** > **Accounts** > **Other Users** > **Add someone else to this PC** > **I don’t have this person’s sign-in information** > **Add a user without a Microsoft account**.
+4. Specify an assessment URL.  
+
+5. Click **Save**.
+
+6. To take the test, the student signs in to the selected account.
+
+
+
+
+## Provide link to test
+
+Anything hosted on the web can be presented in a locked down manner, not just assessments. To lock down online content, just embed a URL with a specific prefix and devices will be locked down when users follow the link. We recommend using this method for lower stakes assessments. 
+
+1. Create a link to the test URL. Use **ms-edu-secureassessment:** before the URL and **!enforceLockdown** after the URL.
+``` 
+ms-edu-secureassessment:<URL>!enforceLockdown
+ ```
+
+2. Distribute the link. You can use the web, email, OneNote, or any other method of your choosing.
+3. To take the test, the student clicks on the link and provides user consent.
+
+
+## Related topics
+[Take tests in Windows 10](take-tests-in-windows-10.md)
+
+[Set up Take a Test on multiple PCs](take-a-test-multiple-pcs.md)
+
+[Take a Test app technical reference](take-a-test-app-technical.md)
+
+
+
+
+
+

education/windows/take-tests-in-windows-10.md

@@ -0,0 +1,68 @@
+---
+title: Take tests in Windows 10
+description: Learn how to set up and use the Take a Test app.
+keywords: ["shared cart", "shared PC", "school"]
+ms.prod: W10
+ms.mktglfcycl: plan
+ms.sitesec: library
+author: jdeckerMS
+---
+
+# Take tests in Windows 10
+**Applies to:**
+
+-   Windows 10 Insider Preview 
+
+
+> <span style="color:#ED1C24;">[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. ]</span>
+
+Many schools use online testing for formative and summative assessments. It's critical that students use a secure browser that prevents them from using other computer or Internet resources during the test. The **Take a Test** app in Windows 10, Version 1607, creates the right environment for taking a test:
+
+- A Microsoft Edge browser window opens, showing just the test and nothing else.
+- Students aren’t able to go to other websites.
+- Students can’t open or access other apps.
+- Students can't share, print, or record their screens.
+- Students can’t copy or paste.
+- Students can’t change settings, extend their display, see notifications, get updates, or use autofill features.
+- Cortana is turned off.
+
+
+**Take a Test** is included in Windows 10 Education. To add **Take a Test** to other editions of Windows 10, see [Add the Take a Test app to Windows 10](#add-the-take-a-test-app-to-windows-10)
+
+## How you use Take a Test
+
+![Use test account or test url in Take a Test](images/take-a-test-flow.png)
+
+- **Use a test URL and a dedicated testing account** - A user signs in to the account and the **Take a Test** app automatically launches the pre-configured assessment URL in Microsoft Edge in a single-app, kiosk mode. A student will never have access to the desktop in this configuration. We recommend this configuration for high stakes testing.
+- **Put a test URL with an included prefix on a web page or OneNote for students to click** - This allows teachers and test administrators an easier way to deploy assessments. We recommend this method for lower stakes assessments.
+
+[Learn how to set up Take a Test on a single PC](take-a-test-single-pc.md)
+
+[Learn how to set up Take a Test on multiple PCs](take-a-test-multiple-pcs.md)
+
+## Add the Take a Test app to Windows 10
+
+You can add the Take a Test app to Windows 10 Pro and Enterprise.
+
+### Add Take a Test on a single PC
+
+Use **Settings** to get **Take a Test** from Windows Update.
+
+1. Open **Settings**.
+2. Go to **System** > **Apps & features** > **Manage optional features** > **Add a feature**.
+3. Select **Take a Test**.
+
+### Deploy Take a Test to multiple PCs using DISM
+
+You can deploy the Take a Test package through Deployment Image Servicing and Management (DISM.exe).
+
+1. Get the Take a Test package from the [Microsoft update catalog](http://catalog.update.microsoft.com/).
+2. Upload the package to a network share or to your Windows Server Update Services (WSUS) server.
+3. Create and deploy a DISM script to add the package to offline or online images. For more information on how to add or enable features through DISM, see [DISM Operating System Package (.cab or .msu) Servicing Command-Line Options](https://msdn.microsoft.com/windows/hardware/commercialize/manufacture/desktop/dism-operating-system-package-servicing-command-line-options).
+
+## Related topics
+
+[Take a Test app technical reference](take-a-test-app-technical.md)
+
+
+

windows/keep-secure/kerberos-policy.md

@@ -2,56 +2,37 @@
 title: Kerberos Policy (Windows 10)
 description: Describes the Kerberos Policy settings and provides links to policy setting descriptions.
 ms.assetid: 94017dd9-b1a3-4624-af9f-b29161b4bf38
-ms.pagetype: security
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
+ms.pagetype: security
 author: brianlic-msft
 ---
+
 # Kerberos Policy
+
 **Applies to**
 -   Windows 10
+
 Describes the Kerberos Policy settings and provides links to policy setting descriptions.
+
 The Kerberos version 5 authentication protocol provides the default mechanism for authentication services and the authorization data necessary for a user to access a resource and perform a task on that resource. By reducing the lifetime of Kerberos tickets, you reduce the risk of a legitimate user's credentials being stolen and successfully used by an attacker. However, this also increases the authorization overhead. In most environments, these settings should not need to be changed.
+
 These policy settings are located in **\\Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Kerberos Policy**.
-The following topics provide a discussion of implementation and best practices considerations, policy location, default values for the server type or GPO, relevant differences in operating system versions, security considerations (including the possible settings vulnerabilities of each setting), countermeasures you can take, and the potential impact for each setting.
+
+The following topics provide a discussion of implementation and best practices considerations, policy location, default values for the server type or GPO, relevant differences in operating system versions, security considerations (including the possible settings vulnerabilities of each setting), 
+countermeasures you can take, and the potential impact for each setting.
+
 ## In this section
-<table>
-<colgroup>
-<col width="50%" />
-<col width="50%" />
-</colgroup>
-<thead>
-<tr class="header">
-<th align="left">Topic</th>
-<th align="left">Description</th>
-</tr>
-</thead>
-<tbody>
-<tr class="odd">
-<td align="left"><p>[Enforce user logon restrictions](enforce-user-logon-restrictions.md)</p></td>
-<td align="left"><p>Describes the best practices, location, values, policy management, and security considerations for the <strong>Enforce user logon restrictions</strong> security policy setting.</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>[Maximum lifetime for service ticket](maximum-lifetime-for-service-ticket.md)</p></td>
-<td align="left"><p>Describes the best practices, location, values, policy management, and security considerations for the <strong>Maximum lifetime for service ticket</strong> security policy setting.</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>[Maximum lifetime for user ticket](maximum-lifetime-for-user-ticket.md)</p></td>
-<td align="left"><p>Describes the best practices, location, values, policy management, and security considerations for the <strong>Maximum lifetime for user ticket</strong> policy setting.</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>[Maximum lifetime for user ticket renewal](maximum-lifetime-for-user-ticket-renewal.md)</p></td>
-<td align="left"><p>Describes the best practices, location, values, policy management, and security considerations for the <strong>Maximum lifetime for user ticket renewal</strong> security policy setting.</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>[Maximum tolerance for computer clock synchronization](maximum-tolerance-for-computer-clock-synchronization.md)</p></td>
-<td align="left"><p>Describes the best practices, location, values, policy management, and security considerations for the <strong>Maximum tolerance for computer clock synchronization</strong> security policy setting.</p></td>
-</tr>
-</tbody>
-</table>
+
+| Topic | Description |
+| - | - |
+| [Enforce user logon restrictions](enforce-user-logon-restrictions.md) | Describes the best practices, location, values, policy management, and security considerations for the **Enforce user logon restrictions** security policy setting.| 
+| [Maximum lifetime for service ticket](maximum-lifetime-for-service-ticket.md) | Describes the best practices, location, values, policy management, and security considerations for the **Maximum lifetime for service ticket** security policy setting.| 
+| [Maximum lifetime for user ticket](maximum-lifetime-for-user-ticket.md) | Describes the best practices, location, values, policy management, and security considerations for the **Maximum lifetime for user ticket** policy setting.| 
+| [Maximum lifetime for user ticket renewal](maximum-lifetime-for-user-ticket-renewal.md) | Describes the best practices, location, values, policy management, and security considerations for the **Maximum lifetime for user ticket renewal** security policy setting.| 
+| [Maximum tolerance for computer clock synchronization](maximum-tolerance-for-computer-clock-synchronization.md) | Describes the best practices, location, values, policy management, and security considerations for the **Maximum tolerance for computer clock synchronization** security| policy setting. 
  
 ## Related topics
-[Configure security policy settings](how-to-configure-security-policy-settings.md)
- 
- 
+
+- [Configure security policy settings](how-to-configure-security-policy-settings.md)

windows/keep-secure/load-and-unload-device-drivers.md

@@ -2,96 +2,95 @@
 title: Load and unload device drivers (Windows 10)
 description: Describes the best practices, location, values, policy management, and security considerations for the Load and unload device drivers security policy setting.
 ms.assetid: 66262532-c610-470c-9792-35ff4389430f
-ms.pagetype: security
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
+ms.pagetype: security
 author: brianlic-msft
 ---
+
 # Load and unload device drivers
+
 **Applies to**
 -   Windows 10
+
 Describes the best practices, location, values, policy management, and security considerations for the **Load and unload device drivers** security policy setting.
+
 ## Reference
+
 This policy setting determines which users can dynamically load and unload device drivers. This user right is not required if a signed driver for the new hardware already exists in the driver.cab file on the device. Device drivers run as highly privileged code.
 Windows supports the Plug and Play specifications that define how a computer can detect and configure newly added hardware, and then automatically install the device driver. Prior to Plug and Play, users needed to manually configure devices before attaching them to the device. This model allows a user to plug in the hardware, then Windows searches for an appropriate device driver package and automatically configures it to work without interfering with other devices.
+
 Because device driver software runs as if it is a part of the operating system with unrestricted access to the entire computer, it is critical that only known and authorized device drivers be permitted.
+
 Constant: SeLoadDriverPrivilege
+
 ### Possible values
+
 -   User-defined list of accounts
 -   Default values
 -   Not Defined
+
 ### Best practices
+
 -   Because of the potential security risk, do not assign this user right to any user, group, or process that you do not want to take over the system.
+
 ### Location
+
 Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment
+
 ### Default values
+
 By default this setting is Administrators and Print Operators on domain controllers and Administrators on stand-alone servers.
+
 The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page.
-<table>
-<colgroup>
-<col width="50%" />
-<col width="50%" />
-</colgroup>
-<thead>
-<tr class="header">
-<th align="left">Server type or GPO</th>
-<th align="left">Default value</th>
-</tr>
-</thead>
-<tbody>
-<tr class="odd">
-<td align="left"><p>Default Domain Policy</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Default Domain Controller Policy</p></td>
-<td align="left"><p>Administrators</p>
-<p>Print Operators</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Stand-Alone Server Default Settings</p></td>
-<td align="left"><p>Administrators</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Domain Controller Effective Default Settings</p></td>
-<td align="left"><p>Administrators</p>
-<p>Print Operators</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Member Server Effective Default Settings</p></td>
-<td align="left"><p>Administrators</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Client Computer Effective Default Settings</p></td>
-<td align="left"><p>Administrators</p></td>
-</tr>
-</tbody>
-</table>
+
+| Server type or GPO | Default value |
+| - | - |
+| Default Domain Policy| Not defined| 
+| Default Domain Controller Policy | Administrators<br/>Print Operators| 
+| Stand-Alone Server Default Settings | Administrators| 
+| Domain Controller Effective Default Settings | Administrators<br/>Print Operators |
+| Member Server Effective Default Settings | Administrators| 
+| Client Computer Effective Default Settings | Administrators| 
  
 ## Policy management
+
 This section describes features, tools, and guidance to help you manage this policy.
+
 A restart of the device is not required for this policy setting to be effective.
+
 Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on.
+
 ### Group Policy
+
 Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update:
+
 1.  Local policy settings
 2.  Site policy settings
 3.  Domain policy settings
 4.  OU policy settings
+
 When a local setting is greyed out, it indicates that a GPO currently controls that setting.
+
 ## Security considerations
+
 This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation.
+
 ### Vulnerability
+
 Device drivers run as highly privileged code. A user who has the **Load and unload device drivers** user right could unintentionally install malware that masquerades as a device driver. Administrators should exercise care and install only drivers with verified digital signatures.
-**Note**  
-You must have this user right or be a member of the local Administrators group to install a new driver for a local printer or to manage a local printer and configure defaults for options such as duplex printing.
+
+>**Note:**  You must have this user right or be a member of the local Administrators group to install a new driver for a local printer or to manage a local printer and configure defaults for options such as duplex printing.
  
 ### Countermeasure
+
 Do not assign the **Load and unload device drivers** user right to any user or group other than Administrators on member servers. On domain controllers, do not assign this user right to any user or group other than Domain Admins.
+
 ### Potential impact
+
 If you remove the **Load and unload device drivers** user right from the Print Operators group or other accounts, you could limit the abilities of users who are assigned to specific administrative roles in your environment. You should ensure that delegated tasks are not negatively affected.
+
 ## Related topics
-[User Rights Assignment](user-rights-assignment.md)
- 
- 
+
+- [User Rights Assignment](user-rights-assignment.md)

windows/keep-secure/lock-pages-in-memory.md

@@ -2,92 +2,93 @@
 title: Lock pages in memory (Windows 10)
 description: Describes the best practices, location, values, policy management, and security considerations for the Lock pages in memory security policy setting.
 ms.assetid: cc724979-aec0-496d-be4e-7009aef660a3
-ms.pagetype: security
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
+ms.pagetype: security
 author: brianlic-msft
 ---
+
 # Lock pages in memory
+
 **Applies to**
 -   Windows 10
+
 Describes the best practices, location, values, policy management, and security considerations for the **Lock pages in memory** security policy setting.
+
 ## Reference
+
 This policy setting determines which accounts can use a process to keep data in physical memory, which prevents the computer from paging the data to virtual memory on a disk.
+
 Normally, an application running on Windows can negotiate for more physical memory, and in response to the request, the application begins to move the data from RAM (such as the data cache) to a disk. When the pageable memory is moved to a disk, more RAM is free for the operating system to use.
+
 Enabling this policy setting for a specific account (a user account or a process account for an application) prevents paging of the data. Thereby, the amount of memory that Windows can reclaim under pressure is limited. This could lead to performance degradation.
-**Note**  
-By configuring this policy setting, the performance of the Windows operating system will differ depending on if applications are running on 32-bit or 64-bit systems, and if they are virtualized images. Performance will also differ between earlier and later versions of the Windows operating system.
+
+>**Note:**  By configuring this policy setting, the performance of the Windows operating system will differ depending on if applications are running on 32-bit or 64-bit systems, and if they are virtualized images. Performance will also differ between earlier and later versions of the Windows operating system.
  
 Constant: SeLockMemoryPrivilege
+
 ### Possible values
+
 -   User-defined list of accounts
 -   Not defined
+
 ### Best practices
+
 Best practices are dependent on the platform architecture and the applications running on those platforms.
+
 ### Location
+
 Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment
+
 ### Default values
+
 The following table lists the actual and effective default policy values for the most recent supported versions of Windows. Default values are also listed on the policy’s property page.
-<table>
-<colgroup>
-<col width="50%" />
-<col width="50%" />
-</colgroup>
-<thead>
-<tr class="header">
-<th align="left">Server type or GPO</th>
-<th align="left">Default value</th>
-</tr>
-</thead>
-<tbody>
-<tr class="odd">
-<td align="left"><p>Default Domain Policy</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Default Domain Controller Policy</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Stand-Alone Server Default Settings</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Domain Controller Effective Default Settings</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Member Server Effective Default Settings</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Client Computer Effective Default Settings</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-</tbody>
-</table>
+
+| Server type or GPO | Default value |
+| - | - |
+| Default Domain Policy | Not defined| 
+| Default Domain Controller Policy | Not defined| 
+| Stand-Alone Server Default Settings | Not defined| 
+| Domain Controller Effective Default Settings | Not defined| 
+| Member Server Effective Default Settings | Not defined| 
+| Client Computer Effective Default Settings | Not defined| 
  
 ## Policy management
+
 This section describes features, tools, and guidance to help you manage this policy.
+
 A restart of the computer is not required for this policy setting to be effective.
+
 Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on.
+
 ### Group Policy
+
 Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update:
+
 1.  Local policy settings
 2.  Site policy settings
 3.  Domain policy settings
 4.  OU policy settings
+
 When a local setting is greyed out, it indicates that a GPO currently controls that setting.
+
 ## Security considerations
+
 This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation.
+
 ### Vulnerability
+
 Users with the **Lock pages in memory** user right could assign physical memory to several processes, which could leave little or no RAM for other processes and result in a denial-of-service condition.
+
 ### Countermeasure
+
 Do not assign the **Lock pages in memory** user right to any accounts.
+
 ### Potential impact
+
 None. Not defined is the default configuration.
+
 ## Related topics
-[User Rights Assignment](user-rights-assignment.md)
- 
- 
+
+- [User Rights Assignment](user-rights-assignment.md)

windows/keep-secure/log-on-as-a-batch-job.md

@@ -2,98 +2,92 @@
 title: Log on as a batch job (Windows 10)
 description: Describes the best practices, location, values, policy management, and security considerations for the Log on as a batch job security policy setting.
 ms.assetid: 4eaddb51-0a18-470e-9d3d-5e7cd7970b41
-ms.pagetype: security
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
+ms.pagetype: security
 author: brianlic-msft
 ---
+
 # Log on as a batch job
+
 **Applies to**
 -   Windows 10
+
 Describes the best practices, location, values, policy management, and security considerations for the **Log on as a batch job** security policy setting.
+
 ## Reference
+
 This policy setting determines which accounts can log on by using a batch-queue tool such as the Task Scheduler service. When you use the Add Scheduled Task Wizard to schedule a task to run under a particular user name and password, that user is automatically assigned the **Log on as a batch job** user right. When the scheduled time arrives, the Task Scheduler service logs on the user as a batch job instead of as an interactive user, and the task runs in the user's security context.
+
 Constant: SeBatchLogonRight
+
 ### Possible values
+
 -   User-defined list of accounts
 -   Default values
 -   Not Defined
+
 ### Best practices
+
 -   Use discretion when assigning this right to specific users for security reasons. The default settings are sufficient in most cases.
+
 ### Location
+
 Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment
+
 ### Default values
+
 By default, this setting is for Administrators, Backup Operators, and Performance Log Users on domain controllers and on stand-alone servers.
+
 The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page.
-<table>
-<colgroup>
-<col width="50%" />
-<col width="50%" />
-</colgroup>
-<thead>
-<tr class="header">
-<th align="left">Server type or GPO</th>
-<th align="left">Default value</th>
-</tr>
-</thead>
-<tbody>
-<tr class="odd">
-<td align="left"><p>Default Domain Policy</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Default Domain Controller Policy</p></td>
-<td align="left"><p>Administrators</p>
-<p>Backup Operators</p>
-<p>Performance Log Users</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Stand-Alone Server Default Settings</p></td>
-<td align="left"><p>Administrators</p>
-<p>Backup Operators</p>
-<p>Performance Log Users</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Domain Controller Effective Default Settings</p></td>
-<td align="left"><p>Administrators</p>
-<p>Backup Operators</p>
-<p>Performance Log Users</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Member Server Effective Default Settings</p></td>
-<td align="left"><p>Administrators</p>
-<p>Backup Operators</p>
-<p>Performance Log Users</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Client Computer Effective Default Settings</p></td>
-<td align="left"><p>Administrators</p></td>
-</tr>
-</tbody>
-</table>
+
+| Server type or GPO | Default value |
+| - | - |
+| Default Domain Policy| Not defined| 
+| Default Domain Controller Policy | Administrators<br/>Backup Operators<br/>Performance Log Users| 
+| Stand-Alone Server Default Settings | Administrators<br/>Backup Operators<br/>Performance Log Users| 
+| Domain Controller Effective Default Settings | Administrators<br/>Backup Operators<br/>Performance Log Users| 
+| Member Server Effective Default Settings | Administrators<br/>Backup Operators<br/>Performance Log Users| 
+| Client Computer Effective Default Settings | Administrators| 
  
 ## Policy management
+
 This section describes features, tools, and guidance to help you manage this policy.
+
 A restart of the computer is not required for this policy setting to be effective.
+
 Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on.
+
 ### Group Policy
+
 Task Scheduler automatically grants this right when a user schedules a task. To override this behavior use the [Deny log on as a batch job](deny-log-on-as-a-batch-job.md) User Rights Assignment setting.
+
 Group Policy settings are applied in the following order, which will overwrite settings on the local computer at the next Group Policy update:
+
 1.  Local policy settings
 2.  Site policy settings
 3.  Domain policy settings
 4.  OU policy settings
+
 ## Security considerations
+
 This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation.
+
 ### Vulnerability
+
 The **Log on as a batch job** user right presents a low-risk vulnerability. For most organizations, the default settings are sufficient. Members of the local Administrators group have this right by default.
+
 ### Countermeasure
+
 You should allow the computer to manage this user right automatically if you want to allow scheduled tasks to run for specific user accounts. If you do not want to use the Task Scheduler in this manner, configure the **Log on as a batch job** user right for only the Local Service account.
+
 For IIS servers, you should configure this policy locally instead of through domain–based Group Policy settings so that you can ensure the local IUSR\_*&lt;ComputerName&gt;* and IWAM\_*&lt;ComputerName&gt;* accounts have this user right.
+
 ### Potential impact
+
 If you configure the **Log on as a batch job** setting by using domain-based Group Policy settings, the computer cannot assign the user right to accounts that are used for scheduled jobs in the Task Scheduler. If you install optional components such as ASP.NET or IIS, you may need to assign this user right to additional accounts that are required by those components. For example, IIS requires assignment of this user right to the IIS\_WPG group and the IUSR\_*&lt;ComputerName&gt;*, ASPNET, and IWAM\_*&lt;ComputerName&gt;* accounts. If this user right is not assigned to this group and these accounts, IIS cannot run some COM objects that are necessary for proper functionality.
+
 ## Related topics
-[User Rights Assignment](user-rights-assignment.md)
- 
- 
+
+- [User Rights Assignment](user-rights-assignment.md)

windows/keep-secure/log-on-as-a-service.md

@@ -2,88 +2,91 @@
 title: Log on as a service (Windows 10)
 description: Describes the best practices, location, values, policy management, and security considerations for the Log on as a service security policy setting.
 ms.assetid: acc9a9e0-fd88-4cda-ab54-503120ba1f42
-ms.pagetype: security
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
+ms.pagetype: security
 author: brianlic-msft
 ---
+
 # Log on as a service
+
 **Applies to**
 -   Windows 10
+
 Describes the best practices, location, values, policy management, and security considerations for the **Log on as a service** security policy setting.
+
 ## Reference
+
 This policy setting determines which service accounts can register a process as a service. Running a process under a service account circumvents the need for human intervention.
+
 Constant: SeServiceLogonRight
+
 ### Possible values
+
 -   User-defined list of accounts
 -   Not Defined
+
 ### Best practices
+
 -   Minimize the number of accounts that are granted this user right.
+
 ### Location
+
 Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment
+
 ### Default values
+
 By default this setting is Network Service on domain controllers and Network Service on stand-alone servers.
+
 The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page.
-<table>
-<colgroup>
-<col width="50%" />
-<col width="50%" />
-</colgroup>
-<thead>
-<tr class="header">
-<th align="left">Server type or GPO</th>
-<th align="left">Default value</th>
-</tr>
-</thead>
-<tbody>
-<tr class="odd">
-<td align="left"><p>Default Domain Policy</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Default Domain Controller Policy</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Stand-Alone Server Default Settings</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Domain Controller Effective Default Settings</p></td>
-<td align="left"><p>Network Service</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Member Server Effective Default Settings</p></td>
-<td align="left"><p>Network Service</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Client Computer Effective Default Settings</p></td>
-<td align="left"><p>Network Service</p></td>
-</tr>
-</tbody>
-</table>
+
+| Server type or GPO | Default value |
+| - | - |
+| Default Domain Policy| Not defined| 
+| Default Domain Controller Policy | Not defined| 
+| Stand-Alone Server Default Settings | Not defined| 
+| Domain Controller Effective Default Settings | Network Service| 
+| Member Server Effective Default Settings| Network Service| 
+| Client Computer Effective Default Settings | Network Service| 
  
 ## Policy management
+
 This section describes features, tools, and guidance to help you manage this policy.
+
 A restart of the computer is not required for this policy setting to be effective.
+
 Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on.
+
 ### Group Policy
+
 The policy setting **Deny logon as a service** supersedes this policy setting if a user account is subject to both policies.
+
 Group Policy settings are applied in the following order, which will overwrite settings on the local device at the next Group Policy update:
+
 1.  Local policy settings
 2.  Site policy settings
 3.  Domain policy settings
 4.  OU policy settings
+
 ## Security considerations
+
 This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation.
+
 ### Vulnerability
-The **Log on as a service** user right allows accounts to start network services or services that run continuously on a computer, even when no one is logged on to the console. The risk is reduced by the fact that only users with administrative privileges can install and configure services. An attacker who has already attained that level of access could configure the service to run with the Local System account.
+
+The **Log on as a service** user right allows accounts to start network services or services that run continuously on a computer, even when no one is logged on to the console. The risk is reduced by the fact that only users with administrative privileges can install and configure services. An 
+attacker who has already attained that level of access could configure the service to run with the Local System account.
+
 ### Countermeasure
+
 By definition, the Network Service account has the **Log on as a service** user right. This right is not granted through the Group Policy setting. You should minimize the number of other accounts that are granted this user right.
+
 ### Potential impact
-On most computers, restricting the **Log on as a service** user right to the Local System, Local Service, and Network Service built-in accounts is the default configuration, and there is no negative impact. However, if you have installed optional components such as ASP.NET or IIS, you may need to assign the **Log on as a service** user right to additional accounts that are required by those components. IIS requires that this user right be explicitly granted to the ASPNET user account.
+
+On most computers, restricting the **Log on as a service** user right to the Local System, Local Service, and Network Service built-in accounts is the default configuration, and there is no negative impact. However, if you have installed optional components such as ASP.NET or IIS, you may need to 
+assign the **Log on as a service** user right to additional accounts that are required by those components. IIS requires that this user right be explicitly granted to the ASPNET user account.
+
 ## Related topics
-[User Rights Assignment](user-rights-assignment.md)
- 
- 
+
+- [User Rights Assignment](user-rights-assignment.md)

windows/keep-secure/maintain-applocker-policies.md

@@ -2,64 +2,100 @@
 title: Maintain AppLocker policies (Windows 10)
 description: This topic describes how to maintain rules within AppLocker policies.
 ms.assetid: b4fbfdfe-ef3d-49e0-a390-f2dfe74602bc
-ms.pagetype: security
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
+ms.pagetype: security
 author: brianlic-msft
 ---
+
 # Maintain AppLocker policies
+
 **Applies to**
 -   Windows 10
+
 This topic describes how to maintain rules within AppLocker policies.
+
 Common AppLocker maintenance scenarios include:
+
 -   A new app is deployed, and you need to update an AppLocker policy.
 -   A new version of an app is deployed, and you need to either update an AppLocker policy or create a new rule to update the policy.
 -   An app is no longer supported by your organization, so you need to prevent it from being used.
 -   An app appears to be blocked but should be allowed.
 -   An app appears to be allowed but should be blocked.
 -   A single user or small subset of users needs to use a specific app that is blocked.
+
 There are two methods you can use to maintain AppLocker policies:
+
 -   [Maintaining AppLocker policies by using Group Policy](#bkmk-applkr-use-gp)
 -   [Maintaining AppLocker policies on the local computer](#bkmk-applkr-use-locsnapin)
+
 As new apps are deployed or existing apps are removed by your organization or updated by the software publisher, you might need to make revisions to your rules and update the Group Policy Object (GPO) to ensure that your policy is current.
-You can edit an AppLocker policy by adding, changing, or removing rules. However, you cannot specify a version for the AppLocker policy by importing additional rules. To ensure version control when modifying an AppLocker policy, use Group Policy management software that allows you to create versions of GPOs.
-**Caution**  
-You should not edit an AppLocker rule collection while it is being enforced in Group Policy. Because AppLocker controls what files are allowed to run, making changes to a live policy can create unexpected behavior.
+
+You can edit an AppLocker policy by adding, changing, or removing rules. However, you cannot specify a version for the AppLocker policy by importing additional rules. To ensure version control when modifying an AppLocker policy, use Group Policy management software that allows you to create 
+versions of GPOs.
+
+>**Caution:**  You should not edit an AppLocker rule collection while it is being enforced in Group Policy. Because AppLocker controls what files are allowed to run, making changes to a live policy can create unexpected behavior.
  
 ## <a href="" id="bkmk-applkr-use-gp"></a>Maintaining AppLocker policies by using Group Policy
+
 For every scenario, the steps to maintain an AppLocker policy distributed by Group Policy include the following tasks.
+
 ### Step 1: Understand the current behavior of the policy
+
 Before modifying a policy, evaluate how the policy is currently implemented. For example, if a new version of the application is deployed, you can use **Test-AppLockerPolicy** to verify the effectiveness of your current policy for that app.
+
 ### Step 2: Export the AppLocker policy from the GPO
+
 Updating an AppLocker policy that is currently enforced in your production environment can have unintended results. Therefore, export the policy from the GPO and update the rule or rules by using AppLocker on your AppLocker reference or test computer. To prepare an AppLocker policy for modification, see [Export an AppLocker policy from a GPO](export-an-applocker-policy-from-a-gpo.md)
+
 ### Step 3: Update the AppLocker policy by editing the appropriate AppLocker rule
+
 After the AppLocker policy has been exported from the GPO into the AppLocker reference or test computer, or has been accessed on the local computer, the specific rules can be modified as required.
+
 To modify AppLocker rules, see the following:
+
 -   [Edit AppLocker rules](edit-applocker-rules.md)
 -   [Merge AppLocker policies by using Set-ApplockerPolicy](merge-applocker-policies-by-using-set-applockerpolicy.md) or [Merge AppLocker policies manually](merge-applocker-policies-manually.md)
 -   [Delete an AppLocker rule](delete-an-applocker-rule.md)
 -   [Enforce AppLocker rules](enforce-applocker-rules.md)
+
 ### Step 4: Test the AppLocker policy
+
 You should test each collection of rules to ensure that the rules perform as intended. (Because AppLocker rules are inherited from linked GPOs, you should deploy all rules for simultaneous testing in all test GPOs.) For steps to perform this testing, see [Test and update an AppLocker policy](test-and-update-an-applocker-policy.md).
+
 ### Step 5: Import the AppLocker policy into the GPO
+
 After testing, import the AppLocker policy back into the GPO for implementation. To update the GPO with a modified AppLocker policy, see [Import an AppLocker policy into a GPO](import-an-applocker-policy-into-a-gpo.md).
+
 ### Step 6: Monitor the resulting policy behavior
 After deploying a policy, evaluate the policy's effectiveness.
+
 ## <a href="" id="bkmk-applkr-use-locsnapin"></a>Maintaining AppLocker policies by using the Local Security Policy snap-in
 For every scenario, the steps to maintain an AppLocker policy by using the Local Group Policy Editor or the Local Security Policy snap-in include the following tasks.
+
 ### Step 1: Understand the current behavior of the policy
+
 Before modifying a policy, evaluate how the policy is currently implemented.
+
 ### Step 2: Update the AppLocker policy by modifying the appropriate AppLocker rule
+
 Rules are grouped into a collection, which can have the policy enforcement setting applied to it. By default, AppLocker rules do not allow users to open or run any files that are not specifically allowed.
+
 To modify AppLocker rules, see the appropriate topic listed on [Administer AppLocker](administer-applocker.md).
+
 ### Step 3: Test the AppLocker policy
+
 You should test each collection of rules to ensure that the rules perform as intended. For steps to perform this testing, see [Test and update an AppLocker policy](test-and-update-an-applocker-policy.md).
+
 ### Step 4: Deploy the policy with the modified rule
+
 You can export and then import AppLocker policies to deploy the policy to other computers running Windows 8 or later. To perform this task, see [Export an AppLocker policy to an XML file](export-an-applocker-policy-to-an-xml-file.md) and [Import an AppLocker policy from another computer](import-an-applocker-policy-from-another-computer.md).
+
 ### Step 5: Monitor the resulting policy behavior
+
 After deploying a policy, evaluate the policy's effectiveness.
+
 ## Additional resources
+
 -   For steps to perform other AppLocker policy tasks, see [Administer AppLocker](administer-applocker.md).
- 
- 

windows/keep-secure/manage-auditing-and-security-log.md

@@ -2,95 +2,97 @@
 title: Manage auditing and security log (Windows 10)
 description: Describes the best practices, location, values, policy management, and security considerations for the Manage auditing and security log security policy setting.
 ms.assetid: 4b946c0d-f904-43db-b2d5-7f0917575347
-ms.pagetype: security
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
+ms.pagetype: security
 author: brianlic-msft
 ---
+
 # Manage auditing and security log
+
 **Applies to**
 -   Windows 10
+
 Describes the best practices, location, values, policy management, and security considerations for the **Manage auditing and security log** security policy setting.
+
 ## Reference
-This policy setting determines which users can specify object access audit options for individual resources such as files, Active Directory objects, and registry keys. These objects specify their system access control lists (SACL). A user who is assigned this user right can also view and clear the Security log in Event Viewer. For more info about the Object Access audit policy, see [Audit object access](basic-audit-object-access.md).
+
+This policy setting determines which users can specify object access audit options for individual resources such as files, Active Directory objects, and registry keys. These objects specify their system access control lists (SACL). A user who is assigned this user right can also view and clear the 
+Security log in Event Viewer. For more info about the Object Access audit policy, see [Audit object access](basic-audit-object-access.md).
+
 Constant: SeSecurityPrivilege
+
 ### Possible values
 -   User-defined list of accounts
 -   Administrators
 -   Not Defined
+
 ### Best practices
+
 1.  Before removing this right from a group, investigate whether applications are dependent on this right.
 2.  Generally, assigning this user right to groups other than Administrators is not necessary.
+
 ### Location
+
 Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment
+
 ### Default values
+
 By default this setting is Administrators on domain controllers and on stand-alone servers.
+
 The following table lists the actual and effective default policy values for the most recent supported versions of Windows. Default values are also listed on the policy’s property page.
-<table>
-<colgroup>
-<col width="50%" />
-<col width="50%" />
-</colgroup>
-<thead>
-<tr class="header">
-<th align="left">Server type or GPO</th>
-<th align="left">Default value</th>
-</tr>
-</thead>
-<tbody>
-<tr class="odd">
-<td align="left"><p>Default Domain Policy</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Default Domain Controller Policy</p></td>
-<td align="left"><p>Administrators</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Stand-Alone Server Default Settings</p></td>
-<td align="left"><p>Administrators</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Domain Controller Effective Default Settings</p></td>
-<td align="left"><p>Administrators</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Member Server Effective Default Settings</p></td>
-<td align="left"><p>Administrators</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Client Computer Effective Default Settings</p></td>
-<td align="left"><p>Administrators</p></td>
-</tr>
-</tbody>
-</table>
+
+| Server type or GPO | Default value |
+| - | - |
+| Default Domain Policy| Not defined| 
+| Default Domain Controller Policy | Administrators| 
+| Stand-Alone Server Default Settings | Administrators| 
+| Domain Controller Effective Default Settings | Administrators| 
+| Member Server Effective Default Settings | Administrators| 
+| Client Computer Effective Default Settings| Administrators| 
  
 ## Policy management
+
 This section describes features, tools, and guidance to help you manage this policy.
+
 A restart of the computer is not required for this policy setting to be effective.
+
 Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on.
+
 Audits for object access are not performed unless you enable them by using the Local Group Policy Editor, the Group Policy Management Console (GPMC), or the Auditpol command-line tool.
+
 For more information about the Object Access audit policy, see [Audit object access](basic-audit-object-access.md).
+
 ### Group Policy
+
 Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update:
+
 1.  Local policy settings
 2.  Site policy settings
 3.  Domain policy settings
 4.  OU policy settings
+
 When a local setting is greyed out, it indicates that a GPO currently controls that setting.
+
 ## Security considerations
+
 This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation.
+
 ### Vulnerability
+
 Anyone with the **Manage auditing and security log** user right can clear the Security log to erase important evidence of unauthorized activity.
+
 ### Countermeasure
+
 Ensure that only the local Administrators group has the **Manage auditing and security log** user right.
+
 ### Potential impact
+
 Restricting the **Manage auditing and security log** user right to the local Administrators group is the default configuration.
-**Warning**  
-If groups other than the local Administrators group have been assigned this user right, removing this user right might cause performance issues with other applications. Before removing this right from a group, investigate whether applications are dependent on this right.
+
+>**Warning:**  If groups other than the local Administrators group have been assigned this user right, removing this user right might cause performance issues with other applications. Before removing this right from a group, investigate whether applications are dependent on this right.
  
 ## Related topics
-[User Rights Assignment](user-rights-assignment.md)
- 
- 
+
+- [User Rights Assignment](user-rights-assignment.md)

windows/keep-secure/manage-packaged-apps-with-applocker.md

@@ -2,47 +2,71 @@
 title: Manage packaged apps with AppLocker (Windows 10)
 description: This topic for IT professionals describes concepts and lists procedures to help you manage Packaged apps with AppLocker as part of your overall application control strategy.
 ms.assetid: 6d0c99e7-0284-4547-a30a-0685a9916650
-ms.pagetype: security
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
+ms.pagetype: security
 author: brianlic-msft
 ---
+
 # Manage packaged apps with AppLocker
+
 **Applies to**
 -   Windows 10
+
 This topic for IT professionals describes concepts and lists procedures to help you manage Packaged apps with AppLocker as part of your overall application control strategy.
+
 ## Understanding Packaged apps and Packaged app installers for AppLocker
-Packaged apps, also known as Universal Windows apps, are based on a model that ensures all the files within an app package share the same identity. With classic Windows apps, each file within the app could have a unique identity. With packaged apps, it is possible to control the entire app by using a single AppLocker rule.
-**Note**  
-AppLocker supports only publisher rules for packaged apps. All packaged apps must be signed by the software publisher because Windows does not support unsigned packaged apps.
+
+Packaged apps, also known as Universal Windows apps, are based on a model that ensures all the files within an app package share the same identity. With classic Windows apps, each file within the app could have a unique identity. 
+With packaged apps, it is possible to control the entire app by using a single AppLocker rule.
+
+>**Note:**  AppLocker supports only publisher rules for packaged apps. All packaged apps must be signed by the software publisher because Windows does not support unsigned packaged apps.
  
 Typically, an app consists of multiple components: the installer that is used to install the app, and one or more exes, dlls, or scripts. With classic Windows apps, not all these components always share common attributes such as the software’s publisher name, product name, and product version. Therefore, AppLocker controls each of these components separately through different rule collections, such as exe, dll, script, and Windows Installer rules. In contrast, all the components of a packaged app share the same publisher name, package name, and package version attributes. Therefore, you can control an entire app with a single rule.
+
 ### <a href="" id="bkmk-compareclassicmetro"></a>Comparing classic Windows apps and packaged apps
-AppLocker policies for packaged apps can only be applied to apps installed on computers running at least Windows Server 2012 or Windows 8, but classic Windows apps can be controlled on devices running at least Windows Server 2008 R2 or Windows 7. The rules for classic Windows apps and packaged apps can be enforced in tandem. The differences between packaged apps and classic Windows apps that you should consider include:
+
+AppLocker policies for packaged apps can only be applied to apps installed on computers running at least Windows Server 2012 or Windows 8, but classic Windows apps can be controlled on devices running at least Windows Server 
+2008 R2 or Windows 7. The rules for classic Windows apps and packaged apps can be enforced in tandem. The differences between packaged apps and classic Windows apps that you should consider include:
+
 -   **Installing the apps**   All packaged apps can be installed by a standard user, whereas a number of classic Windows apps require administrative privileges to install. In an environment where most of the users are standard users, you might not have numerous exe rules (because classic Windows apps require administrative privileges to install), but you might want to have more explicit policies for packaged apps.
 -   **Changing the system state**   Classic Windows apps can be written to change the system state if they are run with administrative privileges. Most packaged apps cannot change the system state because they run with limited privileges. When you design your AppLocker policies, it is important to understand whether an app that you are allowing can make system-wide changes.
 -   **Acquiring the apps**   Packaged apps can be acquired through the Store, or by loading using Windows PowerShell cmdlets (which requires a special enterprise license). Classic Windows apps can be acquired through traditional means.
+
 AppLocker uses different rule collections to control packaged apps and classic Windows apps. You have the choice to control one type, the other type, or both.
+
 For info about controlling classic Windows apps, see [Administer AppLocker](administer-applocker.md).
+
 For more info about packaged apps, see [Packaged apps and packaged app installer rules in AppLocker](packaged-apps-and-packaged-app-installer-rules-in-applocker.md).
+
 ## Design and deployment decisions
+
 You can use two methods to create an inventory of packaged apps on a computer: the AppLocker console or the **Get-AppxPackage** Windows PowerShell cmdlet.
-**Note**  
-Not all packaged apps are listed in AppLocker’s application inventory wizard. Certain app packages are framework packages that are leveraged by other apps. By themselves, these packages cannot do anything, but blocking such packages can inadvertently cause failure for apps that you want to allow. Instead, you can create Allow or Deny rules for the packaged apps that use these framework packages. The AppLocker user interface deliberately filters out all the packages that are registered as framework packages. For info about how to create an inventory list, see [Create list of apps deployed to each business group](create-list-of-applications-deployed-to-each-business-group.md).
+
+>**Note:**  Not all packaged apps are listed in AppLocker’s application inventory wizard. Certain app packages are framework packages that are leveraged by other apps. By themselves, these packages cannot do anything, but blocking such packages can inadvertently cause failure for apps that you want to allow. Instead, you can create Allow or Deny rules for the packaged apps that use these framework packages. The AppLocker user interface deliberately filters out all the packages that are registered as framework packages. For info about how to create an inventory list, see [Create list of apps deployed to each business group](create-list-of-applications-deployed-to-each-business-group.md).
  
 For info about how to use the **Get-AppxPackage** Windows PowerShell cmdlet, see the [AppLocker PowerShell Command Reference](http://technet.microsoft.com/library/hh847210.aspx).
+
 For info about creating rules for Packaged apps, see [Create a rule for packaged apps](create-a-rule-for-packaged-apps.md).
+
 Consider the following info when you are designing and deploying apps:
+
 -   Because AppLocker supports only publisher rules for packaged apps, collecting the installation path information for packaged apps is not necessary.
 -   You cannot create hash- or path-based rules for packaged apps because all packaged apps and packaged app installers are signed by the software publisher of the package. Classic Windows apps were not always consistently signed; therefore, AppLocker has to support hash- or path-based rules.
--   By default, if there are no rules in a particular rule collection, AppLocker allows every file that is included in that rule collection. For example, if there are no Windows Installer rules, AppLocker allows all .msi, .msp, and .mst files to run. An existing AppLocker policy that was targeted at computers running Windows Server 2008 R2 and Windows 7 would not have rules for Packaged apps. Therefore, when a computer running at least Windows Server 2012 or Windows 8 joins a domain where an AppLocker policy is already configured, users would be allowed to run any packaged app. This might be contrary to your design.
+-   By default, if there are no rules in a particular rule collection, AppLocker allows every file that is included in that rule collection. For example, if there are no Windows Installer rules, AppLocker allows all .msi, .msp, and .mst files to run. An existing AppLocker policy that was targeted at computers running Windows Server 2008 R2 and Windows 7 would not have rules for Packaged apps. Therefore, when a computer running at least Windows Server 2012 or 
+Windows 8 joins a domain where an AppLocker policy is already configured, users would be allowed to run any packaged app. This might be contrary to your design.
+
     To prevent all packaged apps from running on a newly domain-joined computer, by default AppLocker blocks all packaged apps on a computer running at least Windows Server 2012 or Windows 8 if the existing domain policy has rules configured in the exe rule collection. You must take explicit action to allow packaged apps in your enterprise. You can allow only a select set of packaged apps. Or if you want to allow all packaged apps, you can create a default rule for the packaged apps collection.
+
 ## Using AppLocker to manage packaged apps
+
 Just as there are differences in managing each rule collection, you need to manage the packaged apps with the following strategy:
+
 1.  Gather information about which Packaged apps are running in your environment. For information about how to do this, see [Create list of apps deployed to each business group](create-list-of-applications-deployed-to-each-business-group.md).
+
 2.  Create AppLocker rules for specific packaged apps based on your policy strategies. For more information, see [Create a rule for packaged apps](create-a-rule-for-packaged-apps.md) and [Packaged Apps Default Rules in AppLocker](http://technet.microsoft.com/library/ee460941(WS.10).aspx).
+
 3.  Continue to update the AppLocker policies as new package apps are introduced into your environment. To do this, see [Add rules for packaged apps to existing AppLocker rule-set](add-rules-for-packaged-apps-to-existing-applocker-rule-set.md).
+
 4.  Continue to monitor your environment to verify the effectiveness of the rules that are deployed in AppLocker policies. To do this, see [Monitor app usage with AppLocker](monitor-application-usage-with-applocker.md).
- 
- 

windows/keep-secure/manage-tpm-commands.md

@@ -2,54 +2,75 @@
 title: Manage TPM commands (Windows 10)
 description: This topic for the IT professional describes how to manage which Trusted Platform Module (TPM) commands are available to domain users and to local users.
 ms.assetid: a78e751a-2806-43ae-9c20-2e7ca466b765
-ms.pagetype: security
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
+ms.pagetype: security
 author: brianlic-msft
 ---
+
 # Manage TPM commands
+
 **Applies to**
 -   Windows 10
+
 This topic for the IT professional describes how to manage which Trusted Platform Module (TPM) commands are available to domain users and to local users.
+
 ## <a href="" id="bkmk-commands1"></a>
+
 After a computer user takes ownership of the TPM, the TPM owner can limit which TPM commands can be run by creating a list of blocked TPM commands. The list can be created and applied to all computers in a domain by using Group Policy, or a list can be created for individual computers by using the TPM MMC. Because some hardware vendors might provide additional commands or the Trusted Computing Group may decide to add commands in the future, the TPM MMC also supports the ability to block new commands.
+
 Domain administrators can configure a list of blocked TPM commands by using Group Policy. Local administrators cannot allow TPM commands that are blocked through Group Policy. For more information about this Group Policy setting, see [TPM Group Policy settings](trusted-platform-module-services-group-policy-settings.md#bkmk-tpmgp-clbtc).
+
 Local administrators can block commands by using the TPM MMC, and commands on the default block list are also blocked unless the Group Policy settings are changed from the default settings.
+
 Two policy settings control the enforcement which allows TPM commands to run. For more information about these policy settings, see [TPM Group Policy settings](trusted-platform-module-services-group-policy-settings.md#bkmk-tpmgp-idlb).
+
 The following procedures describe how to manage the TPM command lists. You must be a member of the local Administrators group.
+
 **To block TPM commands by using the Local Group Policy Editor**
+
 1.  Open the Local Group Policy Editor (gpedit.msc). If the **User Account Control** dialog box appears, confirm that the action it displays is what you want, and then click **Yes**.
-    **Note**  
-    Administrators with appropriate rights in a domain can configure a Group Policy Object (GPO) that can be applied through Active Directory Domain Services (AD DS).
+    
+    >**Note:**  Administrators with appropriate rights in a domain can configure a Group Policy Object (GPO) that can be applied through Active Directory Domain Services (AD DS).
      
 2.  In the console tree, under **Computer Configuration**, expand **Administrative Templates**, and then expand **System**.
 3.  Under **System**, click **Trusted Platform Module Services**.
 4.  In the details pane, double-click **Configure the list of blocked TPM commands**.
 5.  Click **Enabled**, and then click **Show**.
 6.  For each command that you want to block, click **Add**, enter the command number, and then click **OK**.
-    **Note**  
-    For a list of commands, see the [Trusted Platform Module (TPM) Specifications](http://go.microsoft.com/fwlink/p/?linkid=139770).
+    
+    >**Note:**  For a list of commands, see the [Trusted Platform Module (TPM) Specifications](http://go.microsoft.com/fwlink/p/?linkid=139770).
      
 7.  After you have added numbers for each command that you want to block, click **OK** twice.
 8.  Close the Local Group Policy Editor.
+
 **To block or allow TPM commands by using the TPM MMC**
+
 1.  Open the TPM MMC (tpm.msc)
 2.  If the **User Account Control** dialog box appears, confirm that the action it displays is what you want, and then click **Yes**.
 3.  In the console tree, click **Command Management**. A list of TPM commands is displayed.
 4.  In the list, select a command that you want to block or allow.
 5.  Under **Actions**, click **Block Selected Command** or **Allow Selected Command** as needed. If **Allow Selected Command** is unavailable, that command is currently blocked by Group Policy.
+
 **To block new commands**
+
 1.  Open the TPM MMC (tpm.msc).
+
     If the **User Account Control** dialog box appears, confirm that the action it displays is what you want, and then click **Yes**.
+
 2.  In the console tree, click **Command Management**. A list of TPM commands is displayed.
 3.  In the **Action** pane, click **Block New Command**. The **Block New Command** dialog box is displayed.
 4.  In the **Command Number** text box, type the number of the new command that you want to block, and then click **OK**. The command number you entered is added to the blocked list.
+
 ## <a href="" id="bkmk-tpmcmdlets"></a>Use the TPM cmdlets
+
 If you are using Windows PowerShell to manage your computers, you can also manage the TPM by using Windows PowerShell. To install the TPM cmdlets, type the following command:
-**dism /online /enable-feature /FeatureName:tpm-psh-cmdlets**
+
+`dism /online /enable-feature /FeatureName:tpm-psh-cmdlets`
+
 For details about the individual cmdlets, see [TPM Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/jj603116.aspx)
+
 ## Additional resources
+
 For more info about TPM, see [Trusted Platform Module technology overview](trusted-platform-module-overview.md#bkmk-additionalresources).
- 
- 

windows/keep-secure/maximum-lifetime-for-service-ticket.md

@@ -2,89 +2,91 @@
 title: Maximum lifetime for service ticket (Windows 10)
 description: Describes the best practices, location, values, policy management, and security considerations for the Maximum lifetime for service ticket security policy setting.
 ms.assetid: 484bf05a-3858-47fc-bc02-6599ca860247
-ms.pagetype: security
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
+ms.pagetype: security
 author: brianlic-msft
 ---
+
 # Maximum lifetime for service ticket
+
 **Applies to**
 -   Windows 10
+
 Describes the best practices, location, values, policy management, and security considerations for the **Maximum lifetime for service ticket** security policy setting.
+
 ## Reference
+
 The **Maximum lifetime for service ticket** policy setting determines the maximum number of minutes that a granted session ticket can be used to access a particular service. The value must be 10 minutes or greater, and it must be less than or equal to the value of the **Maximum lifetime for service ticket** policy setting.
+
 The possible values for this Group Policy setting are:
+
 -   A user-defined number of minutes from 10 through 99,999, or 0 (in which case service tickets do not expire).
 -   Not defined.
+
 If a client presents an expired session ticket when it requests a connection to a server, the server returns an error message. The client must request a new session ticket from the Kerberos V5 KDC. After a connection is authenticated, however, it no longer matters whether the session ticket remains valid. Session tickets are used only to authenticate new connections with servers. Ongoing operations are not interrupted if the session ticket that authenticated the connection expires during the connection.
+
 If the value for this policy setting is too high, users might be able to access network resources outside of their logon hours. In addition, users whose accounts have been disabled might be able to continue accessing network services by using valid service tickets that were issued before their account was disabled. If the value is set to 0, service tickets never expire.
+
 ### Best practices
+
 -   It is advisable to set **Maximum lifetime for service ticket** to **600** minutes.
+
 ### Location
+
 Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Kerberos Policy
+
 ### Default values
+
 The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page.
-<table>
-<colgroup>
-<col width="50%" />
-<col width="50%" />
-</colgroup>
-<thead>
-<tr class="header">
-<th align="left">Server Type or GPO</th>
-<th align="left">Default Value</th>
-</tr>
-</thead>
-<tbody>
-<tr class="odd">
-<td align="left"><p>Default Domain Policy</p></td>
-<td align="left"><p>600 minutes</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Default Domain Controller Policy</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Stand-Alone Server Default Settings</p></td>
-<td align="left"><p>Not applicable</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>DC Effective Default Settings</p></td>
-<td align="left"><p>600 minutes</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Member Server Effective Default Settings</p></td>
-<td align="left"><p>Not applicable</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Client Computer Effective Default Settings</p></td>
-<td align="left"><p>Not applicable</p></td>
-</tr>
-</tbody>
-</table>
+
+| Server Type or GPO | Default Value |
+| - | - |
+| Default Domain Policy| 600 minutes| 
+| Default Domain Controller Policy | Not defined| 
+| Stand-Alone Server Default Settings | Not applicable| 
+| DC Effective Default Settings | 600 minutes| 
+| Member Server Effective Default Settings | Not applicable| 
+| Client Computer Effective Default Settings | Not applicable| 
  
 ## Policy management
+
 This section describes features, tools, and guidance to help you manage this policy.
+
 A restart of the device is not required for this policy setting to be effective.
+
 This policy setting is configured on the domain controller.
+
 ### Group Policy
+
 Client computers will get the new setting during the next scheduled and successful Group Policy refresh. But for domain controllers to assign these new settings immediately, a gpupdate.exe /force is required. On the local device, the Security Configuration Engine will refresh this setting in about five minutes.
+
 Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update:
+
 1.  Local policy settings
 2.  Site policy settings
 3.  Domain policy settings
 4.  OU policy settings
+
 When a local setting is greyed out, it indicates that a GPO currently controls that setting.
+
 ## Security considerations
+
 This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation.
+
 ### Vulnerability
+
 If you configure the value for the **Maximum lifetime for service ticket** setting too high, users might be able to access network resources outside of their logon hours. Also, users whose accounts were disabled might continue to have access to network services with valid service tickets that were issued before their accounts were disabled.
+
 ### Countermeasure
+
 Configure the **Maximum lifetime for service ticket** setting to 600 minutes.
+
 ### Potential impact
+
 None. This is the default configuration.
+
 ## Related topics
-[Kerberos Policy](kerberos-policy.md)
- 
- 
+
+- [Kerberos Policy](kerberos-policy.md)

windows/keep-secure/maximum-lifetime-for-user-ticket-renewal.md

@@ -2,88 +2,89 @@
 title: Maximum lifetime for user ticket renewal (Windows 10)
 description: Describes the best practices, location, values, policy management, and security considerations for the Maximum lifetime for user ticket renewal security policy setting.
 ms.assetid: f88cd819-3dd1-4e38-b560-13fe6881b609
-ms.pagetype: security
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
+ms.pagetype: security
 author: brianlic-msft
 ---
+
 # Maximum lifetime for user ticket renewal
+
 **Applies to**
 -   Windows 10
+
 Describes the best practices, location, values, policy management, and security considerations for the **Maximum lifetime for user ticket renewal** security policy setting.
+
 ## Reference
+
 The **Maximum lifetime for user ticket renewal** policy setting determines the period of time (in days) during which a user’s ticket-granting ticket can be renewed.
+
 The possible values for this Group Policy setting are:
+
 -   A user-defined number of days from 0 through 99,999
 -   Not defined
+
 ### Best practices
+
 -   If the value for this policy setting is too high, users may be able to renew very old user ticket-granting tickets. If the value is 0, ticket-granting tickets never expire.
+
     It is advisable to set **Maximum lifetime for user ticket renewal** to **7** days.
+
 ### Location
+
 Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Kerberos Policy
+
 ### Default values
+
 The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page.
-<table>
-<colgroup>
-<col width="50%" />
-<col width="50%" />
-</colgroup>
-<thead>
-<tr class="header">
-<th align="left">Server type or GPO</th>
-<th align="left">Default value</th>
-</tr>
-</thead>
-<tbody>
-<tr class="odd">
-<td align="left"><p>Default Domain Policy</p></td>
-<td align="left"><p>7 days</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Default Domain Controller Policy</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Stand-Alone Server Default Settings</p></td>
-<td align="left"><p>Not applicable</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Domain Controller Effective Default Settings</p></td>
-<td align="left"><p>7 days</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Member Server Effective Default Settings</p></td>
-<td align="left"><p>Not applicable</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Client Computer Effective Default Settings</p></td>
-<td align="left"><p>Not applicable</p></td>
-</tr>
-</tbody>
-</table>
+
+| Server type or GPO | Default value |
+| - | - |
+| Default Domain Policy| 7 days| 
+| Default Domain Controller Policy| Not defined| 
+| Stand-Alone Server Default Settings | Not applicable| 
+| Domain Controller Effective Default Settings | 7 days| 
+| Member Server Effective Default Settings | Not applicable| 
+| Client Computer Effective Default Settings | Not applicable| 
  
 ### Policy management
+
 This section describes features, tools, and guidance to help you manage this policy.
+
 A restart of the device is not required for this policy setting to be effective.
+
 This policy setting is configured on the domain controller.
+
 ### Group Policy
+
 Client devices will get the new setting during the next scheduled and successful Group Policy refresh. But for domain controllers to assign these new settings immediately, a gpupdate.exe /force is required. On the local device, the Security Configuration Engine will refresh this setting in about five minutes.
+
 Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update:
+
 1.  Local policy settings
 2.  Site policy settings
 3.  Domain policy settings
 4.  OU policy settings
+
 When a local setting is greyed out, it indicates that a GPO currently controls that setting.
+
 ## Security considerations
+
 This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation.
+
 ### Vulnerability
+
 If the value for the **Maximum lifetime for user ticket renewal** setting is too high, users might be able to renew very old user tickets.
+
 ### Countermeasure
+
 Configure the **Maximum lifetime for user ticket renewal** setting to 7 days.
+
 ### Potential impact
+
 None. This is the default configuration.
+
 ## Related topics
-[Kerberos Policy](kerberos-policy.md)
- 
- 
+
+- [Kerberos Policy](kerberos-policy.md)

windows/keep-secure/maximum-lifetime-for-user-ticket.md

@@ -2,88 +2,89 @@
 title: Maximum lifetime for user ticket (Windows 10)
 description: Describes the best practices, location, values, policy management, and security considerations for the Maximum lifetime for user ticket policy setting.
 ms.assetid: bcb4ff59-334d-4c2f-99af-eca2b64011dc
-ms.pagetype: security
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
+ms.pagetype: security
 author: brianlic-msft
 ---
+
 # Maximum lifetime for user ticket
+
 **Applies to**
 -   Windows 10
+
 Describes the best practices, location, values, policy management, and security considerations for the **Maximum lifetime for user ticket** policy setting.
+
 ## Reference
+
 The **Maximum lifetime for user ticket** policy setting determines the maximum amount of time (in hours) that a user’s ticket-granting ticket can be used. When a user’s ticket-granting ticket expires, a new one must be requested or the existing one must be renewed.
+
 The possible values for this Group Policy setting are:
+
 -   A user-defined number of hours from 0 through 99,999
 -   Not defined
+
 If the value for this policy setting is too high, users might be able to access network resources outside of their logon hours, or users whose accounts have been disabled might be able to continue to access network services by using valid service tickets that were issued before their account was disabled. If the value is set to 0, ticket-granting tickets never expire.
+
 ### Best practices
+
 -   It is advisable to set **Maximum lifetime for user ticket** to 10 hours.
+
 ### Location
+
 Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Kerberos Policy
+
 ### Default Values
+
 The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page.
-<table>
-<colgroup>
-<col width="50%" />
-<col width="50%" />
-</colgroup>
-<thead>
-<tr class="header">
-<th align="left">Server Type or GPO</th>
-<th align="left">Default Value</th>
-</tr>
-</thead>
-<tbody>
-<tr class="odd">
-<td align="left"><p>Default Domain Policy</p></td>
-<td align="left"><p>10 hours</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Default Domain Controller Policy</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Stand-Alone Server Default Settings</p></td>
-<td align="left"><p>Not applicable</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Domain Controller Effective Default Settings</p></td>
-<td align="left"><p>10 hours</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Member Server Effective Default Settings</p></td>
-<td align="left"><p>Not applicable</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Client Computer Effective Default Settings</p></td>
-<td align="left"><p>Not applicable</p></td>
-</tr>
-</tbody>
-</table>
+
+| Server Type or GPO | Default Value |
+| - | - |
+| Default Domain Policy| 10 hours| 
+| Default Domain Controller Policy| Not defined| 
+| Stand-Alone Server Default Settings | Not applicable| 
+| Domain Controller Effective Default Settings | 10 hours| 
+| Member Server Effective Default Settings | Not applicable| 
+| Client Computer Effective Default Settings | Not applicable| 
  
 ## Policy management
+
 This section describes features, tools, and guidance to help you manage this policy.
+
 A restart of the computer is not required for this policy setting to be effective.
+
 This policy setting is configured on the domain controller.
+
 ### Group Policy
+
 Client devices will get the new setting during the next scheduled and successful Group Policy refresh. But for domain controllers to assign these new settings immediately, a gpupdate.exe /force is required. On the local computer, the Security Configuration Engine will refresh this setting in about five minutes.
+
 Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update:
+
 1.  Local policy settings
 2.  Site policy settings
 3.  Domain policy settings
 4.  OU policy settings
+
 When a local setting is greyed out, it indicates that a GPO currently controls that setting.
+
 ## Security considerations
+
 This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation.
+
 ### Vulnerability
+
 If you configure the value for the **Maximum lifetime for user ticket** setting too high, users might be able to access network resources outside of their logon hours. Also, users whose accounts were disabled might continue to have access to network services with valid user tickets that were issued before their accounts were disabled. If you configure this value too low, ticket requests to the KDC may affect the performance of your KDC and present an opportunity for a DoS attack.
+
 ### Countermeasure
+
 Configure the **Maximum lifetime for user ticket** setting with a value between 4 and 10 hours.
+
 ### Potential impact
+
 Reducing this setting from the default value reduces the likelihood that the ticket-granting ticket will be used to access resources that the user does not have rights to. However, it requires more frequent requests to the KDC for ticket-granting tickets on behalf of users. Most KDCs can support a value of four hours without too much additional burden.
+
 ## Related topics
-[Kerberos Policy](kerberos-policy.md)
- 
- 
+
+- [Kerberos Policy](kerberos-policy.md)

windows/keep-secure/maximum-password-age.md

@@ -2,82 +2,76 @@
 title: Maximum password age (Windows 10)
 description: Describes the best practices, location, values, policy management, and security considerations for the Maximum password age security policy setting.
 ms.assetid: 2d6e70e7-c8b0-44fb-8113-870c6120871d
-ms.pagetype: security
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
+ms.pagetype: security
 author: brianlic-msft
 ---
+
 # Maximum password age
+
 **Applies to**
 -   Windows 10
+
 Describes the best practices, location, values, policy management, and security considerations for the **Maximum password age** security policy setting.
+
 ## Reference
+
 The **Maximum password age** policy setting determines the period of time (in days) that a password can be used before the system requires the user to change it. You can set passwords to expire after a number of days between 1 and 999, or you can specify that passwords never expire by setting the number of days to 0. If **Maximum password age** is between 1 and 999 days, the minimum password age must be less than the maximum password age. If **Maximum password age** is set to 0, [Minimum password age](minimum-password-age.md) can be any value between 0 and 998 days.
-**Note**  
-Setting **Maximum password age** to -1 is equivalent to 0, which means it never expires. Setting it to any other negative number is equivalent to setting it to **Not Defined**.
+
+>**Note:**  Setting **Maximum password age** to -1 is equivalent to 0, which means it never expires. Setting it to any other negative number is equivalent to setting it to **Not Defined**.
  
 ### Possible values
+
 -   User-specified number of days between 0 and 999
 -   Not defined
+
 ### Best practices
+
 Set **Maximum password age** to a value between 30 and 90 days, depending on your environment. This way, an attacker has a limited amount of time in which to compromise a user's password and have access to your network resources.
+
 ### Location
+
 **Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Password Policy**
+
 ### Default values
+
 The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page.
-<table>
-<colgroup>
-<col width="50%" />
-<col width="50%" />
-</colgroup>
-<thead>
-<tr class="header">
-<th align="left">Server type or Group Policy Object (GPO)</th>
-<th align="left">Default value</th>
-</tr>
-</thead>
-<tbody>
-<tr class="odd">
-<td align="left"><p>Default domain policy</p></td>
-<td align="left"><p>42 days</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Default domain controller policy</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Stand-alone server default settings</p></td>
-<td align="left"><p>42 days</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Domain controller effective default settings</p></td>
-<td align="left"><p>42 days</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Member server effective default settings</p></td>
-<td align="left"><p>42 days</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Effective GPO default settings on client computers</p></td>
-<td align="left"><p>42 days</p></td>
-</tr>
-</tbody>
-</table>
+
+| Server type or Group Policy Object (GPO) | Default value |
+| - | - |
+| Default domain policy| 42 days| 
+| Default domain controller policy| Not defined| 
+| Stand-alone server default settings | 42 days| 
+| Domain controller effective default settings | 42 days| 
+| Member server effective default settings | 42 days| 
+| Effective GPO default settings on client computers| 42 days| 
  
 ## Policy management
+
 This section describes features, tools, and guidance to help you manage this policy.
+
 ### Restart requirement
+
 None. Changes to this policy become effective without a computer restart when they are saved locally or distributed through Group Policy.
+
 ## Security considerations
+
 This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation.
+
 ### Vulnerability
+
 The longer a password exists, the higher the likelihood that it will be compromised by a brute force attack, by an attacker gaining general knowledge about the user, or by the user sharing the password. Configuring the **Maximum password age** policy setting to 0 so that users are never required to change their passwords is a major security risk because that allows a compromised password to be used by the malicious user for as long as the valid user is authorized access.
+
 ### Countermeasure
+
 Configure the **Maximum password age** policy setting to a value that is suitable for your organization's business requirements.
+
 ### Potential impact
+
 If the **Maximum password age** policy setting is too low, users are required to change their passwords very often. Such a configuration can reduce security in the organization because users might keep their passwords in an unsecured location or lose them. If the value for this policy setting is too high, the level of security within an organization is reduced because it allows potential attackers more time in which to discover user passwords or to use compromised accounts.
+
 ## Related topics
-[Password Policy](password-policy.md)
- 
- 
+
+- [Password Policy](password-policy.md)

windows/keep-secure/maximum-tolerance-for-computer-clock-synchronization.md

@@ -2,88 +2,90 @@
 title: Maximum tolerance for computer clock synchronization (Windows 10)
 description: Describes the best practices, location, values, policy management, and security considerations for the Maximum tolerance for computer clock synchronization security policy setting.
 ms.assetid: ba2cf59e-d69d-469e-95e3-8e6a0ba643af
-ms.pagetype: security
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
+ms.pagetype: security
 author: brianlic-msft
 ---
+
 # Maximum tolerance for computer clock synchronization
+
 **Applies to**
 -   Windows 10
+
 Describes the best practices, location, values, policy management, and security considerations for the **Maximum tolerance for computer clock synchronization** security policy setting.
+
 ## Reference
+
 This security setting determines the maximum time difference (in minutes) that Kerberos V5 tolerates between the time on the client clock and the time on the domain controller that provides Kerberos authentication.
-To prevent "replay attacks," the Kerberos v5 protocol uses time stamps as part of its protocol definition. For time stamps to work properly, the clocks of the client and the domain controller need to be in sync as much as possible. In other words, both devices must be set to the same time and date. Because the clocks of two computers are often out of sync, you can use this policy setting to establish the maximum acceptable difference to the Kerberos protocol between a client clock and domain controller clock. If the difference between a client computer clock and the domain controller clock is less than the maximum time difference that is specified in this policy, any time stamp that is used in a session between the two devices is considered to be authentic.
+
+To prevent "replay attacks," the Kerberos v5 protocol uses time stamps as part of its protocol definition. For time stamps to work properly, the clocks of the client and the domain controller need to be in sync as much as possible. In other words, both devices must be set to the same time and date. 
+Because the clocks of two computers are often out of sync, you can use this policy setting to establish the maximum acceptable difference to the Kerberos protocol between a client clock and domain controller clock. If the difference between a client computer clock and the domain controller clock is less than the maximum time difference that is specified in this policy, any time stamp that is used in a session between the two devices is considered to be authentic.
+
 The possible values for this Group Policy setting are:
+
 -   A user-defined number of minutes from 1 through 99,999
 -   Not defined
+
 ### Best practices
+
 -   It is advisable to set **Maximum tolerance for computer clock synchronization** to a value of 5 minutes.
+
 ### Location
+
 Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Kerberos Policy
+
 ### Default values
+
 The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page.
-<table>
-<colgroup>
-<col width="50%" />
-<col width="50%" />
-</colgroup>
-<thead>
-<tr class="header">
-<th align="left">Server type or GPO</th>
-<th align="left">Default value</th>
-</tr>
-</thead>
-<tbody>
-<tr class="odd">
-<td align="left"><p>Default Domain Policy</p></td>
-<td align="left"><p>5 minutes</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Default Domain Controller Policy</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Stand-Alone Server Default Settings</p></td>
-<td align="left"><p>Not applicable</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Domain Controller Effective Default Settings</p></td>
-<td align="left"><p>5 minutes</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Member Server Effective Default Settings</p></td>
-<td align="left"><p>Not applicable</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Client Computer Effective Default Settings</p></td>
-<td align="left"><p>Not applicable</p></td>
-</tr>
-</tbody>
-</table>
+
+| Server type or GPO | Default value |
+| - | - |
+| Default Domain Policy| 5 minutes| 
+| Default Domain Controller Policy | Not defined| 
+| Stand-Alone Server Default Settings | Not applicable| 
+| Domain Controller Effective Default Settings| 5 minutes| 
+| Member Server Effective Default Settings | Not applicable| 
+| Client Computer Effective Default Settings | Not applicable| 
  
 ## Policy management
+
 This section describes features, tools, and guidance to help you manage this policy.
+
 A restart of the device is not required for this policy setting to be effective.
+
 This policy setting is configured on the domain controller.
+
 ### Group Policy
+
 Client devices will get the new setting during the next scheduled and successful Group Policy refresh. But for domain controllers to assign these new settings immediately, a gpupdate.exe /force is required. On the local device, the Security Configuration Engine will refresh this setting in about five minutes.
+
 Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update:
+
 1.  Local policy settings
 2.  Site policy settings
 3.  Domain policy settings
 4.  OU policy settings
+
 When a local setting is greyed out, it indicates that a GPO currently controls that setting.
+
 ## Security considerations
+
 This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation.
+
 ### Vulnerability
+
 To prevent "replay attacks" (which are attacks in which an authentication credential is resubmitted by a malicious user or program to gain access to a protected resource), the Kerberos protocol uses time stamps as part of its definition. For time stamps to work properly, the clocks of the client computer and the domain controller need to be closely synchronized. Because the clocks of two computers are often not synchronized, administrators can use this policy to establish the maximum acceptable difference to the Kerberos protocol between a client computer clock and a domain controller clock. If the difference between the client computer clock and the domain controller clock is less than the maximum time difference specified in this setting, any time stamp that is used in a session between the two computers is considered to be authentic.
+
 ### Countermeasure
+
 Configure the **Maximum tolerance for computer clock synchronization** setting to 5 minutes.
+
 ### Potential impact
+
 None. This is the default configuration.
+
 ## Related topics
-[Kerberos Policy](kerberos-policy.md)
- 
- 
+
+- [Kerberos Policy](kerberos-policy.md)

windows/keep-secure/merge-applocker-policies-by-using-set-applockerpolicy.md

@@ -2,27 +2,36 @@
 title: Merge AppLocker policies by using Set-ApplockerPolicy (Windows 10)
 description: This topic for IT professionals describes the steps to merge AppLocker policies by using Windows PowerShell.
 ms.assetid: f1c7d5c0-463e-4fe2-a410-844a404f18d0
-ms.pagetype: security
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
+ms.pagetype: security
 author: brianlic-msft
 ---
+
 # Merge AppLocker policies by using Set-ApplockerPolicy
+
 **Applies to**
 -   Windows 10
+
 This topic for IT professionals describes the steps to merge AppLocker policies by using Windows PowerShell.
+
 The **Set-AppLockerPolicy** cmdlet sets the specified Group Policy Object (GPO) to contain the specified AppLocker policy. If no Lightweight Directory Access Protocol (LDAP) is specified, the local GPO is the default. When the Merge parameter is used, rules in the specified AppLocker policy will be merged with the AppLocker rules in the target GPO specified in the LDAP path. The merging of policies will remove rules with duplicate rule IDs, and the enforcement setting specified by the AppLocker policy in the target GPO will be preserved. If the Merge parameter is not specified, then the new policy will overwrite the existing policy.
+
 For info about using **Set-AppLockerPolicy**, including syntax descriptions and parameters, see [Set-AppLockerPolicy](http://technet.microsoft.com/library/hh847212.aspx).
+
 For info about using Windows PowerShell for AppLocker, including how to import the AppLocker cmdlets into Windows PowerShell, see [Use the AppLocker Windows PowerShell cmdlets](use-the-applocker-windows-powershell-cmdlets.md).
+
 You can also manually merge AppLocker policies. For the procedure to do this, see [Merge AppLocker policies manually](merge-applocker-policies-manually.md).
+
 **To merge a local AppLocker policy with another AppLocker policy by using LDAP paths**
 1.  Open the PowerShell command window. For info about performing Windows PowerShell commands for AppLocker, see [Use the AppLocker Windows PowerShell cmdlets](use-the-applocker-windows-powershell-cmdlets.md).
 2.  At the command prompt, type **C:\\PS>Get-AppLockerPolicy -Local | Set-AppLockerPolicy -LDAP "LDAP: //***<string>***"** **-Merge** where *<string>* specifies the LDAP path of the unique GPO.
+
 ## Example
+
 Gets the local AppLocker policy, and then merges the policy with the existing AppLocker policy in the GPO specified in the LDAP path.
+
 ``` syntax
 C:\PS>Get-AppLockerPolicy -Local | Set-AppLockerPolicy -LDAP "LDAP://DC13.Contoso.com/CN={31B2F340-016D-11D2-945F-00C044FB984F9},CN=Policies,CN=System,DC=Contoso,DC=com" -Merge
 ```
- 
- 

windows/keep-secure/merge-applocker-policies-manually.md

@@ -2,84 +2,46 @@
 title: Merge AppLocker policies manually (Windows 10)
 description: This topic for IT professionals describes the steps to manually merge AppLocker policies to update the Group Policy Object (GPO).
 ms.assetid: 3605f293-e5f2-481d-8efd-775f9f23c30f
-ms.pagetype: security
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
+ms.pagetype: security
 author: brianlic-msft
 ---
+
 # Merge AppLocker policies manually
+
 **Applies to**
 -   Windows 10
+
 This topic for IT professionals describes the steps to manually merge AppLocker policies to update the Group Policy Object (GPO).
+
 If you have created multiple AppLocker policies and need to merge them to create one AppLocker policy, you can either manually merge the policies or use the Windows PowerShell cmdlets for AppLocker. You cannot automatically merge policies by using the AppLocker console. You must create one rule collection from two or more policies. For info about merging policies by using the cmdlet, see [Merge AppLocker policies by using Set-ApplockerPolicy](merge-applocker-policies-by-using-set-applockerpolicy.md).
+
 The AppLocker policy is saved in XML format, and the exported policy can be edited with any text or XML editor. Rule collections are specified within the **RuleCollection Type** element. The XML schema includes five attributes for the different rule collections, as shown in the following table:
-<table>
-<colgroup>
-<col width="50%" />
-<col width="50%" />
-</colgroup>
-<thead>
-<tr class="header">
-<th align="left">Rule collection</th>
-<th align="left">RuleCollection Type element</th>
-</tr>
-</thead>
-<tbody>
-<tr class="odd">
-<td align="left"><p>Executable rules</p></td>
-<td align="left"><p>Exe</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Windows Installer rules</p></td>
-<td align="left"><p>Msi</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Script rules</p></td>
-<td align="left"><p>Script</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>DLL rules</p></td>
-<td align="left"><p>Dll</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Packaged apps and packaged app installers</p></td>
-<td align="left"><p>Appx</p></td>
-</tr>
-</tbody>
-</table>
+
+| Rule collection | RuleCollection Type element |
+| - | - |
+| Executable rules| Exe| 
+| Windows Installer rules| Msi| 
+| Script rules | Script| 
+| DLL rules | Dll| 
+| Packaged apps and packaged app installers|Appx| 
  
 Rule enforcement is specified with the **EnforcementMode** element. The three enforcement modes in the XML correspond to the three enforcement modes in the AppLocker console, as shown in the following table:
-<table>
-<colgroup>
-<col width="50%" />
-<col width="50%" />
-</colgroup>
-<thead>
-<tr class="header">
-<th align="left">XML enforcement mode</th>
-<th align="left">Enforcement mode in Group Policy</th>
-</tr>
-</thead>
-<tbody>
-<tr class="odd">
-<td align="left"><p>NotConfigured</p></td>
-<td align="left"><p>Not configured (rules are enforced)</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>AuditOnly</p></td>
-<td align="left"><p>Audit only</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Enabled</p></td>
-<td align="left"><p>Enforce rules</p></td>
-</tr>
-</tbody>
-</table>
+
+| XML enforcement mode |Enforcement mode in Group Policy |
+| - | - |
+| NotConfigured | Not configured (rules are enforced)| 
+| AuditOnly | Audit only| 
+| Enabled | Enforce rules| 
  
 Each of the three condition types use specific elements. For XML examples of the different rule types, see Merge AppLocker policies manually.
+
 Membership in the local **Administrators** group, or equivalent, is the minimum required to complete this procedure.
+
 **To merge two or more AppLocker policies**
+
 1.  Open an XML policy file in a text editor or XML editor, such as Notepad.
 2.  Select the rule collection where you want to copy rules from.
 3.  Select the rules that you want to add to another policy file, and then copy the text.
@@ -87,5 +49,3 @@ Membership in the local **Administrators** group, or equivalent, is the minimum
 5.  Select and expand the rule collection where you want to add the rules.
 6.  At the bottom of the rule list for the collection, after the closing element, paste the rules that you copied from the first policy file. Verify that the opening and closing elements are intact, and then save the policy.
 7.  Upload the policy to a reference computer to ensure that it is functioning properly within the GPO.
- 
- 

windows/keep-secure/microsoft-network-client-digitally-sign-communications-always.md

@@ -2,103 +2,109 @@
 title: Microsoft network client Digitally sign communications (always) (Windows 10)
 description: Describes the best practices, location, values, policy management and security considerations for the Microsoft network client Digitally sign communications (always) security policy setting.
 ms.assetid: 4b7b0298-b130-40f8-960d-60418ba85f76
-ms.pagetype: security
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
+ms.pagetype: security
 author: brianlic-msft
 ---
+
 # Microsoft network client: Digitally sign communications (always)
+
 **Applies to**
 -   Windows 10
+
 Describes the best practices, location, values, policy management and security considerations for the **Microsoft network client: Digitally sign communications (always)** security policy setting.
+
 ## Reference
-The Server Message Block (SMB) protocol provides the basis for file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether SMB packet signing must be negotiated before further communication with the Server service is permitted.
+
+The Server Message Block (SMB) protocol provides the basis for file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. 
+This policy setting determines whether SMB packet signing must be negotiated before further communication with the Server service is permitted.
+
 Implementation of digital signatures in high-security networks helps prevent the impersonation of client computers and servers, which is known as "session hijacking." But misuse of these policy settings is a common error that can cause data loss or problems with data access or security.
+
 If server-side SMB signing is required, a client device will not be able to establish a session with that server, unless it has client-side SMB signing enabled. By default, client-side SMB signing is enabled on workstations, servers, and domain controllers. Similarly, if client-side SMB signing is required, that client device will not be able to establish a session with servers that do not have packet signing enabled. By default, server-side SMB signing is enabled only on domain controllers.
+
 If server-side SMB signing is enabled, SMB packet signing will be negotiated with client computers that have SMB signing enabled.
+
 Using SMB packet signing can impose up to a 15 percent performance degradation on file service transactions.
+
 There are three other policy settings that relate to packet-signing requirements for Server Message Block (SMB) communications:
 -   [Microsoft network server: Digitally sign communications (always)](microsoft-network-server-digitally-sign-communications-always.md)
 -   [Microsoft network client: Digitally sign communications (if server agrees)](microsoft-network-client-digitally-sign-communications-if-server-agrees.md)
 -   [Microsoft network server: Digitally sign communications (if client agrees)](microsoft-network-server-digitally-sign-communications-if-client-agrees.md)
+
 ### Possible values
+
 -   Enabled
 -   Disabled
 -   Not defined
+
 ### Best practices
+
 1.  Configure the following security policy settings as follows:
+
     -   Disable **Microsoft network client: Digitally sign communications (always)**.
     -   Disable [Microsoft network server: Digitally sign communications (always)](microsoft-network-server-digitally-sign-communications-always.md).
     -   Enable [Microsoft network client: Digitally sign communications (if server agrees)](microsoft-network-client-digitally-sign-communications-if-server-agrees.md).
     -   Enable [Microsoft network server: Digitally sign communications (if client agrees)](microsoft-network-server-digitally-sign-communications-if-client-agrees.md).
+
 2.  Alternately, you can set all of these policy settings to Enabled, but enabling them can cause slower performance on client devices and prevent them from communicating with legacy SMB applications and operating systems.
+
 ### Location
+
 Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options
+
 ### Default values
+
 The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page.
-<table>
-<colgroup>
-<col width="50%" />
-<col width="50%" />
-</colgroup>
-<thead>
-<tr class="header">
-<th align="left">Server type or GPO</th>
-<th align="left">Default value</th>
-</tr>
-</thead>
-<tbody>
-<tr class="odd">
-<td align="left"><p>Default Domain Policy</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Default Domain Controller Policy</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Stand-Alone Server Default Settings</p></td>
-<td align="left"><p>Disabled</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>DC Effective Default Settings</p></td>
-<td align="left"><p>Disabled</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Member Server Effective Default Settings</p></td>
-<td align="left"><p>Disabled</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Client Computer Effective Default Settings</p></td>
-<td align="left"><p>Disabled</p></td>
-</tr>
-</tbody>
-</table>
+
+| Server type or GPO | Default value |
+| - | - |
+| Default Domain Policy| Not defined| 
+| Default Domain Controller Policy | Not defined| 
+| Stand-Alone Server Default Settings | Disabled| 
+| DC Effective Default Settings | Disabled| 
+| Member Server Effective Default Settings | Disabled| 
+| Client Computer Effective Default Settings | Disabled| 
  
 ## Policy management
+
 This section describes features and tools that are available to help you manage this policy.
+
 ### Restart requirement
+
 None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy.
+
 ## Security considerations
+
 This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation.
+
 ### Vulnerability
+
 Session hijacking uses tools that allow attackers who have access to the same network as the client device or server to interrupt, end, or steal a session in progress. Attackers can potentially intercept and modify unsigned Server Message Block (SMB) packets and then modify the traffic and forward it so that the server might perform objectionable actions. Alternatively, the attacker could pose as the server or client computer after legitimate authentication, and gain unauthorized access to data.
+
 SMB is the resource-sharing protocol that is supported by many Windows operating systems. It is the basis of NetBIOS and many other protocols. SMB signatures authenticate users and the servers that host the data. If either side fails the authentication process, data transmission does not take place.
+
 ### Countermeasure
+
 Configure the settings as follows:
+
 -   Disable **Microsoft network client: Digitally sign communications (always)**.
 -   Disable [Microsoft network server: Digitally sign communications (always)](microsoft-network-server-digitally-sign-communications-always.md).
 -   Enable [Microsoft network client: Digitally sign communications (if server agrees)](microsoft-network-client-digitally-sign-communications-if-server-agrees.md).
 -   Enable [Microsoft network server: Digitally sign communications (if client agrees)](microsoft-network-server-digitally-sign-communications-if-client-agrees.md).
+
 In highly secure environments, we recommend that you configure all of these settings to Enabled. However, that configuration may cause slower performance on client devices and prevent communications with earlier SMB applications and operating systems.
-**Note**  
-An alternative countermeasure that could protect all network traffic is to implement digital signatures with IPsec. There are hardware-based accelerators for IPsec encryption and signing that could be used to minimize the performance impact on the servers' CPUs. No such accelerators are available for SMB signing.
+
+>**Note:**  An alternative countermeasure that could protect all network traffic is to implement digital signatures with IPsec. There are hardware-based accelerators for IPsec encryption and signing that could be used to minimize the performance impact on the servers' CPUs. No such accelerators are available for SMB signing.
  
 ### Potential impact
+
 Implementations of the SMB file and print-sharing protocol support mutual authentication. This prevents session hijacking attacks and supports message authentication to prevent man-in-the-middle attacks. SMB signing provides this authentication by placing a digital signature into each SMB, which is then verified by the client and the server.
+
 Implementation of SMB signing may negatively affect performance because each packet must be signed and verified. If these settings are enabled on a server that is performing multiple roles, such as a small business server that is serving as a domain controller, file server, print server, and application server, performance may be substantially slowed. Additionally, if you configure devices to ignore all unsigned SMB communications, older applications and operating systems cannot connect. However, if you completely disable all SMB signing, computers are vulnerable to session-hijacking attacks.
+
 ## Related topics
-[Security Options](security-options.md)
- 
- 
+
+- [Security Options](security-options.md)

windows/keep-secure/microsoft-network-client-digitally-sign-communications-if-server-agrees.md

@@ -2,103 +2,111 @@
 title: Microsoft network client Digitally sign communications (if server agrees) (Windows 10)
 description: Describes the best practices, location, values, and security considerations for the Microsoft network client Digitally sign communications (if server agrees) security policy setting.
 ms.assetid: e553f700-aae5-425c-8650-f251c90ba5dd
-ms.pagetype: security
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
+ms.pagetype: security
 author: brianlic-msft
+
 ---
 # Microsoft network client: Digitally sign communications (if server agrees)
+
 **Applies to**
 -   Windows 10
+
 Describes the best practices, location, values, and security considerations for the **Microsoft network client: Digitally sign communications (if server agrees)** security policy setting.
+
 ## Reference
+
 The Server Message Block (SMB) protocol provides the basis for Microsoft file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether SMB packet signing must be negotiated before further communication with the Server service is permitted.
+
 Implementation of digital signatures in high-security networks helps to prevent the impersonation of client computers and servers, which is known as "session hijacking." But misuse of these policy settings is a common error that can cause data loss or problems with data access or security.
+
 If server-side SMB signing is required, a client computer will not be able to establish a session with that server, unless it has client-side SMB signing enabled. By default, client-side SMB signing is enabled on workstations, servers, and domain controllers. Similarly, if client-side SMB signing is required, that client device will not be able to establish a session with servers that do not have packet signing enabled. By default, server-side SMB signing is enabled only on domain controllers.
+
 If server-side SMB signing is enabled, SMB packet signing will be negotiated with client computers that have SMB signing enabled.
+
 Using SMB packet signing can impose up to a 15 percent performance degradation on file service transactions.
+
 There are three other policy settings that relate to packet-signing requirements for Server Message Block (SMB) communications:
+
 -   [Microsoft network server: Digitally sign communications (always)](microsoft-network-server-digitally-sign-communications-always.md)
 -   [Microsoft network client: Digitally sign communications (always)](microsoft-network-client-digitally-sign-communications-always.md)
 -   [Microsoft network server: Digitally sign communications (if client agrees)](microsoft-network-server-digitally-sign-communications-if-client-agrees.md)
+
 ### Possible values
+
 -   Enabled
 -   Disabled
 -   Not defined
+
 ### Best practices
+
 1.  Configure the following security policy settings as follows:
+
     -   Disable [Microsoft network client: Digitally sign communications (always)](microsoft-network-client-digitally-sign-communications-always.md).
     -   Disable [Microsoft network server: Digitally sign communications (always)](microsoft-network-server-digitally-sign-communications-always.md).
     -   Enable **Microsoft Network Client: Digitally Sign Communications (If Server Agrees)**.
     -   Enable [Microsoft network server: Digitally sign communications (if client agrees)](microsoft-network-server-digitally-sign-communications-if-client-agrees.md).
+
 2.  Alternately, you can set all of these policy settings to Enabled, but enabling them can cause slower performance on client devices and prevent them from communicating with legacy SMB applications and operating systems.
+
 ### Location
+
 Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options
+
 ### Default values
+
 The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page.
-<table>
-<colgroup>
-<col width="50%" />
-<col width="50%" />
-</colgroup>
-<thead>
-<tr class="header">
-<th align="left">Server type or GPO</th>
-<th align="left">Default value</th>
-</tr>
-</thead>
-<tbody>
-<tr class="odd">
-<td align="left"><p>Default Domain Policy</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Default Domain Controller Policy</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Stand-Alone Server Default Settings</p></td>
-<td align="left"><p>Enabled</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>DC Effective Default Settings</p></td>
-<td align="left"><p>Enabled</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Member Server Effective Default Settings</p></td>
-<td align="left"><p>Enabled</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Client Computer Effective Default Settings</p></td>
-<td align="left"><p>Enabled</p></td>
-</tr>
-</tbody>
-</table>
+
+| Server type or GPO | Default value |
+| - | - |
+| Default Domain Policy| Not defined| 
+| Default Domain Controller Policy | Not defined| 
+| Stand-Alone Server Default Settings | Enabled| 
+| DC Effective Default Settings | Enabled| 
+| Member Server Effective Default Settings| Enabled| 
+| Client Computer Effective Default Settings | Enabled| 
  
 ## Policy management
+
 This section describes features and tools that are available to help you manage this policy.
+
 ### Restart requirement
+
 None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy.
+
 ## Security considerations
+
 This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation.
+
 ### Vulnerability
-Session hijacking uses tools that allow attackers who have access to the same network as the client or server to interrupt, end, or steal a session in progress. Attackers can potentially intercept and modify unsigned Server Message Block (SMB) packets and then modify the traffic and forward it so that the server might perform objectionable actions. Alternatively, the attacker could pose as the server or client device after legitimate authentication and gain unauthorized access to data.
+
+Session hijacking uses tools that allow attackers who have access to the same network as the client or server to interrupt, end, or steal a session in progress. Attackers can potentially intercept and modify unsigned Server Message Block (SMB) packets and then modify the traffic and forward it so 
+that the server might perform objectionable actions. Alternatively, the attacker could pose as the server or client device after legitimate authentication and gain unauthorized access to data.
+
 SMB is the resource-sharing protocol that is supported by many Windows operating systems. It is the basis of NetBIOS and many other protocols. SMB signatures authenticate users and the servers that host the data. If either side fails the authentication process, data transmission does not take place.
+
 ### Countermeasure
+
 Configure the settings as follows:
+
 -   Disable [Microsoft network client: Digitally sign communications (always)](microsoft-network-client-digitally-sign-communications-always.md).
 -   Disable [Microsoft network server: Digitally sign communications (always)](microsoft-network-server-digitally-sign-communications-always.md).
 -   Enable **Microsoft network client: Digitally sign communications (if server agrees)**.
 -   Enable [Microsoft network server: Digitally sign communications (if client agrees)](microsoft-network-server-digitally-sign-communications-if-client-agrees.md).
+
 In highly secure environments we recommend that you configure all of these settings to Enabled. However, that configuration may cause slower performance on client devices and prevent communications with earlier SMB applications and operating systems.
-**Note**  
-An alternative countermeasure that could protect all network traffic is to implement digital signatures with IPsec. There are hardware-based accelerators for IPsec encryption and signing that could be used to minimize the performance impact on the servers' CPUs. No such accelerators are available for SMB signing.
+
+>**Note:**  An alternative countermeasure that could protect all network traffic is to implement digital signatures with IPsec. There are hardware-based accelerators for IPsec encryption and signing that could be used to minimize the performance impact on the servers' CPUs. No such accelerators are available for SMB signing.
  
 ### Potential impact
+
 Implementations of the SMB file and print-sharing protocol support mutual authentication. This prevents session hijacking attacks and supports message authentication to prevent man-in-the-middle attacks. SMB signing provides this authentication by placing a digital signature into each SMB, which is then verified by the client and the server.
-Implementation of SMB signing may negatively affect performance because each packet must be signed and verified. If these settings are enabled on a server that is performing multiple roles, such as a small business server that is serving as a domain controller, file server, print server, and application server, performance may be substantially slowed. Additionally, if you configure devices to ignore all unsigned SMB communications, older applications and operating systems cannot connect. However, if you completely disable all SMB signing, devices are vulnerable to session-hijacking attacks.
+
+Implementation of SMB signing may negatively affect performance because each packet must be signed and verified. If these settings are enabled on a server that is performing multiple roles, such as a small business server that is serving as a domain controller, file server, print server, and application server, performance may be substantially slowed. Additionally, if you configure devices to ignore all unsigned SMB communications, older applications and operating systems cannot connect. However, if you completely disable all SMB signing, devices are vulnerable to session-hijacking 
+attacks.
+
 ## Related topics
-[Security Options](security-options.md)
- 
- 
+
+- [Security Options](security-options.md)

windows/keep-secure/microsoft-network-client-send-unencrypted-password-to-third-party-smb-servers.md

@@ -2,82 +2,82 @@
 title: Microsoft network client Send unencrypted password to third-party SMB servers (Windows 10)
 description: Describes the best practices, location, values, policy management and security considerations for the Microsoft network client Send unencrypted password to third-party SMB servers security policy setting.
 ms.assetid: 97a76b93-afa7-4dd9-bb52-7c9e289b6017
-ms.pagetype: security
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
+ms.pagetype: security
 author: brianlic-msft
 ---
+
+
 # Microsoft network client: Send unencrypted password to third-party SMB servers
+
 **Applies to**
 -   Windows 10
+
 Describes the best practices, location, values, policy management and security considerations for the **Microsoft network client: Send unencrypted password to third-party SMB servers** security policy setting.
+
 ## Reference
+
 The Server Message Block (SMB) protocol provides the basis for file and print sharing and many other networking operations, such as remote Windows administration. This policy setting allows or prevents the SMB redirector to send plaintext passwords to a non-Microsoft server service that does not support password encryption during authentication.
+
 ### Possible values
+
 -   Enabled
+
     The Server Message Block (SMB) redirector is allowed to send plaintext passwords to a non-Microsoft server service that does not support password encryption during authentication.
+
 -   Disabled
+
     The Server Message Block (SMB) redirector only sends encrypted passwords to non-Microsoft SMB server services. If those server services do not support password encryption, the authentication request will fail.
+
 -   Not defined
+
 ### Best practices
+
 -   It is advisable to set **Microsoft network client: Send unencrypted password to connect to third-party SMB servers** to Disabled.
+
 ### Location
+
 Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options
+
 ### Default values
+
 The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page.
-<table>
-<colgroup>
-<col width="50%" />
-<col width="50%" />
-</colgroup>
-<thead>
-<tr class="header">
-<th align="left">Server type or GPO</th>
-<th align="left">Default value</th>
-</tr>
-</thead>
-<tbody>
-<tr class="odd">
-<td align="left"><p>Default Domain Policy</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Default Domain Controller Policy</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Stand-Alone Server Default Settings</p></td>
-<td align="left"><p>Disabled</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>DC Effective Default Settings</p></td>
-<td align="left"><p>Disabled</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Member Server Effective Default Settings</p></td>
-<td align="left"><p>Disabled</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Client Computer Effective Default Settings</p></td>
-<td align="left"><p>Disabled</p></td>
-</tr>
-</tbody>
-</table>
+
+| Server type or GPO | Default value |
+| - | - |
+| Default Domain Policy| Not defined| 
+| Default Domain Controller Policy | Not defined| 
+| Stand-Alone Server Default Settings | Disabled| 
+| DC Effective Default Settings | Disabled| 
+| Member Server Effective Default Settings| Disabled| 
+| Client Computer Effective Default Settings | Disabled| 
  
 ## Policy management
+
 This section describes features and tools that are available to help you manage this policy.
+
 ### Restart requirement
+
 None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy.
+
 ## Security considerations
+
 This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation.
+
 ### Vulnerability
+
 If you enable this policy setting, the server can transmit plaintext passwords across the network to other computers that offer SMB services. These other devices might not use any of the SMB security mechanisms that are included with Windows Server 2003 or later.
+
 ### Countermeasure
+
 Disable the **Microsoft network client: Send unencrypted password to connect to third-party SMB servers** setting.
+
 ### Potential impact
+
 Some older applications may not be able to communicate with the servers in your organization by means of the SMB protocol.
+
 ## Related topics
-[Security Options](security-options.md)
- 
- 
+
+- [Security Options](security-options.md)

windows/keep-secure/microsoft-network-server-amount-of-idle-time-required-before-suspending-session.md

@@ -2,81 +2,79 @@
 title: Microsoft network server Amount of idle time required before suspending session (Windows 10)
 description: Describes the best practices, location, values, and security considerations for the Microsoft network server Amount of idle time required before suspending session security policy setting.
 ms.assetid: 8227842a-569d-480f-b43c-43450bbaa722
-ms.pagetype: security
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
+ms.pagetype: security
 author: brianlic-msft
 ---
+
 # Microsoft network server: Amount of idle time required before suspending session
+
 **Applies to**
 -   Windows 10
+
 Describes the best practices, location, values, and security considerations for the **Microsoft network server: Amount of idle time required before suspending session** security policy setting.
+
 ## Reference
+
 Each Server Message Block (SMB) session consumes server resources. Establishing numerous null sessions will cause the server to slow down or possibly fail. A malicious user might repeatedly establish SMB sessions until the server stops responding; at this point, SMB services will become slow or unresponsive.
+
 The **Microsoft network server: Amount of idle time required before suspending session** policy setting determines the amount of continuous idle time that must pass in an SMB session before the session is suspended due to inactivity. You can use this policy setting to control when a device suspends an inactive SMB session. The session is automatically reestablished when client device activity resumes.
+
 ### Possible values
+
 -   A user-defined number of minutes from 0 through 99,999
+
     For this policy setting, a value of 0 means to disconnect an idle session as quickly as is reasonably possible. The maximum value is 99999, which is 208 days. In effect, this value disables the policy.
+
 -   Not defined
+
 ### Best practices
+
 -   It is advisable to set this policy to 15 minutes. There will be little impact because SMB sessions will be reestablished automatically if the client resumes activity.
+
 ### Location
+
 Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options
+
 ### Default values
+
 The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page.
-<table>
-<colgroup>
-<col width="50%" />
-<col width="50%" />
-</colgroup>
-<thead>
-<tr class="header">
-<th align="left">Server type or GPO</th>
-<th align="left">Default value</th>
-</tr>
-</thead>
-<tbody>
-<tr class="odd">
-<td align="left"><p>Default Domain Policy</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Default Domain Controller Policy</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Stand-Alone Server Default Settings</p></td>
-<td align="left"><p>15 minutes</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>DC Effective Default Settings</p></td>
-<td align="left"><p>15 minutes</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Member Server Effective Default Settings</p></td>
-<td align="left"><p>15 minutes</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Client Computer Effective Default Settings</p></td>
-<td align="left"><p>15 minutes</p></td>
-</tr>
-</tbody>
-</table>
+
+| Server type or GPO Default value |
+| - | - |
+| Default Domain Policy| Not defined| 
+| Default Domain Controller Policy | Not defined |
+| Stand-Alone Server Default Settings | 15 minutes| 
+| DC Effective Default Settings | 15 minutes| 
+| Member Server Effective Default Settings | 15 minutes| 
+| Client Computer Effective Default Settings | 15 minutes| 
  
 ## Policy management
+
 This section describes features and tools that are available to help you manage this policy.
+
 ### Restart requirement
+
 None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy.
+
 ## Security considerations
+
 This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation.
+
 ### Vulnerability
+
 Each SMB session consumes server resources, and numerous null sessions slow the server or possibly cause it to fail. An attacker could repeatedly establish SMB sessions until the server's SMB services become slow or unresponsive.
+
 ### Countermeasure
+
 The default behavior on a server mitigates this threat by design.
+
 ### Potential impact
+
 There is little impact because SMB sessions are reestablished automatically if the client computer resumes activity.
+
 ## Related topics
-[Security Options](security-options.md)
- 
- 
+
+- [Security Options](security-options.md)

windows/keep-secure/microsoft-network-server-attempt-s4u2self-to-obtain-claim-information.md

@@ -2,88 +2,95 @@
 title: Microsoft network server Attempt S4U2Self to obtain claim information (Windows 10)
 description: Describes the best practices, location, values, management, and security considerations for the Microsoft network server Attempt S4U2Self to obtain claim information security policy setting.
 ms.assetid: e4508387-35ed-4a3f-a47c-27f8396adbba
-ms.pagetype: security
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
+ms.pagetype: security
 author: brianlic-msft
 ---
+
 # Microsoft network server: Attempt S4U2Self to obtain claim information
+
 **Applies to**
 -   Windows 10
+
 Describes the best practices, location, values, management, and security considerations for the **Microsoft network server: Attempt S4U2Self to obtain claim information** security policy setting.
+
 ## Reference
-This security setting supports client devices running a version of Windows prior to Windows 8 that are trying to access a file share that requires user claims. This setting determines whether the local file server will attempt to use Kerberos Service-for-User-to-Self (S4U2Self) functionality to obtain a network client principal’s claims from the client’s account domain. This setting should only be enabled if the file server is using user claims to control access to files, and if the file server will support client principals whose accounts might be in a domain that has client computers and domain controllers running a version of Windows prior to Windows 8 or Windows Server 2012.
+
+This security setting supports client devices running a version of Windows prior to Windows 8 that are trying to access a file share that requires user claims. This setting determines whether the local file server will attempt to use Kerberos Service-for-User-to-Self (S4U2Self) functionality to obtain a network client principal’s claims from the client’s account domain. This setting should only be enabled if the file server is using user claims to control access to files, and if the file server will support client principals whose accounts might be in a domain that has client computers 
+and domain controllers running a version of Windows prior to Windows 8 or Windows Server 2012.
+
 When enabled, this security setting causes the Windows file server to examine the access token of an authenticated network client principal and determines if claim information is present. If claims are not present, the file server will then use the Kerberos S4U2Self feature to attempt to contact a Windows Server 2012 domain controller in the client’s account domain and obtain a claims-enabled access token for the client principal. A claims-enabled token might be needed to access files or folders that have claim-based access control policy applied.
+
 If this setting is disabled, the Windows file server will not attempt to obtain a claim-enabled access token for the client principal.
+
 ### Possible values
+
 -   **Default**
+
     The Windows file server will examine the access token of an authenticated network client principal and determine if claim information is present.
+
 -   **Enabled**
+
     Same as **Default**.
+
 -   **Disabled**
+
 -   **Not defined**
+
     Same as **Disabled**.
+
 ### Best practices
+
 This setting should be set to **Default** so that the file server can automatically evaluate whether claims are needed for the user. You should explicitly configure this setting to **Enabled** only if there are local file access policies that include user claims.
+
 ### Location
+
 Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options
+
 ### Default values
+
 The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page.
-<table>
-<colgroup>
-<col width="50%" />
-<col width="50%" />
-</colgroup>
-<thead>
-<tr class="header">
-<th align="left">Server type or GPO</th>
-<th align="left">Default value</th>
-</tr>
-</thead>
-<tbody>
-<tr class="odd">
-<td align="left"><p>Default Domain Policy</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Default Domain Controller Policy</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Stand-Alone Server Default Settings</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>DC Effective Default Settings</p></td>
-<td align="left"><p>Disabled</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Member Server Effective Default Settings</p></td>
-<td align="left"><p>Disabled</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Client Computer Effective Default Settings</p></td>
-<td align="left"><p>Disabled</p></td>
-</tr>
-</tbody>
-</table>
+
+| Server type or GPO | Default value |
+| - | - |
+| Default Domain Policy| Not defined| 
+| Default Domain Controller Policy | Not defined| 
+| Stand-Alone Server Default Settings | Not defined| 
+| DC Effective Default Settings | Disabled| 
+| Member Server Effective Default Settings | Disabled| 
+| Client Computer Effective Default Settings| Disabled| 
  
 ## Policy management
+
 This section describes features and tools that are available to help you manage this policy.
+
 ### Restart requirement
+
 None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy.
+
 ### Group Policy
+
 This setting should only be enabled if the file server is using user claims to control access to files, and if the file server will support client principals whose accounts might be in a domain that has client computers and domain controllers running a version of Windows prior to Windows 8 or Windows Server 2012.
+
 ## Security considerations
+
 This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation.
+
 ### Vulnerability
-None. Enabling this policy setting allows you take advantage of features in Windows Server 2012 and Windows 8 for specific scenarios to use claims-enabled tokens to access files or folders that have claim-based access control policy applied on Windows operating systems prior to Windows Server 2012 and Windows 8.
+
+None. Enabling this policy setting allows you take advantage of features in Windows Server 2012 and Windows 8 and later for specific scenarios to use claims-enabled tokens to access files or folders that have claim-based access control policy applied on Windows operating systems prior to Windows Server 2012 
+and Windows 8.
+
 ### Countermeasure
+
 Not applicable.
+
 ### Potential impact
+
 None.
+
 ## Related topics
-[Security Options](security-options.md)
- 
- 
+
+- [Security Options](security-options.md)

windows/keep-secure/microsoft-network-server-digitally-sign-communications-always.md

@@ -2,104 +2,112 @@
 title: Microsoft network server Digitally sign communications (always) (Windows 10)
 description: Describes the best practices, location, values, policy management and security considerations for the Microsoft network server Digitally sign communications (always) security policy setting.
 ms.assetid: 2007b622-7bc2-44e8-9cf1-d34b62117ea8
-ms.pagetype: security
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
+ms.pagetype: security
 author: brianlic-msft
 ---
+
 # Microsoft network server: Digitally sign communications (always)
+
 **Applies to**
 -   Windows 10
+
 Describes the best practices, location, values, policy management and security considerations for the **Microsoft network server: Digitally sign communications (always)** security policy setting.
+
 ## Reference
-The Server Message Block (SMB) protocol provides the basis for file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether SMB packet signing must be negotiated before further communication with the Server service is permitted.
+
+The Server Message Block (SMB) protocol provides the basis for file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. 
+This policy setting determines whether SMB packet signing must be negotiated before further communication with the Server service is permitted.
+
 Implementation of digital signatures in high-security networks helps to prevent the impersonation of client computers and servers, which is known as "session hijacking." But misuse of these policy settings is a common error that can cause data loss or problems with data access or security.
+
 For this policy to take effect on computers running Windows 2000, client-side packet signing must also be enabled. To enable client-side SMB packet signing, set [Microsoft network client: Digitally sign communications (if server agrees)](microsoft-network-client-digitally-sign-communications-if-server-agrees.md). Devices that have this policy set will not be able to communicate with devices that do not have server-side packet signing enabled. By default, server-side packet signing is enabled only on domain controllers. Server-side packet signing can be enabled on devices by setting [Microsoft network server: Digitally sign communications (if client agrees)](microsoft-network-server-digitally-sign-communications-if-client-agrees.md).
+
 If server-side SMB signing is required, a client device will not be able to establish a session with that server, unless it has client-side SMB signing enabled. By default, client-side SMB signing is enabled on workstations, servers, and domain controllers. Similarly, if client-side SMB signing is required, that client device will not be able to establish a session with servers that do not have packet signing enabled. By default, server-side SMB signing is enabled only on domain controllers.
+
 If server-side SMB signing is enabled, SMB packet signing will be negotiated with client devices that have SMB signing enabled.
+
 Using SMB packet signing can impose up to a 15 percent performance degradation on file service transactions.
+
 There are three other policy settings that relate to packet-signing requirements for Server Message Block (SMB) communications:
+
 -   [Microsoft network client: Digitally sign communications (always)](microsoft-network-client-digitally-sign-communications-always.md)
 -   [Microsoft network client: Digitally sign communications (if server agrees)](microsoft-network-client-digitally-sign-communications-if-server-agrees.md)
 -   [Microsoft network server: Digitally sign communications (if client agrees)](microsoft-network-server-digitally-sign-communications-if-client-agrees.md)
+
 ### Possible values
+
 -   Enabled
 -   Disabled
 -   Not defined
+
 ### Best practices
+
 1.  Configure the following security policy settings as follows:
+
     -   Disable [Microsoft network client: Digitally sign communications (always)](microsoft-network-client-digitally-sign-communications-always.md).
     -   Disable **Microsoft network server: Digitally sign communications (always)**.
     -   Enable [Microsoft network client: Digitally sign communications (if server agrees)](microsoft-network-client-digitally-sign-communications-if-server-agrees.md).
     -   Enable [Microsoft network server: Digitally sign communications (if client agrees)](microsoft-network-server-digitally-sign-communications-if-client-agrees.md).
+
 2.  Alternately, you can set all of these policy settings to Enabled, but enabling them can cause slower performance on client devices and prevent them from communicating with legacy SMB applications and operating systems.
+
 ### Location
+
 Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options
+
 ### Default values
+
 The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page.
-<table>
-<colgroup>
-<col width="50%" />
-<col width="50%" />
-</colgroup>
-<thead>
-<tr class="header">
-<th align="left">Server type or GPO</th>
-<th align="left">Default value</th>
-</tr>
-</thead>
-<tbody>
-<tr class="odd">
-<td align="left"><p>Default Domain Policy</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Default Domain Controller Policy</p></td>
-<td align="left"><p>Enabled</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Stand-Alone Server Default Settings</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>DC Effective Default Settings</p></td>
-<td align="left"><p>Enabled</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Member Server Effective Default Settings</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Client Computer Effective Default Settings</p></td>
-<td align="left"><p>Disabled</p></td>
-</tr>
-</tbody>
-</table>
+
+| Server type or GPO | Default value |
+| - | - |
+| Default Domain Policy| Not defined|
+| Default Domain Controller Policy | Enabled| 
+| Stand-Alone Server Default Settings | Not defined| 
+| DC Effective Default Settings | Enabled| 
+| Member Server Effective Default Settings| Not defined| 
+| Client Computer Effective Default Settings | Disabled| 
  
 ## Policy management
+
 This section describes features and tools that are available to help you manage this policy.
+
 ### Restart requirement
+
 None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy.
+
 ## Security considerations
+
 This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation.
+
 ### Vulnerability
+
 Session hijacking uses tools that allow attackers who have access to the same network as the client device or server to interrupt, end, or steal a session in progress. Attackers can potentially intercept and modify unsigned Server Message Block (SMB) packets and then modify the traffic and forward it so that the server might perform objectionable actions. Alternatively, the attacker could pose as the server or client device after legitimate authentication and gain unauthorized access to data.
+
 SMB is the resource-sharing protocol that is supported by many Windows operating systems. It is the basis of NetBIOS and many other protocols. SMB signatures authenticate users and the servers that host the data. If either side fails the authentication process, data transmission does not take place.
+
 ### Countermeasure
+
 Configure the settings as follows:
+
 -   Disable [Microsoft network client: Digitally sign communications (always)](microsoft-network-client-digitally-sign-communications-always.md).
 -   Disable **Microsoft network server: Digitally sign communications (always)**.
 -   Enable [Microsoft network client: Digitally sign communications (if server agrees)](microsoft-network-client-digitally-sign-communications-if-server-agrees.md).
 -   Enable [Microsoft network server: Digitally sign communications (if client agrees)](microsoft-network-server-digitally-sign-communications-if-client-agrees.md).
+
 In highly secure environments we recommend that you configure all of these settings to Enabled. However, that configuration may cause slower performance on client devices and prevent communications with earlier SMB applications and operating systems.
-**Note**  
-An alternative countermeasure that could protect all network traffic is to implement digital signatures with IPsec. There are hardware-based accelerators for IPsec encryption and signing that could be used to minimize the performance impact on the servers' CPUs. No such accelerators are available for SMB signing.
+
+>**Note:**  An alternative countermeasure that could protect all network traffic is to implement digital signatures with IPsec. There are hardware-based accelerators for IPsec encryption and signing that could be used to minimize the performance impact on the servers' CPUs. No such accelerators are available for SMB signing.
  
 ### Potential impact
+
 Implementations of the SMB file and print-sharing protocol support mutual authentication. This prevents session hijacking attacks and supports message authentication to prevent man-in-the-middle attacks. SMB signing provides this authentication by placing a digital signature into each SMB, which is then verified by the client and the server.
+
 Implementation of SMB signing may negatively affect performance because each packet must be signed and verified. If these settings are enabled on a server that is performing multiple roles, such as a small business server that is serving as a domain controller, file server, print server, and application server, performance may be substantially slowed. Additionally, if you configure computers to ignore all unsigned SMB communications, older applications and operating systems cannot connect. However, if you completely disable all SMB signing, devices are vulnerable to session-hijacking attacks.
+
 ## Related topics
-[Security Options](security-options.md)
- 
- 
+
+- [Security Options](security-options.md)

windows/keep-secure/microsoft-network-server-digitally-sign-communications-if-client-agrees.md

@@ -2,103 +2,110 @@
 title: Microsoft network server Digitally sign communications (if client agrees) (Windows 10)
 description: Describes the best practices, location, values, policy management and security considerations for the Microsoft network server Digitally sign communications (if client agrees) security policy setting.
 ms.assetid: c92b2e3d-1dbf-4337-a145-b17a585f4fc1
-ms.pagetype: security
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
+ms.pagetype: security
 author: brianlic-msft
 ---
+
 # Microsoft network server: Digitally sign communications (if client agrees)
+
 **Applies to**
 -   Windows 10
+
 Describes the best practices, location, values, policy management and security considerations for the **Microsoft network server: Digitally sign communications (if client agrees)** security policy setting.
+
 ## Reference
-The Server Message Block (SMB) protocol provides the basis for file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether SMB packet signing must be negotiated before further communication with the Server service is permitted.
+
+The Server Message Block (SMB) protocol provides the basis for file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. 
+This policy setting determines whether SMB packet signing must be negotiated before further communication with the Server service is permitted.
+
 Implementation of digital signatures in high-security networks helps to prevent the impersonation of client computers and servers, which is known as "session hijacking." But misuse of these policy settings is a common error that can cause data loss or problems with data access or security.
+
 If server-side SMB signing is required, a client device will not be able to establish a session with that server, unless it has client-side SMB signing enabled. By default, client-side SMB signing is enabled on workstations, servers, and domain controllers. Similarly, if client-side SMB signing is required, that client device will not be able to establish a session with servers that do not have packet signing enabled. By default, server-side SMB signing is enabled only on domain controllers.
+
 If server-side SMB signing is enabled, SMB packet signing will be negotiated with client computers that have SMB signing enabled.
+
 Using SMB packet signing can impose up to a 15 percent performance degradation on file service transactions.
+
 There are three other policy settings that relate to packet-signing requirements for Server Message Block (SMB) communications:
+
 -   [Microsoft network server: Digitally sign communications (always)](microsoft-network-server-digitally-sign-communications-always.md)
 -   [Microsoft network client: Digitally sign communications (if server agrees)](microsoft-network-client-digitally-sign-communications-if-server-agrees.md)
 -   [Microsoft network client: Digitally sign communications (always)](microsoft-network-client-digitally-sign-communications-always.md)
+
 ### Possible values
+
 -   Enabled
 -   Disabled
 -   Not defined
+
 ### Best practices
+
 1.  Configure the following security policy settings as follows:
+
     -   Disable [Microsoft network client: Digitally sign communications (always)](microsoft-network-client-digitally-sign-communications-always.md).
     -   Disable [Microsoft network server: Digitally sign communications (always)](microsoft-network-server-digitally-sign-communications-always.md).
     -   Enable [Microsoft network server: Digitally sign communications (always)](microsoft-network-server-digitally-sign-communications-always.md).
     -   Enable **Microsoft Network Server: Digitally Sign Communications (If Client Agrees)**.
+
 2.  Alternately, you can set all of these policy settings to Enabled, but enabling them can cause slower performance on client devices and prevent them from communicating with legacy SMB applications and operating systems.
+
 ### Location
+
 Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options
+
 ### Default values
+
 The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page.
-<table>
-<colgroup>
-<col width="50%" />
-<col width="50%" />
-</colgroup>
-<thead>
-<tr class="header">
-<th align="left">Server type or GPO</th>
-<th align="left">Default value</th>
-</tr>
-</thead>
-<tbody>
-<tr class="odd">
-<td align="left"><p>Default Domain Policy</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Default Domain Controller Policy</p></td>
-<td align="left"><p>Enabled</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Stand-Alone Server Default Settings</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>DC Effective Default Settings</p></td>
-<td align="left"><p>Enabled</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Member Server Effective Default Settings</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Client Computer Effective Default Settings</p></td>
-<td align="left"><p>Disabled</p></td>
-</tr>
-</tbody>
-</table>
+
+| Server type or GPO Default value |
+| - | - |
+| Default Domain Policy| Not defined| 
+| Default Domain Controller Policy| Enabled| 
+| Stand-Alone Server Default Settings | Not defined| 
+| DC Effective Default Settings | Enabled| 
+| Member Server Effective Default Settings|Not defined| 
+| Client Computer Effective Default Settings | Disabled| 
  
 ## Policy management
+
 This section describes features and tools that are available to help you manage this policy.
+
 ### Restart requirement
+
 None. Changes to this policy become effective without a computer restart when they are saved locally or distributed through Group Policy.
+
 ## Security considerations
+
 This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation.
+
 ### Vulnerability
+
 Session hijacking uses tools that allow attackers who have access to the same network as the client device or server to interrupt, end, or steal a session in progress. Attackers can potentially intercept and modify unsigned Server Message Block (SMB) packets and then modify the traffic and forward it so that the server might perform objectionable actions. Alternatively, the attacker could pose as the server or client computer after legitimate authentication and gain unauthorized access to data.
+
 SMB is the resource-sharing protocol that is supported by many Windows operating systems. It is the basis of NetBIOS and many other protocols. SMB signatures authenticate users and the servers that host the data. If either side fails the authentication process, data transmission does not take place.
+
 ### Countermeasure
+
 Configure the settings as follows:
+
 -   Disable [Microsoft network client: Digitally sign communications (always)](microsoft-network-client-digitally-sign-communications-always.md).
 -   Disable [Microsoft network server: Digitally sign communications (always)](microsoft-network-server-digitally-sign-communications-always.md).
 -   Enable [Microsoft network client: Digitally sign communications (if server agrees)](microsoft-network-client-digitally-sign-communications-if-server-agrees.md).
 -   Enable **Microsoft network server: Digitally sign communications (if client agrees)**.
+
 In highly secure environments we recommend that you configure all of these settings to Enabled. However, that configuration may cause slower performance on client devices and prevent communications with earlier SMB applications and operating systems.
-**Note**  
-An alternative countermeasure that could protect all network traffic is to implement digital signatures with IPsec. There are hardware-based accelerators for IPsec encryption and signing that could be used to minimize the performance impact on the servers' CPUs. No such accelerators are available for SMB signing.
+
+>**Note:**  An alternative countermeasure that could protect all network traffic is to implement digital signatures with IPsec. There are hardware-based accelerators for IPsec encryption and signing that could be used to minimize the performance impact on the servers' CPUs. No such accelerators are available for SMB signing.
  
 ### Potential impact
+
 SMB file and print-sharing protocol support mutual authentication. This prevents session hijacking attacks and supports message authentication to prevent man-in-the-middle attacks. SMB signing provides this authentication by placing a digital signature into each SMB, which is then verified by the client and the server.
+
 Implementation of SMB signing may negatively affect performance because each packet must be signed and verified. If these settings are enabled on a server that is performing multiple roles, such as a small business server that is serving as a domain controller, file server, print server, and application server, performance may be substantially slowed. Additionally, if you configure computers to ignore all unsigned SMB communications, older applications and operating systems cannot connect. However, if you completely disable all SMB signing, computers are vulnerable to session-hijacking attacks.
+
 ## Related topics
-[Security Options](security-options.md)
- 
- 
+
+- [Security Options](security-options.md)

windows/keep-secure/microsoft-network-server-disconnect-clients-when-logon-hours-expire.md

@@ -2,84 +2,85 @@
 title: Microsoft network server Disconnect clients when logon hours expire (Windows 10)
 description: Describes the best practices, location, values, and security considerations for the Microsoft network server Disconnect clients when logon hours expire security policy setting.
 ms.assetid: 48b5c424-9ba8-416d-be7d-ccaabb3f49af
-ms.pagetype: security
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
+ms.pagetype: security
 author: brianlic-msft
 ---
+
 # Microsoft network server: Disconnect clients when logon hours expire
+
 **Applies to**
 -   Windows 10
+
 Describes the best practices, location, values, and security considerations for the **Microsoft network server: Disconnect clients when logon hours expire** security policy setting.
+
 ## Reference
+
 This policy setting enables or disables the forced disconnection of users who are connected to the local device outside their user account's valid logon hours. It affects the SMB component. If you enable this policy setting, client computer sessions with the SMB service are forcibly disconnected when the client's logon hours expire. If you disable this policy setting, established client device sessions are maintained after the client device's logon hours expire.
+
 ### Possible values
+
 -   Enabled
+
     Client device sessions with the SMB service are forcibly disconnected when the client device's logon hours expire. If logon hours are not used in your organization, enabling this policy setting will have no impact.
+
 -   Disabled
+
     The system maintains an established client device session after the client device's logon hours have expired.
+
 -   Not defined
+
 ### Best practices
+
 -   If you enable this policy setting, you should also enable [Network security: Force logoff when logon hours expire](network-security-force-logoff-when-logon-hours-expire.md).
+
 ### Location
+
 Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options
+
 ### Default values
+
 The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page.
-<table>
-<colgroup>
-<col width="50%" />
-<col width="50%" />
-</colgroup>
-<thead>
-<tr class="header">
-<th align="left">Server type or GPO</th>
-<th align="left">Default value</th>
-</tr>
-</thead>
-<tbody>
-<tr class="odd">
-<td align="left"><p>Default Domain Policy</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Default Domain Controller Policy</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Stand-Alone Server Default Settings</p></td>
-<td align="left"><p>Enabled</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>DC Effective Default Settings</p></td>
-<td align="left"><p>Enabled</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Member Server Effective Default Settings</p></td>
-<td align="left"><p>Enabled</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Client Computer Effective Default Settings</p></td>
-<td align="left"><p>Enabled</p></td>
-</tr>
-</tbody>
-</table>
+
+| Server type or GPO | Default value |
+| - | - |
+| Default Domain Policy| Not defined| 
+| Default Domain Controller Policy | Not defined| 
+| Stand-Alone Server Default Settings | Enabled| 
+| DC Effective Default Settings| Enabled |
+| Member Server Effective Default Settings| Enabled| 
+| Client Computer Effective Default Settings | Enabled| 
  
 ## Policy management
+
 This section describes features and tools that are available to help you manage this policy.
+
 ### Restart requirement
+
 None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy.
+
 ### Group Policy
+
 This policy setting can be configured by using the Group Policy Management Console (GPMC) to be distributed through Group Policy Objects (GPOs). If this policy is not contained in a distributed GPO, this policy can be configured on the local computer by using the Local Security Policy snap-in.
+
 ## Security considerations
+
 This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation.
+
 ### Vulnerability
+
 If your organization configures logon hours for users, it makes sense to enable this policy setting. Otherwise, users who should not have access to network resources outside of their logon hours can continue to use those resources with sessions that were established during allowed hours.
+
 ### Countermeasure
+
 Enable the **Microsoft network server: Disconnect clients when logon hours expire** setting.
+
 ### Potential impact
+
 If logon hours are not used in your organization, this policy setting has no impact. If logon hours are used, existing user sessions are forcibly terminated when their logon hours expire.
+
 ## Related topics
-[Security Options](security-options.md)
- 
- 
+
+- [Security Options](security-options.md)

windows/keep-secure/microsoft-network-server-server-spn-target-name-validation-level.md

@@ -2,94 +2,101 @@
 title: Microsoft network server Server SPN target name validation level (Windows 10)
 description: Describes the best practices, location, and values, policy management and security considerations for the Microsoft network server Server SPN target name validation level security policy setting.
 ms.assetid: 18337f78-eb45-42fd-bdbd-f8cd02c3e154
-ms.pagetype: security
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
+ms.pagetype: security
 author: brianlic-msft
 ---
+
 # Microsoft network server: Server SPN target name validation level
+
 **Applies to**
 -   Windows 10
+
 Describes the best practices, location, and values, policy management and security considerations for the **Microsoft network server: Server SPN target name validation level** security policy setting.
+
 ## Reference
+
 This policy setting controls the level of validation that a server with shared folders or printers performs on the service principal name (SPN) that is provided by the client device when the client device establishes a session by using the Server Message Block (SMB) protocol. The level of validation can help prevent a class of attacks against SMB services (referred to as SMB relay attacks). This setting affects both SMB1 and SMB2.
+
 Servers that use SMB provide availability to their file systems and other resources, such as printers, to networked client devices. Most servers that use SMB validate user access to resources by using NT Domain authentication (NTLMv1 and NTLMv2) and the Kerberos protocol.
+
 ### Possible values
+
 The options for validation levels are:
+
 -   **Off**
+
     The SPN from a SMB client is not required or validated by the SMB server.
+
 -   **Accept if provided by client**
+
     The SMB server will accept and validate the SPN provided by the SMB client and allow a session to be established if it matches the SMB server’s list of SPN’s. If the SPN does not match, the session request for that SMB client will be denied.
+
 -   **Required from client**
+
     The SMB client must send a SPN name in session setup, and the SPN name provided must match the SMB server that is being requested to establish a connection. If no SPN is provided by the client device, or the SPN provided does not match, the session is denied.
+
 The default setting is Off.
+
 ### Best practices
+
 This setting affects the server SMB behavior, and its implementation should be carefully evaluated and tested to prevent disruptions to file and print serving capabilities.
-**Note**  
-All Windows operating systems support a client-side SMB component and a server-side SMB component.
+
+>**Note:**  All Windows operating systems support a client-side SMB component and a server-side SMB component.
  
 ### Location
+
 Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options
+
 ### Default values
+
 The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page.
-<table>
-<colgroup>
-<col width="50%" />
-<col width="50%" />
-</colgroup>
-<thead>
-<tr class="header">
-<th align="left">Server type or Group Policy object (GPO)</th>
-<th align="left">Default value</th>
-</tr>
-</thead>
-<tbody>
-<tr class="odd">
-<td align="left"><p>Default domain policy</p></td>
-<td align="left"><p>Off</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Default domain controller policy</p></td>
-<td align="left"><p>Off</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Stand-alone server default settings</p></td>
-<td align="left"><p>Off</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Domain controller effective default settings</p></td>
-<td align="left"><p>Validation level check not implemented</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Member server effective default settings</p></td>
-<td align="left"><p>Validation level check not implemented</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Effective GPO default settings on client computers</p></td>
-<td align="left"><p>Validation level check not implemented</p></td>
-</tr>
-</tbody>
-</table>
+
+| Server type or Group Policy object (GPO) | Default value |
+| - | - |
+| Default domain policy | Off | 
+| Default domain controller policy| Off| 
+| Stand-alone server default settings | Off| 
+| Domain controller effective default settings| Validation level check not implemented| 
+| Member server effective default settings | Validation level check not implemented| 
+| Effective GPO default settings on client computers | Validation level check not implemented| 
  
 ## Policy management
+
 This section describes features and tools that are available to help you manage this policy.
+
 ### Restart requirement
+
 None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy.
+
 ### Policy conflict considerations
+
 None.
+
 ### Group Policy
+
 This policy setting can be configured by using the Group Policy Management Console (GPMC) to be distributed through Group Policy Objects (GPOs). If this policy is not contained in a distributed GPO, this policy can be configured on the local computer by using the Local Security Policy snap-in.
+
 ## Security considerations
+
 This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation.
+
 ### Vulnerability
+
 This policy setting controls the level of validation that a server with shared folders or printers performs on the service principal name (SPN) that is provided by the client device when the client device establishes a session by using the SMB protocol. The level of validation can help prevent a class of attacks against SMB servers (referred to as SMB relay attacks). This setting will affect both SMB1 and SMB2.
+
 ### Countermeasure
+
 For countermeasures that are appropriate to your environment, see **Possible values** above.
+
 ### Potential impact
+
 All Windows operating systems support a client-side SMB component and a server-side SMB component. This setting affects the server SMB behavior, and its implementation should be carefully evaluated and tested to prevent disruptions to file and print serving capabilities.
+
 Because the SMB protocol is widely deployed, setting the options to **Accept if provided by client** or **Required from client** will prevent some clients from successfully authenticating to some servers in your environment.
+
 ## Related topics
-[Security Options](security-options.md)
- 
- 
+
+- [Security Options](security-options.md)

windows/keep-secure/minimum-password-age.md

@@ -2,81 +2,78 @@
 title: Minimum password age (Windows 10)
 description: Describes the best practices, location, values, policy management, and security considerations for the Minimum password age security policy setting.
 ms.assetid: 91915cb2-1b3f-4fb7-afa0-d03df95e8161
-ms.pagetype: security
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
+ms.pagetype: security
 author: brianlic-msft
 ---
+
 # Minimum password age
+
 **Applies to**
 -   Windows 10
+
 Describes the best practices, location, values, policy management, and security considerations for the **Minimum password age** security policy setting.
+
 ## Reference
+
 The **Minimum password age** policy setting determines the period of time (in days) that a password can be used before the system requires the user to change it. You can set passwords to expire after a number of days between 1 and 999, or you can specify that passwords never expire by setting the number of days to 0. If [Maximum password age](maximum-password-age.md) is between 1 and 999 days, the minimum password age must be less than the maximum password age. If Maximum password age is set to 0, **Minimum password age** can be any value between 0 and 998 days.
+
 ### Possible values
+
 -   User-specified number of days between 0 and 998
 -   Not defined
+
 ### Best practices
+
 Set **Minimum password age** to a value of 2 days. Setting the number of days to 0 allows immediate password changes, which is not recommended.
+
 If you set a password for a user and you want that user to change the administrator-defined password, you must select the **User must change password at next logon** check box. Otherwise, the user will not be able to change the password until the number of days specified by **Minimum password age**.
+
 ### Location
+
 **Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Password Policy**
+
 ### Default values
+
 The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page.
-<table>
-<colgroup>
-<col width="50%" />
-<col width="50%" />
-</colgroup>
-<thead>
-<tr class="header">
-<th align="left">Server type or Group Policy Object (GPO)</th>
-<th align="left">Default value</th>
-</tr>
-</thead>
-<tbody>
-<tr class="odd">
-<td align="left"><p>Default domain policy</p></td>
-<td align="left"><p>1 day</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Default domain controller policy</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Stand-alone server default settings</p></td>
-<td align="left"><p>0 days</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Domain controller effective default settings</p></td>
-<td align="left"><p>1 day</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Member server effective default settings</p></td>
-<td align="left"><p>1 day</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Effective GPO default settings on client computers</p></td>
-<td align="left"><p>1 day</p></td>
-</tr>
-</tbody>
-</table>
+
+| Server type or Group Policy Object (GPO) | Default value |
+| - | - |
+| Default domain policy| 1 day| 
+| Default domain controller policy| Not defined| 
+| Stand-alone server default settings | 0 days| 
+| Domain controller effective default settings | 1 day| 
+| Member server effective default settings | 1 day| 
+| Effective GPO default settings on client computers| 1 day| 
  
 ## Policy management
+
 This section describes features, tools, and guidance to help you manage this policy.
+
 ### Restart requirement
+
 None. Changes to this policy become effective without a computer restart when they are saved locally or distributed through Group Policy.
+
 ## Security considerations
+
 This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation.
+
 ### Vulnerability
+
 Users may have favorite passwords that they like to use because they are easy to remember and they believe that their password choice is secure from compromise. Unfortunately, passwords can be compromised and if an attacker is targeting a specific individual user account, with knowledge of data about that user, reuse of old passwords can cause a security breach.
+
 To address password reuse, you must use a combination of security settings. Using this policy setting with the [Enforce password history](enforce-password-history.md) policy setting prevents the easy reuse of old passwords. For example, if you configure the Enforce password history policy setting to ensure that users cannot reuse any of their last 12 passwords, but you do not configure the **Minimum password age** policy setting to a number that is greater than 0, users could change their password 13 times in a few minutes and reuse their original password. You must configure this policy setting to a number that is greater than 0 for the Enforce password history policy setting to be effective.
+
 ### Countermeasure
+
 Configure the **Minimum password age** policy setting to a value of at least 2 days. Users should know about this limitation and contact the Help Desk if they need to change their password during that two-day period. If you configure the number of days to 0, immediate password changes would be allowed, which we do not recommend.
+
 ### Potential impact
+
 If you set a password for a user but wants that user to change the password when the user first logs on, the administrator must select the **User must change password at next logon** check box, or the user cannot change the password until the next day.
+
 ## Related topics
-[Password Policy](password-policy.md)
- 
- 
+
+- [Password Policy](password-policy.md)

windows/keep-secure/minimum-password-length.md

@@ -2,85 +2,82 @@
 title: Minimum password length (Windows 10)
 description: Describes the best practices, location, values, policy management, and security considerations for the Minimum password length security policy setting.
 ms.assetid: 3d22eb9a-859a-4b6f-82f5-c270c427e17e
-ms.pagetype: security
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
+ms.pagetype: security
 author: brianlic-msft
 ---
+
 # Minimum password length
+
 **Applies to**
 -   Windows 10
+
 Describes the best practices, location, values, policy management, and security considerations for the **Minimum password length** security policy setting.
+
 ## Reference
+
 The **Minimum password length** policy setting determines the least number of characters that can make up a password for a user account. You can set a value of between 1 and 14 characters, or you can establish that no password is required by setting the number of characters to 0.
+
 ### Possible values
+
 -   User-specified number of characters between 0 and 14
 -   Not defined
+
 ### Best practices
+
 Set Minimum password length to at least a value of 8. If the number of characters is set to 0, no password is required. In most environments, an eight-character password is recommended because it is long enough to provide adequate security and still short enough for users to easily remember. This value will help provide adequate defense against a brute force attack. Adding complexity requirements will help reduce the possibility of a dictionary attack. For more info, see [Password must meet complexity requirements](password-must-meet-complexity-requirements.md).
+
 Permitting short passwords reduces security because short passwords can be easily broken with tools that perform dictionary or brute force attacks against the passwords. Requiring very long passwords can result in mistyped passwords that might cause an account lockout and subsequently increase the volume of Help Desk calls.
+
 In addition, requiring extremely long passwords can actually decrease the security of an organization because users might be more likely to write down their passwords to avoid forgetting them. However, if users are taught that they can use passphrases (sentences such as "I want to drink a $5 milkshake"), they should be much more likely to remember.
+
 ### Location
+
 **Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Password Policy**
+
 ### Default values
+
 The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page.
-<table>
-<colgroup>
-<col width="50%" />
-<col width="50%" />
-</colgroup>
-<thead>
-<tr class="header">
-<th align="left">Server type or Group Policy Object (GPO)</th>
-<th align="left">Default value</th>
-</tr>
-</thead>
-<tbody>
-<tr class="odd">
-<td align="left"><p>Default domain policy</p></td>
-<td align="left"><p>7 characters</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Default domain controller policy</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Stand-alone server default settings</p></td>
-<td align="left"><p>0 characters</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Domain controller effective default settings</p></td>
-<td align="left"><p>7 characters</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Member server effective default settings</p></td>
-<td align="left"><p>7 characters</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Effective GPO default settings on client computers</p></td>
-<td align="left"><p>0 characters</p></td>
-</tr>
-</tbody>
-</table>
+
+| Server type or Group Policy Object (GPO) | Default value |
+| - | - |
+| Default domain policy| 7 characters| 
+| Default domain controller policy | Not defined| 
+| Stand-alone server default settings | 0 characters| 
+| Domain controller effective default settings | 7 characters| 
+| Member server effective default settings | 7 characters| 
+| Effective GPO default settings on client computers | 0 characters| 
  
 ## Policy management
+
 This section describes features, tools, and guidance to help you manage this policy.
+
 ### Restart requirement
+
 None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy.
+
 ## Security considerations
+
 This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation.
+
 ### Vulnerability
+
 Types of password attacks include dictionary attacks (which attempt to use common words and phrases) and brute force attacks (which try every possible combination of characters). Also, attackers sometimes try to obtain the account database so they can use tools to discover the accounts and passwords.
+
 ### Countermeasure
+
 Configure the **** policy setting to a value of 8 or more. If the number of characters is set to 0, no password will be required.
+
 In most environments, we recommend an eight-character password because it is long enough to provide adequate security, but not too difficult for users to easily remember. This configuration provides adequate defense against a brute force attack. Using the [Password must meet complexity requirements](password-must-meet-complexity-requirements.md) policy setting in addition to the **Minimum password length** setting helps reduce the possibility of a dictionary attack.
-**Note**  
-Some jurisdictions have established legal requirements for password length as part of establishing security regulations.
+
+>**Note:**  Some jurisdictions have established legal requirements for password length as part of establishing security regulations.
  
 ### Potential impact
+
 Requirements for extremely long passwords can actually decrease the security of an organization because users might leave the information in an unsecured location or lose it. If very long passwords are required, mistyped passwords could cause account lockouts and increase the volume of Help Desk calls. If your organization has issues with forgotten passwords due to password length requirements, consider teaching your users about passphrases, which are often easier to remember and, due to the larger number of character combinations, much harder to discover.
+
 ## Related topics
-[Password Policy](password-policy.md)
- 
- 
+
+- [Password Policy](password-policy.md)

windows/keep-secure/modify-an-object-label.md

@@ -2,96 +2,102 @@
 title: Modify an object label (Windows 10)
 description: Describes the best practices, location, values, policy management, and security considerations for the Modify an object label security policy setting.
 ms.assetid: 3e5a97dd-d363-43a8-ae80-452e866ebfd5
-ms.pagetype: security
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
+ms.pagetype: security
 author: brianlic-msft
 ---
+
 # Modify an object label
+
 **Applies to**
 -   Windows 10
+
 Describes the best practices, location, values, policy management, and security considerations for the **Modify an object label** security policy setting.
+
 ## Reference
+
 This privilege determines which user accounts can modify the integrity label of objects, such as files, registry keys, or processes owned by other users. Processes running under a user account can modify the label of an object owned by that user to a lower level without this privilege.
-The integrity label is used by the Windows Integrity Controls (WIC) feature, which was introduced in Windows Server 2008 and Windows Vista. WIC keeps lower integrity processes from modifying higher integrity processes by assigning one of six possible labels to objects on the system. Although similar to NTFS file and folder permissions, which are discretionary controls on objects, the WIC integrity levels are mandatory controls that are put in place and enforced by the operating system. The following list describes the integrity levels from lowest to highest:
+
+The integrity label is used by the Windows Integrity Controls (WIC) feature, which was introduced in Windows Server 2008 and Windows Vista. WIC keeps lower integrity processes from modifying higher integrity processes by assigning one of six possible labels to objects on the system. Although 
+similar to NTFS file and folder permissions, which are discretionary controls on objects, the WIC integrity levels are mandatory controls that are put in place and enforced by the operating system. The following list describes the integrity levels from lowest to highest:
+
 -   **Untrusted**   Default assignment for processes that are logged on anonymously.
 -   **Low**   Default assignment for processes that interact with the Internet.
 -   **Medium**   Default assignment for standard user accounts and any object that is not explicitly designated with a lower or higher integrity level.
 -   **High**  Default assignment for administrator accounts and processes that request to run using administrative rights.
 -   **System**   Default assignment for Windows kernel and core services.
 -   **Installer**   Used by setup programs to install software. It is important that only trusted software is installed on computers because objects that are assigned the Installer integrity level can install, modify, and uninstall all other objects.
+
 Constant: SeRelabelPrivilege
+
 ### Possible values
+
 -   User-defined list of accounts
 -   Not Defined
+
 ### Best practices
+
 -   Do not give any group this user right.
+
 ### Location
+
 Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment
+
 ### Default values
+
 By default this setting is Not defined on domain controllers and on stand-alone servers.
+
 The following table lists the actual and effective default policy values for the most recent supported versions of Windows. Default values are also listed on the policy’s property page.
-<table>
-<colgroup>
-<col width="50%" />
-<col width="50%" />
-</colgroup>
-<thead>
-<tr class="header">
-<th align="left">Server type or GPO</th>
-<th align="left">Default value</th>
-</tr>
-</thead>
-<tbody>
-<tr class="odd">
-<td align="left"><p>Default Domain Policy</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Default Domain Controller Policy</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Stand-Alone Server Default Settings</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Domain Controller Effective Default Settings</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Member Server Effective Default Settings</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Client Computer Effective Default Settings</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-</tbody>
-</table>
+
+| Server type or GPO | Default value |
+| - | - |
+| Default Domain Policy| Not defined| 
+| Default Domain Controller Policy | Not defined| 
+| Stand-Alone Server Default Settings | Not defined| 
+| Domain Controller Effective Default Settings | Not defined| 
+| Member Server Effective Default Settings | Not defined| 
+| Client Computer Effective Default Settings | Not defined| 
  
 ## Policy management
+
 This section describes features, tools, and guidance to help you manage this policy.
+
 A restart of the computer is not required for this policy setting to be effective.
+
 Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on.
+
 ### Group Policy
+
 Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update:
+
 1.  Local policy settings
 2.  Site policy settings
 3.  Domain policy settings
 4.  OU policy settings
+
 When a local setting is greyed out, it indicates that a GPO currently controls that setting.
+
 ## Security considerations
+
 This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation.
+
 ### Vulnerability
-Anyone with the **Modify an object label** user right can change the integrity level of a file or process so that it becomes elevated or decreased to a point where it can be deleted by lower integrity processes. Either of these states effectively circumvents the protection that is offered by Windows Integrity Controls and makes your system vulnerable to attacks by malicious software.
+
+Anyone with the **Modify an object label** user right can change the integrity level of a file or process so that it becomes elevated or decreased to a point where it can be deleted by lower integrity processes. Either of these states effectively circumvents the protection that is offered by 
+Windows Integrity Controls and makes your system vulnerable to attacks by malicious software.
+
 If malicious software is set with an elevated integrity level such as Trusted Installer or System, administrator accounts do not have sufficient integrity levels to delete the program from the system. In that case, use of the **Modify an object label** right is mandated so that the object can be re-labeled. However, the re-labeling must occur by using a process that is at the same or a higher level of integrity than the object that you are attempting to re-label.
+
 ### Countermeasure
+
 Do not give any group this right. If necessary, implement it for a constrained period of time to a trusted individual to respond to a specific organizational need.
+
 ### Potential impact
+
 None. Not defined is the default configuration.
+
 ## Related topics
-[User Rights Assignment](user-rights-assignment.md)
- 
- 
+
+- [User Rights Assignment](user-rights-assignment.md)

windows/keep-secure/modify-firmware-environment-values.md

@@ -2,94 +2,100 @@
 title: Modify firmware environment values (Windows 10)
 description: Describes the best practices, location, values, policy management, and security considerations for the Modify firmware environment values security policy setting.
 ms.assetid: 80bad5c4-d9eb-4e3a-a5dc-dcb742b83fca
-ms.pagetype: security
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
+ms.pagetype: security
 author: brianlic-msft
 ---
+
 # Modify firmware environment values
+
 **Applies to**
 -   Windows 10
+
 Describes the best practices, location, values, policy management, and security considerations for the **Modify firmware environment values** security policy setting.
+
 ## Reference
+
 This security setting determines who can modify firmware environment values. Firmware environment values are settings that are stored in the nonvolatile RAM of non-x86-based computers. The effect of the setting depends on the processor.
+
 On x86-based computers, the only firmware environment value that can be modified by assigning this user right is the **Last Known Good Configuration** setting, which should only be modified by the system.
+
 On Itanium-based computers, boot information is stored in nonvolatile RAM. Users must be assigned this user right to run bootcfg.exe and to change the **Default Operating System** setting using the **Startup and Recovery** feature on the **Advanced** tab of **System Properties**.
+
 The exact setting for firmware environment values is determined by the boot firmware. The location of these values is also specified by the firmware. For example, on a UEFI-based system, NVRAM contains firmware environment values that specify system boot settings.
+
 On all computers, this user right is required to install or upgrade Windows.
+
 Constant: SeSystemEnvironmentPrivilege
+
 ### Possible values
+
 -   User-defined list of accounts
 -   Administrators
 -   Not Defined
+
 ### Best practices
+
 -   Ensure that only the local Administrators group is assigned the **Modify firmware environment values** user right.
+
 ### Location
+
 Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment
+
 ### Default values
+
 By default this setting is Administrators on domain controllers and on stand-alone servers.
+
 The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page.
-<table>
-<colgroup>
-<col width="50%" />
-<col width="50%" />
-</colgroup>
-<thead>
-<tr class="header">
-<th align="left">Server type or GPO</th>
-<th align="left">Default value</th>
-</tr>
-</thead>
-<tbody>
-<tr class="odd">
-<td align="left"><p>Default Domain Policy</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Default Domain Controller Policy</p></td>
-<td align="left"><p>Adminstrators</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Stand-Alone Server Default Settings</p></td>
-<td align="left"><p>Adminstrators</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Domain Controller Effective Default Settings</p></td>
-<td align="left"><p>Adminstrators</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Member Server Effective Default Settings</p></td>
-<td align="left"><p>Adminstrators</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Client Computer Effective Default Settings</p></td>
-<td align="left"><p>Adminstrators</p></td>
-</tr>
-</tbody>
-</table>
+
+| Server type or GPO |Default value |
+| - | - |
+| Default Domain Policy| Not defined| 
+| Default Domain Controller Policy | Adminstrators| 
+| Stand-Alone Server Default Settings | Adminstrators| 
+| Domain Controller Effective Default Settings | Adminstrators| 
+| Member Server Effective Default Settings | Adminstrators| 
+| Client Computer Effective Default Settings | Adminstrators| 
  
 ## Policy management
+
 This section describes features, tools, and guidance to help you manage this policy.
+
 A restart of the device is not required for this policy setting to be effective.
+
 Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on.
+
 This security setting does not affect who can modify the system environment values and user environment values that are displayed on the **Advanced** tab of **System Properties**.
+
 ### Group Policy
+
 Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update:
+
 1.  Local policy settings
 2.  Site policy settings
 3.  Domain policy settings
 4.  OU policy settings
+
 When a local setting is greyed out, it indicates that a GPO currently controls that setting.
+
 ## Security considerations
+
 This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation.
+
 ### Vulnerability
+
 Anyone who is assigned the **Modify firmware environment values** user right could configure the settings of a hardware component to cause it to fail, which could lead to data corruption or a denial-of-service condition.
+
 ### Countermeasure
+
 Ensure that only the local Administrators group is assigned the **Modify firmware environment values** user right.
+
 ### Potential impact
+
 None. Restricting the **Modify firmware environment values** user right to the members of the local Administrators group is the default configuration.
+
 ## Related topics
-[User Rights Assignment](user-rights-assignment.md)
- 
- 
+
+- [User Rights Assignment](user-rights-assignment.md)

windows/keep-secure/monitor-application-usage-with-applocker.md

@@ -2,51 +2,83 @@
 title: Monitor app usage with AppLocker (Windows 10)
 description: This topic for IT professionals describes how to monitor app usage when AppLocker policies are applied.
 ms.assetid: 0516da6e-ebe4-45b4-a97b-31daba96d1cf
-ms.pagetype: security
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
+ms.pagetype: security
 author: brianlic-msft
 ---
+
 # Monitor app usage with AppLocker
+
 **Applies to**
 -   Windows 10
+
 This topic for IT professionals describes how to monitor app usage when AppLocker policies are applied.
+
 Once you set rules and deploy the AppLocker policies, it is good practice to determine if the policy implementation is what you expected.
+
 ### <a href="" id="bkmk-applkr-disc-effect-pol"></a>Discover the effect of an AppLocker policy
+
 You can evaluate how the AppLocker policy is currently implemented for documentation or audit purposes, or before you modify the policy. Updating your AppLocker Policy Deployment Planning document will help you track your findings. For information about creating this document, see [Create your AppLocker planning document](create-your-applocker-planning-document.md). You can perform one or more of the following steps to understand what application controls are currently enforced through AppLocker rules.
+
 -   **Analyze the AppLocker logs in Event Viewer**
+
     When AppLocker policy enforcement is set to **Enforce rules**, rules are enforced for the rule collection and all events are audited. When AppLocker policy enforcement is set to **Audit only**, rules are not enforced but are still evaluated to generate audit event data that is written to the AppLocker logs.
+
     For the procedure to access the log, see [View the AppLocker Log in Event Viewer](#bkmk-applkr-view-log).
+
 -   **Enable the Audit only AppLocker enforcement setting**
+
     By using the **Audit only** enforcement setting, you can ensure that the AppLocker rules are properly configured for your organization. When AppLocker policy enforcement is set to **Audit only**, rules are only evaluated but all events generated from that evaluation are written to the AppLocker log.
+
     For the procedure to do this, see [Configure an AppLocker policy for audit only](configure-an-applocker-policy-for-audit-only.md).
+
 -   **Review AppLocker events with Get-AppLockerFileInformation**
+
     For both event subscriptions and local events, you can use the **Get-AppLockerFileInformation** Windows PowerShell cmdlet to determine which files have been blocked or would have been blocked (if you are using the audit-only enforcement mode) and how many times the event has occurred for each file.
+
     For the procedure to do this, see [Review AppLocker Events with Get-AppLockerFileInformation](#bkmk-applkr-review-events).
+
 -   **Review AppLocker events with Test-AppLockerPolicy**
+
     You can use the **Test-AppLockerPolicy** Windows PowerShell cmdlet to determine whether any of the rules in your rule collections will be blocked on your reference device or the device on which you maintain policies.
+
     For the procedure to do this, see [Test an AppLocker policy by using Test-AppLockerPolicy](test-an-applocker-policy-by-using-test-applockerpolicy.md).
+
 ### <a href="" id="bkmk-applkr-review-events"></a>Review AppLocker events with Get-AppLockerFileInformation
+
 For both event subscriptions and local events, you can use the **Get-AppLockerFileInformation** Windows PowerShell cmdlet to determine which files have been blocked or would have been blocked (if the **Audit only** enforcement setting is applied) and how many times the event has occurred for each file.
+
 Membership in the local **Administrators** group, or equivalent, is the minimum required to complete this procedure.
-**Note**  
-If the AppLocker logs are not on your local device, you will need permission to view the logs. If the output is saved to a file, you will need permission to read that file.
+
+>**Note:**  If the AppLocker logs are not on your local device, you will need permission to view the logs. If the output is saved to a file, you will need permission to read that file.
  
 **To review AppLocker events with Get-AppLockerFileInformation**
+
 1.  At the command prompt, type **PowerShell**, and then press ENTER.
 2.  Run the following command to review how many times a file would have been blocked from running if rules were enforced:
+
     `Get-AppLockerFileInformation –EventLog –EventType Audited –Statistics`
+
 3.  Run the following command to review how many times a file has been allowed to run or prevented from running:
+
     `Get-AppLockerFileInformation –EventLog –EventType Allowed –Statistics`
+
 ### <a href="" id="bkmk-applkr-view-log"></a>View the AppLocker Log in Event Viewer
+
 When AppLocker policy enforcement is set to **Enforce rules**, rules are enforced for the rule collection and all events are audited. When AppLocker policy enforcement is set to **Audit only**, rules are only evaluated but all events generated from that evaluation are written to the AppLocker log.
+
 Membership in the local **Administrators** group, or equivalent, is the minimum required to complete this procedure.
+
 **To view events in the AppLocker log by using Event Viewer**
+
 1.  Open Event Viewer. To do this, click **Start**, type **eventvwr.msc**, and then press ENTER.
 2.  In the console tree under **Application and Services Logs\\Microsoft\\Windows**, double-click **AppLocker**.
-AppLocker events are listed in either the **EXE and DLL** log, the **MSI and Script** log, or the **Packaged app-Deployment** or **Packaged app-Execution** log. Event information includes the enforcement setting, file name, date and time, and user name. The logs can be exported to other file formats for further analysis.
+
+AppLocker events are listed in either the **EXE and DLL** log, the **MSI and Script** log, or the **Packaged app-Deployment** or **Packaged app-Execution** log. Event information includes the enforcement setting, file name, date and time, and user name. The logs can be exported to other file 
+formats for further analysis.
+
 ## Related topics
-[AppLocker](applocker-overview.md)
- 
- 
+
+- [AppLocker](applocker-overview.md)

windows/keep-secure/monitor-central-access-policy-and-rule-definitions.md

@@ -2,22 +2,27 @@
 title: Monitor central access policy and rule definitions (Windows 10)
 description: This topic for the IT professional describes how to monitor changes to central access policy and central access rule definitions when you use advanced security auditing options to monitor dynamic access control objects.
 ms.assetid: 553f98a6-7606-4518-a3c5-347a33105130
-ms.pagetype: security
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
+ms.pagetype: security
 author: brianlic-msft
 ---
+
 # Monitor central access policy and rule definitions
+
 **Applies to**
 -   Windows 10
+
 This topic for the IT professional describes how to monitor changes to central access policy and central access rule definitions when you use advanced security auditing options to monitor dynamic access control objects.
 Central access policies and rules determine access permissions for multiple files on multiple file servers. Therefore, it is important to monitor changes to them. Like user claim and device claim definitions, central access policy and rule definitions reside in Active Directory Domain Services (AD DS), and they can be monitored just like any other object in Active Directory. Central access policies and rules are critical elements in a Dynamic Access Control deployment. These policies and rules are stored in AD DS, so they should be less likely to be tampered with than other network objects. However, it is important to monitor these objects for potential changes in security auditing and to verify that policies are being enforced.
+
 Use the following procedures to configure settings to monitor changes to central access policy and central access rule definitions and to verify the changes. These procedures assume that you have configured and deployed Dynamic Access Control, including central access policies, claims, and other components, in your network. If you have not yet deployed Dynamic Access Control in your network, see [Deploy a Central Access Policy (Demonstration Steps)](http://technet.microsoft.com/library/hh846167.aspx).
-**Note**  
-Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings.
+
+>**Note:**  Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings.
  
 **To configure settings to monitor changes to central access policy and rule definitions**
+
 1.  Sign in to your domain controller by using domain administrator credentials.
 2.  In Server Manager, point to **Tools**, and then click **Group Policy Management**.
 3.  In the console tree, right-click the default domain controller Group Policy Object, and then click **Edit**.
@@ -28,8 +33,11 @@ Your server might function differently based on the version and edition of the o
 8.  Under Dynamic Access Control, right-click **Central Access Policies**, and then select **Properties**.
 9.  Click the **Security** tab, click **Advanced** to open the **Advanced Security Settings** dialog box, and then click the **Auditing** tab.
 10. Click **Add**, add a security auditing setting for the container, and then close all Security properties dialog boxes.
+
 After you configure settings to monitor changes to central access policy and central access rule definitions, verify that the changes are being monitored.
+
 **To verify that changes to central access policy and rule definitions are monitored**
+
 1.  Sign in to your domain controller by using domain administrator credentials.
 2.  Open the Active Directory Administrative Center.
 3.  Under **Dynamic Access Control**, right-click **Central Access Policies**, and then click **Properties**.
@@ -39,7 +47,7 @@ After you configure settings to monitor changes to central access policy and cen
 7.  Click **OK**, and then close the Active Directory Administrative Center.
 8.  In Server Manager, click **Tools**, and then click **Event Viewer**.
 9.  Expand **Windows Logs**, and then click **Security**. Verify that event 4819 appears in the security log.
+
 ### Related resource
-[Using advanced security auditing options to monitor dynamic access control objects](using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md)
- 
- 
+
+- [Using advanced security auditing options to monitor dynamic access control objects](using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md)

windows/keep-secure/monitor-claim-types.md

@@ -2,39 +2,52 @@
 title: Monitor claim types (Windows 10)
 description: This topic for the IT professional describes how to monitor changes to claim types that are associated with dynamic access control when you are using advanced security auditing options.
 ms.assetid: 426084da-4eef-44af-aeec-e7ab4d4e2439
-ms.pagetype: security
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
+ms.pagetype: security
 author: brianlic-msft
 ---
+
 # Monitor claim types
+
 **Applies to**
 -   Windows 10
+
 This topic for the IT professional describes how to monitor changes to claim types that are associated with dynamic access control when you are using advanced security auditing options.
+
 Claim types are one of the basic building blocks of Dynamic Access Control. Claim types can include attributes such as the departments in an organization or the levels of security clearance that apply to classes of users. You can use security auditing to track whether claims are added, modified, enabled, disabled, or deleted.
-Use the following procedures to configure settings to monitor changes to claim types in AD DS. These procedures assume that you have configured and deployed Dynamic Access Control, including central access policies, claims, and other components, in your network. If you have not yet deployed Dynamic Access Control in your network, see [Deploy a Central Access Policy (Demonstration Steps)](http://technet.microsoft.com/library/hh846167.aspx).
-**Note**  
-Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings.
+
+Use the following procedures to configure settings to monitor changes to claim types in AD DS. These procedures assume that you have configured and deployed Dynamic Access Control, including central access policies, claims, and other components, in your network. If you have not yet deployed Dynamic 
+Access Control in your network, see [Deploy a Central Access Policy (Demonstration Steps)](http://technet.microsoft.com/library/hh846167.aspx).
+
+>**Note:**  Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings.
  
 **To configure settings to monitor changes to claim types**
+
 1.  Sign in to your domain controller by using domain administrator credential.
 2.  In Server Manager, point to **Tools**, and then click **Group Policy Management**.
 3.  In the console tree, right-click the default domain controller Group Policy Object, and then click **Edit**.
 4.  Double-click **Computer Configuration**, click **Security Settings**, expand **Advanced Audit Policy Configuration**, expand **System Audit Policies**, click **DS Access**, and then double-click **Audit directory service changes**.
 5.  Select the **Configure the following audit events** check box, select the **Success** check box (andthe **Failure** check box, if desired), and then click **OK**.
+
 After you configure settings to monitor changes to claim types in AD DS, verify that the changes are being monitored.
+
 **To verify that changes to claim types are monitored**
+
 1.  Sign in to your domain controller by using domain administrator credentials.
 2.  Open the Active Directory Administrative Center.
 3.  Under **Dynamic Access Control**, right-click **Claim Types**, and then click **Properties**.
 4.  Click the **Security** tab, click **Advanced** to open the **Advanced Security Settings** dialog box, and then click the **Auditing** tab.
 5.  Click **Add**, add a security auditing setting for the container, and then close all the Security properties dialog boxes.
 6.  In the **Claim Types** container, add a new claim type or select an existing claim type. In the **Tasks** pane, click **Properties**, and then change one or more attributes.
+
     Click **OK**, and then close the Active Directory Administrative Center.
+
 7.  Open Event Viewer on this domain controller, expand **Windows Logs**, and select the **Security** log.
+
     Look for event 5137. Key information to look for includes the name of the new attribute that was added, the type of claim that was created, and the user who created the claim.
+
 ### Related resource
-[Using advanced security auditing options to monitor dynamic access control objects](using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md)
- 
- 
+
+- [Using advanced security auditing options to monitor dynamic access control objects](using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md)

windows/keep-secure/monitor-resource-attribute-definitions.md

@@ -2,23 +2,29 @@
 title: Monitor resource attribute definitions (Windows 10)
 description: This topic for the IT professional describes how to monitor changes to resource attribute definitions when you are using advanced security auditing options to monitor dynamic access control objects.
 ms.assetid: aace34b0-123a-4b83-9e09-f269220e79de
-ms.pagetype: security
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
+ms.pagetype: security
 author: brianlic-msft
 ---
+
 # Monitor resource attribute definitions
+
 **Applies to**
 -   Windows 10
+
 This topic for the IT professional describes how to monitor changes to resource attribute definitions when you are using advanced security auditing options to monitor dynamic access control objects.
 Resource attribute definitions define the basic properties of resource attributes, such as what it means for a resource to be defined as “high business value.” Resource attribute definitions are stored in AD DS under the Resource Properties container. Changes to these definitions could significantly change the protections that govern a resource, even if the resource attributes that apply to the resource remain unchanged. Changes can be monitored like any other AD DS object.
+
 For information about monitoring changes to the resource attributes that apply to files, see [Monitor the resource attributes on files and folders](monitor-the-resource-attributes-on-files-and-folders.md).
+
 Use the following procedures to configure settings to monitor changes to resource attribute definitions in AD DS and to verify the changes. These procedures assume that you have configured and deployed Dynamic Access Control, including central access policies, claims, and other components, in your network. If you have not yet deployed Dynamic Access Control in your network, see [Deploy a Central Access Policy (Demonstration Steps)](http://technet.microsoft.com/library/hh846167.aspx).
-**Note**  
-Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings.
+
+>**Note:**  Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings.
  
 **To configure settings to monitor changes to resource attributes**
+
 1.  Sign in to your domain controller by using domain administrator credentials.
 2.  In Server Manager, point to **Tools**, and then click **Group Policy Management**.
 3.  In the console tree, right-click the Group Policy Object for the default domain controller, and then click **Edit**.
@@ -29,8 +35,11 @@ Your server might function differently based on the version and edition of the o
 8.  Under **Dynamic Access Control**, right-click **Resource Properties**, and then click **Properties**.
 9.  Click the **Security** tab, click **Advanced** to open the **Advanced Security Settings** dialog box, and then click the **Auditing** tab.
 10. Click **Add**, add a security auditing setting for the container, and then close all Security properties dialog boxes.
+
 After you configure settings to monitor changes to resource attributes in AD DS, verify that the changes are being monitored.
+
 **To verify that changes to resource definitions are monitored**
+
 1.  Sign in to your domain controller by using domain administrator credentials.
 2.  Open the Active Directory Administrative Center.
 3.  Under **Dynamic Access Control**, click **Resource Properties**, and then double-click a resource attribute.
@@ -38,7 +47,7 @@ After you configure settings to monitor changes to resource attributes in AD DS
 5.  Click **OK**, and then close the Active Directory Administrative Center.
 6.  In Server Manager, click **Tools**, and then click **Event Viewer**.
 7.  Expand **Windows Logs**, and then click **Security**. Verify that event 5137 appears in the security log.
+
 ### Related resource
-[Using advanced security auditing options to monitor dynamic access control objects](using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md)
- 
- 
+
+- [Using advanced security auditing options to monitor dynamic access control objects](using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md)

windows/keep-secure/monitor-the-central-access-policies-associated-with-files-and-folders.md

@@ -2,53 +2,67 @@
 title: Monitor the central access policies associated with files and folders (Windows 10)
 description: This topic for the IT professional describes how to monitor changes to the central access policies that are associated with files and folders when you are using advanced security auditing options to monitor dynamic access control objects.
 ms.assetid: 2ea8fc23-b3ac-432f-87b0-6a16506e8eed
-ms.pagetype: security
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
+ms.pagetype: security
 author: brianlic-msft
 ---
+
 # Monitor the central access policies associated with files and folders
+
 **Applies to**
 -   Windows 10
+
 This topic for the IT professional describes how to monitor changes to the central access policies that are associated with files and folders when you are using advanced security auditing options to monitor dynamic access control objects.
+
 This security audit policy and the event that it records are generated when the central access policy that is associated with a file or folder is changed. This security audit policy is useful when an administrator wants to monitor potential changes on some, but not all, files and folders on a file server.
+
 For info about monitoring potential central access policy changes for an entire file server, see [Monitor the central access policies that apply on a file server](monitor-the-central-access-policies-that-apply-on-a-file-server.md).
+
 Use the following procedures to configure settings to monitor central access policies that are associated with files. These procedures assume that you have configured and deployed Dynamic Access Control in your network. For more information about how to configure and deploy Dynamic Access Control, see [Dynamic Access Control: Scenario Overview](http://technet.microsoft.com/library/hh831717.aspx).
-**Note**  
-Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings.
+
+>**Note:**  Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings.
  
 **To configure settings to monitor central access policies associated with files or folders**
+
 1.  Sign in to your domain controller by using domain administrator credentials.
 2.  In Server Manager, point to **Tools**, and then click **Group Policy Management**.
 3.  In the console tree, right-click the flexible access Group Policy Object, and then click **Edit**.
 4.  Double-click **Computer Configuration**, double-click **Security Settings**, double-click **Advanced Audit Policy Configuration**, double-click **Policy Change**, and then double-click **Audit Authorization Policy Change**.
 5.  Select the **Configure the following audit events** check box, select the **Success** check box (and the **Failure** check box, if desired), and then click **OK**.
 6.  Enable auditing for a file or folder as described in the following procedure.
+
 **To enable auditing for a file or folder**
+
 1.  Sign in as a member of the local administrators group on the computer that contains the files or folders that you want to audit.
 2.  Right-click the file or folder, click **Properties**, and then click the **Security** tab.
 3.  Click **Advanced**, click the **Auditing** tab, and then click **Continue**.
+
     If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click **Yes**.
+
 4.  Click **Add**, click **Select a principal**, type a user name or group name in the format **contoso\\user1**, and then click **OK**.
 5.  In the **Auditing Entry for** dialog box, select the permissions that you want to audit, such as **Full Control** or **Delete**.
 6.  Click **OK** four times to complete the configuration of the object SACL.
 7.  Open a File Explorer window and select or create a file or folder to audit.
 8.  Open an elevated command prompt, and run the following command:
-    **gpupdate /force**
+
+    `gpupdate /force`
+
 After you configure settings to monitor changes to the central access policies that are associated with files and folders, verify that the changes are being monitored.
+
 **To verify that changes to central access policies associated with files and folders are monitored**
+
 1.  Sign in as a member of the local administrators group on the computer that contains the files or folders that you want to audit.
 2.  Open a File Explorer window and select the file or folder that you configured for auditing in the previous procedure.
 3.  Right-click the file or folder, click **Properties**, click the **Security** tab, and then click **Advanced**.
 4.  Click the **Central Policy** tab, click **Change**, and select a different central access policy (if one is available) or select **No Central Access Policy**, and then click **OK** twice.
-    **Note**  
-    You must select a setting that is different than your original setting to generate the audit event.
+    >**Note:**  You must select a setting that is different than your original setting to generate the audit event.
      
 5.  In Server Manager, click **Tools**, and then click **Event Viewer**.
 6.  Expand **Windows Logs**, and then click **Security**.
 7.  Look for event 4913, which is generated when the central access policy that is associated with a file or folder is changed. This event includes the security identifiers (SIDs) of the old and new central access policies.
+
 ### Related resource
-[Using advanced security auditing options to monitor dynamic access control objects](using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md)
- 
- 
+
+- [Using advanced security auditing options to monitor dynamic access control objects](using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md)

windows/keep-secure/monitor-the-central-access-policies-that-apply-on-a-file-server.md

@@ -2,28 +2,37 @@
 title: Monitor the central access policies that apply on a file server (Windows 10)
 description: This topic for the IT professional describes how to monitor changes to the central access policies that apply to a file server when using advanced security auditing options to monitor dynamic access control objects.
 ms.assetid: 126b051e-c20d-41f1-b42f-6cff24dcf20c
-ms.pagetype: security
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
+ms.pagetype: security
 author: brianlic-msft
 ---
+
 # Monitor the central access policies that apply on a file server
+
 **Applies to**
 -   Windows 10
+
 This topic for the IT professional describes how to monitor changes to the central access policies that apply to a file server when using advanced security auditing options to monitor dynamic access control objects. Central access policies are created on a domain controller and then applied to file servers through Group Policy management.
+
 Use the following procedures to configure and verify security auditing settings that are used to monitor changes to the set of central access policies on a file server. The following procedures assume that you have configured and deployed dynamic access control, including central access policies, and claims in your network. If you have not yet deployed dynamic access control in your network, see [Deploy a Central Access Policy (Demonstration Steps)](http://technet.microsoft.com/library/hh846167.aspx).
+
 **To configure settings to monitor changes to central access policies**
+
 1.  Sign in to your domain controller by using domain administrator credentials.
 2.  In Server Manager, point to **Tools**, and then click **Group Policy Management**.
 3.  In the console tree, right-click the flexible access Group Policy Object, and then click **Edit**.
 4.  Double-click **Computer Configuration**, double-click **Security Settings**, double-click **Advanced Audit Policy Configuration**, double-click **Policy Change**, and then double-click **Other Policy Change Events**.
-    **Note**  
-    This policy setting monitors policy changes that might not be captured otherwise, such as central access policy changes or trusted platform module configuration changes.
+
+    >**Note:**  This policy setting monitors policy changes that might not be captured otherwise, such as central access policy changes or trusted platform module configuration changes.
      
 5.  Select the **Configure the following audit events** check box, select the **Success** check box (and the **Failure** check box, if desired), and then click **OK**.
+
 After you modify the central access policies on the domain controller, verify that the changes have been applied to the file server and that the proper events are logged.
+
 **To verify changes to the central access policies**
+
 1.  Sign in to your domain controller by using domain administrator credentials.
 2.  Open the Group Policy Management Console.
 3.  Right-click **Default domain policy**, and then click **Edit**.
@@ -32,13 +41,13 @@ After you modify the central access policies on the domain controller, verify th
 6.  In the wizard that appears, follow the instructions to add a new central access policy (CAP), and then click **OK**.
 7.  Use local administrator credentials to sign in to the server that hosts resources that are subject to the central access policies you changed.
 8.  Press the Windows key + R, then type **cmd** to open a Command Prompt window.
-    **Note**  
-    If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click **Yes**.
+
+    >**Note:**  If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click **Yes**.
      
 9.  Type **gpupdate /force**, and press ENTER.
 10. In Server Manager, click **Tools**, and then click **Event Viewer**.
 11. Expand **Windows Logs**, and then click **Security**. Verify that event 4819 appears in the security log.
+
 ## Related resource
-[Using advanced security auditing options to monitor dynamic access control objects](using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md)
- 
- 
+
+- [Using advanced security auditing options to monitor dynamic access control objects](using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md)

windows/keep-secure/monitor-the-resource-attributes-on-files-and-folders.md

@@ -2,42 +2,54 @@
 title: Monitor the resource attributes on files and folders (Windows 10)
 description: This topic for the IT professional describes how to monitor attempts to change settings to the resource attributes on files when you are using advanced security auditing options to monitor dynamic access control objects.
 ms.assetid: 4944097b-320f-44c7-88ed-bf55946a358b
-ms.pagetype: security
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
+ms.pagetype: security
 author: brianlic-msft
 ---
+
 # Monitor the resource attributes on files and folders
+
 **Applies to**
 -   Windows 10
+
 This topic for the IT professional describes how to monitor attempts to change settings to the resource attributes on files when you are using advanced security auditing options to monitor dynamic access control objects.
+
 If your organization has a carefully thought out authorization configuration for resources, changes to these resource attributes can create potential security risks. Examples include:
+
 -   Changing files that have been marked as high business value to low business value.
 -   Changing the Retention attribute of files that have been marked for retention.
 -   Changing the Department attribute of files that are marked as belonging to a particular department.
+
 Use the following procedures to configure settings to monitor changes to resource attributes on files and folders. These procedures assume that have configured and deployed central access policies in your network. For more information about how to configure and deploy central access policies, see [Dynamic Access Control: Scenario Overview](http://technet.microsoft.com/library/hh831717.aspx) .
-**Note**  
-Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings.
+
+>**Note:**  Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings.
  
 **To monitor changes to resource attributes on files**
+
 1.  Sign in to your domain controller by using domain administrator credentials.
 2.  In Server Manager, point to **Tools**, and then click **Group Policy Management**.
 3.  In the console tree, right-click the flexible access Group Policy Object, and then click **Edit**.
 4.  Double-click **Computer Configuration**, double-click **Security Settings**, double-click **Advanced Audit Policy Configuration**, double-click **Policy Change**, and then double-click **Audit Authorization Policy Change**.
 5.  Select the **Configure the following audit events** check box, select the **Success** and **Failure** check boxes, and then click **OK**.
+
 After you configure settings to monitor resource attributes on files, verify that the changes are being monitored.
+
 **To verify that changes to resource attributes on files are monitored**
+
 1.  Use administrator credentials to sign in to the server that hosts the resource you want to monitor.
 2.  From an elevated command prompt, type **gpupdate /force**, and then press ENTER.
 3.  Attempt to change resource properties on one or more files and folders.
 4.  In Server Manager, click **Tools**, and then click **Event Viewer**.
 5.  Expand **Windows Logs**, and then click **Security**.
 6.  Depending on which resource attributes you attempted to change, you should look for the following events:
+
     -   Event 4911, which tracks changes to file attributes
     -   Event 4913, which tracks changes to central access policies
+
     Key information to look for includes the name and account domain of the principal attempting to change the resource attribute, the object that the principal is attempting to modify, and information about the changes that are being attempted.
+
 ### Related resource
-[Using advanced security auditing options to monitor dynamic access control objects](using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md)
- 
- 
+
+- [Using advanced security auditing options to monitor dynamic access control objects](using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md)

windows/keep-secure/monitor-the-use-of-removable-storage-devices.md

@@ -2,22 +2,28 @@
 title: Monitor the use of removable storage devices (Windows 10)
 description: This topic for the IT professional describes how to monitor attempts to use removable storage devices to access network resources. It describes how to use advanced security auditing options to monitor dynamic access control objects.
 ms.assetid: b0a9e4a5-b7ff-41c6-96ff-0228d4ba5da8
-ms.pagetype: security
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
+ms.pagetype: security
 author: brianlic-msft
 ---
+
 # Monitor the use of removable storage devices
+
 **Applies to**
 -   Windows 10
+
 This topic for the IT professional describes how to monitor attempts to use removable storage devices to access network resources. It describes how to use advanced security auditing options to monitor dynamic access control objects.
+
 If you configure this policy setting, an audit event is generated each time a user attempts to copy, move, or save a resource to a removable storage device.
+
 Use the following procedures to monitor the use of removable storage devices and to verify that the devices are being monitored.
-**Note**  
-Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings.
+
+>**Note:**  Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings.
  
 **To configure settings to monitor removable storage devices**
+
 1.  Sign in to your domain controller by using domain administrator credentials.
 2.  In Server Manager, point to **Tools**, and then click **Group Policy Management**.
 3.  In the console tree, right-click the flexible access Group Policy Object on the domain controller, and then click **Edit**.
@@ -25,22 +31,25 @@ Your server might function differently based on the version and edition of the o
 5.  Select the **Configure the following audit events** check box, select the **Success** check box (and the **Failure** check box, if desired), and then click **OK**.
 6.  If you selected the **Failure** check box, double-click **Audit Handle Manipulation**, select the **Configure the following audit events check box**, and then select **Failure**.
 7.  Click **OK**, and then close the Group Policy Management Editor.
+
 After you configure the settings to monitor removable storage devices, use the following procedure to verify that the settings are active.
+
 **To verify that removable storage devices are monitored**
+
 1.  Sign in to the computer that hosts the resources that you want to monitor. Press the Windows key + R, and then type **cmd** to open a Command Prompt window.
-    **Note**  
-    If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click **Yes**.
+
+    >**Note:**  If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click **Yes**.
      
 2.  Type **gpupdate /force**, and press ENTER.
 3.  Connect a removable storage device to the targeted computer and attempt to copy a file that is protected with the Removable Storage Audit policy.
 4.  In Server Manager, click **Tools**, and then click **Event Viewer**.
 5.  Expand **Windows Logs**, and then click **Security**.
 6.  Look for event 4663, which logs successful attempts to write to or read from a removable storage device. Failures will log event 4656. Both events include **Task Category = Removable Storage device**.
+
     Key information to look for includes the name and account domain of the user who attempted to access the file, the object that the user is attempting to access, resource attributes of the resource, and the type of access that was attempted.
-    **Note**  
-    We do not recommend that you enable this category on a file server that hosts file shares on a removable storage device. When Removable Storage Auditing is configured, any attempt to access the removable storage device will generate an audit event.
+
+    >**Note:**  We do not recommend that you enable this category on a file server that hosts file shares on a removable storage device. When Removable Storage Auditing is configured, any attempt to access the removable storage device will generate an audit event.
      
 ### Related resource
-[Using advanced security auditing options to monitor dynamic access control objects](using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md)
- 
- 
+
+- [Using advanced security auditing options to monitor dynamic access control objects](using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md)

windows/keep-secure/monitor-user-and-device-claims-during-sign-in.md

@@ -2,36 +2,48 @@
 title: Monitor user and device claims during sign-in (Windows 10)
 description: This topic for the IT professional describes how to monitor user and device claims that are associated with a user’s security token when you are using advanced security auditing options to monitor dynamic access control objects.
 ms.assetid: 71796ea9-5fe4-4183-8475-805c3c1f319f
-ms.pagetype: security
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
+ms.pagetype: security
 author: brianlic-msft
+
 ---
+
 # Monitor user and device claims during sign-in
+
 **Applies to**
 -   Windows 10
+
 This topic for the IT professional describes how to monitor user and device claims that are associated with a user’s security token when you are using advanced security auditing options to monitor dynamic access control objects.
+
 Device claims are associated with the system that is used to access resources that are protected with Dynamic Access Control. User claims are attributes that are associated with a user. User claims and device claims are included in the user’s security token used at sign-on. For example, information about Department, Company, Project, or Security clearances might be included in the token.
+
 Use the following procedures to monitor changes to user claims and device claims in the user’s sign-on token and to verify the changes. These procedures assume that you have configured and deployed Dynamic Access Control, including central access policies, claims, and other components, in your network. If you have not yet deployed Dynamic Access Control in your network, see [Deploy a Central Access Policy (Demonstration Steps)](http://technet.microsoft.com/library/hh846167.aspx).
-**Note**  
-Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings.
+
+>**Note:**  Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings.
  
 **To monitor user and device claims in user logon token**
+
 1.  Sign in to your domain controller by using domain administrator credentials.
 2.  In Server Manager, point to **Tools**, and then click **Group Policy Management**.
 3.  In the console tree, right-click the flexible access Group Policy Object, and then click **Edit**.
 4.  Double-click **Computer Configuration**, click **Security Settings**, expand **Advanced Audit Policy Configuration**, expand **System Audit Policies**, click **Logon/Logoff**, and then double-click **Audit User/Device claims**.
 5.  Select the **Configure the following audit events** check box, select the **Success** check box (and the **Failure** check box, if desired), and then click **OK**.
 6.  Close the Group Policy Management Editor.
+
 After you configure settings to monitor user and device claims, verify that the changes are being monitored.
+
 **To verify that user and device claims in user logon token are monitored**
+
 1.  With local administrator credentials, sign in to a file server that is subject to the flexible access Group Policy Object.
 2.  Open an elevated command prompt, and run the following command:
-    **gpupdate force**
+
+    `gpupdate force`
+
 3.  From a client computer, connect to a file share on the file server as a user who has access permissions to the file server.
 4.  On the file server, open Event Viewer, expand **Windows Logs**, and select the **Security** log. Look for event 4626, and confirm that it contains information about user claims and device claims.
+
 ### Related resource
-[Using advanced security auditing options to monitor dynamic access control objects](using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md)
- 
- 
+
+- [Using advanced security auditing options to monitor dynamic access control objects](using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md)

windows/keep-secure/network-access-allow-anonymous-sidname-translation.md

@@ -2,90 +2,96 @@
 title: Network access Allow anonymous SID/Name translation (Windows 10)
 description: Describes the best practices, location, values, policy management and security considerations for the Network access Allow anonymous SID/Name translation security policy setting.
 ms.assetid: 0144477f-22a6-4d06-b70a-9c9c2196e99e
-ms.pagetype: security
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
+ms.pagetype: security
 author: brianlic-msft
 ---
+
 # Network access: Allow anonymous SID/Name translation
+
 **Applies to**
 -   Windows 10
+
 Describes the best practices, location, values, policy management and security considerations for the **Network access: Allow anonymous SID/Name translation** security policy setting.
+
 ## Reference
+
 This policy setting enables or disables the ability of an anonymous user to request security identifier (SID) attributes for another user.
+
 If this policy setting is enabled, a user might use the well-known Administrators SID to get the real name of the built-in Administrator account, even if the account has been renamed. That person might then use the account name to initiate a brute-force password-guessing attack.
+
 Misuse of this policy setting is a common error that can cause data loss or problems with data access or security.
+
 ### Possible values
+
 -   Enabled
+
     An anonymous user can request the SID attribute for another user. An anonymous user with knowledge of an administrator's SID could contact a computer that has this policy enabled and use the SID to get the administrator's name. This setting affects the SID-to-name translation as well as the name-to-SID translation
+
 -   Disabled
+
     Prevents an anonymous user from requesting the SID attribute for another user.
+
 -   Not defined
+
 ### Best practices
+
 -   Set this policy to Disabled. This is the default value on member computers; therefore, it will have no impact on them. The default value for domain controllers is Enabled.
+
 ### Location
+
 Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options
+
 ### Default values
+
 The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page.
-<table>
-<colgroup>
-<col width="50%" />
-<col width="50%" />
-</colgroup>
-<thead>
-<tr class="header">
-<th align="left">Server type or GPO</th>
-<th align="left">Default value</th>
-</tr>
-</thead>
-<tbody>
-<tr class="odd">
-<td align="left"><p>Default Domain Policy</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Default Domain Controller Policy</p></td>
-<td align="left"><p>Note defined</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Stand-Alone Server Default Settings</p></td>
-<td align="left"><p>Disabled</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>DC Effective Default Settings</p></td>
-<td align="left"><p>Enabled</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Member Server Effective Default Settings</p></td>
-<td align="left"><p>Disabled</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Client Computer Effective Default Settings</p></td>
-<td align="left"><p>Disabled</p></td>
-</tr>
-</tbody>
-</table>
+
+| Server type or GPO | Default value |
+| - | - |
+| Default Domain Policy| Not defined| 
+| Default Domain Controller Policy | Note defined| 
+| Stand-Alone Server Default Settings | Disabled| 
+| DC Effective Default Settings | Enabled| 
+| Member Server Effective Default Settings| Disabled| 
+| Client Computer Effective Default Settings | Disabled| 
  
 ### Operating system version differences
+
 The default value of this setting has changed between operating systems as follows:
+
 -   The default on domain controllers running Windows Server 2003 R2 or earlier was set to Enabled.
 -   The default on domain controllers running Windows Server 2008 and later is set to Disabled.
+
 ## Policy management
+
 This section describes features and tools that are available to help you manage this policy.
+
 ### Restart requirement
+
 None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy.
+
 ### Group Policy
+
 Modifying this setting may affect compatibility with client computers, services, and applications.
+
 ## Security considerations
+
 This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation.
+
 ### Vulnerability
+
 If this policy setting is enabled, a user with local access could use the well-known Administrator's SID to learn the real name of the built-in Administrator account, even if it has been renamed. That person could then use the account name to initiate a password-guessing attack.
+
 ### Countermeasure
+
 Disable the **Network access: Allow anonymous SID/Name translation** setting.
+
 ### Potential impact
+
 Disabled is the default configuration for this policy setting on member devices; therefore, it has no impact on them. The default configuration for domain controllers is Enabled.
+
 ## Related topics
-[Security Options](security-options.md)
- 
- 
+
+- [Security Options](security-options.md)

windows/keep-secure/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares.md

@@ -2,85 +2,86 @@
 title: Network access Do not allow anonymous enumeration of SAM accounts and shares (Windows 10)
 description: Describes the best practices, location, values, and security considerations for the Network access Do not allow anonymous enumeration of SAM accounts and shares security policy setting.
 ms.assetid: 3686788d-4cc7-4222-9163-cbc7c3362d73
-ms.pagetype: security
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
+ms.pagetype: security
 author: brianlic-msft
 ---
+
 # Network access: Do not allow anonymous enumeration of SAM accounts and shares
+
 **Applies to**
 -   Windows 10
+
 Describes the best practices, location, values, and security considerations for the **Network access: Do not allow anonymous enumeration of SAM accounts and shares** security policy setting.
+
 ## Reference
+
 This policy setting determines which additional permissions will be assigned for anonymous connections to the device. Windows allows anonymous users to perform certain activities, such as enumerating the names of domain accounts and network shares. This is convenient, for example, when an administrator wants to give access to users in a trusted domain that does not maintain a reciprocal trust. However, even with this policy setting enabled, anonymous users will have access to resources with permissions that explicitly include the built-in group, ANONYMOUS LOGON.
+
 This policy setting has no impact on domain controllers.
 Misuse of this policy setting is a common error that can cause data loss or problems with data access or security.
+
 ### Possible values
+
 -   Enabled
+
 -   Disabled
+
     No additional permissions can be assigned by the administrator for anonymous connections to the device. Anonymous connections will rely on default permissions. However, an unauthorized user could anonymously list account names and use the information to attempt to guess passwords or perform social-engineering attacks.
+
 -   Not defined
+
 ### Location
+
 Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options
+
 ### Default values
+
 The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page.
-<table>
-<colgroup>
-<col width="50%" />
-<col width="50%" />
-</colgroup>
-<thead>
-<tr class="header">
-<th align="left">Server type or GPO</th>
-<th align="left">Default value</th>
-</tr>
-</thead>
-<tbody>
-<tr class="odd">
-<td align="left"><p>Default Domain Policy</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Default Domain Controller Policy</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Stand-Alone Server Default Settings</p></td>
-<td align="left"><p>Disabled</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>DC Effective Default Settings</p></td>
-<td align="left"><p>Disabled</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Member Server Effective Default Settings</p></td>
-<td align="left"><p>Disabled</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Client Computer Effective Default Settings</p></td>
-<td align="left"><p>Disabled</p></td>
-</tr>
-</tbody>
-</table>
+
+| Server type or GPO | Default value |
+| - | - |
+| Default Domain Policy| Not defined| 
+| Default Domain Controller Policy | Not defined| 
+| Stand-Alone Server Default Settings | Disabled| 
+| DC Effective Default Settings | Disabled| 
+| Member Server Effective Default Settings | Disabled| 
+| Client Computer Effective Default Settings | Disabled| 
  
 ## Policy management
+
 This section describes features and tools that are available to help you manage this policy.
+
 ### Restart requirement
+
 None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy.
+
 ### Policy conflicts
+
 Even with this policy setting enabled, anonymous users will have access to resources with permissions that explicitly include the built-in group, ANONYMOUS LOGON (on systems earlier than Windows Server 2008 and Windows Vista).
+
 ### Group Policy
+
 This policy has no impact on domain controllers.
+
 ## Security considerations
+
 This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation.
+
 ### Vulnerability
+
 An unauthorized user could anonymously list account names and shared resources and use the information to attempt to guess passwords or perform social-engineering attacks.
+
 ### Countermeasure
+
 Enable the **Network access: Do not allow anonymous enumeration of SAM accounts and shares** setting.
+
 ### Potential impact
+
 It is impossible to grant access to users of another domain across a one-way trust because administrators in the trusting domain are unable to enumerate lists of accounts in the other domain. Users who access file and print servers anonymously are unable to list the shared network resources on those servers; the users must be authenticated before they can view the lists of shared folders and printers.
+
 ## Related topics
-[Security Options](security-options.md)
- 
- 
+
+- [Security Options](security-options.md)

windows/keep-secure/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts.md

@@ -2,85 +2,88 @@
 title: Network access Do not allow anonymous enumeration of SAM accounts (Windows 10)
 description: Describes the best practices, location, values, and security considerations for the Network access Do not allow anonymous enumeration of SAM accounts security policy setting.
 ms.assetid: 6ee25b33-ad43-4097-b031-7be680f64c7c
-ms.pagetype: security
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
+ms.pagetype: security
 author: brianlic-msft
+
 ---
+
 # Network access: Do not allow anonymous enumeration of SAM accounts
+
 **Applies to**
 -   Windows 10
+
 Describes the best practices, location, values, and security considerations for the **Network access: Do not allow anonymous enumeration of SAM accounts** security policy setting.
+
 ## Reference
+
 This policy setting determines which additional permissions will be assigned for anonymous connections to the device. Windows allows anonymous users to perform certain activities, such as enumerating the names of domain accounts and network shares. This is convenient, for example, when an administrator wants to give access to users in a trusted domain that does not maintain a reciprocal trust.
+
 This policy setting has no impact on domain controllers.
+
 Misuse of this policy setting is a common error that can cause data loss or problems with data access or security.
+
 ### Possible values
+
 -   Enabled
+
 -   Disabled
+
     No additional permissions can be assigned by the administrator for anonymous connections to the device. Anonymous connections will rely on default permissions.
+
 -   Not defined
+
 ### Location
+
 Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options
+
 ### Default values
+
 The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page.
-<table>
-<colgroup>
-<col width="50%" />
-<col width="50%" />
-</colgroup>
-<thead>
-<tr class="header">
-<th align="left">Server type or GPO</th>
-<th align="left">Default value</th>
-</tr>
-</thead>
-<tbody>
-<tr class="odd">
-<td align="left"><p>Default Domain Policy</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Default Domain Controller Policy</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Stand-Alone Server Default Settings</p></td>
-<td align="left"><p>Enabled</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>DC Effective Default Settings</p></td>
-<td align="left"><p>Enabled</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Member Server Effective Default Settings</p></td>
-<td align="left"><p>Enabled</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Client Computer Effective Default Settings</p></td>
-<td align="left"><p>Enabled</p></td>
-</tr>
-</tbody>
-</table>
+
+| Server type or GPO | Default value |
+| - | - |
+| Default Domain Policy| Not defined| 
+| Default Domain Controller Policy | Not defined| 
+| Stand-Alone Server Default Settings | Enabled|
+| DC Effective Default Settings | Enabled| 
+| Member Server Effective Default Settings| Enabled| 
+| Client Computer Effective Default Settings | Enabled| 
  
 ## Policy management
+
 This section describes features and tools that are available to help you manage this policy.
+
 ### Restart requirement
+
 None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy.
+
 ### Policy conflicts
+
 Even with this policy setting enabled, anonymous users will have access to resources with permissions that explicitly include the built-in group, ANONYMOUS LOGON (on systems earlier than Windows Server 2008 and Windows Vista).
+
 ### Group Policy
+
 This policy has no impact on domain controllers.
+
 ## Security considerations
+
 This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation.
+
 ### Vulnerability
+
 An unauthorized user could anonymously list account names and use the information to perform social engineering attacks or attempt to guess passwords. Social engineering attackers try to deceive users in some way to obtain passwords or some form of security information.
+
 ### Countermeasure
+
 Enable the **Network access: Do not allow anonymous enumeration of SAM accounts** setting.
+
 ### Potential impact
+
 It is impossible to grant access to users of another domain across a one-way trust because administrators in the trusting domain are unable to enumerate lists of accounts in the other domain. Users who access file and print servers anonymously are unable to list the shared network resources on those servers; the users must be authenticated before they can view the lists of shared folders and printers.
+
 ## Related topics
-[Security Options](security-options.md)
- 
- 
+
+- [Security Options](security-options.md)

windows/keep-secure/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication.md

@@ -2,91 +2,95 @@
 title: Network access Do not allow storage of passwords and credentials for network authentication (Windows 10)
 description: Describes the best practices, location, values, policy management and security considerations for the Network access Do not allow storage of passwords and credentials for network authentication security policy setting.
 ms.assetid: b9b64360-36ea-40fa-b795-2d6558c46563
-ms.pagetype: security
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
+ms.pagetype: security
 author: brianlic-msft
 ---
+
 # Network access: Do not allow storage of passwords and credentials for network authentication
+
 **Applies to**
 -   Windows 10
+
 Describes the best practices, location, values, policy management and security considerations for the **Network access: Do not allow storage of passwords and credentials for network authentication** security policy setting.
+
 ## Reference
+
 This security setting determines whether Credential Manager saves passwords and credentials for later use when it gains domain authentication.
+
 ### Possible values
+
 -   Enabled
+
     Credential Manager does not store passwords and credentials on the device
+
 -   Disabled
+
     Credential Manager will store passwords and credentials on this computer for later use for domain authentication.
+
 -   Not defined
+
 ### Best practices
+
 It is a recommended practice to disable the ability of the Windows operating system to cache credentials on any device where credentials are not needed. Evaluate your servers and workstations to determine the requirements. Cached credentials are designed primarily to be used on laptops that require domain credentials when disconnected from the domain.
+
 ### Location
+
 Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options
+
 ### Default values
+
 The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page.
-<table>
-<colgroup>
-<col width="50%" />
-<col width="50%" />
-</colgroup>
-<thead>
-<tr class="header">
-<th align="left">Server type or Group Policy Object (GPO)</th>
-<th align="left">Default value</th>
-</tr>
-</thead>
-<tbody>
-<tr class="odd">
-<td align="left"><p>Default domain policy</p></td>
-<td align="left"><p>Disabled</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Default domain controller policy</p></td>
-<td align="left"><p>Disabled</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Stand-alone server default settings</p></td>
-<td align="left"><p>Disabled</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Domain controller effective default settings</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Member server effective default settings</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Effective GPO default settings on client computers</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-</tbody>
-</table>
+
+| Server type or Group Policy Object (GPO) | Default value |
+| - | - |
+| Default domain policy| Disabled| 
+| Default domain controller policy| Disabled| 
+| Stand-alone server default settings | Disabled| 
+| Domain controller effective default settings| Not defined| 
+| Member server effective default settings | Not defined| 
+| Effective GPO default settings on client computers | Not defined| 
  
 ### Policy management
+
 This section describes features and tools that are available to help you manage this policy.
+
 ### Restart requirement
+
 A restart of the device is required before this policy will be effective when changes to this policy are saved locally or distributed through Group Policy.
+
 ### Group Policy
+
 This policy setting can be configured by using the Group Policy Management Console (GPMC) to be distributed through Group Policy Objects (GPOs). If this policy is not contained in a distributed GPO, this policy can be configured on the local computer by using the Local Security Policy snap-in.
+
 ## Security considerations
+
 This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation.
+
 ### Vulnerability
+
 Passwords that are cached can be accessed by the user when logged on to the device. Although this information may sound obvious, a problem can arise if the user unknowingly runs malicious software that reads the passwords and forwards them to another, unauthorized user.
-**Note**  
-The chances of success for this exploit and others that involve malicious software are reduced significantly for organizations that effectively implement and manage an enterprise antivirus solution combined with sensible software restriction policies.
+
+>**Note:**  The chances of success for this exploit and others that involve malicious software are reduced significantly for organizations that effectively implement and manage an enterprise antivirus solution combined with sensible software restriction policies.
  
 Regardless of what encryption algorithm is used to encrypt the password verifier, a password verifier can be overwritten so that an attacker can authenticate as the user to whom the verifier belongs. Therefore, the administrator's password may be overwritten. This procedure requires physical access to the device. Utilities exist that can help overwrite the cached verifier. By using one of these utilities, an attacker can authenticate by using the overwritten value.
+
 Overwriting the administrator's password does not help the attacker access data that is encrypted by using that password. Also, overwriting the password does not help the attacker access any Encrypting File System (EFS) data that belongs to other users on that device. Overwriting the password does not help an attacker replace the verifier, because the base keying material is incorrect. Therefore, data that is encrypted by using Encrypting File System or by using the Data Protection API (DPAPI) will not decrypt.
+
 ### Countermeasure
+
 Enable the **Network access: Do not allow storage of passwords and credentials for network authentication** setting.
+
 To limit the number of changed domain credentials that are stored on the computer, set the **cachedlogonscount** registry entry. By default, the operating system caches the verifier for each unique user's ten most recent valid logons. This value can be set to any value between 0 and 50. By default, all versions of the Windows operating system remember 10 cached logons, except Windows Server 2008 and later, which are set at 25.
+
 When you try to log on to a domain from a Windows-based client device, and a domain controller is unavailable, you do not receive an error message. Therefore, you may not notice that you logged on with cached domain credentials. You can set a notification of logon that uses cached domain credentials with the ReportDC registry entry.
+
 ### Potential impact
+
 Users are forced to type passwords whenever they log on to their Microsoft Account or other network resources that are not accessible to their domain account. This policy setting should have no impact on users who access network resources that are configured to allow access with their Active Directory–based domain account.
+
 ## Related topics
-[Security Options](security-options.md)
- 
- 
+
+- [Security Options](security-options.md)

windows/keep-secure/network-access-let-everyone-permissions-apply-to-anonymous-users.md

@@ -2,83 +2,83 @@
 title: Network access Let Everyone permissions apply to anonymous users (Windows 10)
 description: Describes the best practices, location, values, policy management and security considerations for the Network access Let Everyone permissions apply to anonymous users security policy setting.
 ms.assetid: cdbc5159-9173-497e-b46b-7325f4256353
-ms.pagetype: security
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
+ms.pagetype: security
 author: brianlic-msft
 ---
+
 # Network access: Let Everyone permissions apply to anonymous users
+
 **Applies to**
 -   Windows 10
+
 Describes the best practices, location, values, policy management and security considerations for the **Network access: Let Everyone permissions apply to anonymous users** security policy setting.
+
 ## Reference
+
 This policy setting determines what additional permissions are granted for anonymous connections to the device. If you enable this policy setting, anonymous users can enumerate the names of domain accounts and shared folders and perform certain other activities. This capability is convenient, for example, when an administrator wants to grant access to users in a trusted domain that does not maintain a reciprocal trust.
+
 By default, the token that is created for anonymous connections does not include the Everyone SID. Therefore, permissions that are assigned to the Everyone group do not apply to anonymous users.
+
 ### Possible values
+
 -   Enabled
+
     The Everyone SID is added to the token that is created for anonymous connections, and anonymous users can access any resource for which the Everyone group has been assigned permissions.
+
 -   Disabled
+
     The Everyone SID is removed from the token that is created for anonymous connections.
+
 -   Not defined
+
 ### Best practices
+
 -   Set this policy to **Disabled**.
+
 ### Location
+
 Computer Configuration\\Windows Settings\\Security Settings\\Local Polices\\Security Options
+
 ### Default values
+
 The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page.
-<table>
-<colgroup>
-<col width="50%" />
-<col width="50%" />
-</colgroup>
-<thead>
-<tr class="header">
-<th align="left">Server type or GPO</th>
-<th align="left">Default value</th>
-</tr>
-</thead>
-<tbody>
-<tr class="odd">
-<td align="left"><p>Default Domain Policy</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Default Domain Controller Policy</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Stand-Alone Server Default Settings</p></td>
-<td align="left"><p>Disabled</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>DC Effective Default Settings</p></td>
-<td align="left"><p>Disabled</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Member Server Effective Default Settings</p></td>
-<td align="left"><p>Disabled</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Client Computer Effective Default Settings</p></td>
-<td align="left"><p>Disabled</p></td>
-</tr>
-</tbody>
-</table>
+
+| Server type or GPO | Default value |
+| - | - |
+| Default Domain Policy| Not defined| 
+| Default Domain Controller Policy | Not defined| 
+| Stand-Alone Server Default Settings | Disabled| 
+| DC Effective Default Settings | Disabled| 
+| Member Server Effective Default Settings | Disabled| 
+| Client Computer Effective Default Settings | Disabled| 
  
 ## Policy management
+
 This section describes features and tools that are available to help you manage this policy.
+
 ### Restart requirement
+
 None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy.
+
 ## Security considerations
+
 This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation.
+
 ### Vulnerability
+
 An unauthorized user could anonymously list account names and shared resources and use the information to attempt to guess passwords, perform social engineering attacks, or launch DoS attacks.
+
 ### Countermeasure
+
 Disable the **Network access: Let Everyone permissions apply to anonymous users** setting.
+
 ### Potential impact
+
 None. This is the default configuration.
+
 ## Related topics
-[Security Options](security-options.md)
- 
- 
+
+- [Security Options](security-options.md)

windows/keep-secure/network-access-named-pipes-that-can-be-accessed-anonymously.md

@@ -2,129 +2,91 @@
 title: Network access Named Pipes that can be accessed anonymously (Windows 10)
 description: Describes the best practices, location, values, policy management and security considerations for the Network access Named Pipes that can be accessed anonymously security policy setting.
 ms.assetid: 8897d2a4-813e-4d2b-8518-fcee71e1cf2c
-ms.pagetype: security
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
+ms.pagetype: security
 author: brianlic-msft
 ---
+
 # Network access: Named Pipes that can be accessed anonymously
+
 **Applies to**
 -   Windows 10
+
 Describes the best practices, location, values, policy management and security considerations for the **Network access: Named Pipes that can be accessed anonymously** security policy setting.
+
 ## Reference
+
 This policy setting determines which communication sessions, or pipes, have attributes and permissions that allow anonymous access.
+
 Restricting access over named pipes such as COMNAP and LOCATOR helps prevent unauthorized access to the network.
+
 ### Possible values
+
 -   User-defined list of shared folders
 -   Not defined
+
 ### Best practices
+
 -   Set this policy to a null value; that is, enable the policy setting, but do not enter named pipes in the text box. This will disable null session access over named pipes, and applications that rely on this feature or on unauthenticated access to named pipes will no longer function.
+
 ### Location
+
 Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options
+
 ### Default values
+
 The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page.
-<table>
-<colgroup>
-<col width="50%" />
-<col width="50%" />
-</colgroup>
-<thead>
-<tr class="header">
-<th align="left">Server type or GPO</th>
-<th align="left">Default value</th>
-</tr>
-</thead>
-<tbody>
-<tr class="odd">
-<td align="left"><p>Default Domain Policy</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Default Domain Controller Policy</p></td>
-<td align="left"><p>Netlogon, samr, lsarpc</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Stand-Alone Server Default Settings</p></td>
-<td align="left"><p>Null</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>DC Effective Default Settings</p></td>
-<td align="left"><p>Netlogon, samr, lsarpc</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Member Server Effective Default Settings</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Client Computer Effective Default Settings</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-</tbody>
-</table>
+
+| Server type or GPO | Default value |
+| - | - |
+| Default Domain Policy | Not defined | 
+| Default Domain Controller Policy | Netlogon, samr, lsarpc| 
+| Stand-Alone Server Default Settings | Null| 
+| DC Effective Default Settings | Netlogon, samr, lsarpc| 
+| Member Server Effective Default Settings | Not defined| 
+| Client Computer Effective Default Settings | Not defined| 
  
 ## Policy management
+
 This section describes different features and tools available to help you manage this policy.
+
 ### Restart requirement
+
 None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy.
+
 ### Group Policy
+
 For this policy setting to take effect, you must also enable the [Network access: Restrict anonymous access to Named Pipes and Shares](network-access-restrict-anonymous-access-to-named-pipes-and-shares.md) setting.
+
 ## Security considerations
+
 This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation.
+
 ### Vulnerability
+
 You can restrict access over named pipes such as COMNAP and LOCATOR to help prevent unauthorized access to the network. The following list describes available named pipes and their purpose. These pipes were granted anonymous access in earlier versions of Windows and some legacy applications may still use them.
-<table>
-<colgroup>
-<col width="50%" />
-<col width="50%" />
-</colgroup>
-<thead>
-<tr class="header">
-<th align="left">Named pipe</th>
-<th align="left">Purpose</th>
-</tr>
-</thead>
-<tbody>
-<tr class="odd">
-<td align="left"><p>COMNAP</p></td>
-<td align="left"><p>SNABase named pipe. Systems network Architecture (SNA) is a collection of network protocols that were originally developed for IBM mainframe computers.</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>COMNODE</p></td>
-<td align="left"><p>SNA Server named pipe.</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>SQL\QUERY</p></td>
-<td align="left"><p>Default named pipe for SQL Server.</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>SPOOLSS</p></td>
-<td align="left"><p>Named pipe for the Print Spooler service.</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>EPMAPPER</p></td>
-<td align="left"><p>End Point Mapper named pipe.</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>LOCATOR</p></td>
-<td align="left"><p>Remote Procedure Call Locator service named pipe.</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>TrlWks</p></td>
-<td align="left"><p>Distributed Link Tracking Client named pipe.</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>TrkSvr</p></td>
-<td align="left"><p>Distributed Link Tracking Server named pipe.</p></td>
-</tr>
-</tbody>
-</table>
+
+| Named pipe | Purpose |
+| - | - |
+| COMNAP | SNABase named pipe. Systems network Architecture (SNA) is a collection of network protocols that were originally developed for IBM mainframe computers.| 
+| COMNODE| SNA Server named pipe.| 
+| SQL\QUERY | Default named pipe for SQL Server.| 
+| SPOOLSS | Named pipe for the Print Spooler service.| 
+| EPMAPPER | End Point Mapper named pipe.| 
+| LOCATOR | Remote Procedure Call Locator service named pipe.| 
+| TrlWks | Distributed Link Tracking Client named pipe.| 
+| TrkSvr | Distributed Link Tracking Server named pipe.| 
  
 ### Countermeasure
+
 Configure the **Network access: Named Pipes that can be accessed anonymously** setting to a null value (enable the setting but do not specify named pipes in the text box).
+
 ### Potential impact
+
 This configuration disables null-session access over named pipes, and applications that rely on this feature or on unauthenticated access to named pipes no longer function. This may break trust between Windows Server 2003 domains in a mixed mode environment.
+
 ## Related topics
-[Security Options](security-options.md)
- 
- 
+
+- [Security Options](security-options.md)

windows/keep-secure/network-access-remotely-accessible-registry-paths-and-subpaths.md

@@ -2,69 +2,57 @@
 title: Network access Remotely accessible registry paths and subpaths (Windows 10)
 description: Describes the best practices, location, values, and security considerations for the Network access Remotely accessible registry paths and subpaths security policy setting.
 ms.assetid: 3fcbbf70-a002-4f85-8e86-8dabad21928e
-ms.pagetype: security
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
+ms.pagetype: security
 author: brianlic-msft
 ---
+
 # Network access: Remotely accessible registry paths and subpaths
+
 **Applies to**
 -   Windows 10
+
 Describes the best practices, location, values, and security considerations for the **Network access: Remotely accessible registry paths and subpaths** security policy setting.
+
 ## Reference
+
 This policy setting determines which registry paths and subpaths are accessible when an application or process references the WinReg key to determine access permissions.
-The registry is a database for device configuration information, much of which is sensitive. A malicious user can use it to facilitate unauthorized activities. The chance of this happening is reduced by the fact that the default ACLs that are assigned throughout the registry are fairly restrictive, and they help protect it from access by unauthorized users.
+
+The registry is a database for device configuration information, much of which is sensitive. A malicious user can use it to facilitate unauthorized activities. The chance of this happening is reduced by the fact that the default ACLs that are assigned throughout the registry are fairly restrictive, 
+and they help protect it from access by unauthorized users.
+
 To allow remote access, you must also enable the Remote Registry service.
+
 ### Possible values
+
 -   User-defined list of paths
 -   Not Defined
+
 ### Best practices
+
 -   Set this policy to a null value; that is, enable the policy setting, but do not enter any paths in the text box. Remote management tools, such as the Microsoft Baseline Security Analyzer and Configuration Manager, require remote access to the registry. Removing the default registry paths from the list of accessible paths might cause these and other management tools to fail.
+
 ### Location
+
 Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options
+
 ### Default values
+
 The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page.
-<table>
-<colgroup>
-<col width="50%" />
-<col width="50%" />
-</colgroup>
-<thead>
-<tr class="header">
-<th align="left">Server type or GPO</th>
-<th align="left">Default value</th>
-</tr>
-</thead>
-<tbody>
-<tr class="odd">
-<td align="left"><p>Default Domain Policy</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Default Domain Controller Policy</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Stand-Alone Server Default Settings</p></td>
-<td align="left"><p>See the following registry key combination</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>DC Effective Default Settings</p></td>
-<td align="left"><p>See the following registry key combination</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Member Server Effective Default Settings</p></td>
-<td align="left"><p>See the following registry key combination</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Client Computer Effective Default Settings</p></td>
-<td align="left"><p>See the following registry key combination</p></td>
-</tr>
-</tbody>
-</table>
+
+| Server type or GPO | Default value |
+| - | - |
+| Default Domain Policy | Not defined| 
+| Default Domain Controller Policy | Not defined| 
+| Stand-Alone Server Default Settings | See the following registry key combination| 
+| DC Effective Default Settings | See the following registry key combination| 
+| Member Server Effective Default Settings | See the following registry key combination| 
+| Client Computer Effective Default Settings | See the following registry key combination| 
  
 The combination of all the following registry keys apply to the previous settings:
+
 1.  System\\CurrentControlSet\\Control\\Print\\Printers
 2.  System\\CurrentControlSet\\Services\\Eventlog
 3.  Software\\Microsoft\\OLAP Server
@@ -76,22 +64,33 @@ The combination of all the following registry keys apply to the previous setting
 9.  System\\CurrentControlSet\\Control\\Terminal Server\\DefaultUserConfiguration
 10. Software\\Microsoft\\Windows NT\\CurrentVersion\\Perflib
 11. System\\CurrentControlSet\\Services\\SysmonLog
+
 ## Policy management
+
 This section describes features and tools that are available to help you manage this policy.
+
 ### Restart requirement
+
 None. Changes to this policy become effective without a computer restart when they are saved locally or distributed through Group Policy.
+
 ## Security considerations
+
 This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation.
+
 ### Vulnerability
+
 The registry contains sensitive device configuration information that could be used by an attacker to facilitate unauthorized activities. The fact that the default ACLs that are assigned throughout the registry are fairly restrictive and help to protect the registry from access by unauthorized users reduces the risk of such an attack.
+
 ### Countermeasure
+
 Configure the **Network access: Remotely accessible registry paths and sub-paths** setting to a null value (enable the setting but do not enter any paths in the text box).
+
 ### Potential impact
+
 Remote management tools such as MBSA and Configuration Manager require remote access to the registry to properly monitor and manage those computers. If you remove the default registry paths from the list of accessible ones, such remote management tools could fail.
-**Note**  
-If you want to allow remote access, you must also enable the Remote Registry service.
+
+>**Note:**  If you want to allow remote access, you must also enable the Remote Registry service.
  
 ## Related topics
-[Security Options](security-options.md)
- 
- 
+
+- [Security Options](security-options.md)

windows/keep-secure/network-access-remotely-accessible-registry-paths.md

@@ -2,88 +2,86 @@
 title: Network access Remotely accessible registry paths (Windows 10)
 description: Describes the best practices, location, values, policy management and security considerations for the Network access Remotely accessible registry paths security policy setting.
 ms.assetid: 977f86ea-864f-4f1b-9756-22220efce0bd
-ms.pagetype: security
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
+ms.pagetype: security
 author: brianlic-msft
 ---
+
 # Network access: Remotely accessible registry paths
+
 **Applies to**
 -   Windows 10
+
 Describes the best practices, location, values, policy management and security considerations for the **Network access: Remotely accessible registry paths** security policy setting.
+
 ## Reference
+
 This policy setting determines which registry paths are accessible when an application or process references the WinReg key to determine access permissions.
+
 The registry is a database for device configuration information, much of which is sensitive. A malicious user can use the registry to facilitate unauthorized activities. To reduce the risk of this happening, suitable access control lists (ACLs) are assigned throughout the registry to help protect it from access by unauthorized users.
+
 To allow remote access, you must also enable the Remote Registry service.
+
 ### Possible values
+
 -   User-defined list of paths
 -   Not Defined
+
 ### Best practices
+
 -   Set this policy to a null value; that is, enable the policy setting but do not enter any paths in the text box. Remote management tools, such as the Microsoft Baseline Security Analyzer and Configuration Manager, require remote access to the registry. Removing the default registry paths from the list of accessible paths might cause these and other management tools to fail.
+
 ### Location
+
 Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options
+
 ### Default values
+
 The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page.
-<table>
-<colgroup>
-<col width="50%" />
-<col width="50%" />
-</colgroup>
-<thead>
-<tr class="header">
-<th align="left">Server type or GPO</th>
-<th align="left">Default value</th>
-</tr>
-</thead>
-<tbody>
-<tr class="odd">
-<td align="left"><p>Default Domain Policy</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Default Domain Controller Policy</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Stand-Alone Server Default Settings</p></td>
-<td align="left"><p>See the following registry key combination</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>DC Effective Default Settings</p></td>
-<td align="left"><p>See the following registry key combination</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Member Server Effective Default Settings</p></td>
-<td align="left"><p>See the following registry key combination</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Client Computer Effective Default Settings</p></td>
-<td align="left"><p>See the following registry key combination</p></td>
-</tr>
-</tbody>
-</table>
+
+| Server type or GPO | Default value |
+| - | - |
+| Default Domain Policy | Not defined| 
+| Default Domain Controller Policy | Not defined| 
+| Stand-Alone Server Default Settings | See the following registry key combination| 
+| DC Effective Default Settings | See the following registry key combination| 
+| Member Server Effective Default Settings | See the following registry key combination| 
+| Client Computer Effective Default Settings | See the following registry key combination| 
  
 The combination of all the following registry keys apply to the previous settings:
+
 1.  System\\CurrentControlSet\\Control\\ProductOptions
 2.  System\\CurrentControlSet\\Control\\Server Applications
 3.  Software\\Microsoft\\Windows NT\\CurrentVersion
+
 ## Policy management
+
 This section describes features and tools that are available to help you manage this policy.
+
 ### Restart requirement
+
 None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy.
+
 ## Security considerations
+
 This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation.
+
 ### Vulnerability
+
 An attacker could use information in the registry to facilitate unauthorized activities. To reduce the risk of such an attack, suitable ACLs are assigned throughout the registry to help protect it from access by unauthorized users.
+
 ### Countermeasure
+
 Configure the **Network access: Remotely accessible registry paths** setting to a null value (enable the setting, but do not enter any paths in the text box).
+
 ### Potential impact
+
 Remote management tools such as the Microsoft Baseline Security Analyzer (MBSA) and Configuration Manager require remote access to the registry to properly monitor and manage those computers. If you remove the default registry paths from the list of accessible ones, such remote management tools could fail.
-**Note**  
-If you want to allow remote access, you must also enable the Remote Registry service.
+
+>**Note:**  If you want to allow remote access, you must also enable the Remote Registry service.
  
 ## Related topics
-[Security Options](security-options.md)
- 
- 
+
+- [Security Options](security-options.md)

windows/keep-secure/network-access-restrict-anonymous-access-to-named-pipes-and-shares.md

@@ -2,81 +2,78 @@
 title: Network access Restrict anonymous access to Named Pipes and Shares (Windows 10)
 description: Describes the best practices, location, values, policy management and security considerations for the Network access Restrict anonymous access to Named Pipes and Shares security policy setting.
 ms.assetid: e66cd708-7322-4d49-9b57-1bf8ec7a4c10
-ms.pagetype: security
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
+ms.pagetype: security
 author: brianlic-msft
 ---
+
 # Network access: Restrict anonymous access to Named Pipes and Shares
+
 **Applies to**
 -   Windows 10
+
 Describes the best practices, location, values, policy management and security considerations for the **Network access: Restrict anonymous access to Named Pipes and Shares** security policy setting.
+
 ## Reference
-This policy setting enables or disables the restriction of anonymous access to only those shared folders and pipes that are named in the **Network access: Named pipes that can be accessed anonymously** and [Network access: Shares that can be accessed anonymously](network-access-shares-that-can-be-accessed-anonymously.md) settings. The setting controls null session access to shared folders on your computers by adding RestrictNullSessAccess with the value 1 in the registry key **HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Services\\LanManServer\\Parameters**. This registry value toggles null session shared folders on or off to control whether the Server service restricts unauthenticated clients' access to named resources.
+
+This policy setting enables or disables the restriction of anonymous access to only those shared folders and pipes that are named in the **Network access: Named pipes that can be accessed anonymously** and [Network access: Shares that can be accessed anonymously](network-access-shares-that-can-be-accessed-anonymously.md) settings. The setting controls null session access to shared folders on your computers by adding RestrictNullSessAccess with the value 1 in the registry key 
+**HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Services\\LanManServer\\Parameters**. This registry value toggles null session shared folders on or off to control whether the Server service restricts unauthenticated clients' access to named resources.
+
 Null sessions are a weakness that can be exploited through the various shared folders on the devices in your environment.
+
 ### Possible values
+
 -   Enabled
 -   Disabled
 -   Not defined
+
 ### Best practices
+
 -   Set this policy to Enabled. Enabling this policy setting restricts null session access to unauthenticated users to all server pipes and shared folders except those listed in the **NullSessionPipes** and **NullSessionShares** registry entries.
+
 ### Location
+
 Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options
+
 ### Default values
+
 The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page.
-<table>
-<colgroup>
-<col width="50%" />
-<col width="50%" />
-</colgroup>
-<thead>
-<tr class="header">
-<th align="left">Server type or GPO</th>
-<th align="left">Default value</th>
-</tr>
-</thead>
-<tbody>
-<tr class="odd">
-<td align="left"><p>Default Domain Policy</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Default Domain Controller Policy</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Stand-Alone Server Default Settings</p></td>
-<td align="left"><p>Enabled</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>DC Effective Default Settings</p></td>
-<td align="left"><p>Enabled</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Member Server Effective Default Settings</p></td>
-<td align="left"><p>Enabled</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Client Computer Effective Default Settings</p></td>
-<td align="left"><p>Enabled</p></td>
-</tr>
-</tbody>
-</table>
+
+| Server type or GPO | Default value |
+| - | - |
+| Default Domain Policy| Not defined| 
+| Default Domain Controller Policy | Not defined| 
+| Stand-Alone Server Default Settings | Enabled| 
+| DC Effective Default Settings | Enabled| 
+| Member Server Effective Default Settings | Enabled| 
+| Client Computer Effective Default Settings| Enabled| 
  
 ## Policy management
+
 This section describes features and tools that are available to help you manage this policy.
+
 ### Restart requirement
+
 None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy.
+
 ## Security considerations
+
 This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation.
+
 ### Vulnerability
+
 Null sessions are a weakness that can be exploited through shared folders (including the default shared folders) on devices in your environment.
+
 ### Countermeasure
+
 Enable the **Network access: Restrict anonymous access to Named Pipes and Shares** setting.
+
 ### Potential impact
+
 You can enable this policy setting to restrict null-session access for unauthenticated users to all server pipes and shared folders except those that are listed in the NullSessionPipes and NullSessionShares entries.
+
 ## Related topics
-[Security Options](security-options.md)
- 
- 
+
+- [Security Options](security-options.md)

windows/keep-secure/network-access-shares-that-can-be-accessed-anonymously.md

@@ -2,79 +2,74 @@
 title: Network access Shares that can be accessed anonymously (Windows 10)
 description: Describes the best practices, location, values, policy management and security considerations for the Network access Shares that can be accessed anonymously security policy setting.
 ms.assetid: f3e4b919-8279-4972-b415-5f815e2f0a1a
-ms.pagetype: security
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
+ms.pagetype: security
 author: brianlic-msft
 ---
+
 # Network access: Shares that can be accessed anonymously
+
 **Applies to**
 -   Windows 10
+
 Describes the best practices, location, values, policy management and security considerations for the **Network access: Shares that can be accessed anonymously** security policy setting.
+
 ## Reference
+
 This policy setting determines which shared folders can be accessed by anonymous users.
+
 ### Possible values
+
 -   User-defined list of shared folders
 -   Not Defined
+
 ### Best practices
+
 -   Set this policy to a null value. There should be little impact because this is the default value. All users will have to be authenticated before they can access shared resources on the server.
+
 ### Location
+
 Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options
+
 ### Default values
+
 The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page.
-<table>
-<colgroup>
-<col width="50%" />
-<col width="50%" />
-</colgroup>
-<thead>
-<tr class="header">
-<th align="left">Server type or GPO</th>
-<th align="left">Default value</th>
-</tr>
-</thead>
-<tbody>
-<tr class="odd">
-<td align="left"><p>Default Domain Policy</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Default Domain Controller Policy</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Stand-Alone Server Default Settings</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>DC Effective Default Settings</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Member Server Effective Default Settings</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Client Computer Effective Default Settings</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-</tbody>
-</table>
+
+| Server type or GPO | Default value |
+| - | - |
+| Default Domain Policy| Not defined| 
+| Default Domain Controller Policy | Not defined| 
+| Stand-Alone Server Default Settings | Not defined| 
+| DC Effective Default Settings | Not defined| 
+| Member Server Effective Default Settings | Not defined| 
+| Client Computer Effective Default Settings | Not defined| 
  
 ## Policy management
+
 This section describes features and tools that are available to help you manage this policy.
+
 ### Restart requirement
+
 None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy.
+
 ## Security considerations
+
 This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation.
+
 ### Vulnerability
+
 Any shared folders that are listed can be accessed by any network user, which could lead to the exposure or corruption of sensitive data.
+
 ### Countermeasure
+
 Configure the **Network access: Shares that can be accessed anonymously** setting to a null value.
+
 ### Potential impact
+
 There should be little impact because this is the default configuration. Only authenticated users have access to shared resources on the server.
+
 ## Related topics
-[Security Options](security-options.md)
- 
- 
+
+- [Security Options](security-options.md)

windows/keep-secure/network-access-sharing-and-security-model-for-local-accounts.md

@@ -2,88 +2,85 @@
 title: Network access Sharing and security model for local accounts (Windows 10)
 description: Describes the best practices, location, values, policy management and security considerations for the Network access Sharing and security model for local accounts security policy setting.
 ms.assetid: 0b3d703c-ea27-488f-8f59-b345af75b994
-ms.pagetype: security
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
+ms.pagetype: security
 author: brianlic-msft
 ---
+
 # Network access: Sharing and security model for local accounts
+
 **Applies to**
 -   Windows 10
+
 Describes the best practices, location, values, policy management and security considerations for the **Network access: Sharing and security model for local accounts** security policy setting.
+
 ## Reference
+
 This policy setting determines how network logons that use local accounts are authenticated. If you configure this policy setting to Classic, network logons that use local account credentials authenticate with those credentials. If you configure this policy setting to Guest only, network logons that use local accounts are automatically mapped to the Guest account. The Classic model provides precise control over access to resources, and it enables you to grant different types of access to different users for the same resource. Conversely, the Guest only model treats all users equally, and they all receive the same level of access to a given resource, which can be either Read Only or Modify.
-**Note**  
-This policy setting does not affect network logons that use domain accounts. Nor does this policy setting affect interactive logons that are performed remotely through services such as Telnet or Remote Desktop Services.
+
+>**Note:**  This policy setting does not affect network logons that use domain accounts. Nor does this policy setting affect interactive logons that are performed remotely through services such as Telnet or Remote Desktop Services.
 When the device is not joined to a domain, this policy setting also tailors the **Sharing** and **Security** tabs in Windows Explorer to correspond to the sharing and security model that is being used.
  
 When the value of this policy setting is **Guest only - local users authenticate as Guest**, any user who can access your device over the network does so with Guest user rights. This means that they will probably be unable to write to shared folders. Although this does increase security, it makes it impossible for authorized users to access shared resources on those systems. When the value is **Classic - local users authenticate as themselves**, local accounts must be password-protected; otherwise, anyone can use those user accounts to access shared system resources.
+
 ### Possible values
+
 -   Classic - Local users authenticate as themselves
 -   Guest only - Local users authenticate as Guest
 -   Not defined
+
 ### Best practices
+
 1.  For network servers, set this policy to **Classic - local users authenticate as themselves**.
 2.  On end-user systems, set this policy to **Guest only - local users authenticate as Guest**.
+
 ### Location
+
 Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options
+
 ### Default values
+
 The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page.
-<table>
-<colgroup>
-<col width="50%" />
-<col width="50%" />
-</colgroup>
-<thead>
-<tr class="header">
-<th align="left">Server type or GPO</th>
-<th align="left">Default value</th>
-</tr>
-</thead>
-<tbody>
-<tr class="odd">
-<td align="left"><p>Default Domain Policy</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Default Domain Controller Policy</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Stand-Alone Server Default Settings</p></td>
-<td align="left"><p>Classic (local users authenticate as themselves)</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>DC Effective Default Settings</p></td>
-<td align="left"><p>Classic (local users authenticate as themselves)</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Member Server Effective Default Settings</p></td>
-<td align="left"><p>Classic (local users authenticate as themselves)</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Client Computer Effective Default Settings</p></td>
-<td align="left"><p>Classic (local users authenticate as themselves)</p></td>
-</tr>
-</tbody>
-</table>
+
+| Server type or GPO | Default value |
+| - | - |
+| Default Domain Policy | Not defined| 
+| Default Domain Controller Policy | Not defined| 
+| Stand-Alone Server Default Settings | Classic (local users authenticate as themselves)| 
+| DC Effective Default Settings | Classic (local users authenticate as themselves)| 
+| Member Server Effective Default Settings | Classic (local users authenticate as themselves)| 
+| Client Computer Effective Default Settings | Classic (local users authenticate as themselves)| 
  
 ## Policy management
+
 This section describes features and tools that are available to help you manage this policy.
+
 ### Restart requirement
+
 None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy.
+
 ### Group Policy
+
 This policy setting can be configured by using the Group Policy Management Console (GPMC) to be distributed through Group Policy Objects (GPOs). If this policy is not contained in a distributed GPO, this policy can be configured on the local computer by using the Local Security Policy snap-in.
+
 ## Security considerations
+
 This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation.
+
 ### Vulnerability
+
 With the Guest only model, any user who can authenticate to your device over the network does so with Guest privileges, which probably means that they do not have Write access to shared resources on that device. Although this restriction does increase security, it makes it more difficult for authorized users to access shared resources on those computers because ACLs on those resources must include access control entries (ACEs) for the Guest account. With the Classic model, local accounts should be password protected. Otherwise, if Guest access is enabled, anyone can use those user accounts to access shared system resources.
+
 ### Countermeasure
+
 For network servers, configure the **Network access: Sharing and security model for local accounts setting** to **Classic – local users authenticate as themselves**. On end-user computers, configure this policy setting to **Guest only – local users authenticate as guest**.
+
 ### Potential impact
+
 None. This is the default configuration.
+
 ## Related topics
-[Security Options](security-options.md)
- 
- 
+
+- [Security Options](security-options.md)

windows/keep-secure/network-list-manager-policies.md

@@ -2,50 +2,75 @@
 title: Network List Manager policies (Windows 10)
 description: Network List Manager policies are security settings that you can use to configure different aspects of how networks are listed and displayed on one device or on many devices.
 ms.assetid: bd8109d4-b07c-4beb-a9a6-affae2ba2fda
-ms.pagetype: security
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
+ms.pagetype: security
 author: brianlic-msft
 ---
+
 # Network List Manager policies
+
 **Applies to**
 -   Windows 10
+
 Network List Manager policies are security settings that you can use to configure different aspects of how networks are listed and displayed on one device or on many devices.
+
 To configure Network List Manager Policies for one device, you can use the Microsoft Management Console (MMC) with the Group Policy Object Editor snap-in, and edit the local computer policy. The Network List Manager Policies are located at the following path in Group Policy Object Editor:
 **Computer Configuration | Windows Settings | Security Settings | Network List Manager Policies**
+
 To configure Network List Manager Policies for many computers, such as for all of the Domain Computers in an Active Directory domain, follow Group Policy documentation to learn how to edit the policies for the object that you require. The path to the Network List Manager Policies is the same as the path listed above.
+
 ### Policy settings for Network List Manager Policies
+
 The following policy settings are provided for Network List Manager Policies. These policy settings are located in the details pane of the Group Policy Object Editor, in **Network Name**.
+
 ### Unidentified Networks
-This policy setting allows you to configure the **Network Location**, including the location type and the user permissions, for networks that Windows cannot identify due to a network issue or a lack of identifiable characters in the network information received by the operating system from the network. A network location identifies the type of network that a computer is connected to and automatically sets the appropriate firewall settings for that location. You can configure the following items for this policy setting:
+
+This policy setting allows you to configure the **Network Location**, including the location type and the user permissions, for networks that Windows cannot identify due to a network issue or a lack of identifiable characters in the network information received by the operating system from the 
+network. A network location identifies the type of network that a computer is connected to and automatically sets the appropriate firewall settings for that location. You can configure the following items for this policy setting:
+
 -   **Location type**. For this item, the following options are available:
+
     -   **Not configured**. If you select this option, this policy setting does not apply a location type to unidentified network connections.
     -   **Private**. If you select this option, this policy setting applies a location type of Private to unidentified network connections. A private network, such as a home or work network, is a location type that assumes that you trust the other computers on the network. Do not select this item if there is a possibility that an active, unidentified network is in a public place.
+
     -   **Public**. If you select this option, this policy setting applies a location type of Public to unidentified network connections. A public network, such as a wireless network at an airport or coffee shop, is a location type that assumes that you do not trust the other computers on the network.
+
 -   **User permissions**. For this item, the following options are available:
+
     -   **Not configured**. If you select this option, this policy setting does not specify whether users can change the location for unidentified network connections.
     -   **User can change location**. If you select this option, this policy setting allows users to change an unidentified network connection location from Private to Public or from Public to Private.
     -   **User cannot change location**. If you select this option, this policy setting does not allow users to change the location of an unidentified network connection.
+
 ### Identifying Networks
+
 This policy setting allows you to configure the **Network Location** for networks that are in a temporary state while Windows works to identify the network and location type. A network location identifies the type of network that a computer is connected to and automatically sets the appropriate firewall settings for that location. You can configure the following items for this policy setting:
+
 -   **Location type**. For this item, the following options are available:
+
     -   **Not configured**. If you select this option, this policy setting does not apply a location type to network connections that are in the process of being identified by Windows.
     -   **Private**. If you select this option, this policy setting applies a location type of Private to network connections that are in the process of being identified. A private network, such as a home or work network, is a location type that assumes that you trust the other devices on the network. Do not select this item if there is a possibility that an active, unidentified network is in a public place.
     -   **Public**. If you select this option, this policy setting applies a location type of Public to network connections that are in the process of being identified by Windows. A public network, such as a wireless network at an airport or coffee shop, is a location type that assumes that you do not trust the other devices on the network.
+
 ### All Networks
+
 This policy setting allows you to specify the **User Permissions** that control whether users can change the network name, location, or icon, for all networks to which the user connects. You can configure the following items for this policy setting:
+
 -   **Network name**. For this item, the following options are available:
+
     -   **Not configured**. If you select this option, this policy setting does not specify whether users can change the network name for all network connections.
     -   **User can change name**. If you select this option, users can change the network name for all networks to which they connect.
     -   **User cannot change name**. If you select this option, users cannot change the network name for any networks to which they connect.
+
 -   **Network location**. For this item, the following options are available:
+
     -   **Not configured**. If you select this option, this policy setting does not specify whether users can change the location for all network connections.
     -   **User can change location**. If you select this option, this policy setting allows users to change all network locations from Private to Public or from Public to Private.
     -   **User cannot change location**. If you select this option, this policy setting does not allow users to change the location for any networks to which they connect.
+
 -   **Network icon**. For this item, the following options are available:
+
     -   **Not configured**. If you select this option, this policy setting does not specify whether users can change the network icon for all network connections.
     -   **User can change icon**. If you select this option, this policy setting allows users to change the network icon for all networks to which the user connects.
     -   **User cannot change icon**. If you select this option, this policy setting does not allow users to change the network icon for any networks to which the user connects.
- 
- 

windows/keep-secure/network-security-allow-local-system-to-use-computer-identity-for-ntlm.md

@@ -2,115 +2,87 @@
 title: Network security Allow Local System to use computer identity for NTLM (Windows 10)
 description: Describes the location, values, policy management, and security considerations for the Network security Allow Local System to use computer identity for NTLM security policy setting.
 ms.assetid: c46a658d-b7a4-4139-b7ea-b9268c240053
-ms.pagetype: security
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
+ms.pagetype: security
 author: brianlic-msft
 ---
+
 # Network security: Allow Local System to use computer identity for NTLM
+
 **Applies to**
 -   Windows 10
+
 Describes the location, values, policy management, and security considerations for the **Network security: Allow Local System to use computer identity for NTLM** security policy setting.
+
 ## Reference
+
 When services connect to devices that are running versions of the Windows operating system earlier than Windows Vista or Windows Server 2008, services that run as Local System and use SPNEGO (Negotiate) that revert to NTLM will authenticate anonymously. In Windows Server 2008 R2 and Windows 7 and later, if a service connects to a computer running Windows Server 2008 or Windows Vista, the system service uses the computer identity.
+
 When a service connects with the device identity, signing and encryption are supported to provide data protection. (When a service connects anonymously, a system-generated session key is created, which provides no protection, but it allows applications to sign and encrypt data without errors. Anonymous authentication uses a NULL session, which is a session with a server in which no user authentication is performed; and therefore, anonymous access is allowed.)
+
 ### Possible values
-<table>
-<colgroup>
-<col width="33%" />
-<col width="33%" />
-<col width="33%" />
-</colgroup>
-<thead>
-<tr class="header">
-<th align="left">Setting</th>
-<th align="left">Windows Server 2008 and Windows Vista</th>
-<th align="left">At least Windows Server 2008 R2 and Windows 7</th>
-</tr>
-</thead>
-<tbody>
-<tr class="odd">
-<td align="left"><p>Enabled</p></td>
-<td align="left"><p>Services running as Local System that use Negotiate will use the computer identity. This might cause some authentication requests between Windows operating systems to fail and log an error.</p></td>
-<td align="left"><p>Services running as Local System that use Negotiate will use the computer identity. This is the default behavior.</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Disabled</p></td>
-<td align="left"><p>Services running as Local System that use Negotiate when reverting to NTLM authentication will authenticate anonymously. This is the default behavior.</p></td>
-<td align="left"><p>Services running as Local System that use Negotiate when reverting to NTLM authentication will authenticate anonymously.</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Neither</p></td>
-<td align="left"><p>Services running as Local System that use Negotiate when reverting to NTLM authentication will authenticate anonymously.</p></td>
-<td align="left"><p>Services running as Local System that use Negotiate will use the computer identity. This might cause some authentication requests between Windows operating systems to fail and log an error.</p></td>
-</tr>
-</tbody>
-</table>
+
+| Setting | Windows Server 2008 and Windows Vista | At least Windows Server 2008 R2 and Windows 7 |
+| - | - |
+| Enabled | Services running as Local System that use Negotiate will use the computer identity. This might cause some authentication requests between Windows operating systems to fail and log an error.| Services running as Local System that use Negotiate will use the computer identity. This is the default behavior. |
+| Disabled| Services running as Local System that use Negotiate when reverting to NTLM authentication will authenticate anonymously. This is the default behavior.| Services running as Local System that use Negotiate when reverting to NTLM authentication will authenticate anonymously.|
+|Neither|Services running as Local System that use Negotiate when reverting to NTLM authentication will authenticate anonymously. | Services running as Local System that use Negotiate will use the computer identity. This might cause some authentication requests between Windows operating systems to fail and log an error.| 
  
 ### Location
+
 Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options
 ### Default values
+
 The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page.
-<table>
-<colgroup>
-<col width="50%" />
-<col width="50%" />
-</colgroup>
-<thead>
-<tr class="header">
-<th align="left">Server type or Group Policy object (GPO)</th>
-<th align="left">Default value</th>
-</tr>
-</thead>
-<tbody>
-<tr class="odd">
-<td align="left"><p>Default domain policy</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Default domain controller policy</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Stand-alone server default settings</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Domain controller effective default settings</p></td>
-<td align="left"><p>Not applicable</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Member server effective default settings</p></td>
-<td align="left"><p>Not applicable</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Effective GPO default settings on client computers</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-</tbody>
-</table>
+
+| Server type or Group Policy object (GPO) | Default value |
+| - | - |
+| Default domain policy| Not defined| 
+| Default domain controller policy | Not defined| 
+| Stand-alone server default settings | Not defined| 
+| Domain controller effective default settings | Not applicable| 
+| Member server effective default settings | Not applicable| 
+| Effective GPO default settings on client computers | Not defined| 
  
 ## Policy management
+
 This section describes features and tools that are available to help you manage this policy.
+
 ### Restart requirement
+
 None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy.
+
 ### Policy conflict considerations
+
 The policy [Network security: Allow LocalSystem NULL session fallback](network-security-allow-localsystem-null-session-fallback.md), if enabled, will allow NTLM or Kerberos authentication to be used when a system service attempts authentication. This will increase the success of interoperability at the expense of security.
+
 The anonymous authentication behavior is different for Windows Server 2008 and Windows Vista than later versions of Windows. Configuring and applying this policy setting on those systems might not produce the same results.
+
 ### Group Policy
+
 This policy setting can be configured by using the Group Policy Management Console (GPMC) to be distributed through Group Policy Objects (GPOs). If this policy is not contained in a distributed GPO, this policy can be configured on the local computer by using the Local Security Policy snap-in.
+
 ## Security considerations
+
 This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation.
+
 ### Vulnerability
+
 When a service connects to computers running versions of Windows earlier than Windows Vista or Windows Server 2008, services that run as Local System and use SPNEGO (Negotiate) that revert to NTLM will use NULL session. In Windows Server 2008 R2 and Windows 7 and later, if a service connects to a computer running Windows Server 2008 or Windows Vista, the system service uses the computer identity.
+
 When a service connects with the computer identity, signing and encryption are supported to provide data protection. When a service connects with a NULL session, a system-generated session key is created, which provides no protection, but it allows applications to sign and encrypt data without errors.
+
 ### Countermeasure
+
 You can configure the **Network security: Allow Local System to use computer identity for NTLM** security policy setting to allow Local System services that use Negotiate to use the computer identity when reverting to NTLM authentication.
+
 ### Potential impact
+
 If you do not configure this policy setting on Windows Server 2008 and Windows Vista, services running as Local System that use the default credentials will use the NULL session and revert to NTLM authentication for Windows operating systems earlier than Windows Vista or Windows Server 2008.
 Beginning with Windows Server 2008 R2 and Windows 7, the system allows Local System services that use Negotiate to use the computer identity when reverting to NTLM authentication.
+
 ## Related topics
-[Security Options](security-options.md)
- 
- 
+
+- [Security Options](security-options.md)

windows/keep-secure/network-security-allow-localsystem-null-session-fallback.md

@@ -2,78 +2,75 @@
 title: Network security Allow LocalSystem NULL session fallback (Windows 10)
 description: Describes the best practices, location, values, and security considerations for the Network security Allow LocalSystem NULL session fallback security policy setting.
 ms.assetid: 5b72edaa-bec7-4572-b6f0-648fc38f5395
-ms.pagetype: security
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
+ms.pagetype: security
 author: brianlic-msft
 ---
+
 # Network security: Allow LocalSystem NULL session fallback
+
 **Applies to**
 -   Windows 10
+
 Describes the best practices, location, values, and security considerations for the **Network security: Allow LocalSystem NULL session fallback** security policy setting.
+
 ## Reference
-This policy affects session security during the authentication process between devices running Windows Server 2008 R2 and Windows 7 and later and those devices running earlier versions of the Windows operating system. For computers running Windows Server 2008 R2 and Windows 7 and later, services running as Local System require a service principal name (SPN) to generate the session key. However, if [Network security: Allow Local System to use computer identity for NTLM](network-security-allow-local-system-to-use-computer-identity-for-ntlm.md) is set to disabled, services running as Local System will fall back to using NULL session authentication when they transmit data to servers running versions of Windows earlier than Windows Vista or Windows Server 2008. NULL session does not establish a unique session key for each authentication; and thus, it cannot provide integrity or confidentiality protection. The setting **Network security: Allow LocalSystem NULL session fallback** determines whether services that request the use of session security are allowed to perform signature or encryption functions with a well-known key for application compatibility.
+
+This policy affects session security during the authentication process between devices running Windows Server 2008 R2 and Windows 7 and later and those devices running earlier versions of the Windows operating system. For computers running Windows Server 2008 R2 and Windows 7 and later, services running as Local System require a service principal name (SPN) to generate the session key. However, if [Network security: Allow Local System to use computer identity for NTLM](network-security-allow-local-system-to-use-computer-identity-for-ntlm.md) is set to disabled, services running as Local 
+System will fall back to using NULL session authentication when they transmit data to servers running versions of Windows earlier than Windows Vista or Windows Server 2008. NULL session does not establish a unique session key for each authentication; and thus, it cannot provide integrity or confidentiality protection. The setting **Network security: Allow LocalSystem NULL session fallback** determines whether services that request the use of session security are allowed to perform signature or encryption functions with a well-known key for application compatibility.
+
 ### Possible values
+
 -   **Enabled**
+
     When a service running as Local System connects with a NULL session, a system-generated session key is created, which provides no protection but allows applications to sign and encrypt data without errors. This increases application compatibility, but it degrades the level of security.
+
 -   **Disabled**
-    When a service running as Local System connects with a NULL session, session security will be unavailable. Calls seeking encryption or signing will fail. This setting is more secure, but at the risk of degrading application incompatibility. Calls that are using the device identity instead of a NULL session will still have full use of session security.
+
+    When a service running as Local System connects with a NULL session, session security will be unavailable. Calls seeking encryption or signing will fail. This setting is more secure, but at the risk of degrading application incompatibility. Calls that are using the device identity instead of a 
+    NULL session will still have full use of session security.
+
 -   Not defined. When this policy is not defined, the default takes effect. This is Enabled for versions of the Windows operating system earlier than Windows Server 2008 R2 and Windows 7, and it is Disabled otherwise.
+
 ### Best practices
+
 When services connect with the device identity, signing and encryption are supported to provide data protection. When services connect with a NULL session, this level of data protection is not provided. However, you will need to evaluate your environment to determine the Windows operating system versions that you support. If this policy is enabled, some services may not be able to authenticate.
+
 This policy applies to Windows Server 2008 and Windows Vista (SP1 and later). When your environment no longer requires support for Windows NT 4, this policy should be disabled. By default, it is disabled in Windows 7 and Windows Server 2008 R2 and later.
+
 ### Location
+
 Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options
+
 ### Default values
-<table>
-<colgroup>
-<col width="50%" />
-<col width="50%" />
-</colgroup>
-<thead>
-<tr class="header">
-<th align="left">Server type or Group Policy Object (GPO)</th>
-<th align="left">Default value</th>
-</tr>
-</thead>
-<tbody>
-<tr class="odd">
-<td align="left"><p>Default domain policy</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Default domain controller policy</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Stand-alone server default settings</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Domain controller effective default settings</p></td>
-<td align="left"><p>Not applicable</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Member server effective default settings</p></td>
-<td align="left"><p>Not applicable</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Effective GPO default settings on client computers</p></td>
-<td align="left"><p>Not applicable</p></td>
-</tr>
-</tbody>
-</table>
+
+| Server type or Group Policy Object (GPO) | Default value |
+| - | - |
+| Default domain policy| Not defined| 
+| Default domain controller policy | Not defined| 
+| Stand-alone server default settings | Not defined| 
+| Domain controller effective default settings | Not applicable| 
+| Member server effective default settings | Not applicable |
+| Effective GPO default settings on client computers | Not applicable| 
  
 ## Security considerations
+
 This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation.
+
 ### Vulnerability
+
 If this setting is Enabled, when a service connects with a NULL session, a system-generated session key is created, which provides no protection but allows applications to sign and encrypt data without errors. Data that is intended to be protected might be exposed.
+
 ### Countermeasure
+
 You can configure the computer to use the computer identity for Local System with the policy **Network security: Allow Local System to use computer identity for NTLM**. If that is not possible, this policy can be used to prevent data from being exposed in transit if it was protected with a well-known key.
+
 ### Potential impact
+
 If you enable this policy, services that use NULL session with Local System could fail to authenticate because they will be prohibited from using signing and encryption.
+
 ## Related topics
-[Security Options](security-options.md)
- 
- 
+
+- [Security Options](security-options.md)

windows/keep-secure/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities.md

@@ -2,83 +2,79 @@
 title: Network security Allow PKU2U authentication requests to this computer to use online identities (Windows 10)
 description: Describes the best practices, location, and values for the Network Security Allow PKU2U authentication requests to this computer to use online identities security policy setting.
 ms.assetid: e04a854e-d94d-4306-9fb3-56e9bd7bb926
-ms.pagetype: security
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
+ms.pagetype: security
 author: brianlic-msft
 ---
+
 # Network security: Allow PKU2U authentication requests to this computer to use online identities
+
 **Applies to**
 -   Windows 10
+
 Describes the best practices, location, and values for the **Network Security: Allow PKU2U authentication requests to this computer to use online identities** security policy setting.
+
 ## Reference
+
 Starting with Windows Server 2008 R2 and Windows 7, the Negotiate Security Support Provider (SSP) supports an extension SSP, Negoexts.dll. This extension SSP is treated as an authentication protocol by the Windows operating system, and it supports SSPs from Microsoft, including PKU2U. You can also develop or add other SSPs.
+
 When devices are configured to accept authentication requests by using online IDs, Negoexts.dll calls the PKU2U SSP on the computer that is used to log on. The PKU2U SSP obtains a local certificate and exchanges the policy between the peer computers. When validated on the peer computer, the certificate within the metadata is sent to the logon peer for validation. It associates the user's certificate to a security token, and then the logon process completes.
-**Note**  
-The ability to link online IDs can be performed by anyone with an account that has standard user’s credentials through **Credential Manager**.
+
+>**Note:**  The ability to link online IDs can be performed by anyone with an account that has standard user’s credentials through **Credential Manager**.
  
 This policy is not configured by default on domain-joined devices. This would disallow the online identities to be able to authenticate to the domain-joined computers in Windows 7 and later.
+
 ### Possible values
+
 -   **Enabled**
+
     This will allow authentication to successfully complete between the two (or more) computers that have established a peer relationship through the use on online IDs. The PKU2U SSP obtains a local certificate and exchanges the policy between the peer devices. When validated on the peer computer, the certificate within the metadata is sent to the logon peer for validation. It associates the user's certificate to a security token, and then the logon process completes.
+
 -   **Disabled**
+
     This will prevent online IDs from being used to authenticate the user to another computer in a peer-to-peer relationship.
+
 -   Not set. Not configuring this policy prevents online IDs from being used to authenticate the user. This is the default on domain-joined devices
+
 ### Best practices
+
 Within a domain, domain accounts should be used for authentication. Set this policy to **Disabled** or do not configure this policy to exclude online identities from being used to authenticate.
+
 ### Location
+
 Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options
+
 ### Default values
+
 The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page.
-<table>
-<colgroup>
-<col width="50%" />
-<col width="50%" />
-</colgroup>
-<thead>
-<tr class="header">
-<th align="left">Server type or Group Policy Object (GPO)</th>
-<th align="left">Default value</th>
-</tr>
-</thead>
-<tbody>
-<tr class="odd">
-<td align="left"><p>Default domain policy</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Default domain controller policy</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Stand-alone server default settings</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Domain controller effective default settings</p></td>
-<td align="left"><p>Disabled</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Member server effective default settings</p></td>
-<td align="left"><p>Disabled</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Effective GPO default settings on client computers</p></td>
-<td align="left"><p>Disabled</p></td>
-</tr>
-</tbody>
-</table>
+
+| Server type or Group Policy Object (GPO) | Default value |
+| - | - |
+| Default domain policy| Not defined| 
+| Default domain controller policy | Not defined| 
+| Stand-alone server default settings | Not defined| 
+| Domain controller effective default settings | Disabled| 
+| Member server effective default settings | Disabled| 
+| Effective GPO default settings on client computers | Disabled| 
  
 ## Security considerations
+
 This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation.
+
 ### Vulnerability
+
 Enabling this policy setting allows a user’s account on one computer to be associated with an online identity, such as Microsoft Account, so that account can log on to a peer device (if the peer device is likewise configured) without the use of a Windows logon account (domain or local). Although this is beneficial for workgroups or home groups, using this feature in a domain-joined environment might circumvent your established security policies.
+
 ### Countermeasure
+
 Set this policy to Disabled or do not configure this security policy for domain-joined devices.
+
 ### Potential impact
+
 If you do not set or disable this policy, the PKU2U protocol will not be used to authenticate between peer devices, which forces users to follow domain defined access control policies. If you enable this policy, you will allow your users to authenticate by using local certificates between systems that are not part of a domain that uses PKU2U. This will allow users to share resources between devices
+
 ## Related topics
-[Security Options](security-options.md)
- 
- 
+
+- [Security Options](security-options.md)

windows/keep-secure/network-security-configure-encryption-types-allowed-for-kerberos.md

@@ -2,128 +2,89 @@
 title: Network security Configure encryption types allowed for Kerberos Win7 only (Windows 10)
 description: Describes the best practices, location, values and security considerations for the Network security Configure encryption types allowed for Kerberos Win7 only security policy setting.
 ms.assetid: 303d32cc-415b-44ba-96c0-133934046ece
-ms.pagetype: security
 ms.prod: W10
 ms.mktglfcycl: deploy
 ms.sitesec: library
+ms.pagetype: security
 author: brianlic-msft
 ---
+
 # Network security: Configure encryption types allowed for Kerberos Win7 only
+
 **Applies to**
 -   Windows 10
+
 Describes the best practices, location, values and security considerations for the **Network security: Configure encryption types allowed for Kerberos Win7 only** security policy setting.
+
 ## Reference
+
 This policy setting allows you to set the encryption types that the Kerberos protocol is allowed to use. If it is not selected, the encryption type will not be allowed. This setting might affect compatibility with client computers or services and applications. Multiple selections are permitted.
+
 For more information, see [article 977321](http://support.microsoft.com/kb/977321) in the Microsoft Knowledge Base.
+
 The following table lists and explains the allowed encryption types.
-<table>
-<colgroup>
-<col width="50%" />
-<col width="50%" />
-</colgroup>
-<thead>
-<tr class="header">
-<th align="left">Encryption type</th>
-<th align="left">Description and version support</th>
-</tr>
-</thead>
-<tbody>
-<tr class="odd">
-<td align="left"><p>DES_CBC_CRC</p></td>
-<td align="left"><p>Data Encryption Standard with Cipher Block Chaining using the Cyclic Redundancy Check function</p>
-<p>Supported in Windows 2000 Server, Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008. The Windows 7 and Windows Server 2008 R2 operating systems do not support DES by default.</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>DES_CBC_MD5</p></td>
-<td align="left"><p>Data Encryption Standard with Cipher Block Chaining using the Message-Digest algorithm 5 checksum function</p>
-<p>Supported in Windows 2000 Server, Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008. The Windows 7 and Windows Server 2008 R2 operating systems do not support DES by default.</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>RC4_HMAC_MD5</p></td>
-<td align="left"><p>Rivest Cipher 4 with Hashed Message Authentication Code using the Message-Digest algorithm 5 checksum function</p>
-<p>Supported in Windows 2000 Server, Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2.</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>AES128_HMAC_SHA1</p></td>
-<td align="left"><p>Advanced Encryption Standard in 128 bit cipher block with Hashed Message Authentication Code using the Secure Hash Algorithm (1).</p>
-<p>Not supported in Windows 2000 Server, Windows XP, or Windows Server 2003. Supported in Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2.</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>AES256_HMAC_SHA1</p></td>
-<td align="left"><p>Advanced Encryption Standard in 256 bit cipher block with Hashed Message Authentication Code using the Secure Hash Algorithm (1).</p>
-<p>Not supported in Windows 2000 Server, Windows XP, or Windows Server 2003. Supported in Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2.</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Future encryption types</p></td>
-<td align="left"><p>Reserved by Microsoft for additional encryption types that might be implemented.</p></td>
-</tr>
-</tbody>
-</table>
+
+| Encryption type | Description and version support |
+| - | - |
+| DES_CBC_CRC | Data Encryption Standard with Cipher Block Chaining using the Cyclic Redundancy Check function<br/>Supported in Windows 2000 Server, Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008. The Windows 7 and Windows Server 2008 R2 operating systems do not support DES| by default. 
+| DES_CBC_MD5| Data Encryption Standard with Cipher Block Chaining using the Message-Digest algorithm 5 checksum function<br/>Supported in Windows 2000 Server, Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008. The Windows 7 and Windows Server 2008 R2 operating systems do not support DES by default. |
+| RC4_HMAC_MD5| Rivest Cipher 4 with Hashed Message Authentication Code using the Message-Digest algorithm 5 checksum function<br/>Supported in Windows 2000 Server, Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2.| 
+| AES128_HMAC_SHA1| Advanced Encryption Standard in 128 bit cipher block with Hashed Message Authentication Code using the Secure Hash Algorithm (1).<br/>Not supported in Windows 2000 Server, Windows XP, or Windows Server 2003. Supported in Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2. |
+| AES256_HMAC_SHA1| Advanced Encryption Standard in 256 bit cipher block with Hashed Message Authentication Code using the Secure Hash Algorithm (1).<br/>Not supported in Windows 2000 Server, Windows XP, or Windows Server 2003. Supported in Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2. |
+| Future encryption types| Reserved by Microsoft for additional encryption types that might be implemented.| 
  
 ### Possible values
+
+
 The encryption type options include:
+
 -   DES\_CBC\_CRC
 -   DES\_CBC\_MD5
 -   RC4\_HMAC\_MD5
 -   AES128\_HMAC\_SHA1
 -   AES256\_HMAC\_SHA1
 -   Future encryption types
+
     As of the release of Windows 7 and Windows Server 2008 R2, this is reserved by Microsoft for additional encryption types that might be implemented.
+
 ### Best practices
+
 You must analyze your environment to determine which encryption types will be supported and then select those that meet that evaluation.
+
 ### Location
+
 Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options
+
 ### Default values
-<table>
-<colgroup>
-<col width="50%" />
-<col width="50%" />
-</colgroup>
-<thead>
-<tr class="header">
-<th align="left">Server type or Group Policy Object (GPO)</th>
-<th align="left">Default value</th>
-</tr>
-</thead>
-<tbody>
-<tr class="odd">
-<td align="left"><p>Default domain policy</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Default domain controller policy</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Stand-alone server default settings</p></td>
-<td align="left"><p>Not defined</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Domain controller effective default settings</p></td>
-<td align="left"><p>None of these encryption types that are available in this policy are allowed.</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p>Member server effective default settings</p></td>
-<td align="left"><p>None of these encryption types that are available in this policy are allowed.</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>Effective GPO default settings on client computers</p></td>
-<td align="left"><p>None of these encryption types that are available in this policy are allowed.</p></td>
-</tr>
-</tbody>
-</table>
+| Server type or Group Policy Object (GPO) | Default value |
+| - | - |
+| Default domain policy| Not defined| 
+| Default domain controller policy| Not defined| 
+| Stand-alone server default settings | Not defined| 
+| Domain controller effective default settings | None of these encryption types that are available in this policy are allowed.| 
+| Member server effective default settings | None of these encryption types that are available in this policy are allowed.| 
+| Effective GPO default settings on client computers | None of these encryption types that are available in this policy are allowed.| 
  
 ## Security considerations
+
 This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation.
+
 ### Vulnerability
-Windows Server 2008 R2 and Windows 7 do not support the DES cryptographic suites because stronger ones are available. To enable Kerberos interoperability with non-Windows versions of the Kerberos protocol, these suites can be enabled. However, doing so might open attack vectors on computers running Windows Server 2008 R2 and Windows 7. You can also disable DES for your computers running Windows Vista and Windows Server 2008.
+
+Windows Server 2008 R2 and Windows 7 do not support the DES cryptographic suites because stronger ones are available. To enable Kerberos interoperability with non-Windows versions of the Kerberos protocol, these suites can be enabled. However, doing so might open attack vectors on computers running 
+Windows Server 2008 R2 and Windows 7. You can also disable DES for your computers running Windows Vista and Windows Server 2008.
+
 ### Countermeasure
+
 Do not configure this policy. This will force the computers running Windows Server 2008 R2 and Windows 7 to use the AES or RC4 cryptographic suites.
+
 ### Potential impact
+
 If you do not select any of the encryption types, computers running Windows Server 2008 R2 and Windows 7 might have Kerberos authentication failures when connecting with computers running non-Windows versions of the Kerberos protocol.
+
 If you do select any encryption type, you will lower the effectiveness of encryption for Kerberos authentication but you will improve interoperability with computers running older versions of Windows.
 Contemporary non-Windows implementations of the Kerberos protocol support RC4 and AES 128-bit and AES 256-bit encryption. Most implementations, including the MIT Kerberos protocol and the Windows Kerberos protocol, are deprecating DES encryption.
+
 ## Related topics
-[Security Options](security-options.md)
- 
- 
+
+- [Security Options](security-options.md)